[JSC] Use KnownStringUse for GetByVal(Array::String) since AI would offer wider type...
[WebKit-https.git] / JSTests / ChangeLog
1 2019-01-15  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
2
3         [JSC] Use KnownStringUse for GetByVal(Array::String) since AI would offer wider type information and offer non-string type after removing Check(String)
4         https://bugs.webkit.org/show_bug.cgi?id=193438
5         <rdar://problem/45581249>
6
7         Reviewed by Saam Barati and Keith Miller.
8
9         Under the heavy load (like, compiling WebKit), AI in this code can broaden type information after the 1st run.
10         Then, GetByVal(String) crashed.
11
12         * stress/string-get-by-val-lowering.js: Added.
13         (shouldBe):
14         (test):
15         * stress/type-for-get-by-val-can-be-widen-after-ai.js: Added.
16         (Hello):
17         (foo):
18
19 2019-01-15  Tomas Popela  <tpopela@redhat.com>
20
21         Unreviewed, skip JIT tests if it's not enabled
22
23         * stress/bit-op-with-object-returning-int32.js:
24
25 2019-01-15  Caio Lima  <ticaiolima@gmail.com>
26
27         DFGByteCodeParser rules for bitwise operations should consider type of their operands
28         https://bugs.webkit.org/show_bug.cgi?id=192966
29
30         Reviewed by Yusuke Suzuki.
31
32         * stress/bit-op-with-object-returning-int32.js: Added.
33
34 2019-01-15  Guillaume Emont  <guijemont@igalia.com>
35
36         Skip a slow test and a flakey test on arm
37
38         Unreviewed gardening.
39
40         * typeProfiler/getter-richards.js:
41         this test always times out, it used to be always skipped on arm and
42         mips, but got accidentally enabled by r237919 now that we have DFG on
43         arm. Also skipping on mips as we plan to soon enable DFG for it too.
44
45 2019-01-14  Keith Miller  <keith_miller@apple.com>
46
47         Skip type-check-hoisting-phase-hoist... with no jit
48         https://bugs.webkit.org/show_bug.cgi?id=193421
49
50         Reviewed by Mark Lam.
51
52         It's timing out the 32-bit bots and takes 330 seconds
53         on my machine when run by itself.
54
55         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js:
56
57 2019-01-14  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
58
59         [JSC] AI should check the given constant's array type when folding GetByVal into constant
60         https://bugs.webkit.org/show_bug.cgi?id=193413
61         <rdar://problem/46092389>
62
63         Reviewed by Keith Miller.
64
65         This test is super flaky. It causes crash in r238109, but it does not crash with `--useConcurrentJIT=false`.
66         It does not cause any crashes on the latest revision too. Basically, it highly depends on the timing, and
67         without this patch, the root cause is not fixed yet. If GetLocal is turned into JSConstant in AI,
68         but GetByVal does not have appropriate ArrayModes, JSC crashes.
69
70         * stress/ai-should-perform-array-check-on-get-by-val-constant-folding.js: Added.
71         (compareArray):
72
73 2019-01-14  Caio Lima  <ticaiolima@gmail.com>
74
75         [BigInt] Literal parsing is crashing when used inside a Object Literal
76         https://bugs.webkit.org/show_bug.cgi?id=193404
77
78         Reviewed by Yusuke Suzuki.
79
80         * stress/big-int-literal-inside-literal-object.js: Added.
81
82 2019-01-14  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
83
84         [JSC] Do not use asArrayModes() with Structures because it discards TypedArray information
85         https://bugs.webkit.org/show_bug.cgi?id=193372
86
87         Reviewed by Saam Barati.
88
89         * stress/typed-array-array-modes-profile.js: Added.
90         (foo):
91
92 2019-01-14  Mark Lam  <mark.lam@apple.com>
93
94         Fix all CLoop JSC test failures (including some LLInt bugs due to recent bytecode format change).
95         https://bugs.webkit.org/show_bug.cgi?id=193402
96         <rdar://problem/46012309>
97
98         Reviewed by Keith Miller.
99
100         * stress/regexp-compile-oom.js:
101         - Skip this test for !$jitTests because it is tuned for stack usage when the JIT
102           is enabled.  As a result, it will fail on cloop builds though there is no bug.
103
104 2019-01-11  Saam barati  <sbarati@apple.com>
105
106         DFG combined liveness can be wrong for terminal basic blocks
107         https://bugs.webkit.org/show_bug.cgi?id=193304
108         <rdar://problem/45268632>
109
110         Reviewed by Yusuke Suzuki.
111
112         * stress/dfg-combined-liveness-consider-terminal-blocks-bytecode-liveness.js: Added.
113
114 2019-01-11  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
115
116         [JSC] Global lexical bindings can shadow global variables if it is `configurable = true`
117         https://bugs.webkit.org/show_bug.cgi?id=193308
118         <rdar://problem/45546542>
119
120         Reviewed by Saam Barati.
121
122         * stress/const-lexical-binding-shadow-existing-global-property-ftl.js: Added.
123         (shouldThrow):
124         (shouldBe):
125         (foo):
126         (get shouldThrow):
127         * stress/const-lexical-binding-shadow-existing-global-property-tdz-ftl.js: Added.
128         (shouldThrow):
129         (shouldBe):
130         (foo):
131         (get shouldBe):
132         (get shouldThrow):
133         (get return):
134         * stress/const-lexical-binding-shadow-existing-global-property-tdz.js: Added.
135         (shouldThrow):
136         (shouldBe):
137         (foo):
138         (get shouldBe):
139         (get shouldThrow):
140         * stress/const-lexical-binding-shadow-existing-global-property.js: Added.
141         (shouldThrow):
142         (shouldBe):
143         (foo):
144         * stress/const-lexical-binding-shadowing-global-properties-and-eval-injection.js: Added.
145         (shouldThrow):
146         (shouldBe):
147         (foo):
148         * stress/global-add-function-should-not-be-shadowed-by-lexical-bindings.js: Added.
149         (shouldThrow):
150         * stress/global-static-variables-should-not-be-shadowed-by-lexical-bindings.js: Added.
151         (shouldThrow):
152         * stress/let-lexical-binding-shadow-existing-global-property-ftl.js: Added.
153         (shouldThrow):
154         (shouldBe):
155         (foo):
156         * stress/let-lexical-binding-shadow-existing-global-property-tdz-ftl.js: Added.
157         (shouldThrow):
158         (shouldBe):
159         (foo):
160         (get shouldBe):
161         (get shouldThrow):
162         (get return):
163         * stress/let-lexical-binding-shadow-existing-global-property-tdz.js: Added.
164         (shouldThrow):
165         (shouldBe):
166         (foo):
167         (get shouldBe):
168         (get shouldThrow):
169         * stress/let-lexical-binding-shadow-existing-global-property.js: Added.
170         (shouldThrow):
171         (shouldBe):
172         (foo):
173         * stress/let-lexical-binding-shadowing-global-properties-and-eval-injection.js: Added.
174         (shouldThrow):
175         (shouldBe):
176         (foo):
177
178 2019-01-11  Dominik Infuehr  <dinfuehr@igalia.com>
179
180         Enable DFG on ARM/Linux again
181         https://bugs.webkit.org/show_bug.cgi?id=192496
182
183         Reviewed by Yusuke Suzuki.
184
185         Test wasn't really skipped before moving the line with skip
186         to the top.
187
188         * stress/regress-192717.js:
189
190 2019-01-10  Commit Queue  <commit-queue@webkit.org>
191
192         Unreviewed, rolling out r239825.
193         https://bugs.webkit.org/show_bug.cgi?id=193330
194
195         Broke tests on armv7/linux bots (Requested by guijemont on
196         #webkit).
197
198         Reverted changeset:
199
200         "Enable DFG on ARM/Linux again"
201         https://bugs.webkit.org/show_bug.cgi?id=192496
202         https://trac.webkit.org/changeset/239825
203
204 2019-01-10  Dominik Infuehr  <dinfuehr@igalia.com>
205
206         Enable DFG on ARM/Linux again
207         https://bugs.webkit.org/show_bug.cgi?id=192496
208
209         Reviewed by Yusuke Suzuki.
210
211         Test wasn't really skipped before moving the line with skip
212         to the top.
213
214         * stress/regress-192717.js:
215
216 2019-01-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
217
218         Array.prototype.flat/flatMap have a minor bug in ArraySpeciesCreate
219         https://bugs.webkit.org/show_bug.cgi?id=193127
220
221         Reviewed by Saam Barati.
222
223         * stress/array-species-create-should-handle-masquerader.js: Added.
224         (shouldThrow):
225         * stress/is-undefined-or-null-builtin.js: Added.
226         (shouldBe):
227         (isUndefinedOrNull.vm.createBuiltin):
228
229 2019-01-08  Tadeu Zagallo  <tzagallo@apple.com>
230
231         LLInt put_by_id uses the wrong load instruction for loading flags from the metadata
232         https://bugs.webkit.org/show_bug.cgi?id=193221
233
234         Reviewed by Mark Lam.
235
236         * stress/put-by-id-flags.js: Added.
237         (f):
238         (g):
239         (numberOfDFGCompiles):
240
241 2019-01-04  Tadeu Zagallo  <tzagallo@apple.com>
242
243         Baseline version of get_by_id may corrupt metadata
244         https://bugs.webkit.org/show_bug.cgi?id=193085
245         <rdar://problem/23453006>
246
247         Reviewed by Saam Barati.
248
249         * stress/get-by-id-change-mode.js: Added.
250         (forEach):
251
252 2019-01-02  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
253
254         [JSC] Optimize Object.prototype.toString
255         https://bugs.webkit.org/show_bug.cgi?id=193031
256
257         Reviewed by Saam Barati.
258
259         * stress/object-tostring-changed-proto.js: Added.
260         (shouldBe):
261         (test):
262         * stress/object-tostring-changed.js: Added.
263         (shouldBe):
264         (test):
265         * stress/object-tostring-misc.js: Added.
266         (shouldBe):
267         (test):
268         (i.switch):
269         * stress/object-tostring-other.js: Added.
270         (shouldBe):
271         (test):
272         * stress/object-tostring-untyped.js: Added.
273         (shouldBe):
274         (test):
275         (i.switch):
276
277 2019-01-03  Ross Kirsling  <ross.kirsling@sony.com>
278
279         test262-runner misbehaves when test file YAML has a trailing space
280         https://bugs.webkit.org/show_bug.cgi?id=193053
281
282         Reviewed by Yusuke Suzuki.
283
284         * test262/expectations.yaml:
285         Mark two dozen tests as passing (and correct the output of another).
286
287 2018-12-30  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
288
289         Unreviewed, JSTests gardening with memoryLimited
290
291         * stress/string-overflow-createError.js:
292
293 2018-12-30  Ross Kirsling  <ross.kirsling@sony.com>
294
295         [JSC] Identifier validity should be based on ID_Start / ID_Continue properties
296         https://bugs.webkit.org/show_bug.cgi?id=193050
297
298         Reviewed by Yusuke Suzuki.
299
300         * test262.yaml:
301         * test262/expectations.yaml:
302         Mark 16 tests as passing.
303
304 2018-12-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
305
306         [BigInt] Support BigInt in JSON.stringify
307         https://bugs.webkit.org/show_bug.cgi?id=192624
308
309         Reviewed by Saam Barati.
310
311         * stress/big-int-json-stringify-to-json.js: Added.
312         (shouldBe):
313         (shouldThrow):
314         (BigInt.prototype.toJSON):
315         (shouldBe.JSON.stringify):
316         * stress/big-int-json-stringify.js: Added.
317         (shouldBe):
318         (shouldThrow):
319
320 2018-12-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
321
322         [JSC] Implement "well-formed JSON.stringify" proposal
323         https://bugs.webkit.org/show_bug.cgi?id=191677
324
325         Reviewed by Darin Adler.
326
327         * stress/json-surrogate-pair.js: Added.
328         (shouldBe):
329         * test262/expectations.yaml:
330
331 2018-12-20  Keith Miller  <keith_miller@apple.com>
332
333         Add support for globalThis
334         https://bugs.webkit.org/show_bug.cgi?id=165171
335
336         Reviewed by Mark Lam.
337
338         * test262/config.yaml:
339
340 2018-12-19  Keith Miller  <keith_miller@apple.com>
341
342         Update test262 configuration to not run tests dependent on ICU version.
343         https://bugs.webkit.org/show_bug.cgi?id=192920
344
345         Reviewed by Saam Barati.
346
347         * test262/expectations.yaml:
348
349 2018-12-20  Mark Lam  <mark.lam@apple.com>
350
351         Fix a typo in slow_path_construct_arityCheck and operationConstructArityCheck.
352         https://bugs.webkit.org/show_bug.cgi?id=192939
353         <rdar://problem/46869516>
354
355         Reviewed by Keith Miller.
356
357         * stress/stack-overflow-frame-for-construct-arityCheck-should-use-construct-codeBlock.js: Added.
358
359 2018-12-20  Tadeu Zagallo  <tzagallo@apple.com>
360
361         WTF::String and StringImpl overflow MaxLength
362         https://bugs.webkit.org/show_bug.cgi?id=192853
363         <rdar://problem/45726906>
364
365         Reviewed by Mark Lam.
366
367         * stress/string-16bit-repeat-overflow.js: Added.
368         (catch):
369
370 2018-12-19  Ross Kirsling  <ross.kirsling@sony.com>
371
372         Unreviewed follow-up to r192914.
373
374         * test262/expectations.yaml:
375         Add the last 20 missing expectations.
376
377 2018-12-19  Keith Miller  <keith_miller@apple.com>
378
379         Fix test262 expectations
380         https://bugs.webkit.org/show_bug.cgi?id=192914
381
382         Unreviewed, when I imported the latest round of test262 tests I must have failed to update the test expectations.
383
384         * test262/expectations.yaml:
385
386 2018-12-19  Keith Miller  <keith_miller@apple.com>
387
388         Update test262 tests.
389         https://bugs.webkit.org/show_bug.cgi?id=192907
390
391         Rubber stamped by Mark Lam.
392
393         * test262/*: Omitted because prepare-changelog crashes.
394
395 2018-12-19  Mark Lam  <mark.lam@apple.com>
396
397         JSPropertyNameEnumerator should cache the iterated object's structure only after getting its property names.
398         https://bugs.webkit.org/show_bug.cgi?id=192464
399         <rdar://problem/46519455>
400
401         Reviewed by Saam Barati.
402
403         This patch is about a 10% speed up on the new for-in-on-object-with-lazily-materialized-properties.js
404         microbenchmark.
405
406         * microbenchmarks/for-in-on-object-with-lazily-materialized-properties.js: Added.
407         * stress/property-name-enumerator-should-cache-structure-after-getting-property-names.js: Added.
408
409 2018-12-19  Tadeu Zagallo  <tzagallo@apple.com>
410
411         String overflow in JSC::createError results in ASSERT in WTF::makeString
412         https://bugs.webkit.org/show_bug.cgi?id=192833
413         <rdar://problem/45706868>
414
415         Reviewed by Mark Lam.
416
417         * stress/string-overflow-createError.js: Added.
418
419 2018-12-18  Ross Kirsling  <ross.kirsling@sony.com>
420
421         Error message for `-x ** y` contains a typo.
422         https://bugs.webkit.org/show_bug.cgi?id=192832
423
424         Reviewed by Saam Barati.
425
426         * ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
427         (assert.assert.return.throws):
428         * stress/pow-expects-update-expression-on-lhs.js:
429         (throw.new.Error):
430         Update test expectations which match against the exact error message.
431
432 2018-12-18  Mark Lam  <mark.lam@apple.com>
433
434         Gardening: test options fix.
435         https://bugs.webkit.org/show_bug.cgi?id=192822
436
437         Unreviewed.
438
439         * stress/json-stringify-string-builder-overflow.js:
440
441 2018-12-18  Mark Lam  <mark.lam@apple.com>
442
443         JSON.stringify() should throw OOM on StringBuilder overflows.
444         https://bugs.webkit.org/show_bug.cgi?id=192822
445         <rdar://problem/46670577>
446
447         Reviewed by Saam Barati.
448
449         * stress/json-stringify-string-builder-overflow.js: Added.
450
451 2018-12-18  Ross Kirsling  <ross.kirsling@sony.com>
452
453         Redeclaration of var over let/const/class should be a syntax error.
454         https://bugs.webkit.org/show_bug.cgi?id=192298
455
456         Reviewed by Keith Miller.
457
458         * test262.yaml:
459         * test262/expectations.yaml:
460         Mark 46 tests as passing.
461
462         * stress/block-scope-redeclarations.js:
463         Add some new tests.
464
465         * stress/for-in-invalidate-context-weird-assignments.js:
466         * stress/for-in-tests.js:
467         Replace tests for outdated behavior with tests for SyntaxError.
468
469         * ChakraCore/test/LetConst/defer3.baseline-jsc:
470         * ChakraCore/test/LetConst/letvar.baseline-jsc:
471         Update expectations.
472
473 2018-12-18  Mark Lam  <mark.lam@apple.com>
474
475         Skip the stress/elidable-new-object-roflcopter-then-exit.js test on 32-bit.
476         https://bugs.webkit.org/show_bug.cgi?id=191374
477         <rdar://problem/46525447>
478
479         Reviewed by Yusuke Suzuki.
480
481         This test runs too slow on 32-bit, and is not relevant for non-JIT builds.
482
483         * stress/elidable-new-object-roflcopter-then-exit.js:
484
485 2018-12-17  Mark Lam  <mark.lam@apple.com>
486
487         Skip the stress/materialized-regexp-has-correct-last-index-set-by-match.js test on 32-bit.
488         https://bugs.webkit.org/show_bug.cgi?id=192019
489         <rdar://problem/46525456>
490
491         Reviewed by Yusuke Suzuki.
492
493         The test runs too slow on 32-bit.
494
495         * stress/materialized-regexp-has-correct-last-index-set-by-match.js:
496
497 2018-12-17  Mark Lam  <mark.lam@apple.com>
498
499         Skip the stress/materialize-regexp-cyclic-regexp.js test on 32-bit.
500         https://bugs.webkit.org/show_bug.cgi?id=191373
501         <rdar://problem/46525458>
502
503         Reviewed by Yusuke Suzuki.
504
505         The test is already slow running with a JIT on 64-bit.  It will always timeout
506         on 32-bit without a JIT.
507
508         * stress/materialize-regexp-cyclic-regexp.js:
509
510 2018-12-17  Mark Lam  <mark.lam@apple.com>
511
512         Array unshift/shift should not race against the AI in the compiler thread.
513         https://bugs.webkit.org/show_bug.cgi?id=192795
514         <rdar://problem/46724263>
515
516         Reviewed by Saam Barati.
517
518         * stress/array-unshift-should-not-race-against-compiler-thread.js: Added.
519
520 2018-12-16  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
521
522         [JSC] Optimize Object.keys by caching own keys results in StructureRareData
523         https://bugs.webkit.org/show_bug.cgi?id=190047
524
525         Reviewed by Saam Barati.
526
527         * stress/object-keys-cached-zero.js: Added.
528         (shouldBe):
529         (test):
530         * stress/object-keys-changed-attribute.js: Added.
531         (shouldBe):
532         (test):
533         * stress/object-keys-changed-index.js: Added.
534         (shouldBe):
535         (test):
536         * stress/object-keys-changed.js: Added.
537         (shouldBe):
538         (test):
539         * stress/object-keys-indexed-non-cache.js: Added.
540         (shouldBe):
541         (test):
542         * stress/object-keys-overrides-get-property-names.js: Added.
543         (shouldBe):
544         (test):
545         (noInline):
546
547 2018-12-17  Mark Lam  <mark.lam@apple.com>
548
549         SamplingProfiler's isValidFramePointer() should reject address at stack origin.
550         https://bugs.webkit.org/show_bug.cgi?id=192779
551         <rdar://problem/46775869>
552
553         Reviewed by Saam Barati.
554
555         * stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js: Added.
556
557 2018-12-17  Ryan Haddad  <ryanhaddad@apple.com>
558
559         Unreviewed test gardening, address a syntax error in a new test.
560
561         * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js:
562
563 2018-12-17  Mark Lam  <mark.lam@apple.com>
564
565         Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit().
566         https://bugs.webkit.org/show_bug.cgi?id=192776
567         <rdar://problem/46772368>
568
569         Reviewed by Keith Miller.
570
571         * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js: Added.
572
573 2018-12-17  Mark Lam  <mark.lam@apple.com>
574
575         Fix stale assertion in attemptToForceStringArrayModeByToStringConversion().
576         https://bugs.webkit.org/show_bug.cgi?id=192770
577         <rdar://problem/46449037>
578
579         Reviewed by Keith Miller.
580
581         * stress/force-string-arrayMode-on-originalNonArray-array-class.js: Added.
582
583 2018-12-14  Mark Lam  <mark.lam@apple.com>
584
585         CallFrame::convertToStackOverflowFrame() needs to keep the top CodeBlock alive.
586         https://bugs.webkit.org/show_bug.cgi?id=192717
587         <rdar://problem/46660677>
588
589         Reviewed by Saam Barati.
590
591         * stress/regress-192717.js: Added.
592
593 2018-12-14  Commit Queue  <commit-queue@webkit.org>
594
595         Unreviewed, rolling out r239153, r239154, and r239155.
596         https://bugs.webkit.org/show_bug.cgi?id=192715
597
598         Caused flaky GC-related crashes seen with layout tests
599         (Requested by ryanhaddad on #webkit).
600
601         Reverted changesets:
602
603         "[JSC] Optimize Object.keys by caching own keys results in
604         StructureRareData"
605         https://bugs.webkit.org/show_bug.cgi?id=190047
606         https://trac.webkit.org/changeset/239153
607
608         "Unreviewed, build fix after r239153"
609         https://bugs.webkit.org/show_bug.cgi?id=190047
610         https://trac.webkit.org/changeset/239154
611
612         "Unreviewed, build fix after r239153, part 2"
613         https://bugs.webkit.org/show_bug.cgi?id=190047
614         https://trac.webkit.org/changeset/239155
615
616 2018-12-14  Keith Miller  <keith_miller@apple.com>
617
618         Callers of JSString::getIndex should check for OOM exceptions
619         https://bugs.webkit.org/show_bug.cgi?id=192709
620
621         Reviewed by Mark Lam.
622
623         * stress/StringObject-define-length-getter-rope-string-oom.js: Added.
624
625 2018-12-13  Mark Lam  <mark.lam@apple.com>
626
627         Add a missing exception check.
628         https://bugs.webkit.org/show_bug.cgi?id=192626
629         <rdar://problem/46662163>
630
631         Reviewed by Keith Miller.
632
633         * stress/regress-192626.js: Added.
634
635 2018-12-13  Caio Lima  <ticaiolima@gmail.com>
636
637         [BigInt] Add ValueDiv into DFG
638         https://bugs.webkit.org/show_bug.cgi?id=186178
639
640         Reviewed by Yusuke Suzuki.
641
642         * stress/big-int-div-jit-osr.js: Added.
643         * stress/big-int-div-jit-untyped.js: Added.
644         * stress/value-div-fixup-int32-big-int.js: Added.
645
646 2018-12-10  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
647
648         [JSC] Optimize Object.keys by caching own keys results in StructureRareData
649         https://bugs.webkit.org/show_bug.cgi?id=190047
650
651         Reviewed by Keith Miller.
652
653         * stress/object-keys-cached-zero.js: Added.
654         (shouldBe):
655         (test):
656         * stress/object-keys-changed-attribute.js: Added.
657         (shouldBe):
658         (test):
659         * stress/object-keys-changed-index.js: Added.
660         (shouldBe):
661         (test):
662         * stress/object-keys-changed.js: Added.
663         (shouldBe):
664         (test):
665         * stress/object-keys-indexed-non-cache.js: Added.
666         (shouldBe):
667         (test):
668         * stress/object-keys-overrides-get-property-names.js: Added.
669         (shouldBe):
670         (test):
671         (noInline):
672
673 2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
674
675         [DFG][FTL] Add NewSymbol
676         https://bugs.webkit.org/show_bug.cgi?id=192620
677
678         Reviewed by Saam Barati.
679
680         * microbenchmarks/symbol-creation.js: Added.
681         (test):
682         * stress/symbol-description-identity.js: Added.
683         (shouldBe):
684         (test):
685         * stress/symbol-identity.js: Added.
686         (shouldBe):
687         (test):
688         * stress/symbol-with-description-throw-error.js: Added.
689         (shouldBe):
690         (shouldThrow):
691         (test):
692         (object.toString):
693
694 2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
695
696         [BigInt] Implement DFG/FTL typeof for BigInt
697         https://bugs.webkit.org/show_bug.cgi?id=192619
698
699         Reviewed by Keith Miller.
700
701         * stress/big-int-boolean-proven-type.js: Added.
702         (assert):
703         (bool):
704         * stress/big-int-type-of-proven-type-non-constant-including-symbol.js: Added.
705         (assert):
706         (typeOf):
707         (i.switch):
708         * stress/big-int-type-of-proven-type-non-constant.js: Added.
709         (assert):
710         (typeOf):
711         * stress/big-int-type-of.js:
712         (typeOf):
713         (func):
714
715 2018-12-10  Mark Lam  <mark.lam@apple.com>
716
717         PropertyAttribute needs a CustomValue bit.
718         https://bugs.webkit.org/show_bug.cgi?id=191993
719         <rdar://problem/46264467>
720
721         Reviewed by Saam Barati.
722
723         * stress/regress-191993.js: Added.
724
725 2018-12-10  Caio Lima  <ticaiolima@gmail.com>
726
727         [BigInt] Add ValueMul into DFG
728         https://bugs.webkit.org/show_bug.cgi?id=186175
729
730         Reviewed by Yusuke Suzuki.
731
732         * stress/big-int-mul-jit-osr.js: Added.
733         * stress/big-int-mul-jit-untyped.js: Added.
734         * stress/value-mul-fixup-int32-big-int.js: Added.
735
736 2018-12-06  Keith Miller  <keith_miller@apple.com>
737
738         stress/big-wasm-memory tests failing on 32-bit JSC bot
739         https://bugs.webkit.org/show_bug.cgi?id=192020
740
741         Reviewed by Saam Barati.
742
743         Not every platform has WebAssembly, e.g. 32-bit, so we should exit
744         the wasm stress tests if the WebAssembly object does not exist.
745
746         * stress/big-wasm-memory-grow-no-max.js:
747         (test.foo):
748         (test):
749         (foo): Deleted.
750         (catch): Deleted.
751         * stress/big-wasm-memory-grow.js:
752         (test.foo):
753         (test):
754         (foo): Deleted.
755         (catch): Deleted.
756         * stress/big-wasm-memory.js:
757         (test.foo):
758         (test):
759         (foo): Deleted.
760         (catch): Deleted.
761
762 2018-12-05  Mark Lam  <mark.lam@apple.com>
763
764         speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
765         https://bugs.webkit.org/show_bug.cgi?id=192441
766         <rdar://problem/46480355>
767
768         Reviewed by Saam Barati.
769
770         * stress/regress-192441.js: Added.
771
772 2018-12-04  Mark Lam  <mark.lam@apple.com>
773
774         DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility.
775         https://bugs.webkit.org/show_bug.cgi?id=192386
776         <rdar://problem/46445516>
777
778         Reviewed by Saam Barati.
779
780         * stress/regress-192386.js: Added.
781
782 2018-12-04  Caio Lima  <ticaiolima@gmail.com>
783
784         [ESNext][BigInt] Support logic operations
785         https://bugs.webkit.org/show_bug.cgi?id=179903
786
787         Reviewed by Yusuke Suzuki.
788
789         * stress/big-int-branch-usage.js: Added.
790         * stress/big-int-logical-and.js: Added.
791         * stress/big-int-logical-not.js: Added.
792         * stress/big-int-logical-or.js: Added.
793
794 2018-12-03  Ryan Haddad  <ryanhaddad@apple.com>
795
796         Unreviewed, rolling out r238833.
797
798         Breaks macOS and iOS debug builds.
799
800         Reverted changeset:
801
802         "[ESNext][BigInt] Support logic operations"
803         https://bugs.webkit.org/show_bug.cgi?id=179903
804         https://trac.webkit.org/changeset/238833
805
806 2018-12-03  Caio Lima  <ticaiolima@gmail.com>
807
808         [ESNext][BigInt] Support logic operations
809         https://bugs.webkit.org/show_bug.cgi?id=179903
810
811         Reviewed by Yusuke Suzuki.
812
813         * stress/big-int-branch-usage.js: Added.
814         * stress/big-int-logical-and.js: Added.
815         * stress/big-int-logical-not.js: Added.
816         * stress/big-int-logical-or.js: Added.
817
818 2018-12-02  Caio Lima  <ticaiolima@gmail.com>
819
820         [ESNext][BigInt] Implement support for "<<" and ">>"
821         https://bugs.webkit.org/show_bug.cgi?id=186233
822
823         Reviewed by Yusuke Suzuki.
824
825         * stress/big-int-left-shift-general.js: Added.
826         * stress/big-int-left-shift-range-error.js: Added.
827         * stress/big-int-left-shift-type-error.js: Added.
828         * stress/big-int-left-shift-wrapped-value.js: Added.
829         * stress/big-int-right-shift-general.js: Added.
830         * stress/big-int-right-shift-type-error.js: Added.
831         * stress/big-int-right-shift-wrapped-value.js: Added.
832         * stress/left-shift-to-primitive-precedence.js: Added.
833         * stress/right-shift-to-primitive-precedence.js: Added.
834
835 2018-11-30  Dean Jackson  <dino@apple.com>
836
837         Add first-class support for .mjs files in jsc binary
838         https://bugs.webkit.org/show_bug.cgi?id=192190
839         <rdar://problem/46375715>
840
841         Reviewed by Keith Miller.
842
843         * stress/simple-module.mjs: Added.
844         * stress/simple-script.js: Added.
845
846 2018-11-30  Caio Lima  <ticaiolima@gmail.com>
847
848         [BigInt] Implement ValueBitXor into DFG
849         https://bugs.webkit.org/show_bug.cgi?id=190264
850
851         Reviewed by Yusuke Suzuki.
852
853         * stress/big-int-bitwise-xor-jit.js: Added.
854         * stress/big-int-bitwise-xor-memory-stress.js: Added.
855         * stress/big-int-bitwise-xor-untyped.js: Added.
856
857 2018-11-27  Saam barati  <sbarati@apple.com>
858
859         r238510 broke scopes of size zero
860         https://bugs.webkit.org/show_bug.cgi?id=192033
861         <rdar://problem/46281734>
862
863         Reviewed by Keith Miller.
864
865         * stress/r238510-bad-loop.js: Added.
866         (foo):
867
868 2018-11-27  Mark Lam  <mark.lam@apple.com>
869
870         [Re-landing] NaNs read from Wasm code needs to be be purified.
871         https://bugs.webkit.org/show_bug.cgi?id=191056
872         <rdar://problem/45660341>
873
874         Reviewed by Filip Pizlo.
875
876         * wasm/regress/regress-191056.js: Added.
877
878 2018-11-27  Ryan Haddad  <ryanhaddad@apple.com>
879
880         Unreviewed, rolling out r238509.
881
882         Causes JSC tests to fail on iOS.
883
884         Reverted changeset:
885
886         "NaNs read from Wasm code needs to be be purified."
887         https://bugs.webkit.org/show_bug.cgi?id=191056
888         https://trac.webkit.org/changeset/238509
889
890 2018-11-26  Caio Lima  <ticaiolima@gmail.com>
891
892         Re-introduce op_bitnot
893         https://bugs.webkit.org/show_bug.cgi?id=190923
894
895         Reviewed by Yusuke Suzuki.
896
897         * stress/bit-not-must-generate.js: Added.
898         * stress/bitwise-not-no-int32.js: Added.
899
900 2018-11-26  Saam barati  <sbarati@apple.com>
901
902         InPlaceAbstractState::endBasicBlock rule for SetLocal should filter the value based on the flush format
903         https://bugs.webkit.org/show_bug.cgi?id=191956
904         <rdar://problem/45665806>
905
906         Reviewed by Yusuke Suzuki.
907
908         * stress/end-basic-block-set-local-should-filter-type.js: Added.
909         (bar):
910         (foo):
911
912 2018-11-26  Saam barati  <sbarati@apple.com>
913
914         Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation
915         https://bugs.webkit.org/show_bug.cgi?id=191958
916         <rdar://problem/46221877>
917
918         Reviewed by Yusuke Suzuki.
919
920         * stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added.
921         (x):
922         (foo):
923
924 2018-11-26  Mark Lam  <mark.lam@apple.com>
925
926         NaNs read from Wasm code needs to be be purified.
927         https://bugs.webkit.org/show_bug.cgi?id=191056
928         <rdar://problem/45660341>
929
930         Reviewed by Filip Pizlo.
931
932         * wasm/regress/regress-191056.js: Added.
933
934 2018-11-26  Michael Saboff  <msaboff@apple.com>
935
936         32-bit JSC test failure: stress/regexp-compile-oom.js
937         https://bugs.webkit.org/show_bug.cgi?id=191375
938
939         Reviewed by Mark Lam.
940
941         Disabled the test for 32 bit platforms.
942
943         * stress/regexp-compile-oom.js:
944
945 2018-11-26  Tadeu Zagallo  <tzagallo@apple.com>
946
947         ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
948         https://bugs.webkit.org/show_bug.cgi?id=191716
949         <rdar://problem/45723878>
950
951         Reviewed by Saam Barati.
952
953         * stress/regress-187373.js: Added.
954         (async.fn):
955
956 2018-11-21  Saam barati  <sbarati@apple.com>
957
958         DFGSpeculativeJIT should not &= exitOK with mayExit(node)
959         https://bugs.webkit.org/show_bug.cgi?id=191897
960         <rdar://problem/45871998>
961
962         Reviewed by Mark Lam.
963
964         * stress/exitok-is-not-the-same-as-mayExit.js: Added.
965         (bar):
966         (foo):
967
968 2018-11-21  Saam barati  <sbarati@apple.com>
969
970         Fix assertion in KnownCellUse inside SpeculativeJIT::speculate
971         https://bugs.webkit.org/show_bug.cgi?id=191895
972         <rdar://problem/46167406>
973
974         Reviewed by Mark Lam.
975
976         * stress/known-cell-use-needs-type-check-assertion.js: Added.
977         (foo):
978         (bar):
979
980 2018-11-21  Mark Lam  <mark.lam@apple.com>
981
982         Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError.
983         https://bugs.webkit.org/show_bug.cgi?id=191776
984         <rdar://problem/46152851>
985
986         Reviewed by Saam Barati.
987
988         * stress/big-wasm-memory-grow-no-max.js:
989         * stress/big-wasm-memory-grow.js:
990         * stress/big-wasm-memory.js:
991         - updated these to expect an OutOfMemoryError.
992
993         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: Added.
994         (Binary.prototype.emit_u8):
995         (Binary.prototype.emit_u32v):
996         (Binary.prototype.emit_header):
997         (Binary.prototype.emit_section):
998         (Binary):
999         (WasmModuleBuilder):
1000         (WasmModuleBuilder.prototype.addMemory):
1001         (WasmModuleBuilder.prototype.toArray):
1002         (WasmModuleBuilder.prototype.toBuffer):
1003         (WasmModuleBuilder.prototype.instantiate):
1004         (catch):
1005         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Added.
1006         (catch):
1007
1008 2018-11-21  Caio Lima  <ticaiolima@gmail.com>
1009
1010         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
1011         https://bugs.webkit.org/show_bug.cgi?id=190836
1012
1013         Reviewed by Saam Barati and Yusuke Suzuki.
1014
1015         * stress/big-int-out-of-memory-tests.js: Added.
1016
1017 2018-11-20  Mark Lam  <mark.lam@apple.com>
1018
1019         Remove invalid assertion in VMTraps::SignalSender's SignalAction.
1020         https://bugs.webkit.org/show_bug.cgi?id=191856
1021         <rdar://problem/46089992>
1022
1023         Reviewed by Yusuke Suzuki.
1024
1025         * stress/regress-191856.js: Added.
1026         - this test is skipped for now until we have a fix for webkit.org/b/191855.
1027
1028 2018-11-21  Dominik Infuehr  <dinfuehr@igalia.com>
1029
1030         Enable JIT on ARM/Linux
1031         https://bugs.webkit.org/show_bug.cgi?id=191548
1032
1033         Reviewed by Yusuke Suzuki.
1034
1035         Disable test on system with limited memory. Program was killed by
1036         the OS before the exception was thrown.
1037
1038         * slowMicrobenchmarks/function-constructor-with-huge-strings.js:
1039
1040 2018-11-20  Saam barati  <sbarati@apple.com>
1041
1042         Merging an IC variant may lead to the IC status containing overlapping structure sets
1043         https://bugs.webkit.org/show_bug.cgi?id=191869
1044         <rdar://problem/45403453>
1045
1046         Reviewed by Mark Lam.
1047
1048         * stress/merging-ic-variants-should-bail-if-structures-overlap.js: Added.
1049
1050 2018-11-19  Mark Lam  <mark.lam@apple.com>
1051
1052         globalFuncImportModule() should return a promise when it clears exceptions.
1053         https://bugs.webkit.org/show_bug.cgi?id=191792
1054         <rdar://problem/46090763>
1055
1056         Reviewed by Michael Saboff.
1057
1058         * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: Added.
1059
1060 2018-11-19  Guillaume Emont  <guijemont@igalia.com>
1061
1062         Skip new memory-hungry tests on memory limited devices
1063
1064         Unreviewed gardening.
1065
1066         * stress/big-wasm-memory-grow-no-max.js:
1067         * stress/big-wasm-memory-grow.js:
1068         * stress/big-wasm-memory.js:
1069
1070 2018-11-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1071
1072         Unreviewed, rolling in the rest of r237254
1073         https://bugs.webkit.org/show_bug.cgi?id=190340
1074
1075         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1076         * stress/function-cache-with-parameters-end-position.js: Added.
1077         (shouldBe):
1078         (shouldThrow):
1079         (i.anonymous):
1080         * stress/function-constructor-name.js: Added.
1081         (shouldBe):
1082         (GeneratorFunction):
1083         (AsyncFunction.async):
1084         (AsyncGeneratorFunction.async):
1085         (anonymous):
1086         (async.anonymous):
1087         * test262/expectations.yaml:
1088
1089 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
1090
1091         All users of ArrayBuffer should agree on the same max size
1092         https://bugs.webkit.org/show_bug.cgi?id=191771
1093
1094         Reviewed by Mark Lam.
1095
1096         * stress/big-wasm-memory-grow-no-max.js: Added.
1097         (foo):
1098         (catch):
1099         * stress/big-wasm-memory-grow.js: Added.
1100         (foo):
1101         (catch):
1102         * stress/big-wasm-memory.js: Added.
1103         (foo):
1104         (catch):
1105
1106 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
1107
1108         Unreviewed, make some more tests not crash my computer by only running on instance of it. These tests do not need to
1109         run for each JSC config since they're regression tests for runtime bugs.
1110
1111         * stress/json-stringified-overflow-2.js:
1112         * stress/json-stringified-overflow.js:
1113
1114 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
1115
1116         Unreviewed, make some tests not crash my computer by only running on instance of it. These tests do not need to run for each JSC
1117         config since they're regression tests for runtime bugs.
1118
1119         * stress/large-unshift-splice.js:
1120         * stress/regress-185888.js:
1121
1122 2018-11-16  Saam Barati  <sbarati@apple.com>
1123
1124         KnownCellUse should also have SpecCellCheck as its type filter
1125         https://bugs.webkit.org/show_bug.cgi?id=191729
1126         <rdar://problem/45872852>
1127
1128         Reviewed by Filip Pizlo.
1129
1130         * stress/known-cell-type-check-should-allow-empty-value-to-flow-through.js: Added.
1131         (C):
1132
1133 2018-11-16  Tadeu Zagallo  <tzagallo@apple.com>
1134
1135         Fix assertion failure on BytecodeGenerator::recordOpcode
1136         https://bugs.webkit.org/show_bug.cgi?id=191724
1137         <rdar://problem/45724395>
1138
1139         Reviewed by Saam Barati.
1140
1141         * stress/regress-187373-2.js: Added.
1142         (foo):
1143
1144 2018-11-15  Mark Lam  <mark.lam@apple.com>
1145
1146         RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
1147         https://bugs.webkit.org/show_bug.cgi?id=191730
1148         <rdar://problem/46048517>
1149
1150         Reviewed by Saam Barati.
1151
1152         * stress/regress-187006.js: Removed.
1153           - this test is invalid because its sole purpose is to test for the non-spec
1154             compliant behavior that we just fixed.
1155
1156         * stress/regress-191730.js: Added.
1157
1158 2018-11-15  Mark Lam  <mark.lam@apple.com>
1159
1160         RegExp operations should not take fast patch if lastIndex is not numeric.
1161         https://bugs.webkit.org/show_bug.cgi?id=191731
1162         <rdar://problem/46017305>
1163
1164         Reviewed by Saam Barati.
1165
1166         * stress/regress-191731.js: Added.
1167
1168 2018-11-13  Saam Barati  <sbarati@apple.com>
1169
1170         TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM
1171         https://bugs.webkit.org/show_bug.cgi?id=191600
1172
1173         Reviewed by Mark Lam.
1174
1175         * stress/type-profiler-log-should-defer-pending-exceptions.js: Added.
1176         (foo):
1177         (test):
1178         (bar):
1179
1180 2018-11-13  Ryan Haddad  <ryanhaddad@apple.com>
1181
1182         Unreviewed, rolling out r238132.
1183
1184         The test added with this change is timing out on Debug JSC
1185         bots.
1186
1187         Reverted changeset:
1188
1189         "[BigInt] JSBigInt::createWithLength should throw when length
1190         is greater than JSBigInt::maxLength"
1191         https://bugs.webkit.org/show_bug.cgi?id=190836
1192         https://trac.webkit.org/changeset/238132
1193
1194 2018-11-13  Mark Lam  <mark.lam@apple.com>
1195
1196         Add OOM detection to StringPrototype's substituteBackreferences().
1197         https://bugs.webkit.org/show_bug.cgi?id=191563
1198         <rdar://problem/45720428>
1199
1200         Reviewed by Saam Barati.
1201
1202         * stress/regress-191563.js: Added.
1203
1204 2018-11-13  Mark Lam  <mark.lam@apple.com>
1205
1206         LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame.
1207         https://bugs.webkit.org/show_bug.cgi?id=191579
1208         <rdar://problem/45942472>
1209
1210         Reviewed by Saam Barati.
1211
1212         * stress/regress-191579.js: Added.
1213
1214 2018-11-13  Caio Lima  <ticaiolima@gmail.com>
1215
1216         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
1217         https://bugs.webkit.org/show_bug.cgi?id=190836
1218
1219         Reviewed by Saam Barati.
1220
1221         * stress/big-int-out-of-memory-tests.js: Added.
1222
1223 2018-11-08  Ross Kirsling  <ross.kirsling@sony.com>
1224
1225         U+180E is no longer a whitespace character
1226         https://bugs.webkit.org/show_bug.cgi?id=191415
1227
1228         Reviewed by Saam Barati.
1229
1230         * ChakraCore/test/es5/regexSpace.baseline:
1231         * ChakraCore/test/es6/unicode_whitespace.js:
1232         Update tests to latest version.
1233         (See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.)
1234
1235         * test262.yaml:
1236         * test262/config.yaml:
1237         * test262/expectations.yaml:
1238         Update expectations.
1239
1240 2018-11-07  Caio Lima  <ticaiolima@gmail.com>
1241
1242         [BigInt] Add support to BigInt into ValueAdd
1243         https://bugs.webkit.org/show_bug.cgi?id=186177
1244
1245         Reviewed by Keith Miller.
1246
1247         * stress/big-int-negate-jit.js:
1248         * stress/value-add-big-int-and-string.js: Added.
1249         * stress/value-add-big-int-prediction-propagation.js: Added.
1250         * stress/value-add-big-int-untyped.js: Added.
1251
1252 2018-11-07  Tadeu Zagallo  <tzagallo@apple.com>
1253
1254         REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled
1255         https://bugs.webkit.org/show_bug.cgi?id=191184
1256
1257         Reviewed by Saam Barati.
1258
1259         Most tests were failing due to timeouts, since they are too slow to
1260         run on CLoop. The exceptions are:
1261
1262         proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop
1263         dont-crash-on-stack-overflow-when-parsing-builtin.js and
1264         dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had
1265         to change the stack size since CLoop requires it to be page aligned.
1266
1267         * microbenchmarks/array-push-1.js:
1268         * microbenchmarks/array-push-2.js:
1269         * microbenchmarks/elidable-new-object-dag.js:
1270         * microbenchmarks/elidable-new-object-roflcopter.js:
1271         * microbenchmarks/elidable-new-object-tree.js:
1272         * microbenchmarks/getter-richards.js:
1273         * microbenchmarks/sinkable-new-object-dag.js:
1274         * microbenchmarks/string-concat-long-convert.js:
1275         * microbenchmarks/typed-array-get-set-by-val-profiling.js:
1276         * slowMicrobenchmarks/array-push-3.js:
1277         * slowMicrobenchmarks/large-map-iteration-with-additions.js:
1278         * slowMicrobenchmarks/spread-small-array.js:
1279         * slowMicrobenchmarks/undefined-property-access.js:
1280         * stress/activation-sink-default-value-tdz-error.js:
1281         * stress/activation-sink-default-value.js:
1282         * stress/activation-sink-osrexit-default-value-tdz-error.js:
1283         * stress/activation-sink-osrexit-default-value.js:
1284         * stress/activation-sink-osrexit.js:
1285         * stress/activation-sink.js:
1286         * stress/allow-math-ic-b3-code-duplication.js:
1287         * stress/array-push-multiple-int32.js:
1288         * stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js:
1289         * stress/arrowfunction-lexical-this-activation-sink-osrexit.js:
1290         * stress/arrowfunction-lexical-this-activation-sink.js:
1291         * stress/dont-crash-on-stack-overflow-when-parsing-builtin.js:
1292         * stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js:
1293         * stress/elide-new-object-dag-then-exit.js:
1294         * stress/materialize-regexp-cyclic.js:
1295         * stress/new-regex-inline.js:
1296         * stress/op_add.js:
1297         * stress/op_bitand.js:
1298         * stress/op_bitor.js:
1299         * stress/op_bitxor.js:
1300         * stress/op_div-ConstVar.js:
1301         * stress/op_div-VarConst.js:
1302         * stress/op_div-VarVar.js:
1303         * stress/op_lshift-ConstVar.js:
1304         * stress/op_lshift-VarConst.js:
1305         * stress/op_lshift-VarVar.js:
1306         * stress/op_mod-ConstVar.js:
1307         * stress/op_mod-VarConst.js:
1308         * stress/op_mod-VarVar.js:
1309         * stress/op_mul-ConstVar.js:
1310         * stress/op_mul-VarConst.js:
1311         * stress/op_mul-VarVar.js:
1312         * stress/op_rshift-ConstVar.js:
1313         * stress/op_rshift-VarConst.js:
1314         * stress/op_rshift-VarVar.js:
1315         * stress/op_sub-ConstVar.js:
1316         * stress/op_sub-VarConst.js:
1317         * stress/op_sub-VarVar.js:
1318         * stress/op_urshift-ConstVar.js:
1319         * stress/op_urshift-VarConst.js:
1320         * stress/op_urshift-VarVar.js:
1321         * stress/proxy-get-set-correct-receiver.js:
1322         * stress/regress-179562.js:
1323         * stress/rest-parameter-many-arguments.js:
1324         * stress/sampling-profiler-richards.js:
1325         * stress/splay-flash-access-1ms.js:
1326         * stress/tailCallForwardArguments.js:
1327         * stress/typed-array-get-by-val-profiling.js:
1328         * typeProfiler/getter-richards.js:
1329
1330 2018-11-06  Michael Saboff  <msaboff@apple.com>
1331
1332         Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.
1333         https://bugs.webkit.org/show_bug.cgi?id=191271
1334
1335         Reviewed by Saam Barati.
1336
1337         Added more test cases and made all test cases run with the same deeply recursive stack
1338         instead of finding that same point for each test case.
1339
1340         * stress/regexp-compile-oom.js:
1341         (prototype.runTest):
1342         (recurseAndTest):
1343         (testList.push.new.TestAndExpectedException):
1344
1345 2018-11-05  Michael Saboff  <msaboff@apple.com>
1346
1347         Unreviewed build fix for linux.
1348
1349         * stress/regexp-compile-oom.js: Disabled for non-darwin OSes.
1350
1351 2018-11-02  Michael Saboff  <msaboff@apple.com>
1352
1353         Rolling in r237753 with unreviewed build fix.
1354
1355         Fixed issues with DECLARE_THROW_SCOPE placement.
1356
1357 2018-11-02  Ryan Haddad  <ryanhaddad@apple.com>
1358
1359         Unreviewed, rolling out r237753.
1360
1361         Introduced JSC test failures
1362
1363         Reverted changeset:
1364
1365         "Running out of stack space not properly handled in
1366         RegExp::compile() and its callers"
1367         https://bugs.webkit.org/show_bug.cgi?id=191206
1368         https://trac.webkit.org/changeset/237753
1369
1370 2018-11-02  Michael Saboff  <msaboff@apple.com>
1371
1372         Running out of stack space not properly handled in RegExp::compile() and its callers
1373         https://bugs.webkit.org/show_bug.cgi?id=191206
1374
1375         Reviewed by Filip Pizlo.
1376
1377         New regression test.
1378
1379         * stress/regexp-compile-oom.js: Added.
1380         (recurseAndTest):
1381
1382 2018-11-01  Guillaume Emont  <guijemont@igalia.com>
1383
1384         Skip tests on arm/mips that time out now we're running on CLoop
1385
1386         Unreviewed gardening.
1387
1388         Since the JIT is temporarily disabled on 32-bit platforms, these tests
1389         time out on the bots and need to be disabled. There's more tests
1390         disabled on arm because the timeout is longer on the mips bot (as the
1391         device is slower to start with), so many of the tests don't time out
1392         there.
1393
1394         * microbenchmarks/getter-richards.js: disable on arm and mips.
1395         * stress/op_add.js: disable on arm.
1396         * stress/op_bitand.js: disable on arm.
1397         * stress/op_bitor.js: disable on arm.
1398         * stress/op_bitxor.js: disable on arm.
1399         * stress/op_lshift-ConstVar.js: disable on arm.
1400         * stress/op_lshift-VarConst.js: disable on arm.
1401         * stress/op_lshift-VarVar.js: disable on arm.
1402         * stress/op_mod-ConstVar.js: disable on arm.
1403         * stress/op_mod-VarConst.js: disable on arm.
1404         * stress/op_mod-VarVar.js: disable on arm.
1405         * stress/op_mul-ConstVar.js: disable on arm.
1406         * stress/op_mul-VarConst.js: disable on arm.
1407         * stress/op_mul-VarVar.js: disable on arm.
1408         * stress/op_rshift-ConstVar.js: disable on arm.
1409         * stress/op_rshift-VarConst.js: disable on arm.
1410         * stress/op_rshift-VarVar.js: disable on arm.
1411         * stress/op_sub-ConstVar.js: disable on arm.
1412         * stress/op_sub-VarConst.js: disable on arm.
1413         * stress/op_sub-VarVar.js: disable on arm.
1414         * stress/op_urshift-ConstVar.js: disable on arm.
1415         * stress/op_urshift-VarConst.js: disable on arm.
1416         * stress/op_urshift-VarVar.js: disable on arm.
1417         * stress/spread-forward-call-varargs-stack-overflow.js: disable on arm.
1418         * stress/value-to-boolean.js: disable on arm and mips.
1419
1420 2018-10-31  Tadeu Zagallo  <tzagallo@apple.com>
1421
1422         REGRESSION(r237547): Exception handlers should be aware of wide opcodes
1423         https://bugs.webkit.org/show_bug.cgi?id=191108
1424         <rdar://problem/45690700>
1425
1426         Reviewed by Saam Barati.
1427
1428         * stress/wide-op_catch.js: Added.
1429         (catch):
1430
1431 2018-10-29  Mark Lam  <mark.lam@apple.com>
1432
1433         Correctly detect string overflow when using the 'Function' constructor.
1434         https://bugs.webkit.org/show_bug.cgi?id=184883
1435         <rdar://problem/36320331>
1436
1437         Reviewed by Saam Barati.
1438
1439         I've verified that this passes on 32-bit as well.
1440
1441         * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
1442
1443 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
1444
1445         Add support for GetStack FlushedDouble
1446         https://bugs.webkit.org/show_bug.cgi?id=191012
1447         <rdar://problem/45265141>
1448
1449         Reviewed by Saam Barati.
1450
1451         * stress/get-stack-double.js: Added.
1452         (bar):
1453         (noInline):
1454
1455 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
1456
1457         New bytecode format for JSC
1458         https://bugs.webkit.org/show_bug.cgi?id=187373
1459         <rdar://problem/44186758>
1460
1461         Reviewed by Filip Pizlo.
1462
1463         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
1464
1465         * stress/maximum-inline-capacity.js: Added.
1466         (test1):
1467         (test3.Foo):
1468         (test3):
1469
1470 2018-10-26  Commit Queue  <commit-queue@webkit.org>
1471
1472         Unreviewed, rolling out r237479 and r237484.
1473         https://bugs.webkit.org/show_bug.cgi?id=190978
1474
1475         broke JSC on iOS (Requested by tadeuzagallo on #webkit).
1476
1477         Reverted changesets:
1478
1479         "New bytecode format for JSC"
1480         https://bugs.webkit.org/show_bug.cgi?id=187373
1481         https://trac.webkit.org/changeset/237479
1482
1483         "Gardening: Build fix after r237479."
1484         https://bugs.webkit.org/show_bug.cgi?id=187373
1485         https://trac.webkit.org/changeset/237484
1486
1487 2018-10-26  Tadeu Zagallo  <tzagallo@apple.com>
1488
1489         New bytecode format for JSC
1490         https://bugs.webkit.org/show_bug.cgi?id=187373
1491         <rdar://problem/44186758>
1492
1493         Reviewed by Filip Pizlo.
1494
1495         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
1496
1497         * stress/maximum-inline-capacity.js: Added.
1498         (test1):
1499         (test3.Foo):
1500         (test3):
1501
1502 2018-10-26  Mark Lam  <mark.lam@apple.com>
1503
1504         Fix missing edge cases with JSGlobalObjects having a bad time.
1505         https://bugs.webkit.org/show_bug.cgi?id=189028
1506         <rdar://problem/45204939>
1507
1508         Reviewed by Saam Barati.
1509
1510         * stress/regress-189028.js: Added.
1511
1512 2018-10-22  Mark Lam  <mark.lam@apple.com>
1513
1514         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
1515         https://bugs.webkit.org/show_bug.cgi?id=190515
1516         <rdar://problem/45222379>
1517
1518         Rubber-stamped by Saam Barati.
1519
1520         Adding another test.
1521
1522         * stress/regress-190515-2.js: Added.
1523
1524 2018-10-22  Mark Lam  <mark.lam@apple.com>
1525
1526         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
1527         https://bugs.webkit.org/show_bug.cgi?id=190515
1528         <rdar://problem/45222379>
1529
1530         Reviewed by Saam Barati.
1531
1532         * stress/regress-190515.js: Added.
1533
1534 2018-10-19  Commit Queue  <commit-queue@webkit.org>
1535
1536         Unreviewed, rolling out r237254.
1537         https://bugs.webkit.org/show_bug.cgi?id=190760
1538
1539         "It regresses JetStream 2 by 5% on some iOS devices"
1540         (Requested by saamyjoon on #webkit).
1541
1542         Reverted changeset:
1543
1544         "[JSC] JSC should have "parseFunction" to optimize Function
1545         constructor"
1546         https://bugs.webkit.org/show_bug.cgi?id=190340
1547         https://trac.webkit.org/changeset/237254
1548
1549 2018-10-19  Saam Barati  <sbarati@apple.com>
1550
1551         vmCall should check if we exit before emitting an OSR exit due to exceptions
1552         https://bugs.webkit.org/show_bug.cgi?id=190740
1553         <rdar://problem/45220139>
1554
1555         Reviewed by Mark Lam.
1556
1557         * stress/dont-emit-osr-exits-for-every-call-ftl.js: Added.
1558         (foo):
1559
1560 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
1561
1562         [ESNext][BigInt] Implement support for "^"
1563         https://bugs.webkit.org/show_bug.cgi?id=186235
1564
1565         Reviewed by Yusuke Suzuki.
1566
1567         * stress/big-int-bitwise-xor-general.js: Added.
1568         * stress/big-int-bitwise-xor-to-primitive-precedence.js: Added.
1569         * stress/big-int-bitwise-xor-type-error.js: Added.
1570         * stress/big-int-bitwise-xor-wrapped-value.js: Added.
1571
1572 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
1573
1574         [BigInt] Add ValueSub into DFG
1575         https://bugs.webkit.org/show_bug.cgi?id=186176
1576
1577         Reviewed by Yusuke Suzuki.
1578
1579         * stress/big-int-subtraction-jit.js:
1580         * stress/value-sub-big-int-prediction-propagation.js: Added.
1581         * stress/value-sub-big-int-untyped.js: Added.
1582         * stress/value-sub-spec-none-case.js: Added.
1583
1584 2018-10-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1585
1586         [JSC] JSC should have "parseFunction" to optimize Function constructor
1587         https://bugs.webkit.org/show_bug.cgi?id=190340
1588
1589         Reviewed by Mark Lam.
1590
1591         This patch fixes the line number of syntax errors raised by the Function constructor,
1592         since we now parse the final code only once. And we no longer use block statement
1593         for Function constructor's parsing.
1594
1595         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1596         * stress/function-cache-with-parameters-end-position.js: Added.
1597         (shouldBe):
1598         (shouldThrow):
1599         (i.anonymous):
1600         * stress/function-constructor-name.js: Added.
1601         (shouldBe):
1602         (GeneratorFunction):
1603         (AsyncFunction.async):
1604         (AsyncGeneratorFunction.async):
1605         (anonymous):
1606         (async.anonymous):
1607         * test262/expectations.yaml:
1608
1609 2018-10-18  Commit Queue  <commit-queue@webkit.org>
1610
1611         Unreviewed, rolling out r237242.
1612         https://bugs.webkit.org/show_bug.cgi?id=190701
1613
1614         it breaks "stress/sampling-profiler-basic.js" (Requested by
1615         caiolima on #webkit).
1616
1617         Reverted changeset:
1618
1619         "[BigInt] Add ValueSub into DFG"
1620         https://bugs.webkit.org/show_bug.cgi?id=186176
1621         https://trac.webkit.org/changeset/237242
1622
1623 2018-10-17  Keith Miller  <keith_miller@apple.com>
1624
1625         AI does not clear Phantom allocation nodes.
1626         https://bugs.webkit.org/show_bug.cgi?id=190694
1627
1628         Reviewed by Saam Barati.
1629
1630         * stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added.
1631         (Day):
1632         (DaysInYear):
1633         (TimeInYear):
1634         (TimeFromYear):
1635         (DayFromYear):
1636         (InLeapYear):
1637         (YearFromTime):
1638         (WeekDay):
1639         (DaylightSavingTA):
1640         (GetSecondSundayInMarch):
1641         (TimeInMonth):
1642
1643 2018-10-17  Caio Lima  <ticaiolima@gmail.com>
1644
1645         [BigInt] Add ValueSub into DFG
1646         https://bugs.webkit.org/show_bug.cgi?id=186176
1647
1648         Reviewed by Yusuke Suzuki.
1649
1650         * stress/big-int-subtraction-jit.js:
1651         * stress/value-sub-big-int-prediction-propagation.js: Added.
1652         * stress/value-sub-big-int-untyped.js: Added.
1653
1654 2018-10-16  Dominik Infuehr  <dinfuehr@igalia.com>
1655
1656         [JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips
1657         https://bugs.webkit.org/show_bug.cgi?id=190611
1658
1659         Reviewed by Saam Barati.
1660
1661         Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js
1662         to improve test runtime. On ARM/MIPS this test even timed out when running all
1663         tests.
1664
1665         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
1666         (test):
1667
1668 2018-10-15  Guillaume Emont  <guijemont@igalia.com>
1669
1670         Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux
1671
1672         Unreviewed gardening.
1673
1674         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
1675
1676 2018-10-15  Saam barati  <sbarati@apple.com>
1677
1678         Emit fjcvtzs on ARM64E on Darwin
1679         https://bugs.webkit.org/show_bug.cgi?id=184023
1680
1681         Reviewed by Yusuke Suzuki and Filip Pizlo.
1682
1683         * stress/double-to-int32-NaN.js: Added.
1684         (assert):
1685         (foo):
1686
1687 2018-10-15  Saam Barati  <sbarati@apple.com>
1688
1689         JSArray::shiftCountWithArrayStorage is wrong when an array has holes
1690         https://bugs.webkit.org/show_bug.cgi?id=190262
1691         <rdar://problem/44986241>
1692
1693         Reviewed by Mark Lam.
1694
1695         * stress/array-prototype-concat-of-long-spliced-arrays.js:
1696         (test):
1697         * stress/slice-array-storage-with-holes.js: Added.
1698         (main):
1699
1700 2018-10-15  Commit Queue  <commit-queue@webkit.org>
1701
1702         Unreviewed, rolling out r237054.
1703         https://bugs.webkit.org/show_bug.cgi?id=190593
1704
1705         "this regressed JetStream 2 by 6% on iOS" (Requested by
1706         saamyjoon on #webkit).
1707
1708         Reverted changeset:
1709
1710         "[JSC] JSC should have "parseFunction" to optimize Function
1711         constructor"
1712         https://bugs.webkit.org/show_bug.cgi?id=190340
1713         https://trac.webkit.org/changeset/237054
1714
1715 2018-10-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1716
1717         [JSC] JSON.stringify can accept call-with-no-arguments
1718         https://bugs.webkit.org/show_bug.cgi?id=190343
1719
1720         Reviewed by Mark Lam.
1721
1722         * stress/json-stringify-no-arguments.js: Added.
1723         (shouldBe):
1724
1725 2018-10-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1726
1727         [JSC] JSC should have "parseFunction" to optimize Function constructor
1728         https://bugs.webkit.org/show_bug.cgi?id=190340
1729
1730         Reviewed by Mark Lam.
1731
1732         This patch fixes the line number of syntax errors raised by the Function constructor,
1733         since we now parse the final code only once. And we no longer use block statement
1734         for Function constructor's parsing.
1735
1736         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1737         * stress/function-cache-with-parameters-end-position.js: Added.
1738         (shouldBe):
1739         (shouldThrow):
1740         (i.anonymous):
1741         * stress/function-constructor-name.js: Added.
1742         (shouldBe):
1743         (GeneratorFunction):
1744         (AsyncFunction.async):
1745         (AsyncGeneratorFunction.async):
1746         (anonymous):
1747         (async.anonymous):
1748         * test262/expectations.yaml:
1749
1750 2018-10-10  Guillaume Emont  <guijemont@igalia.com>
1751
1752         Skip JSC test stress/sampling-profiler-richards.js on armv7/linux
1753         https://bugs.webkit.org/show_bug.cgi?id=190426
1754
1755         Unreviewed gardening.
1756
1757         * stress/sampling-profiler-richards.js:
1758
1759 2018-10-06  Caio Lima  <ticaiolima@gmail.com>
1760
1761         [ESNext][BigInt] Implement support for "|"
1762         https://bugs.webkit.org/show_bug.cgi?id=186229
1763
1764         Reviewed by Yusuke Suzuki.
1765
1766         * stress/big-int-bitwise-and-jit.js:
1767         * stress/big-int-bitwise-or-general.js: Added.
1768         * stress/big-int-bitwise-or-jit-untyped.js: Added.
1769         * stress/big-int-bitwise-or-jit.js: Added.
1770         * stress/big-int-bitwise-or-memory-stress.js: Added.
1771         * stress/big-int-bitwise-or-to-primitive-precedence.js: Added.
1772         * stress/big-int-bitwise-or-type-error.js: Added.
1773         * stress/big-int-bitwise-or-wrapped-value.js: Added.
1774
1775 2018-10-05  Dominik Infuehr  <dominik.infuehr@gmail.com>
1776
1777         Skip test on systems with limited memory
1778         https://bugs.webkit.org/show_bug.cgi?id=190310
1779
1780         Invoking runDefault adds test to runlist, skipping the test in the next
1781         line does not prevent the test from executing. Change order of lines such
1782         that runDefault is only executed if test is not executed.
1783
1784         Reviewed by Mark Lam.
1785
1786         * stress/regress-190187.js:
1787
1788 2018-10-03  Saam barati  <sbarati@apple.com>
1789
1790         lowXYZ in FTLLower should always filter the type of the incoming edge
1791         https://bugs.webkit.org/show_bug.cgi?id=189939
1792         <rdar://problem/44407030>
1793
1794         Reviewed by Michael Saboff.
1795
1796         * stress/ftl-should-always-filter-for-low-type-check-functions.js: Added.
1797         (foo):
1798         (test):
1799
1800 2018-10-03  Mark Lam  <mark.lam@apple.com>
1801
1802         Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX.
1803         https://bugs.webkit.org/show_bug.cgi?id=190187
1804         <rdar://problem/42512909>
1805
1806         Reviewed by Michael Saboff.
1807
1808         * stress/regress-190187.js: Added.
1809
1810 2018-10-02  Caio Lima  <ticaiolima@gmail.com>
1811
1812         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
1813         https://bugs.webkit.org/show_bug.cgi?id=190033
1814
1815         Reviewed by Yusuke Suzuki.
1816
1817         * stress/big-int-to-string.js:
1818
1819 2018-10-01  Mark Lam  <mark.lam@apple.com>
1820
1821         Function.toString() should also copy the source code Functions that are class definitions.
1822         https://bugs.webkit.org/show_bug.cgi?id=190186
1823         <rdar://problem/44733360>
1824
1825         Reviewed by Saam Barati.
1826
1827         * stress/regress-190186.js: Added.
1828
1829 2018-10-01  Dominik Infuehr  <dinfuehr@igalia.com>
1830
1831         Split NaN-check into separate test
1832         https://bugs.webkit.org/show_bug.cgi?id=190010
1833
1834         Reviewed by Saam Barati.
1835
1836         DataView exposes NaN-representation, which is not necessarily the same on each
1837         architecture. Therefore move the check of the NaN-representation into its own
1838         file such that we can disable this test on MIPS where NaN-representation can be
1839         different on older CPUs.
1840
1841         * stress/dataview-jit-set-nan.js: Added.
1842         (assert):
1843         (test.storeLittleEndian):
1844         (test.storeBigEndian):
1845         (test.store):
1846         (test):
1847         * stress/dataview-jit-set.js:
1848         (test5):
1849
1850 2018-10-01  Commit Queue  <commit-queue@webkit.org>
1851
1852         Unreviewed, rolling out r236647.
1853         https://bugs.webkit.org/show_bug.cgi?id=190124
1854
1855         Breaking test stress/big-int-to-string.js (Requested by
1856         caiolima_ on #webkit).
1857
1858         Reverted changeset:
1859
1860         "[BigInt] BigInt.proptotype.toString is broken when radix is
1861         power of 2"
1862         https://bugs.webkit.org/show_bug.cgi?id=190033
1863         https://trac.webkit.org/changeset/236647
1864
1865 2018-09-30  Caio Lima  <ticaiolima@gmail.com>
1866
1867         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
1868         https://bugs.webkit.org/show_bug.cgi?id=190033
1869
1870         Reviewed by Yusuke Suzuki.
1871
1872         * stress/big-int-to-string.js:
1873
1874 2018-09-28  Caio Lima  <ticaiolima@gmail.com>
1875
1876         [ESNext][BigInt] Implement support for "&"
1877         https://bugs.webkit.org/show_bug.cgi?id=186228
1878
1879         Reviewed by Yusuke Suzuki.
1880
1881         * stress/big-int-bitwise-and-general.js: Added.
1882         (assert):
1883         (assert.sameValue):
1884         * stress/big-int-bitwise-and-jit.js: Added.
1885         (let.assert.sameValue):
1886         (bigIntBitAnd):
1887         * stress/big-int-bitwise-and-memory-stress.js: Added.
1888         (assert):
1889         * stress/big-int-bitwise-and-to-primitive-precedence.js: Added.
1890         (assert.sameValue):
1891         (let.o.Symbol.toPrimitive):
1892         (catch):
1893         * stress/big-int-bitwise-and-type-error.js: Added.
1894         (assert):
1895         (assertThrowTypeError):
1896         (let.o.valueOf):
1897         (o.valueOf):
1898         (o.toString):
1899         (o.Symbol.toPrimitive):
1900         * stress/big-int-bitwise-and-wrapped-value.js: Added.
1901         (assert.sameValue):
1902         (testBitAnd):
1903         (let.o.Symbol.toPrimitive):
1904         (o.valueOf):
1905         (o.toString):
1906
1907 2018-09-28  Ross Kirsling  <ross.kirsling@sony.com>
1908
1909         JSC test stress/jsc-read.js doesn't support CRLF
1910         https://bugs.webkit.org/show_bug.cgi?id=190063
1911
1912         Reviewed by Yusuke Suzuki.
1913
1914         In order to run this test via Windows command prompt, we can't assume that the final newline will be LF.
1915
1916         * stress/jsc-read.js:
1917         (test):
1918
1919 2018-09-27  Saam barati  <sbarati@apple.com>
1920
1921         Verify the contents of AssemblerBuffer on arm64e
1922         https://bugs.webkit.org/show_bug.cgi?id=190057
1923         <rdar://problem/38916630>
1924
1925         Reviewed by Mark Lam.
1926
1927         * stress/regress-189132.js:
1928
1929 2018-09-27  Dominik Infuehr  <dinfuehr@igalia.com>
1930
1931         Disable test without LLInt on ARMv7
1932         https://bugs.webkit.org/show_bug.cgi?id=190037
1933
1934         Reviewed by Mark Lam.
1935
1936         Test runs out of executable memory on ARMv7, do not run
1937         this test without LLInt enabled.
1938
1939         * stress/regress-169445.js:
1940
1941 2018-09-26  Keith Miller  <keith_miller@apple.com>
1942
1943         We should zero unused property storage when rebalancing array storage.
1944         https://bugs.webkit.org/show_bug.cgi?id=188151
1945
1946         Reviewed by Michael Saboff.
1947
1948         * stress/splice-should-zero-property-storage-when-rebalancing.js: Added.
1949
1950 2018-09-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1951
1952         [JSC] Optimize Array#lastIndexOf
1953         https://bugs.webkit.org/show_bug.cgi?id=189780
1954
1955         Reviewed by Saam Barati.
1956
1957         * stress/array-lastindexof-array-prototype-trap.js: Added.
1958         (shouldBe):
1959         (AncestorArray.prototype.get 2):
1960         (AncestorArray):
1961         * stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added.
1962         (shouldBe):
1963         * stress/array-lastindexof-hole-nan.js: Added.
1964         (shouldBe):
1965         (throw.new.Error):
1966         * stress/array-lastindexof-infinity.js: Added.
1967         (shouldBe):
1968         (throw.new.Error):
1969         * stress/array-lastindexof-negative-zero.js: Added.
1970         (shouldBe):
1971         (throw.new.Error):
1972         * stress/array-lastindexof-own-getter.js: Added.
1973         (shouldBe):
1974         (throw.new.Error.get array):
1975         (get array):
1976         * stress/array-lastindexof-prototype-trap.js: Added.
1977         (shouldBe):
1978         (DerivedArray.prototype.get 2):
1979         (DerivedArray):
1980
1981 2018-09-25  Saam Barati  <sbarati@apple.com>
1982
1983         Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
1984         https://bugs.webkit.org/show_bug.cgi?id=189940
1985         <rdar://problem/43640987>
1986
1987         Reviewed by Mark Lam.
1988
1989         * stress/use-baseline-codeblock-materialize-osr-exit.js: Added.
1990
1991 2018-09-24  Saam Barati  <sbarati@apple.com>
1992
1993         Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects
1994         https://bugs.webkit.org/show_bug.cgi?id=189922
1995         <rdar://problem/44651275>
1996
1997         Reviewed by Mark Lam.
1998
1999         * stress/array-indexof-fast-path-effects.js: Added.
2000         * stress/array-indexof-cached-length.js: Added.
2001
2002 2018-09-24  Saam barati  <sbarati@apple.com>
2003
2004         ArgumentsEliminationPhase should snip basic blocks after proven OSR exits
2005         https://bugs.webkit.org/show_bug.cgi?id=189682
2006         <rdar://problem/43557315>
2007
2008         Reviewed by Mark Lam.
2009
2010         * stress/arguments-elimination-will-generate-edge-without-result.js: Added.
2011         (foo):
2012
2013 2018-09-22  Saam barati  <sbarati@apple.com>
2014
2015         The sampling should not use Strong<CodeBlock> in its machineLocation field
2016         https://bugs.webkit.org/show_bug.cgi?id=189319
2017
2018         Reviewed by Filip Pizlo.
2019
2020         * stress/sampling-profiler-richards.js: Added.
2021
2022 2018-09-19  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
2023
2024         [JSC] Optimize Array#indexOf in C++ runtime
2025         https://bugs.webkit.org/show_bug.cgi?id=189507
2026
2027         Reviewed by Saam Barati.
2028
2029         * stress/array-indexof-array-prototype-trap.js: Added.
2030         (shouldBe):
2031         (AncestorArray.prototype.get 2):
2032         (AncestorArray):
2033         * stress/array-indexof-have-a-bad-time-c-runtime.js: Added.
2034         (shouldBe):
2035         * stress/array-indexof-hole-nan.js: Added.
2036         (shouldBe):
2037         (throw.new.Error):
2038         * stress/array-indexof-infinity.js: Added.
2039         (shouldBe):
2040         (throw.new.Error):
2041         * stress/array-indexof-negative-zero.js: Added.
2042         (shouldBe):
2043         (throw.new.Error):
2044         * stress/array-indexof-own-getter.js: Added.
2045         (shouldBe):
2046         (throw.new.Error.get array):
2047         (get array):
2048         * stress/array-indexof-prototype-trap.js: Added.
2049         (shouldBe):
2050         (DerivedArray.prototype.get 2):
2051         (DerivedArray):
2052
2053 2018-09-19  Saam barati  <sbarati@apple.com>
2054
2055         AI rule for MultiPutByOffset executes its effects in the wrong order
2056         https://bugs.webkit.org/show_bug.cgi?id=189757
2057         <rdar://problem/43535257>
2058
2059         Reviewed by Michael Saboff.
2060
2061         * stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
2062         (foo):
2063         (Foo):
2064         (g):
2065
2066 2018-09-17  Mark Lam  <mark.lam@apple.com>
2067
2068         Ensure that ForInContexts are invalidated if their loop local is over-written.
2069         https://bugs.webkit.org/show_bug.cgi?id=189571
2070         <rdar://problem/44402277>
2071
2072         Reviewed by Saam Barati.
2073
2074         * stress/regress-189571.js: Added.
2075
2076 2018-09-17  Saam barati  <sbarati@apple.com>
2077
2078         We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
2079         https://bugs.webkit.org/show_bug.cgi?id=189676
2080         <rdar://problem/39682897>
2081
2082         Reviewed by Michael Saboff.
2083
2084         * typeProfiler/check-structure-or-empty-in-fixup.js: Added.
2085         (A):
2086         (K):
2087         (i.catch):
2088
2089 2018-09-14  Saam barati  <sbarati@apple.com>
2090
2091         Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
2092         https://bugs.webkit.org/show_bug.cgi?id=189628
2093         <rdar://problem/39481690>
2094
2095         Reviewed by Mark Lam.
2096
2097         * stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
2098         (foo):
2099
2100 2018-09-11  Mark Lam  <mark.lam@apple.com>
2101
2102         Test for array initialization in arrayProtoFuncSplice.
2103         https://bugs.webkit.org/show_bug.cgi?id=170253
2104         <rdar://problem/31328773>
2105
2106         Rubber-stamped by Saam Barati.
2107
2108         * stress/regress-170253.js: Added.
2109
2110 2018-09-11  Mark Lam  <mark.lam@apple.com>
2111
2112         Test for IntlObject initialization.
2113         https://bugs.webkit.org/show_bug.cgi?id=170251
2114         <rdar://problem/31328419>
2115
2116         Rubber-stamped by Saam Barati.
2117
2118         * stress/regress-170251.js: Added.
2119
2120 2018-09-11  Mark Lam  <mark.lam@apple.com>
2121
2122         Test for array memcpy'ing when JSGlobalObject::haveABadTime.
2123         https://bugs.webkit.org/show_bug.cgi?id=169889
2124         <rdar://problem/31155607>
2125
2126         Reviewed by Saam Barati.
2127
2128         * stress/regress-169889-array-concat.js: Added.
2129         * stress/regress-169889-array-concat1.js: Added.
2130         * stress/regress-169889-array-slice.js: Added.
2131
2132 2018-09-11  Mark Lam  <mark.lam@apple.com>
2133
2134         Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope.
2135         https://bugs.webkit.org/show_bug.cgi?id=169445
2136         <rdar://problem/30957435>
2137
2138         Reviewed by Saam Barati.
2139
2140         * stress/regress-169445.js: Added.
2141         (let.gun.eval.A):
2142         (let.gun.eval.B.C):
2143         (let.gun.eval.B.C.prototype.trigger):
2144         (let.gun.eval.B.C.prototype.triggerWithRestParameters):
2145         (let.gun.eval.B):
2146         (let.gun.eval):
2147
2148 == Rolled over to ChangeLog-2018-09-11 ==