Unreviewed follow-up to r192914.
[WebKit-https.git] / JSTests / ChangeLog
1 2018-12-19  Ross Kirsling  <ross.kirsling@sony.com>
2
3         Unreviewed follow-up to r192914.
4
5         * test262/expectations.yaml:
6         Add the last 20 missing expectations.
7
8 2018-12-19  Keith Miller  <keith_miller@apple.com>
9
10         Fix test262 expectations
11         https://bugs.webkit.org/show_bug.cgi?id=192914
12
13         Unreviewed, when I imported the latest round of test262 tests I must have failed to update the test expectations.
14
15         * test262/expectations.yaml:
16
17 2018-12-19  Keith Miller  <keith_miller@apple.com>
18
19         Update test262 tests.
20         https://bugs.webkit.org/show_bug.cgi?id=192907
21
22         Rubber stamped by Mark Lam.
23
24         * test262/*: Omitted because prepare-changelog crashes.
25
26 2018-12-19  Mark Lam  <mark.lam@apple.com>
27
28         JSPropertyNameEnumerator should cache the iterated object's structure only after getting its property names.
29         https://bugs.webkit.org/show_bug.cgi?id=192464
30         <rdar://problem/46519455>
31
32         Reviewed by Saam Barati.
33
34         This patch is about a 10% speed up on the new for-in-on-object-with-lazily-materialized-properties.js
35         microbenchmark.
36
37         * microbenchmarks/for-in-on-object-with-lazily-materialized-properties.js: Added.
38         * stress/property-name-enumerator-should-cache-structure-after-getting-property-names.js: Added.
39
40 2018-12-19  Tadeu Zagallo  <tzagallo@apple.com>
41
42         String overflow in JSC::createError results in ASSERT in WTF::makeString
43         https://bugs.webkit.org/show_bug.cgi?id=192833
44         <rdar://problem/45706868>
45
46         Reviewed by Mark Lam.
47
48         * stress/string-overflow-createError.js: Added.
49
50 2018-12-18  Ross Kirsling  <ross.kirsling@sony.com>
51
52         Error message for `-x ** y` contains a typo.
53         https://bugs.webkit.org/show_bug.cgi?id=192832
54
55         Reviewed by Saam Barati.
56
57         * ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
58         (assert.assert.return.throws):
59         * stress/pow-expects-update-expression-on-lhs.js:
60         (throw.new.Error):
61         Update test expectations which match against the exact error message.
62
63 2018-12-18  Mark Lam  <mark.lam@apple.com>
64
65         Gardening: test options fix.
66         https://bugs.webkit.org/show_bug.cgi?id=192822
67
68         Unreviewed.
69
70         * stress/json-stringify-string-builder-overflow.js:
71
72 2018-12-18  Mark Lam  <mark.lam@apple.com>
73
74         JSON.stringify() should throw OOM on StringBuilder overflows.
75         https://bugs.webkit.org/show_bug.cgi?id=192822
76         <rdar://problem/46670577>
77
78         Reviewed by Saam Barati.
79
80         * stress/json-stringify-string-builder-overflow.js: Added.
81
82 2018-12-18  Ross Kirsling  <ross.kirsling@sony.com>
83
84         Redeclaration of var over let/const/class should be a syntax error.
85         https://bugs.webkit.org/show_bug.cgi?id=192298
86
87         Reviewed by Keith Miller.
88
89         * test262.yaml:
90         * test262/expectations.yaml:
91         Mark 46 tests as passing.
92
93         * stress/block-scope-redeclarations.js:
94         Add some new tests.
95
96         * stress/for-in-invalidate-context-weird-assignments.js:
97         * stress/for-in-tests.js:
98         Replace tests for outdated behavior with tests for SyntaxError.
99
100         * ChakraCore/test/LetConst/defer3.baseline-jsc:
101         * ChakraCore/test/LetConst/letvar.baseline-jsc:
102         Update expectations.
103
104 2018-12-18  Mark Lam  <mark.lam@apple.com>
105
106         Skip the stress/elidable-new-object-roflcopter-then-exit.js test on 32-bit.
107         https://bugs.webkit.org/show_bug.cgi?id=191374
108         <rdar://problem/46525447>
109
110         Reviewed by Yusuke Suzuki.
111
112         This test runs too slow on 32-bit, and is not relevant for non-JIT builds.
113
114         * stress/elidable-new-object-roflcopter-then-exit.js:
115
116 2018-12-17  Mark Lam  <mark.lam@apple.com>
117
118         Skip the stress/materialized-regexp-has-correct-last-index-set-by-match.js test on 32-bit.
119         https://bugs.webkit.org/show_bug.cgi?id=192019
120         <rdar://problem/46525456>
121
122         Reviewed by Yusuke Suzuki.
123
124         The test runs too slow on 32-bit.
125
126         * stress/materialized-regexp-has-correct-last-index-set-by-match.js:
127
128 2018-12-17  Mark Lam  <mark.lam@apple.com>
129
130         Skip the stress/materialize-regexp-cyclic-regexp.js test on 32-bit.
131         https://bugs.webkit.org/show_bug.cgi?id=191373
132         <rdar://problem/46525458>
133
134         Reviewed by Yusuke Suzuki.
135
136         The test is already slow running with a JIT on 64-bit.  It will always timeout
137         on 32-bit without a JIT.
138
139         * stress/materialize-regexp-cyclic-regexp.js:
140
141 2018-12-17  Mark Lam  <mark.lam@apple.com>
142
143         Array unshift/shift should not race against the AI in the compiler thread.
144         https://bugs.webkit.org/show_bug.cgi?id=192795
145         <rdar://problem/46724263>
146
147         Reviewed by Saam Barati.
148
149         * stress/array-unshift-should-not-race-against-compiler-thread.js: Added.
150
151 2018-12-16  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
152
153         [JSC] Optimize Object.keys by caching own keys results in StructureRareData
154         https://bugs.webkit.org/show_bug.cgi?id=190047
155
156         Reviewed by Saam Barati.
157
158         * stress/object-keys-cached-zero.js: Added.
159         (shouldBe):
160         (test):
161         * stress/object-keys-changed-attribute.js: Added.
162         (shouldBe):
163         (test):
164         * stress/object-keys-changed-index.js: Added.
165         (shouldBe):
166         (test):
167         * stress/object-keys-changed.js: Added.
168         (shouldBe):
169         (test):
170         * stress/object-keys-indexed-non-cache.js: Added.
171         (shouldBe):
172         (test):
173         * stress/object-keys-overrides-get-property-names.js: Added.
174         (shouldBe):
175         (test):
176         (noInline):
177
178 2018-12-17  Mark Lam  <mark.lam@apple.com>
179
180         SamplingProfiler's isValidFramePointer() should reject address at stack origin.
181         https://bugs.webkit.org/show_bug.cgi?id=192779
182         <rdar://problem/46775869>
183
184         Reviewed by Saam Barati.
185
186         * stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js: Added.
187
188 2018-12-17  Ryan Haddad  <ryanhaddad@apple.com>
189
190         Unreviewed test gardening, address a syntax error in a new test.
191
192         * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js:
193
194 2018-12-17  Mark Lam  <mark.lam@apple.com>
195
196         Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit().
197         https://bugs.webkit.org/show_bug.cgi?id=192776
198         <rdar://problem/46772368>
199
200         Reviewed by Keith Miller.
201
202         * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js: Added.
203
204 2018-12-17  Mark Lam  <mark.lam@apple.com>
205
206         Fix stale assertion in attemptToForceStringArrayModeByToStringConversion().
207         https://bugs.webkit.org/show_bug.cgi?id=192770
208         <rdar://problem/46449037>
209
210         Reviewed by Keith Miller.
211
212         * stress/force-string-arrayMode-on-originalNonArray-array-class.js: Added.
213
214 2018-12-14  Mark Lam  <mark.lam@apple.com>
215
216         CallFrame::convertToStackOverflowFrame() needs to keep the top CodeBlock alive.
217         https://bugs.webkit.org/show_bug.cgi?id=192717
218         <rdar://problem/46660677>
219
220         Reviewed by Saam Barati.
221
222         * stress/regress-192717.js: Added.
223
224 2018-12-14  Commit Queue  <commit-queue@webkit.org>
225
226         Unreviewed, rolling out r239153, r239154, and r239155.
227         https://bugs.webkit.org/show_bug.cgi?id=192715
228
229         Caused flaky GC-related crashes seen with layout tests
230         (Requested by ryanhaddad on #webkit).
231
232         Reverted changesets:
233
234         "[JSC] Optimize Object.keys by caching own keys results in
235         StructureRareData"
236         https://bugs.webkit.org/show_bug.cgi?id=190047
237         https://trac.webkit.org/changeset/239153
238
239         "Unreviewed, build fix after r239153"
240         https://bugs.webkit.org/show_bug.cgi?id=190047
241         https://trac.webkit.org/changeset/239154
242
243         "Unreviewed, build fix after r239153, part 2"
244         https://bugs.webkit.org/show_bug.cgi?id=190047
245         https://trac.webkit.org/changeset/239155
246
247 2018-12-14  Keith Miller  <keith_miller@apple.com>
248
249         Callers of JSString::getIndex should check for OOM exceptions
250         https://bugs.webkit.org/show_bug.cgi?id=192709
251
252         Reviewed by Mark Lam.
253
254         * stress/StringObject-define-length-getter-rope-string-oom.js: Added.
255
256 2018-12-13  Mark Lam  <mark.lam@apple.com>
257
258         Add a missing exception check.
259         https://bugs.webkit.org/show_bug.cgi?id=192626
260         <rdar://problem/46662163>
261
262         Reviewed by Keith Miller.
263
264         * stress/regress-192626.js: Added.
265
266 2018-12-13  Caio Lima  <ticaiolima@gmail.com>
267
268         [BigInt] Add ValueDiv into DFG
269         https://bugs.webkit.org/show_bug.cgi?id=186178
270
271         Reviewed by Yusuke Suzuki.
272
273         * stress/big-int-div-jit-osr.js: Added.
274         * stress/big-int-div-jit-untyped.js: Added.
275         * stress/value-div-fixup-int32-big-int.js: Added.
276
277 2018-12-10  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
278
279         [JSC] Optimize Object.keys by caching own keys results in StructureRareData
280         https://bugs.webkit.org/show_bug.cgi?id=190047
281
282         Reviewed by Keith Miller.
283
284         * stress/object-keys-cached-zero.js: Added.
285         (shouldBe):
286         (test):
287         * stress/object-keys-changed-attribute.js: Added.
288         (shouldBe):
289         (test):
290         * stress/object-keys-changed-index.js: Added.
291         (shouldBe):
292         (test):
293         * stress/object-keys-changed.js: Added.
294         (shouldBe):
295         (test):
296         * stress/object-keys-indexed-non-cache.js: Added.
297         (shouldBe):
298         (test):
299         * stress/object-keys-overrides-get-property-names.js: Added.
300         (shouldBe):
301         (test):
302         (noInline):
303
304 2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
305
306         [DFG][FTL] Add NewSymbol
307         https://bugs.webkit.org/show_bug.cgi?id=192620
308
309         Reviewed by Saam Barati.
310
311         * microbenchmarks/symbol-creation.js: Added.
312         (test):
313         * stress/symbol-description-identity.js: Added.
314         (shouldBe):
315         (test):
316         * stress/symbol-identity.js: Added.
317         (shouldBe):
318         (test):
319         * stress/symbol-with-description-throw-error.js: Added.
320         (shouldBe):
321         (shouldThrow):
322         (test):
323         (object.toString):
324
325 2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
326
327         [BigInt] Implement DFG/FTL typeof for BigInt
328         https://bugs.webkit.org/show_bug.cgi?id=192619
329
330         Reviewed by Keith Miller.
331
332         * stress/big-int-boolean-proven-type.js: Added.
333         (assert):
334         (bool):
335         * stress/big-int-type-of-proven-type-non-constant-including-symbol.js: Added.
336         (assert):
337         (typeOf):
338         (i.switch):
339         * stress/big-int-type-of-proven-type-non-constant.js: Added.
340         (assert):
341         (typeOf):
342         * stress/big-int-type-of.js:
343         (typeOf):
344         (func):
345
346 2018-12-10  Mark Lam  <mark.lam@apple.com>
347
348         PropertyAttribute needs a CustomValue bit.
349         https://bugs.webkit.org/show_bug.cgi?id=191993
350         <rdar://problem/46264467>
351
352         Reviewed by Saam Barati.
353
354         * stress/regress-191993.js: Added.
355
356 2018-12-10  Caio Lima  <ticaiolima@gmail.com>
357
358         [BigInt] Add ValueMul into DFG
359         https://bugs.webkit.org/show_bug.cgi?id=186175
360
361         Reviewed by Yusuke Suzuki.
362
363         * stress/big-int-mul-jit-osr.js: Added.
364         * stress/big-int-mul-jit-untyped.js: Added.
365         * stress/value-mul-fixup-int32-big-int.js: Added.
366
367 2018-12-06  Keith Miller  <keith_miller@apple.com>
368
369         stress/big-wasm-memory tests failing on 32-bit JSC bot
370         https://bugs.webkit.org/show_bug.cgi?id=192020
371
372         Reviewed by Saam Barati.
373
374         Not every platform has WebAssembly, e.g. 32-bit, so we should exit
375         the wasm stress tests if the WebAssembly object does not exist.
376
377         * stress/big-wasm-memory-grow-no-max.js:
378         (test.foo):
379         (test):
380         (foo): Deleted.
381         (catch): Deleted.
382         * stress/big-wasm-memory-grow.js:
383         (test.foo):
384         (test):
385         (foo): Deleted.
386         (catch): Deleted.
387         * stress/big-wasm-memory.js:
388         (test.foo):
389         (test):
390         (foo): Deleted.
391         (catch): Deleted.
392
393 2018-12-05  Mark Lam  <mark.lam@apple.com>
394
395         speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
396         https://bugs.webkit.org/show_bug.cgi?id=192441
397         <rdar://problem/46480355>
398
399         Reviewed by Saam Barati.
400
401         * stress/regress-192441.js: Added.
402
403 2018-12-04  Mark Lam  <mark.lam@apple.com>
404
405         DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility.
406         https://bugs.webkit.org/show_bug.cgi?id=192386
407         <rdar://problem/46445516>
408
409         Reviewed by Saam Barati.
410
411         * stress/regress-192386.js: Added.
412
413 2018-12-04  Caio Lima  <ticaiolima@gmail.com>
414
415         [ESNext][BigInt] Support logic operations
416         https://bugs.webkit.org/show_bug.cgi?id=179903
417
418         Reviewed by Yusuke Suzuki.
419
420         * stress/big-int-branch-usage.js: Added.
421         * stress/big-int-logical-and.js: Added.
422         * stress/big-int-logical-not.js: Added.
423         * stress/big-int-logical-or.js: Added.
424
425 2018-12-03  Ryan Haddad  <ryanhaddad@apple.com>
426
427         Unreviewed, rolling out r238833.
428
429         Breaks macOS and iOS debug builds.
430
431         Reverted changeset:
432
433         "[ESNext][BigInt] Support logic operations"
434         https://bugs.webkit.org/show_bug.cgi?id=179903
435         https://trac.webkit.org/changeset/238833
436
437 2018-12-03  Caio Lima  <ticaiolima@gmail.com>
438
439         [ESNext][BigInt] Support logic operations
440         https://bugs.webkit.org/show_bug.cgi?id=179903
441
442         Reviewed by Yusuke Suzuki.
443
444         * stress/big-int-branch-usage.js: Added.
445         * stress/big-int-logical-and.js: Added.
446         * stress/big-int-logical-not.js: Added.
447         * stress/big-int-logical-or.js: Added.
448
449 2018-12-02  Caio Lima  <ticaiolima@gmail.com>
450
451         [ESNext][BigInt] Implement support for "<<" and ">>"
452         https://bugs.webkit.org/show_bug.cgi?id=186233
453
454         Reviewed by Yusuke Suzuki.
455
456         * stress/big-int-left-shift-general.js: Added.
457         * stress/big-int-left-shift-range-error.js: Added.
458         * stress/big-int-left-shift-type-error.js: Added.
459         * stress/big-int-left-shift-wrapped-value.js: Added.
460         * stress/big-int-right-shift-general.js: Added.
461         * stress/big-int-right-shift-type-error.js: Added.
462         * stress/big-int-right-shift-wrapped-value.js: Added.
463         * stress/left-shift-to-primitive-precedence.js: Added.
464         * stress/right-shift-to-primitive-precedence.js: Added.
465
466 2018-11-30  Dean Jackson  <dino@apple.com>
467
468         Add first-class support for .mjs files in jsc binary
469         https://bugs.webkit.org/show_bug.cgi?id=192190
470         <rdar://problem/46375715>
471
472         Reviewed by Keith Miller.
473
474         * stress/simple-module.mjs: Added.
475         * stress/simple-script.js: Added.
476
477 2018-11-30  Caio Lima  <ticaiolima@gmail.com>
478
479         [BigInt] Implement ValueBitXor into DFG
480         https://bugs.webkit.org/show_bug.cgi?id=190264
481
482         Reviewed by Yusuke Suzuki.
483
484         * stress/big-int-bitwise-xor-jit.js: Added.
485         * stress/big-int-bitwise-xor-memory-stress.js: Added.
486         * stress/big-int-bitwise-xor-untyped.js: Added.
487
488 2018-11-27  Saam barati  <sbarati@apple.com>
489
490         r238510 broke scopes of size zero
491         https://bugs.webkit.org/show_bug.cgi?id=192033
492         <rdar://problem/46281734>
493
494         Reviewed by Keith Miller.
495
496         * stress/r238510-bad-loop.js: Added.
497         (foo):
498
499 2018-11-27  Mark Lam  <mark.lam@apple.com>
500
501         [Re-landing] NaNs read from Wasm code needs to be be purified.
502         https://bugs.webkit.org/show_bug.cgi?id=191056
503         <rdar://problem/45660341>
504
505         Reviewed by Filip Pizlo.
506
507         * wasm/regress/regress-191056.js: Added.
508
509 2018-11-27  Ryan Haddad  <ryanhaddad@apple.com>
510
511         Unreviewed, rolling out r238509.
512
513         Causes JSC tests to fail on iOS.
514
515         Reverted changeset:
516
517         "NaNs read from Wasm code needs to be be purified."
518         https://bugs.webkit.org/show_bug.cgi?id=191056
519         https://trac.webkit.org/changeset/238509
520
521 2018-11-26  Caio Lima  <ticaiolima@gmail.com>
522
523         Re-introduce op_bitnot
524         https://bugs.webkit.org/show_bug.cgi?id=190923
525
526         Reviewed by Yusuke Suzuki.
527
528         * stress/bit-not-must-generate.js: Added.
529         * stress/bitwise-not-no-int32.js: Added.
530
531 2018-11-26  Saam barati  <sbarati@apple.com>
532
533         InPlaceAbstractState::endBasicBlock rule for SetLocal should filter the value based on the flush format
534         https://bugs.webkit.org/show_bug.cgi?id=191956
535         <rdar://problem/45665806>
536
537         Reviewed by Yusuke Suzuki.
538
539         * stress/end-basic-block-set-local-should-filter-type.js: Added.
540         (bar):
541         (foo):
542
543 2018-11-26  Saam barati  <sbarati@apple.com>
544
545         Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation
546         https://bugs.webkit.org/show_bug.cgi?id=191958
547         <rdar://problem/46221877>
548
549         Reviewed by Yusuke Suzuki.
550
551         * stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added.
552         (x):
553         (foo):
554
555 2018-11-26  Mark Lam  <mark.lam@apple.com>
556
557         NaNs read from Wasm code needs to be be purified.
558         https://bugs.webkit.org/show_bug.cgi?id=191056
559         <rdar://problem/45660341>
560
561         Reviewed by Filip Pizlo.
562
563         * wasm/regress/regress-191056.js: Added.
564
565 2018-11-26  Michael Saboff  <msaboff@apple.com>
566
567         32-bit JSC test failure: stress/regexp-compile-oom.js
568         https://bugs.webkit.org/show_bug.cgi?id=191375
569
570         Reviewed by Mark Lam.
571
572         Disabled the test for 32 bit platforms.
573
574         * stress/regexp-compile-oom.js:
575
576 2018-11-26  Tadeu Zagallo  <tzagallo@apple.com>
577
578         ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
579         https://bugs.webkit.org/show_bug.cgi?id=191716
580         <rdar://problem/45723878>
581
582         Reviewed by Saam Barati.
583
584         * stress/regress-187373.js: Added.
585         (async.fn):
586
587 2018-11-21  Saam barati  <sbarati@apple.com>
588
589         DFGSpeculativeJIT should not &= exitOK with mayExit(node)
590         https://bugs.webkit.org/show_bug.cgi?id=191897
591         <rdar://problem/45871998>
592
593         Reviewed by Mark Lam.
594
595         * stress/exitok-is-not-the-same-as-mayExit.js: Added.
596         (bar):
597         (foo):
598
599 2018-11-21  Saam barati  <sbarati@apple.com>
600
601         Fix assertion in KnownCellUse inside SpeculativeJIT::speculate
602         https://bugs.webkit.org/show_bug.cgi?id=191895
603         <rdar://problem/46167406>
604
605         Reviewed by Mark Lam.
606
607         * stress/known-cell-use-needs-type-check-assertion.js: Added.
608         (foo):
609         (bar):
610
611 2018-11-21  Mark Lam  <mark.lam@apple.com>
612
613         Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError.
614         https://bugs.webkit.org/show_bug.cgi?id=191776
615         <rdar://problem/46152851>
616
617         Reviewed by Saam Barati.
618
619         * stress/big-wasm-memory-grow-no-max.js:
620         * stress/big-wasm-memory-grow.js:
621         * stress/big-wasm-memory.js:
622         - updated these to expect an OutOfMemoryError.
623
624         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: Added.
625         (Binary.prototype.emit_u8):
626         (Binary.prototype.emit_u32v):
627         (Binary.prototype.emit_header):
628         (Binary.prototype.emit_section):
629         (Binary):
630         (WasmModuleBuilder):
631         (WasmModuleBuilder.prototype.addMemory):
632         (WasmModuleBuilder.prototype.toArray):
633         (WasmModuleBuilder.prototype.toBuffer):
634         (WasmModuleBuilder.prototype.instantiate):
635         (catch):
636         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Added.
637         (catch):
638
639 2018-11-21  Caio Lima  <ticaiolima@gmail.com>
640
641         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
642         https://bugs.webkit.org/show_bug.cgi?id=190836
643
644         Reviewed by Saam Barati and Yusuke Suzuki.
645
646         * stress/big-int-out-of-memory-tests.js: Added.
647
648 2018-11-20  Mark Lam  <mark.lam@apple.com>
649
650         Remove invalid assertion in VMTraps::SignalSender's SignalAction.
651         https://bugs.webkit.org/show_bug.cgi?id=191856
652         <rdar://problem/46089992>
653
654         Reviewed by Yusuke Suzuki.
655
656         * stress/regress-191856.js: Added.
657         - this test is skipped for now until we have a fix for webkit.org/b/191855.
658
659 2018-11-21  Dominik Infuehr  <dinfuehr@igalia.com>
660
661         Enable JIT on ARM/Linux
662         https://bugs.webkit.org/show_bug.cgi?id=191548
663
664         Reviewed by Yusuke Suzuki.
665
666         Disable test on system with limited memory. Program was killed by
667         the OS before the exception was thrown.
668
669         * slowMicrobenchmarks/function-constructor-with-huge-strings.js:
670
671 2018-11-20  Saam barati  <sbarati@apple.com>
672
673         Merging an IC variant may lead to the IC status containing overlapping structure sets
674         https://bugs.webkit.org/show_bug.cgi?id=191869
675         <rdar://problem/45403453>
676
677         Reviewed by Mark Lam.
678
679         * stress/merging-ic-variants-should-bail-if-structures-overlap.js: Added.
680
681 2018-11-19  Mark Lam  <mark.lam@apple.com>
682
683         globalFuncImportModule() should return a promise when it clears exceptions.
684         https://bugs.webkit.org/show_bug.cgi?id=191792
685         <rdar://problem/46090763>
686
687         Reviewed by Michael Saboff.
688
689         * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: Added.
690
691 2018-11-19  Guillaume Emont  <guijemont@igalia.com>
692
693         Skip new memory-hungry tests on memory limited devices
694
695         Unreviewed gardening.
696
697         * stress/big-wasm-memory-grow-no-max.js:
698         * stress/big-wasm-memory-grow.js:
699         * stress/big-wasm-memory.js:
700
701 2018-11-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
702
703         Unreviewed, rolling in the rest of r237254
704         https://bugs.webkit.org/show_bug.cgi?id=190340
705
706         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
707         * stress/function-cache-with-parameters-end-position.js: Added.
708         (shouldBe):
709         (shouldThrow):
710         (i.anonymous):
711         * stress/function-constructor-name.js: Added.
712         (shouldBe):
713         (GeneratorFunction):
714         (AsyncFunction.async):
715         (AsyncGeneratorFunction.async):
716         (anonymous):
717         (async.anonymous):
718         * test262/expectations.yaml:
719
720 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
721
722         All users of ArrayBuffer should agree on the same max size
723         https://bugs.webkit.org/show_bug.cgi?id=191771
724
725         Reviewed by Mark Lam.
726
727         * stress/big-wasm-memory-grow-no-max.js: Added.
728         (foo):
729         (catch):
730         * stress/big-wasm-memory-grow.js: Added.
731         (foo):
732         (catch):
733         * stress/big-wasm-memory.js: Added.
734         (foo):
735         (catch):
736
737 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
738
739         Unreviewed, make some more tests not crash my computer by only running on instance of it. These tests do not need to
740         run for each JSC config since they're regression tests for runtime bugs.
741
742         * stress/json-stringified-overflow-2.js:
743         * stress/json-stringified-overflow.js:
744
745 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
746
747         Unreviewed, make some tests not crash my computer by only running on instance of it. These tests do not need to run for each JSC
748         config since they're regression tests for runtime bugs.
749
750         * stress/large-unshift-splice.js:
751         * stress/regress-185888.js:
752
753 2018-11-16  Saam Barati  <sbarati@apple.com>
754
755         KnownCellUse should also have SpecCellCheck as its type filter
756         https://bugs.webkit.org/show_bug.cgi?id=191729
757         <rdar://problem/45872852>
758
759         Reviewed by Filip Pizlo.
760
761         * stress/known-cell-type-check-should-allow-empty-value-to-flow-through.js: Added.
762         (C):
763
764 2018-11-16  Tadeu Zagallo  <tzagallo@apple.com>
765
766         Fix assertion failure on BytecodeGenerator::recordOpcode
767         https://bugs.webkit.org/show_bug.cgi?id=191724
768         <rdar://problem/45724395>
769
770         Reviewed by Saam Barati.
771
772         * stress/regress-187373-2.js: Added.
773         (foo):
774
775 2018-11-15  Mark Lam  <mark.lam@apple.com>
776
777         RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
778         https://bugs.webkit.org/show_bug.cgi?id=191730
779         <rdar://problem/46048517>
780
781         Reviewed by Saam Barati.
782
783         * stress/regress-187006.js: Removed.
784           - this test is invalid because its sole purpose is to test for the non-spec
785             compliant behavior that we just fixed.
786
787         * stress/regress-191730.js: Added.
788
789 2018-11-15  Mark Lam  <mark.lam@apple.com>
790
791         RegExp operations should not take fast patch if lastIndex is not numeric.
792         https://bugs.webkit.org/show_bug.cgi?id=191731
793         <rdar://problem/46017305>
794
795         Reviewed by Saam Barati.
796
797         * stress/regress-191731.js: Added.
798
799 2018-11-13  Saam Barati  <sbarati@apple.com>
800
801         TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM
802         https://bugs.webkit.org/show_bug.cgi?id=191600
803
804         Reviewed by Mark Lam.
805
806         * stress/type-profiler-log-should-defer-pending-exceptions.js: Added.
807         (foo):
808         (test):
809         (bar):
810
811 2018-11-13  Ryan Haddad  <ryanhaddad@apple.com>
812
813         Unreviewed, rolling out r238132.
814
815         The test added with this change is timing out on Debug JSC
816         bots.
817
818         Reverted changeset:
819
820         "[BigInt] JSBigInt::createWithLength should throw when length
821         is greater than JSBigInt::maxLength"
822         https://bugs.webkit.org/show_bug.cgi?id=190836
823         https://trac.webkit.org/changeset/238132
824
825 2018-11-13  Mark Lam  <mark.lam@apple.com>
826
827         Add OOM detection to StringPrototype's substituteBackreferences().
828         https://bugs.webkit.org/show_bug.cgi?id=191563
829         <rdar://problem/45720428>
830
831         Reviewed by Saam Barati.
832
833         * stress/regress-191563.js: Added.
834
835 2018-11-13  Mark Lam  <mark.lam@apple.com>
836
837         LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame.
838         https://bugs.webkit.org/show_bug.cgi?id=191579
839         <rdar://problem/45942472>
840
841         Reviewed by Saam Barati.
842
843         * stress/regress-191579.js: Added.
844
845 2018-11-13  Caio Lima  <ticaiolima@gmail.com>
846
847         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
848         https://bugs.webkit.org/show_bug.cgi?id=190836
849
850         Reviewed by Saam Barati.
851
852         * stress/big-int-out-of-memory-tests.js: Added.
853
854 2018-11-08  Ross Kirsling  <ross.kirsling@sony.com>
855
856         U+180E is no longer a whitespace character
857         https://bugs.webkit.org/show_bug.cgi?id=191415
858
859         Reviewed by Saam Barati.
860
861         * ChakraCore/test/es5/regexSpace.baseline:
862         * ChakraCore/test/es6/unicode_whitespace.js:
863         Update tests to latest version.
864         (See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.)
865
866         * test262.yaml:
867         * test262/config.yaml:
868         * test262/expectations.yaml:
869         Update expectations.
870
871 2018-11-07  Caio Lima  <ticaiolima@gmail.com>
872
873         [BigInt] Add support to BigInt into ValueAdd
874         https://bugs.webkit.org/show_bug.cgi?id=186177
875
876         Reviewed by Keith Miller.
877
878         * stress/big-int-negate-jit.js:
879         * stress/value-add-big-int-and-string.js: Added.
880         * stress/value-add-big-int-prediction-propagation.js: Added.
881         * stress/value-add-big-int-untyped.js: Added.
882
883 2018-11-07  Tadeu Zagallo  <tzagallo@apple.com>
884
885         REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled
886         https://bugs.webkit.org/show_bug.cgi?id=191184
887
888         Reviewed by Saam Barati.
889
890         Most tests were failing due to timeouts, since they are too slow to
891         run on CLoop. The exceptions are:
892
893         proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop
894         dont-crash-on-stack-overflow-when-parsing-builtin.js and
895         dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had
896         to change the stack size since CLoop requires it to be page aligned.
897
898         * microbenchmarks/array-push-1.js:
899         * microbenchmarks/array-push-2.js:
900         * microbenchmarks/elidable-new-object-dag.js:
901         * microbenchmarks/elidable-new-object-roflcopter.js:
902         * microbenchmarks/elidable-new-object-tree.js:
903         * microbenchmarks/getter-richards.js:
904         * microbenchmarks/sinkable-new-object-dag.js:
905         * microbenchmarks/string-concat-long-convert.js:
906         * microbenchmarks/typed-array-get-set-by-val-profiling.js:
907         * slowMicrobenchmarks/array-push-3.js:
908         * slowMicrobenchmarks/large-map-iteration-with-additions.js:
909         * slowMicrobenchmarks/spread-small-array.js:
910         * slowMicrobenchmarks/undefined-property-access.js:
911         * stress/activation-sink-default-value-tdz-error.js:
912         * stress/activation-sink-default-value.js:
913         * stress/activation-sink-osrexit-default-value-tdz-error.js:
914         * stress/activation-sink-osrexit-default-value.js:
915         * stress/activation-sink-osrexit.js:
916         * stress/activation-sink.js:
917         * stress/allow-math-ic-b3-code-duplication.js:
918         * stress/array-push-multiple-int32.js:
919         * stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js:
920         * stress/arrowfunction-lexical-this-activation-sink-osrexit.js:
921         * stress/arrowfunction-lexical-this-activation-sink.js:
922         * stress/dont-crash-on-stack-overflow-when-parsing-builtin.js:
923         * stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js:
924         * stress/elide-new-object-dag-then-exit.js:
925         * stress/materialize-regexp-cyclic.js:
926         * stress/new-regex-inline.js:
927         * stress/op_add.js:
928         * stress/op_bitand.js:
929         * stress/op_bitor.js:
930         * stress/op_bitxor.js:
931         * stress/op_div-ConstVar.js:
932         * stress/op_div-VarConst.js:
933         * stress/op_div-VarVar.js:
934         * stress/op_lshift-ConstVar.js:
935         * stress/op_lshift-VarConst.js:
936         * stress/op_lshift-VarVar.js:
937         * stress/op_mod-ConstVar.js:
938         * stress/op_mod-VarConst.js:
939         * stress/op_mod-VarVar.js:
940         * stress/op_mul-ConstVar.js:
941         * stress/op_mul-VarConst.js:
942         * stress/op_mul-VarVar.js:
943         * stress/op_rshift-ConstVar.js:
944         * stress/op_rshift-VarConst.js:
945         * stress/op_rshift-VarVar.js:
946         * stress/op_sub-ConstVar.js:
947         * stress/op_sub-VarConst.js:
948         * stress/op_sub-VarVar.js:
949         * stress/op_urshift-ConstVar.js:
950         * stress/op_urshift-VarConst.js:
951         * stress/op_urshift-VarVar.js:
952         * stress/proxy-get-set-correct-receiver.js:
953         * stress/regress-179562.js:
954         * stress/rest-parameter-many-arguments.js:
955         * stress/sampling-profiler-richards.js:
956         * stress/splay-flash-access-1ms.js:
957         * stress/tailCallForwardArguments.js:
958         * stress/typed-array-get-by-val-profiling.js:
959         * typeProfiler/getter-richards.js:
960
961 2018-11-06  Michael Saboff  <msaboff@apple.com>
962
963         Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.
964         https://bugs.webkit.org/show_bug.cgi?id=191271
965
966         Reviewed by Saam Barati.
967
968         Added more test cases and made all test cases run with the same deeply recursive stack
969         instead of finding that same point for each test case.
970
971         * stress/regexp-compile-oom.js:
972         (prototype.runTest):
973         (recurseAndTest):
974         (testList.push.new.TestAndExpectedException):
975
976 2018-11-05  Michael Saboff  <msaboff@apple.com>
977
978         Unreviewed build fix for linux.
979
980         * stress/regexp-compile-oom.js: Disabled for non-darwin OSes.
981
982 2018-11-02  Michael Saboff  <msaboff@apple.com>
983
984         Rolling in r237753 with unreviewed build fix.
985
986         Fixed issues with DECLARE_THROW_SCOPE placement.
987
988 2018-11-02  Ryan Haddad  <ryanhaddad@apple.com>
989
990         Unreviewed, rolling out r237753.
991
992         Introduced JSC test failures
993
994         Reverted changeset:
995
996         "Running out of stack space not properly handled in
997         RegExp::compile() and its callers"
998         https://bugs.webkit.org/show_bug.cgi?id=191206
999         https://trac.webkit.org/changeset/237753
1000
1001 2018-11-02  Michael Saboff  <msaboff@apple.com>
1002
1003         Running out of stack space not properly handled in RegExp::compile() and its callers
1004         https://bugs.webkit.org/show_bug.cgi?id=191206
1005
1006         Reviewed by Filip Pizlo.
1007
1008         New regression test.
1009
1010         * stress/regexp-compile-oom.js: Added.
1011         (recurseAndTest):
1012
1013 2018-11-01  Guillaume Emont  <guijemont@igalia.com>
1014
1015         Skip tests on arm/mips that time out now we're running on CLoop
1016
1017         Unreviewed gardening.
1018
1019         Since the JIT is temporarily disabled on 32-bit platforms, these tests
1020         time out on the bots and need to be disabled. There's more tests
1021         disabled on arm because the timeout is longer on the mips bot (as the
1022         device is slower to start with), so many of the tests don't time out
1023         there.
1024
1025         * microbenchmarks/getter-richards.js: disable on arm and mips.
1026         * stress/op_add.js: disable on arm.
1027         * stress/op_bitand.js: disable on arm.
1028         * stress/op_bitor.js: disable on arm.
1029         * stress/op_bitxor.js: disable on arm.
1030         * stress/op_lshift-ConstVar.js: disable on arm.
1031         * stress/op_lshift-VarConst.js: disable on arm.
1032         * stress/op_lshift-VarVar.js: disable on arm.
1033         * stress/op_mod-ConstVar.js: disable on arm.
1034         * stress/op_mod-VarConst.js: disable on arm.
1035         * stress/op_mod-VarVar.js: disable on arm.
1036         * stress/op_mul-ConstVar.js: disable on arm.
1037         * stress/op_mul-VarConst.js: disable on arm.
1038         * stress/op_mul-VarVar.js: disable on arm.
1039         * stress/op_rshift-ConstVar.js: disable on arm.
1040         * stress/op_rshift-VarConst.js: disable on arm.
1041         * stress/op_rshift-VarVar.js: disable on arm.
1042         * stress/op_sub-ConstVar.js: disable on arm.
1043         * stress/op_sub-VarConst.js: disable on arm.
1044         * stress/op_sub-VarVar.js: disable on arm.
1045         * stress/op_urshift-ConstVar.js: disable on arm.
1046         * stress/op_urshift-VarConst.js: disable on arm.
1047         * stress/op_urshift-VarVar.js: disable on arm.
1048         * stress/spread-forward-call-varargs-stack-overflow.js: disable on arm.
1049         * stress/value-to-boolean.js: disable on arm and mips.
1050
1051 2018-10-31  Tadeu Zagallo  <tzagallo@apple.com>
1052
1053         REGRESSION(r237547): Exception handlers should be aware of wide opcodes
1054         https://bugs.webkit.org/show_bug.cgi?id=191108
1055         <rdar://problem/45690700>
1056
1057         Reviewed by Saam Barati.
1058
1059         * stress/wide-op_catch.js: Added.
1060         (catch):
1061
1062 2018-10-29  Mark Lam  <mark.lam@apple.com>
1063
1064         Correctly detect string overflow when using the 'Function' constructor.
1065         https://bugs.webkit.org/show_bug.cgi?id=184883
1066         <rdar://problem/36320331>
1067
1068         Reviewed by Saam Barati.
1069
1070         I've verified that this passes on 32-bit as well.
1071
1072         * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
1073
1074 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
1075
1076         Add support for GetStack FlushedDouble
1077         https://bugs.webkit.org/show_bug.cgi?id=191012
1078         <rdar://problem/45265141>
1079
1080         Reviewed by Saam Barati.
1081
1082         * stress/get-stack-double.js: Added.
1083         (bar):
1084         (noInline):
1085
1086 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
1087
1088         New bytecode format for JSC
1089         https://bugs.webkit.org/show_bug.cgi?id=187373
1090         <rdar://problem/44186758>
1091
1092         Reviewed by Filip Pizlo.
1093
1094         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
1095
1096         * stress/maximum-inline-capacity.js: Added.
1097         (test1):
1098         (test3.Foo):
1099         (test3):
1100
1101 2018-10-26  Commit Queue  <commit-queue@webkit.org>
1102
1103         Unreviewed, rolling out r237479 and r237484.
1104         https://bugs.webkit.org/show_bug.cgi?id=190978
1105
1106         broke JSC on iOS (Requested by tadeuzagallo on #webkit).
1107
1108         Reverted changesets:
1109
1110         "New bytecode format for JSC"
1111         https://bugs.webkit.org/show_bug.cgi?id=187373
1112         https://trac.webkit.org/changeset/237479
1113
1114         "Gardening: Build fix after r237479."
1115         https://bugs.webkit.org/show_bug.cgi?id=187373
1116         https://trac.webkit.org/changeset/237484
1117
1118 2018-10-26  Tadeu Zagallo  <tzagallo@apple.com>
1119
1120         New bytecode format for JSC
1121         https://bugs.webkit.org/show_bug.cgi?id=187373
1122         <rdar://problem/44186758>
1123
1124         Reviewed by Filip Pizlo.
1125
1126         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
1127
1128         * stress/maximum-inline-capacity.js: Added.
1129         (test1):
1130         (test3.Foo):
1131         (test3):
1132
1133 2018-10-26  Mark Lam  <mark.lam@apple.com>
1134
1135         Fix missing edge cases with JSGlobalObjects having a bad time.
1136         https://bugs.webkit.org/show_bug.cgi?id=189028
1137         <rdar://problem/45204939>
1138
1139         Reviewed by Saam Barati.
1140
1141         * stress/regress-189028.js: Added.
1142
1143 2018-10-22  Mark Lam  <mark.lam@apple.com>
1144
1145         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
1146         https://bugs.webkit.org/show_bug.cgi?id=190515
1147         <rdar://problem/45222379>
1148
1149         Rubber-stamped by Saam Barati.
1150
1151         Adding another test.
1152
1153         * stress/regress-190515-2.js: Added.
1154
1155 2018-10-22  Mark Lam  <mark.lam@apple.com>
1156
1157         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
1158         https://bugs.webkit.org/show_bug.cgi?id=190515
1159         <rdar://problem/45222379>
1160
1161         Reviewed by Saam Barati.
1162
1163         * stress/regress-190515.js: Added.
1164
1165 2018-10-19  Commit Queue  <commit-queue@webkit.org>
1166
1167         Unreviewed, rolling out r237254.
1168         https://bugs.webkit.org/show_bug.cgi?id=190760
1169
1170         "It regresses JetStream 2 by 5% on some iOS devices"
1171         (Requested by saamyjoon on #webkit).
1172
1173         Reverted changeset:
1174
1175         "[JSC] JSC should have "parseFunction" to optimize Function
1176         constructor"
1177         https://bugs.webkit.org/show_bug.cgi?id=190340
1178         https://trac.webkit.org/changeset/237254
1179
1180 2018-10-19  Saam Barati  <sbarati@apple.com>
1181
1182         vmCall should check if we exit before emitting an OSR exit due to exceptions
1183         https://bugs.webkit.org/show_bug.cgi?id=190740
1184         <rdar://problem/45220139>
1185
1186         Reviewed by Mark Lam.
1187
1188         * stress/dont-emit-osr-exits-for-every-call-ftl.js: Added.
1189         (foo):
1190
1191 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
1192
1193         [ESNext][BigInt] Implement support for "^"
1194         https://bugs.webkit.org/show_bug.cgi?id=186235
1195
1196         Reviewed by Yusuke Suzuki.
1197
1198         * stress/big-int-bitwise-xor-general.js: Added.
1199         * stress/big-int-bitwise-xor-to-primitive-precedence.js: Added.
1200         * stress/big-int-bitwise-xor-type-error.js: Added.
1201         * stress/big-int-bitwise-xor-wrapped-value.js: Added.
1202
1203 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
1204
1205         [BigInt] Add ValueSub into DFG
1206         https://bugs.webkit.org/show_bug.cgi?id=186176
1207
1208         Reviewed by Yusuke Suzuki.
1209
1210         * stress/big-int-subtraction-jit.js:
1211         * stress/value-sub-big-int-prediction-propagation.js: Added.
1212         * stress/value-sub-big-int-untyped.js: Added.
1213         * stress/value-sub-spec-none-case.js: Added.
1214
1215 2018-10-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1216
1217         [JSC] JSC should have "parseFunction" to optimize Function constructor
1218         https://bugs.webkit.org/show_bug.cgi?id=190340
1219
1220         Reviewed by Mark Lam.
1221
1222         This patch fixes the line number of syntax errors raised by the Function constructor,
1223         since we now parse the final code only once. And we no longer use block statement
1224         for Function constructor's parsing.
1225
1226         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1227         * stress/function-cache-with-parameters-end-position.js: Added.
1228         (shouldBe):
1229         (shouldThrow):
1230         (i.anonymous):
1231         * stress/function-constructor-name.js: Added.
1232         (shouldBe):
1233         (GeneratorFunction):
1234         (AsyncFunction.async):
1235         (AsyncGeneratorFunction.async):
1236         (anonymous):
1237         (async.anonymous):
1238         * test262/expectations.yaml:
1239
1240 2018-10-18  Commit Queue  <commit-queue@webkit.org>
1241
1242         Unreviewed, rolling out r237242.
1243         https://bugs.webkit.org/show_bug.cgi?id=190701
1244
1245         it breaks "stress/sampling-profiler-basic.js" (Requested by
1246         caiolima on #webkit).
1247
1248         Reverted changeset:
1249
1250         "[BigInt] Add ValueSub into DFG"
1251         https://bugs.webkit.org/show_bug.cgi?id=186176
1252         https://trac.webkit.org/changeset/237242
1253
1254 2018-10-17  Keith Miller  <keith_miller@apple.com>
1255
1256         AI does not clear Phantom allocation nodes.
1257         https://bugs.webkit.org/show_bug.cgi?id=190694
1258
1259         Reviewed by Saam Barati.
1260
1261         * stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added.
1262         (Day):
1263         (DaysInYear):
1264         (TimeInYear):
1265         (TimeFromYear):
1266         (DayFromYear):
1267         (InLeapYear):
1268         (YearFromTime):
1269         (WeekDay):
1270         (DaylightSavingTA):
1271         (GetSecondSundayInMarch):
1272         (TimeInMonth):
1273
1274 2018-10-17  Caio Lima  <ticaiolima@gmail.com>
1275
1276         [BigInt] Add ValueSub into DFG
1277         https://bugs.webkit.org/show_bug.cgi?id=186176
1278
1279         Reviewed by Yusuke Suzuki.
1280
1281         * stress/big-int-subtraction-jit.js:
1282         * stress/value-sub-big-int-prediction-propagation.js: Added.
1283         * stress/value-sub-big-int-untyped.js: Added.
1284
1285 2018-10-16  Dominik Infuehr  <dinfuehr@igalia.com>
1286
1287         [JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips
1288         https://bugs.webkit.org/show_bug.cgi?id=190611
1289
1290         Reviewed by Saam Barati.
1291
1292         Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js
1293         to improve test runtime. On ARM/MIPS this test even timed out when running all
1294         tests.
1295
1296         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
1297         (test):
1298
1299 2018-10-15  Guillaume Emont  <guijemont@igalia.com>
1300
1301         Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux
1302
1303         Unreviewed gardening.
1304
1305         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
1306
1307 2018-10-15  Saam barati  <sbarati@apple.com>
1308
1309         Emit fjcvtzs on ARM64E on Darwin
1310         https://bugs.webkit.org/show_bug.cgi?id=184023
1311
1312         Reviewed by Yusuke Suzuki and Filip Pizlo.
1313
1314         * stress/double-to-int32-NaN.js: Added.
1315         (assert):
1316         (foo):
1317
1318 2018-10-15  Saam Barati  <sbarati@apple.com>
1319
1320         JSArray::shiftCountWithArrayStorage is wrong when an array has holes
1321         https://bugs.webkit.org/show_bug.cgi?id=190262
1322         <rdar://problem/44986241>
1323
1324         Reviewed by Mark Lam.
1325
1326         * stress/array-prototype-concat-of-long-spliced-arrays.js:
1327         (test):
1328         * stress/slice-array-storage-with-holes.js: Added.
1329         (main):
1330
1331 2018-10-15  Commit Queue  <commit-queue@webkit.org>
1332
1333         Unreviewed, rolling out r237054.
1334         https://bugs.webkit.org/show_bug.cgi?id=190593
1335
1336         "this regressed JetStream 2 by 6% on iOS" (Requested by
1337         saamyjoon on #webkit).
1338
1339         Reverted changeset:
1340
1341         "[JSC] JSC should have "parseFunction" to optimize Function
1342         constructor"
1343         https://bugs.webkit.org/show_bug.cgi?id=190340
1344         https://trac.webkit.org/changeset/237054
1345
1346 2018-10-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1347
1348         [JSC] JSON.stringify can accept call-with-no-arguments
1349         https://bugs.webkit.org/show_bug.cgi?id=190343
1350
1351         Reviewed by Mark Lam.
1352
1353         * stress/json-stringify-no-arguments.js: Added.
1354         (shouldBe):
1355
1356 2018-10-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1357
1358         [JSC] JSC should have "parseFunction" to optimize Function constructor
1359         https://bugs.webkit.org/show_bug.cgi?id=190340
1360
1361         Reviewed by Mark Lam.
1362
1363         This patch fixes the line number of syntax errors raised by the Function constructor,
1364         since we now parse the final code only once. And we no longer use block statement
1365         for Function constructor's parsing.
1366
1367         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1368         * stress/function-cache-with-parameters-end-position.js: Added.
1369         (shouldBe):
1370         (shouldThrow):
1371         (i.anonymous):
1372         * stress/function-constructor-name.js: Added.
1373         (shouldBe):
1374         (GeneratorFunction):
1375         (AsyncFunction.async):
1376         (AsyncGeneratorFunction.async):
1377         (anonymous):
1378         (async.anonymous):
1379         * test262/expectations.yaml:
1380
1381 2018-10-10  Guillaume Emont  <guijemont@igalia.com>
1382
1383         Skip JSC test stress/sampling-profiler-richards.js on armv7/linux
1384         https://bugs.webkit.org/show_bug.cgi?id=190426
1385
1386         Unreviewed gardening.
1387
1388         * stress/sampling-profiler-richards.js:
1389
1390 2018-10-06  Caio Lima  <ticaiolima@gmail.com>
1391
1392         [ESNext][BigInt] Implement support for "|"
1393         https://bugs.webkit.org/show_bug.cgi?id=186229
1394
1395         Reviewed by Yusuke Suzuki.
1396
1397         * stress/big-int-bitwise-and-jit.js:
1398         * stress/big-int-bitwise-or-general.js: Added.
1399         * stress/big-int-bitwise-or-jit-untyped.js: Added.
1400         * stress/big-int-bitwise-or-jit.js: Added.
1401         * stress/big-int-bitwise-or-memory-stress.js: Added.
1402         * stress/big-int-bitwise-or-to-primitive-precedence.js: Added.
1403         * stress/big-int-bitwise-or-type-error.js: Added.
1404         * stress/big-int-bitwise-or-wrapped-value.js: Added.
1405
1406 2018-10-05  Dominik Infuehr  <dominik.infuehr@gmail.com>
1407
1408         Skip test on systems with limited memory
1409         https://bugs.webkit.org/show_bug.cgi?id=190310
1410
1411         Invoking runDefault adds test to runlist, skipping the test in the next
1412         line does not prevent the test from executing. Change order of lines such
1413         that runDefault is only executed if test is not executed.
1414
1415         Reviewed by Mark Lam.
1416
1417         * stress/regress-190187.js:
1418
1419 2018-10-03  Saam barati  <sbarati@apple.com>
1420
1421         lowXYZ in FTLLower should always filter the type of the incoming edge
1422         https://bugs.webkit.org/show_bug.cgi?id=189939
1423         <rdar://problem/44407030>
1424
1425         Reviewed by Michael Saboff.
1426
1427         * stress/ftl-should-always-filter-for-low-type-check-functions.js: Added.
1428         (foo):
1429         (test):
1430
1431 2018-10-03  Mark Lam  <mark.lam@apple.com>
1432
1433         Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX.
1434         https://bugs.webkit.org/show_bug.cgi?id=190187
1435         <rdar://problem/42512909>
1436
1437         Reviewed by Michael Saboff.
1438
1439         * stress/regress-190187.js: Added.
1440
1441 2018-10-02  Caio Lima  <ticaiolima@gmail.com>
1442
1443         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
1444         https://bugs.webkit.org/show_bug.cgi?id=190033
1445
1446         Reviewed by Yusuke Suzuki.
1447
1448         * stress/big-int-to-string.js:
1449
1450 2018-10-01  Mark Lam  <mark.lam@apple.com>
1451
1452         Function.toString() should also copy the source code Functions that are class definitions.
1453         https://bugs.webkit.org/show_bug.cgi?id=190186
1454         <rdar://problem/44733360>
1455
1456         Reviewed by Saam Barati.
1457
1458         * stress/regress-190186.js: Added.
1459
1460 2018-10-01  Dominik Infuehr  <dinfuehr@igalia.com>
1461
1462         Split NaN-check into separate test
1463         https://bugs.webkit.org/show_bug.cgi?id=190010
1464
1465         Reviewed by Saam Barati.
1466
1467         DataView exposes NaN-representation, which is not necessarily the same on each
1468         architecture. Therefore move the check of the NaN-representation into its own
1469         file such that we can disable this test on MIPS where NaN-representation can be
1470         different on older CPUs.
1471
1472         * stress/dataview-jit-set-nan.js: Added.
1473         (assert):
1474         (test.storeLittleEndian):
1475         (test.storeBigEndian):
1476         (test.store):
1477         (test):
1478         * stress/dataview-jit-set.js:
1479         (test5):
1480
1481 2018-10-01  Commit Queue  <commit-queue@webkit.org>
1482
1483         Unreviewed, rolling out r236647.
1484         https://bugs.webkit.org/show_bug.cgi?id=190124
1485
1486         Breaking test stress/big-int-to-string.js (Requested by
1487         caiolima_ on #webkit).
1488
1489         Reverted changeset:
1490
1491         "[BigInt] BigInt.proptotype.toString is broken when radix is
1492         power of 2"
1493         https://bugs.webkit.org/show_bug.cgi?id=190033
1494         https://trac.webkit.org/changeset/236647
1495
1496 2018-09-30  Caio Lima  <ticaiolima@gmail.com>
1497
1498         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
1499         https://bugs.webkit.org/show_bug.cgi?id=190033
1500
1501         Reviewed by Yusuke Suzuki.
1502
1503         * stress/big-int-to-string.js:
1504
1505 2018-09-28  Caio Lima  <ticaiolima@gmail.com>
1506
1507         [ESNext][BigInt] Implement support for "&"
1508         https://bugs.webkit.org/show_bug.cgi?id=186228
1509
1510         Reviewed by Yusuke Suzuki.
1511
1512         * stress/big-int-bitwise-and-general.js: Added.
1513         (assert):
1514         (assert.sameValue):
1515         * stress/big-int-bitwise-and-jit.js: Added.
1516         (let.assert.sameValue):
1517         (bigIntBitAnd):
1518         * stress/big-int-bitwise-and-memory-stress.js: Added.
1519         (assert):
1520         * stress/big-int-bitwise-and-to-primitive-precedence.js: Added.
1521         (assert.sameValue):
1522         (let.o.Symbol.toPrimitive):
1523         (catch):
1524         * stress/big-int-bitwise-and-type-error.js: Added.
1525         (assert):
1526         (assertThrowTypeError):
1527         (let.o.valueOf):
1528         (o.valueOf):
1529         (o.toString):
1530         (o.Symbol.toPrimitive):
1531         * stress/big-int-bitwise-and-wrapped-value.js: Added.
1532         (assert.sameValue):
1533         (testBitAnd):
1534         (let.o.Symbol.toPrimitive):
1535         (o.valueOf):
1536         (o.toString):
1537
1538 2018-09-28  Ross Kirsling  <ross.kirsling@sony.com>
1539
1540         JSC test stress/jsc-read.js doesn't support CRLF
1541         https://bugs.webkit.org/show_bug.cgi?id=190063
1542
1543         Reviewed by Yusuke Suzuki.
1544
1545         In order to run this test via Windows command prompt, we can't assume that the final newline will be LF.
1546
1547         * stress/jsc-read.js:
1548         (test):
1549
1550 2018-09-27  Saam barati  <sbarati@apple.com>
1551
1552         Verify the contents of AssemblerBuffer on arm64e
1553         https://bugs.webkit.org/show_bug.cgi?id=190057
1554         <rdar://problem/38916630>
1555
1556         Reviewed by Mark Lam.
1557
1558         * stress/regress-189132.js:
1559
1560 2018-09-27  Dominik Infuehr  <dinfuehr@igalia.com>
1561
1562         Disable test without LLInt on ARMv7
1563         https://bugs.webkit.org/show_bug.cgi?id=190037
1564
1565         Reviewed by Mark Lam.
1566
1567         Test runs out of executable memory on ARMv7, do not run
1568         this test without LLInt enabled.
1569
1570         * stress/regress-169445.js:
1571
1572 2018-09-26  Keith Miller  <keith_miller@apple.com>
1573
1574         We should zero unused property storage when rebalancing array storage.
1575         https://bugs.webkit.org/show_bug.cgi?id=188151
1576
1577         Reviewed by Michael Saboff.
1578
1579         * stress/splice-should-zero-property-storage-when-rebalancing.js: Added.
1580
1581 2018-09-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1582
1583         [JSC] Optimize Array#lastIndexOf
1584         https://bugs.webkit.org/show_bug.cgi?id=189780
1585
1586         Reviewed by Saam Barati.
1587
1588         * stress/array-lastindexof-array-prototype-trap.js: Added.
1589         (shouldBe):
1590         (AncestorArray.prototype.get 2):
1591         (AncestorArray):
1592         * stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added.
1593         (shouldBe):
1594         * stress/array-lastindexof-hole-nan.js: Added.
1595         (shouldBe):
1596         (throw.new.Error):
1597         * stress/array-lastindexof-infinity.js: Added.
1598         (shouldBe):
1599         (throw.new.Error):
1600         * stress/array-lastindexof-negative-zero.js: Added.
1601         (shouldBe):
1602         (throw.new.Error):
1603         * stress/array-lastindexof-own-getter.js: Added.
1604         (shouldBe):
1605         (throw.new.Error.get array):
1606         (get array):
1607         * stress/array-lastindexof-prototype-trap.js: Added.
1608         (shouldBe):
1609         (DerivedArray.prototype.get 2):
1610         (DerivedArray):
1611
1612 2018-09-25  Saam Barati  <sbarati@apple.com>
1613
1614         Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
1615         https://bugs.webkit.org/show_bug.cgi?id=189940
1616         <rdar://problem/43640987>
1617
1618         Reviewed by Mark Lam.
1619
1620         * stress/use-baseline-codeblock-materialize-osr-exit.js: Added.
1621
1622 2018-09-24  Saam Barati  <sbarati@apple.com>
1623
1624         Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects
1625         https://bugs.webkit.org/show_bug.cgi?id=189922
1626         <rdar://problem/44651275>
1627
1628         Reviewed by Mark Lam.
1629
1630         * stress/array-indexof-fast-path-effects.js: Added.
1631         * stress/array-indexof-cached-length.js: Added.
1632
1633 2018-09-24  Saam barati  <sbarati@apple.com>
1634
1635         ArgumentsEliminationPhase should snip basic blocks after proven OSR exits
1636         https://bugs.webkit.org/show_bug.cgi?id=189682
1637         <rdar://problem/43557315>
1638
1639         Reviewed by Mark Lam.
1640
1641         * stress/arguments-elimination-will-generate-edge-without-result.js: Added.
1642         (foo):
1643
1644 2018-09-22  Saam barati  <sbarati@apple.com>
1645
1646         The sampling should not use Strong<CodeBlock> in its machineLocation field
1647         https://bugs.webkit.org/show_bug.cgi?id=189319
1648
1649         Reviewed by Filip Pizlo.
1650
1651         * stress/sampling-profiler-richards.js: Added.
1652
1653 2018-09-19  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1654
1655         [JSC] Optimize Array#indexOf in C++ runtime
1656         https://bugs.webkit.org/show_bug.cgi?id=189507
1657
1658         Reviewed by Saam Barati.
1659
1660         * stress/array-indexof-array-prototype-trap.js: Added.
1661         (shouldBe):
1662         (AncestorArray.prototype.get 2):
1663         (AncestorArray):
1664         * stress/array-indexof-have-a-bad-time-c-runtime.js: Added.
1665         (shouldBe):
1666         * stress/array-indexof-hole-nan.js: Added.
1667         (shouldBe):
1668         (throw.new.Error):
1669         * stress/array-indexof-infinity.js: Added.
1670         (shouldBe):
1671         (throw.new.Error):
1672         * stress/array-indexof-negative-zero.js: Added.
1673         (shouldBe):
1674         (throw.new.Error):
1675         * stress/array-indexof-own-getter.js: Added.
1676         (shouldBe):
1677         (throw.new.Error.get array):
1678         (get array):
1679         * stress/array-indexof-prototype-trap.js: Added.
1680         (shouldBe):
1681         (DerivedArray.prototype.get 2):
1682         (DerivedArray):
1683
1684 2018-09-19  Saam barati  <sbarati@apple.com>
1685
1686         AI rule for MultiPutByOffset executes its effects in the wrong order
1687         https://bugs.webkit.org/show_bug.cgi?id=189757
1688         <rdar://problem/43535257>
1689
1690         Reviewed by Michael Saboff.
1691
1692         * stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
1693         (foo):
1694         (Foo):
1695         (g):
1696
1697 2018-09-17  Mark Lam  <mark.lam@apple.com>
1698
1699         Ensure that ForInContexts are invalidated if their loop local is over-written.
1700         https://bugs.webkit.org/show_bug.cgi?id=189571
1701         <rdar://problem/44402277>
1702
1703         Reviewed by Saam Barati.
1704
1705         * stress/regress-189571.js: Added.
1706
1707 2018-09-17  Saam barati  <sbarati@apple.com>
1708
1709         We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
1710         https://bugs.webkit.org/show_bug.cgi?id=189676
1711         <rdar://problem/39682897>
1712
1713         Reviewed by Michael Saboff.
1714
1715         * typeProfiler/check-structure-or-empty-in-fixup.js: Added.
1716         (A):
1717         (K):
1718         (i.catch):
1719
1720 2018-09-14  Saam barati  <sbarati@apple.com>
1721
1722         Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
1723         https://bugs.webkit.org/show_bug.cgi?id=189628
1724         <rdar://problem/39481690>
1725
1726         Reviewed by Mark Lam.
1727
1728         * stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
1729         (foo):
1730
1731 2018-09-11  Mark Lam  <mark.lam@apple.com>
1732
1733         Test for array initialization in arrayProtoFuncSplice.
1734         https://bugs.webkit.org/show_bug.cgi?id=170253
1735         <rdar://problem/31328773>
1736
1737         Rubber-stamped by Saam Barati.
1738
1739         * stress/regress-170253.js: Added.
1740
1741 2018-09-11  Mark Lam  <mark.lam@apple.com>
1742
1743         Test for IntlObject initialization.
1744         https://bugs.webkit.org/show_bug.cgi?id=170251
1745         <rdar://problem/31328419>
1746
1747         Rubber-stamped by Saam Barati.
1748
1749         * stress/regress-170251.js: Added.
1750
1751 2018-09-11  Mark Lam  <mark.lam@apple.com>
1752
1753         Test for array memcpy'ing when JSGlobalObject::haveABadTime.
1754         https://bugs.webkit.org/show_bug.cgi?id=169889
1755         <rdar://problem/31155607>
1756
1757         Reviewed by Saam Barati.
1758
1759         * stress/regress-169889-array-concat.js: Added.
1760         * stress/regress-169889-array-concat1.js: Added.
1761         * stress/regress-169889-array-slice.js: Added.
1762
1763 2018-09-11  Mark Lam  <mark.lam@apple.com>
1764
1765         Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope.
1766         https://bugs.webkit.org/show_bug.cgi?id=169445
1767         <rdar://problem/30957435>
1768
1769         Reviewed by Saam Barati.
1770
1771         * stress/regress-169445.js: Added.
1772         (let.gun.eval.A):
1773         (let.gun.eval.B.C):
1774         (let.gun.eval.B.C.prototype.trigger):
1775         (let.gun.eval.B.C.prototype.triggerWithRestParameters):
1776         (let.gun.eval.B):
1777         (let.gun.eval):
1778
1779 == Rolled over to ChangeLog-2018-09-11 ==