Update test262 configuration to not run tests dependent on ICU version.
[WebKit-https.git] / JSTests / ChangeLog
1 2018-12-19  Keith Miller  <keith_miller@apple.com>
2
3         Update test262 configuration to not run tests dependent on ICU version.
4         https://bugs.webkit.org/show_bug.cgi?id=192920
5
6         Reviewed by Saam Barati.
7
8         * test262/expectations.yaml:
9
10 2018-12-20  Mark Lam  <mark.lam@apple.com>
11
12         Fix a typo in slow_path_construct_arityCheck and operationConstructArityCheck.
13         https://bugs.webkit.org/show_bug.cgi?id=192939
14         <rdar://problem/46869516>
15
16         Reviewed by Keith Miller.
17
18         * stress/stack-overflow-frame-for-construct-arityCheck-should-use-construct-codeBlock.js: Added.
19
20 2018-12-20  Tadeu Zagallo  <tzagallo@apple.com>
21
22         WTF::String and StringImpl overflow MaxLength
23         https://bugs.webkit.org/show_bug.cgi?id=192853
24         <rdar://problem/45726906>
25
26         Reviewed by Mark Lam.
27
28         * stress/string-16bit-repeat-overflow.js: Added.
29         (catch):
30
31 2018-12-19  Ross Kirsling  <ross.kirsling@sony.com>
32
33         Unreviewed follow-up to r192914.
34
35         * test262/expectations.yaml:
36         Add the last 20 missing expectations.
37
38 2018-12-19  Keith Miller  <keith_miller@apple.com>
39
40         Fix test262 expectations
41         https://bugs.webkit.org/show_bug.cgi?id=192914
42
43         Unreviewed, when I imported the latest round of test262 tests I must have failed to update the test expectations.
44
45         * test262/expectations.yaml:
46
47 2018-12-19  Keith Miller  <keith_miller@apple.com>
48
49         Update test262 tests.
50         https://bugs.webkit.org/show_bug.cgi?id=192907
51
52         Rubber stamped by Mark Lam.
53
54         * test262/*: Omitted because prepare-changelog crashes.
55
56 2018-12-19  Mark Lam  <mark.lam@apple.com>
57
58         JSPropertyNameEnumerator should cache the iterated object's structure only after getting its property names.
59         https://bugs.webkit.org/show_bug.cgi?id=192464
60         <rdar://problem/46519455>
61
62         Reviewed by Saam Barati.
63
64         This patch is about a 10% speed up on the new for-in-on-object-with-lazily-materialized-properties.js
65         microbenchmark.
66
67         * microbenchmarks/for-in-on-object-with-lazily-materialized-properties.js: Added.
68         * stress/property-name-enumerator-should-cache-structure-after-getting-property-names.js: Added.
69
70 2018-12-19  Tadeu Zagallo  <tzagallo@apple.com>
71
72         String overflow in JSC::createError results in ASSERT in WTF::makeString
73         https://bugs.webkit.org/show_bug.cgi?id=192833
74         <rdar://problem/45706868>
75
76         Reviewed by Mark Lam.
77
78         * stress/string-overflow-createError.js: Added.
79
80 2018-12-18  Ross Kirsling  <ross.kirsling@sony.com>
81
82         Error message for `-x ** y` contains a typo.
83         https://bugs.webkit.org/show_bug.cgi?id=192832
84
85         Reviewed by Saam Barati.
86
87         * ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
88         (assert.assert.return.throws):
89         * stress/pow-expects-update-expression-on-lhs.js:
90         (throw.new.Error):
91         Update test expectations which match against the exact error message.
92
93 2018-12-18  Mark Lam  <mark.lam@apple.com>
94
95         Gardening: test options fix.
96         https://bugs.webkit.org/show_bug.cgi?id=192822
97
98         Unreviewed.
99
100         * stress/json-stringify-string-builder-overflow.js:
101
102 2018-12-18  Mark Lam  <mark.lam@apple.com>
103
104         JSON.stringify() should throw OOM on StringBuilder overflows.
105         https://bugs.webkit.org/show_bug.cgi?id=192822
106         <rdar://problem/46670577>
107
108         Reviewed by Saam Barati.
109
110         * stress/json-stringify-string-builder-overflow.js: Added.
111
112 2018-12-18  Ross Kirsling  <ross.kirsling@sony.com>
113
114         Redeclaration of var over let/const/class should be a syntax error.
115         https://bugs.webkit.org/show_bug.cgi?id=192298
116
117         Reviewed by Keith Miller.
118
119         * test262.yaml:
120         * test262/expectations.yaml:
121         Mark 46 tests as passing.
122
123         * stress/block-scope-redeclarations.js:
124         Add some new tests.
125
126         * stress/for-in-invalidate-context-weird-assignments.js:
127         * stress/for-in-tests.js:
128         Replace tests for outdated behavior with tests for SyntaxError.
129
130         * ChakraCore/test/LetConst/defer3.baseline-jsc:
131         * ChakraCore/test/LetConst/letvar.baseline-jsc:
132         Update expectations.
133
134 2018-12-18  Mark Lam  <mark.lam@apple.com>
135
136         Skip the stress/elidable-new-object-roflcopter-then-exit.js test on 32-bit.
137         https://bugs.webkit.org/show_bug.cgi?id=191374
138         <rdar://problem/46525447>
139
140         Reviewed by Yusuke Suzuki.
141
142         This test runs too slow on 32-bit, and is not relevant for non-JIT builds.
143
144         * stress/elidable-new-object-roflcopter-then-exit.js:
145
146 2018-12-17  Mark Lam  <mark.lam@apple.com>
147
148         Skip the stress/materialized-regexp-has-correct-last-index-set-by-match.js test on 32-bit.
149         https://bugs.webkit.org/show_bug.cgi?id=192019
150         <rdar://problem/46525456>
151
152         Reviewed by Yusuke Suzuki.
153
154         The test runs too slow on 32-bit.
155
156         * stress/materialized-regexp-has-correct-last-index-set-by-match.js:
157
158 2018-12-17  Mark Lam  <mark.lam@apple.com>
159
160         Skip the stress/materialize-regexp-cyclic-regexp.js test on 32-bit.
161         https://bugs.webkit.org/show_bug.cgi?id=191373
162         <rdar://problem/46525458>
163
164         Reviewed by Yusuke Suzuki.
165
166         The test is already slow running with a JIT on 64-bit.  It will always timeout
167         on 32-bit without a JIT.
168
169         * stress/materialize-regexp-cyclic-regexp.js:
170
171 2018-12-17  Mark Lam  <mark.lam@apple.com>
172
173         Array unshift/shift should not race against the AI in the compiler thread.
174         https://bugs.webkit.org/show_bug.cgi?id=192795
175         <rdar://problem/46724263>
176
177         Reviewed by Saam Barati.
178
179         * stress/array-unshift-should-not-race-against-compiler-thread.js: Added.
180
181 2018-12-16  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
182
183         [JSC] Optimize Object.keys by caching own keys results in StructureRareData
184         https://bugs.webkit.org/show_bug.cgi?id=190047
185
186         Reviewed by Saam Barati.
187
188         * stress/object-keys-cached-zero.js: Added.
189         (shouldBe):
190         (test):
191         * stress/object-keys-changed-attribute.js: Added.
192         (shouldBe):
193         (test):
194         * stress/object-keys-changed-index.js: Added.
195         (shouldBe):
196         (test):
197         * stress/object-keys-changed.js: Added.
198         (shouldBe):
199         (test):
200         * stress/object-keys-indexed-non-cache.js: Added.
201         (shouldBe):
202         (test):
203         * stress/object-keys-overrides-get-property-names.js: Added.
204         (shouldBe):
205         (test):
206         (noInline):
207
208 2018-12-17  Mark Lam  <mark.lam@apple.com>
209
210         SamplingProfiler's isValidFramePointer() should reject address at stack origin.
211         https://bugs.webkit.org/show_bug.cgi?id=192779
212         <rdar://problem/46775869>
213
214         Reviewed by Saam Barati.
215
216         * stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js: Added.
217
218 2018-12-17  Ryan Haddad  <ryanhaddad@apple.com>
219
220         Unreviewed test gardening, address a syntax error in a new test.
221
222         * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js:
223
224 2018-12-17  Mark Lam  <mark.lam@apple.com>
225
226         Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit().
227         https://bugs.webkit.org/show_bug.cgi?id=192776
228         <rdar://problem/46772368>
229
230         Reviewed by Keith Miller.
231
232         * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js: Added.
233
234 2018-12-17  Mark Lam  <mark.lam@apple.com>
235
236         Fix stale assertion in attemptToForceStringArrayModeByToStringConversion().
237         https://bugs.webkit.org/show_bug.cgi?id=192770
238         <rdar://problem/46449037>
239
240         Reviewed by Keith Miller.
241
242         * stress/force-string-arrayMode-on-originalNonArray-array-class.js: Added.
243
244 2018-12-14  Mark Lam  <mark.lam@apple.com>
245
246         CallFrame::convertToStackOverflowFrame() needs to keep the top CodeBlock alive.
247         https://bugs.webkit.org/show_bug.cgi?id=192717
248         <rdar://problem/46660677>
249
250         Reviewed by Saam Barati.
251
252         * stress/regress-192717.js: Added.
253
254 2018-12-14  Commit Queue  <commit-queue@webkit.org>
255
256         Unreviewed, rolling out r239153, r239154, and r239155.
257         https://bugs.webkit.org/show_bug.cgi?id=192715
258
259         Caused flaky GC-related crashes seen with layout tests
260         (Requested by ryanhaddad on #webkit).
261
262         Reverted changesets:
263
264         "[JSC] Optimize Object.keys by caching own keys results in
265         StructureRareData"
266         https://bugs.webkit.org/show_bug.cgi?id=190047
267         https://trac.webkit.org/changeset/239153
268
269         "Unreviewed, build fix after r239153"
270         https://bugs.webkit.org/show_bug.cgi?id=190047
271         https://trac.webkit.org/changeset/239154
272
273         "Unreviewed, build fix after r239153, part 2"
274         https://bugs.webkit.org/show_bug.cgi?id=190047
275         https://trac.webkit.org/changeset/239155
276
277 2018-12-14  Keith Miller  <keith_miller@apple.com>
278
279         Callers of JSString::getIndex should check for OOM exceptions
280         https://bugs.webkit.org/show_bug.cgi?id=192709
281
282         Reviewed by Mark Lam.
283
284         * stress/StringObject-define-length-getter-rope-string-oom.js: Added.
285
286 2018-12-13  Mark Lam  <mark.lam@apple.com>
287
288         Add a missing exception check.
289         https://bugs.webkit.org/show_bug.cgi?id=192626
290         <rdar://problem/46662163>
291
292         Reviewed by Keith Miller.
293
294         * stress/regress-192626.js: Added.
295
296 2018-12-13  Caio Lima  <ticaiolima@gmail.com>
297
298         [BigInt] Add ValueDiv into DFG
299         https://bugs.webkit.org/show_bug.cgi?id=186178
300
301         Reviewed by Yusuke Suzuki.
302
303         * stress/big-int-div-jit-osr.js: Added.
304         * stress/big-int-div-jit-untyped.js: Added.
305         * stress/value-div-fixup-int32-big-int.js: Added.
306
307 2018-12-10  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
308
309         [JSC] Optimize Object.keys by caching own keys results in StructureRareData
310         https://bugs.webkit.org/show_bug.cgi?id=190047
311
312         Reviewed by Keith Miller.
313
314         * stress/object-keys-cached-zero.js: Added.
315         (shouldBe):
316         (test):
317         * stress/object-keys-changed-attribute.js: Added.
318         (shouldBe):
319         (test):
320         * stress/object-keys-changed-index.js: Added.
321         (shouldBe):
322         (test):
323         * stress/object-keys-changed.js: Added.
324         (shouldBe):
325         (test):
326         * stress/object-keys-indexed-non-cache.js: Added.
327         (shouldBe):
328         (test):
329         * stress/object-keys-overrides-get-property-names.js: Added.
330         (shouldBe):
331         (test):
332         (noInline):
333
334 2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
335
336         [DFG][FTL] Add NewSymbol
337         https://bugs.webkit.org/show_bug.cgi?id=192620
338
339         Reviewed by Saam Barati.
340
341         * microbenchmarks/symbol-creation.js: Added.
342         (test):
343         * stress/symbol-description-identity.js: Added.
344         (shouldBe):
345         (test):
346         * stress/symbol-identity.js: Added.
347         (shouldBe):
348         (test):
349         * stress/symbol-with-description-throw-error.js: Added.
350         (shouldBe):
351         (shouldThrow):
352         (test):
353         (object.toString):
354
355 2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
356
357         [BigInt] Implement DFG/FTL typeof for BigInt
358         https://bugs.webkit.org/show_bug.cgi?id=192619
359
360         Reviewed by Keith Miller.
361
362         * stress/big-int-boolean-proven-type.js: Added.
363         (assert):
364         (bool):
365         * stress/big-int-type-of-proven-type-non-constant-including-symbol.js: Added.
366         (assert):
367         (typeOf):
368         (i.switch):
369         * stress/big-int-type-of-proven-type-non-constant.js: Added.
370         (assert):
371         (typeOf):
372         * stress/big-int-type-of.js:
373         (typeOf):
374         (func):
375
376 2018-12-10  Mark Lam  <mark.lam@apple.com>
377
378         PropertyAttribute needs a CustomValue bit.
379         https://bugs.webkit.org/show_bug.cgi?id=191993
380         <rdar://problem/46264467>
381
382         Reviewed by Saam Barati.
383
384         * stress/regress-191993.js: Added.
385
386 2018-12-10  Caio Lima  <ticaiolima@gmail.com>
387
388         [BigInt] Add ValueMul into DFG
389         https://bugs.webkit.org/show_bug.cgi?id=186175
390
391         Reviewed by Yusuke Suzuki.
392
393         * stress/big-int-mul-jit-osr.js: Added.
394         * stress/big-int-mul-jit-untyped.js: Added.
395         * stress/value-mul-fixup-int32-big-int.js: Added.
396
397 2018-12-06  Keith Miller  <keith_miller@apple.com>
398
399         stress/big-wasm-memory tests failing on 32-bit JSC bot
400         https://bugs.webkit.org/show_bug.cgi?id=192020
401
402         Reviewed by Saam Barati.
403
404         Not every platform has WebAssembly, e.g. 32-bit, so we should exit
405         the wasm stress tests if the WebAssembly object does not exist.
406
407         * stress/big-wasm-memory-grow-no-max.js:
408         (test.foo):
409         (test):
410         (foo): Deleted.
411         (catch): Deleted.
412         * stress/big-wasm-memory-grow.js:
413         (test.foo):
414         (test):
415         (foo): Deleted.
416         (catch): Deleted.
417         * stress/big-wasm-memory.js:
418         (test.foo):
419         (test):
420         (foo): Deleted.
421         (catch): Deleted.
422
423 2018-12-05  Mark Lam  <mark.lam@apple.com>
424
425         speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
426         https://bugs.webkit.org/show_bug.cgi?id=192441
427         <rdar://problem/46480355>
428
429         Reviewed by Saam Barati.
430
431         * stress/regress-192441.js: Added.
432
433 2018-12-04  Mark Lam  <mark.lam@apple.com>
434
435         DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility.
436         https://bugs.webkit.org/show_bug.cgi?id=192386
437         <rdar://problem/46445516>
438
439         Reviewed by Saam Barati.
440
441         * stress/regress-192386.js: Added.
442
443 2018-12-04  Caio Lima  <ticaiolima@gmail.com>
444
445         [ESNext][BigInt] Support logic operations
446         https://bugs.webkit.org/show_bug.cgi?id=179903
447
448         Reviewed by Yusuke Suzuki.
449
450         * stress/big-int-branch-usage.js: Added.
451         * stress/big-int-logical-and.js: Added.
452         * stress/big-int-logical-not.js: Added.
453         * stress/big-int-logical-or.js: Added.
454
455 2018-12-03  Ryan Haddad  <ryanhaddad@apple.com>
456
457         Unreviewed, rolling out r238833.
458
459         Breaks macOS and iOS debug builds.
460
461         Reverted changeset:
462
463         "[ESNext][BigInt] Support logic operations"
464         https://bugs.webkit.org/show_bug.cgi?id=179903
465         https://trac.webkit.org/changeset/238833
466
467 2018-12-03  Caio Lima  <ticaiolima@gmail.com>
468
469         [ESNext][BigInt] Support logic operations
470         https://bugs.webkit.org/show_bug.cgi?id=179903
471
472         Reviewed by Yusuke Suzuki.
473
474         * stress/big-int-branch-usage.js: Added.
475         * stress/big-int-logical-and.js: Added.
476         * stress/big-int-logical-not.js: Added.
477         * stress/big-int-logical-or.js: Added.
478
479 2018-12-02  Caio Lima  <ticaiolima@gmail.com>
480
481         [ESNext][BigInt] Implement support for "<<" and ">>"
482         https://bugs.webkit.org/show_bug.cgi?id=186233
483
484         Reviewed by Yusuke Suzuki.
485
486         * stress/big-int-left-shift-general.js: Added.
487         * stress/big-int-left-shift-range-error.js: Added.
488         * stress/big-int-left-shift-type-error.js: Added.
489         * stress/big-int-left-shift-wrapped-value.js: Added.
490         * stress/big-int-right-shift-general.js: Added.
491         * stress/big-int-right-shift-type-error.js: Added.
492         * stress/big-int-right-shift-wrapped-value.js: Added.
493         * stress/left-shift-to-primitive-precedence.js: Added.
494         * stress/right-shift-to-primitive-precedence.js: Added.
495
496 2018-11-30  Dean Jackson  <dino@apple.com>
497
498         Add first-class support for .mjs files in jsc binary
499         https://bugs.webkit.org/show_bug.cgi?id=192190
500         <rdar://problem/46375715>
501
502         Reviewed by Keith Miller.
503
504         * stress/simple-module.mjs: Added.
505         * stress/simple-script.js: Added.
506
507 2018-11-30  Caio Lima  <ticaiolima@gmail.com>
508
509         [BigInt] Implement ValueBitXor into DFG
510         https://bugs.webkit.org/show_bug.cgi?id=190264
511
512         Reviewed by Yusuke Suzuki.
513
514         * stress/big-int-bitwise-xor-jit.js: Added.
515         * stress/big-int-bitwise-xor-memory-stress.js: Added.
516         * stress/big-int-bitwise-xor-untyped.js: Added.
517
518 2018-11-27  Saam barati  <sbarati@apple.com>
519
520         r238510 broke scopes of size zero
521         https://bugs.webkit.org/show_bug.cgi?id=192033
522         <rdar://problem/46281734>
523
524         Reviewed by Keith Miller.
525
526         * stress/r238510-bad-loop.js: Added.
527         (foo):
528
529 2018-11-27  Mark Lam  <mark.lam@apple.com>
530
531         [Re-landing] NaNs read from Wasm code needs to be be purified.
532         https://bugs.webkit.org/show_bug.cgi?id=191056
533         <rdar://problem/45660341>
534
535         Reviewed by Filip Pizlo.
536
537         * wasm/regress/regress-191056.js: Added.
538
539 2018-11-27  Ryan Haddad  <ryanhaddad@apple.com>
540
541         Unreviewed, rolling out r238509.
542
543         Causes JSC tests to fail on iOS.
544
545         Reverted changeset:
546
547         "NaNs read from Wasm code needs to be be purified."
548         https://bugs.webkit.org/show_bug.cgi?id=191056
549         https://trac.webkit.org/changeset/238509
550
551 2018-11-26  Caio Lima  <ticaiolima@gmail.com>
552
553         Re-introduce op_bitnot
554         https://bugs.webkit.org/show_bug.cgi?id=190923
555
556         Reviewed by Yusuke Suzuki.
557
558         * stress/bit-not-must-generate.js: Added.
559         * stress/bitwise-not-no-int32.js: Added.
560
561 2018-11-26  Saam barati  <sbarati@apple.com>
562
563         InPlaceAbstractState::endBasicBlock rule for SetLocal should filter the value based on the flush format
564         https://bugs.webkit.org/show_bug.cgi?id=191956
565         <rdar://problem/45665806>
566
567         Reviewed by Yusuke Suzuki.
568
569         * stress/end-basic-block-set-local-should-filter-type.js: Added.
570         (bar):
571         (foo):
572
573 2018-11-26  Saam barati  <sbarati@apple.com>
574
575         Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation
576         https://bugs.webkit.org/show_bug.cgi?id=191958
577         <rdar://problem/46221877>
578
579         Reviewed by Yusuke Suzuki.
580
581         * stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added.
582         (x):
583         (foo):
584
585 2018-11-26  Mark Lam  <mark.lam@apple.com>
586
587         NaNs read from Wasm code needs to be be purified.
588         https://bugs.webkit.org/show_bug.cgi?id=191056
589         <rdar://problem/45660341>
590
591         Reviewed by Filip Pizlo.
592
593         * wasm/regress/regress-191056.js: Added.
594
595 2018-11-26  Michael Saboff  <msaboff@apple.com>
596
597         32-bit JSC test failure: stress/regexp-compile-oom.js
598         https://bugs.webkit.org/show_bug.cgi?id=191375
599
600         Reviewed by Mark Lam.
601
602         Disabled the test for 32 bit platforms.
603
604         * stress/regexp-compile-oom.js:
605
606 2018-11-26  Tadeu Zagallo  <tzagallo@apple.com>
607
608         ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
609         https://bugs.webkit.org/show_bug.cgi?id=191716
610         <rdar://problem/45723878>
611
612         Reviewed by Saam Barati.
613
614         * stress/regress-187373.js: Added.
615         (async.fn):
616
617 2018-11-21  Saam barati  <sbarati@apple.com>
618
619         DFGSpeculativeJIT should not &= exitOK with mayExit(node)
620         https://bugs.webkit.org/show_bug.cgi?id=191897
621         <rdar://problem/45871998>
622
623         Reviewed by Mark Lam.
624
625         * stress/exitok-is-not-the-same-as-mayExit.js: Added.
626         (bar):
627         (foo):
628
629 2018-11-21  Saam barati  <sbarati@apple.com>
630
631         Fix assertion in KnownCellUse inside SpeculativeJIT::speculate
632         https://bugs.webkit.org/show_bug.cgi?id=191895
633         <rdar://problem/46167406>
634
635         Reviewed by Mark Lam.
636
637         * stress/known-cell-use-needs-type-check-assertion.js: Added.
638         (foo):
639         (bar):
640
641 2018-11-21  Mark Lam  <mark.lam@apple.com>
642
643         Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError.
644         https://bugs.webkit.org/show_bug.cgi?id=191776
645         <rdar://problem/46152851>
646
647         Reviewed by Saam Barati.
648
649         * stress/big-wasm-memory-grow-no-max.js:
650         * stress/big-wasm-memory-grow.js:
651         * stress/big-wasm-memory.js:
652         - updated these to expect an OutOfMemoryError.
653
654         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: Added.
655         (Binary.prototype.emit_u8):
656         (Binary.prototype.emit_u32v):
657         (Binary.prototype.emit_header):
658         (Binary.prototype.emit_section):
659         (Binary):
660         (WasmModuleBuilder):
661         (WasmModuleBuilder.prototype.addMemory):
662         (WasmModuleBuilder.prototype.toArray):
663         (WasmModuleBuilder.prototype.toBuffer):
664         (WasmModuleBuilder.prototype.instantiate):
665         (catch):
666         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Added.
667         (catch):
668
669 2018-11-21  Caio Lima  <ticaiolima@gmail.com>
670
671         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
672         https://bugs.webkit.org/show_bug.cgi?id=190836
673
674         Reviewed by Saam Barati and Yusuke Suzuki.
675
676         * stress/big-int-out-of-memory-tests.js: Added.
677
678 2018-11-20  Mark Lam  <mark.lam@apple.com>
679
680         Remove invalid assertion in VMTraps::SignalSender's SignalAction.
681         https://bugs.webkit.org/show_bug.cgi?id=191856
682         <rdar://problem/46089992>
683
684         Reviewed by Yusuke Suzuki.
685
686         * stress/regress-191856.js: Added.
687         - this test is skipped for now until we have a fix for webkit.org/b/191855.
688
689 2018-11-21  Dominik Infuehr  <dinfuehr@igalia.com>
690
691         Enable JIT on ARM/Linux
692         https://bugs.webkit.org/show_bug.cgi?id=191548
693
694         Reviewed by Yusuke Suzuki.
695
696         Disable test on system with limited memory. Program was killed by
697         the OS before the exception was thrown.
698
699         * slowMicrobenchmarks/function-constructor-with-huge-strings.js:
700
701 2018-11-20  Saam barati  <sbarati@apple.com>
702
703         Merging an IC variant may lead to the IC status containing overlapping structure sets
704         https://bugs.webkit.org/show_bug.cgi?id=191869
705         <rdar://problem/45403453>
706
707         Reviewed by Mark Lam.
708
709         * stress/merging-ic-variants-should-bail-if-structures-overlap.js: Added.
710
711 2018-11-19  Mark Lam  <mark.lam@apple.com>
712
713         globalFuncImportModule() should return a promise when it clears exceptions.
714         https://bugs.webkit.org/show_bug.cgi?id=191792
715         <rdar://problem/46090763>
716
717         Reviewed by Michael Saboff.
718
719         * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: Added.
720
721 2018-11-19  Guillaume Emont  <guijemont@igalia.com>
722
723         Skip new memory-hungry tests on memory limited devices
724
725         Unreviewed gardening.
726
727         * stress/big-wasm-memory-grow-no-max.js:
728         * stress/big-wasm-memory-grow.js:
729         * stress/big-wasm-memory.js:
730
731 2018-11-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
732
733         Unreviewed, rolling in the rest of r237254
734         https://bugs.webkit.org/show_bug.cgi?id=190340
735
736         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
737         * stress/function-cache-with-parameters-end-position.js: Added.
738         (shouldBe):
739         (shouldThrow):
740         (i.anonymous):
741         * stress/function-constructor-name.js: Added.
742         (shouldBe):
743         (GeneratorFunction):
744         (AsyncFunction.async):
745         (AsyncGeneratorFunction.async):
746         (anonymous):
747         (async.anonymous):
748         * test262/expectations.yaml:
749
750 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
751
752         All users of ArrayBuffer should agree on the same max size
753         https://bugs.webkit.org/show_bug.cgi?id=191771
754
755         Reviewed by Mark Lam.
756
757         * stress/big-wasm-memory-grow-no-max.js: Added.
758         (foo):
759         (catch):
760         * stress/big-wasm-memory-grow.js: Added.
761         (foo):
762         (catch):
763         * stress/big-wasm-memory.js: Added.
764         (foo):
765         (catch):
766
767 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
768
769         Unreviewed, make some more tests not crash my computer by only running on instance of it. These tests do not need to
770         run for each JSC config since they're regression tests for runtime bugs.
771
772         * stress/json-stringified-overflow-2.js:
773         * stress/json-stringified-overflow.js:
774
775 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
776
777         Unreviewed, make some tests not crash my computer by only running on instance of it. These tests do not need to run for each JSC
778         config since they're regression tests for runtime bugs.
779
780         * stress/large-unshift-splice.js:
781         * stress/regress-185888.js:
782
783 2018-11-16  Saam Barati  <sbarati@apple.com>
784
785         KnownCellUse should also have SpecCellCheck as its type filter
786         https://bugs.webkit.org/show_bug.cgi?id=191729
787         <rdar://problem/45872852>
788
789         Reviewed by Filip Pizlo.
790
791         * stress/known-cell-type-check-should-allow-empty-value-to-flow-through.js: Added.
792         (C):
793
794 2018-11-16  Tadeu Zagallo  <tzagallo@apple.com>
795
796         Fix assertion failure on BytecodeGenerator::recordOpcode
797         https://bugs.webkit.org/show_bug.cgi?id=191724
798         <rdar://problem/45724395>
799
800         Reviewed by Saam Barati.
801
802         * stress/regress-187373-2.js: Added.
803         (foo):
804
805 2018-11-15  Mark Lam  <mark.lam@apple.com>
806
807         RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
808         https://bugs.webkit.org/show_bug.cgi?id=191730
809         <rdar://problem/46048517>
810
811         Reviewed by Saam Barati.
812
813         * stress/regress-187006.js: Removed.
814           - this test is invalid because its sole purpose is to test for the non-spec
815             compliant behavior that we just fixed.
816
817         * stress/regress-191730.js: Added.
818
819 2018-11-15  Mark Lam  <mark.lam@apple.com>
820
821         RegExp operations should not take fast patch if lastIndex is not numeric.
822         https://bugs.webkit.org/show_bug.cgi?id=191731
823         <rdar://problem/46017305>
824
825         Reviewed by Saam Barati.
826
827         * stress/regress-191731.js: Added.
828
829 2018-11-13  Saam Barati  <sbarati@apple.com>
830
831         TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM
832         https://bugs.webkit.org/show_bug.cgi?id=191600
833
834         Reviewed by Mark Lam.
835
836         * stress/type-profiler-log-should-defer-pending-exceptions.js: Added.
837         (foo):
838         (test):
839         (bar):
840
841 2018-11-13  Ryan Haddad  <ryanhaddad@apple.com>
842
843         Unreviewed, rolling out r238132.
844
845         The test added with this change is timing out on Debug JSC
846         bots.
847
848         Reverted changeset:
849
850         "[BigInt] JSBigInt::createWithLength should throw when length
851         is greater than JSBigInt::maxLength"
852         https://bugs.webkit.org/show_bug.cgi?id=190836
853         https://trac.webkit.org/changeset/238132
854
855 2018-11-13  Mark Lam  <mark.lam@apple.com>
856
857         Add OOM detection to StringPrototype's substituteBackreferences().
858         https://bugs.webkit.org/show_bug.cgi?id=191563
859         <rdar://problem/45720428>
860
861         Reviewed by Saam Barati.
862
863         * stress/regress-191563.js: Added.
864
865 2018-11-13  Mark Lam  <mark.lam@apple.com>
866
867         LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame.
868         https://bugs.webkit.org/show_bug.cgi?id=191579
869         <rdar://problem/45942472>
870
871         Reviewed by Saam Barati.
872
873         * stress/regress-191579.js: Added.
874
875 2018-11-13  Caio Lima  <ticaiolima@gmail.com>
876
877         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
878         https://bugs.webkit.org/show_bug.cgi?id=190836
879
880         Reviewed by Saam Barati.
881
882         * stress/big-int-out-of-memory-tests.js: Added.
883
884 2018-11-08  Ross Kirsling  <ross.kirsling@sony.com>
885
886         U+180E is no longer a whitespace character
887         https://bugs.webkit.org/show_bug.cgi?id=191415
888
889         Reviewed by Saam Barati.
890
891         * ChakraCore/test/es5/regexSpace.baseline:
892         * ChakraCore/test/es6/unicode_whitespace.js:
893         Update tests to latest version.
894         (See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.)
895
896         * test262.yaml:
897         * test262/config.yaml:
898         * test262/expectations.yaml:
899         Update expectations.
900
901 2018-11-07  Caio Lima  <ticaiolima@gmail.com>
902
903         [BigInt] Add support to BigInt into ValueAdd
904         https://bugs.webkit.org/show_bug.cgi?id=186177
905
906         Reviewed by Keith Miller.
907
908         * stress/big-int-negate-jit.js:
909         * stress/value-add-big-int-and-string.js: Added.
910         * stress/value-add-big-int-prediction-propagation.js: Added.
911         * stress/value-add-big-int-untyped.js: Added.
912
913 2018-11-07  Tadeu Zagallo  <tzagallo@apple.com>
914
915         REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled
916         https://bugs.webkit.org/show_bug.cgi?id=191184
917
918         Reviewed by Saam Barati.
919
920         Most tests were failing due to timeouts, since they are too slow to
921         run on CLoop. The exceptions are:
922
923         proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop
924         dont-crash-on-stack-overflow-when-parsing-builtin.js and
925         dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had
926         to change the stack size since CLoop requires it to be page aligned.
927
928         * microbenchmarks/array-push-1.js:
929         * microbenchmarks/array-push-2.js:
930         * microbenchmarks/elidable-new-object-dag.js:
931         * microbenchmarks/elidable-new-object-roflcopter.js:
932         * microbenchmarks/elidable-new-object-tree.js:
933         * microbenchmarks/getter-richards.js:
934         * microbenchmarks/sinkable-new-object-dag.js:
935         * microbenchmarks/string-concat-long-convert.js:
936         * microbenchmarks/typed-array-get-set-by-val-profiling.js:
937         * slowMicrobenchmarks/array-push-3.js:
938         * slowMicrobenchmarks/large-map-iteration-with-additions.js:
939         * slowMicrobenchmarks/spread-small-array.js:
940         * slowMicrobenchmarks/undefined-property-access.js:
941         * stress/activation-sink-default-value-tdz-error.js:
942         * stress/activation-sink-default-value.js:
943         * stress/activation-sink-osrexit-default-value-tdz-error.js:
944         * stress/activation-sink-osrexit-default-value.js:
945         * stress/activation-sink-osrexit.js:
946         * stress/activation-sink.js:
947         * stress/allow-math-ic-b3-code-duplication.js:
948         * stress/array-push-multiple-int32.js:
949         * stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js:
950         * stress/arrowfunction-lexical-this-activation-sink-osrexit.js:
951         * stress/arrowfunction-lexical-this-activation-sink.js:
952         * stress/dont-crash-on-stack-overflow-when-parsing-builtin.js:
953         * stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js:
954         * stress/elide-new-object-dag-then-exit.js:
955         * stress/materialize-regexp-cyclic.js:
956         * stress/new-regex-inline.js:
957         * stress/op_add.js:
958         * stress/op_bitand.js:
959         * stress/op_bitor.js:
960         * stress/op_bitxor.js:
961         * stress/op_div-ConstVar.js:
962         * stress/op_div-VarConst.js:
963         * stress/op_div-VarVar.js:
964         * stress/op_lshift-ConstVar.js:
965         * stress/op_lshift-VarConst.js:
966         * stress/op_lshift-VarVar.js:
967         * stress/op_mod-ConstVar.js:
968         * stress/op_mod-VarConst.js:
969         * stress/op_mod-VarVar.js:
970         * stress/op_mul-ConstVar.js:
971         * stress/op_mul-VarConst.js:
972         * stress/op_mul-VarVar.js:
973         * stress/op_rshift-ConstVar.js:
974         * stress/op_rshift-VarConst.js:
975         * stress/op_rshift-VarVar.js:
976         * stress/op_sub-ConstVar.js:
977         * stress/op_sub-VarConst.js:
978         * stress/op_sub-VarVar.js:
979         * stress/op_urshift-ConstVar.js:
980         * stress/op_urshift-VarConst.js:
981         * stress/op_urshift-VarVar.js:
982         * stress/proxy-get-set-correct-receiver.js:
983         * stress/regress-179562.js:
984         * stress/rest-parameter-many-arguments.js:
985         * stress/sampling-profiler-richards.js:
986         * stress/splay-flash-access-1ms.js:
987         * stress/tailCallForwardArguments.js:
988         * stress/typed-array-get-by-val-profiling.js:
989         * typeProfiler/getter-richards.js:
990
991 2018-11-06  Michael Saboff  <msaboff@apple.com>
992
993         Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.
994         https://bugs.webkit.org/show_bug.cgi?id=191271
995
996         Reviewed by Saam Barati.
997
998         Added more test cases and made all test cases run with the same deeply recursive stack
999         instead of finding that same point for each test case.
1000
1001         * stress/regexp-compile-oom.js:
1002         (prototype.runTest):
1003         (recurseAndTest):
1004         (testList.push.new.TestAndExpectedException):
1005
1006 2018-11-05  Michael Saboff  <msaboff@apple.com>
1007
1008         Unreviewed build fix for linux.
1009
1010         * stress/regexp-compile-oom.js: Disabled for non-darwin OSes.
1011
1012 2018-11-02  Michael Saboff  <msaboff@apple.com>
1013
1014         Rolling in r237753 with unreviewed build fix.
1015
1016         Fixed issues with DECLARE_THROW_SCOPE placement.
1017
1018 2018-11-02  Ryan Haddad  <ryanhaddad@apple.com>
1019
1020         Unreviewed, rolling out r237753.
1021
1022         Introduced JSC test failures
1023
1024         Reverted changeset:
1025
1026         "Running out of stack space not properly handled in
1027         RegExp::compile() and its callers"
1028         https://bugs.webkit.org/show_bug.cgi?id=191206
1029         https://trac.webkit.org/changeset/237753
1030
1031 2018-11-02  Michael Saboff  <msaboff@apple.com>
1032
1033         Running out of stack space not properly handled in RegExp::compile() and its callers
1034         https://bugs.webkit.org/show_bug.cgi?id=191206
1035
1036         Reviewed by Filip Pizlo.
1037
1038         New regression test.
1039
1040         * stress/regexp-compile-oom.js: Added.
1041         (recurseAndTest):
1042
1043 2018-11-01  Guillaume Emont  <guijemont@igalia.com>
1044
1045         Skip tests on arm/mips that time out now we're running on CLoop
1046
1047         Unreviewed gardening.
1048
1049         Since the JIT is temporarily disabled on 32-bit platforms, these tests
1050         time out on the bots and need to be disabled. There's more tests
1051         disabled on arm because the timeout is longer on the mips bot (as the
1052         device is slower to start with), so many of the tests don't time out
1053         there.
1054
1055         * microbenchmarks/getter-richards.js: disable on arm and mips.
1056         * stress/op_add.js: disable on arm.
1057         * stress/op_bitand.js: disable on arm.
1058         * stress/op_bitor.js: disable on arm.
1059         * stress/op_bitxor.js: disable on arm.
1060         * stress/op_lshift-ConstVar.js: disable on arm.
1061         * stress/op_lshift-VarConst.js: disable on arm.
1062         * stress/op_lshift-VarVar.js: disable on arm.
1063         * stress/op_mod-ConstVar.js: disable on arm.
1064         * stress/op_mod-VarConst.js: disable on arm.
1065         * stress/op_mod-VarVar.js: disable on arm.
1066         * stress/op_mul-ConstVar.js: disable on arm.
1067         * stress/op_mul-VarConst.js: disable on arm.
1068         * stress/op_mul-VarVar.js: disable on arm.
1069         * stress/op_rshift-ConstVar.js: disable on arm.
1070         * stress/op_rshift-VarConst.js: disable on arm.
1071         * stress/op_rshift-VarVar.js: disable on arm.
1072         * stress/op_sub-ConstVar.js: disable on arm.
1073         * stress/op_sub-VarConst.js: disable on arm.
1074         * stress/op_sub-VarVar.js: disable on arm.
1075         * stress/op_urshift-ConstVar.js: disable on arm.
1076         * stress/op_urshift-VarConst.js: disable on arm.
1077         * stress/op_urshift-VarVar.js: disable on arm.
1078         * stress/spread-forward-call-varargs-stack-overflow.js: disable on arm.
1079         * stress/value-to-boolean.js: disable on arm and mips.
1080
1081 2018-10-31  Tadeu Zagallo  <tzagallo@apple.com>
1082
1083         REGRESSION(r237547): Exception handlers should be aware of wide opcodes
1084         https://bugs.webkit.org/show_bug.cgi?id=191108
1085         <rdar://problem/45690700>
1086
1087         Reviewed by Saam Barati.
1088
1089         * stress/wide-op_catch.js: Added.
1090         (catch):
1091
1092 2018-10-29  Mark Lam  <mark.lam@apple.com>
1093
1094         Correctly detect string overflow when using the 'Function' constructor.
1095         https://bugs.webkit.org/show_bug.cgi?id=184883
1096         <rdar://problem/36320331>
1097
1098         Reviewed by Saam Barati.
1099
1100         I've verified that this passes on 32-bit as well.
1101
1102         * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
1103
1104 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
1105
1106         Add support for GetStack FlushedDouble
1107         https://bugs.webkit.org/show_bug.cgi?id=191012
1108         <rdar://problem/45265141>
1109
1110         Reviewed by Saam Barati.
1111
1112         * stress/get-stack-double.js: Added.
1113         (bar):
1114         (noInline):
1115
1116 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
1117
1118         New bytecode format for JSC
1119         https://bugs.webkit.org/show_bug.cgi?id=187373
1120         <rdar://problem/44186758>
1121
1122         Reviewed by Filip Pizlo.
1123
1124         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
1125
1126         * stress/maximum-inline-capacity.js: Added.
1127         (test1):
1128         (test3.Foo):
1129         (test3):
1130
1131 2018-10-26  Commit Queue  <commit-queue@webkit.org>
1132
1133         Unreviewed, rolling out r237479 and r237484.
1134         https://bugs.webkit.org/show_bug.cgi?id=190978
1135
1136         broke JSC on iOS (Requested by tadeuzagallo on #webkit).
1137
1138         Reverted changesets:
1139
1140         "New bytecode format for JSC"
1141         https://bugs.webkit.org/show_bug.cgi?id=187373
1142         https://trac.webkit.org/changeset/237479
1143
1144         "Gardening: Build fix after r237479."
1145         https://bugs.webkit.org/show_bug.cgi?id=187373
1146         https://trac.webkit.org/changeset/237484
1147
1148 2018-10-26  Tadeu Zagallo  <tzagallo@apple.com>
1149
1150         New bytecode format for JSC
1151         https://bugs.webkit.org/show_bug.cgi?id=187373
1152         <rdar://problem/44186758>
1153
1154         Reviewed by Filip Pizlo.
1155
1156         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
1157
1158         * stress/maximum-inline-capacity.js: Added.
1159         (test1):
1160         (test3.Foo):
1161         (test3):
1162
1163 2018-10-26  Mark Lam  <mark.lam@apple.com>
1164
1165         Fix missing edge cases with JSGlobalObjects having a bad time.
1166         https://bugs.webkit.org/show_bug.cgi?id=189028
1167         <rdar://problem/45204939>
1168
1169         Reviewed by Saam Barati.
1170
1171         * stress/regress-189028.js: Added.
1172
1173 2018-10-22  Mark Lam  <mark.lam@apple.com>
1174
1175         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
1176         https://bugs.webkit.org/show_bug.cgi?id=190515
1177         <rdar://problem/45222379>
1178
1179         Rubber-stamped by Saam Barati.
1180
1181         Adding another test.
1182
1183         * stress/regress-190515-2.js: Added.
1184
1185 2018-10-22  Mark Lam  <mark.lam@apple.com>
1186
1187         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
1188         https://bugs.webkit.org/show_bug.cgi?id=190515
1189         <rdar://problem/45222379>
1190
1191         Reviewed by Saam Barati.
1192
1193         * stress/regress-190515.js: Added.
1194
1195 2018-10-19  Commit Queue  <commit-queue@webkit.org>
1196
1197         Unreviewed, rolling out r237254.
1198         https://bugs.webkit.org/show_bug.cgi?id=190760
1199
1200         "It regresses JetStream 2 by 5% on some iOS devices"
1201         (Requested by saamyjoon on #webkit).
1202
1203         Reverted changeset:
1204
1205         "[JSC] JSC should have "parseFunction" to optimize Function
1206         constructor"
1207         https://bugs.webkit.org/show_bug.cgi?id=190340
1208         https://trac.webkit.org/changeset/237254
1209
1210 2018-10-19  Saam Barati  <sbarati@apple.com>
1211
1212         vmCall should check if we exit before emitting an OSR exit due to exceptions
1213         https://bugs.webkit.org/show_bug.cgi?id=190740
1214         <rdar://problem/45220139>
1215
1216         Reviewed by Mark Lam.
1217
1218         * stress/dont-emit-osr-exits-for-every-call-ftl.js: Added.
1219         (foo):
1220
1221 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
1222
1223         [ESNext][BigInt] Implement support for "^"
1224         https://bugs.webkit.org/show_bug.cgi?id=186235
1225
1226         Reviewed by Yusuke Suzuki.
1227
1228         * stress/big-int-bitwise-xor-general.js: Added.
1229         * stress/big-int-bitwise-xor-to-primitive-precedence.js: Added.
1230         * stress/big-int-bitwise-xor-type-error.js: Added.
1231         * stress/big-int-bitwise-xor-wrapped-value.js: Added.
1232
1233 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
1234
1235         [BigInt] Add ValueSub into DFG
1236         https://bugs.webkit.org/show_bug.cgi?id=186176
1237
1238         Reviewed by Yusuke Suzuki.
1239
1240         * stress/big-int-subtraction-jit.js:
1241         * stress/value-sub-big-int-prediction-propagation.js: Added.
1242         * stress/value-sub-big-int-untyped.js: Added.
1243         * stress/value-sub-spec-none-case.js: Added.
1244
1245 2018-10-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1246
1247         [JSC] JSC should have "parseFunction" to optimize Function constructor
1248         https://bugs.webkit.org/show_bug.cgi?id=190340
1249
1250         Reviewed by Mark Lam.
1251
1252         This patch fixes the line number of syntax errors raised by the Function constructor,
1253         since we now parse the final code only once. And we no longer use block statement
1254         for Function constructor's parsing.
1255
1256         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1257         * stress/function-cache-with-parameters-end-position.js: Added.
1258         (shouldBe):
1259         (shouldThrow):
1260         (i.anonymous):
1261         * stress/function-constructor-name.js: Added.
1262         (shouldBe):
1263         (GeneratorFunction):
1264         (AsyncFunction.async):
1265         (AsyncGeneratorFunction.async):
1266         (anonymous):
1267         (async.anonymous):
1268         * test262/expectations.yaml:
1269
1270 2018-10-18  Commit Queue  <commit-queue@webkit.org>
1271
1272         Unreviewed, rolling out r237242.
1273         https://bugs.webkit.org/show_bug.cgi?id=190701
1274
1275         it breaks "stress/sampling-profiler-basic.js" (Requested by
1276         caiolima on #webkit).
1277
1278         Reverted changeset:
1279
1280         "[BigInt] Add ValueSub into DFG"
1281         https://bugs.webkit.org/show_bug.cgi?id=186176
1282         https://trac.webkit.org/changeset/237242
1283
1284 2018-10-17  Keith Miller  <keith_miller@apple.com>
1285
1286         AI does not clear Phantom allocation nodes.
1287         https://bugs.webkit.org/show_bug.cgi?id=190694
1288
1289         Reviewed by Saam Barati.
1290
1291         * stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added.
1292         (Day):
1293         (DaysInYear):
1294         (TimeInYear):
1295         (TimeFromYear):
1296         (DayFromYear):
1297         (InLeapYear):
1298         (YearFromTime):
1299         (WeekDay):
1300         (DaylightSavingTA):
1301         (GetSecondSundayInMarch):
1302         (TimeInMonth):
1303
1304 2018-10-17  Caio Lima  <ticaiolima@gmail.com>
1305
1306         [BigInt] Add ValueSub into DFG
1307         https://bugs.webkit.org/show_bug.cgi?id=186176
1308
1309         Reviewed by Yusuke Suzuki.
1310
1311         * stress/big-int-subtraction-jit.js:
1312         * stress/value-sub-big-int-prediction-propagation.js: Added.
1313         * stress/value-sub-big-int-untyped.js: Added.
1314
1315 2018-10-16  Dominik Infuehr  <dinfuehr@igalia.com>
1316
1317         [JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips
1318         https://bugs.webkit.org/show_bug.cgi?id=190611
1319
1320         Reviewed by Saam Barati.
1321
1322         Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js
1323         to improve test runtime. On ARM/MIPS this test even timed out when running all
1324         tests.
1325
1326         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
1327         (test):
1328
1329 2018-10-15  Guillaume Emont  <guijemont@igalia.com>
1330
1331         Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux
1332
1333         Unreviewed gardening.
1334
1335         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
1336
1337 2018-10-15  Saam barati  <sbarati@apple.com>
1338
1339         Emit fjcvtzs on ARM64E on Darwin
1340         https://bugs.webkit.org/show_bug.cgi?id=184023
1341
1342         Reviewed by Yusuke Suzuki and Filip Pizlo.
1343
1344         * stress/double-to-int32-NaN.js: Added.
1345         (assert):
1346         (foo):
1347
1348 2018-10-15  Saam Barati  <sbarati@apple.com>
1349
1350         JSArray::shiftCountWithArrayStorage is wrong when an array has holes
1351         https://bugs.webkit.org/show_bug.cgi?id=190262
1352         <rdar://problem/44986241>
1353
1354         Reviewed by Mark Lam.
1355
1356         * stress/array-prototype-concat-of-long-spliced-arrays.js:
1357         (test):
1358         * stress/slice-array-storage-with-holes.js: Added.
1359         (main):
1360
1361 2018-10-15  Commit Queue  <commit-queue@webkit.org>
1362
1363         Unreviewed, rolling out r237054.
1364         https://bugs.webkit.org/show_bug.cgi?id=190593
1365
1366         "this regressed JetStream 2 by 6% on iOS" (Requested by
1367         saamyjoon on #webkit).
1368
1369         Reverted changeset:
1370
1371         "[JSC] JSC should have "parseFunction" to optimize Function
1372         constructor"
1373         https://bugs.webkit.org/show_bug.cgi?id=190340
1374         https://trac.webkit.org/changeset/237054
1375
1376 2018-10-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1377
1378         [JSC] JSON.stringify can accept call-with-no-arguments
1379         https://bugs.webkit.org/show_bug.cgi?id=190343
1380
1381         Reviewed by Mark Lam.
1382
1383         * stress/json-stringify-no-arguments.js: Added.
1384         (shouldBe):
1385
1386 2018-10-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1387
1388         [JSC] JSC should have "parseFunction" to optimize Function constructor
1389         https://bugs.webkit.org/show_bug.cgi?id=190340
1390
1391         Reviewed by Mark Lam.
1392
1393         This patch fixes the line number of syntax errors raised by the Function constructor,
1394         since we now parse the final code only once. And we no longer use block statement
1395         for Function constructor's parsing.
1396
1397         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1398         * stress/function-cache-with-parameters-end-position.js: Added.
1399         (shouldBe):
1400         (shouldThrow):
1401         (i.anonymous):
1402         * stress/function-constructor-name.js: Added.
1403         (shouldBe):
1404         (GeneratorFunction):
1405         (AsyncFunction.async):
1406         (AsyncGeneratorFunction.async):
1407         (anonymous):
1408         (async.anonymous):
1409         * test262/expectations.yaml:
1410
1411 2018-10-10  Guillaume Emont  <guijemont@igalia.com>
1412
1413         Skip JSC test stress/sampling-profiler-richards.js on armv7/linux
1414         https://bugs.webkit.org/show_bug.cgi?id=190426
1415
1416         Unreviewed gardening.
1417
1418         * stress/sampling-profiler-richards.js:
1419
1420 2018-10-06  Caio Lima  <ticaiolima@gmail.com>
1421
1422         [ESNext][BigInt] Implement support for "|"
1423         https://bugs.webkit.org/show_bug.cgi?id=186229
1424
1425         Reviewed by Yusuke Suzuki.
1426
1427         * stress/big-int-bitwise-and-jit.js:
1428         * stress/big-int-bitwise-or-general.js: Added.
1429         * stress/big-int-bitwise-or-jit-untyped.js: Added.
1430         * stress/big-int-bitwise-or-jit.js: Added.
1431         * stress/big-int-bitwise-or-memory-stress.js: Added.
1432         * stress/big-int-bitwise-or-to-primitive-precedence.js: Added.
1433         * stress/big-int-bitwise-or-type-error.js: Added.
1434         * stress/big-int-bitwise-or-wrapped-value.js: Added.
1435
1436 2018-10-05  Dominik Infuehr  <dominik.infuehr@gmail.com>
1437
1438         Skip test on systems with limited memory
1439         https://bugs.webkit.org/show_bug.cgi?id=190310
1440
1441         Invoking runDefault adds test to runlist, skipping the test in the next
1442         line does not prevent the test from executing. Change order of lines such
1443         that runDefault is only executed if test is not executed.
1444
1445         Reviewed by Mark Lam.
1446
1447         * stress/regress-190187.js:
1448
1449 2018-10-03  Saam barati  <sbarati@apple.com>
1450
1451         lowXYZ in FTLLower should always filter the type of the incoming edge
1452         https://bugs.webkit.org/show_bug.cgi?id=189939
1453         <rdar://problem/44407030>
1454
1455         Reviewed by Michael Saboff.
1456
1457         * stress/ftl-should-always-filter-for-low-type-check-functions.js: Added.
1458         (foo):
1459         (test):
1460
1461 2018-10-03  Mark Lam  <mark.lam@apple.com>
1462
1463         Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX.
1464         https://bugs.webkit.org/show_bug.cgi?id=190187
1465         <rdar://problem/42512909>
1466
1467         Reviewed by Michael Saboff.
1468
1469         * stress/regress-190187.js: Added.
1470
1471 2018-10-02  Caio Lima  <ticaiolima@gmail.com>
1472
1473         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
1474         https://bugs.webkit.org/show_bug.cgi?id=190033
1475
1476         Reviewed by Yusuke Suzuki.
1477
1478         * stress/big-int-to-string.js:
1479
1480 2018-10-01  Mark Lam  <mark.lam@apple.com>
1481
1482         Function.toString() should also copy the source code Functions that are class definitions.
1483         https://bugs.webkit.org/show_bug.cgi?id=190186
1484         <rdar://problem/44733360>
1485
1486         Reviewed by Saam Barati.
1487
1488         * stress/regress-190186.js: Added.
1489
1490 2018-10-01  Dominik Infuehr  <dinfuehr@igalia.com>
1491
1492         Split NaN-check into separate test
1493         https://bugs.webkit.org/show_bug.cgi?id=190010
1494
1495         Reviewed by Saam Barati.
1496
1497         DataView exposes NaN-representation, which is not necessarily the same on each
1498         architecture. Therefore move the check of the NaN-representation into its own
1499         file such that we can disable this test on MIPS where NaN-representation can be
1500         different on older CPUs.
1501
1502         * stress/dataview-jit-set-nan.js: Added.
1503         (assert):
1504         (test.storeLittleEndian):
1505         (test.storeBigEndian):
1506         (test.store):
1507         (test):
1508         * stress/dataview-jit-set.js:
1509         (test5):
1510
1511 2018-10-01  Commit Queue  <commit-queue@webkit.org>
1512
1513         Unreviewed, rolling out r236647.
1514         https://bugs.webkit.org/show_bug.cgi?id=190124
1515
1516         Breaking test stress/big-int-to-string.js (Requested by
1517         caiolima_ on #webkit).
1518
1519         Reverted changeset:
1520
1521         "[BigInt] BigInt.proptotype.toString is broken when radix is
1522         power of 2"
1523         https://bugs.webkit.org/show_bug.cgi?id=190033
1524         https://trac.webkit.org/changeset/236647
1525
1526 2018-09-30  Caio Lima  <ticaiolima@gmail.com>
1527
1528         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
1529         https://bugs.webkit.org/show_bug.cgi?id=190033
1530
1531         Reviewed by Yusuke Suzuki.
1532
1533         * stress/big-int-to-string.js:
1534
1535 2018-09-28  Caio Lima  <ticaiolima@gmail.com>
1536
1537         [ESNext][BigInt] Implement support for "&"
1538         https://bugs.webkit.org/show_bug.cgi?id=186228
1539
1540         Reviewed by Yusuke Suzuki.
1541
1542         * stress/big-int-bitwise-and-general.js: Added.
1543         (assert):
1544         (assert.sameValue):
1545         * stress/big-int-bitwise-and-jit.js: Added.
1546         (let.assert.sameValue):
1547         (bigIntBitAnd):
1548         * stress/big-int-bitwise-and-memory-stress.js: Added.
1549         (assert):
1550         * stress/big-int-bitwise-and-to-primitive-precedence.js: Added.
1551         (assert.sameValue):
1552         (let.o.Symbol.toPrimitive):
1553         (catch):
1554         * stress/big-int-bitwise-and-type-error.js: Added.
1555         (assert):
1556         (assertThrowTypeError):
1557         (let.o.valueOf):
1558         (o.valueOf):
1559         (o.toString):
1560         (o.Symbol.toPrimitive):
1561         * stress/big-int-bitwise-and-wrapped-value.js: Added.
1562         (assert.sameValue):
1563         (testBitAnd):
1564         (let.o.Symbol.toPrimitive):
1565         (o.valueOf):
1566         (o.toString):
1567
1568 2018-09-28  Ross Kirsling  <ross.kirsling@sony.com>
1569
1570         JSC test stress/jsc-read.js doesn't support CRLF
1571         https://bugs.webkit.org/show_bug.cgi?id=190063
1572
1573         Reviewed by Yusuke Suzuki.
1574
1575         In order to run this test via Windows command prompt, we can't assume that the final newline will be LF.
1576
1577         * stress/jsc-read.js:
1578         (test):
1579
1580 2018-09-27  Saam barati  <sbarati@apple.com>
1581
1582         Verify the contents of AssemblerBuffer on arm64e
1583         https://bugs.webkit.org/show_bug.cgi?id=190057
1584         <rdar://problem/38916630>
1585
1586         Reviewed by Mark Lam.
1587
1588         * stress/regress-189132.js:
1589
1590 2018-09-27  Dominik Infuehr  <dinfuehr@igalia.com>
1591
1592         Disable test without LLInt on ARMv7
1593         https://bugs.webkit.org/show_bug.cgi?id=190037
1594
1595         Reviewed by Mark Lam.
1596
1597         Test runs out of executable memory on ARMv7, do not run
1598         this test without LLInt enabled.
1599
1600         * stress/regress-169445.js:
1601
1602 2018-09-26  Keith Miller  <keith_miller@apple.com>
1603
1604         We should zero unused property storage when rebalancing array storage.
1605         https://bugs.webkit.org/show_bug.cgi?id=188151
1606
1607         Reviewed by Michael Saboff.
1608
1609         * stress/splice-should-zero-property-storage-when-rebalancing.js: Added.
1610
1611 2018-09-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1612
1613         [JSC] Optimize Array#lastIndexOf
1614         https://bugs.webkit.org/show_bug.cgi?id=189780
1615
1616         Reviewed by Saam Barati.
1617
1618         * stress/array-lastindexof-array-prototype-trap.js: Added.
1619         (shouldBe):
1620         (AncestorArray.prototype.get 2):
1621         (AncestorArray):
1622         * stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added.
1623         (shouldBe):
1624         * stress/array-lastindexof-hole-nan.js: Added.
1625         (shouldBe):
1626         (throw.new.Error):
1627         * stress/array-lastindexof-infinity.js: Added.
1628         (shouldBe):
1629         (throw.new.Error):
1630         * stress/array-lastindexof-negative-zero.js: Added.
1631         (shouldBe):
1632         (throw.new.Error):
1633         * stress/array-lastindexof-own-getter.js: Added.
1634         (shouldBe):
1635         (throw.new.Error.get array):
1636         (get array):
1637         * stress/array-lastindexof-prototype-trap.js: Added.
1638         (shouldBe):
1639         (DerivedArray.prototype.get 2):
1640         (DerivedArray):
1641
1642 2018-09-25  Saam Barati  <sbarati@apple.com>
1643
1644         Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
1645         https://bugs.webkit.org/show_bug.cgi?id=189940
1646         <rdar://problem/43640987>
1647
1648         Reviewed by Mark Lam.
1649
1650         * stress/use-baseline-codeblock-materialize-osr-exit.js: Added.
1651
1652 2018-09-24  Saam Barati  <sbarati@apple.com>
1653
1654         Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects
1655         https://bugs.webkit.org/show_bug.cgi?id=189922
1656         <rdar://problem/44651275>
1657
1658         Reviewed by Mark Lam.
1659
1660         * stress/array-indexof-fast-path-effects.js: Added.
1661         * stress/array-indexof-cached-length.js: Added.
1662
1663 2018-09-24  Saam barati  <sbarati@apple.com>
1664
1665         ArgumentsEliminationPhase should snip basic blocks after proven OSR exits
1666         https://bugs.webkit.org/show_bug.cgi?id=189682
1667         <rdar://problem/43557315>
1668
1669         Reviewed by Mark Lam.
1670
1671         * stress/arguments-elimination-will-generate-edge-without-result.js: Added.
1672         (foo):
1673
1674 2018-09-22  Saam barati  <sbarati@apple.com>
1675
1676         The sampling should not use Strong<CodeBlock> in its machineLocation field
1677         https://bugs.webkit.org/show_bug.cgi?id=189319
1678
1679         Reviewed by Filip Pizlo.
1680
1681         * stress/sampling-profiler-richards.js: Added.
1682
1683 2018-09-19  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1684
1685         [JSC] Optimize Array#indexOf in C++ runtime
1686         https://bugs.webkit.org/show_bug.cgi?id=189507
1687
1688         Reviewed by Saam Barati.
1689
1690         * stress/array-indexof-array-prototype-trap.js: Added.
1691         (shouldBe):
1692         (AncestorArray.prototype.get 2):
1693         (AncestorArray):
1694         * stress/array-indexof-have-a-bad-time-c-runtime.js: Added.
1695         (shouldBe):
1696         * stress/array-indexof-hole-nan.js: Added.
1697         (shouldBe):
1698         (throw.new.Error):
1699         * stress/array-indexof-infinity.js: Added.
1700         (shouldBe):
1701         (throw.new.Error):
1702         * stress/array-indexof-negative-zero.js: Added.
1703         (shouldBe):
1704         (throw.new.Error):
1705         * stress/array-indexof-own-getter.js: Added.
1706         (shouldBe):
1707         (throw.new.Error.get array):
1708         (get array):
1709         * stress/array-indexof-prototype-trap.js: Added.
1710         (shouldBe):
1711         (DerivedArray.prototype.get 2):
1712         (DerivedArray):
1713
1714 2018-09-19  Saam barati  <sbarati@apple.com>
1715
1716         AI rule for MultiPutByOffset executes its effects in the wrong order
1717         https://bugs.webkit.org/show_bug.cgi?id=189757
1718         <rdar://problem/43535257>
1719
1720         Reviewed by Michael Saboff.
1721
1722         * stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
1723         (foo):
1724         (Foo):
1725         (g):
1726
1727 2018-09-17  Mark Lam  <mark.lam@apple.com>
1728
1729         Ensure that ForInContexts are invalidated if their loop local is over-written.
1730         https://bugs.webkit.org/show_bug.cgi?id=189571
1731         <rdar://problem/44402277>
1732
1733         Reviewed by Saam Barati.
1734
1735         * stress/regress-189571.js: Added.
1736
1737 2018-09-17  Saam barati  <sbarati@apple.com>
1738
1739         We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
1740         https://bugs.webkit.org/show_bug.cgi?id=189676
1741         <rdar://problem/39682897>
1742
1743         Reviewed by Michael Saboff.
1744
1745         * typeProfiler/check-structure-or-empty-in-fixup.js: Added.
1746         (A):
1747         (K):
1748         (i.catch):
1749
1750 2018-09-14  Saam barati  <sbarati@apple.com>
1751
1752         Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
1753         https://bugs.webkit.org/show_bug.cgi?id=189628
1754         <rdar://problem/39481690>
1755
1756         Reviewed by Mark Lam.
1757
1758         * stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
1759         (foo):
1760
1761 2018-09-11  Mark Lam  <mark.lam@apple.com>
1762
1763         Test for array initialization in arrayProtoFuncSplice.
1764         https://bugs.webkit.org/show_bug.cgi?id=170253
1765         <rdar://problem/31328773>
1766
1767         Rubber-stamped by Saam Barati.
1768
1769         * stress/regress-170253.js: Added.
1770
1771 2018-09-11  Mark Lam  <mark.lam@apple.com>
1772
1773         Test for IntlObject initialization.
1774         https://bugs.webkit.org/show_bug.cgi?id=170251
1775         <rdar://problem/31328419>
1776
1777         Rubber-stamped by Saam Barati.
1778
1779         * stress/regress-170251.js: Added.
1780
1781 2018-09-11  Mark Lam  <mark.lam@apple.com>
1782
1783         Test for array memcpy'ing when JSGlobalObject::haveABadTime.
1784         https://bugs.webkit.org/show_bug.cgi?id=169889
1785         <rdar://problem/31155607>
1786
1787         Reviewed by Saam Barati.
1788
1789         * stress/regress-169889-array-concat.js: Added.
1790         * stress/regress-169889-array-concat1.js: Added.
1791         * stress/regress-169889-array-slice.js: Added.
1792
1793 2018-09-11  Mark Lam  <mark.lam@apple.com>
1794
1795         Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope.
1796         https://bugs.webkit.org/show_bug.cgi?id=169445
1797         <rdar://problem/30957435>
1798
1799         Reviewed by Saam Barati.
1800
1801         * stress/regress-169445.js: Added.
1802         (let.gun.eval.A):
1803         (let.gun.eval.B.C):
1804         (let.gun.eval.B.C.prototype.trigger):
1805         (let.gun.eval.B.C.prototype.triggerWithRestParameters):
1806         (let.gun.eval.B):
1807         (let.gun.eval):
1808
1809 == Rolled over to ChangeLog-2018-09-11 ==