[JSC] JSC should have consistent InById IC
[WebKit-https.git] / JSTests / ChangeLog
1 2018-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2
3         [JSC] JSC should have consistent InById IC
4         https://bugs.webkit.org/show_bug.cgi?id=185682
5
6         Reviewed by Filip Pizlo.
7
8         * stress/in-by-id-accessors.js: Added.
9         (shouldBe):
10         (test):
11         (protoGetter.__proto__.get hello):
12         (protoSetter.__proto__.set hello):
13         (i.shouldBe.test.get hello):
14         (i.shouldBe.test.set hello):
15         * stress/in-by-id-ai.js: Added.
16         (shouldBe):
17         (test):
18         * stress/in-by-id-custom-accessors.js: Added.
19         (shouldBe):
20         (test1):
21         (test2):
22         * stress/in-by-id-custom-values.js: Added.
23         (shouldBe):
24         (test):
25         * stress/in-by-id-operation.js: Added.
26         (shouldBe):
27         (test):
28         (selfCache):
29         * stress/in-by-id-proxy.js: Added.
30         (shouldBe):
31         (test):
32         (handler.has):
33
34 2018-05-18  Keith Miller  <keith_miller@apple.com>
35
36         op_in should mark if it sees out of bounds accesses
37         https://bugs.webkit.org/show_bug.cgi?id=185792
38
39         Reviewed by Filip Pizlo.
40
41         * stress/has-indexed-property-array-storage-ftl.js:
42         (test2):
43         * stress/has-indexed-property-slow-put-array-storage-ftl.js:
44         (test2):
45
46 2018-05-18  Mark Lam  <mark.lam@apple.com>
47
48         Add missing exception check.
49         https://bugs.webkit.org/show_bug.cgi?id=185786
50         <rdar://problem/35686560>
51
52         Reviewed by Michael Saboff.
53
54         * stress/regress-185786.js: Added.
55
56 2018-05-16  Filip Pizlo  <fpizlo@apple.com>
57
58         JSC should have InstanceOf inline caching
59         https://bugs.webkit.org/show_bug.cgi?id=185652
60
61         Reviewed by Saam Barati.
62
63         * microbenchmarks/instanceof-always-hit-one.js: Added.
64         * microbenchmarks/instanceof-always-hit-two.js: Added.
65         * microbenchmarks/instanceof-dynamic.js: Added.
66         * microbenchmarks/instanceof-sometimes-hit.js: Added.
67         * stress/instanceof-dynamic-proxy-check-structure.js: Added.
68         * stress/instanceof-dynamic-proxy-loop.js: Added.
69         * stress/instanceof-dynamic-proxy.js: Added.
70         * stress/instanceof-hit-one-object-then-another.js: Added.
71         * stress/instanceof-hit-two-objects-then-another.js: Added.
72         * stress/instanceof-prototype-change.js: Added.
73         * stress/instanceof-prototype-change-to-hit.js: Added.
74         * stress/instanceof-prototype-change-to-null.js: Added.
75         * stress/instanceof-prototype-change-watchpointable.js: Added.
76
77 2018-05-17  Michael Saboff  <msaboff@apple.com>
78
79         We don't throw SyntaxErrors for runtime generated regular expressions with errors
80         https://bugs.webkit.org/show_bug.cgi?id=185755
81
82         Reviewed by Keith Miller.
83
84         New regression test.
85
86         * stress/regexp-with-runtime-syntax-errors.js: Added.
87         (testThrowsSyntaxtError):
88         (fromExecWithBadUnicodeEscape):
89         (fromTestWithBadUnicodeProperty):
90         (fromSplitWithBadUnicodeIdentity):
91         (fromMatchWithBadUnicodeBackReference):
92         (fromReplaceWithBadUnicodeEscape):
93         (fromSearchWithBadUnicodeEscape):
94
95 2018-05-16  Caio Lima  <ticaiolima@gmail.com>
96
97         [ESNext][BigInt] Implement support for "/" operation
98         https://bugs.webkit.org/show_bug.cgi?id=183996
99
100         Reviewed by Yusuke Suzuki.
101
102         * bigIntTests.yaml:
103         * stress/big-int-div-jit.js: Added.
104         * stress/big-int-div-memory-stress.js: Added.
105         * stress/big-int-div-to-primitive-precedence.js: Added.
106         * stress/big-int-div-to-primitive.js: Added.
107         * stress/big-int-div-type-error.js: Added.
108         * stress/big-int-div-wrapped-value.js: Added.
109         * stress/big-int-division.js: Added.
110
111 2018-05-16  Saam Barati  <sbarati@apple.com>
112
113         Constant fold CheckTypeInfoFlags on ImplementsDefaultHasInstance
114         https://bugs.webkit.org/show_bug.cgi?id=185670
115
116         Reviewed by Yusuke Suzuki.
117
118         * microbenchmarks/constant-fold-check-type-info-flags.js: Added.
119         * stress/dont-constant-fold-check-type-info-on-bound-function.js: Added.
120
121 2018-05-16  Commit Queue  <commit-queue@webkit.org>
122
123         Unreviewed, rolling out r231845.
124         https://bugs.webkit.org/show_bug.cgi?id=185702
125
126         it is breaking Apple High Sierra 32-bit JSC bot (Requested by
127         caiolima on #webkit).
128
129         Reverted changeset:
130
131         "[ESNext][BigInt] Implement support for "/" operation"
132         https://bugs.webkit.org/show_bug.cgi?id=183996
133         https://trac.webkit.org/changeset/231845
134
135 2018-05-16  Filip Pizlo  <fpizlo@apple.com>
136
137         DFG models InstanceOf incorrectly
138         https://bugs.webkit.org/show_bug.cgi?id=185694
139
140         Reviewed by Keith Miller.
141
142         * stress/instanceof-proxy-check-structure.js: Added.
143         (Foo):
144         (Bar):
145         (doBadThings):
146         (getPrototypeOf):
147         (foo):
148         (i.new.Bar):
149         (new.Bar):
150         * stress/instanceof-proxy-loop.js: Added.
151         (Foo):
152         (Bar):
153         (doBadThings):
154         (getPrototypeOf):
155         (foo):
156         * stress/instanceof-proxy.js: Added.
157         (Foo):
158         (Bar):
159         (doBadThings):
160         (getPrototypeOf):
161         (foo):
162
163 2018-05-16  Caio Lima  <ticaiolima@gmail.com>
164
165         [ESNext][BigInt] Implement support for "/" operation
166         https://bugs.webkit.org/show_bug.cgi?id=183996
167
168         Reviewed by Yusuke Suzuki.
169
170         * bigIntTests.yaml:
171         * stress/big-int-div-jit.js: Added.
172         * stress/big-int-div-memory-stress.js: Added.
173         * stress/big-int-div-to-primitive-precedence.js: Added.
174         * stress/big-int-div-to-primitive.js: Added.
175         * stress/big-int-div-type-error.js: Added.
176         * stress/big-int-div-wrapped-value.js: Added.
177         * stress/big-int-division.js: Added.
178
179 2018-05-14  Leo Balter  <leonardo.balter@gmail.com>
180
181         Fix a legacy CRLF eol from Test262
182         https://bugs.webkit.org/show_bug.cgi?id=185565
183
184         Reviewed by Yusuke Suzuki.
185
186         * test262/config.yaml:
187         * test262/test/built-ins/Math/cbrt/prop-desc.js:
188
189 2018-05-14  Yusuke Suzuki  <utatane.tea@gmail.com>
190
191         [JSC] timeClip(-0) should produce +0
192         https://bugs.webkit.org/show_bug.cgi?id=185589
193
194         Reviewed by Saam Barati.
195
196         Fix several test262 failures.
197
198         * stress/date-negative-zero.js: Added.
199         (shouldBe):
200         * test262/expectations.yaml:
201
202 2018-05-13  Caio Lima  <ticaiolima@gmail.com>
203
204         [BigInt] stress/big-int-spec-to-primitive.js test is failing
205         https://bugs.webkit.org/show_bug.cgi?id=185582
206
207         Reviewed by Yusuke Suzuki.
208
209         This patch is removing the use of ```numberOfDFGCompiles``` from 
210         stress/big-int-spec-to-primitive.js because it makes this est fail
211         sometimes.
212
213         * stress/big-int-spec-to-primitive.js:
214
215 2018-05-13  Andy VanWagoner  <andy@vanwagoner.family>
216
217         [INTL] Improve spec & test262 compliance for Intl APIs
218         https://bugs.webkit.org/show_bug.cgi?id=185578
219
220         Reviewed by Yusuke Suzuki.
221
222         Remove intl402 failures that have been fixed.
223
224         * test262/expectations.yaml:
225         * stress/regress-178385.js: toStringTag is configurable, but not writable.
226
227 2018-05-11  Caio Lima  <ticaiolima@gmail.com>
228
229         [ESNext][BigInt] Implement support for "*" operation
230         https://bugs.webkit.org/show_bug.cgi?id=183721
231
232         Reviewed by Yusuke Suzuki.
233
234         * bigIntTests.yaml:
235         * stress/big-int-mul-jit.js: Added.
236         * stress/big-int-mul-to-primitive-precedence.js: Added.
237         * stress/big-int-mul-to-primitive.js: Added.
238         * stress/big-int-mul-type-error.js: Added.
239         * stress/big-int-mul-wrapped-value.js: Added.
240         * stress/big-int-multiplication.js: Added.
241         * stress/big-int-multiply-memory-stress.js: Added.
242
243 2018-05-11  Michael Saboff  <msaboff@apple.com>
244
245         [DFG] Compiler uses incorrect output register for NumberIsInteger operation
246         https://bugs.webkit.org/show_bug.cgi?id=185328
247
248         Reviewed by Keith Miller.
249
250         New regression test.
251
252         * stress/isInteger-doesnt-overwrite-argument.js: Added.
253         (testIsInteger):
254
255 2018-05-09  Yusuke Suzuki  <utatane.tea@gmail.com>
256
257         [JSC] Object.assign for final objects should be faster
258         https://bugs.webkit.org/show_bug.cgi?id=185348
259
260         Reviewed by Saam Barati.
261
262         * stress/object-assign-fast-path.js: Added.
263         (shouldBe):
264         (checkProperty):
265
266 2018-05-10  Leo Balter  <leonardo.balter@gmail.com>
267
268         Update Test262 tests through the new import script - 20180509
269         https://bugs.webkit.org/show_bug.cgi?id=185482
270
271         Reviewed by Michael Saboff.
272
273         Also update the test262/expecatations.yaml with the recent imported files.
274
275         * test262/expectations.yaml:
276         * test262/harness/compareIterator.js: Added.
277         (assert.compareIterator):
278         * test262/harness/nativeFunctionMatcher.js:
279         (const.assertToStringOrNativeFunction):
280         (const.assertNativeFunction):
281         * test262/harness/regExpUtils.js:
282         * test262/harness/testIntl.js:
283         (getInvalidLanguageTags):
284         * test262/harness/testTypedArray.js:
285         * test262/harness/wellKnownIntrinsicObjects.js: Added.
286         (WellKnownIntrinsicObjects.forEach.wkio.catch):
287         * test262/latest-changes-summary.txt: Added.
288         * test262/test/annexB/language/eval-code/direct/block-decl-nostrict.js: Copied from JSTests/test262/test/language/eval-code/direct/block-decl-strict-caller.js.
289         (catch):
290         * test262/test/annexB/language/eval-code/direct/switch-case-decl-nostrict.js: Copied from JSTests/test262/test/language/eval-code/direct/switch-case-decl-strict-source.js.
291         (catch):
292         * test262/test/annexB/language/eval-code/direct/switch-dflt-decl-nostrict.js: Copied from JSTests/test262/test/language/eval-code/direct/switch-dflt-decl-strict-caller.js.
293         (catch):
294         * test262/test/annexB/language/function-code/block-decl-nested-blocks-with-fun-decl.js: Added.
295         (g.f):
296         (g):
297         * test262/test/annexB/language/function-code/block-decl-nostrict.js: Copied from JSTests/test262/test/language/function-code/block-decl-strict.js.
298         (catch):
299         (f):
300         * test262/test/annexB/language/function-code/switch-case-decl-nostrict.js: Copied from JSTests/test262/test/language/function-code/switch-case-decl-strict.js.
301         (catch):
302         (switch.case.1):
303         (switch):
304         * test262/test/annexB/language/function-code/switch-dflt-decl-nostrict.js: Copied from JSTests/test262/test/language/function-code/switch-dflt-decl-strict.js.
305         (catch):
306         (switch.default):
307         (switch):
308         * test262/test/built-ins/Array/prototype/filter/target-array-with-non-writable-property.js: Added.
309         (a.Symbol.species):
310         (r.a.filter):
311         * test262/test/built-ins/Array/prototype/indexOf/calls-only-has-on-prototype-after-length-zeroed.js: Added.
312         (allowProxyTraps.has):
313         (fromIndex.valueOf):
314         * test262/test/built-ins/Array/prototype/lastIndexOf/calls-only-has-on-prototype-after-length-zeroed.js: Added.
315         (allowProxyTraps.has):
316         (fromIndex.valueOf):
317         * test262/test/built-ins/Array/prototype/map/target-array-with-non-writable-property.js: Added.
318         (a.Symbol.species):
319         (r.a.map):
320         * test262/test/built-ins/Array/prototype/slice/target-array-with-non-writable-property.js: Added.
321         (a.Symbol.species):
322         * test262/test/built-ins/Array/prototype/splice/property-traps-order-with-species.js: Added.
323         (a.Symbol.species):
324         * test262/test/built-ins/Array/prototype/splice/target-array-with-non-writable-property.js: Added.
325         (a.Symbol.species):
326         * test262/test/built-ins/Atomics/Symbol.toStringTag.js:
327         * test262/test/built-ins/Atomics/add/bad-range.js:
328         (testWithTypedArrayConstructors):
329         * test262/test/built-ins/Atomics/add/good-views.js:
330         (testWithTypedArrayConstructors):
331         * test262/test/built-ins/Atomics/add/non-views.js:
332         * test262/test/built-ins/Atomics/add/nonshared-int-views.js:
333         (testWithTypedArrayConstructors):
334         * test262/test/built-ins/Atomics/add/shared-nonint-views.js:
335         (testWithTypedArrayConstructors):
336         * test262/test/built-ins/Atomics/and/bad-range.js:
337         (testWithTypedArrayConstructors):
338         * test262/test/built-ins/Atomics/and/good-views.js:
339         (testWithTypedArrayConstructors):
340         * test262/test/built-ins/Atomics/and/non-views.js:
341         * test262/test/built-ins/Atomics/and/nonshared-int-views.js:
342         (testWithTypedArrayConstructors):
343         * test262/test/built-ins/Atomics/and/shared-nonint-views.js:
344         (testWithTypedArrayConstructors):
345         * test262/test/built-ins/Atomics/compareExchange/bad-range.js:
346         (testWithTypedArrayConstructors):
347         * test262/test/built-ins/Atomics/compareExchange/good-views.js:
348         (testWithTypedArrayConstructors):
349         (view): Deleted.
350         * test262/test/built-ins/Atomics/compareExchange/non-views.js:
351         * test262/test/built-ins/Atomics/compareExchange/nonshared-int-views.js:
352         (testWithTypedArrayConstructors):
353         * test262/test/built-ins/Atomics/compareExchange/shared-nonint-views.js:
354         (testWithTypedArrayConstructors):
355         * test262/test/built-ins/Atomics/exchange/bad-range.js:
356         (testWithTypedArrayConstructors):
357         * test262/test/built-ins/Atomics/exchange/good-views.js:
358         (testWithTypedArrayConstructors):
359         * test262/test/built-ins/Atomics/exchange/non-views.js:
360         * test262/test/built-ins/Atomics/exchange/nonshared-int-views.js:
361         (testWithTypedArrayConstructors):
362         * test262/test/built-ins/Atomics/exchange/shared-nonint-views.js:
363         (testWithTypedArrayConstructors):
364         * test262/test/built-ins/Atomics/isLockFree/corner-cases.js:
365         (hide):
366         * test262/test/built-ins/Atomics/isLockFree/value.js:
367         (testIsLockFree): Deleted.
368         * test262/test/built-ins/Atomics/load/bad-range.js:
369         (testWithTypedArrayConstructors):
370         * test262/test/built-ins/Atomics/load/good-views.js:
371         (testWithTypedArrayConstructors):
372         * test262/test/built-ins/Atomics/load/non-views.js:
373         * test262/test/built-ins/Atomics/load/nonshared-int-views.js:
374         (testWithTypedArrayConstructors):
375         * test262/test/built-ins/Atomics/load/shared-nonint-views.js:
376         (testWithTypedArrayConstructors):
377         * test262/test/built-ins/Atomics/or/bad-range.js:
378         (testWithTypedArrayConstructors):
379         * test262/test/built-ins/Atomics/or/good-views.js:
380         (testWithTypedArrayConstructors):
381         * test262/test/built-ins/Atomics/or/non-views.js:
382         * test262/test/built-ins/Atomics/or/nonshared-int-views.js:
383         (testWithTypedArrayConstructors):
384         * test262/test/built-ins/Atomics/or/shared-nonint-views.js:
385         (testWithTypedArrayConstructors):
386         * test262/test/built-ins/Atomics/prop-desc.js:
387         * test262/test/built-ins/Atomics/proto.js:
388         * test262/test/built-ins/Atomics/store/bad-range.js:
389         (testWithTypedArrayConstructors):
390         * test262/test/built-ins/Atomics/store/good-views.js:
391         (testWithTypedArrayConstructors):
392         (ToInteger):
393         * test262/test/built-ins/Atomics/store/non-views.js:
394         * test262/test/built-ins/Atomics/store/nonshared-int-views.js:
395         (testWithTypedArrayConstructors):
396         * test262/test/built-ins/Atomics/store/shared-nonint-views.js:
397         (testWithTypedArrayConstructors):
398         * test262/test/built-ins/Atomics/sub/bad-range.js:
399         (testWithTypedArrayConstructors):
400         * test262/test/built-ins/Atomics/sub/good-views.js:
401         (testWithTypedArrayConstructors):
402         * test262/test/built-ins/Atomics/sub/non-views.js:
403         * test262/test/built-ins/Atomics/sub/nonshared-int-views.js:
404         (testWithTypedArrayConstructors):
405         * test262/test/built-ins/Atomics/sub/shared-nonint-views.js:
406         (testWithTypedArrayConstructors):
407         * test262/test/built-ins/Atomics/wait/bad-range.js: Copied from JSTests/test262/test/built-ins/Atomics/wake/bad-range.js.
408         (testWithTypedArrayConstructors):
409         * test262/test/built-ins/Atomics/wait/cannot-suspend-throws.js:
410         * test262/test/built-ins/Atomics/wait/did-timeout.js:
411         (getReport):
412         * test262/test/built-ins/Atomics/wait/false-for-timeout-agent.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/false-for-timeout.js.
413         (getReport):
414         (262.agent.start.valueOf.valueOf):
415         (toPrimitive.Symbol.toPrimitive):
416         (262.agent.receiveBroadcast):
417         * test262/test/built-ins/Atomics/wait/false-for-timeout.js:
418         (valueOf.valueOf):
419         (toPrimitive.Symbol.toPrimitive):
420         (getReport): Deleted.
421         (262.agent.start.262.agent.receiveBroadcast): Deleted.
422         * test262/test/built-ins/Atomics/wait/good-views.js:
423         (r.getReport):
424         (getReport):
425         * test262/test/built-ins/Atomics/wait/nan-for-timeout.js:
426         (getReport):
427         * test262/test/built-ins/Atomics/wait/negative-index-throws.js:
428         * test262/test/built-ins/Atomics/wait/negative-timeout-agent.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/negative-timeout.js.
429         (getReport):
430         (262.agent.start.262.agent.receiveBroadcast):
431         * test262/test/built-ins/Atomics/wait/negative-timeout.js:
432         (262.agent.start.262.agent.receiveBroadcast): Deleted.
433         (getReport): Deleted.
434         * test262/test/built-ins/Atomics/wait/no-spurious-wakeup.js:
435         (getReport):
436         * test262/test/built-ins/Atomics/wait/non-int32-typedarray-throws.js:
437         * test262/test/built-ins/Atomics/wait/non-shared-bufferdata-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/nonshared-bufferdata-throws.js.
438         * test262/test/built-ins/Atomics/wait/not-a-typedarray-throws.js:
439         * test262/test/built-ins/Atomics/wait/not-an-object-throws.js:
440         * test262/test/built-ins/Atomics/wait/null-bufferdata-throws.js:
441         * test262/test/built-ins/Atomics/wait/null-for-timeout-agent.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/false-for-timeout.js.
442         (getReport):
443         (262.agent.start.valueOf.valueOf):
444         (toPrimitive.Symbol.toPrimitive):
445         (262.agent.receiveBroadcast):
446         * test262/test/built-ins/Atomics/wait/null-for-timeout.js:
447         (valueOf.valueOf):
448         (toPrimitive.Symbol.toPrimitive):
449         (getReport): Deleted.
450         (262.agent.start.262.agent.receiveBroadcast): Deleted.
451         * test262/test/built-ins/Atomics/wait/object-for-timeout-agent.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/false-for-timeout.js.
452         (getReport):
453         (262.agent.start.valueOf.valueOf):
454         (toString.toString):
455         (toPrimitive.Symbol.toPrimitive):
456         (262.agent.receiveBroadcast):
457         * test262/test/built-ins/Atomics/wait/object-for-timeout.js:
458         (valueOf.valueOf):
459         (toString.toString):
460         (toPrimitive.Symbol.toPrimitive):
461         (getReport): Deleted.
462         (262.agent.start.262.agent.receiveBroadcast): Deleted.
463         * test262/test/built-ins/Atomics/wait/out-of-range-index-throws.js:
464         * test262/test/built-ins/Atomics/wait/poisoned-object-for-timeout-throws-agent.js: Added.
465         (getReport):
466         (262.agent.start.poisonedValueOf.valueOf):
467         (poisonedToPrimitive.Symbol.toPrimitive):
468         (262.agent.receiveBroadcast):
469         * test262/test/built-ins/Atomics/wait/poisoned-object-for-timeout-throws.js:
470         (poisonedValueOf.valueOf):
471         (poisonedToPrimitive.Symbol.toPrimitive):
472         (getReport): Deleted.
473         (262.agent.start.262.agent.receiveBroadcast): Deleted.
474         * test262/test/built-ins/Atomics/wait/symbol-for-index-throws-agent.js: Added.
475         (getReport):
476         (262.agent.start.poisonedValueOf.valueOf):
477         (poisonedToPrimitive.Symbol.toPrimitive):
478         (262.agent.receiveBroadcast):
479         * test262/test/built-ins/Atomics/wait/symbol-for-index-throws.js:
480         (poisonedToPrimitive.Symbol.toPrimitive):
481         (poisoned.valueOf): Deleted.
482         (poisonedWithString.get valueOf): Deleted.
483         (poisonedToPrimitive.get Symbol): Deleted.
484         * test262/test/built-ins/Atomics/wait/symbol-for-timeout-throws-agent.js: Added.
485         (getReport):
486         (262.agent.start.262.agent.receiveBroadcast):
487         * test262/test/built-ins/Atomics/wait/symbol-for-timeout-throws.js:
488         (poisonedValueOf.valueOf):
489         (poisonedToPrimitive.Symbol.toPrimitive):
490         (getReport): Deleted.
491         (262.agent.start.262.agent.receiveBroadcast): Deleted.
492         * test262/test/built-ins/Atomics/wait/symbol-for-value-throws-agent.js: Added.
493         (getReport):
494         (262.agent.start.poisonedValueOf.valueOf):
495         (poisonedToPrimitive.Symbol.toPrimitive):
496         (262.agent.receiveBroadcast):
497         * test262/test/built-ins/Atomics/wait/symbol-for-value-throws.js: Added.
498         (poisonedValueOf.valueOf):
499         (poisonedToPrimitive.Symbol.toPrimitive):
500         * test262/test/built-ins/Atomics/wait/true-for-timeout-agent.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/null-for-timeout.js.
501         (getReport):
502         (262.agent.start.valueOf.valueOf):
503         (toPrimitive.Symbol.toPrimitive):
504         (262.agent.receiveBroadcast):
505         * test262/test/built-ins/Atomics/wait/true-for-timeout.js:
506         (valueOf.valueOf):
507         (toPrimitive.Symbol.toPrimitive):
508         (getReport): Deleted.
509         (262.agent.start.262.agent.receiveBroadcast): Deleted.
510         * test262/test/built-ins/Atomics/wait/undefined-for-timeout.js:
511         (getReport):
512         * test262/test/built-ins/Atomics/wait/undefined-index-defaults-to-zero.js:
513         (262.agent.start.262.agent.receiveBroadcast):
514         (getReport):
515         * test262/test/built-ins/Atomics/wait/value-not-equal.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/wait-index-value-not-equal.js.
516         (getReport):
517         (262.agent.start.262.agent.receiveBroadcast):
518         * test262/test/built-ins/Atomics/wait/wait-index-value-not-equal.js:
519         (262.agent.start.262.agent.receiveBroadcast):
520         * test262/test/built-ins/Atomics/wait/waiterlist-block-indexedposition-wake.js: Added.
521         (getReport):
522         (262.agent.start.262.agent.receiveBroadcast):
523         * test262/test/built-ins/Atomics/wait/waiterlist-order-of-operations-is-fifo.js: Added.
524         (getReport):
525         (262.agent.start.262.agent.receiveBroadcast):
526         * test262/test/built-ins/Atomics/wait/was-woken-before-timeout.js:
527         (getReport):
528         (262.agent.start.262.agent.receiveBroadcast):
529         * test262/test/built-ins/Atomics/wait/was-woken.js:
530         (getReport):
531         (262.agent.start.262.agent.receiveBroadcast):
532         * test262/test/built-ins/Atomics/wake/bad-range.js:
533         (testWithTypedArrayConstructors):
534         * test262/test/built-ins/Atomics/wake/count-boundary-cases.js: Renamed from JSTests/test262/test/built-ins/Atomics/wake/counts.js.
535         * test262/test/built-ins/Atomics/wake/count-defaults-to-infinity-missing.js: Added.
536         (getReport):
537         (262.agent.start.262.agent.receiveBroadcast):
538         * test262/test/built-ins/Atomics/wake/count-defaults-to-infinity-undefined.js: Added.
539         (getReport):
540         (262.agent.start.262.agent.receiveBroadcast):
541         * test262/test/built-ins/Atomics/wake/count-from-nans.js: Added.
542         * test262/test/built-ins/Atomics/wake/count-symbol-throws.js: Added.
543         * test262/test/built-ins/Atomics/wake/count-tointeger-throws-then-wake-throws.js: Added.
544         (poisoned.valueOf):
545         * test262/test/built-ins/Atomics/wake/good-views.js:
546         * test262/test/built-ins/Atomics/wake/negative-count.js: Renamed from JSTests/test262/test/built-ins/Atomics/wake/wake-negative.js.
547         * test262/test/built-ins/Atomics/wake/negative-index-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/negative-index-throws.js.
548         (poisoned.valueOf):
549         * test262/test/built-ins/Atomics/wake/non-int32-typedarray-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/non-int32-typedarray-throws.js.
550         (poisoned.valueOf):
551         * test262/test/built-ins/Atomics/wake/non-shared-bufferdata-throws.js: Renamed from JSTests/test262/test/built-ins/Atomics/wait/nonshared-bufferdata-throws.js.
552         (poisoned.valueOf):
553         * test262/test/built-ins/Atomics/wake/non-views.js:
554         * test262/test/built-ins/Atomics/wake/nonshared-int-views.js:
555         (testWithTypedArrayConstructors):
556         * test262/test/built-ins/Atomics/wake/not-a-typedarray-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/not-a-typedarray-throws.js.
557         (poisoned.valueOf):
558         * test262/test/built-ins/Atomics/wake/not-an-object-throws.js: Added.
559         (poisoned.valueOf):
560         * test262/test/built-ins/Atomics/wake/null-bufferdata-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/null-bufferdata-throws.js.
561         (poisoned.valueOf):
562         * test262/test/built-ins/Atomics/wake/out-of-range-index-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/out-of-range-index-throws.js.
563         (poisoned.valueOf):
564         * test262/test/built-ins/Atomics/wake/shared-nonint-views.js:
565         (testWithTypedArrayConstructors):
566         * test262/test/built-ins/Atomics/wake/symbol-for-index-throws.js: Added.
567         (poisonedValueOf.valueOf):
568         (poisonedToPrimitive.Symbol.toPrimitive):
569         * test262/test/built-ins/Atomics/wake/undefined-index-defaults-to-zero.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/undefined-index-defaults-to-zero.js.
570         (262.agent.start.262.agent.receiveBroadcast):
571         (getReport):
572         * test262/test/built-ins/Atomics/wake/wake-all-on-loc.js:
573         (262.agent.start.262.agent.receiveBroadcast):
574         (getReport):
575         (waitUntil):
576         * test262/test/built-ins/Atomics/wake/wake-all.js:
577         (262.agent.start.262.agent.receiveBroadcast):
578         (getReport):
579         (waitUntil):
580         * test262/test/built-ins/Atomics/wake/wake-in-order.js:
581         (getReport):
582         (waitUntil):
583         * test262/test/built-ins/Atomics/wake/wake-nan.js:
584         (getReport):
585         * test262/test/built-ins/Atomics/wake/wake-one.js:
586         (getReport):
587         (waitUntil):
588         * test262/test/built-ins/Atomics/wake/wake-rewake-noop.js: Added.
589         (getReport):
590         (waitUntil):
591         (262.agent.start.262.agent.receiveBroadcast):
592         * test262/test/built-ins/Atomics/wake/wake-two.js:
593         (getReport):
594         * test262/test/built-ins/Atomics/wake/wake-with-no-agents-waiting.js: Added.
595         (262.agent.start.262.agent.receiveBroadcast):
596         (waitUntil):
597         * test262/test/built-ins/Atomics/wake/wake-with-no-matching-agents-waiting.js: Added.
598         (262.agent.start.262.agent.receiveBroadcast):
599         (waitUntil):
600         * test262/test/built-ins/Atomics/wake/wake-zero.js:
601         (i.262.agent.start.262.agent.receiveBroadcast):
602         (getReport):
603         (waitUntil):
604         * test262/test/built-ins/Atomics/xor/bad-range.js:
605         (testWithTypedArrayConstructors):
606         * test262/test/built-ins/Atomics/xor/good-views.js:
607         (testWithTypedArrayConstructors):
608         * test262/test/built-ins/Atomics/xor/non-views.js:
609         * test262/test/built-ins/Atomics/xor/nonshared-int-views.js:
610         (testWithTypedArrayConstructors):
611         * test262/test/built-ins/Atomics/xor/shared-nonint-views.js:
612         (testWithTypedArrayConstructors):
613         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint-errors.js:
614         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint-toprimitive.js:
615         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint-wrapped-values.js:
616         * test262/test/built-ins/BigInt/asIntN/bits-toindex-errors.js:
617         * test262/test/built-ins/BigInt/asIntN/bits-toindex-toprimitive.js:
618         * test262/test/built-ins/BigInt/asIntN/bits-toindex-wrapped-values.js:
619         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint-errors.js:
620         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint-toprimitive.js:
621         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint-wrapped-values.js:
622         * test262/test/built-ins/BigInt/asUintN/bits-toindex-errors.js:
623         * test262/test/built-ins/BigInt/asUintN/bits-toindex-toprimitive.js:
624         * test262/test/built-ins/BigInt/asUintN/bits-toindex-wrapped-values.js:
625         * test262/test/built-ins/BigInt/constructor-empty-string.js:
626         * test262/test/built-ins/BigInt/constructor-from-binary-string.js:
627         * test262/test/built-ins/BigInt/constructor-from-decimal-string.js:
628         * test262/test/built-ins/BigInt/constructor-from-hex-string.js:
629         * test262/test/built-ins/BigInt/constructor-from-octal-string.js:
630         * test262/test/built-ins/BigInt/constructor-from-string-syntax-errors.js:
631         * test262/test/built-ins/BigInt/constructor-integer.js: Added.
632         * test262/test/built-ins/BigInt/constructor-trailing-leading-spaces.js:
633         * test262/test/built-ins/BigInt/issafeinteger-true.js: Removed.
634         * test262/test/built-ins/BigInt/out-of-bounds-integer-rangeerror.js: Removed.
635         * test262/test/built-ins/BigInt/prototype/Symbol.toStringTag.js:
636         * test262/test/built-ins/BigInt/prototype/toString/default-radix.js: Added.
637         * test262/test/built-ins/BigInt/prototype/toString/thisbigintvalue-not-valid-throws.js:
638         * test262/test/built-ins/BigInt/prototype/valueOf/cross-realm.js: Added.
639         * test262/test/built-ins/BigInt/tostring-throws.js: Copied from JSTests/test262/test/built-ins/BigInt/value-of-throws.js.
640         * test262/test/built-ins/BigInt/valueof-throws.js: Renamed from JSTests/test262/test/built-ins/BigInt/value-of-throws.js.
641         (BigInt.valueOf):
642         * test262/test/built-ins/DataView/prototype/setBigInt64/set-values-return-undefined.js:
643         (values.forEach):
644         * test262/test/built-ins/Function/prototype/bind/length-exceeds-int32.js: Added.
645         (f):
646         * test262/test/built-ins/Function/prototype/toString/anonymous-intrinsics.js: Removed.
647         * test262/test/built-ins/Function/prototype/toString/bound-function.js:
648         (assertNativeFunction):
649         (let.f): Deleted.
650         * test262/test/built-ins/Function/prototype/toString/built-in-function-object.js: Added.
651         * test262/test/built-ins/Function/prototype/toString/intrinsics.js: Removed.
652         * test262/test/built-ins/Function/prototype/toString/proxy-arrow-function.js: Added.
653         (assertNativeFunction.new.Proxy):
654         * test262/test/built-ins/Function/prototype/toString/proxy-async-function.js: Added.
655         (assertNativeFunction.new.Proxy.async):
656         * test262/test/built-ins/Function/prototype/toString/proxy-async-generator-function.js: Added.
657         (assertNativeFunction.new.Proxy.async):
658         * test262/test/built-ins/Function/prototype/toString/proxy-async-generator-method-definition.js: Added.
659         (assertNativeFunction.new.Proxy.async.method):
660         (apply):
661         * test262/test/built-ins/Function/prototype/toString/proxy-async-method-definition.js: Added.
662         (assertNativeFunction.new.Proxy.async.method):
663         (apply):
664         * test262/test/built-ins/Function/prototype/toString/proxy-bound-function.js: Added.
665         (assertNativeFunction.new.Proxy):
666         (bind):
667         * test262/test/built-ins/Function/prototype/toString/proxy-class.js: Added.
668         (assertNativeFunction):
669         * test262/test/built-ins/Function/prototype/toString/proxy-function-expression.js: Added.
670         (assertNativeFunction.new.Proxy):
671         * test262/test/built-ins/Function/prototype/toString/proxy-generator-function.js: Added.
672         (assertNativeFunction.new.Proxy):
673         * test262/test/built-ins/Function/prototype/toString/proxy-method-definition.js: Added.
674         (assertNativeFunction.new.Proxy.method):
675         (apply):
676         * test262/test/built-ins/Function/prototype/toString/proxy-non-callable-throws.js: Added.
677         * test262/test/built-ins/Function/prototype/toString/proxy.js: Removed.
678         * test262/test/built-ins/Function/prototype/toString/well-known-intrinsic-object-functions.js: Added.
679         (WellKnownIntrinsicObjects.forEach):
680         * test262/test/built-ins/JSON/prop-desc.js: Added.
681         * test262/test/built-ins/Math/acosh/nan-returns.js:
682         * test262/test/built-ins/Math/asinh/asinh-specialVals.js:
683         * test262/test/built-ins/Math/atanh/atanh-specialVals.js:
684         * test262/test/built-ins/Math/cbrt/cbrt-specialValues.js:
685         * test262/test/built-ins/Math/cbrt/prop-desc.js:
686         * test262/test/built-ins/Math/cosh/cosh-specialVals.js:
687         * test262/test/built-ins/Math/expm1/expm1-specialVals.js:
688         * test262/test/built-ins/Math/log10/Log10-specialVals.js:
689         * test262/test/built-ins/Math/log2/log2-basicTests.js:
690         * test262/test/built-ins/Math/prop-desc.js:
691         * test262/test/built-ins/Math/sign/sign-specialVals.js:
692         * test262/test/built-ins/Math/sinh/sinh-specialVals.js:
693         * test262/test/built-ins/Math/tanh/tanh-specialVals.js:
694         * test262/test/built-ins/Math/trunc/trunc-sampleTests.js:
695         * test262/test/built-ins/Math/trunc/trunc-specialVals.js:
696         * test262/test/built-ins/Object/assign/strings-and-symbol-order.js: Added.
697         * test262/test/built-ins/Object/keys/property-traps-order-with-proxied-array.js: Added.
698         (get t):
699         * test262/test/built-ins/Reflect/Reflect.js: Removed.
700         * test262/test/built-ins/Reflect/prop-desc.js: Added.
701         * test262/test/built-ins/Reflect/properties.js: Removed.
702         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/internal-regexp-lastindex-not-zero.js: Added.
703         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/isregexp-internal-regexp-is-false.js: Added.
704         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/isregexp-internal-regexp-throws.js: Added.
705         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/isregexp-this-throws.js: Added.
706         (obj.get Symbol):
707         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/length.js: Added.
708         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/name.js: Added.
709         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/prop-desc.js: Added.
710         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/regexpcreate-this-throws.js: Added.
711         (obj.toString):
712         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-get-constructor-throws.js: Added.
713         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-get-species-throws.js: Added.
714         (regexp.get Symbol):
715         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-is-not-object-throws.js: Added.
716         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-is-undefined.js: Added.
717         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-species-is-not-constructor.js: Added.
718         (callMatchAll):
719         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-species-is-null-or-undefined.js: Added.
720         (TestWithConstructor):
721         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-species-throws.js: Added.
722         (regexp.Symbol.species):
723         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor.js: Added.
724         (regexp.Symbol.species):
725         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-regexp-get-global-throws.js: Added.
726         (regexp.Symbol.species):
727         (get assert):
728         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-regexp-get-unicode-throws.js: Added.
729         (regexp.Symbol.species):
730         (get assert):
731         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/string-tostring-throws.js: Added.
732         (obj.valueOf):
733         (obj.toString):
734         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/string-tostring.js: Added.
735         (obj.toString):
736         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-get-flags-throws.js: Added.
737         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-get-flags.js: Added.
738         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-lastindex-cached.js: Added.
739         (regexp.lastIndex.valueOf):
740         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-not-object-throws.js: Added.
741         (callMatchAll):
742         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-tolength-lastindex-throws.js: Added.
743         (regexp.lastIndex.valueOf):
744         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-tostring-flags-throws.js: Added.
745         (value.valueOf):
746         (value.toString):
747         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-tostring-flags.js: Added.
748         (value.toString):
749         * test262/test/built-ins/RegExpStringIteratorPrototype/Symbol.toStringTag.js: Added.
750         * test262/test/built-ins/RegExpStringIteratorPrototype/ancestry.js: Added.
751         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-call-throws.js: Added.
752         (RegExp.prototype.exec):
753         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-get-throws.js: Added.
754         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-match-get-0-throws.js: Added.
755         (return.get string_appeared_here):
756         (RegExp.prototype.exec):
757         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-match-get-0-tostring-throws.js: Added.
758         (return.toString):
759         (RegExp.prototype.exec):
760         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-match-get-0-tostring.js: Added.
761         (execResult.get string_appeared_here):
762         (RegExp.prototype.exec):
763         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-not-callable.js: Added.
764         (TestWithRegExpExec):
765         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec.js: Added.
766         (callNextWithExecReturnValue.RegExp.prototype.exec):
767         (callNextWithExecReturnValue):
768         * test262/test/built-ins/RegExpStringIteratorPrototype/next/length.js: Added.
769         * test262/test/built-ins/RegExpStringIteratorPrototype/next/name.js: Added.
770         * test262/test/built-ins/RegExpStringIteratorPrototype/next/next-iteration-global.js: Added.
771         * test262/test/built-ins/RegExpStringIteratorPrototype/next/next-iteration.js: Added.
772         * test262/test/built-ins/RegExpStringIteratorPrototype/next/next-missing-internal-slots.js: Added.
773         * test262/test/built-ins/RegExpStringIteratorPrototype/next/prop-desc.js: Added.
774         * test262/test/built-ins/RegExpStringIteratorPrototype/next/regexp-tolength-lastindex-throws.js: Added.
775         (RegExp.prototype.exec):
776         * test262/test/built-ins/RegExpStringIteratorPrototype/next/this-is-not-object-throws.js: Added.
777         (callNext):
778         * test262/test/built-ins/String/prototype/matchAll/length.js: Added.
779         * test262/test/built-ins/String/prototype/matchAll/name.js: Added.
780         * test262/test/built-ins/String/prototype/matchAll/prop-desc.js: Added.
781         * test262/test/built-ins/String/prototype/matchAll/regexp-get-matchAll-throws.js: Added.
782         * test262/test/built-ins/String/prototype/matchAll/regexp-is-null.js: Added.
783         * test262/test/built-ins/String/prototype/matchAll/regexp-is-undefined.js: Added.
784         * test262/test/built-ins/String/prototype/matchAll/regexp-matchAll-invocation.js: Added.
785         (obj.Symbol.matchAll):
786         * test262/test/built-ins/String/prototype/matchAll/regexp-matchAll-throws.js: Added.
787         (regexp.Symbol.matchAll):
788         * test262/test/built-ins/String/prototype/matchAll/regexp-prototype-get-matchAll-throws.js: Added.
789         * test262/test/built-ins/String/prototype/matchAll/regexp-prototype-has-no-matchAll.js: Added.
790         * test262/test/built-ins/String/prototype/matchAll/regexp-prototype-matchAll-invocation.js: Added.
791         (RegExp.prototype.Symbol.matchAll):
792         * test262/test/built-ins/String/prototype/matchAll/regexp-prototype-matchAll-throws.js: Added.
793         (RegExp.prototype.Symbol.matchAll):
794         * test262/test/built-ins/String/prototype/matchAll/this-val-non-obj-coercible.js: Added.
795         * test262/test/built-ins/Symbol/matchAll/cross-realm.js: Added.
796         * test262/test/built-ins/Symbol/matchAll/prop-desc.js: Added.
797         * test262/test/harness/testTypedArray.js:
798         * test262/test/intl402/Array/prototype/toLocaleString/calls-toLocaleString-number-elements.js: Added.
799         * test262/test/intl402/Intl/getCanonicalLocales/invalid-tags.js:
800         * test262/test/intl402/Locale/constructor-newtarget-undefined.js: Added.
801         * test262/test/intl402/Locale/constructor-options-calendar-invalid.js: Added.
802         (const.invalidCalendarOption.of.invalidCalendarOptions.new.Intl.Locale):
803         * test262/test/intl402/Locale/constructor-options-calendar-valid.js: Added.
804         * test262/test/intl402/Locale/constructor-options-language-invalid.js: Added.
805         (const.invalidLanguageOption.of.invalidLanguageOptions.new.Intl.Locale):
806         * test262/test/intl402/Locale/constructor-options-language-valid.js: Added.
807         (toString):
808         * test262/test/intl402/Locale/constructor-options-region-invalid.js: Added.
809         (const.invalidRegionOption.of.invalidRegionOptions.new.Intl.Locale):
810         * test262/test/intl402/Locale/constructor-options-region-valid.js: Added.
811         * test262/test/intl402/Locale/constructor-options-script-invalid.js: Added.
812         (const.invalidScriptOption.of.invalidScriptOptions.new.Intl.Locale):
813         * test262/test/intl402/Locale/constructor-options-script-valid.js: Added.
814         (toString):
815         * test262/test/intl402/Locale/function-prototype.js: Added.
816         * test262/test/intl402/Locale/instance-extensibility.js: Added.
817         * test262/test/intl402/Locale/instance.js: Added.
818         * test262/test/intl402/Locale/invalid-tag-throws-boolean.js: Added.
819         * test262/test/intl402/Locale/invalid-tag-throws-null.js: Added.
820         * test262/test/intl402/Locale/invalid-tag-throws-number.js: Added.
821         * test262/test/intl402/Locale/invalid-tag-throws-symbol.js: Added.
822         * test262/test/intl402/Locale/invalid-tag-throws-undefined.js: Added.
823         * test262/test/intl402/Locale/invalid-tag-throws.js: Added.
824         (const.invalidTag.of.getInvalidLanguageTags):
825         * test262/test/intl402/Locale/length.js: Added.
826         * test262/test/intl402/Locale/name.js: Added.
827         * test262/test/intl402/Locale/prop-desc.js: Added.
828         * test262/test/intl402/Locale/prototype/constructor.js: Added.
829         * test262/test/intl402/Locale/prototype/maximize/length.js: Added.
830         * test262/test/intl402/Locale/prototype/maximize/name.js: Added.
831         * test262/test/intl402/Locale/prototype/maximize/prop-desc.js: Added.
832         * test262/test/intl402/Locale/prototype/prop-desc.js: Added.
833         * test262/test/intl402/Locale/prototype/toStringTag.js: Added.
834         * test262/test/intl402/TypedArray/prototype/toLocaleString/calls-toLocaleString-number-elements.js: Added.
835         (testWithTypedArrayConstructors):
836         * test262/test/language/asi/S7.9_A11_T8.js:
837         (else.x.1): Deleted.
838         * test262/test/language/asi/S7.9_A4.js:
839         (catch):
840         * test262/test/language/asi/S7.9_A5.1_T1.js:
841         * test262/test/language/asi/S7.9_A5.3_T1.js:
842         * test262/test/language/block-scope/syntax/redeclaration/function-declaration-attempt-to-redeclare-with-var-declaration-nested-in-function.js: Added.
843         (g.f):
844         (g):
845         * test262/test/language/destructuring/binding/initialization-requires-object-coercible-null.js:
846         * test262/test/language/destructuring/binding/initialization-requires-object-coercible-undefined.js:
847         * test262/test/language/destructuring/binding/initialization-returns-normal-completion-for-empty-objects.js:
848         * test262/test/language/destructuring/binding/syntax/array-elements-with-initializer.js:
849         * test262/test/language/destructuring/binding/syntax/array-elements-with-object-patterns.js:
850         * test262/test/language/destructuring/binding/syntax/array-elements-without-initializer.js:
851         * test262/test/language/destructuring/binding/syntax/array-pattern-with-elisions.js:
852         * test262/test/language/destructuring/binding/syntax/array-pattern-with-no-elements.js:
853         * test262/test/language/destructuring/binding/syntax/array-rest-elements.js:
854         * test262/test/language/destructuring/binding/syntax/object-pattern-with-no-property-list.js:
855         * test262/test/language/destructuring/binding/syntax/property-list-bindings-elements.js:
856         * test262/test/language/destructuring/binding/syntax/property-list-followed-by-a-single-comma.js:
857         * test262/test/language/destructuring/binding/syntax/property-list-single-name-bindings.js:
858         * test262/test/language/destructuring/binding/syntax/property-list-with-property-list.js:
859         * test262/test/language/destructuring/binding/syntax/recursive-array-and-object-patterns.js:
860         * test262/test/language/eval-code/direct/block-decl-eval-source-is-strict-nostrict.js: Copied from JSTests/test262/test/language/eval-code/direct/block-decl-strict-source.js.
861         * test262/test/language/eval-code/direct/block-decl-eval-source-is-strict-onlystrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/block-decl-strict-source.js.
862         (catch):
863         * test262/test/language/eval-code/direct/block-decl-onlystrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/block-decl-strict-caller.js.
864         * test262/test/language/eval-code/direct/switch-case-decl-eval-source-is-strict-nostrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/switch-case-decl-strict-source.js.
865         * test262/test/language/eval-code/direct/switch-case-decl-eval-source-is-strict-onlystrict.js: Copied from JSTests/test262/test/language/eval-code/direct/switch-case-decl-strict-caller.js.
866         (catch):
867         * test262/test/language/eval-code/direct/switch-case-decl-onlystrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/switch-case-decl-strict-caller.js.
868         * test262/test/language/eval-code/direct/switch-dflt-decl-eval-source-is-strict-nostrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/switch-dflt-decl-strict-source.js.
869         * test262/test/language/eval-code/direct/switch-dflt-decl-eval-source-is-strict-onlystrict.js: Copied from JSTests/test262/test/language/eval-code/direct/switch-dflt-decl-strict-caller.js.
870         (catch):
871         * test262/test/language/eval-code/direct/switch-dflt-decl-onlystrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/switch-dflt-decl-strict-caller.js.
872         * test262/test/language/expressions/async-arrow-function/await-as-param-ident-nested-arrow-parameter-position.js: Added.
873         (async):
874         * test262/test/language/expressions/async-arrow-function/await-as-param-nested-arrow-body-position.js: Added.
875         (async):
876         * test262/test/language/expressions/async-arrow-function/await-as-param-nested-arrow-parameter-position.js: Added.
877         (async.a):
878         * test262/test/language/expressions/async-arrow-function/await-as-param-rest-nested-arrow-parameter-position.js: Added.
879         (async.a):
880         * test262/test/language/expressions/async-arrow-function/escaped-async-line-terminator.js: Added.
881         * test262/test/language/expressions/async-generator/generator-created-after-decl-inst.js: Added.
882         (g.async.a):
883         * test262/test/language/expressions/class/class-name-ident-await-escaped-module.js: Added.
884         (C):
885         * test262/test/language/expressions/class/class-name-ident-await-escaped.js: Added.
886         (C):
887         * test262/test/language/expressions/class/class-name-ident-await-module.js: Added.
888         (C):
889         * test262/test/language/expressions/class/class-name-ident-await.js: Added.
890         (C):
891         * test262/test/language/expressions/class/class-name-ident-let-escaped.js: Added.
892         (C):
893         * test262/test/language/expressions/class/class-name-ident-let.js: Added.
894         (C):
895         * test262/test/language/expressions/class/class-name-ident-static-escaped.js: Added.
896         (C):
897         * test262/test/language/expressions/class/class-name-ident-static.js: Added.
898         * test262/test/language/expressions/class/class-name-ident-yield-escaped.js: Added.
899         (C):
900         * test262/test/language/expressions/class/class-name-ident-yield.js: Added.
901         (C):
902         * test262/test/language/expressions/class/constructor-this-tdz-during-initializers.js: Added.
903         (Base):
904         (C):
905         * test262/test/language/expressions/class/fields-run-once-on-double-super.js: Added.
906         (Base):
907         (C):
908         * test262/test/language/expressions/generators/generator-created-after-decl-inst.js: Added.
909         (g):
910         * test262/test/language/expressions/greater-than-or-equal/bigint-and-incomparable-string.js: Added.
911         * test262/test/language/expressions/greater-than-or-equal/bigint-and-string.js: Added.
912         * test262/test/language/expressions/greater-than/bigint-and-boolean.js: Added.
913         * test262/test/language/expressions/greater-than/bigint-and-incomparable-string.js: Added.
914         * test262/test/language/expressions/greater-than/bigint-and-string.js: Added.
915         * test262/test/language/expressions/less-than-or-equal/bigint-and-incomparable-string.js: Added.
916         * test262/test/language/expressions/less-than-or-equal/bigint-and-string.js: Added.
917         * test262/test/language/expressions/less-than/bigint-and-boolean.js: Added.
918         * test262/test/language/expressions/less-than/bigint-and-incomparable-string.js: Added.
919         * test262/test/language/expressions/less-than/bigint-and-string.js: Added.
920         * test262/test/language/expressions/object/method-definition/generator-super-prop-param.js:
921         * test262/test/language/function-code/block-decl-onlystrict.js: Renamed from JSTests/test262/test/language/function-code/block-decl-strict.js.
922         * test262/test/language/function-code/switch-case-decl-onlystrict.js: Renamed from JSTests/test262/test/language/function-code/switch-case-decl-strict.js.
923         * test262/test/language/function-code/switch-dflt-decl-onlystrict.js: Renamed from JSTests/test262/test/language/function-code/switch-dflt-decl-strict.js.
924         * test262/test/language/line-terminators/S7.3_A2.3.js: Removed.
925         * test262/test/language/line-terminators/S7.3_A2.4.js: Removed.
926         * test262/test/language/literals/regexp/invalid-optional-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
927         * test262/test/language/literals/regexp/invalid-optional-negative-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
928         * test262/test/language/literals/regexp/invalid-range-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
929         * test262/test/language/literals/regexp/invalid-range-negative-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
930         * test262/test/language/literals/regexp/u-invalid-optional-lookahead.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
931         * test262/test/language/literals/regexp/u-invalid-optional-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
932         * test262/test/language/literals/regexp/u-invalid-optional-negative-lookahead.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
933         * test262/test/language/literals/regexp/u-invalid-optional-negative-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
934         * test262/test/language/literals/regexp/u-invalid-range-lookahead.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
935         * test262/test/language/literals/regexp/u-invalid-range-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
936         * test262/test/language/literals/regexp/u-invalid-range-negative-lookahead.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
937         * test262/test/language/literals/regexp/u-invalid-range-negative-lookbehind.js: Renamed from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
938         * test262/test/language/literals/string/line-separator-eval.js: Added.
939         * test262/test/language/literals/string/line-separator.js: Added.
940         * test262/test/language/literals/string/paragraph-separator-eval.js: Added.
941         * test262/test/language/literals/string/paragraph-separator.js: Added.
942         * test262/test/language/module-code/early-strict-mode.js:
943         * test262/test/language/statements/async-generator/generator-created-after-decl-inst.js: Added.
944         (async.g):
945         * test262/test/language/statements/break/S12.8_A8_T1.js:
946         (catch):
947         * test262/test/language/statements/break/S12.8_A8_T2.js:
948         (catch):
949         * test262/test/language/statements/class/class-name-ident-await-escaped-module.js: Added.
950         (aw):
951         * test262/test/language/statements/class/class-name-ident-await-escaped.js: Added.
952         (aw):
953         * test262/test/language/statements/class/class-name-ident-await-module.js: Added.
954         (await):
955         * test262/test/language/statements/class/class-name-ident-await.js: Added.
956         (await):
957         * test262/test/language/statements/class/class-name-ident-let-escaped.js: Added.
958         (l):
959         * test262/test/language/statements/class/class-name-ident-let.js: Added.
960         (let):
961         * test262/test/language/statements/class/class-name-ident-static-escaped.js: Added.
962         (st):
963         * test262/test/language/statements/class/class-name-ident-static.js: Added.
964         * test262/test/language/statements/class/class-name-ident-yield-escaped.js: Added.
965         (yi):
966         * test262/test/language/statements/class/class-name-ident-yield.js: Added.
967         (yield):
968         * test262/test/language/statements/continue/S12.7_A8_T1.js:
969         (catch):
970         * test262/test/language/statements/continue/S12.7_A8_T2.js:
971         (catch):
972         * test262/test/language/statements/generators/generator-created-after-decl-inst.js: Added.
973         (g):
974         * test262/test/language/statements/try/early-catch-duplicates.js:
975         * test262/test/language/statements/try/early-catch-function.js: Added.
976         (f.catch.e):
977         (f):
978         * test262/test/language/statements/try/early-catch-lex.js:
979         * test262/test/language/statements/try/early-catch-var.js:
980         * test262/test262-Revision.txt:
981
982 2018-05-09  Caio Lima  <ticaiolima@gmail.com>
983
984         [ESNext][BigInt] Implement support for "==" operation
985         https://bugs.webkit.org/show_bug.cgi?id=184474
986
987         Reviewed by Yusuke Suzuki.
988
989         * stress/big-int-equals-basic.js: Added.
990         * stress/big-int-equals-to-primitive-precedence.js: Added.
991         * stress/big-int-equals-wrapped-value.js: Added.
992
993 2018-05-08  Valerie R Young  <valerie@bocoup.com>
994
995         test262/Runner.pm: move input files to JSTests/test262
996         https://bugs.webkit.org/show_bug.cgi?id=185389
997
998         Reviewed by Michael Saboff.
999
1000         * test262/config.yaml: Renamed from Tools/Scripts/test262/config.yaml.
1001         * test262/expectations.yaml: Renamed from Tools/Scripts/test262/expectations.yaml.
1002
1003 2018-05-05  Filip Pizlo  <fpizlo@apple.com>
1004
1005         DFG AI should have O(1) clobbering
1006         https://bugs.webkit.org/show_bug.cgi?id=185287
1007
1008         Reviewed by Saam Barati.
1009
1010         * stress/simple-ai-effect.js: Added.
1011         (bar):
1012         (foo):
1013
1014 2018-05-04  Keith Miller  <keith_miller@apple.com>
1015
1016         isCacheableArrayLength should return true for undecided arrays
1017         https://bugs.webkit.org/show_bug.cgi?id=185309
1018
1019         Reviewed by Michael Saboff.
1020
1021         * stress/get-array-length-undecided.js: Added.
1022         (test):
1023
1024 2018-05-04  Dominik Infuehr  <dinfuehr@igalia.com>
1025
1026         Disable tests on systems with limited memory
1027         https://bugs.webkit.org/show_bug.cgi?id=185296
1028
1029         Reviewed by Saam Barati.
1030
1031         Test doesn't work with a limited amount of memory. I tried to reduce memory usage
1032         but then it was hard to reproduce the failure the test was originally made to test.
1033
1034         * stress/array-reverse-doesnt-clobber.js:
1035
1036 2018-05-03  Saam Barati  <sbarati@apple.com>
1037
1038         Don't prevent CreateThis being folded to NewObject when the structure is poly proto
1039         https://bugs.webkit.org/show_bug.cgi?id=185177
1040
1041         Reviewed by Filip Pizlo.
1042
1043         * microbenchmarks/construct-poly-proto-object.js: Added.
1044         (foo.A):
1045         (foo):
1046         * stress/allocation-sinking-new-object-with-poly-proto.js: Added.
1047         (foo.A):
1048         (foo):
1049         (makePolyProto):
1050         (bar):
1051         (baz):
1052
1053 2018-05-03  Michael Saboff  <msaboff@apple.com>
1054
1055         OSR entry pruning of Program Bytecodes doesn't take into account try/catch
1056         https://bugs.webkit.org/show_bug.cgi?id=185281
1057
1058         Reviewed by Saam Barati.
1059
1060         New regression test.
1061
1062         * stress/baseline-osrentry-catch-is-reachable.js: Added.
1063         (i.j.catch):
1064
1065 2018-05-03  Ryan Haddad  <ryanhaddad@apple.com>
1066
1067         Unreviewed, rolling out r231197.
1068
1069         The test added with this change crashes on the 32-bit JSC bot.
1070
1071         Reverted changeset:
1072
1073         "Correctly detect string overflow when using the 'Function'
1074         constructor"
1075         https://bugs.webkit.org/show_bug.cgi?id=184883
1076         https://trac.webkit.org/changeset/231197
1077
1078 2018-05-02  Filip Pizlo  <fpizlo@apple.com>
1079
1080         JSC should know how to cache custom getter accesses on the prototype chain
1081         https://bugs.webkit.org/show_bug.cgi?id=185213
1082
1083         Reviewed by Keith Miller.
1084
1085         * microbenchmarks/get-custom-getter.js: Added.
1086         (test):
1087
1088 2018-05-02  Robin Morisset  <rmorisset@apple.com>
1089
1090         emitCodeToGetArgumentsArrayLength should not crash on PhantomNewArrayWithSpread
1091         https://bugs.webkit.org/show_bug.cgi?id=183172
1092
1093         Reviewed by Filip Pizlo.
1094
1095         * stress/length-of-new-array-with-spread.js: Added.
1096         (foo):
1097         (bar):
1098         (baz):
1099
1100 2018-05-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1101
1102         [JSC] Add SameValue DFG node
1103         https://bugs.webkit.org/show_bug.cgi?id=185065
1104
1105         Reviewed by Saam Barati.
1106
1107         * microbenchmarks/object-is.js: Added.
1108         (incognito):
1109         (sameValue):
1110         (test1):
1111         (test2):
1112         (test3):
1113         (test4):
1114         (test5):
1115         (test6):
1116         * stress/object-is.js: Added.
1117         (shouldBe):
1118         (is1):
1119         (is2):
1120         (is3):
1121         (is4):
1122         (is5):
1123         (is6):
1124         (is7):
1125         (is8):
1126         (is9):
1127         (is10):
1128         (is11):
1129         (is12):
1130         (is13):
1131         (is14):
1132         (is15):
1133
1134 2018-05-01  Robin Morisset  <rmorisset@apple.com>
1135
1136         Correctly detect string overflow when using the 'Function' constructor
1137         https://bugs.webkit.org/show_bug.cgi?id=184883
1138         <rdar://problem/36320331>
1139
1140         Reviewed by Filip Pizlo.
1141
1142         I put this regression test in the 'slowMicrobenchmarks' directory because it takes nearly 30s to run, and I am not sure where else to put it.
1143
1144         * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
1145         (catch):
1146
1147 2018-05-01  Robin Morisset  <rmorisset@apple.com>
1148
1149         IntlObject.cpp::removeUnicodeLocaleExtension() should not touch locales that end in '-u'
1150         https://bugs.webkit.org/show_bug.cgi?id=185162
1151
1152         Reviewed by Filip Pizlo.
1153
1154         * stress/incomplete-unicode-locale.js: Added.
1155         (catch):
1156
1157 2018-05-01  Dominik Infuehr  <dinfuehr@igalia.com>
1158
1159         Add SetCallee as DFG-Operation
1160         https://bugs.webkit.org/show_bug.cgi?id=184582
1161
1162         Reviewed by Filip Pizlo.
1163
1164         Added test that runs into infinite loop without updating the callee and
1165         therefore emitting SetCallee in DFG for recursive tail calls.
1166
1167         * stress/closure-recursive-tail-call-infinite-loop.js: Added.
1168         (Foo):
1169         (second):
1170         (first):
1171         (return.closure):
1172         (createClosure):
1173
1174 2018-04-30  Saam Barati  <sbarati@apple.com>
1175
1176         ToString constant folds without preserving checks, causing us to break assumptions that the code would OSR exit
1177         https://bugs.webkit.org/show_bug.cgi?id=185149
1178         <rdar://problem/39455917>
1179
1180         Reviewed by Filip Pizlo.
1181
1182         * stress/keep-checks-when-converting-to-lazy-js-constant-in-strength-reduction.js: Added.
1183
1184 2018-04-29  Filip Pizlo  <fpizlo@apple.com>
1185
1186         LICM shouldn't hoist nodes if hoisted nodes exited in that code block
1187         https://bugs.webkit.org/show_bug.cgi?id=185126
1188
1189         Reviewed by Saam Barati.
1190         
1191         I found this bug by accident when I was writing this test for something else.
1192         
1193         This change also speeds up other benchmarks of this case that we already had. They are all called
1194         the licm-dragons tests.
1195
1196         * microbenchmarks/licm-dragons-two-structures.js: Added.
1197         (foo):
1198
1199 2018-04-29  Commit Queue  <commit-queue@webkit.org>
1200
1201         Unreviewed, rolling out r231137.
1202         https://bugs.webkit.org/show_bug.cgi?id=185118
1203
1204         It is breaking Test262 language/expressions/multiplication
1205         /order-of-evaluation.js (Requested by caiolima on #webkit).
1206
1207         Reverted changeset:
1208
1209         "[ESNext][BigInt] Implement support for "*" operation"
1210         https://bugs.webkit.org/show_bug.cgi?id=183721
1211         https://trac.webkit.org/changeset/231137
1212
1213 2018-04-28  Saam Barati  <sbarati@apple.com>
1214
1215         We don't model regexp effects properly
1216         https://bugs.webkit.org/show_bug.cgi?id=185059
1217         <rdar://problem/39736150>
1218
1219         Reviewed by Filip Pizlo.
1220
1221         * stress/regexp-exec-test-effectful-last-index.js: Added.
1222         (assert):
1223         (foo):
1224         (i.regexLastIndex.toString):
1225         (bar):
1226
1227 2018-04-28  Rick Waldron  <waldron.rick@gmail.com>
1228
1229         Token misspelled "tocken" in error message string
1230         https://bugs.webkit.org/show_bug.cgi?id=185030
1231
1232         Reviewed by Saam Barati.
1233
1234         * ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc: Fix typo "tocken" => "token"
1235         * stress/destructuring-assignment-syntax.js: Fix typo "tocken" => "token"
1236         * stress/error-messages-for-in-operator-should-not-crash.js: Fix typo "tocken" => "token"
1237         * stress/reserved-word-with-escape.js: Fix typo "tocken" => "token"
1238         (testSyntaxError.String.raw.v):
1239         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
1240         (testSyntaxError.String.raw.a):
1241
1242 2018-04-28  Caio Lima  <ticaiolima@gmail.com>
1243
1244         [ESNext][BigInt] Implement support for "*" operation
1245         https://bugs.webkit.org/show_bug.cgi?id=183721
1246
1247         Reviewed by Saam Barati.
1248
1249         * bigIntTests.yaml:
1250         * stress/big-int-mul-jit.js: Added.
1251         * stress/big-int-mul-to-primitive-precedence.js: Added.
1252         * stress/big-int-mul-to-primitive.js: Added.
1253         * stress/big-int-mul-type-error.js: Added.
1254         * stress/big-int-mul-wrapped-value.js: Added.
1255         * stress/big-int-multiplication.js: Added.
1256         * stress/big-int-multiply-memory-stress.js: Added.
1257
1258 2018-04-28  Commit Queue  <commit-queue@webkit.org>
1259
1260         Unreviewed, rolling out r231131.
1261         https://bugs.webkit.org/show_bug.cgi?id=185112
1262
1263         It is breaking Debug build due to unchecked exception
1264         (Requested by caiolima on #webkit).
1265
1266         Reverted changeset:
1267
1268         "[ESNext][BigInt] Implement support for "*" operation"
1269         https://bugs.webkit.org/show_bug.cgi?id=183721
1270         https://trac.webkit.org/changeset/231131
1271
1272 2018-04-27  Caio Lima  <ticaiolima@gmail.com>
1273
1274         [ESNext][BigInt] Implement support for "*" operation
1275         https://bugs.webkit.org/show_bug.cgi?id=183721
1276
1277         Reviewed by Saam Barati.
1278
1279         * bigIntTests.yaml:
1280         * stress/big-int-mul-jit.js: Added.
1281         * stress/big-int-mul-to-primitive-precedence.js: Added.
1282         * stress/big-int-mul-to-primitive.js: Added.
1283         * stress/big-int-mul-type-error.js: Added.
1284         * stress/big-int-mul-wrapped-value.js: Added.
1285         * stress/big-int-multiplication.js: Added.
1286         * stress/big-int-multiply-memory-stress.js: Added.
1287
1288 2018-04-27  Ryan Haddad  <ryanhaddad@apple.com>
1289
1290         Unreviewed, rolling out r231086.
1291
1292         Caused JSC test failures due to an unchecked exception.
1293
1294         Reverted changeset:
1295
1296         "[ESNext][BigInt] Implement support for "*" operation"
1297         https://bugs.webkit.org/show_bug.cgi?id=183721
1298         https://trac.webkit.org/changeset/231086
1299
1300 2018-04-27  Ryan Haddad  <ryanhaddad@apple.com>
1301
1302         Unreviewed test gardening, update expectations for test262/intl402/PluralRules tests after r231047.
1303
1304         * test262.yaml: Mark tests as passing.
1305
1306 2018-04-26  Caio Lima  <ticaiolima@gmail.com>
1307
1308         [ESNext][BigInt] Implement support for "*" operation
1309         https://bugs.webkit.org/show_bug.cgi?id=183721
1310
1311         Reviewed by Saam Barati.
1312
1313         * bigIntTests.yaml:
1314         * stress/big-int-mul-jit.js: Added.
1315         * stress/big-int-mul-to-primitive-precedence.js: Added.
1316         * stress/big-int-mul-to-primitive.js: Added.
1317         * stress/big-int-mul-type-error.js: Added.
1318         * stress/big-int-mul-wrapped-value.js: Added.
1319         * stress/big-int-multiplication.js: Added.
1320         * stress/big-int-multiply-memory-stress.js: Added.
1321
1322 2018-04-25  Robin Morisset  <rmorisset@apple.com>
1323
1324         In FTLLowerDFGToB3.cpp::compileCreateRest, always use a contiguous array as the indexing type when under isWatchingHavingABadTimeWatchpoint
1325         https://bugs.webkit.org/show_bug.cgi?id=184773
1326         <rdar://problem/37773612>
1327
1328         Reviewed by Filip Pizlo.
1329
1330         This bug requires a race between the thread doing FTL compilation and the main thread, but it triggers in 100% of cases (before the fix) on my machine
1331         so I decided to add it to the stress tests nonetheless.
1332
1333         * stress/create-rest-while-having-a-bad-time.js: Added.
1334         (f):
1335         (g):
1336         (h):
1337
1338 2018-04-25  Keith Miller  <keith_miller@apple.com>
1339
1340         Add missing scope release to functionProtoFuncToString
1341         https://bugs.webkit.org/show_bug.cgi?id=184995
1342
1343         Reviewed by Saam Barati.
1344
1345         * stress/function-toString-arrow.js: Added.
1346         (async):
1347
1348 2018-04-24  Keith Miller  <keith_miller@apple.com>
1349
1350         fromCharCode is missing some exception checks
1351         https://bugs.webkit.org/show_bug.cgi?id=184952
1352
1353         Reviewed by Saam Barati.
1354
1355         * stress/fromCharCode-exception-check.js: Added.
1356         (get catch):
1357
1358 2018-04-24  Mark Lam  <mark.lam@apple.com>
1359
1360         Gardening: test fix after r230863.
1361         https://bugs.webkit.org/show_bug.cgi?id=184846
1362         <rdar://problem/39390672>
1363
1364         Not reviewed.
1365
1366         * stress/json-stringified-overflow-2.js:
1367         (catch):
1368         * stress/json-stringified-overflow.js:
1369         (catch):
1370
1371 2018-04-20  JF Bastien  <jfbastien@apple.com>
1372
1373         Handle more JSON stringify OOM
1374         https://bugs.webkit.org/show_bug.cgi?id=184846
1375         <rdar://problem/39390672>
1376
1377         Reviewed by Mark Lam.
1378
1379         * stress/json-stringified-overflow-2.js: Added. Same as the one
1380         below, but with a bigger input which will trigger a different code
1381         path.
1382         (catch):
1383         * stress/json-stringified-overflow.js: Modify the test to only
1384         catch OOM on stringification. not on string creation.
1385
1386 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1387
1388         [WebAssembly][Modules] Import tables in wasm modules
1389         https://bugs.webkit.org/show_bug.cgi?id=184738
1390
1391         Reviewed by JF Bastien.
1392
1393         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js:
1394         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm:
1395         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat:
1396         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js:
1397         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm:
1398         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat:
1399         * wasm/modules/wasm-imports-wasm-exports.js:
1400         * wasm/modules/wasm-imports-wasm-exports/imports.wasm:
1401         * wasm/modules/wasm-imports-wasm-exports/imports.wat:
1402         * wasm/modules/wasm-imports-wasm-exports/sum.wasm:
1403         * wasm/modules/wasm-imports-wasm-exports/sum.wat:
1404
1405 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1406
1407         [WebAssembly][Modules] Import globals from wasm modules
1408         https://bugs.webkit.org/show_bug.cgi?id=184736
1409
1410         Reviewed by JF Bastien.
1411
1412         * wasm.yaml:
1413         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js:
1414         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm:
1415         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat:
1416         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js:
1417         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm:
1418         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat:
1419         * wasm/modules/wasm-imports-wasm-exports.js:
1420         * wasm/modules/wasm-imports-wasm-exports/imports.wasm:
1421         * wasm/modules/wasm-imports-wasm-exports/imports.wat:
1422         * wasm/modules/wasm-imports-wasm-exports/sum.wasm:
1423         * wasm/modules/wasm-imports-wasm-exports/sum.wat:
1424
1425 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1426
1427         Unreviewed, reland r230697, r230720, and r230724.
1428         https://bugs.webkit.org/show_bug.cgi?id=184600
1429
1430         * wasm.yaml:
1431         * wasm/modules/constant.wasm: Added.
1432         * wasm/modules/constant.wat: Added.
1433         * wasm/modules/default-import-star-error.js: Added.
1434         (then):
1435         * wasm/modules/default-import-star-error/entry.wasm: Added.
1436         * wasm/modules/default-import-star-error/entry.wat: Added.
1437         * wasm/modules/default-import-star-error/t0.js: Added.
1438         * wasm/modules/default-import-star-error/t1.js: Added.
1439         * wasm/modules/default-import-star-error/t2.js: Added.
1440         (export.default.Cocoa):
1441         * wasm/modules/js-wasm-cycle.js: Added.
1442         * wasm/modules/js-wasm-cycle/entry.js: Added.
1443         (from.string_appeared_here.export.return42):
1444         * wasm/modules/js-wasm-cycle/sum.wasm: Added.
1445         * wasm/modules/js-wasm-cycle/sum.wat: Added.
1446         * wasm/modules/js-wasm-function-namespace.js: Added.
1447         (assert.throws):
1448         * wasm/modules/js-wasm-function.js: Added.
1449         (assert.throws):
1450         * wasm/modules/js-wasm-global-namespace.js: Added.
1451         (assert.throws):
1452         * wasm/modules/js-wasm-global.js: Added.
1453         (assert.throws):
1454         * wasm/modules/js-wasm-memory-namespace.js: Added.
1455         (assert.throws):
1456         * wasm/modules/js-wasm-memory.js: Added.
1457         (assert.throws):
1458         * wasm/modules/js-wasm-start.js: Added.
1459         (then):
1460         * wasm/modules/js-wasm-table-namespace.js: Added.
1461         (assert.throws):
1462         * wasm/modules/js-wasm-table.js: Added.
1463         (assert.throws):
1464         * wasm/modules/memory.wasm: Added.
1465         * wasm/modules/memory.wat: Added.
1466         * wasm/modules/run-from-wasm.wasm: Added.
1467         * wasm/modules/run-from-wasm.wat: Added.
1468         * wasm/modules/run-from-wasm/check.js: Added.
1469         (export.check):
1470         * wasm/modules/start.wasm: Added.
1471         * wasm/modules/start.wat: Added.
1472         * wasm/modules/sum.wasm: Added.
1473         * wasm/modules/sum.wat: Added.
1474         * wasm/modules/table.wasm: Added.
1475         * wasm/modules/table.wat: Added.
1476         * wasm/modules/wasm-imports-js-exports.js: Added.
1477         * wasm/modules/wasm-imports-js-exports/imports.wasm: Added.
1478         * wasm/modules/wasm-imports-js-exports/imports.wat: Added.
1479         * wasm/modules/wasm-imports-js-exports/sum.js: Added.
1480         (export.sum):
1481         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js: Added.
1482         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm: Added.
1483         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat: Added.
1484         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js: Added.
1485         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm: Added.
1486         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat: Added.
1487         * wasm/modules/wasm-imports-wasm-exports.js: Added.
1488         * wasm/modules/wasm-imports-wasm-exports/imports.wasm: Added.
1489         * wasm/modules/wasm-imports-wasm-exports/imports.wat: Added.
1490         * wasm/modules/wasm-imports-wasm-exports/sum.wasm: Added.
1491         * wasm/modules/wasm-imports-wasm-exports/sum.wat: Added.
1492         * wasm/modules/wasm-js-cycle.js: Added.
1493         * wasm/modules/wasm-js-cycle/entry.wasm: Added.
1494         * wasm/modules/wasm-js-cycle/entry.wat: Added.
1495         * wasm/modules/wasm-js-cycle/sum.js: Added.
1496         (from.string_appeared_here.export.sum):
1497         * wasm/modules/wasm-wasm-cycle.js: Added.
1498         * wasm/modules/wasm-wasm-cycle/entry.wasm: Added.
1499         * wasm/modules/wasm-wasm-cycle/entry.wat: Added.
1500         * wasm/modules/wasm-wasm-cycle/sum.wasm: Added.
1501         * wasm/modules/wasm-wasm-cycle/sum.wat: Added.
1502
1503 2018-04-17  Commit Queue  <commit-queue@webkit.org>
1504
1505         Unreviewed, rolling out r230697, r230720, and r230724.
1506         https://bugs.webkit.org/show_bug.cgi?id=184717
1507
1508         These caused multiple failures on the Test262 testers.
1509         (Requested by mlewis13 on #webkit).
1510
1511         Reverted changesets:
1512
1513         "[WebAssembly][Modules] Prototype wasm import"
1514         https://bugs.webkit.org/show_bug.cgi?id=184600
1515         https://trac.webkit.org/changeset/230697
1516
1517         "[WebAssembly][Modules] Implement function import from wasm
1518         modules"
1519         https://bugs.webkit.org/show_bug.cgi?id=184689
1520         https://trac.webkit.org/changeset/230720
1521
1522         "[JSC] Rename runWebAssembly to runWebAssemblySuite"
1523         https://bugs.webkit.org/show_bug.cgi?id=184703
1524         https://trac.webkit.org/changeset/230724
1525
1526 2018-04-17  JF Bastien  <jfbastien@apple.com>
1527
1528         A put is not an ExistingProperty put when we transition a structure because of an attributes change
1529         https://bugs.webkit.org/show_bug.cgi?id=184706
1530         <rdar://problem/38871451>
1531
1532         Reviewed by Saam Barati.
1533
1534         * stress/put-by-id-direct-strict-transition.js: Added.
1535         (const.foo):
1536         (j.const.obj.set hello):
1537         * stress/put-by-id-direct-transition.js: Added.
1538         (const.foo):
1539         (j.const.obj.set hello):
1540         * stress/put-getter-setter-by-id-strict-transition.js: Added.
1541         (const.foo):
1542         (j.const.obj.set hello):
1543         * stress/put-getter-setter-by-id-transition.js: Added.
1544         (const.foo):
1545         (j.const.obj.set hello):
1546
1547 2018-04-16  Filip Pizlo  <fpizlo@apple.com>
1548
1549         PutStackSinkingPhase should know that KillStack means ConflictingFlush
1550         https://bugs.webkit.org/show_bug.cgi?id=184672
1551
1552         Reviewed by Michael Saboff.
1553
1554         * stress/sink-put-stack-over-kill-stack.js: Added.
1555         (avocado_1):
1556         (apricot_0):
1557         (__c_0):
1558         (banana_2):
1559
1560 2018-04-17  Yusuke Suzuki  <utatane.tea@gmail.com>
1561
1562         [JSC] Rename runWebAssembly to runWebAssemblySuite
1563         https://bugs.webkit.org/show_bug.cgi?id=184703
1564
1565         Reviewed by JF Bastien.
1566
1567         And add runWebAssembly as a command to simplely run wasm modules.
1568
1569         * wasm.yaml:
1570
1571 2018-04-17  Yusuke Suzuki  <utatane.tea@gmail.com>
1572
1573         [WebAssembly][Modules] Implement function import from wasm modules
1574         https://bugs.webkit.org/show_bug.cgi?id=184689
1575
1576         Reviewed by JF Bastien.
1577
1578         * wasm.yaml:
1579         * wasm/modules/js-wasm-cycle.js: Added.
1580         * wasm/modules/js-wasm-cycle/entry.js: Added.
1581         (from.string_appeared_here.export.return42):
1582         * wasm/modules/js-wasm-cycle/sum.wasm: Added.
1583         * wasm/modules/js-wasm-cycle/sum.wat: Added.
1584         * wasm/modules/run-from-wasm.wasm: Added.
1585         * wasm/modules/run-from-wasm.wat: Added.
1586         * wasm/modules/run-from-wasm/check.js: Added.
1587         (export.check):
1588         * wasm/modules/wasm-imports-js-exports.js: Added.
1589         * wasm/modules/wasm-imports-js-exports/imports.wasm: Added.
1590         * wasm/modules/wasm-imports-js-exports/imports.wat: Added.
1591         * wasm/modules/wasm-imports-js-exports/sum.js: Added.
1592         (export.sum):
1593         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js: Added.
1594         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm: Added.
1595         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat: Added.
1596         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js: Added.
1597         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm: Added.
1598         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat: Added.
1599         * wasm/modules/wasm-imports-wasm-exports.js: Added.
1600         * wasm/modules/wasm-imports-wasm-exports/imports.wasm: Added.
1601         * wasm/modules/wasm-imports-wasm-exports/imports.wat: Added.
1602         * wasm/modules/wasm-imports-wasm-exports/sum.wasm: Added.
1603         * wasm/modules/wasm-imports-wasm-exports/sum.wat: Added.
1604         * wasm/modules/wasm-js-cycle.js: Added.
1605         * wasm/modules/wasm-js-cycle/entry.wasm: Added.
1606         * wasm/modules/wasm-js-cycle/entry.wat: Added.
1607         * wasm/modules/wasm-js-cycle/sum.js: Added.
1608         (from.string_appeared_here.export.sum):
1609         * wasm/modules/wasm-wasm-cycle.js: Added.
1610         * wasm/modules/wasm-wasm-cycle/entry.wasm: Added.
1611         * wasm/modules/wasm-wasm-cycle/entry.wat: Added.
1612         * wasm/modules/wasm-wasm-cycle/sum.wasm: Added.
1613         * wasm/modules/wasm-wasm-cycle/sum.wat: Added.
1614
1615 2018-04-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1616
1617         [WebAssembly][Modules] Prototype wasm import
1618         https://bugs.webkit.org/show_bug.cgi?id=184600
1619
1620         Reviewed by JF Bastien.
1621
1622         Add wasm and wat files since module loader want to load wasm files from FS.
1623         Currently, importing the other modules from wasm is not supported.
1624
1625         * wasm.yaml:
1626         * wasm/modules/constant.wasm: Added.
1627         * wasm/modules/constant.wat: Added.
1628         * wasm/modules/js-wasm-function-namespace.js: Added.
1629         (assert.throws):
1630         * wasm/modules/js-wasm-function.js: Added.
1631         (assert.throws):
1632         * wasm/modules/js-wasm-global-namespace.js: Added.
1633         (assert.throws):
1634         * wasm/modules/js-wasm-global.js: Added.
1635         (assert.throws):
1636         * wasm/modules/js-wasm-memory-namespace.js: Added.
1637         (assert.throws):
1638         * wasm/modules/js-wasm-memory.js: Added.
1639         (assert.throws):
1640         * wasm/modules/js-wasm-start.js: Added.
1641         (then):
1642         * wasm/modules/js-wasm-table-namespace.js: Added.
1643         (assert.throws):
1644         * wasm/modules/js-wasm-table.js: Added.
1645         (assert.throws):
1646         * wasm/modules/memory.wasm: Added.
1647         * wasm/modules/memory.wat: Added.
1648         * wasm/modules/start.wasm: Added.
1649         * wasm/modules/start.wat: Added.
1650         * wasm/modules/sum.wasm: Added.
1651         * wasm/modules/sum.wat: Added.
1652         * wasm/modules/table.wasm: Added.
1653         * wasm/modules/table.wat: Added.
1654
1655 2018-04-14  Filip Pizlo  <fpizlo@apple.com>
1656
1657         Function.prototype.caller shouldn't return generator bodies
1658         https://bugs.webkit.org/show_bug.cgi?id=184630
1659
1660         Reviewed by Yusuke Suzuki.
1661
1662         * stress/function-caller-async-arrow-function-body.js: Added.
1663         * stress/function-caller-async-function-body.js: Added.
1664         * stress/function-caller-async-generator-body.js: Added.
1665         * stress/function-caller-generator-body.js: Added.
1666         * stress/function-caller-generator-method-body.js: Added.
1667
1668 2018-04-12  Tomas Popela  <tpopela@redhat.com>
1669
1670         Unreviewed, skip JIT tests if it isn't enabled
1671
1672         See https://bugs.webkit.org/show_bug.cgi?id=182730.
1673
1674         * stress/big-int-spec-to-primitive.js:
1675         * stress/big-int-spec-to-this.js:
1676
1677 2018-04-10  Caio Lima  <ticaiolima@gmail.com>
1678
1679         [ESNext][BigInt] Add support for BigInt in SpeculatedType
1680         https://bugs.webkit.org/show_bug.cgi?id=182470
1681
1682         Reviewed by Saam Barati.
1683
1684         * stress/big-int-spec-to-primitive.js: Added.
1685         * stress/big-int-spec-to-this.js: Added.
1686         * stress/big-int-strict-equals-jit.js: Added.
1687         * stress/big-int-strict-spec-to-this.js: Added.
1688         * stress/big-int-type-of-proven-type.js: Added.
1689
1690 2018-04-10  Filip Pizlo  <fpizlo@apple.com>
1691
1692         DFG AI and clobberize should agree with each other
1693         https://bugs.webkit.org/show_bug.cgi?id=184440
1694
1695         Reviewed by Saam Barati.
1696         
1697         Add tests for all of the bugs I fixed.
1698
1699         * stress/direct-arguments-out-of-bounds-change-structure.js: Added.
1700         (foo):
1701         * stress/new-typed-array-cse-effects.js: Added.
1702         (foo):
1703         * stress/scoped-arguments-out-of-bounds-change-structure.js: Added.
1704         (foo.theO):
1705         (foo):
1706         * stress/string-from-char-code-change-structure-not-dead.js: Added.
1707         (foo):
1708         (i.valueOf):
1709         (weirdValue.valueOf):
1710         * stress/string-from-char-code-change-structure.js: Added.
1711         (foo):
1712         (i.valueOf):
1713         (weirdValue.valueOf):
1714
1715 2018-04-09  Leo Balter  <leonardo.balter@gmail.com>
1716
1717         Fix errant Test262 files CRLF to LF for consistency with the original source
1718         https://bugs.webkit.org/show_bug.cgi?id=184425
1719
1720         Reviewed by Yusuke Suzuki.
1721
1722         * test262/test/built-ins/Math/acosh/nan-returns.js:
1723         * test262/test/built-ins/Math/asinh/asinh-specialVals.js:
1724         * test262/test/built-ins/Math/atanh/atanh-specialVals.js:
1725         * test262/test/built-ins/Math/cbrt/cbrt-specialValues.js:
1726         * test262/test/built-ins/Math/cbrt/prop-desc.js:
1727         * test262/test/built-ins/Math/cosh/cosh-specialVals.js:
1728         * test262/test/built-ins/Math/expm1/expm1-specialVals.js:
1729         * test262/test/built-ins/Math/log10/Log10-specialVals.js:
1730         * test262/test/built-ins/Math/log2/log2-basicTests.js:
1731         * test262/test/built-ins/Math/sign/sign-specialVals.js:
1732         * test262/test/built-ins/Math/sinh/sinh-specialVals.js:
1733         * test262/test/built-ins/Math/tanh/tanh-specialVals.js:
1734         * test262/test/built-ins/Math/trunc/trunc-sampleTests.js:
1735         * test262/test/built-ins/Math/trunc/trunc-specialVals.js:
1736
1737 2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1738
1739         Unreviewed, remove incorrect entry in test262.yaml
1740         https://bugs.webkit.org/show_bug.cgi?id=184266
1741
1742         * test262.yaml:
1743
1744 2018-04-08  Valerie Young  <valerie@bocoup.com>
1745
1746         [JSC] Update Test262 to April 6 version
1747         https://bugs.webkit.org/show_bug.cgi?id=184266
1748
1749         Rubber stamped by Yusuke Suzuki.
1750
1751 2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1752
1753         [JSC] Introduce op_get_by_id_direct
1754         https://bugs.webkit.org/show_bug.cgi?id=183970
1755
1756         Reviewed by Filip Pizlo.
1757
1758         * stress/generator-prototype-copy.js: Added.
1759         (gen):
1760         (catch):
1761         Adopted JF's tests.
1762
1763         * stress/generator-type-check.js: Added.
1764         (shouldThrow):
1765         (foo2):
1766         (i.shouldThrow):
1767         * stress/get-by-id-direct-getter.js: Added.
1768         (shouldBe):
1769         (shouldThrow):
1770         (obj.get hello):
1771         (builtin.createBuiltin):
1772         (obj2.get length):
1773         * stress/get-by-id-direct.js: Added.
1774         (shouldBe):
1775         (shouldThrow):
1776         (builtin.createBuiltin):
1777         * test262.yaml:
1778         We fixed long-standing spec compatibility issue.
1779         As a result, this patch makes several test262 tests passed!
1780
1781
1782 2018-04-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1783
1784         Unreviewed, annotate test with @skip if $memoryLimited
1785         https://bugs.webkit.org/show_bug.cgi?id=183894
1786
1787         * stress/json-stringified-overflow.js:
1788
1789 2018-04-06  Alexey Proskuryakov  <ap@apple.com>
1790
1791         Add svn:eol-style to line-terminator-normalisation-CR.js
1792         https://bugs.webkit.org/show_bug.cgi?id=184341
1793
1794         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js: Added property svn:eol-style.
1795
1796 2018-04-06  Ross Kirsling  <ross.kirsling@sony.com>
1797
1798         Unreviewed, remove errant LF from existing test262 test for CR line endings.
1799
1800         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
1801
1802 2018-04-05  Ross Kirsling  <ross.kirsling@sony.com>
1803
1804         Unreviewed, rolling out r230320.
1805
1806         Revert fix, as the root cause lies elsewhere.
1807
1808         Reverted changeset:
1809
1810         "[test262] Mark line-terminator-normalisation-CR.js as a
1811         binary file."
1812         https://bugs.webkit.org/show_bug.cgi?id=184341
1813         https://trac.webkit.org/changeset/230320
1814
1815 2018-04-05  Ross Kirsling  <ross.kirsling@sony.com>
1816
1817         [test262] Mark line-terminator-normalisation-CR.js as a binary file.
1818         https://bugs.webkit.org/show_bug.cgi?id=184341
1819
1820         Reviewed by Yusuke Suzuki.
1821
1822         This test is all about CR line endings, but `svn-apply` can't deal with them.
1823         Treating the file as binary ensures that its contents never are never shown in a diff.
1824
1825         * .gitattributes: Added.
1826
1827 2018-04-05  Robin Morisset  <rmorisset@apple.com>
1828
1829         Fix testcase (missing try/catch).
1830         https://bugs.webkit.org/show_bug.cgi?id=183657
1831
1832         Unreviewed.
1833
1834         * stress/large-unshift-splice.js
1835
1836 2018-04-04  Filip Pizlo  <fpizlo@apple.com>
1837
1838         REGRESSION(r222563): removed DoubleReal type check causes tons of crashes because CSE has never known how to handle SaneChain
1839         https://bugs.webkit.org/show_bug.cgi?id=184319
1840
1841         Reviewed by Saam Barati.
1842
1843         * stress/array-push-nan-to-double-array-cse-sane-and-insane-chain.js: Added.
1844         (foo):
1845         (bar):
1846         * stress/array-push-nan-to-double-array.js: Added.
1847         (foo):
1848         (bar):
1849
1850 2018-04-03  Mark Lam  <mark.lam@apple.com>
1851
1852         Test js-fixed-array-out-of-memory.js should be excluded for memory limited devices.
1853         https://bugs.webkit.org/show_bug.cgi?id=184284
1854
1855         Reviewed by Saam Barati.
1856
1857         * stress/js-fixed-array-out-of-memory.js:
1858
1859 2018-03-31  Filip Pizlo  <fpizlo@apple.com>
1860
1861         JSC crash in JIT code with for-of loop and Array/Set iterators
1862         https://bugs.webkit.org/show_bug.cgi?id=183174
1863
1864         Reviewed by Saam Barati.
1865
1866         * microbenchmarks/hoist-get-by-offset-tower-with-inferred-types.js: Added. This test shows that fixing the bug didn't break hoisting of GetByOffset with inferred types. I confirmed that if I did break it, this test slows down by >7x.
1867         (foo):
1868         * stress/hoist-get-by-offset-with-control-dependent-inferred-type.js: Added. This test shows that the bug is fixed.
1869         (f):
1870
1871 2018-03-30  JF Bastien  <jfbastien@apple.com>
1872
1873         WebAssembly: support DataView compilation
1874         https://bugs.webkit.org/show_bug.cgi?id=183342
1875
1876         Reviewed by Mark Lam.
1877
1878         Test WebAssembly compilation using a DataView with offset.
1879
1880         * wasm/regress/183342.js: Added.
1881         (attempt.catch):
1882
1883 2018-03-30  Filip Pizlo  <fpizlo@apple.com>
1884
1885         Bytecode generator should not get_from_scope something that may be a hole into a variable that is already live
1886         https://bugs.webkit.org/show_bug.cgi?id=184189
1887
1888         Reviewed by JF Bastien.
1889
1890         * stress/load-hole-from-scope-into-live-var.js: Added.
1891         (result.eval.try.switch):
1892         (catch):
1893
1894 2018-03-30  Ryan Haddad  <ryanhaddad@apple.com>
1895
1896         Unreviewed, rolling out r230102.
1897
1898         Caused assertion failures on JSC bots.
1899
1900         Reverted changeset:
1901
1902         "A stack overflow in the parsing of a builtin (called by
1903         createExecutable) cause a crash instead of a catchable js
1904         exception"
1905         https://bugs.webkit.org/show_bug.cgi?id=184074
1906         https://trac.webkit.org/changeset/230102
1907
1908 2018-03-30  Robin Morisset  <rmorisset@apple.com>
1909
1910         Inlining of a function that ends in op_unreachable in a non-tail position triggers an ASSERT
1911         https://bugs.webkit.org/show_bug.cgi?id=183812
1912
1913         Reviewed by Keith Miller.
1914
1915         * stress/inlining-unreachable-non-tail.js: Added.
1916         (foo.):
1917         (foo):
1918
1919 2018-03-30  Robin Morisset  <rmorisset@apple.com>
1920
1921         A stack overflow in the parsing of a builtin (called by createExecutable) cause a crash instead of a catchable js exception
1922         https://bugs.webkit.org/show_bug.cgi?id=184074
1923         <rdar://problem/37165897>
1924
1925         Reviewed by Keith Miller.
1926
1927         * stress/stack-overflow-while-parsing-builtin.js: Added.
1928         (f):
1929
1930 2018-03-30  Robin Morisset  <rmorisset@apple.com>
1931
1932         Out-of-bounds accesses due to a missing check for MAX_STORAGE_VECTOR_LENGTH in unshiftCountForAnyIndexingType
1933         https://bugs.webkit.org/show_bug.cgi?id=183657
1934
1935         Reviewed by Keith Miller.
1936
1937         * stress/large-unshift-splice.js: Added.
1938         (make_contig_arr):
1939
1940 2018-03-28  Robin Morisset  <rmorisset@apple.com>
1941
1942         appendQuotedJSONString stops on arithmetic overflow instead of propagating it upwards
1943         https://bugs.webkit.org/show_bug.cgi?id=183894
1944
1945         Reviewed by Saam Barati.
1946
1947         * stress/json-stringified-overflow.js: Added.
1948         (catch):
1949
1950 2018-03-26  Filip Pizlo  <fpizlo@apple.com>
1951
1952         DFG should know that CreateThis can be effectful
1953         https://bugs.webkit.org/show_bug.cgi?id=184013
1954
1955         Reviewed by Saam Barati.
1956
1957         * stress/create-this-property-change.js: Added.
1958         (Foo):
1959         (RealBar):
1960         (get if):
1961         * stress/create-this-structure-change-without-cse.js: Added.
1962         (Foo):
1963         (RealBar):
1964         (get if):
1965         * stress/create-this-structure-change.js: Added.
1966         (Foo):
1967         (RealBar):
1968         (get if):
1969
1970 2018-03-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1971
1972         [DFG] Introduces fused compare and jump
1973         https://bugs.webkit.org/show_bug.cgi?id=177100
1974
1975         Reviewed by Mark Lam.
1976
1977         * stress/fused-jeq-slow.js: Added.
1978         (shouldBe):
1979         (testJEQ):
1980         (testJNEQB):
1981         (testJEQB):
1982         (testJNEQF):
1983         (testJEQF):
1984         * stress/fused-jeq.js: Added.
1985         (shouldBe):
1986         (testJEQ):
1987         (testJNEQB):
1988         (testJEQB):
1989         (testJNEQF):
1990         (testJEQF):
1991         * stress/fused-jstricteq-slow.js: Added.
1992         (shouldBe):
1993         (testJSTRICTEQ):
1994         (testJNSTRICTEQB):
1995         (testJSTRICTEQB):
1996         (testJNSTRICTEQF):
1997         (testJSTRICTEQF):
1998         * stress/fused-jstricteq.js: Added.
1999         (shouldBe):
2000         (testJSTRICTEQ):
2001         (testJNSTRICTEQB):
2002         (testJSTRICTEQB):
2003         (testJNSTRICTEQF):
2004         (testJSTRICTEQF):
2005
2006 2018-03-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2007
2008         [JSC] Clear MustGenerate for ToString(Number) converted from NumberToStringWithRadix
2009         https://bugs.webkit.org/show_bug.cgi?id=183559
2010
2011         Reviewed by Mark Lam.
2012
2013         * stress/double-to-string-in-loop-removed.js: Added.
2014         (test):
2015         * stress/int32-to-string-in-loop-removed.js: Added.
2016         (test):
2017         * stress/int52-to-string-in-loop-removed.js: Added.
2018         (test):
2019
2020 2018-03-22  Michael Saboff  <msaboff@apple.com>
2021
2022         Race Condition in arrayProtoFuncReverse() causes wrong results or crash
2023         https://bugs.webkit.org/show_bug.cgi?id=183901
2024
2025         Reviewed by Keith Miller.
2026
2027         New test.
2028
2029         * stress/array-reverse-doesnt-clobber.js: Added.
2030         (testArrayReverse):
2031         (createArrayOfArrays):
2032         (createArrayStorage):
2033
2034 2018-03-21  Filip Pizlo  <fpizlo@apple.com>
2035
2036         ScopedArguments should do poisoning and index masking
2037         https://bugs.webkit.org/show_bug.cgi?id=183863
2038
2039         Reviewed by Mark Lam.
2040         
2041         Adds another stress test of scoped arguments.
2042
2043         * stress/scoped-arguments-test.js: Added.
2044         (foo):
2045
2046 2018-03-20  Saam Barati  <sbarati@apple.com>
2047
2048         We need to do proper bookkeeping of exitOK when inserting constants when sinking NewArrayBuffer
2049         https://bugs.webkit.org/show_bug.cgi?id=183795
2050         <rdar://problem/38298694>
2051
2052         Reviewed by JF Bastien.
2053
2054         * stress/sink-phantom-new-array-buffer-exit-ok.js: Added.
2055         (foo):
2056         (bar):
2057
2058 2018-03-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2059
2060         [DFG][FTL] Add vectorLengthHint for NewArray
2061         https://bugs.webkit.org/show_bug.cgi?id=183694
2062
2063         Reviewed by Saam Barati.
2064
2065         * stress/vector-length-hint-array-constructor.js: Added.
2066         (shouldBe):
2067         (test):
2068         * stress/vector-length-hint-new-array.js: Added.
2069         (shouldBe):
2070         (test):
2071
2072 2018-03-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2073
2074         [DFG][FTL] Make ArraySlice(0) code tight
2075         https://bugs.webkit.org/show_bug.cgi?id=183590
2076
2077         Reviewed by Saam Barati.
2078
2079         * stress/array-slice-with-zero.js: Added.
2080         (shouldBe):
2081         (test):
2082         (test2):
2083         * stress/array-slice-zero-args.js: Added.
2084         (shouldBe):
2085         (test):
2086
2087 2018-03-14  Caitlin Potter  <caitp@igalia.com>
2088
2089         [JSC] fix order of evaluation for ClassDefinitionEvaluation
2090         https://bugs.webkit.org/show_bug.cgi?id=183523
2091
2092         Reviewed by Keith Miller.
2093
2094         Computed property names need to be evaluated in source order during class
2095         definition evaluation, as it's observable (and specified to work this way).
2096
2097         This change improves compatibility with Chromium.
2098
2099         * stress/class_elements.js: Added.
2100         (test):
2101         (test.C.prototype.effect):
2102         (test.C.effect):
2103         (test.C.prototype.get effect):
2104         (test.C.prototype.set effect):
2105         (test.C):
2106
2107 2018-03-11  Yusuke Suzuki  <utatane.tea@gmail.com>
2108
2109         [DFG] AI should convert CreateThis to NewObject if the prototype object is proved
2110         https://bugs.webkit.org/show_bug.cgi?id=183310
2111
2112         Reviewed by Filip Pizlo.
2113
2114         * stress/ai-create-this-to-new-object-fire.js: Added.
2115         (assert):
2116         (test):
2117         (func):
2118         (check):
2119         (test.body.A):
2120         (test.body.B):
2121         (test.body):
2122         * stress/ai-create-this-to-new-object.js: Added.
2123         (assert):
2124         (test):
2125         (func):
2126         (check):
2127         (test.body.A):
2128         (test.body.B):
2129         (test.body):
2130
2131 2018-03-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2132
2133         [FTL] Drop NewRegexp for String.prototype.match with RegExp + global flag
2134         https://bugs.webkit.org/show_bug.cgi?id=181848
2135
2136         Reviewed by Sam Weinig.
2137
2138         * microbenchmarks/regexp-u-global-es5.js: Added.
2139         (fn):
2140         * microbenchmarks/regexp-u-global-es6.js: Added.
2141         (fn):
2142         * stress/materialized-regexp-has-correct-last-index-set-by-match-at-osr-exit.js: Added.
2143         (shouldBe):
2144         (test):
2145         (i.switch):
2146         * stress/materialized-regexp-has-correct-last-index-set-by-match.js: Added.
2147         (shouldBe):
2148         (test):
2149
2150 2018-03-07  Dominik Infuehr  <dinfuehr@igalia.com>
2151
2152         Disable test stress/var-injection-cache-invalidation.js on systems with limited memory
2153         https://bugs.webkit.org/show_bug.cgi?id=183334
2154
2155         Reviewed by Žan Doberšek.
2156
2157         * stress/var-injection-cache-invalidation.js:
2158
2159 2018-03-06  Dominik Infuehr  <dinfuehr@igalia.com>
2160
2161         [ARM] Disable tests that run out of memory
2162         https://bugs.webkit.org/show_bug.cgi?id=182699
2163
2164         Reviewed by Žan Doberšek.
2165
2166         Skip tests that run of of memory. Do not run
2167         modules/module-jit-reachability.js without LLInt to prevent
2168         running out of executable memory.
2169
2170         * modules.yaml:
2171         * modules/module-jit-reachability.js:
2172         * stress/has-own-property-name-cache-string-keys.js:
2173         * stress/has-own-property-name-cache-symbol-keys.js:
2174
2175 2018-03-01  Yusuke Suzuki  <utatane.tea@gmail.com>
2176
2177         ASSERTION FAILED: matchContextualKeyword(m_vm->propertyNames->async)
2178         https://bugs.webkit.org/show_bug.cgi?id=183173
2179
2180         Reviewed by Saam Barati.
2181
2182         * stress/async-arrow-function-in-class-heritage.js: Added.
2183         (testSyntax):
2184         (testSyntaxError):
2185         (SyntaxError):
2186
2187 2018-03-01  Saam Barati  <sbarati@apple.com>
2188
2189         We need to clear cached structures when having a bad time
2190         https://bugs.webkit.org/show_bug.cgi?id=183256
2191         <rdar://problem/36245022>
2192
2193         Reviewed by Mark Lam.
2194
2195         * stress/having-a-bad-time-with-derived-arrays.js: Added.
2196         (assert):
2197         (defineSetter):
2198         (iterate):
2199         (doSlice):
2200
2201 2018-02-28  Yusuke Suzuki  <utatane.tea@gmail.com>
2202
2203         JSC crash with `import("")`
2204         https://bugs.webkit.org/show_bug.cgi?id=183175
2205
2206         Reviewed by Saam Barati.
2207
2208         * stress/import-with-empty-string.js: Added.
2209
2210 2018-02-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2211
2212         Unreviewed, skip FTL tests if FTL is disabled
2213         https://bugs.webkit.org/show_bug.cgi?id=183071
2214
2215         * stress/has-indexed-property-array-storage-ftl.js:
2216         * stress/has-indexed-property-slow-put-array-storage-ftl.js:
2217
2218 2018-02-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2219
2220         [FTL] Support PutByVal(ArrayStorage/SlowPutArrayStorage)
2221         https://bugs.webkit.org/show_bug.cgi?id=182965
2222
2223         Reviewed by Saam Barati.
2224
2225         * stress/put-by-val-array-storage.js: Added.
2226         (shouldBe):
2227         (testArrayStorageInBounds):
2228         * stress/put-by-val-direct-out-of-bounds-setter.js: Added.
2229         (shouldBe):
2230         (testInt32.createBuiltin):
2231         (set for):
2232         * stress/put-by-val-slow-put-array-storage.js: Added.
2233         (shouldBe):
2234         (testArrayStorageInBounds):
2235
2236 2018-02-26  Saam Barati  <sbarati@apple.com>
2237
2238         validateStackAccess should not validate if the offset is within the stack bounds
2239         https://bugs.webkit.org/show_bug.cgi?id=183067
2240         <rdar://problem/37749988>
2241
2242         Reviewed by Mark Lam.
2243
2244         * stress/dont-validate-stack-offset-in-b3-because-it-might-be-guarded-by-control-flow.js: Added.
2245         (assert):
2246         (test.a):
2247         (test.b):
2248         (test):
2249
2250 2018-02-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2251
2252         Unreviewed, skip FTL tests if FTL is disabled
2253         https://bugs.webkit.org/show_bug.cgi?id=183071
2254
2255         * stress/has-indexed-property-array-storage-ftl.js:
2256         * stress/has-indexed-property-slow-put-array-storage-ftl.js:
2257
2258 2018-02-23  Saam Barati  <sbarati@apple.com>
2259
2260         Make Number.isInteger an intrinsic
2261         https://bugs.webkit.org/show_bug.cgi?id=183088
2262
2263         Reviewed by JF Bastien.
2264
2265         * stress/number-is-integer-intrinsic.js: Added.
2266
2267 2018-02-23  Oleksandr Skachkov  <gskachkov@gmail.com>
2268
2269         WebAssembly: cache memory address / size on instance
2270         https://bugs.webkit.org/show_bug.cgi?id=177305
2271
2272         Reviewed by JF Bastien.
2273
2274         * wasm/function-tests/memory-reuse.js: Added.
2275         (createWasmInstance):
2276         (doCheckTrap):
2277         (doMemoryGrow):
2278         (doCheck):
2279         (checkWasmInstancesWithSharedMemory):
2280
2281 2018-02-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2282
2283         [JSC] Implement $vm.ftlTrue function for FTL testing
2284         https://bugs.webkit.org/show_bug.cgi?id=183071
2285
2286         Reviewed by Mark Lam.
2287
2288         * stress/dead-fiat-value-to-int52-then-exit-not-double.js:
2289         (foo):
2290         * stress/dead-fiat-value-to-int52-then-exit-not-int52.js:
2291         (foo):
2292         * stress/dead-fiat-value-to-int52.js:
2293         (foo):
2294         * stress/dead-osr-entry-value.js:
2295         (foo):
2296         * stress/fiat-value-to-int52-then-exit-not-double.js:
2297         (foo):
2298         * stress/fiat-value-to-int52-then-exit-not-int52.js:
2299         (foo):
2300         * stress/fiat-value-to-int52-then-fail-to-fold.js:
2301         (foo):
2302         * stress/fiat-value-to-int52-then-fold.js:
2303         (foo):
2304         * stress/fiat-value-to-int52.js:
2305         (foo):
2306         * stress/fold-based-on-int32-proof-mul-branch.js:
2307         (foo):
2308         * stress/fold-profiled-call-to-call.js:
2309         (foo):
2310         * stress/fold-to-double-constant-then-exit.js:
2311         (foo):
2312         * stress/fold-to-int52-constant-then-exit.js:
2313         (foo):
2314         * stress/fold-to-primitive-in-cfa.js:
2315         (foo):
2316         * stress/fold-to-primitive-to-identity-in-cfa.js:
2317         (foo):
2318         * stress/has-indexed-property-array-storage-ftl.js: Added.
2319         (shouldBe):
2320         (test1):
2321         (test2):
2322         * stress/has-indexed-property-slow-put-array-storage-ftl.js: Added.
2323         (shouldBe):
2324         (test1):
2325         (test2):
2326         * stress/int52-ai-add-then-filter-int32.js:
2327         (foo):
2328         * stress/int52-ai-mul-and-clean-neg-zero-then-filter-int32.js:
2329         (foo):
2330         * stress/int52-ai-mul-then-filter-int32.js:
2331         (foo):
2332         * stress/int52-ai-neg-then-filter-int32.js:
2333         (foo):
2334         * stress/int52-ai-sub-then-filter-int32.js:
2335         (foo):
2336         * stress/licm-pre-header-cannot-exit-nested.js:
2337         (foo):
2338         * stress/licm-pre-header-cannot-exit.js:
2339         (foo):
2340         * stress/sparse-array-entry-update-144067.js:
2341         (useMemoryToTriggerGCs):
2342         * stress/test-spec-misc.js:
2343         (foo):
2344         * stress/tricky-array-bounds-checks.js:
2345         (foo):
2346
2347 2018-02-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2348
2349         [FTL] Support HasIndexedProperty for ArrayStorage and SlowPutArrayStorage
2350         https://bugs.webkit.org/show_bug.cgi?id=182792
2351
2352         Reviewed by Mark Lam.
2353
2354         * stress/has-indexed-property-array-storage.js: Added.
2355         (shouldBe):
2356         (test1):
2357         (test2):
2358         * stress/has-indexed-property-slow-put-array-storage.js: Added.
2359         (shouldBe):
2360         (test1):
2361         (test2):
2362
2363 2018-02-20  Saam Barati  <sbarati@apple.com>
2364
2365         DFG::VarargsForwardingPhase should eliminate getting argument length
2366         https://bugs.webkit.org/show_bug.cgi?id=182959
2367
2368         Reviewed by Keith Miller.
2369
2370         * microbenchmarks/forward-arguments-dont-escape-on-arguments-length.js: Added.
2371
2372 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2373
2374         [FTL] Support ArrayPush for ArrayStorage
2375         https://bugs.webkit.org/show_bug.cgi?id=182782
2376
2377         Reviewed by Saam Barati.
2378
2379         Existing array-push-multiple-storage.js covers ArrayPush(ArrayStorage) multiple arguments case.
2380
2381         * stress/array-push-array-storage-beyond-int32.js: Added.
2382         (shouldBe):
2383         (test):
2384         * stress/array-push-array-storage.js: Added.
2385         (shouldBe):
2386         (test):
2387         * stress/array-push-multiple-array-storage-beyond-int32.js: Added.
2388         (shouldBe):
2389         (test):
2390         * stress/array-push-multiple-storage-continuous.js: Added.
2391         (shouldBe):
2392         (test):
2393
2394 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2395
2396         [FTL] Support ArrayPop for ArrayStorage
2397         https://bugs.webkit.org/show_bug.cgi?id=182783
2398
2399         Reviewed by Saam Barati.
2400
2401         * stress/array-pop-array-storage.js: Added.
2402         (shouldBe):
2403         (test):
2404
2405 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2406
2407         [FTL] Add Arrayify for ArrayStorage and SlowPutArrayStorage
2408         https://bugs.webkit.org/show_bug.cgi?id=182731
2409
2410         Reviewed by Saam Barati.
2411
2412         * stress/arrayify-array-storage-array.js: Added.
2413         (shouldBe):
2414         (testArrayStorage):
2415         * stress/arrayify-array-storage-non-array.js: Added.
2416         (shouldBe):
2417         (testArrayStorage):
2418         * stress/arrayify-array-storage.js: Added.
2419         (shouldBe):
2420         (testArrayStorage):
2421         * stress/arrayify-slow-put-array-storage-pass-array-storage.js: Added.
2422         (shouldBe):
2423         (testArrayStorage):
2424         * stress/arrayify-slow-put-array-storage.js: Added.
2425         (shouldBe):
2426         (testArrayStorage):
2427
2428 2018-02-19  Saam Barati  <sbarati@apple.com>
2429
2430         Don't use JSFunction's allocation profile when getting the prototype can be effectful
2431         https://bugs.webkit.org/show_bug.cgi?id=182942
2432         <rdar://problem/37584764>
2433
2434         Reviewed by Mark Lam.
2435
2436         * stress/get-prototype-create-this-effectful.js: Added.
2437
2438 2018-02-16  Saam Barati  <sbarati@apple.com>
2439
2440         Fix bugs from r228411
2441         https://bugs.webkit.org/show_bug.cgi?id=182851
2442         <rdar://problem/37577732>
2443
2444         Reviewed by JF Bastien.
2445
2446         * stress/constant-folding-phase-insert-check-handle-varargs.js: Added.
2447
2448 2018-02-15  Filip Pizlo  <fpizlo@apple.com>
2449
2450         Unreviewed, roll out r228366 since it did not progress anything.
2451
2452         * stress/gc-error-stack.js: Removed.
2453         * stress/no-gc-error-stack.js: Removed.
2454
2455 2018-02-15  Tomas Popela  <tpopela@redhat.com>
2456
2457         Many stress tests fail with JIT disabled
2458         https://bugs.webkit.org/show_bug.cgi?id=182730
2459
2460         Reviewed by Saam Barati.
2461
2462         These tests are broken by design if the JIT is disabled - they test
2463         the return value of numberOfDFGCompiles(), which is always set to
2464         1000000.0 in TestRunnerUtils.cpp and makes the tests to fail.
2465
2466         * stress/arith-abs-on-various-types.js:
2467         * stress/arith-abs-to-arith-negate-range-optimizaton.js:
2468         * stress/arith-acos-on-various-types.js:
2469         * stress/arith-acosh-on-various-types.js:
2470         * stress/arith-asin-on-various-types.js:
2471         * stress/arith-asinh-on-various-types.js:
2472         * stress/arith-atan-on-various-types.js:
2473         * stress/arith-atanh-on-various-types.js:
2474         * stress/arith-cbrt-on-various-types.js:
2475         * stress/arith-ceil-on-various-types.js:
2476         * stress/arith-clz32-on-various-types.js:
2477         * stress/arith-cos-on-various-types.js:
2478         * stress/arith-cosh-on-various-types.js:
2479         * stress/arith-expm1-on-various-types.js:
2480         * stress/arith-floor-on-various-types.js:
2481         * stress/arith-fround-on-various-types.js:
2482         * stress/arith-log-on-various-types.js:
2483         * stress/arith-log10-on-various-types.js:
2484         * stress/arith-log2-on-various-types.js:
2485         * stress/arith-negate-on-various-types.js:
2486         * stress/arith-round-on-various-types.js:
2487         * stress/arith-sin-on-various-types.js:
2488         * stress/arith-sinh-on-various-types.js:
2489         * stress/arith-sqrt-on-various-types.js:
2490         * stress/arith-tan-on-various-types.js:
2491         * stress/arith-tanh-on-various-types.js:
2492         * stress/arith-trunc-on-various-types.js:
2493         * stress/compare-strict-eq-on-various-types.js:
2494
2495 2018-02-14  Ryan Haddad  <ryanhaddad@apple.com>
2496
2497         Skip stress/new-largeish-contiguous-array-with-size.js on arm.
2498
2499         Unreviewed test gardening.
2500
2501         * stress/new-largeish-contiguous-array-with-size.js:
2502
2503 2018-02-14  Saam Barati  <sbarati@apple.com>
2504
2505         Setting a VMTrap shouldn't look at topCallFrame since that may imply we're in C code and holding the malloc lock
2506         https://bugs.webkit.org/show_bug.cgi?id=182801
2507
2508         Reviewed by Keith Miller.
2509
2510         * stress/watchdog-dont-malloc-when-in-c-code.js: Added.
2511
2512 2018-02-14  Ryan Haddad  <ryanhaddad@apple.com>
2513
2514         Skip JSC test stress/activation-sink-default-value-tdz-error.js on debug.
2515         https://bugs.webkit.org/show_bug.cgi?id=182526
2516
2517         Unreviewed test gardening.
2518
2519         * stress/activation-sink-default-value-tdz-error.js:
2520
2521 2018-02-13  Saam Barati  <sbarati@apple.com>
2522
2523         putDirectIndexSlowOrBeyondVectorLength needs to convert to dictionary indexing mode always if attributes are present
2524         https://bugs.webkit.org/show_bug.cgi?id=182755
2525         <rdar://problem/37080864>
2526
2527         Reviewed by Keith Miller.
2528
2529         * stress/always-enter-dictionary-indexing-mode-with-getter.js: Added.
2530         (test1.o.get 10005):
2531         (test1):
2532         (test2.o.get 1000):
2533         (test2):
2534
2535 2018-02-13  Caitlin Potter  <caitp@igalia.com>
2536
2537         [JSC] cache TaggedTemplate arrays by callsite rather than by contents
2538         https://bugs.webkit.org/show_bug.cgi?id=182717
2539
2540         Reviewed by Yusuke Suzuki.
2541
2542         https://github.com/tc39/ecma262/pull/890 imposes a change to template
2543         literals, to allow template callsite arrays to be collected when the
2544         code containing the tagged template call is collected. This spec change
2545         has received concensus and been ratified.
2546
2547         This change eliminates the eternal map associating template contents
2548         with arrays.
2549
2550         * stress/tagged-template-object-collect.js: Renamed from JSTests/stress/tagged-template-registry-key-collect.js.
2551         * stress/tagged-template-object.js: Renamed from JSTests/stress/tagged-template-registry-key.js.
2552         * stress/tagged-templates-identity.js:
2553         * stress/template-string-tags-eval.js:
2554         * test262.yaml:
2555
2556 2018-02-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2557
2558         Support GetArrayLength on ArrayStorage in the FTL
2559         https://bugs.webkit.org/show_bug.cgi?id=182625
2560
2561         Reviewed by Saam Barati.
2562
2563         * stress/array-storage-length.js: Added.
2564         (shouldBe):
2565         (testInBound):
2566         (testUncountable):
2567         (testSlowPutInBound):
2568         (testSlowPutUncountable):
2569         * stress/undecided-length.js: Added.
2570         (shouldBe):
2571         (test2):
2572
2573 2018-02-12  Saam Barati  <sbarati@apple.com>
2574
2575         DFG::emitCodeToGetArgumentsArrayLength needs to handle NewArrayBuffer/PhantomNewArrayBuffer
2576         https://bugs.webkit.org/show_bug.cgi?id=182706
2577         <rdar://problem/36833681>
2578
2579         Reviewed by Filip Pizlo.
2580
2581         * stress/get-array-length-phantom-new-array-buffer.js: Added.
2582         (effects):
2583         (foo):
2584
2585 2018-02-09  Filip Pizlo  <fpizlo@apple.com>
2586
2587         Don't waste memory for error.stack
2588         https://bugs.webkit.org/show_bug.cgi?id=182656
2589
2590         Reviewed by Saam Barati.
2591         
2592         Tests the policy.
2593
2594         * stress/gc-error-stack.js: Added. Shows that the GC forgets frames now.
2595         * stress/no-gc-error-stack.js: Added. Shows that the GC won't forget things if you ask for the stack.
2596
2597 2018-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2598
2599         [JSC] Update Test262 to Feb 9 version
2600         https://bugs.webkit.org/show_bug.cgi?id=182468
2601
2602         Reviewed by Saam Barati.
2603
2604 2018-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2605
2606         Unreviewed, fix invalid line terminator in old test262 file part 2
2607         https://bugs.webkit.org/show_bug.cgi?id=182468
2608
2609         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2610
2611 2018-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2612
2613         Unreviewed, fix invalid line terminator in old test262 file
2614         https://bugs.webkit.org/show_bug.cgi?id=182468
2615
2616         * test262/test/language/literals/regexp/7.8.5-1.js:
2617
2618 2018-02-06  Yusuke Suzuki  <utatane.tea@gmail.com>
2619
2620         [JSC] Implement Array.prototype.flatMap and Array.prototype.flatten
2621         https://bugs.webkit.org/show_bug.cgi?id=182440
2622
2623         Reviewed by Darin Adler.
2624
2625         * stress/array-flatmap.js: Added.
2626         (shouldBe):
2627         (shouldBeArray):
2628         (shouldThrow):
2629         (var):
2630         * stress/array-flatten.js: Added.
2631         (shouldBe):
2632         (shouldBeArray):
2633         * test262.yaml:
2634         * test262/test/built-ins/Array/prototype/flatMap/depth-always-one.js:
2635         (3.flatMap):
2636         Pick test262 82c6148980332febe92a544a1fb653718e9fdb57 change.
2637
2638 2018-02-06  Keith Miller  <keith_miller@apple.com>
2639
2640         put_to_scope/get_from_scope should not cache lexical scopes when expecting a global object
2641         https://bugs.webkit.org/show_bug.cgi?id=182549
2642         <rdar://problem/36189995>
2643
2644         Reviewed by Saam Barati.
2645
2646         * stress/var-injection-cache-invalidation.js: Added.
2647         (allocateLotsOfThings):
2648         (test):
2649
2650 2018-02-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2651
2652         Unreviewed, follow up for test262 update
2653         https://bugs.webkit.org/show_bug.cgi?id=182288
2654
2655         * test262.yaml:
2656
2657 2018-02-02  Ryan Haddad  <ryanhaddad@apple.com>
2658
2659         Update test262 to Jan 30 version
2660         https://bugs.webkit.org/show_bug.cgi?id=182288
2661
2662         Unreviewed test gardening.
2663
2664         * test262.yaml: Remove entry for missing test language/expressions/assignment/white-space.js
2665
2666 2018-02-02  Saam Barati  <sbarati@apple.com>
2667
2668         When BytecodeParser inserts Unreachable after ForceOSRExit it needs to update ArgumentPositions for Flushes it inserts
2669         https://bugs.webkit.org/show_bug.cgi?id=182368
2670         <rdar://problem/36932466>
2671
2672         Reviewed by Mark Lam.
2673
2674         * stress/flush-after-force-exit-in-bytecodeparser-needs-to-update-argument-positions.js: Added.
2675         (runNearStackLimit.t):
2676         (runNearStackLimit):
2677         (try.runNearStackLimit):
2678         (catch):
2679
2680 2018-02-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2681
2682         Update test262 to Jan 30 version
2683         https://bugs.webkit.org/show_bug.cgi?id=182288
2684
2685         Rubber stamped by Saam Barati.
2686
2687         This patch updates test262 to the latest one, Jan 30 version.
2688         Since added and changed files are too many, we cannot create ChangeLog.
2689         The following files are changed.
2690
2691         Several files are intentionally omitted due to merge failures. We should investigate how to merge files
2692         including some special line terminators (like u2028, u2029).
2693
2694         * test262.yaml:
2695         * test262/test262-Revision.txt:
2696         * test262/*:
2697
2698 2018-02-02  Guillaume Emont  <guijemont@igalia.com>
2699
2700         JSTests: Skip mozilla/js1_5/Array/regress-157652.js on all memory limited platforms
2701         https://bugs.webkit.org/show_bug.cgi?id=182411
2702
2703         Reviewed by Carlos Alberto Lopez Perez.
2704
2705         This is skipped only on arm memory limited platforms. Until recently
2706         it was not a problem on MIPS as the butterfly was not initialized. But
2707         since r227435, the butterfly is initialized in that test and therefore
2708         memory is allocated, and the test typically takes around 512M, which
2709         means it generally gets OOM-killed on the MIPS buildbot.
2710
2711         * mozilla/mozilla-tests.yaml:
2712
2713 2018-02-01  Mark Lam  <mark.lam@apple.com>
2714
2715         Fix broken bounds check in FTL's compileGetMyArgumentByVal().
2716         https://bugs.webkit.org/show_bug.cgi?id=182419
2717         <rdar://problem/37044945>
2718
2719         Reviewed by Saam Barati.
2720
2721         * stress/regress-182419.js: Added.
2722
2723 2018-02-01  Keith Miller  <keith_miller@apple.com>
2724
2725         Fix crashes due to mishandling custom sections.
2726         https://bugs.webkit.org/show_bug.cgi?id=182404
2727         <rdar://problem/36935863>
2728
2729         Reviewed by Saam Barati.
2730
2731         * wasm/Builder.js:
2732         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
2733         * wasm/js-api/validate.js:
2734         (assert.truthy):
2735
2736 2018-01-31  Saam Barati  <sbarati@apple.com>
2737
2738         JSC incorrectly interpreting script, sets Global Property instead of Global Lexical variable (LiteralParser / JSONP path)
2739         https://bugs.webkit.org/show_bug.cgi?id=182074
2740         <rdar://problem/36846261>
2741
2742         Reviewed by Mark Lam.
2743
2744         * stress/jsonp-program-evaluate-path-must-consider-global-lexical-environment.js: Added.
2745         (assert):
2746         (let.func):
2747         (let.o.foo):
2748         (varFunc):
2749
2750 2018-01-30  Yusuke Suzuki  <utatane.tea@gmail.com>
2751
2752         Unreviewed, update test262 expects
2753         https://bugs.webkit.org/show_bug.cgi?id=182232
2754
2755         * test262.yaml:
2756
2757 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2758
2759         [JSC] Implement trimStart and trimEnd
2760         https://bugs.webkit.org/show_bug.cgi?id=182233
2761
2762         Reviewed by Mark Lam.
2763
2764         * stress/trim.js: Added.
2765         (shouldBe):
2766         (startTest):
2767         (endTest):
2768         (trimTest):
2769
2770 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2771
2772         [JSC] Relax line terminators in String to make JSON subset of JS
2773         https://bugs.webkit.org/show_bug.cgi?id=182232
2774
2775         Reviewed by Keith Miller.
2776
2777         * ChakraCore/test/es5/Lex_u3.baseline-jsc:
2778         * stress/relaxed-line-terminators-in-string.js: Added.
2779         (shouldBe):
2780
2781 2018-01-29  Michael Saboff  <msaboff@apple.com>
2782
2783         REGRESSION (r227341): DFG_ASSERT failure at JSC::DFG::AtTailAbstractState::forNode()
2784         https://bugs.webkit.org/show_bug.cgi?id=182249
2785
2786         Reviewed by Keith Miller.
2787
2788         New regression test.
2789
2790         * stress/compare-clobber-untypeduse.js: Added.
2791
2792 2018-01-29  Matt Lewis  <jlewis3@apple.com>
2793
2794         Unreviewed, rolling out r227725.
2795
2796         This caused internal failures.
2797
2798         Reverted changeset:
2799
2800         "JSC Sampling Profiler: Detect tester and testee when sampling
2801         in RegExp JIT"
2802         https://bugs.webkit.org/show_bug.cgi?id=152729
2803         https://trac.webkit.org/changeset/227725
2804
2805 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2806
2807         JSC Sampling Profiler: Detect tester and testee when sampling in RegExp JIT
2808         https://bugs.webkit.org/show_bug.cgi?id=152729
2809
2810         Reviewed by Saam Barati.
2811
2812         * stress/sampling-profiler-regexp.js: Added.
2813         (platformSupportsSamplingProfiler.test):
2814         (platformSupportsSamplingProfiler.baz):
2815         (platformSupportsSamplingProfiler):
2816
2817 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2818
2819         [DFG][FTL] WeakMap#set should have DFG node
2820         https://bugs.webkit.org/show_bug.cgi?id=180015
2821
2822         Reviewed by Saam Barati.
2823
2824         * stress/weakmap-set-change-get.js: Added.
2825         (shouldBe):
2826         (test):
2827         * stress/weakmap-set-cse.js: Added.
2828         (shouldBe):
2829         (test):
2830         * stress/weakset-add-change-get.js: Added.
2831         (shouldBe):
2832         * stress/weakset-add-cse.js: Added.
2833         (shouldBe):
2834
2835 2018-01-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2836
2837         DFG strength reduction fails to convert NumberToStringWithValidRadixConstant for 0 to constant '0'
2838         https://bugs.webkit.org/show_bug.cgi?id=182213
2839
2840         Reviewed by Mark Lam.
2841
2842         * stress/int32-min-to-string.js: Added.
2843         (shouldBe):
2844         (test2):
2845         (test4):
2846         (test8):
2847         (test16):
2848         (test32):
2849         * stress/zero-to-string.js: Added.
2850         (shouldBe):
2851         (test2):
2852         (test4):
2853         (test8):
2854         (test16):
2855         (test32):
2856
2857 2018-01-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2858
2859         Add more module scope related tests with code evaluation by string
2860         https://bugs.webkit.org/show_bug.cgi?id=181983
2861
2862         Reviewed by Sam Weinig.
2863
2864         Add more module scope related tests. When the original tests are landed,
2865         we do not have browser integration. This patch adds more module scope tests
2866         with dynamically created script evaluation. We add tests with Function
2867         constructor, direct eval, indirect eval, setTimeout, setInterval, and event handlers.
2868
2869         * modules/scopes-eval.js: Added.
2870         (shouldBe):
2871         * modules/scopes.js:
2872         (shouldBe):
2873
2874 2018-01-23  Filip Pizlo  <fpizlo@apple.com>
2875
2876         Unreviewed, retire some microbenchmarks that are proportionately very slow. Benchmark running time should be proportional to their value. Microbenchmarks have little value, so they should be very fast.
2877
2878         * microbenchmarks/array-push-3.js: Removed.
2879         * microbenchmarks/bigswitch-indirect-symbol-or-undefined.js: Removed.
2880         * microbenchmarks/double-to-int32.js: Removed.
2881         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Removed.
2882         * microbenchmarks/ftl-polymorphic-bitand.js: Removed.
2883         * microbenchmarks/ftl-polymorphic-bitor.js: Removed.
2884         * microbenchmarks/ftl-polymorphic-bitxor.js: Removed.
2885         * microbenchmarks/ftl-polymorphic-lshift.js: Removed.
2886         * microbenchmarks/ftl-polymorphic-rshift.js: Removed.
2887         * microbenchmarks/ftl-polymorphic-sub.js: Removed.
2888         * microbenchmarks/ftl-polymorphic-urshift.js: Removed.
2889         * microbenchmarks/map-constant-key.js: Removed.
2890         * microbenchmarks/nested-function-parsing.js: Removed.
2891         * microbenchmarks/rest-parameter-allocation-elimination.js: Removed.
2892         * microbenchmarks/spread-large-array.js: Removed.
2893         * microbenchmarks/string-add-constant-folding.js: Removed.
2894         * microbenchmarks/to-lower-case.js: Removed.
2895         * microbenchmarks/undefined-property-access.js: Removed.
2896         * slowMicrobenchmarks/array-push-3.js: Copied from JSTests/microbenchmarks/array-push-3.js.
2897         * slowMicrobenchmarks/bigswitch-indirect-symbol-or-undefined.js: Copied from JSTests/microbenchmarks/bigswitch-indirect-symbol-or-undefined.js.
2898         * slowMicrobenchmarks/double-to-int32.js: Copied from JSTests/microbenchmarks/double-to-int32.js.
2899         * slowMicrobenchmarks/fake-iterators-that-throw-when-finished.js: Copied from JSTests/microbenchmarks/fake-iterators-that-throw-when-finished.js.
2900         * slowMicrobenchmarks/ftl-polymorphic-bitand.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitand.js.
2901         * slowMicrobenchmarks/ftl-polymorphic-bitor.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitor.js.
2902         * slowMicrobenchmarks/ftl-polymorphic-bitxor.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitxor.js.
2903         * slowMicrobenchmarks/ftl-polymorphic-lshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-lshift.js.
2904         * slowMicrobenchmarks/ftl-polymorphic-rshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-rshift.js.
2905         * slowMicrobenchmarks/ftl-polymorphic-sub.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-sub.js.
2906         * slowMicrobenchmarks/ftl-polymorphic-urshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-urshift.js.
2907         * slowMicrobenchmarks/map-constant-key.js: Copied from JSTests/microbenchmarks/map-constant-key.js.
2908         * slowMicrobenchmarks/nested-function-parsing.js: Copied from JSTests/microbenchmarks/nested-function-parsing.js.
2909         * slowMicrobenchmarks/rest-parameter-allocation-elimination.js: Copied from JSTests/microbenchmarks/rest-parameter-allocation-elimination.js.
2910         * slowMicrobenchmarks/spread-large-array.js: Copied from JSTests/microbenchmarks/spread-large-array.js.
2911         * slowMicrobenchmarks/string-add-constant-folding.js: Copied from JSTests/microbenchmarks/string-add-constant-folding.js.
2912         * slowMicrobenchmarks/to-lower-case.js: Copied from JSTests/microbenchmarks/to-lower-case.js.
2913         * slowMicrobenchmarks/undefined-property-access.js: Copied from JSTests/microbenchmarks/undefined-property-access.js.
2914
2915 2018-01-23  Robin Morisset  <rmorisset@apple.com>
2916
2917         Update the argument count in DFGByteCodeParser::handleRecursiveCall
2918         https://bugs.webkit.org/show_bug.cgi?id=181739
2919         <rdar://problem/36627662>
2920
2921         Reviewed by Saam Barati.
2922
2923         * stress/recursive-tail-call-with-different-argument-count.js: Added.
2924         (foo):
2925         (bar):
2926
2927 2018-01-22  Michael Saboff  <msaboff@apple.com>
2928
2929         DFG abstract interpreter needs to properly model effects of some Math ops
2930         https://bugs.webkit.org/show_bug.cgi?id=181886
2931
2932         Reviewed by Saam Barati.
2933
2934         New regression test.
2935
2936         * stress/arith-nodes-abstract-interpreter-untypeduse.js: Added.
2937         (test):
2938
2939 2018-01-20  Caio Lima  <ticaiolima@gmail.com>
2940
2941         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
2942         https://bugs.webkit.org/show_bug.cgi?id=181182
2943
2944         Reviewed by Darin Adler.
2945
2946         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
2947         * stress/big-int-prototype-to-string-exception.js: Added.
2948         * stress/big-int-prototype-to-string-wrong-values.js: Added.
2949         * stress/number-prototype-to-string-cast-overflow.js: Added.
2950         * stress/number-prototype-to-string-exception.js: Added.
2951         * stress/number-prototype-to-string-wrong-values.js: Added.
2952
2953 2018-01-19  Ryan Haddad  <ryanhaddad@apple.com>
2954
2955         Disable Atomics when SharedArrayBuffer isn’t enabled
2956         https://bugs.webkit.org/show_bug.cgi?id=181572
2957
2958         Unreviewed test gardening.
2959
2960         * test262.yaml: Skip tests that fail after this change.
2961
2962 2018-01-19  Saam Barati  <sbarati@apple.com>
2963
2964         Kill ArithNegate's ArithProfile assert inside BytecodeParser
2965         https://bugs.webkit.org/show_bug.cgi?id=181877
2966         <rdar://problem/36630552>
2967
2968         Reviewed by Mark Lam.
2969
2970         * stress/arith-profile-for-negate-can-see-non-number-due-to-dfg-osr-exit-profiling.js: Added.
2971         (runNearStackLimit):
2972         (f1):
2973         (f2):
2974         (f3):
2975         (i.catch):
2976         (i.try.runNearStackLimit):
2977         (catch):
2978
2979 2018-01-19  Saam Barati  <sbarati@apple.com>
2980
2981         Spread's effects are modeled incorrectly both in AI and in Clobberize
2982         https://bugs.webkit.org/show_bug.cgi?id=181867
2983         <rdar://problem/36290415>
2984
2985         Reviewed by Michael Saboff.
2986
2987         * stress/ai-needs-to-model-spreads-effects.js: Added.
2988         (try.p.Symbol.iterator):
2989         (try.go):
2990         (catch):
2991         * stress/clobberize-needs-to-model-spread-effects.js: Added.
2992         (assert):
2993         (foo):
2994         (a.Symbol.iterator):
2995
2996 2018-01-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2997
2998         Unreviewed, reduce count of iteration to fix timing out debug JSC test
2999         https://bugs.webkit.org/show_bug.cgi?id=181535
3000
3001         * stress/inserted-recovery-with-set-last-index.js:
3002
3003 2018-01-17  Yusuke Suzuki  <utatane.tea@gmail.com>
3004
3005         [DFG][FTL] Introduce PhantomNewRegexp and RegExpExecNonGlobalOrSticky
3006         https://bugs.webkit.org/show_bug.cgi?id=181535
3007
3008         Reviewed by Saam Barati.
3009
3010         * stress/inserted-recovery-with-set-last-index.js: Added.
3011         (shouldBe):
3012         (foo):
3013         * stress/materialize-regexp-at-osr-exit.js: Added.
3014         (shouldBe):
3015         (test):
3016         * stress/materialize-regexp-cyclic-regexp-at-osr-exit.js: Added.
3017         (shouldBe):
3018         (test):
3019         * stress/materialize-regexp-cyclic-regexp.js: Added.
3020         (shouldBe):
3021         (test):
3022         (i.switch):
3023         * stress/materialize-regexp-cyclic.js: Added.
3024         (shouldBe):
3025         (test):
3026         (i.switch):
3027         * stress/materialize-regexp-referenced-from-phantom-regexp-cyclic.js: Added.
3028         (bar):
3029         (foo):
3030         (test):
3031         * stress/materialize-regexp-referenced-from-phantom-regexp.js: Added.
3032         (bar):
3033         (foo):
3034         (test):
3035         * stress/materialize-regexp.js: Added.
3036         (shouldBe):
3037         (test):
3038         * stress/phantom-regexp-regexp-exec.js: Added.
3039         (shouldBe):
3040         (test):
3041         * stress/phantom-regexp-string-match.js: Added.
3042         (shouldBe):
3043         (test):
3044         * stress/regexp-last-index-sinking.js: Added.
3045         (shouldBe):
3046         (test):
3047
3048 2018-01-17  Saam Barati  <sbarati@apple.com>
3049
3050         Disable Atomics when SharedArrayBuffer isn’t enabled
3051         https://bugs.webkit.org/show_bug.cgi?id=181572
3052         <rdar://problem/36553206>
3053
3054         Reviewed by Michael Saboff.
3055
3056         * stress/isLockFree.js:
3057
3058 2018-01-17  Saam Barati  <sbarati@apple.com>
3059
3060         DFG::Node::convertToConstant needs to clear the varargs flags
3061         https://bugs.webkit.org/show_bug.cgi?id=181697
3062         <rdar://problem/36497332>
3063
3064         Reviewed by Yusuke Suzuki.
3065
3066         * stress/dfg-node-convert-to-constant-must-clear-varargs-flags.js: Added.
3067         (doIndexOf):
3068         (bar):
3069         (i.bar):
3070
3071 2018-01-16  Ryan Haddad  <ryanhaddad@apple.com>
3072
3073         Unreviewed, rolling out r226937.
3074
3075         Tests added with this change are failing due to a missing
3076         exception check.
3077
3078         Reverted changeset:
3079
3080         "[JSC] NumberPrototype::extractRadixFromArgs incorrectly cast
3081         double to int32_t"
3082         https://bugs.webkit.org/show_bug.cgi?id=181182
3083         https://trac.webkit.org/changeset/226937
3084
3085 2018-01-13  Caio Lima  <ticaiolima@gmail.com>
3086
3087         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
3088         https://bugs.webkit.org/show_bug.cgi?id=181182
3089
3090         Reviewed by Darin Adler.
3091
3092         * bigIntTests.yaml:
3093         * stress/big-int-constructor.js:
3094         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
3095         (assert):
3096         (assertThrowRangeError):
3097         * stress/number-prototype-to-string-cast-overflow.js: Added.
3098         (assert):
3099         (assertThrowRangeError):
3100
3101 2018-01-12  Saam Barati  <sbarati@apple.com>
3102
3103         CheckStructure can be incorrectly subsumed by CheckStructureOrEmpty
3104         https://bugs.webkit.org/show_bug.cgi?id=181177
3105         <rdar://problem/36205704>
3106
3107         Reviewed by Yusuke Suzuki.
3108
3109         * stress/check-structure-ir-ensures-empty-does-not-flow-through.js: Added.
3110         (runNearStackLimit.t):
3111         (runNearStackLimit):
3112         (test.f):
3113         (test):
3114
3115 2018-01-12  Saam Barati  <sbarati@apple.com>
3116
3117         Each variant of a polymorphic inlined call should be exitOK at the top of the block
3118         https://bugs.webkit.org/show_bug.cgi?id=181562
3119         <rdar://problem/36445624>
3120
3121         Reviewed by Yusuke Suzuki.
3122
3123         * stress/each-block-at-top-of-polymorphic-call-inlining-should-be-exitOK.js: Added.
3124         (f):
3125         (foo):
3126
3127 2018-01-11  Saam Barati  <sbarati@apple.com>
3128
3129         When inserting Unreachable in byte code parser we need to flush all the right things
3130         https://bugs.webkit.org/show_bug.cgi?id=181509
3131         <rdar://problem/36423110>
3132
3133         Reviewed by Mark Lam.
3134
3135         * stress/proper-flushing-when-we-insert-unreachable-after-force-exit-in-bytecode-parser.js: Added.
3136
3137 2018-01-11  Saam Barati  <sbarati@apple.com>
3138
3139         JITMathIC code in the FTL is wrong when code gets duplicated
3140         https://bugs.webkit.org/show_bug.cgi?id=181525
3141         <rdar://problem/36351993>
3142
3143         Reviewed by Michael Saboff and Keith Miller.
3144
3145         * stress/allow-math-ic-b3-code-duplication.js: Added.
3146
3147 2018-01-11  Saam Barati  <sbarati@apple.com>
3148
3149         Our for-in caching is wrong when we add indexed properties on things in the prototype chain
3150         https://bugs.webkit.org/show_bug.cgi?id=181508
3151
3152         Reviewed by Yusuke Suzuki.
3153
3154         * stress/for-in-prototype-with-indexed-properties-should-prevent-caching.js: Added.
3155         (assert):
3156         (test1.foo):
3157         (test1):
3158         (test2.foo):
3159         (test2):
3160
3161 2018-01-09  Mark Lam  <mark.lam@apple.com>
3162
3163         ASSERTION FAILED: pair.second->m_type & PropertyNode::Getter
3164         https://bugs.webkit.org/show_bug.cgi?id=181388
3165         <rdar://problem/36349351>
3166
3167         Reviewed by Saam Barati.
3168
3169         * stress/regress-181388.js: Added.
3170
3171 2018-01-08  JF Bastien  <jfbastien@apple.com>
3172
3173         WebAssembly: mask indexed accesses to Table
3174         https://bugs.webkit.org/show_bug.cgi?id=181412
3175         <rdar://problem/36363236>
3176
3177         Reviewed by Saam Barati.
3178
3179         Update error messages.
3180
3181         * wasm/js-api/table.js:
3182         (assert.throws.WebAssembly.Table.prototype.grow):
3183
3184 2018-01-08  Ryan Haddad  <ryanhaddad@apple.com>
3185
3186         Disable SharedArrayBuffer tests missed in r226386.
3187         https://bugs.webkit.org/show_bug.cgi?id=181266
3188
3189         Unreviewed test gardening.
3190
3191         * test262.yaml:
3192
3193 2018-01-06  Yusuke Suzuki  <utatane.tea@gmail.com>
3194
3195         Object.getOwnPropertyNames includes "arguments" and "caller" for bound functions
3196         https://bugs.webkit.org/show_bug.cgi?id=181321
3197
3198         Reviewed by Saam Barati.
3199
3200         * stress/bound-function-does-not-have-caller-and-arguments.js: Added.
3201         (shouldBe):
3202         (testFunction):
3203         * test262.yaml:
3204
3205 2018-01-05  Ryan Haddad  <ryanhaddad@apple.com>
3206
3207         Unreviewed, attempt to fix test262 after r226386.
3208
3209         * test262.yaml:
3210
3211 2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>
3212
3213         [DFG] Define defs for MapSet/SetAdd to participate in CSE
3214         https://bugs.webkit.org/show_bug.cgi?id=179911
3215
3216         Reviewed by Saam Barati.
3217
3218         In addition to these tests, map-set-cse.js and set-add-cse.js work.
3219
3220         * stress/map-set-change-get.js: Added.
3221         (shouldBe):
3222         (test):
3223         * stress/map-set-create-bucket.js: Added.
3224         (shouldBe):
3225         (test):
3226         * stress/set-add-create-bucket.js: Added.
3227         (shouldBe):
3228
3229 2018-01-03  Michael Saboff  <msaboff@apple.com>
3230
3231         Disable SharedArrayBuffers from Web API
3232         https://bugs.webkit.org/show_bug.cgi?id=181266
3233
3234         Reviewed by Saam Barati.
3235
3236         Disabled SharedArrayBuffer tests.
3237
3238         * stress/SharedArrayBuffer-opt.js:
3239         * stress/SharedArrayBuffer.js:
3240         * stress/array-buffer-byte-length.js:
3241         * stress/atomics-add-uint32.js:
3242         * stress/atomics-known-int-use.js:
3243         * stress/atomics-neg-zero.js:
3244         * stress/atomics-store-return.js:
3245         * stress/lars-sab-workers.js:
3246         * stress/regress-159779-1.js:
3247         * stress/regress-159779-2.js:
3248         * stress/regress-170473.js:
3249         * test262.yaml:
3250
3251 2018-01-03  Caio Lima  <ticaiolima@gmail.com>
3252
3253         [ESNext][BigInt] Failing test stress/big-int-constructor-oom.js into MIPS
3254         https://bugs.webkit.org/show_bug.cgi?id=181258
3255
3256         Reviewed by Antonio Gomes.
3257
3258         * stress/big-int-constructor-gc.js:
3259         * stress/big-int-constructor-oom.js:
3260
3261 2018-01-03  Robin Morisset  <rmorisset@apple.com>
3262
3263         Inlining of a function that ends in op_unreachable crashes
3264         https://bugs.webkit.org/show_bug.cgi?id=181027
3265
3266         Reviewed by Filip Pizlo.
3267
3268         * stress/inlining-unreachable.js: Added.
3269         (bar):
3270         (baz):
3271         (i.catch):
3272
3273 2018-01-02  Saam Barati  <sbarati@apple.com>
3274
3275         Incorrect assertion inside AccessCase
3276         https://bugs.webkit.org/show_bug.cgi?id=181200
3277         <rdar://problem/35494754>
3278
3279         Reviewed by Yusuke Suzuki.
3280
3281         * stress/setter-same-base-and-rhs-invalid-assertion-inside-access-case.js: Added.
3282         (ctor):
3283         (theFunc):
3284         (run):
3285
3286 2018-01-02  Caio Lima  <ticaiolima@gmail.com>
3287
3288         [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
3289         https://bugs.webkit.org/show_bug.cgi?id=175359
3290
3291         Reviewed by Yusuke Suzuki.
3292
3293         * bigIntTests.yaml:
3294         * stress/big-int-as-key.js: Added.
3295         * stress/big-int-constructor-gc.js: Added.
3296         * stress/big-int-constructor-oom.js: Added.
3297         * stress/big-int-constructor-properties.js: Added.
3298         * stress/big-int-constructor-prototype-prop-descriptor.js: Added.
3299         * stress/big-int-constructor-prototype.js: Added.
3300         * stress/big-int-constructor.js: Added.
3301         * stress/big-int-function-apply.js:
3302         * stress/big-int-length.js: Added.
3303         * stress/big-int-prop-descriptor.js: Added.
3304         * stress/big-int-proto-constructor.js: Added.
3305         * stress/big-int-proto-name.js: Added.
3306         * stress/big-int-prototype-properties.js: Added.
3307         * stress/big-int-prototype-proto.js: Added.
3308         * stress/big-int-prototype-value-of.js: Added.
3309         * stress/big-int-prototype-symbol-to-string-tag.js: Added.
3310         * stress/big-int-prototype-to-string-apply.js: Added.
3311         * stress/big-int-to-object.js: Added.
3312         * stress/big-int-to-string.js: Added.
3313
3314 2017-12-28  Saam Barati  <sbarati@apple.com>
3315
3316         Assertion used to determine if something is an async generator is wrong
3317         https://bugs.webkit.org/show_bug.cgi?id=181168
3318         <rdar://problem/35640560>
3319
3320         Reviewed by Yusuke Suzuki.
3321
3322         * stress/async-generator-assertion.js: Added.
3323
3324 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
3325
3326         Skip stress/splay-flash-access tests on memory limited platforms
3327         https://bugs.webkit.org/show_bug.cgi?id=181086
3328
3329         Reviewed by Carlos Alberto Lopez Perez.
3330
3331         These tests use about 185M of memory, and occasionally get OOM-killed
3332         on memory limited platforms.
3333
3334         * stress/splay-flash-access-1ms.js:
3335         * stress/splay-flash-access.js:
3336
3337 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
3338
3339         Skip slow jsc tests on embedded platforms
3340         https://bugs.webkit.org/show_bug.cgi?id=180937
3341
3342         Reviewed by Carlos Alberto Lopez Perez.
3343
3344         The tests typeProfiler/deltablue-for-of.js and
3345         typeProfiler/getter-richards.js take a very long time in the
3346         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
3347         thus always timeout. They should be skipped on these platforms.
3348
3349         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
3350         * typeProfiler/getter-richards.js: Skip on arm*/mips.
3351
3352 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
3353
3354         [JSC] Do not check isValid() in op_new_regexp
3355         https://bugs.webkit.org/show_bug.cgi?id=180970
3356
3357         Reviewed by Saam Barati.
3358
3359         * stress/regexp-syntax-error-invalid-flags.js: Added.
3360         (shouldThrow):
3361
3362 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
3363
3364         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
3365         https://bugs.webkit.org/show_bug.cgi?id=180712
3366
3367         Reviewed by Michael Catanzaro.
3368
3369         stress/call-apply-exponential-bytecode-size.js crashes if the
3370         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
3371         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
3372         should skip the test on other platforms.
3373
3374         * stress/call-apply-exponential-bytecode-size.js:
3375
3376 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
3377
3378         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
3379         https://bugs.webkit.org/show_bug.cgi?id=179762
3380
3381         Reviewed by Saam Barati.
3382
3383         * stress/call-varargs-double-new-array-buffer.js: Added.
3384         (assert):
3385         (bar):
3386         (foo):
3387         * stress/call-varargs-spread-new-array-buffer.js: Added.
3388         (assert):
3389         (bar):
3390         (foo):
3391         * stress/call-varargs-spread-new-array-buffer2.js: Added.
3392         (assert):
3393         (bar):
3394         (foo):
3395         * stress/forward-varargs-double-new-array-buffer.js: Added.
3396         (assert):
3397         (test.baz):
3398         (test.bar):
3399         (test.foo):
3400         (test):
3401         * stress/new-array-buffer-sinking-osrexit.js: Added.
3402         (target):
3403         (test):
3404         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
3405         (shouldBe):
3406         (test):
3407         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
3408         (shouldBe):
3409         (target):
3410         (test):
3411         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
3412         (assert):
3413         (test1.bar):
3414         (test1.foo):
3415         (test1):
3416         (test2.bar):
3417         (test2.foo):
3418         (test3.baz):
3419         (test3.bar):
3420         (test3.foo):
3421         (test4.baz):
3422         (test4.bar):
3423         (test4.foo):
3424         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
3425         (assert):
3426         (test.baz):
3427         (test.bar):
3428         (test.foo):
3429         (test):
3430         * stress/phantom-new-array-buffer-osr-exit.js: Added.
3431         (assert):
3432         (baz):
3433         (bar):
3434         (effects):
3435         (foo):
3436
3437 2017-12-14  Saam Barati  <sbarati@apple.com>
3438
3439         The CleanUp after LICM is erroneously removing a Check
3440         https://bugs.webkit.org/show_bug.cgi?id=180852
3441         <rdar://problem/36063494>
3442
3443         Reviewed by Filip Pizlo.
3444
3445         * stress/dont-run-cleanup-after-licm.js: Added.
3446
3447 2017-12-14  Michael Saboff  <msaboff@apple.com>
3448
3449         REGRESSION (r225695): Repro crash on yahoo login page
3450         https://bugs.webkit.org/show_bug.cgi?id=180761
3451
3452         Reviewed by JF Bastien.
3453
3454         New regression test.
3455
3456         * stress/regress-180761.js: Added.
3457
3458 2017-12-13  Keith Miller  <keith_miller@apple.com>
3459
3460         JSObjects should have a mask for loading indexed properties
3461         https://bugs.webkit.org/show_bug.cgi?id=180768
3462
3463         Reviewed by Mark Lam.
3464
3465         * stress/int16-put-by-val-in-and-out-of-bounds.js:
3466         (test):
3467
3468 2017-12-13  Saam Barati  <sbarati@apple.com>
3469
3470         Arrow functions need their own structure because they have different properties than sloppy functions
3471         https://bugs.webkit.org/show_bug.cgi?id=180779
3472         <rdar://problem/35814591>
3473
3474         Reviewed by Mark Lam.
3475
3476         * stress/arrow-function-needs-its-own-structure.js: Added.
3477         (assert):
3478         (readPrototype):
3479         (noInline.let.f1):
3480         (noInline):
3481
3482 2017-12-13  Saam Barati  <sbarati@apple.com>
3483
3484         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
3485         https://bugs.webkit.org/show_bug.cgi?id=163579
3486         <rdar://problem/35455798>
3487
3488         Reviewed by Mark Lam.
3489
3490         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
3491         (assert):
3492         (test1):
3493         (i.test1):
3494         (i.test1.C):
3495         (i.test1.async.foo):
3496         (i.test1.foo):
3497         (test2):
3498
3499 2017-12-13  Saam Barati  <sbarati@apple.com>
3500
3501         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
3502         https://bugs.webkit.org/show_bug.cgi?id=180734
3503         <rdar://problem/35640547>
3504
3505         Reviewed by Yusuke Suzuki.
3506
3507         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
3508         (__isPropertyOfType):
3509         (__getProperties):
3510         (__getObjects):
3511         (__getRandomObject):
3512         (theClass.):
3513         (theClass):
3514         (childClass):
3515         (counter.catch):
3516
3517 2017-12-12  Saam Barati  <sbarati@apple.com>
3518
3519         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
3520         https://bugs.webkit.org/show_bug.cgi?id=180725
3521         <rdar://problem/35970511>
3522
3523         Reviewed by Michael Saboff.
3524
3525         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
3526         (f1):
3527         (f2):
3528         (let.o2.valueOf):
3529
3530 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3531
3532         [JSC] Implement optimized WeakMap and WeakSet
3533         https://bugs.webkit.org/show_bug.cgi?id=179929
3534
3535         Reviewed by Saam Barati.
3536
3537         * microbenchmarks/weak-map-key.js:
3538         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
3539         (assert):
3540         (objectKey):
3541         (let.start.Date.now):
3542         * stress/basic-weakmap.js: Added.
3543         (shouldBe):
3544         (test):
3545         * stress/basic-weakset.js: Added.
3546         (shouldBe):
3547         (test.set new):
3548         * stress/weakmap-cse-set-break.js: Added.
3549         (shouldBe):
3550         (test):
3551         * stress/weakmap-cse.js: Added.
3552         (shouldBe):
3553         (test):
3554         * stress/weakmap-gc.js: Added.
3555         (test):
3556         * stress/weakset-cse-add-break.js: Added.
3557         (shouldBe):
3558         (test.set new):
3559         * stress/weakset-cse.js: Added.
3560         (shouldBe):
3561         (test.set new):
3562         * stress/weakset-gc.js: Added.
3563         (test.set add):
3564         (test.set new):
3565         (test):
3566
3567 2017-12-12  Saam Barati  <sbarati@apple.com>
3568
3569         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
3570         https://bugs.webkit.org/show_bug.cgi?id=180723
3571         <rdar://problem/35859726>
3572
3573         Reviewed by JF Bastien.
3574
3575         * stress/get-my-argument-by-val-constant-folding.js: Added.
3576         (test):
3577         (catch):
3578
3579 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
3580
3581         [ESNext][BigInt] Implement BigInt literals and JSBigInt
3582         https://bugs.webkit.org/show_bug.cgi?id=179000
3583
3584         Reviewed by Darin Adler and Yusuke Suzuki.
3585
3586         * bigIntTests.yaml: Added.
3587         * stress/big-int-literal-line-terminator.js: Added.
3588         * stress/big-int-literals.js: Added.
3589         * stress/big-int-operations-error.js: Added.
3590         * stress/big-int-type-of.js: Added.
3591         * stress/big-int-white-space-trailing-leading.js: Added.
3592         * stress/big-int-function-apply.js: Added.
3593
3594 2017-12-11  Saam Barati  <sbarati@apple.com>
3595
3596         We need to disableCaching() in ErrorInstance when we materialize properties
3597         https://bugs.webkit.org/show_bug.cgi?id=180343
3598         <rdar://problem/35833002>
3599
3600         Reviewed by Mark Lam.
3601
3602         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
3603         (assert):
3604         (makeError):
3605         (storeToStack):
3606         (storeToStackAlreadyMaterialized):
3607
3608 2017-12-05  JF Bastien  <jfbastien@apple.com>
3609
3610         WebAssembly: don't eagerly checksum
3611         https://bugs.webkit.org/show_bug.cgi?id=180441
3612         <rdar://problem/35156628>
3613
3614         Reviewed by Saam Barati.
3615
3616         Checksum is now disabled, so tests only have <?> as the module
3617         name.
3618
3619         * wasm/function-tests/nameSection.js:
3620         * wasm/function-tests/stack-overflow.js:
3621         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
3622         (assertOverflows.assertThrows):
3623         (assertOverflows):
3624         * wasm/function-tests/stack-trace.js:
3625
3626 2017-12-04  JF Bastien  <jfbastien@apple.com>
3627
3628         Proxy all functions, except the $ objects
3629         https://bugs.webkit.org/show_bug.cgi?id=180375
3630
3631         Reviewed by Saam Barati.
3632
3633         It looks like this test may have broken some executions because I
3634         call some internal objects. Explicitly ignore objects whose name
3635         starts with "$" because it's a bad idea anyways.
3636
3637         * stress/proxy-all-the-parameters.js:
3638         (generateObjects):
3639         (get throw):
3640
3641 2017-12-04  Saam Barati  <sbarati@apple.com>
3642
3643         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
3644         https://bugs.webkit.org/show_bug.cgi?id=180366
3645         <rdar://problem/35685877>
3646
3647         Reviewed by Michael Saboff.
3648
3649         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
3650         (theParent):
3651         (test1.base.getParentStaticValue):
3652         (test1.base):
3653         (test1.__v_24888.prototype.set prop):
3654         (test1.__v_24888):
3655         (test2.base.getParentStaticValue):
3656         (test2.base):
3657         (test2.__v_24888.prototype.set prop):
3658         (test2.__v_24888):
3659         (test2):
3660
3661 2017-12-01  JF Bastien  <jfbastien@apple.com>
3662
3663         Try proxying all function arguments
3664         https://bugs.webkit.org/show_bug.cgi?id=180306
3665
3666         Reviewed by Saam Barati.
3667
3668         * stress/proxy-all-the-parameters.js: Added.
3669         (isPropertyOfType):
3670         (getProperties):
3671         (generateObjects):
3672         (getObjects):
3673         (getFunctions):
3674         (get throw):
3675         (let.o.of.getObjects.let.f.of.getFunctions.catch):
3676
3677 2017-12-01  JF Bastien  <jfbastien@apple.com>
3678
3679         JavaScriptCore: missing exception checks in Math functions that take more than one argument
3680         https://bugs.webkit.org/show_bug.cgi?id=180297
3681         <rdar://problem/35745556>
3682
3683         Reviewed by Mark Lam.
3684
3685         * stress/math-exceptions.js: Added.
3686         (get try):
3687         (catch):
3688
3689 2017-12-01  JF Bastien  <jfbastien@apple.com>
3690
3691         JavaScriptCore: add test for weird class static getters
3692         https://bugs.webkit.org/show_bug.cgi?id=180281
3693         <rdar://problem/35592139>
3694
3695         Reviewed by Mark Lam.
3696
3697         I fixed a bug for it in r224927 and didn't add a test. Do so.
3698
3699         * stress/class-static-get-weird.js: Added.
3700         (c.prototype.get name):
3701         (c):
3702         (c.prototype.get arguments):
3703         (c.prototype.get caller):
3704         (c.prototype.get length):
3705
3706 2017-12-01  Saam Barati  <sbarati@apple.com>
3707
3708         Having a bad time needs to handle ArrayClass indexing type as well
3709         https://bugs.webkit.org/show_bug.cgi?id=180274
3710         <rdar://problem/35667869>
3711
3712         Reviewed by Keith Miller and Mark Lam.
3713
3714         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
3715         (assert):
3716         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
3717         (assert):
3718
3719 2017-12-01  JF Bastien  <jfbastien@apple.com>
3720
3721         WebAssembly: restore cached stack limit after out-call
3722         https://bugs.webkit.org/show_bug.cgi?id=179106
3723         <rdar://problem/35337525>
3724
3725         Reviewed by Saam Barati.
3726
3727         * wasm/function-tests/double-instance.js: Added.
3728         (const.imp.boom):
3729         (const.imp.get callAnother):
3730
3731 2017-11-30  JF Bastien  <jfbastien@apple.com>
3732
3733         WebAssembly: improve stack trace
3734         https://bugs.webkit.org/show_bug.cgi?id=179343
3735
3736         Reviewed by Saam Barati.
3737
3738         Update the tests to follow the new format. Notably, SHA1 module
3739         hash is now included in traces, and stubs are properly identified.
3740
3741         * wasm/assert.js: Add an assertion which matches regular expressions.
3742         * wasm/function-tests/nameSection.js:
3743         * wasm/function-tests/stack-overflow.js:
3744         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
3745         (assertOverflows.assertThrows.wasm.1):
3746         (assertOverflows.assertThrows.wasm.0):
3747         (assertOverflows.assertThrows):
3748         (assertOverflows):
3749         * wasm/function-tests/stack-trace.js:
3750         (import.Builder.from.string_appeared_here.assert): Deleted.
3751         * wasm/function-tests/trap-after-cross-instance-call.js:
3752         (wasmFrameCountFromError):
3753         * wasm/function-tests/trap-load-2.js:
3754         (wasmFrameCountFromError):
3755         * wasm/function-tests/trap-load.js:
3756         (wasmFrameCountFromError):
3757
3758 2017-11-30  Mark Lam  <mark.lam@apple.com>
3759
3760         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
3761         https://bugs.webkit.org/show_bug.cgi?id=180219
3762         <rdar://problem/35696536>
3763
3764         Reviewed by Filip Pizlo.
3765
3766         * stress/regress-180219.js: Added.
3767
3768 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
3769
3770         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
3771         https://bugs.webkit.org/show_bug.cgi?id=180190
3772
3773         Reviewed by Mark Lam.
3774
3775         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
3776         (shouldBe):
3777         (test1):
3778         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
3779         (shouldBe):
3780         (test1):
3781         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
3782         (shouldBe):
3783         (test1):
3784         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
3785         (shouldBe):
3786         (test1):
3787         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
3788         (shouldBe):
3789         (test1):
3790         * stress/operation-in-may-have-negative-int32.js: Added.
3791         (shouldBe):
3792         (test2):
3793         * stress/operation-in-negative-int32-cast.js: Added.
3794         (shouldBe):
3795         (test1):
3796
3797 2017-11-28  JF Bastien  <jfbastien@apple.com>
3798
3799         Strict and sloppy functions shouldn't share structure
3800         https://bugs.webkit.org/show_bug.cgi?id=180103
3801         <rdar://problem/35667847>
3802
3803         Reviewed by Saam Barati.
3804
3805         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
3806         because the IC was wrong.
3807         (foo):
3808         (bar):
3809         (baz):
3810         (catch):
3811         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
3812         in this patch, but may as well test odd strict mode corner cases.
3813         (bar):
3814         (baz):
3815         (catch):
3816         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
3817         (foo):
3818         (bar):
3819         (baz):
3820         (catch):
3821         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
3822         next file, but with invalidation of the FunctionExecutable's
3823         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
3824         slower path.
3825         (foo):
3826         (bar.const.x):
3827         (bar.const.y):
3828         (bar):
3829         (catch):
3830         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
3831         strict nesting works correctly.
3832         (foo):
3833         (bar.baz):
3834         (bar):
3835         * stress/strict-function-structure.js: Added. The test used to
3836         assert in objectProtoFuncHasOwnProperty.
3837         (foo):
3838         (bar):
3839         (baz):
3840         * stress/strict-nested-function-structure.js: Added. Nesting.
3841         (foo):
3842         (bar):
3843         (baz.boo):
3844         (baz):
3845
3846 2017-11-29  Robin Morisset  <rmorisset@apple.com>
3847
3848         The recursive tail call optimisation is wrong on closures
3849         https://bugs.webkit.org/show_bug.cgi?id=179835
3850
3851         Reviewed by Saam Barati.
3852
3853         * stress/closure-recursive-tail-call.js: Added.
3854         (makeClosure):
3855
3856 2017-11-27  JF Bastien  <jfbastien@apple.com>
3857
3858         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
3859         https://bugs.webkit.org/show_bug.cgi?id=180051
3860         <rdar://problem/35614371>
3861
3862         Reviewed by Saam Barati.
3863
3864         * stress/rest-parameter-negative.js: Added.
3865         (__f_5484):
3866         (catch):
3867         (__f_5485):
3868         (__v_22598.catch):
3869
3870 2017-11-27  Saam Barati  <sbarati@apple.com>
3871
3872         Spread can escape when CreateRest does not
3873         https://bugs.webkit.org/show_bug.cgi?id=180057
3874         <rdar://problem/35676119>
3875
3876         Reviewed by JF Bastien.
3877
3878         * stress/spread-escapes-but-create-rest-does-not.js: Added.
3879         (assert):
3880         (getProperties):
3881         (theFunc):
3882         (let.obj.valueOf):
3883
3884 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3885
3886         [DFG] Add NormalizeMapKey DFG IR
3887         https://bugs.webkit.org/show_bug.cgi?id=179912
3888
3889         Reviewed by Saam Barati.
3890
3891         * stress/map-untyped-normalize-cse.js: Added.
3892         (shouldBe):
3893         (test):
3894         * stress/map-untyped-normalize.js: Added.
3895         (shouldBe):
3896         (test):
3897         * stress/set-untyped-normalize-cse.js: Added.
3898         (shouldBe):
3899         (set return.set has.set has):
3900         * stress/set-untyped-normalize.js: Added.
3901         (shouldBe):
3902         (set return.set has):
3903
3904 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3905
3906         [FTL] Support DeleteById and DeleteByVal
3907         https://bugs.webkit.org/show_bug.cgi?id=180022
3908
3909         Reviewed by Saam Barati.
3910
3911         * stress/delete-by-id.js: Added.
3912         (shouldBe):
3913         (test1):
3914         (test2):
3915         * stress/delete-by-val-ftl.js: Added.
3916         (shouldBe):
3917         (test1):
3918         (test2):
3919
3920 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3921
3922         [DFG] Introduce {Set,Map,WeakMap}Fields
3923         https://bugs.webkit.org/show_bug.cgi?id=179925
3924
3925         Reviewed by Saam Barati.
3926
3927         * stress/map-set-clobber-map-get.js: Added.
3928         (shouldBe):
3929         (test):
3930         * stress/map-set-does-not-clobber-set-has.js: Added.
3931         (shouldBe):
3932         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
3933         (shouldBe):
3934         (test):
3935         * stress/set-add-clobber-set-has.js: Added.
3936         (shouldBe):
3937         * stress/set-add-does-not-clobber-map-get.js: Added.
3938         (shouldBe):
3939
3940 2017-11-24  Mark Lam  <mark.lam@apple.com>
3941
3942         Move unsafe jsc shell test functions to the $vm object.
3943         https://bugs.webkit.org/show_bug.cgi?id=179980
3944
3945         Reviewed by Yusuke Suzuki.
3946
3947         * controlFlowProfiler/driver/driver.js:
3948         * controlFlowProfiler/execution-count.js:
3949         * controlFlowProfiler/if-statement.js:
3950         * controlFlowProfiler/loop-statements.js:
3951         * controlFlowProfiler/switch-statements.js:
3952         * controlFlowProfiler/test-jit.js:
3953         * exceptionFuzz/3d-cube.js:
3954         * exceptionFuzz/date-format-xparb.js:
3955         * exceptionFuzz/earley-boyer.js:
3956         * heapProfiler/basic-edges.js:
3957         * heapProfiler/property-edge-types.js:
3958         * microbenchmarks/try-get-by-id-basic.js:
3959         * microbenchmarks/try-get-by-id-polymorphic.js:
3960         * modules/namespace-object-try-get.js:
3961         * stress/argument-count-bytecode.js:
3962         * stress/argument-intrinsic-basic.js:
3963         * stress/argument-intrinsic-inlining-use-caller-arg.js:
3964         * stress/argument-intrinsic-inlining-with-result-escape.js:
3965         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
3966         * stress/argument-intrinsic-inlining-with-vararg.js:
3967         * stress/argument-intrinsic-nested-inlining.js:
3968         * stress/argument-intrinsic-not-convert-to-get-argument.js:
3969         * stress/argument-intrinsic-with-stack-write.js:
3970         * stress/arity-mismatch-get-argument.js:
3971         * stress/array-message-passing.js:
3972         * stress/array-push-with-force-exit.js:
3973         * stress/check-dom-with-signature.js:
3974         * stress/check-sub-class.js:
3975         * stress/compare-eq-incomplete-profile.js:
3976         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
3977         * stress/do-eval-virtual-call-correctly.js:
3978         * stress/dom-jit-with-poly-proto.js:
3979         * stress/domjit-exception-ic.js:
3980         * stress/domjit-exception.js:
3981         * stress/domjit-getter-complex-with-incorrect-object.js:
3982         * stress/domjit-getter-complex.js:
3983         * stress/domjit-getter-poly.js:
3984         * stress/domjit-getter-proto.js:
3985         * stress/domjit-getter-super-poly.js:
3986         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
3987         * stress/domjit-getter-type-check.js:
3988         * stress/domjit-getter.js:
3989         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
3990         * stress/for-in-proxy-target-changed-structure.js:
3991         * stress/for-in-proxy.js:
3992         * stress/generational-opaque-roots.js:
3993         * stress/global-const-redeclaration-setting-2.js:
3994         * stress/global-const-redeclaration-setting-3.js:
3995         * stress/global-const-redeclaration-setting-4.js:
3996         * stress/global-const-redeclaration-setting-5.js:
3997         * stress/global-const-redeclaration-setting.js:
3998         * stress/import-basic.js:
3999         * stress/import-from-eval.js:
4000         * stress/import-reject-with-exception.js:
4001         * stress/import-syntax.js:
4002         * stress/impure-get-own-property-slot-inline-cache.js:
4003         * stress/is-constructor.js:
4004         * stress/istypedarrayview-intrinsic.js:
4005         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
4006         * stress/jsc-test-functions-should-be-more-robust.js:
4007         * stress/object-toString-with-proxy.js:
4008         * stress/poly-proto-custom-value-and-accessor.js:
4009         * stress/proxy-inline-cache.js:
4010         * stress/re-execute-error-module.js:
4011         * stress/regress-150532.js:
4012         * stress/regress-156992.js:
4013         * stress/regress-179619.js:
4014         * stress/resources/shadow-chicken-support.js:
4015         * stress/runtime-array.js:
4016         * stress/sampling-profiler-microtasks.js:
4017         * stress/shadow-chicken-enabled.js:
4018         * stress/spread-correct-global-object-on-exception.js:
4019         * stress/super-get-by-id.js:
4020         * stress/tailCallForwardArguments.js:
4021         * stress/to-object-intrinsic-boolean-edge.js:
4022         * stress/to-object-intrinsic-null-or-undefined-edge.js:
4023         * stress/to-object-intrinsic-number-edge.js:
4024         * stress/to-object-intrinsic-object-edge.js:
4025         * stress/to-object-intrinsic-string-edge.js:
4026         * stress/to-object-intrinsic-symbol-edge.js:
4027         * stress/to-object-intrinsic.js:
4028         * stress/try-catch-custom-getter-as-get-by-id.js:
4029         * stress/try-get-by-id-poly-proto.js:
4030         * stress/try-get-by-id-should-spill-registers-dfg.js:
4031         * stress/try-get-by-id.js:
4032         * typeProfiler/arrow-functions.js:
4033         * typeProfiler/basic.js:
4034         * typeProfiler/captured.js:
4035         * typeProfiler/classes.js:
4036         * typeProfiler/dfg-jit-optimizations.js:
4037         * typeProfiler/dictionary-mode.js:
4038         * typeProfiler/es6-block-scoping.js:
4039         * typeProfiler/es6-classes.js:
4040         * typeProfiler/inheritance.js:
4041         * typeProfiler/int52-dfg.js:
4042         * typeProfiler/loop.js:
4043         * typeProfiler/optional-fields.js:
4044         * typeProfiler/overflow.js:
4045         * typeProfiler/return.js:
4046         * typeProfiler/symbol.js:
4047         * typeProfiler/weird-prototype-chain.js:
4048
4049 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
4050
4051         [DFG][FTL] Support MapSet / SetAdd intrinsics
4052         https://bugs.webkit.org/show_bug.cgi?id=179858
4053
4054         Reviewed by Saam Barati.
4055
4056         * microbenchmarks/map-has-and-set.js: Added.
4057         (test):
4058         * stress/map-set-check-failure.js: Added.
4059         (shouldBe):
4060         (shouldThrow):
4061         (target):
4062         * stress/map-set-cse.js: Added.
4063         (shouldBe):
4064         (test):
4065         * stress/set-add-check-failure.js: Added.
4066         (shouldBe):
4067         (shouldThrow):
4068         (set shouldThrow):
4069         * stress/set-add-cse.js: Added.
4070         (shouldBe):
4071
4072 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
4073
4074         [JSC] Allow poly proto for intrinsic getters
4075         https://bugs.webkit.org/show_bug.cgi?id=179550
4076
4077         Reviewed by Saam Barati.
4078
4079         This change is also tested by existing tests.
4080
4081             1. stress/intrinsic-getter-with-poly-proto.js
4082             2. stress/poly-proto-intrinsic-getter-correctness.js
4083
4084         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
4085         (shouldBe):
4086         (makePolyProtoObject.foo.C):
4087         (makePolyProtoObject.foo):
4088         (makePolyProtoObject):
4089         (target):
4090         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
4091         (shouldBe):
4092         (makePolyProtoObject.foo.C):
4093         (makePolyProtoObject.foo):
4094         (makePolyProtoObject):
4095         (target):
4096
4097 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
4098
4099         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
4100         https://bugs.webkit.org/show_bug.cgi?id=179744
4101
4102         Reviewed by Michael Catanzaro.
4103
4104         This test uses too much memory for our buildbots on these platforms
4105         and gets OOM-killed.
4106
4107         * stress/unshiftCountSlowCase-correct-postCapacity.js:
4108         Skip if $memoryLimited and linux.
4109
4110 2017-11-17  JF Bastien  <jfbastien@apple.com>
4111
4112         WebAssembly JS API: throw when a promise can't be created
4113         https://bugs.webkit.org/show_bug.cgi?id=179826
4114         <rdar://problem/35455813>
4115
4116         Reviewed by Mark Lam.
4117
4118         Test WebAssembly.{compile,instantiate} where promise creation
4119         fails because of a stack overflow.
4120
4121         * wasm/js-api/promise-stack-overflow.js: Added.
4122         (const.runNearStackLimit.f.const.t):
4123         (async.testCompile):
4124         (async.testInstantiate):
4125
4126 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
4127
4128         Unreviewed, mark regress-178385.js as memory exhausting
4129
4130         * stress/regress-178385.js:
4131
4132 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
4133
4134         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
4135
4136         Unreviewed test gardening.
4137
4138         * test262.yaml:
4139
4140 2017-11-16  Robin Morisset  <rmorisset@apple.com>
4141
4142         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
4143         https://bugs.webkit.org/show_bug.cgi?id=179763
4144         <rdar://problem/35550513>
4145
4146         Reviewed by Keith Miller.
4147
4148         Just adding a slightly cleaned-up version of the original fuzzer-found test.
4149
4150         * stress/tdz-this-in-try-catch.js: Added.
4151         (__v_6388):
4152         (__v_6392):
4153
4154 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
4155
4156         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
4157         https://bugs.webkit.org/show_bug.cgi?id=179594
4158
4159         Reviewed by Saam Barati.
4160
4161         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
4162         (shouldBe):
4163         (args):
4164         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
4165         (shouldBe):
4166         (args):
4167
4168 2017-11-14  Saam Barati  <sbarati@apple.com>
4169
4170         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
4171         https://bugs.webkit.org/show_bug.cgi?id=179639
4172         <rdar://problem/35513018>
4173
4174         Reviewed by JF Bastien.
4175
4176         * wasm/function-tests/grow-memory-cause-gc.js: Added.
4177         (escape):
4178         (i.func):
4179
4180 2017-11-13  Mark Lam  <mark.lam@apple.com>
4181
4182         Add more overflow check book-keeping for MarkedArgumentBuffer.
4183         https://bugs.webkit.org/show_bug.cgi?id=179634
4184         <rdar://problem/35492517>
4185
4186         Reviewed by Saam Barati.
4187
4188         * stress/regress-179634.js: Added.
4189
4190 2017-11-13  Mark Lam  <mark.lam@apple.com>
4191
4192         Make the jsc shell loadGetterFromGetterSetter() function more robust.
4193         https://bugs.webkit.org/show_bug.cgi?id=179619
4194         <rdar://problem/35492518>
4195
4196         Reviewed by Saam Barati.
4197
4198         * stress/regress-179619.js: Added.
4199
4200 2017-11-12  Mark Lam  <mark.lam@apple.com>
4201
4202         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
4203         https://bugs.webkit.org/show_bug.cgi?id=179562
4204         <rdar://problem/35467022>
4205
4206         Reviewed by Saam Barati.
4207
4208         * regress-179562.js: Added.
4209
4210 2017-11-08  Saam Barati  <sbarati@apple.com>
4211
4212         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
4213         https://bugs.webkit.org/show_bug.cgi?id=177792
4214
4215         Reviewed by Yusuke Suzuki.
4216
4217         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
4218         (assert):
4219         (foo.Foo.prototype.ensureX):
4220         (foo.Foo):
4221         (foo):
4222         (access):
4223
4224 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
4225
4226         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
4227         https://bugs.webkit.org/show_bug.cgi?id=178592
4228
4229         Unreviewed test gardening.
4230
4231         * test262.yaml:
4232
4233 2017-11-08  Robin Morisset  <rmorisset@apple.com>
4234
4235         Turn recursive tail calls into loops
4236         https://bugs.webkit.org/show_bug.cgi?id=176601
4237
4238         Reviewed by Saam Barati.
4239
4240         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
4241
4242         Add some simple test that computes factorial in several ways, and other trivial computations.
4243         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
4244         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
4245         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
4246         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
4247
4248         * stress/inline-call-to-recursive-tail-call.js: Added.
4249         (factorial.aux):
4250         (factorial):
4251         (factorial2.aux2):
4252         (factorial2.id):
4253         (factorial2):
4254         (factorial3.aux3):
4255         (factorial3):
4256         (aux4):
4257         (factorial4):
4258         (foo):
4259         (auxBar):
4260         (bar):
4261         (test):
4262
4263 2017-11-07  Mark Lam  <mark.lam@apple.com>
4264
4265         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
4266         https://bugs.webkit.org/show_bug.cgi?id=179355
4267         <rdar://problem/35263053>
4268
4269         Reviewed by Saam Barati.
4270
4271         * stress/regress-179355.js: Added.
4272
4273 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
4274
4275         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
4276         https://bugs.webkit.org/show_bug.cgi?id=144458
4277
4278         Reviewed by Saam Barati.
4279
4280         * microbenchmarks/dfg-internal-function-call.js: Added.
4281         (target):
4282         * microbenchmarks/dfg-internal-function-construct.js: Added.
4283         (target):
4284         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
4285         (target):
4286         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
4287         (target):
4288         * stress/dfg-internal-function-call.js: Added.
4289         (shouldBe):
4290         (target):
4291         * stress/dfg-internal-function-construct.js: Added.
4292         (shouldBe):
4293         (target):
4294         * stress/internal-function-call.js: Added.
4295         (shouldBe):
4296         * stress/internal-function-construct.js: Added.
4297         (shouldBe):
4298
4299 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
4300
4301         [Win] Skip stress/regress-178385.js.
4302         https://bugs.webkit.org/show_bug.cgi?id=179298
4303
4304         Unreviewed test gardening.
4305
4306         * stress/regress-178385.js:
4307
4308 2017-11-03  Keith Miller  <keith_miller@apple.com>
4309
4310         Add test for ic with side effects
4311         https://bugs.webkit.org/show_bug.cgi?id=179268
4312
4313         Reviewed by Saam Barati.
4314 </