test262-runner misbehaves when test file YAML has a trailing space
[WebKit-https.git] / JSTests / ChangeLog
1 2019-01-03  Ross Kirsling  <ross.kirsling@sony.com>
2
3         test262-runner misbehaves when test file YAML has a trailing space
4         https://bugs.webkit.org/show_bug.cgi?id=193053
5
6         Reviewed by Yusuke Suzuki.
7
8         * test262/expectations.yaml:
9         Mark two dozen tests as passing (and correct the output of another).
10
11 2018-12-30  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
12
13         Unreviewed, JSTests gardening with memoryLimited
14
15         * stress/string-overflow-createError.js:
16
17 2018-12-30  Ross Kirsling  <ross.kirsling@sony.com>
18
19         [JSC] Identifier validity should be based on ID_Start / ID_Continue properties
20         https://bugs.webkit.org/show_bug.cgi?id=193050
21
22         Reviewed by Yusuke Suzuki.
23
24         * test262.yaml:
25         * test262/expectations.yaml:
26         Mark 16 tests as passing.
27
28 2018-12-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
29
30         [BigInt] Support BigInt in JSON.stringify
31         https://bugs.webkit.org/show_bug.cgi?id=192624
32
33         Reviewed by Saam Barati.
34
35         * stress/big-int-json-stringify-to-json.js: Added.
36         (shouldBe):
37         (shouldThrow):
38         (BigInt.prototype.toJSON):
39         (shouldBe.JSON.stringify):
40         * stress/big-int-json-stringify.js: Added.
41         (shouldBe):
42         (shouldThrow):
43
44 2018-12-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
45
46         [JSC] Implement "well-formed JSON.stringify" proposal
47         https://bugs.webkit.org/show_bug.cgi?id=191677
48
49         Reviewed by Darin Adler.
50
51         * stress/json-surrogate-pair.js: Added.
52         (shouldBe):
53         * test262/expectations.yaml:
54
55 2018-12-20  Keith Miller  <keith_miller@apple.com>
56
57         Add support for globalThis
58         https://bugs.webkit.org/show_bug.cgi?id=165171
59
60         Reviewed by Mark Lam.
61
62         * test262/config.yaml:
63
64 2018-12-19  Keith Miller  <keith_miller@apple.com>
65
66         Update test262 configuration to not run tests dependent on ICU version.
67         https://bugs.webkit.org/show_bug.cgi?id=192920
68
69         Reviewed by Saam Barati.
70
71         * test262/expectations.yaml:
72
73 2018-12-20  Mark Lam  <mark.lam@apple.com>
74
75         Fix a typo in slow_path_construct_arityCheck and operationConstructArityCheck.
76         https://bugs.webkit.org/show_bug.cgi?id=192939
77         <rdar://problem/46869516>
78
79         Reviewed by Keith Miller.
80
81         * stress/stack-overflow-frame-for-construct-arityCheck-should-use-construct-codeBlock.js: Added.
82
83 2018-12-20  Tadeu Zagallo  <tzagallo@apple.com>
84
85         WTF::String and StringImpl overflow MaxLength
86         https://bugs.webkit.org/show_bug.cgi?id=192853
87         <rdar://problem/45726906>
88
89         Reviewed by Mark Lam.
90
91         * stress/string-16bit-repeat-overflow.js: Added.
92         (catch):
93
94 2018-12-19  Ross Kirsling  <ross.kirsling@sony.com>
95
96         Unreviewed follow-up to r192914.
97
98         * test262/expectations.yaml:
99         Add the last 20 missing expectations.
100
101 2018-12-19  Keith Miller  <keith_miller@apple.com>
102
103         Fix test262 expectations
104         https://bugs.webkit.org/show_bug.cgi?id=192914
105
106         Unreviewed, when I imported the latest round of test262 tests I must have failed to update the test expectations.
107
108         * test262/expectations.yaml:
109
110 2018-12-19  Keith Miller  <keith_miller@apple.com>
111
112         Update test262 tests.
113         https://bugs.webkit.org/show_bug.cgi?id=192907
114
115         Rubber stamped by Mark Lam.
116
117         * test262/*: Omitted because prepare-changelog crashes.
118
119 2018-12-19  Mark Lam  <mark.lam@apple.com>
120
121         JSPropertyNameEnumerator should cache the iterated object's structure only after getting its property names.
122         https://bugs.webkit.org/show_bug.cgi?id=192464
123         <rdar://problem/46519455>
124
125         Reviewed by Saam Barati.
126
127         This patch is about a 10% speed up on the new for-in-on-object-with-lazily-materialized-properties.js
128         microbenchmark.
129
130         * microbenchmarks/for-in-on-object-with-lazily-materialized-properties.js: Added.
131         * stress/property-name-enumerator-should-cache-structure-after-getting-property-names.js: Added.
132
133 2018-12-19  Tadeu Zagallo  <tzagallo@apple.com>
134
135         String overflow in JSC::createError results in ASSERT in WTF::makeString
136         https://bugs.webkit.org/show_bug.cgi?id=192833
137         <rdar://problem/45706868>
138
139         Reviewed by Mark Lam.
140
141         * stress/string-overflow-createError.js: Added.
142
143 2018-12-18  Ross Kirsling  <ross.kirsling@sony.com>
144
145         Error message for `-x ** y` contains a typo.
146         https://bugs.webkit.org/show_bug.cgi?id=192832
147
148         Reviewed by Saam Barati.
149
150         * ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
151         (assert.assert.return.throws):
152         * stress/pow-expects-update-expression-on-lhs.js:
153         (throw.new.Error):
154         Update test expectations which match against the exact error message.
155
156 2018-12-18  Mark Lam  <mark.lam@apple.com>
157
158         Gardening: test options fix.
159         https://bugs.webkit.org/show_bug.cgi?id=192822
160
161         Unreviewed.
162
163         * stress/json-stringify-string-builder-overflow.js:
164
165 2018-12-18  Mark Lam  <mark.lam@apple.com>
166
167         JSON.stringify() should throw OOM on StringBuilder overflows.
168         https://bugs.webkit.org/show_bug.cgi?id=192822
169         <rdar://problem/46670577>
170
171         Reviewed by Saam Barati.
172
173         * stress/json-stringify-string-builder-overflow.js: Added.
174
175 2018-12-18  Ross Kirsling  <ross.kirsling@sony.com>
176
177         Redeclaration of var over let/const/class should be a syntax error.
178         https://bugs.webkit.org/show_bug.cgi?id=192298
179
180         Reviewed by Keith Miller.
181
182         * test262.yaml:
183         * test262/expectations.yaml:
184         Mark 46 tests as passing.
185
186         * stress/block-scope-redeclarations.js:
187         Add some new tests.
188
189         * stress/for-in-invalidate-context-weird-assignments.js:
190         * stress/for-in-tests.js:
191         Replace tests for outdated behavior with tests for SyntaxError.
192
193         * ChakraCore/test/LetConst/defer3.baseline-jsc:
194         * ChakraCore/test/LetConst/letvar.baseline-jsc:
195         Update expectations.
196
197 2018-12-18  Mark Lam  <mark.lam@apple.com>
198
199         Skip the stress/elidable-new-object-roflcopter-then-exit.js test on 32-bit.
200         https://bugs.webkit.org/show_bug.cgi?id=191374
201         <rdar://problem/46525447>
202
203         Reviewed by Yusuke Suzuki.
204
205         This test runs too slow on 32-bit, and is not relevant for non-JIT builds.
206
207         * stress/elidable-new-object-roflcopter-then-exit.js:
208
209 2018-12-17  Mark Lam  <mark.lam@apple.com>
210
211         Skip the stress/materialized-regexp-has-correct-last-index-set-by-match.js test on 32-bit.
212         https://bugs.webkit.org/show_bug.cgi?id=192019
213         <rdar://problem/46525456>
214
215         Reviewed by Yusuke Suzuki.
216
217         The test runs too slow on 32-bit.
218
219         * stress/materialized-regexp-has-correct-last-index-set-by-match.js:
220
221 2018-12-17  Mark Lam  <mark.lam@apple.com>
222
223         Skip the stress/materialize-regexp-cyclic-regexp.js test on 32-bit.
224         https://bugs.webkit.org/show_bug.cgi?id=191373
225         <rdar://problem/46525458>
226
227         Reviewed by Yusuke Suzuki.
228
229         The test is already slow running with a JIT on 64-bit.  It will always timeout
230         on 32-bit without a JIT.
231
232         * stress/materialize-regexp-cyclic-regexp.js:
233
234 2018-12-17  Mark Lam  <mark.lam@apple.com>
235
236         Array unshift/shift should not race against the AI in the compiler thread.
237         https://bugs.webkit.org/show_bug.cgi?id=192795
238         <rdar://problem/46724263>
239
240         Reviewed by Saam Barati.
241
242         * stress/array-unshift-should-not-race-against-compiler-thread.js: Added.
243
244 2018-12-16  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
245
246         [JSC] Optimize Object.keys by caching own keys results in StructureRareData
247         https://bugs.webkit.org/show_bug.cgi?id=190047
248
249         Reviewed by Saam Barati.
250
251         * stress/object-keys-cached-zero.js: Added.
252         (shouldBe):
253         (test):
254         * stress/object-keys-changed-attribute.js: Added.
255         (shouldBe):
256         (test):
257         * stress/object-keys-changed-index.js: Added.
258         (shouldBe):
259         (test):
260         * stress/object-keys-changed.js: Added.
261         (shouldBe):
262         (test):
263         * stress/object-keys-indexed-non-cache.js: Added.
264         (shouldBe):
265         (test):
266         * stress/object-keys-overrides-get-property-names.js: Added.
267         (shouldBe):
268         (test):
269         (noInline):
270
271 2018-12-17  Mark Lam  <mark.lam@apple.com>
272
273         SamplingProfiler's isValidFramePointer() should reject address at stack origin.
274         https://bugs.webkit.org/show_bug.cgi?id=192779
275         <rdar://problem/46775869>
276
277         Reviewed by Saam Barati.
278
279         * stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js: Added.
280
281 2018-12-17  Ryan Haddad  <ryanhaddad@apple.com>
282
283         Unreviewed test gardening, address a syntax error in a new test.
284
285         * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js:
286
287 2018-12-17  Mark Lam  <mark.lam@apple.com>
288
289         Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit().
290         https://bugs.webkit.org/show_bug.cgi?id=192776
291         <rdar://problem/46772368>
292
293         Reviewed by Keith Miller.
294
295         * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js: Added.
296
297 2018-12-17  Mark Lam  <mark.lam@apple.com>
298
299         Fix stale assertion in attemptToForceStringArrayModeByToStringConversion().
300         https://bugs.webkit.org/show_bug.cgi?id=192770
301         <rdar://problem/46449037>
302
303         Reviewed by Keith Miller.
304
305         * stress/force-string-arrayMode-on-originalNonArray-array-class.js: Added.
306
307 2018-12-14  Mark Lam  <mark.lam@apple.com>
308
309         CallFrame::convertToStackOverflowFrame() needs to keep the top CodeBlock alive.
310         https://bugs.webkit.org/show_bug.cgi?id=192717
311         <rdar://problem/46660677>
312
313         Reviewed by Saam Barati.
314
315         * stress/regress-192717.js: Added.
316
317 2018-12-14  Commit Queue  <commit-queue@webkit.org>
318
319         Unreviewed, rolling out r239153, r239154, and r239155.
320         https://bugs.webkit.org/show_bug.cgi?id=192715
321
322         Caused flaky GC-related crashes seen with layout tests
323         (Requested by ryanhaddad on #webkit).
324
325         Reverted changesets:
326
327         "[JSC] Optimize Object.keys by caching own keys results in
328         StructureRareData"
329         https://bugs.webkit.org/show_bug.cgi?id=190047
330         https://trac.webkit.org/changeset/239153
331
332         "Unreviewed, build fix after r239153"
333         https://bugs.webkit.org/show_bug.cgi?id=190047
334         https://trac.webkit.org/changeset/239154
335
336         "Unreviewed, build fix after r239153, part 2"
337         https://bugs.webkit.org/show_bug.cgi?id=190047
338         https://trac.webkit.org/changeset/239155
339
340 2018-12-14  Keith Miller  <keith_miller@apple.com>
341
342         Callers of JSString::getIndex should check for OOM exceptions
343         https://bugs.webkit.org/show_bug.cgi?id=192709
344
345         Reviewed by Mark Lam.
346
347         * stress/StringObject-define-length-getter-rope-string-oom.js: Added.
348
349 2018-12-13  Mark Lam  <mark.lam@apple.com>
350
351         Add a missing exception check.
352         https://bugs.webkit.org/show_bug.cgi?id=192626
353         <rdar://problem/46662163>
354
355         Reviewed by Keith Miller.
356
357         * stress/regress-192626.js: Added.
358
359 2018-12-13  Caio Lima  <ticaiolima@gmail.com>
360
361         [BigInt] Add ValueDiv into DFG
362         https://bugs.webkit.org/show_bug.cgi?id=186178
363
364         Reviewed by Yusuke Suzuki.
365
366         * stress/big-int-div-jit-osr.js: Added.
367         * stress/big-int-div-jit-untyped.js: Added.
368         * stress/value-div-fixup-int32-big-int.js: Added.
369
370 2018-12-10  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
371
372         [JSC] Optimize Object.keys by caching own keys results in StructureRareData
373         https://bugs.webkit.org/show_bug.cgi?id=190047
374
375         Reviewed by Keith Miller.
376
377         * stress/object-keys-cached-zero.js: Added.
378         (shouldBe):
379         (test):
380         * stress/object-keys-changed-attribute.js: Added.
381         (shouldBe):
382         (test):
383         * stress/object-keys-changed-index.js: Added.
384         (shouldBe):
385         (test):
386         * stress/object-keys-changed.js: Added.
387         (shouldBe):
388         (test):
389         * stress/object-keys-indexed-non-cache.js: Added.
390         (shouldBe):
391         (test):
392         * stress/object-keys-overrides-get-property-names.js: Added.
393         (shouldBe):
394         (test):
395         (noInline):
396
397 2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
398
399         [DFG][FTL] Add NewSymbol
400         https://bugs.webkit.org/show_bug.cgi?id=192620
401
402         Reviewed by Saam Barati.
403
404         * microbenchmarks/symbol-creation.js: Added.
405         (test):
406         * stress/symbol-description-identity.js: Added.
407         (shouldBe):
408         (test):
409         * stress/symbol-identity.js: Added.
410         (shouldBe):
411         (test):
412         * stress/symbol-with-description-throw-error.js: Added.
413         (shouldBe):
414         (shouldThrow):
415         (test):
416         (object.toString):
417
418 2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
419
420         [BigInt] Implement DFG/FTL typeof for BigInt
421         https://bugs.webkit.org/show_bug.cgi?id=192619
422
423         Reviewed by Keith Miller.
424
425         * stress/big-int-boolean-proven-type.js: Added.
426         (assert):
427         (bool):
428         * stress/big-int-type-of-proven-type-non-constant-including-symbol.js: Added.
429         (assert):
430         (typeOf):
431         (i.switch):
432         * stress/big-int-type-of-proven-type-non-constant.js: Added.
433         (assert):
434         (typeOf):
435         * stress/big-int-type-of.js:
436         (typeOf):
437         (func):
438
439 2018-12-10  Mark Lam  <mark.lam@apple.com>
440
441         PropertyAttribute needs a CustomValue bit.
442         https://bugs.webkit.org/show_bug.cgi?id=191993
443         <rdar://problem/46264467>
444
445         Reviewed by Saam Barati.
446
447         * stress/regress-191993.js: Added.
448
449 2018-12-10  Caio Lima  <ticaiolima@gmail.com>
450
451         [BigInt] Add ValueMul into DFG
452         https://bugs.webkit.org/show_bug.cgi?id=186175
453
454         Reviewed by Yusuke Suzuki.
455
456         * stress/big-int-mul-jit-osr.js: Added.
457         * stress/big-int-mul-jit-untyped.js: Added.
458         * stress/value-mul-fixup-int32-big-int.js: Added.
459
460 2018-12-06  Keith Miller  <keith_miller@apple.com>
461
462         stress/big-wasm-memory tests failing on 32-bit JSC bot
463         https://bugs.webkit.org/show_bug.cgi?id=192020
464
465         Reviewed by Saam Barati.
466
467         Not every platform has WebAssembly, e.g. 32-bit, so we should exit
468         the wasm stress tests if the WebAssembly object does not exist.
469
470         * stress/big-wasm-memory-grow-no-max.js:
471         (test.foo):
472         (test):
473         (foo): Deleted.
474         (catch): Deleted.
475         * stress/big-wasm-memory-grow.js:
476         (test.foo):
477         (test):
478         (foo): Deleted.
479         (catch): Deleted.
480         * stress/big-wasm-memory.js:
481         (test.foo):
482         (test):
483         (foo): Deleted.
484         (catch): Deleted.
485
486 2018-12-05  Mark Lam  <mark.lam@apple.com>
487
488         speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
489         https://bugs.webkit.org/show_bug.cgi?id=192441
490         <rdar://problem/46480355>
491
492         Reviewed by Saam Barati.
493
494         * stress/regress-192441.js: Added.
495
496 2018-12-04  Mark Lam  <mark.lam@apple.com>
497
498         DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility.
499         https://bugs.webkit.org/show_bug.cgi?id=192386
500         <rdar://problem/46445516>
501
502         Reviewed by Saam Barati.
503
504         * stress/regress-192386.js: Added.
505
506 2018-12-04  Caio Lima  <ticaiolima@gmail.com>
507
508         [ESNext][BigInt] Support logic operations
509         https://bugs.webkit.org/show_bug.cgi?id=179903
510
511         Reviewed by Yusuke Suzuki.
512
513         * stress/big-int-branch-usage.js: Added.
514         * stress/big-int-logical-and.js: Added.
515         * stress/big-int-logical-not.js: Added.
516         * stress/big-int-logical-or.js: Added.
517
518 2018-12-03  Ryan Haddad  <ryanhaddad@apple.com>
519
520         Unreviewed, rolling out r238833.
521
522         Breaks macOS and iOS debug builds.
523
524         Reverted changeset:
525
526         "[ESNext][BigInt] Support logic operations"
527         https://bugs.webkit.org/show_bug.cgi?id=179903
528         https://trac.webkit.org/changeset/238833
529
530 2018-12-03  Caio Lima  <ticaiolima@gmail.com>
531
532         [ESNext][BigInt] Support logic operations
533         https://bugs.webkit.org/show_bug.cgi?id=179903
534
535         Reviewed by Yusuke Suzuki.
536
537         * stress/big-int-branch-usage.js: Added.
538         * stress/big-int-logical-and.js: Added.
539         * stress/big-int-logical-not.js: Added.
540         * stress/big-int-logical-or.js: Added.
541
542 2018-12-02  Caio Lima  <ticaiolima@gmail.com>
543
544         [ESNext][BigInt] Implement support for "<<" and ">>"
545         https://bugs.webkit.org/show_bug.cgi?id=186233
546
547         Reviewed by Yusuke Suzuki.
548
549         * stress/big-int-left-shift-general.js: Added.
550         * stress/big-int-left-shift-range-error.js: Added.
551         * stress/big-int-left-shift-type-error.js: Added.
552         * stress/big-int-left-shift-wrapped-value.js: Added.
553         * stress/big-int-right-shift-general.js: Added.
554         * stress/big-int-right-shift-type-error.js: Added.
555         * stress/big-int-right-shift-wrapped-value.js: Added.
556         * stress/left-shift-to-primitive-precedence.js: Added.
557         * stress/right-shift-to-primitive-precedence.js: Added.
558
559 2018-11-30  Dean Jackson  <dino@apple.com>
560
561         Add first-class support for .mjs files in jsc binary
562         https://bugs.webkit.org/show_bug.cgi?id=192190
563         <rdar://problem/46375715>
564
565         Reviewed by Keith Miller.
566
567         * stress/simple-module.mjs: Added.
568         * stress/simple-script.js: Added.
569
570 2018-11-30  Caio Lima  <ticaiolima@gmail.com>
571
572         [BigInt] Implement ValueBitXor into DFG
573         https://bugs.webkit.org/show_bug.cgi?id=190264
574
575         Reviewed by Yusuke Suzuki.
576
577         * stress/big-int-bitwise-xor-jit.js: Added.
578         * stress/big-int-bitwise-xor-memory-stress.js: Added.
579         * stress/big-int-bitwise-xor-untyped.js: Added.
580
581 2018-11-27  Saam barati  <sbarati@apple.com>
582
583         r238510 broke scopes of size zero
584         https://bugs.webkit.org/show_bug.cgi?id=192033
585         <rdar://problem/46281734>
586
587         Reviewed by Keith Miller.
588
589         * stress/r238510-bad-loop.js: Added.
590         (foo):
591
592 2018-11-27  Mark Lam  <mark.lam@apple.com>
593
594         [Re-landing] NaNs read from Wasm code needs to be be purified.
595         https://bugs.webkit.org/show_bug.cgi?id=191056
596         <rdar://problem/45660341>
597
598         Reviewed by Filip Pizlo.
599
600         * wasm/regress/regress-191056.js: Added.
601
602 2018-11-27  Ryan Haddad  <ryanhaddad@apple.com>
603
604         Unreviewed, rolling out r238509.
605
606         Causes JSC tests to fail on iOS.
607
608         Reverted changeset:
609
610         "NaNs read from Wasm code needs to be be purified."
611         https://bugs.webkit.org/show_bug.cgi?id=191056
612         https://trac.webkit.org/changeset/238509
613
614 2018-11-26  Caio Lima  <ticaiolima@gmail.com>
615
616         Re-introduce op_bitnot
617         https://bugs.webkit.org/show_bug.cgi?id=190923
618
619         Reviewed by Yusuke Suzuki.
620
621         * stress/bit-not-must-generate.js: Added.
622         * stress/bitwise-not-no-int32.js: Added.
623
624 2018-11-26  Saam barati  <sbarati@apple.com>
625
626         InPlaceAbstractState::endBasicBlock rule for SetLocal should filter the value based on the flush format
627         https://bugs.webkit.org/show_bug.cgi?id=191956
628         <rdar://problem/45665806>
629
630         Reviewed by Yusuke Suzuki.
631
632         * stress/end-basic-block-set-local-should-filter-type.js: Added.
633         (bar):
634         (foo):
635
636 2018-11-26  Saam barati  <sbarati@apple.com>
637
638         Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation
639         https://bugs.webkit.org/show_bug.cgi?id=191958
640         <rdar://problem/46221877>
641
642         Reviewed by Yusuke Suzuki.
643
644         * stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added.
645         (x):
646         (foo):
647
648 2018-11-26  Mark Lam  <mark.lam@apple.com>
649
650         NaNs read from Wasm code needs to be be purified.
651         https://bugs.webkit.org/show_bug.cgi?id=191056
652         <rdar://problem/45660341>
653
654         Reviewed by Filip Pizlo.
655
656         * wasm/regress/regress-191056.js: Added.
657
658 2018-11-26  Michael Saboff  <msaboff@apple.com>
659
660         32-bit JSC test failure: stress/regexp-compile-oom.js
661         https://bugs.webkit.org/show_bug.cgi?id=191375
662
663         Reviewed by Mark Lam.
664
665         Disabled the test for 32 bit platforms.
666
667         * stress/regexp-compile-oom.js:
668
669 2018-11-26  Tadeu Zagallo  <tzagallo@apple.com>
670
671         ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
672         https://bugs.webkit.org/show_bug.cgi?id=191716
673         <rdar://problem/45723878>
674
675         Reviewed by Saam Barati.
676
677         * stress/regress-187373.js: Added.
678         (async.fn):
679
680 2018-11-21  Saam barati  <sbarati@apple.com>
681
682         DFGSpeculativeJIT should not &= exitOK with mayExit(node)
683         https://bugs.webkit.org/show_bug.cgi?id=191897
684         <rdar://problem/45871998>
685
686         Reviewed by Mark Lam.
687
688         * stress/exitok-is-not-the-same-as-mayExit.js: Added.
689         (bar):
690         (foo):
691
692 2018-11-21  Saam barati  <sbarati@apple.com>
693
694         Fix assertion in KnownCellUse inside SpeculativeJIT::speculate
695         https://bugs.webkit.org/show_bug.cgi?id=191895
696         <rdar://problem/46167406>
697
698         Reviewed by Mark Lam.
699
700         * stress/known-cell-use-needs-type-check-assertion.js: Added.
701         (foo):
702         (bar):
703
704 2018-11-21  Mark Lam  <mark.lam@apple.com>
705
706         Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError.
707         https://bugs.webkit.org/show_bug.cgi?id=191776
708         <rdar://problem/46152851>
709
710         Reviewed by Saam Barati.
711
712         * stress/big-wasm-memory-grow-no-max.js:
713         * stress/big-wasm-memory-grow.js:
714         * stress/big-wasm-memory.js:
715         - updated these to expect an OutOfMemoryError.
716
717         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: Added.
718         (Binary.prototype.emit_u8):
719         (Binary.prototype.emit_u32v):
720         (Binary.prototype.emit_header):
721         (Binary.prototype.emit_section):
722         (Binary):
723         (WasmModuleBuilder):
724         (WasmModuleBuilder.prototype.addMemory):
725         (WasmModuleBuilder.prototype.toArray):
726         (WasmModuleBuilder.prototype.toBuffer):
727         (WasmModuleBuilder.prototype.instantiate):
728         (catch):
729         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Added.
730         (catch):
731
732 2018-11-21  Caio Lima  <ticaiolima@gmail.com>
733
734         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
735         https://bugs.webkit.org/show_bug.cgi?id=190836
736
737         Reviewed by Saam Barati and Yusuke Suzuki.
738
739         * stress/big-int-out-of-memory-tests.js: Added.
740
741 2018-11-20  Mark Lam  <mark.lam@apple.com>
742
743         Remove invalid assertion in VMTraps::SignalSender's SignalAction.
744         https://bugs.webkit.org/show_bug.cgi?id=191856
745         <rdar://problem/46089992>
746
747         Reviewed by Yusuke Suzuki.
748
749         * stress/regress-191856.js: Added.
750         - this test is skipped for now until we have a fix for webkit.org/b/191855.
751
752 2018-11-21  Dominik Infuehr  <dinfuehr@igalia.com>
753
754         Enable JIT on ARM/Linux
755         https://bugs.webkit.org/show_bug.cgi?id=191548
756
757         Reviewed by Yusuke Suzuki.
758
759         Disable test on system with limited memory. Program was killed by
760         the OS before the exception was thrown.
761
762         * slowMicrobenchmarks/function-constructor-with-huge-strings.js:
763
764 2018-11-20  Saam barati  <sbarati@apple.com>
765
766         Merging an IC variant may lead to the IC status containing overlapping structure sets
767         https://bugs.webkit.org/show_bug.cgi?id=191869
768         <rdar://problem/45403453>
769
770         Reviewed by Mark Lam.
771
772         * stress/merging-ic-variants-should-bail-if-structures-overlap.js: Added.
773
774 2018-11-19  Mark Lam  <mark.lam@apple.com>
775
776         globalFuncImportModule() should return a promise when it clears exceptions.
777         https://bugs.webkit.org/show_bug.cgi?id=191792
778         <rdar://problem/46090763>
779
780         Reviewed by Michael Saboff.
781
782         * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: Added.
783
784 2018-11-19  Guillaume Emont  <guijemont@igalia.com>
785
786         Skip new memory-hungry tests on memory limited devices
787
788         Unreviewed gardening.
789
790         * stress/big-wasm-memory-grow-no-max.js:
791         * stress/big-wasm-memory-grow.js:
792         * stress/big-wasm-memory.js:
793
794 2018-11-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
795
796         Unreviewed, rolling in the rest of r237254
797         https://bugs.webkit.org/show_bug.cgi?id=190340
798
799         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
800         * stress/function-cache-with-parameters-end-position.js: Added.
801         (shouldBe):
802         (shouldThrow):
803         (i.anonymous):
804         * stress/function-constructor-name.js: Added.
805         (shouldBe):
806         (GeneratorFunction):
807         (AsyncFunction.async):
808         (AsyncGeneratorFunction.async):
809         (anonymous):
810         (async.anonymous):
811         * test262/expectations.yaml:
812
813 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
814
815         All users of ArrayBuffer should agree on the same max size
816         https://bugs.webkit.org/show_bug.cgi?id=191771
817
818         Reviewed by Mark Lam.
819
820         * stress/big-wasm-memory-grow-no-max.js: Added.
821         (foo):
822         (catch):
823         * stress/big-wasm-memory-grow.js: Added.
824         (foo):
825         (catch):
826         * stress/big-wasm-memory.js: Added.
827         (foo):
828         (catch):
829
830 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
831
832         Unreviewed, make some more tests not crash my computer by only running on instance of it. These tests do not need to
833         run for each JSC config since they're regression tests for runtime bugs.
834
835         * stress/json-stringified-overflow-2.js:
836         * stress/json-stringified-overflow.js:
837
838 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
839
840         Unreviewed, make some tests not crash my computer by only running on instance of it. These tests do not need to run for each JSC
841         config since they're regression tests for runtime bugs.
842
843         * stress/large-unshift-splice.js:
844         * stress/regress-185888.js:
845
846 2018-11-16  Saam Barati  <sbarati@apple.com>
847
848         KnownCellUse should also have SpecCellCheck as its type filter
849         https://bugs.webkit.org/show_bug.cgi?id=191729
850         <rdar://problem/45872852>
851
852         Reviewed by Filip Pizlo.
853
854         * stress/known-cell-type-check-should-allow-empty-value-to-flow-through.js: Added.
855         (C):
856
857 2018-11-16  Tadeu Zagallo  <tzagallo@apple.com>
858
859         Fix assertion failure on BytecodeGenerator::recordOpcode
860         https://bugs.webkit.org/show_bug.cgi?id=191724
861         <rdar://problem/45724395>
862
863         Reviewed by Saam Barati.
864
865         * stress/regress-187373-2.js: Added.
866         (foo):
867
868 2018-11-15  Mark Lam  <mark.lam@apple.com>
869
870         RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
871         https://bugs.webkit.org/show_bug.cgi?id=191730
872         <rdar://problem/46048517>
873
874         Reviewed by Saam Barati.
875
876         * stress/regress-187006.js: Removed.
877           - this test is invalid because its sole purpose is to test for the non-spec
878             compliant behavior that we just fixed.
879
880         * stress/regress-191730.js: Added.
881
882 2018-11-15  Mark Lam  <mark.lam@apple.com>
883
884         RegExp operations should not take fast patch if lastIndex is not numeric.
885         https://bugs.webkit.org/show_bug.cgi?id=191731
886         <rdar://problem/46017305>
887
888         Reviewed by Saam Barati.
889
890         * stress/regress-191731.js: Added.
891
892 2018-11-13  Saam Barati  <sbarati@apple.com>
893
894         TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM
895         https://bugs.webkit.org/show_bug.cgi?id=191600
896
897         Reviewed by Mark Lam.
898
899         * stress/type-profiler-log-should-defer-pending-exceptions.js: Added.
900         (foo):
901         (test):
902         (bar):
903
904 2018-11-13  Ryan Haddad  <ryanhaddad@apple.com>
905
906         Unreviewed, rolling out r238132.
907
908         The test added with this change is timing out on Debug JSC
909         bots.
910
911         Reverted changeset:
912
913         "[BigInt] JSBigInt::createWithLength should throw when length
914         is greater than JSBigInt::maxLength"
915         https://bugs.webkit.org/show_bug.cgi?id=190836
916         https://trac.webkit.org/changeset/238132
917
918 2018-11-13  Mark Lam  <mark.lam@apple.com>
919
920         Add OOM detection to StringPrototype's substituteBackreferences().
921         https://bugs.webkit.org/show_bug.cgi?id=191563
922         <rdar://problem/45720428>
923
924         Reviewed by Saam Barati.
925
926         * stress/regress-191563.js: Added.
927
928 2018-11-13  Mark Lam  <mark.lam@apple.com>
929
930         LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame.
931         https://bugs.webkit.org/show_bug.cgi?id=191579
932         <rdar://problem/45942472>
933
934         Reviewed by Saam Barati.
935
936         * stress/regress-191579.js: Added.
937
938 2018-11-13  Caio Lima  <ticaiolima@gmail.com>
939
940         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
941         https://bugs.webkit.org/show_bug.cgi?id=190836
942
943         Reviewed by Saam Barati.
944
945         * stress/big-int-out-of-memory-tests.js: Added.
946
947 2018-11-08  Ross Kirsling  <ross.kirsling@sony.com>
948
949         U+180E is no longer a whitespace character
950         https://bugs.webkit.org/show_bug.cgi?id=191415
951
952         Reviewed by Saam Barati.
953
954         * ChakraCore/test/es5/regexSpace.baseline:
955         * ChakraCore/test/es6/unicode_whitespace.js:
956         Update tests to latest version.
957         (See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.)
958
959         * test262.yaml:
960         * test262/config.yaml:
961         * test262/expectations.yaml:
962         Update expectations.
963
964 2018-11-07  Caio Lima  <ticaiolima@gmail.com>
965
966         [BigInt] Add support to BigInt into ValueAdd
967         https://bugs.webkit.org/show_bug.cgi?id=186177
968
969         Reviewed by Keith Miller.
970
971         * stress/big-int-negate-jit.js:
972         * stress/value-add-big-int-and-string.js: Added.
973         * stress/value-add-big-int-prediction-propagation.js: Added.
974         * stress/value-add-big-int-untyped.js: Added.
975
976 2018-11-07  Tadeu Zagallo  <tzagallo@apple.com>
977
978         REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled
979         https://bugs.webkit.org/show_bug.cgi?id=191184
980
981         Reviewed by Saam Barati.
982
983         Most tests were failing due to timeouts, since they are too slow to
984         run on CLoop. The exceptions are:
985
986         proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop
987         dont-crash-on-stack-overflow-when-parsing-builtin.js and
988         dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had
989         to change the stack size since CLoop requires it to be page aligned.
990
991         * microbenchmarks/array-push-1.js:
992         * microbenchmarks/array-push-2.js:
993         * microbenchmarks/elidable-new-object-dag.js:
994         * microbenchmarks/elidable-new-object-roflcopter.js:
995         * microbenchmarks/elidable-new-object-tree.js:
996         * microbenchmarks/getter-richards.js:
997         * microbenchmarks/sinkable-new-object-dag.js:
998         * microbenchmarks/string-concat-long-convert.js:
999         * microbenchmarks/typed-array-get-set-by-val-profiling.js:
1000         * slowMicrobenchmarks/array-push-3.js:
1001         * slowMicrobenchmarks/large-map-iteration-with-additions.js:
1002         * slowMicrobenchmarks/spread-small-array.js:
1003         * slowMicrobenchmarks/undefined-property-access.js:
1004         * stress/activation-sink-default-value-tdz-error.js:
1005         * stress/activation-sink-default-value.js:
1006         * stress/activation-sink-osrexit-default-value-tdz-error.js:
1007         * stress/activation-sink-osrexit-default-value.js:
1008         * stress/activation-sink-osrexit.js:
1009         * stress/activation-sink.js:
1010         * stress/allow-math-ic-b3-code-duplication.js:
1011         * stress/array-push-multiple-int32.js:
1012         * stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js:
1013         * stress/arrowfunction-lexical-this-activation-sink-osrexit.js:
1014         * stress/arrowfunction-lexical-this-activation-sink.js:
1015         * stress/dont-crash-on-stack-overflow-when-parsing-builtin.js:
1016         * stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js:
1017         * stress/elide-new-object-dag-then-exit.js:
1018         * stress/materialize-regexp-cyclic.js:
1019         * stress/new-regex-inline.js:
1020         * stress/op_add.js:
1021         * stress/op_bitand.js:
1022         * stress/op_bitor.js:
1023         * stress/op_bitxor.js:
1024         * stress/op_div-ConstVar.js:
1025         * stress/op_div-VarConst.js:
1026         * stress/op_div-VarVar.js:
1027         * stress/op_lshift-ConstVar.js:
1028         * stress/op_lshift-VarConst.js:
1029         * stress/op_lshift-VarVar.js:
1030         * stress/op_mod-ConstVar.js:
1031         * stress/op_mod-VarConst.js:
1032         * stress/op_mod-VarVar.js:
1033         * stress/op_mul-ConstVar.js:
1034         * stress/op_mul-VarConst.js:
1035         * stress/op_mul-VarVar.js:
1036         * stress/op_rshift-ConstVar.js:
1037         * stress/op_rshift-VarConst.js:
1038         * stress/op_rshift-VarVar.js:
1039         * stress/op_sub-ConstVar.js:
1040         * stress/op_sub-VarConst.js:
1041         * stress/op_sub-VarVar.js:
1042         * stress/op_urshift-ConstVar.js:
1043         * stress/op_urshift-VarConst.js:
1044         * stress/op_urshift-VarVar.js:
1045         * stress/proxy-get-set-correct-receiver.js:
1046         * stress/regress-179562.js:
1047         * stress/rest-parameter-many-arguments.js:
1048         * stress/sampling-profiler-richards.js:
1049         * stress/splay-flash-access-1ms.js:
1050         * stress/tailCallForwardArguments.js:
1051         * stress/typed-array-get-by-val-profiling.js:
1052         * typeProfiler/getter-richards.js:
1053
1054 2018-11-06  Michael Saboff  <msaboff@apple.com>
1055
1056         Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.
1057         https://bugs.webkit.org/show_bug.cgi?id=191271
1058
1059         Reviewed by Saam Barati.
1060
1061         Added more test cases and made all test cases run with the same deeply recursive stack
1062         instead of finding that same point for each test case.
1063
1064         * stress/regexp-compile-oom.js:
1065         (prototype.runTest):
1066         (recurseAndTest):
1067         (testList.push.new.TestAndExpectedException):
1068
1069 2018-11-05  Michael Saboff  <msaboff@apple.com>
1070
1071         Unreviewed build fix for linux.
1072
1073         * stress/regexp-compile-oom.js: Disabled for non-darwin OSes.
1074
1075 2018-11-02  Michael Saboff  <msaboff@apple.com>
1076
1077         Rolling in r237753 with unreviewed build fix.
1078
1079         Fixed issues with DECLARE_THROW_SCOPE placement.
1080
1081 2018-11-02  Ryan Haddad  <ryanhaddad@apple.com>
1082
1083         Unreviewed, rolling out r237753.
1084
1085         Introduced JSC test failures
1086
1087         Reverted changeset:
1088
1089         "Running out of stack space not properly handled in
1090         RegExp::compile() and its callers"
1091         https://bugs.webkit.org/show_bug.cgi?id=191206
1092         https://trac.webkit.org/changeset/237753
1093
1094 2018-11-02  Michael Saboff  <msaboff@apple.com>
1095
1096         Running out of stack space not properly handled in RegExp::compile() and its callers
1097         https://bugs.webkit.org/show_bug.cgi?id=191206
1098
1099         Reviewed by Filip Pizlo.
1100
1101         New regression test.
1102
1103         * stress/regexp-compile-oom.js: Added.
1104         (recurseAndTest):
1105
1106 2018-11-01  Guillaume Emont  <guijemont@igalia.com>
1107
1108         Skip tests on arm/mips that time out now we're running on CLoop
1109
1110         Unreviewed gardening.
1111
1112         Since the JIT is temporarily disabled on 32-bit platforms, these tests
1113         time out on the bots and need to be disabled. There's more tests
1114         disabled on arm because the timeout is longer on the mips bot (as the
1115         device is slower to start with), so many of the tests don't time out
1116         there.
1117
1118         * microbenchmarks/getter-richards.js: disable on arm and mips.
1119         * stress/op_add.js: disable on arm.
1120         * stress/op_bitand.js: disable on arm.
1121         * stress/op_bitor.js: disable on arm.
1122         * stress/op_bitxor.js: disable on arm.
1123         * stress/op_lshift-ConstVar.js: disable on arm.
1124         * stress/op_lshift-VarConst.js: disable on arm.
1125         * stress/op_lshift-VarVar.js: disable on arm.
1126         * stress/op_mod-ConstVar.js: disable on arm.
1127         * stress/op_mod-VarConst.js: disable on arm.
1128         * stress/op_mod-VarVar.js: disable on arm.
1129         * stress/op_mul-ConstVar.js: disable on arm.
1130         * stress/op_mul-VarConst.js: disable on arm.
1131         * stress/op_mul-VarVar.js: disable on arm.
1132         * stress/op_rshift-ConstVar.js: disable on arm.
1133         * stress/op_rshift-VarConst.js: disable on arm.
1134         * stress/op_rshift-VarVar.js: disable on arm.
1135         * stress/op_sub-ConstVar.js: disable on arm.
1136         * stress/op_sub-VarConst.js: disable on arm.
1137         * stress/op_sub-VarVar.js: disable on arm.
1138         * stress/op_urshift-ConstVar.js: disable on arm.
1139         * stress/op_urshift-VarConst.js: disable on arm.
1140         * stress/op_urshift-VarVar.js: disable on arm.
1141         * stress/spread-forward-call-varargs-stack-overflow.js: disable on arm.
1142         * stress/value-to-boolean.js: disable on arm and mips.
1143
1144 2018-10-31  Tadeu Zagallo  <tzagallo@apple.com>
1145
1146         REGRESSION(r237547): Exception handlers should be aware of wide opcodes
1147         https://bugs.webkit.org/show_bug.cgi?id=191108
1148         <rdar://problem/45690700>
1149
1150         Reviewed by Saam Barati.
1151
1152         * stress/wide-op_catch.js: Added.
1153         (catch):
1154
1155 2018-10-29  Mark Lam  <mark.lam@apple.com>
1156
1157         Correctly detect string overflow when using the 'Function' constructor.
1158         https://bugs.webkit.org/show_bug.cgi?id=184883
1159         <rdar://problem/36320331>
1160
1161         Reviewed by Saam Barati.
1162
1163         I've verified that this passes on 32-bit as well.
1164
1165         * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
1166
1167 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
1168
1169         Add support for GetStack FlushedDouble
1170         https://bugs.webkit.org/show_bug.cgi?id=191012
1171         <rdar://problem/45265141>
1172
1173         Reviewed by Saam Barati.
1174
1175         * stress/get-stack-double.js: Added.
1176         (bar):
1177         (noInline):
1178
1179 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
1180
1181         New bytecode format for JSC
1182         https://bugs.webkit.org/show_bug.cgi?id=187373
1183         <rdar://problem/44186758>
1184
1185         Reviewed by Filip Pizlo.
1186
1187         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
1188
1189         * stress/maximum-inline-capacity.js: Added.
1190         (test1):
1191         (test3.Foo):
1192         (test3):
1193
1194 2018-10-26  Commit Queue  <commit-queue@webkit.org>
1195
1196         Unreviewed, rolling out r237479 and r237484.
1197         https://bugs.webkit.org/show_bug.cgi?id=190978
1198
1199         broke JSC on iOS (Requested by tadeuzagallo on #webkit).
1200
1201         Reverted changesets:
1202
1203         "New bytecode format for JSC"
1204         https://bugs.webkit.org/show_bug.cgi?id=187373
1205         https://trac.webkit.org/changeset/237479
1206
1207         "Gardening: Build fix after r237479."
1208         https://bugs.webkit.org/show_bug.cgi?id=187373
1209         https://trac.webkit.org/changeset/237484
1210
1211 2018-10-26  Tadeu Zagallo  <tzagallo@apple.com>
1212
1213         New bytecode format for JSC
1214         https://bugs.webkit.org/show_bug.cgi?id=187373
1215         <rdar://problem/44186758>
1216
1217         Reviewed by Filip Pizlo.
1218
1219         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
1220
1221         * stress/maximum-inline-capacity.js: Added.
1222         (test1):
1223         (test3.Foo):
1224         (test3):
1225
1226 2018-10-26  Mark Lam  <mark.lam@apple.com>
1227
1228         Fix missing edge cases with JSGlobalObjects having a bad time.
1229         https://bugs.webkit.org/show_bug.cgi?id=189028
1230         <rdar://problem/45204939>
1231
1232         Reviewed by Saam Barati.
1233
1234         * stress/regress-189028.js: Added.
1235
1236 2018-10-22  Mark Lam  <mark.lam@apple.com>
1237
1238         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
1239         https://bugs.webkit.org/show_bug.cgi?id=190515
1240         <rdar://problem/45222379>
1241
1242         Rubber-stamped by Saam Barati.
1243
1244         Adding another test.
1245
1246         * stress/regress-190515-2.js: Added.
1247
1248 2018-10-22  Mark Lam  <mark.lam@apple.com>
1249
1250         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
1251         https://bugs.webkit.org/show_bug.cgi?id=190515
1252         <rdar://problem/45222379>
1253
1254         Reviewed by Saam Barati.
1255
1256         * stress/regress-190515.js: Added.
1257
1258 2018-10-19  Commit Queue  <commit-queue@webkit.org>
1259
1260         Unreviewed, rolling out r237254.
1261         https://bugs.webkit.org/show_bug.cgi?id=190760
1262
1263         "It regresses JetStream 2 by 5% on some iOS devices"
1264         (Requested by saamyjoon on #webkit).
1265
1266         Reverted changeset:
1267
1268         "[JSC] JSC should have "parseFunction" to optimize Function
1269         constructor"
1270         https://bugs.webkit.org/show_bug.cgi?id=190340
1271         https://trac.webkit.org/changeset/237254
1272
1273 2018-10-19  Saam Barati  <sbarati@apple.com>
1274
1275         vmCall should check if we exit before emitting an OSR exit due to exceptions
1276         https://bugs.webkit.org/show_bug.cgi?id=190740
1277         <rdar://problem/45220139>
1278
1279         Reviewed by Mark Lam.
1280
1281         * stress/dont-emit-osr-exits-for-every-call-ftl.js: Added.
1282         (foo):
1283
1284 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
1285
1286         [ESNext][BigInt] Implement support for "^"
1287         https://bugs.webkit.org/show_bug.cgi?id=186235
1288
1289         Reviewed by Yusuke Suzuki.
1290
1291         * stress/big-int-bitwise-xor-general.js: Added.
1292         * stress/big-int-bitwise-xor-to-primitive-precedence.js: Added.
1293         * stress/big-int-bitwise-xor-type-error.js: Added.
1294         * stress/big-int-bitwise-xor-wrapped-value.js: Added.
1295
1296 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
1297
1298         [BigInt] Add ValueSub into DFG
1299         https://bugs.webkit.org/show_bug.cgi?id=186176
1300
1301         Reviewed by Yusuke Suzuki.
1302
1303         * stress/big-int-subtraction-jit.js:
1304         * stress/value-sub-big-int-prediction-propagation.js: Added.
1305         * stress/value-sub-big-int-untyped.js: Added.
1306         * stress/value-sub-spec-none-case.js: Added.
1307
1308 2018-10-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1309
1310         [JSC] JSC should have "parseFunction" to optimize Function constructor
1311         https://bugs.webkit.org/show_bug.cgi?id=190340
1312
1313         Reviewed by Mark Lam.
1314
1315         This patch fixes the line number of syntax errors raised by the Function constructor,
1316         since we now parse the final code only once. And we no longer use block statement
1317         for Function constructor's parsing.
1318
1319         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1320         * stress/function-cache-with-parameters-end-position.js: Added.
1321         (shouldBe):
1322         (shouldThrow):
1323         (i.anonymous):
1324         * stress/function-constructor-name.js: Added.
1325         (shouldBe):
1326         (GeneratorFunction):
1327         (AsyncFunction.async):
1328         (AsyncGeneratorFunction.async):
1329         (anonymous):
1330         (async.anonymous):
1331         * test262/expectations.yaml:
1332
1333 2018-10-18  Commit Queue  <commit-queue@webkit.org>
1334
1335         Unreviewed, rolling out r237242.
1336         https://bugs.webkit.org/show_bug.cgi?id=190701
1337
1338         it breaks "stress/sampling-profiler-basic.js" (Requested by
1339         caiolima on #webkit).
1340
1341         Reverted changeset:
1342
1343         "[BigInt] Add ValueSub into DFG"
1344         https://bugs.webkit.org/show_bug.cgi?id=186176
1345         https://trac.webkit.org/changeset/237242
1346
1347 2018-10-17  Keith Miller  <keith_miller@apple.com>
1348
1349         AI does not clear Phantom allocation nodes.
1350         https://bugs.webkit.org/show_bug.cgi?id=190694
1351
1352         Reviewed by Saam Barati.
1353
1354         * stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added.
1355         (Day):
1356         (DaysInYear):
1357         (TimeInYear):
1358         (TimeFromYear):
1359         (DayFromYear):
1360         (InLeapYear):
1361         (YearFromTime):
1362         (WeekDay):
1363         (DaylightSavingTA):
1364         (GetSecondSundayInMarch):
1365         (TimeInMonth):
1366
1367 2018-10-17  Caio Lima  <ticaiolima@gmail.com>
1368
1369         [BigInt] Add ValueSub into DFG
1370         https://bugs.webkit.org/show_bug.cgi?id=186176
1371
1372         Reviewed by Yusuke Suzuki.
1373
1374         * stress/big-int-subtraction-jit.js:
1375         * stress/value-sub-big-int-prediction-propagation.js: Added.
1376         * stress/value-sub-big-int-untyped.js: Added.
1377
1378 2018-10-16  Dominik Infuehr  <dinfuehr@igalia.com>
1379
1380         [JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips
1381         https://bugs.webkit.org/show_bug.cgi?id=190611
1382
1383         Reviewed by Saam Barati.
1384
1385         Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js
1386         to improve test runtime. On ARM/MIPS this test even timed out when running all
1387         tests.
1388
1389         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
1390         (test):
1391
1392 2018-10-15  Guillaume Emont  <guijemont@igalia.com>
1393
1394         Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux
1395
1396         Unreviewed gardening.
1397
1398         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
1399
1400 2018-10-15  Saam barati  <sbarati@apple.com>
1401
1402         Emit fjcvtzs on ARM64E on Darwin
1403         https://bugs.webkit.org/show_bug.cgi?id=184023
1404
1405         Reviewed by Yusuke Suzuki and Filip Pizlo.
1406
1407         * stress/double-to-int32-NaN.js: Added.
1408         (assert):
1409         (foo):
1410
1411 2018-10-15  Saam Barati  <sbarati@apple.com>
1412
1413         JSArray::shiftCountWithArrayStorage is wrong when an array has holes
1414         https://bugs.webkit.org/show_bug.cgi?id=190262
1415         <rdar://problem/44986241>
1416
1417         Reviewed by Mark Lam.
1418
1419         * stress/array-prototype-concat-of-long-spliced-arrays.js:
1420         (test):
1421         * stress/slice-array-storage-with-holes.js: Added.
1422         (main):
1423
1424 2018-10-15  Commit Queue  <commit-queue@webkit.org>
1425
1426         Unreviewed, rolling out r237054.
1427         https://bugs.webkit.org/show_bug.cgi?id=190593
1428
1429         "this regressed JetStream 2 by 6% on iOS" (Requested by
1430         saamyjoon on #webkit).
1431
1432         Reverted changeset:
1433
1434         "[JSC] JSC should have "parseFunction" to optimize Function
1435         constructor"
1436         https://bugs.webkit.org/show_bug.cgi?id=190340
1437         https://trac.webkit.org/changeset/237054
1438
1439 2018-10-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1440
1441         [JSC] JSON.stringify can accept call-with-no-arguments
1442         https://bugs.webkit.org/show_bug.cgi?id=190343
1443
1444         Reviewed by Mark Lam.
1445
1446         * stress/json-stringify-no-arguments.js: Added.
1447         (shouldBe):
1448
1449 2018-10-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1450
1451         [JSC] JSC should have "parseFunction" to optimize Function constructor
1452         https://bugs.webkit.org/show_bug.cgi?id=190340
1453
1454         Reviewed by Mark Lam.
1455
1456         This patch fixes the line number of syntax errors raised by the Function constructor,
1457         since we now parse the final code only once. And we no longer use block statement
1458         for Function constructor's parsing.
1459
1460         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1461         * stress/function-cache-with-parameters-end-position.js: Added.
1462         (shouldBe):
1463         (shouldThrow):
1464         (i.anonymous):
1465         * stress/function-constructor-name.js: Added.
1466         (shouldBe):
1467         (GeneratorFunction):
1468         (AsyncFunction.async):
1469         (AsyncGeneratorFunction.async):
1470         (anonymous):
1471         (async.anonymous):
1472         * test262/expectations.yaml:
1473
1474 2018-10-10  Guillaume Emont  <guijemont@igalia.com>
1475
1476         Skip JSC test stress/sampling-profiler-richards.js on armv7/linux
1477         https://bugs.webkit.org/show_bug.cgi?id=190426
1478
1479         Unreviewed gardening.
1480
1481         * stress/sampling-profiler-richards.js:
1482
1483 2018-10-06  Caio Lima  <ticaiolima@gmail.com>
1484
1485         [ESNext][BigInt] Implement support for "|"
1486         https://bugs.webkit.org/show_bug.cgi?id=186229
1487
1488         Reviewed by Yusuke Suzuki.
1489
1490         * stress/big-int-bitwise-and-jit.js:
1491         * stress/big-int-bitwise-or-general.js: Added.
1492         * stress/big-int-bitwise-or-jit-untyped.js: Added.
1493         * stress/big-int-bitwise-or-jit.js: Added.
1494         * stress/big-int-bitwise-or-memory-stress.js: Added.
1495         * stress/big-int-bitwise-or-to-primitive-precedence.js: Added.
1496         * stress/big-int-bitwise-or-type-error.js: Added.
1497         * stress/big-int-bitwise-or-wrapped-value.js: Added.
1498
1499 2018-10-05  Dominik Infuehr  <dominik.infuehr@gmail.com>
1500
1501         Skip test on systems with limited memory
1502         https://bugs.webkit.org/show_bug.cgi?id=190310
1503
1504         Invoking runDefault adds test to runlist, skipping the test in the next
1505         line does not prevent the test from executing. Change order of lines such
1506         that runDefault is only executed if test is not executed.
1507
1508         Reviewed by Mark Lam.
1509
1510         * stress/regress-190187.js:
1511
1512 2018-10-03  Saam barati  <sbarati@apple.com>
1513
1514         lowXYZ in FTLLower should always filter the type of the incoming edge
1515         https://bugs.webkit.org/show_bug.cgi?id=189939
1516         <rdar://problem/44407030>
1517
1518         Reviewed by Michael Saboff.
1519
1520         * stress/ftl-should-always-filter-for-low-type-check-functions.js: Added.
1521         (foo):
1522         (test):
1523
1524 2018-10-03  Mark Lam  <mark.lam@apple.com>
1525
1526         Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX.
1527         https://bugs.webkit.org/show_bug.cgi?id=190187
1528         <rdar://problem/42512909>
1529
1530         Reviewed by Michael Saboff.
1531
1532         * stress/regress-190187.js: Added.
1533
1534 2018-10-02  Caio Lima  <ticaiolima@gmail.com>
1535
1536         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
1537         https://bugs.webkit.org/show_bug.cgi?id=190033
1538
1539         Reviewed by Yusuke Suzuki.
1540
1541         * stress/big-int-to-string.js:
1542
1543 2018-10-01  Mark Lam  <mark.lam@apple.com>
1544
1545         Function.toString() should also copy the source code Functions that are class definitions.
1546         https://bugs.webkit.org/show_bug.cgi?id=190186
1547         <rdar://problem/44733360>
1548
1549         Reviewed by Saam Barati.
1550
1551         * stress/regress-190186.js: Added.
1552
1553 2018-10-01  Dominik Infuehr  <dinfuehr@igalia.com>
1554
1555         Split NaN-check into separate test
1556         https://bugs.webkit.org/show_bug.cgi?id=190010
1557
1558         Reviewed by Saam Barati.
1559
1560         DataView exposes NaN-representation, which is not necessarily the same on each
1561         architecture. Therefore move the check of the NaN-representation into its own
1562         file such that we can disable this test on MIPS where NaN-representation can be
1563         different on older CPUs.
1564
1565         * stress/dataview-jit-set-nan.js: Added.
1566         (assert):
1567         (test.storeLittleEndian):
1568         (test.storeBigEndian):
1569         (test.store):
1570         (test):
1571         * stress/dataview-jit-set.js:
1572         (test5):
1573
1574 2018-10-01  Commit Queue  <commit-queue@webkit.org>
1575
1576         Unreviewed, rolling out r236647.
1577         https://bugs.webkit.org/show_bug.cgi?id=190124
1578
1579         Breaking test stress/big-int-to-string.js (Requested by
1580         caiolima_ on #webkit).
1581
1582         Reverted changeset:
1583
1584         "[BigInt] BigInt.proptotype.toString is broken when radix is
1585         power of 2"
1586         https://bugs.webkit.org/show_bug.cgi?id=190033
1587         https://trac.webkit.org/changeset/236647
1588
1589 2018-09-30  Caio Lima  <ticaiolima@gmail.com>
1590
1591         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
1592         https://bugs.webkit.org/show_bug.cgi?id=190033
1593
1594         Reviewed by Yusuke Suzuki.
1595
1596         * stress/big-int-to-string.js:
1597
1598 2018-09-28  Caio Lima  <ticaiolima@gmail.com>
1599
1600         [ESNext][BigInt] Implement support for "&"
1601         https://bugs.webkit.org/show_bug.cgi?id=186228
1602
1603         Reviewed by Yusuke Suzuki.
1604
1605         * stress/big-int-bitwise-and-general.js: Added.
1606         (assert):
1607         (assert.sameValue):
1608         * stress/big-int-bitwise-and-jit.js: Added.
1609         (let.assert.sameValue):
1610         (bigIntBitAnd):
1611         * stress/big-int-bitwise-and-memory-stress.js: Added.
1612         (assert):
1613         * stress/big-int-bitwise-and-to-primitive-precedence.js: Added.
1614         (assert.sameValue):
1615         (let.o.Symbol.toPrimitive):
1616         (catch):
1617         * stress/big-int-bitwise-and-type-error.js: Added.
1618         (assert):
1619         (assertThrowTypeError):
1620         (let.o.valueOf):
1621         (o.valueOf):
1622         (o.toString):
1623         (o.Symbol.toPrimitive):
1624         * stress/big-int-bitwise-and-wrapped-value.js: Added.
1625         (assert.sameValue):
1626         (testBitAnd):
1627         (let.o.Symbol.toPrimitive):
1628         (o.valueOf):
1629         (o.toString):
1630
1631 2018-09-28  Ross Kirsling  <ross.kirsling@sony.com>
1632
1633         JSC test stress/jsc-read.js doesn't support CRLF
1634         https://bugs.webkit.org/show_bug.cgi?id=190063
1635
1636         Reviewed by Yusuke Suzuki.
1637
1638         In order to run this test via Windows command prompt, we can't assume that the final newline will be LF.
1639
1640         * stress/jsc-read.js:
1641         (test):
1642
1643 2018-09-27  Saam barati  <sbarati@apple.com>
1644
1645         Verify the contents of AssemblerBuffer on arm64e
1646         https://bugs.webkit.org/show_bug.cgi?id=190057
1647         <rdar://problem/38916630>
1648
1649         Reviewed by Mark Lam.
1650
1651         * stress/regress-189132.js:
1652
1653 2018-09-27  Dominik Infuehr  <dinfuehr@igalia.com>
1654
1655         Disable test without LLInt on ARMv7
1656         https://bugs.webkit.org/show_bug.cgi?id=190037
1657
1658         Reviewed by Mark Lam.
1659
1660         Test runs out of executable memory on ARMv7, do not run
1661         this test without LLInt enabled.
1662
1663         * stress/regress-169445.js:
1664
1665 2018-09-26  Keith Miller  <keith_miller@apple.com>
1666
1667         We should zero unused property storage when rebalancing array storage.
1668         https://bugs.webkit.org/show_bug.cgi?id=188151
1669
1670         Reviewed by Michael Saboff.
1671
1672         * stress/splice-should-zero-property-storage-when-rebalancing.js: Added.
1673
1674 2018-09-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1675
1676         [JSC] Optimize Array#lastIndexOf
1677         https://bugs.webkit.org/show_bug.cgi?id=189780
1678
1679         Reviewed by Saam Barati.
1680
1681         * stress/array-lastindexof-array-prototype-trap.js: Added.
1682         (shouldBe):
1683         (AncestorArray.prototype.get 2):
1684         (AncestorArray):
1685         * stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added.
1686         (shouldBe):
1687         * stress/array-lastindexof-hole-nan.js: Added.
1688         (shouldBe):
1689         (throw.new.Error):
1690         * stress/array-lastindexof-infinity.js: Added.
1691         (shouldBe):
1692         (throw.new.Error):
1693         * stress/array-lastindexof-negative-zero.js: Added.
1694         (shouldBe):
1695         (throw.new.Error):
1696         * stress/array-lastindexof-own-getter.js: Added.
1697         (shouldBe):
1698         (throw.new.Error.get array):
1699         (get array):
1700         * stress/array-lastindexof-prototype-trap.js: Added.
1701         (shouldBe):
1702         (DerivedArray.prototype.get 2):
1703         (DerivedArray):
1704
1705 2018-09-25  Saam Barati  <sbarati@apple.com>
1706
1707         Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
1708         https://bugs.webkit.org/show_bug.cgi?id=189940
1709         <rdar://problem/43640987>
1710
1711         Reviewed by Mark Lam.
1712
1713         * stress/use-baseline-codeblock-materialize-osr-exit.js: Added.
1714
1715 2018-09-24  Saam Barati  <sbarati@apple.com>
1716
1717         Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects
1718         https://bugs.webkit.org/show_bug.cgi?id=189922
1719         <rdar://problem/44651275>
1720
1721         Reviewed by Mark Lam.
1722
1723         * stress/array-indexof-fast-path-effects.js: Added.
1724         * stress/array-indexof-cached-length.js: Added.
1725
1726 2018-09-24  Saam barati  <sbarati@apple.com>
1727
1728         ArgumentsEliminationPhase should snip basic blocks after proven OSR exits
1729         https://bugs.webkit.org/show_bug.cgi?id=189682
1730         <rdar://problem/43557315>
1731
1732         Reviewed by Mark Lam.
1733
1734         * stress/arguments-elimination-will-generate-edge-without-result.js: Added.
1735         (foo):
1736
1737 2018-09-22  Saam barati  <sbarati@apple.com>
1738
1739         The sampling should not use Strong<CodeBlock> in its machineLocation field
1740         https://bugs.webkit.org/show_bug.cgi?id=189319
1741
1742         Reviewed by Filip Pizlo.
1743
1744         * stress/sampling-profiler-richards.js: Added.
1745
1746 2018-09-19  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1747
1748         [JSC] Optimize Array#indexOf in C++ runtime
1749         https://bugs.webkit.org/show_bug.cgi?id=189507
1750
1751         Reviewed by Saam Barati.
1752
1753         * stress/array-indexof-array-prototype-trap.js: Added.
1754         (shouldBe):
1755         (AncestorArray.prototype.get 2):
1756         (AncestorArray):
1757         * stress/array-indexof-have-a-bad-time-c-runtime.js: Added.
1758         (shouldBe):
1759         * stress/array-indexof-hole-nan.js: Added.
1760         (shouldBe):
1761         (throw.new.Error):
1762         * stress/array-indexof-infinity.js: Added.
1763         (shouldBe):
1764         (throw.new.Error):
1765         * stress/array-indexof-negative-zero.js: Added.
1766         (shouldBe):
1767         (throw.new.Error):
1768         * stress/array-indexof-own-getter.js: Added.
1769         (shouldBe):
1770         (throw.new.Error.get array):
1771         (get array):
1772         * stress/array-indexof-prototype-trap.js: Added.
1773         (shouldBe):
1774         (DerivedArray.prototype.get 2):
1775         (DerivedArray):
1776
1777 2018-09-19  Saam barati  <sbarati@apple.com>
1778
1779         AI rule for MultiPutByOffset executes its effects in the wrong order
1780         https://bugs.webkit.org/show_bug.cgi?id=189757
1781         <rdar://problem/43535257>
1782
1783         Reviewed by Michael Saboff.
1784
1785         * stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
1786         (foo):
1787         (Foo):
1788         (g):
1789
1790 2018-09-17  Mark Lam  <mark.lam@apple.com>
1791
1792         Ensure that ForInContexts are invalidated if their loop local is over-written.
1793         https://bugs.webkit.org/show_bug.cgi?id=189571
1794         <rdar://problem/44402277>
1795
1796         Reviewed by Saam Barati.
1797
1798         * stress/regress-189571.js: Added.
1799
1800 2018-09-17  Saam barati  <sbarati@apple.com>
1801
1802         We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
1803         https://bugs.webkit.org/show_bug.cgi?id=189676
1804         <rdar://problem/39682897>
1805
1806         Reviewed by Michael Saboff.
1807
1808         * typeProfiler/check-structure-or-empty-in-fixup.js: Added.
1809         (A):
1810         (K):
1811         (i.catch):
1812
1813 2018-09-14  Saam barati  <sbarati@apple.com>
1814
1815         Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
1816         https://bugs.webkit.org/show_bug.cgi?id=189628
1817         <rdar://problem/39481690>
1818
1819         Reviewed by Mark Lam.
1820
1821         * stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
1822         (foo):
1823
1824 2018-09-11  Mark Lam  <mark.lam@apple.com>
1825
1826         Test for array initialization in arrayProtoFuncSplice.
1827         https://bugs.webkit.org/show_bug.cgi?id=170253
1828         <rdar://problem/31328773>
1829
1830         Rubber-stamped by Saam Barati.
1831
1832         * stress/regress-170253.js: Added.
1833
1834 2018-09-11  Mark Lam  <mark.lam@apple.com>
1835
1836         Test for IntlObject initialization.
1837         https://bugs.webkit.org/show_bug.cgi?id=170251
1838         <rdar://problem/31328419>
1839
1840         Rubber-stamped by Saam Barati.
1841
1842         * stress/regress-170251.js: Added.
1843
1844 2018-09-11  Mark Lam  <mark.lam@apple.com>
1845
1846         Test for array memcpy'ing when JSGlobalObject::haveABadTime.
1847         https://bugs.webkit.org/show_bug.cgi?id=169889
1848         <rdar://problem/31155607>
1849
1850         Reviewed by Saam Barati.
1851
1852         * stress/regress-169889-array-concat.js: Added.
1853         * stress/regress-169889-array-concat1.js: Added.
1854         * stress/regress-169889-array-slice.js: Added.
1855
1856 2018-09-11  Mark Lam  <mark.lam@apple.com>
1857
1858         Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope.
1859         https://bugs.webkit.org/show_bug.cgi?id=169445
1860         <rdar://problem/30957435>
1861
1862         Reviewed by Saam Barati.
1863
1864         * stress/regress-169445.js: Added.
1865         (let.gun.eval.A):
1866         (let.gun.eval.B.C):
1867         (let.gun.eval.B.C.prototype.trigger):
1868         (let.gun.eval.B.C.prototype.triggerWithRestParameters):
1869         (let.gun.eval.B):
1870         (let.gun.eval):
1871
1872 == Rolled over to ChangeLog-2018-09-11 ==