19d572a27b6ac98d9b6bd0cfbe43a2de039ab53e
[WebKit-https.git] / JSTests / ChangeLog
1 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
2
3         Skip stress/splay-flash-access tests on memory limited platforms
4         https://bugs.webkit.org/show_bug.cgi?id=181086
5
6         Reviewed by Carlos Alberto Lopez Perez.
7
8         These tests use about 185M of memory, and occasionally get OOM-killed
9         on memory limited platforms.
10
11         * stress/splay-flash-access-1ms.js:
12         * stress/splay-flash-access.js:
13
14 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
15
16         Skip slow jsc tests on embedded platforms
17         https://bugs.webkit.org/show_bug.cgi?id=180937
18
19         Reviewed by Carlos Alberto Lopez Perez.
20
21         The tests typeProfiler/deltablue-for-of.js and
22         typeProfiler/getter-richards.js take a very long time in the
23         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
24         thus always timeout. They should be skipped on these platforms.
25
26         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
27         * typeProfiler/getter-richards.js: Skip on arm*/mips.
28
29 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
30
31         [JSC] Do not check isValid() in op_new_regexp
32         https://bugs.webkit.org/show_bug.cgi?id=180970
33
34         Reviewed by Saam Barati.
35
36         * stress/regexp-syntax-error-invalid-flags.js: Added.
37         (shouldThrow):
38
39 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
40
41         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
42         https://bugs.webkit.org/show_bug.cgi?id=180712
43
44         Reviewed by Michael Catanzaro.
45
46         stress/call-apply-exponential-bytecode-size.js crashes if the
47         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
48         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
49         should skip the test on other platforms.
50
51         * stress/call-apply-exponential-bytecode-size.js:
52
53 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
54
55         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
56         https://bugs.webkit.org/show_bug.cgi?id=179762
57
58         Reviewed by Saam Barati.
59
60         * stress/call-varargs-double-new-array-buffer.js: Added.
61         (assert):
62         (bar):
63         (foo):
64         * stress/call-varargs-spread-new-array-buffer.js: Added.
65         (assert):
66         (bar):
67         (foo):
68         * stress/call-varargs-spread-new-array-buffer2.js: Added.
69         (assert):
70         (bar):
71         (foo):
72         * stress/forward-varargs-double-new-array-buffer.js: Added.
73         (assert):
74         (test.baz):
75         (test.bar):
76         (test.foo):
77         (test):
78         * stress/new-array-buffer-sinking-osrexit.js: Added.
79         (target):
80         (test):
81         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
82         (shouldBe):
83         (test):
84         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
85         (shouldBe):
86         (target):
87         (test):
88         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
89         (assert):
90         (test1.bar):
91         (test1.foo):
92         (test1):
93         (test2.bar):
94         (test2.foo):
95         (test3.baz):
96         (test3.bar):
97         (test3.foo):
98         (test4.baz):
99         (test4.bar):
100         (test4.foo):
101         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
102         (assert):
103         (test.baz):
104         (test.bar):
105         (test.foo):
106         (test):
107         * stress/phantom-new-array-buffer-osr-exit.js: Added.
108         (assert):
109         (baz):
110         (bar):
111         (effects):
112         (foo):
113
114 2017-12-14  Saam Barati  <sbarati@apple.com>
115
116         The CleanUp after LICM is erroneously removing a Check
117         https://bugs.webkit.org/show_bug.cgi?id=180852
118         <rdar://problem/36063494>
119
120         Reviewed by Filip Pizlo.
121
122         * stress/dont-run-cleanup-after-licm.js: Added.
123
124 2017-12-14  Michael Saboff  <msaboff@apple.com>
125
126         REGRESSION (r225695): Repro crash on yahoo login page
127         https://bugs.webkit.org/show_bug.cgi?id=180761
128
129         Reviewed by JF Bastien.
130
131         New regression test.
132
133         * stress/regress-180761.js: Added.
134
135 2017-12-13  Keith Miller  <keith_miller@apple.com>
136
137         JSObjects should have a mask for loading indexed properties
138         https://bugs.webkit.org/show_bug.cgi?id=180768
139
140         Reviewed by Mark Lam.
141
142         * stress/int16-put-by-val-in-and-out-of-bounds.js:
143         (test):
144
145 2017-12-13  Saam Barati  <sbarati@apple.com>
146
147         Arrow functions need their own structure because they have different properties than sloppy functions
148         https://bugs.webkit.org/show_bug.cgi?id=180779
149         <rdar://problem/35814591>
150
151         Reviewed by Mark Lam.
152
153         * stress/arrow-function-needs-its-own-structure.js: Added.
154         (assert):
155         (readPrototype):
156         (noInline.let.f1):
157         (noInline):
158
159 2017-12-13  Saam Barati  <sbarati@apple.com>
160
161         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
162         https://bugs.webkit.org/show_bug.cgi?id=163579
163         <rdar://problem/35455798>
164
165         Reviewed by Mark Lam.
166
167         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
168         (assert):
169         (test1):
170         (i.test1):
171         (i.test1.C):
172         (i.test1.async.foo):
173         (i.test1.foo):
174         (test2):
175
176 2017-12-13  Saam Barati  <sbarati@apple.com>
177
178         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
179         https://bugs.webkit.org/show_bug.cgi?id=180734
180         <rdar://problem/35640547>
181
182         Reviewed by Yusuke Suzuki.
183
184         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
185         (__isPropertyOfType):
186         (__getProperties):
187         (__getObjects):
188         (__getRandomObject):
189         (theClass.):
190         (theClass):
191         (childClass):
192         (counter.catch):
193
194 2017-12-12  Saam Barati  <sbarati@apple.com>
195
196         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
197         https://bugs.webkit.org/show_bug.cgi?id=180725
198         <rdar://problem/35970511>
199
200         Reviewed by Michael Saboff.
201
202         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
203         (f1):
204         (f2):
205         (let.o2.valueOf):
206
207 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
208
209         [JSC] Implement optimized WeakMap and WeakSet
210         https://bugs.webkit.org/show_bug.cgi?id=179929
211
212         Reviewed by Saam Barati.
213
214         * microbenchmarks/weak-map-key.js:
215         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
216         (assert):
217         (objectKey):
218         (let.start.Date.now):
219         * stress/basic-weakmap.js: Added.
220         (shouldBe):
221         (test):
222         * stress/basic-weakset.js: Added.
223         (shouldBe):
224         (test.set new):
225         * stress/weakmap-cse-set-break.js: Added.
226         (shouldBe):
227         (test):
228         * stress/weakmap-cse.js: Added.
229         (shouldBe):
230         (test):
231         * stress/weakmap-gc.js: Added.
232         (test):
233         * stress/weakset-cse-add-break.js: Added.
234         (shouldBe):
235         (test.set new):
236         * stress/weakset-cse.js: Added.
237         (shouldBe):
238         (test.set new):
239         * stress/weakset-gc.js: Added.
240         (test.set add):
241         (test.set new):
242         (test):
243
244 2017-12-12  Saam Barati  <sbarati@apple.com>
245
246         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
247         https://bugs.webkit.org/show_bug.cgi?id=180723
248         <rdar://problem/35859726>
249
250         Reviewed by JF Bastien.
251
252         * stress/get-my-argument-by-val-constant-folding.js: Added.
253         (test):
254         (catch):
255
256 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
257
258         [ESNext][BigInt] Implement BigInt literals and JSBigInt
259         https://bugs.webkit.org/show_bug.cgi?id=179000
260
261         Reviewed by Darin Adler and Yusuke Suzuki.
262
263         * bigIntTests.yaml: Added.
264         * stress/big-int-literal-line-terminator.js: Added.
265         * stress/big-int-literals.js: Added.
266         * stress/big-int-operations-error.js: Added.
267         * stress/big-int-type-of.js: Added.
268         * stress/big-int-white-space-trailing-leading.js: Added.
269         * stress/big-int-function-apply.js: Added.
270
271 2017-12-11  Saam Barati  <sbarati@apple.com>
272
273         We need to disableCaching() in ErrorInstance when we materialize properties
274         https://bugs.webkit.org/show_bug.cgi?id=180343
275         <rdar://problem/35833002>
276
277         Reviewed by Mark Lam.
278
279         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
280         (assert):
281         (makeError):
282         (storeToStack):
283         (storeToStackAlreadyMaterialized):
284
285 2017-12-05  JF Bastien  <jfbastien@apple.com>
286
287         WebAssembly: don't eagerly checksum
288         https://bugs.webkit.org/show_bug.cgi?id=180441
289         <rdar://problem/35156628>
290
291         Reviewed by Saam Barati.
292
293         Checksum is now disabled, so tests only have <?> as the module
294         name.
295
296         * wasm/function-tests/nameSection.js:
297         * wasm/function-tests/stack-overflow.js:
298         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
299         (assertOverflows.assertThrows):
300         (assertOverflows):
301         * wasm/function-tests/stack-trace.js:
302
303 2017-12-04  JF Bastien  <jfbastien@apple.com>
304
305         Proxy all functions, except the $ objects
306         https://bugs.webkit.org/show_bug.cgi?id=180375
307
308         Reviewed by Saam Barati.
309
310         It looks like this test may have broken some executions because I
311         call some internal objects. Explicitly ignore objects whose name
312         starts with "$" because it's a bad idea anyways.
313
314         * stress/proxy-all-the-parameters.js:
315         (generateObjects):
316         (get throw):
317
318 2017-12-04  Saam Barati  <sbarati@apple.com>
319
320         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
321         https://bugs.webkit.org/show_bug.cgi?id=180366
322         <rdar://problem/35685877>
323
324         Reviewed by Michael Saboff.
325
326         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
327         (theParent):
328         (test1.base.getParentStaticValue):
329         (test1.base):
330         (test1.__v_24888.prototype.set prop):
331         (test1.__v_24888):
332         (test2.base.getParentStaticValue):
333         (test2.base):
334         (test2.__v_24888.prototype.set prop):
335         (test2.__v_24888):
336         (test2):
337
338 2017-12-01  JF Bastien  <jfbastien@apple.com>
339
340         Try proxying all function arguments
341         https://bugs.webkit.org/show_bug.cgi?id=180306
342
343         Reviewed by Saam Barati.
344
345         * stress/proxy-all-the-parameters.js: Added.
346         (isPropertyOfType):
347         (getProperties):
348         (generateObjects):
349         (getObjects):
350         (getFunctions):
351         (get throw):
352         (let.o.of.getObjects.let.f.of.getFunctions.catch):
353
354 2017-12-01  JF Bastien  <jfbastien@apple.com>
355
356         JavaScriptCore: missing exception checks in Math functions that take more than one argument
357         https://bugs.webkit.org/show_bug.cgi?id=180297
358         <rdar://problem/35745556>
359
360         Reviewed by Mark Lam.
361
362         * stress/math-exceptions.js: Added.
363         (get try):
364         (catch):
365
366 2017-12-01  JF Bastien  <jfbastien@apple.com>
367
368         JavaScriptCore: add test for weird class static getters
369         https://bugs.webkit.org/show_bug.cgi?id=180281
370         <rdar://problem/35592139>
371
372         Reviewed by Mark Lam.
373
374         I fixed a bug for it in r224927 and didn't add a test. Do so.
375
376         * stress/class-static-get-weird.js: Added.
377         (c.prototype.get name):
378         (c):
379         (c.prototype.get arguments):
380         (c.prototype.get caller):
381         (c.prototype.get length):
382
383 2017-12-01  Saam Barati  <sbarati@apple.com>
384
385         Having a bad time needs to handle ArrayClass indexing type as well
386         https://bugs.webkit.org/show_bug.cgi?id=180274
387         <rdar://problem/35667869>
388
389         Reviewed by Keith Miller and Mark Lam.
390
391         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
392         (assert):
393         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
394         (assert):
395
396 2017-12-01  JF Bastien  <jfbastien@apple.com>
397
398         WebAssembly: restore cached stack limit after out-call
399         https://bugs.webkit.org/show_bug.cgi?id=179106
400         <rdar://problem/35337525>
401
402         Reviewed by Saam Barati.
403
404         * wasm/function-tests/double-instance.js: Added.
405         (const.imp.boom):
406         (const.imp.get callAnother):
407
408 2017-11-30  JF Bastien  <jfbastien@apple.com>
409
410         WebAssembly: improve stack trace
411         https://bugs.webkit.org/show_bug.cgi?id=179343
412
413         Reviewed by Saam Barati.
414
415         Update the tests to follow the new format. Notably, SHA1 module
416         hash is now included in traces, and stubs are properly identified.
417
418         * wasm/assert.js: Add an assertion which matches regular expressions.
419         * wasm/function-tests/nameSection.js:
420         * wasm/function-tests/stack-overflow.js:
421         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
422         (assertOverflows.assertThrows.wasm.1):
423         (assertOverflows.assertThrows.wasm.0):
424         (assertOverflows.assertThrows):
425         (assertOverflows):
426         * wasm/function-tests/stack-trace.js:
427         (import.Builder.from.string_appeared_here.assert): Deleted.
428         * wasm/function-tests/trap-after-cross-instance-call.js:
429         (wasmFrameCountFromError):
430         * wasm/function-tests/trap-load-2.js:
431         (wasmFrameCountFromError):
432         * wasm/function-tests/trap-load.js:
433         (wasmFrameCountFromError):
434
435 2017-11-30  Mark Lam  <mark.lam@apple.com>
436
437         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
438         https://bugs.webkit.org/show_bug.cgi?id=180219
439         <rdar://problem/35696536>
440
441         Reviewed by Filip Pizlo.
442
443         * stress/regress-180219.js: Added.
444
445 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
446
447         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
448         https://bugs.webkit.org/show_bug.cgi?id=180190
449
450         Reviewed by Mark Lam.
451
452         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
453         (shouldBe):
454         (test1):
455         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
456         (shouldBe):
457         (test1):
458         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
459         (shouldBe):
460         (test1):
461         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
462         (shouldBe):
463         (test1):
464         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
465         (shouldBe):
466         (test1):
467         * stress/operation-in-may-have-negative-int32.js: Added.
468         (shouldBe):
469         (test2):
470         * stress/operation-in-negative-int32-cast.js: Added.
471         (shouldBe):
472         (test1):
473
474 2017-11-28  JF Bastien  <jfbastien@apple.com>
475
476         Strict and sloppy functions shouldn't share structure
477         https://bugs.webkit.org/show_bug.cgi?id=180103
478         <rdar://problem/35667847>
479
480         Reviewed by Saam Barati.
481
482         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
483         because the IC was wrong.
484         (foo):
485         (bar):
486         (baz):
487         (catch):
488         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
489         in this patch, but may as well test odd strict mode corner cases.
490         (bar):
491         (baz):
492         (catch):
493         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
494         (foo):
495         (bar):
496         (baz):
497         (catch):
498         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
499         next file, but with invalidation of the FunctionExecutable's
500         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
501         slower path.
502         (foo):
503         (bar.const.x):
504         (bar.const.y):
505         (bar):
506         (catch):
507         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
508         strict nesting works correctly.
509         (foo):
510         (bar.baz):
511         (bar):
512         * stress/strict-function-structure.js: Added. The test used to
513         assert in objectProtoFuncHasOwnProperty.
514         (foo):
515         (bar):
516         (baz):
517         * stress/strict-nested-function-structure.js: Added. Nesting.
518         (foo):
519         (bar):
520         (baz.boo):
521         (baz):
522
523 2017-11-29  Robin Morisset  <rmorisset@apple.com>
524
525         The recursive tail call optimisation is wrong on closures
526         https://bugs.webkit.org/show_bug.cgi?id=179835
527
528         Reviewed by Saam Barati.
529
530         * stress/closure-recursive-tail-call.js: Added.
531         (makeClosure):
532
533 2017-11-27  JF Bastien  <jfbastien@apple.com>
534
535         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
536         https://bugs.webkit.org/show_bug.cgi?id=180051
537         <rdar://problem/35614371>
538
539         Reviewed by Saam Barati.
540
541         * stress/rest-parameter-negative.js: Added.
542         (__f_5484):
543         (catch):
544         (__f_5485):
545         (__v_22598.catch):
546
547 2017-11-27  Saam Barati  <sbarati@apple.com>
548
549         Spread can escape when CreateRest does not
550         https://bugs.webkit.org/show_bug.cgi?id=180057
551         <rdar://problem/35676119>
552
553         Reviewed by JF Bastien.
554
555         * stress/spread-escapes-but-create-rest-does-not.js: Added.
556         (assert):
557         (getProperties):
558         (theFunc):
559         (let.obj.valueOf):
560
561 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
562
563         [DFG] Add NormalizeMapKey DFG IR
564         https://bugs.webkit.org/show_bug.cgi?id=179912
565
566         Reviewed by Saam Barati.
567
568         * stress/map-untyped-normalize-cse.js: Added.
569         (shouldBe):
570         (test):
571         * stress/map-untyped-normalize.js: Added.
572         (shouldBe):
573         (test):
574         * stress/set-untyped-normalize-cse.js: Added.
575         (shouldBe):
576         (set return.set has.set has):
577         * stress/set-untyped-normalize.js: Added.
578         (shouldBe):
579         (set return.set has):
580
581 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
582
583         [FTL] Support DeleteById and DeleteByVal
584         https://bugs.webkit.org/show_bug.cgi?id=180022
585
586         Reviewed by Saam Barati.
587
588         * stress/delete-by-id.js: Added.
589         (shouldBe):
590         (test1):
591         (test2):
592         * stress/delete-by-val-ftl.js: Added.
593         (shouldBe):
594         (test1):
595         (test2):
596
597 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
598
599         [DFG] Introduce {Set,Map,WeakMap}Fields
600         https://bugs.webkit.org/show_bug.cgi?id=179925
601
602         Reviewed by Saam Barati.
603
604         * stress/map-set-clobber-map-get.js: Added.
605         (shouldBe):
606         (test):
607         * stress/map-set-does-not-clobber-set-has.js: Added.
608         (shouldBe):
609         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
610         (shouldBe):
611         (test):
612         * stress/set-add-clobber-set-has.js: Added.
613         (shouldBe):
614         * stress/set-add-does-not-clobber-map-get.js: Added.
615         (shouldBe):
616
617 2017-11-24  Mark Lam  <mark.lam@apple.com>
618
619         Move unsafe jsc shell test functions to the $vm object.
620         https://bugs.webkit.org/show_bug.cgi?id=179980
621
622         Reviewed by Yusuke Suzuki.
623
624         * controlFlowProfiler/driver/driver.js:
625         * controlFlowProfiler/execution-count.js:
626         * controlFlowProfiler/if-statement.js:
627         * controlFlowProfiler/loop-statements.js:
628         * controlFlowProfiler/switch-statements.js:
629         * controlFlowProfiler/test-jit.js:
630         * exceptionFuzz/3d-cube.js:
631         * exceptionFuzz/date-format-xparb.js:
632         * exceptionFuzz/earley-boyer.js:
633         * heapProfiler/basic-edges.js:
634         * heapProfiler/property-edge-types.js:
635         * microbenchmarks/try-get-by-id-basic.js:
636         * microbenchmarks/try-get-by-id-polymorphic.js:
637         * modules/namespace-object-try-get.js:
638         * stress/argument-count-bytecode.js:
639         * stress/argument-intrinsic-basic.js:
640         * stress/argument-intrinsic-inlining-use-caller-arg.js:
641         * stress/argument-intrinsic-inlining-with-result-escape.js:
642         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
643         * stress/argument-intrinsic-inlining-with-vararg.js:
644         * stress/argument-intrinsic-nested-inlining.js:
645         * stress/argument-intrinsic-not-convert-to-get-argument.js:
646         * stress/argument-intrinsic-with-stack-write.js:
647         * stress/arity-mismatch-get-argument.js:
648         * stress/array-message-passing.js:
649         * stress/array-push-with-force-exit.js:
650         * stress/check-dom-with-signature.js:
651         * stress/check-sub-class.js:
652         * stress/compare-eq-incomplete-profile.js:
653         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
654         * stress/do-eval-virtual-call-correctly.js:
655         * stress/dom-jit-with-poly-proto.js:
656         * stress/domjit-exception-ic.js:
657         * stress/domjit-exception.js:
658         * stress/domjit-getter-complex-with-incorrect-object.js:
659         * stress/domjit-getter-complex.js:
660         * stress/domjit-getter-poly.js:
661         * stress/domjit-getter-proto.js:
662         * stress/domjit-getter-super-poly.js:
663         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
664         * stress/domjit-getter-type-check.js:
665         * stress/domjit-getter.js:
666         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
667         * stress/for-in-proxy-target-changed-structure.js:
668         * stress/for-in-proxy.js:
669         * stress/generational-opaque-roots.js:
670         * stress/global-const-redeclaration-setting-2.js:
671         * stress/global-const-redeclaration-setting-3.js:
672         * stress/global-const-redeclaration-setting-4.js:
673         * stress/global-const-redeclaration-setting-5.js:
674         * stress/global-const-redeclaration-setting.js:
675         * stress/import-basic.js:
676         * stress/import-from-eval.js:
677         * stress/import-reject-with-exception.js:
678         * stress/import-syntax.js:
679         * stress/impure-get-own-property-slot-inline-cache.js:
680         * stress/is-constructor.js:
681         * stress/istypedarrayview-intrinsic.js:
682         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
683         * stress/jsc-test-functions-should-be-more-robust.js:
684         * stress/object-toString-with-proxy.js:
685         * stress/poly-proto-custom-value-and-accessor.js:
686         * stress/proxy-inline-cache.js:
687         * stress/re-execute-error-module.js:
688         * stress/regress-150532.js:
689         * stress/regress-156992.js:
690         * stress/regress-179619.js:
691         * stress/resources/shadow-chicken-support.js:
692         * stress/runtime-array.js:
693         * stress/sampling-profiler-microtasks.js:
694         * stress/shadow-chicken-enabled.js:
695         * stress/spread-correct-global-object-on-exception.js:
696         * stress/super-get-by-id.js:
697         * stress/tailCallForwardArguments.js:
698         * stress/to-object-intrinsic-boolean-edge.js:
699         * stress/to-object-intrinsic-null-or-undefined-edge.js:
700         * stress/to-object-intrinsic-number-edge.js:
701         * stress/to-object-intrinsic-object-edge.js:
702         * stress/to-object-intrinsic-string-edge.js:
703         * stress/to-object-intrinsic-symbol-edge.js:
704         * stress/to-object-intrinsic.js:
705         * stress/try-catch-custom-getter-as-get-by-id.js:
706         * stress/try-get-by-id-poly-proto.js:
707         * stress/try-get-by-id-should-spill-registers-dfg.js:
708         * stress/try-get-by-id.js:
709         * typeProfiler/arrow-functions.js:
710         * typeProfiler/basic.js:
711         * typeProfiler/captured.js:
712         * typeProfiler/classes.js:
713         * typeProfiler/dfg-jit-optimizations.js:
714         * typeProfiler/dictionary-mode.js:
715         * typeProfiler/es6-block-scoping.js:
716         * typeProfiler/es6-classes.js:
717         * typeProfiler/inheritance.js:
718         * typeProfiler/int52-dfg.js:
719         * typeProfiler/loop.js:
720         * typeProfiler/optional-fields.js:
721         * typeProfiler/overflow.js:
722         * typeProfiler/return.js:
723         * typeProfiler/symbol.js:
724         * typeProfiler/weird-prototype-chain.js:
725
726 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
727
728         [DFG][FTL] Support MapSet / SetAdd intrinsics
729         https://bugs.webkit.org/show_bug.cgi?id=179858
730
731         Reviewed by Saam Barati.
732
733         * microbenchmarks/map-has-and-set.js: Added.
734         (test):
735         * stress/map-set-check-failure.js: Added.
736         (shouldBe):
737         (shouldThrow):
738         (target):
739         * stress/map-set-cse.js: Added.
740         (shouldBe):
741         (test):
742         * stress/set-add-check-failure.js: Added.
743         (shouldBe):
744         (shouldThrow):
745         (set shouldThrow):
746         * stress/set-add-cse.js: Added.
747         (shouldBe):
748
749 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
750
751         [JSC] Allow poly proto for intrinsic getters
752         https://bugs.webkit.org/show_bug.cgi?id=179550
753
754         Reviewed by Saam Barati.
755
756         This change is also tested by existing tests.
757
758             1. stress/intrinsic-getter-with-poly-proto.js
759             2. stress/poly-proto-intrinsic-getter-correctness.js
760
761         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
762         (shouldBe):
763         (makePolyProtoObject.foo.C):
764         (makePolyProtoObject.foo):
765         (makePolyProtoObject):
766         (target):
767         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
768         (shouldBe):
769         (makePolyProtoObject.foo.C):
770         (makePolyProtoObject.foo):
771         (makePolyProtoObject):
772         (target):
773
774 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
775
776         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
777         https://bugs.webkit.org/show_bug.cgi?id=179744
778
779         Reviewed by Michael Catanzaro.
780
781         This test uses too much memory for our buildbots on these platforms
782         and gets OOM-killed.
783
784         * stress/unshiftCountSlowCase-correct-postCapacity.js:
785         Skip if $memoryLimited and linux.
786
787 2017-11-17  JF Bastien  <jfbastien@apple.com>
788
789         WebAssembly JS API: throw when a promise can't be created
790         https://bugs.webkit.org/show_bug.cgi?id=179826
791         <rdar://problem/35455813>
792
793         Reviewed by Mark Lam.
794
795         Test WebAssembly.{compile,instantiate} where promise creation
796         fails because of a stack overflow.
797
798         * wasm/js-api/promise-stack-overflow.js: Added.
799         (const.runNearStackLimit.f.const.t):
800         (async.testCompile):
801         (async.testInstantiate):
802
803 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
804
805         Unreviewed, mark regress-178385.js as memory exhausting
806
807         * stress/regress-178385.js:
808
809 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
810
811         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
812
813         Unreviewed test gardening.
814
815         * test262.yaml:
816
817 2017-11-16  Robin Morisset  <rmorisset@apple.com>
818
819         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
820         https://bugs.webkit.org/show_bug.cgi?id=179763
821         <rdar://problem/35550513>
822
823         Reviewed by Keith Miller.
824
825         Just adding a slightly cleaned-up version of the original fuzzer-found test.
826
827         * stress/tdz-this-in-try-catch.js: Added.
828         (__v_6388):
829         (__v_6392):
830
831 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
832
833         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
834         https://bugs.webkit.org/show_bug.cgi?id=179594
835
836         Reviewed by Saam Barati.
837
838         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
839         (shouldBe):
840         (args):
841         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
842         (shouldBe):
843         (args):
844
845 2017-11-14  Saam Barati  <sbarati@apple.com>
846
847         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
848         https://bugs.webkit.org/show_bug.cgi?id=179639
849         <rdar://problem/35513018>
850
851         Reviewed by JF Bastien.
852
853         * wasm/function-tests/grow-memory-cause-gc.js: Added.
854         (escape):
855         (i.func):
856
857 2017-11-13  Mark Lam  <mark.lam@apple.com>
858
859         Add more overflow check book-keeping for MarkedArgumentBuffer.
860         https://bugs.webkit.org/show_bug.cgi?id=179634
861         <rdar://problem/35492517>
862
863         Reviewed by Saam Barati.
864
865         * stress/regress-179634.js: Added.
866
867 2017-11-13  Mark Lam  <mark.lam@apple.com>
868
869         Make the jsc shell loadGetterFromGetterSetter() function more robust.
870         https://bugs.webkit.org/show_bug.cgi?id=179619
871         <rdar://problem/35492518>
872
873         Reviewed by Saam Barati.
874
875         * stress/regress-179619.js: Added.
876
877 2017-11-12  Mark Lam  <mark.lam@apple.com>
878
879         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
880         https://bugs.webkit.org/show_bug.cgi?id=179562
881         <rdar://problem/35467022>
882
883         Reviewed by Saam Barati.
884
885         * regress-179562.js: Added.
886
887 2017-11-08  Saam Barati  <sbarati@apple.com>
888
889         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
890         https://bugs.webkit.org/show_bug.cgi?id=177792
891
892         Reviewed by Yusuke Suzuki.
893
894         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
895         (assert):
896         (foo.Foo.prototype.ensureX):
897         (foo.Foo):
898         (foo):
899         (access):
900
901 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
902
903         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
904         https://bugs.webkit.org/show_bug.cgi?id=178592
905
906         Unreviewed test gardening.
907
908         * test262.yaml:
909
910 2017-11-08  Robin Morisset  <rmorisset@apple.com>
911
912         Turn recursive tail calls into loops
913         https://bugs.webkit.org/show_bug.cgi?id=176601
914
915         Reviewed by Saam Barati.
916
917         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
918
919         Add some simple test that computes factorial in several ways, and other trivial computations.
920         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
921         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
922         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
923         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
924
925         * stress/inline-call-to-recursive-tail-call.js: Added.
926         (factorial.aux):
927         (factorial):
928         (factorial2.aux2):
929         (factorial2.id):
930         (factorial2):
931         (factorial3.aux3):
932         (factorial3):
933         (aux4):
934         (factorial4):
935         (foo):
936         (auxBar):
937         (bar):
938         (test):
939
940 2017-11-07  Mark Lam  <mark.lam@apple.com>
941
942         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
943         https://bugs.webkit.org/show_bug.cgi?id=179355
944         <rdar://problem/35263053>
945
946         Reviewed by Saam Barati.
947
948         * stress/regress-179355.js: Added.
949
950 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
951
952         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
953         https://bugs.webkit.org/show_bug.cgi?id=144458
954
955         Reviewed by Saam Barati.
956
957         * microbenchmarks/dfg-internal-function-call.js: Added.
958         (target):
959         * microbenchmarks/dfg-internal-function-construct.js: Added.
960         (target):
961         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
962         (target):
963         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
964         (target):
965         * stress/dfg-internal-function-call.js: Added.
966         (shouldBe):
967         (target):
968         * stress/dfg-internal-function-construct.js: Added.
969         (shouldBe):
970         (target):
971         * stress/internal-function-call.js: Added.
972         (shouldBe):
973         * stress/internal-function-construct.js: Added.
974         (shouldBe):
975
976 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
977
978         [Win] Skip stress/regress-178385.js.
979         https://bugs.webkit.org/show_bug.cgi?id=179298
980
981         Unreviewed test gardening.
982
983         * stress/regress-178385.js:
984
985 2017-11-03  Keith Miller  <keith_miller@apple.com>
986
987         Add test for ic with side effects
988         https://bugs.webkit.org/show_bug.cgi?id=179268
989
990         Reviewed by Saam Barati.
991
992         * stress/put-inline-cache-side-effects.js: Added.
993         (let.i.of.objs.keys):
994         (f):
995
996 2017-11-03  Mark Lam  <mark.lam@apple.com>
997
998         CachedCall (and its clients) needs overflow checks.
999         https://bugs.webkit.org/show_bug.cgi?id=179185
1000
1001         Reviewed by JF Bastien.
1002
1003         * stress/regress-179185.js: Added.
1004
1005 2017-11-02  Michael Saboff  <msaboff@apple.com>
1006
1007         DFG needs to handle code motion of code in for..in loop bodies
1008         https://bugs.webkit.org/show_bug.cgi?id=179212
1009
1010         Reviewed by Keith Miller.
1011
1012         New regression test.
1013
1014         * stress/for-in-side-effects.js: Added.
1015         (getPrototypeOf):
1016         (reset):
1017         (testWithoutFTL.f):
1018         (testWithoutFTL):
1019         (testWithFTL.f):
1020         (testWithFTL):
1021
1022 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
1023
1024         AI does not correctly model the clobber case of ArithClz32
1025         https://bugs.webkit.org/show_bug.cgi?id=179188
1026
1027         Reviewed by Michael Saboff.
1028
1029         * stress/arith-clz32-effects.js: Added.
1030         (foo):
1031         (valueOf):
1032
1033 2017-11-01  Michael Saboff  <msaboff@apple.com>
1034
1035         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
1036         https://bugs.webkit.org/show_bug.cgi?id=179140
1037
1038         Reviewed by Saam Barati.
1039
1040         New regression test.
1041
1042         * stress/regress-179140.js: Added.
1043         (testWithoutFTL):
1044         (testWithFTL):
1045
1046 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1047
1048         [JSC] Introduce @toObject
1049         https://bugs.webkit.org/show_bug.cgi?id=178726
1050
1051         Reviewed by Saam Barati.
1052
1053         * stress/array-copywithin.js:
1054         (shouldThrow):
1055         * stress/object-constructor-boolean-edge.js: Added.
1056         (shouldBe):
1057         (test):
1058         * stress/object-constructor-global.js: Added.
1059         (shouldBe):
1060         * stress/object-constructor-null-edge.js: Added.
1061         (shouldBe):
1062         (test):
1063         * stress/object-constructor-number-edge.js: Added.
1064         (shouldBe):
1065         (test):
1066         * stress/object-constructor-object-edge.js: Added.
1067         (shouldBe):
1068         (test):
1069         (i.arg):
1070         * stress/object-constructor-string-edge.js: Added.
1071         (shouldBe):
1072         (test):
1073         * stress/object-constructor-symbol-edge.js: Added.
1074         (shouldBe):
1075         (test):
1076         * stress/object-constructor-undefined-edge.js: Added.
1077         (shouldBe):
1078         (test):
1079         * stress/symbol-array-from.js: Added.
1080         (shouldBe):
1081         * stress/to-object-intrinsic-boolean-edge.js: Added.
1082         (shouldBe):
1083         (builtin.createBuiltin):
1084         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
1085         (shouldThrow):
1086         * stress/to-object-intrinsic-number-edge.js: Added.
1087         (shouldBe):
1088         (builtin.createBuiltin):
1089         * stress/to-object-intrinsic-object-edge.js: Added.
1090         (shouldBe):
1091         (builtin.createBuiltin):
1092         (i.arg):
1093         * stress/to-object-intrinsic-string-edge.js: Added.
1094         (shouldBe):
1095         (builtin.createBuiltin):
1096         * stress/to-object-intrinsic-symbol-edge.js: Added.
1097         (shouldBe):
1098         (builtin.createBuiltin):
1099         * stress/to-object-intrinsic.js: Added.
1100         (shouldBe):
1101         (shouldThrow):
1102         (builtin.createBuiltin):
1103
1104 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1105
1106         [DFG][FTL] Introduce StringSlice
1107         https://bugs.webkit.org/show_bug.cgi?id=178934
1108
1109         Reviewed by Saam Barati.
1110
1111         * microbenchmarks/string-slice-empty.js: Added.
1112         (slice):
1113         * microbenchmarks/string-slice-one-char.js: Added.
1114         (slice):
1115         * microbenchmarks/string-slice.js: Added.
1116         (slice):
1117
1118 2017-10-26  Michael Saboff  <msaboff@apple.com>
1119
1120         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
1121         https://bugs.webkit.org/show_bug.cgi?id=178890
1122
1123         Reviewed by Keith Miller.
1124
1125         New regression test.
1126
1127         * stress/regress-178890.js: Added.
1128
1129 2017-10-26  Mark Lam  <mark.lam@apple.com>
1130
1131         JSRopeString::RopeBuilder::append() should check for overflows.
1132         https://bugs.webkit.org/show_bug.cgi?id=178385
1133         <rdar://problem/35027468>
1134
1135         Reviewed by Saam Barati.
1136
1137         * stress/regress-178385.js: Added.
1138
1139 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
1140
1141         Unreviewed, rolling out r223961.
1142
1143         The change that required this has been rolled out.
1144
1145         Reverted changeset:
1146
1147         "Mark test262.yaml/test262/test/language/statements/try/tco-
1148         catch.js as passing."
1149         https://bugs.webkit.org/show_bug.cgi?id=178592
1150         https://trac.webkit.org/changeset/223961
1151
1152 2017-10-25  Commit Queue  <commit-queue@webkit.org>
1153
1154         Unreviewed, rolling out r223691 and r223729.
1155         https://bugs.webkit.org/show_bug.cgi?id=178834
1156
1157         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
1158         by rniwa on #webkit).
1159
1160         Reverted changesets:
1161
1162         "Turn recursive tail calls into loops"
1163         https://bugs.webkit.org/show_bug.cgi?id=176601
1164         https://trac.webkit.org/changeset/223691
1165
1166         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
1167         comparison is always false due to limited range of data type
1168         [-Wtype-limits]"
1169         https://bugs.webkit.org/show_bug.cgi?id=178543
1170         https://trac.webkit.org/changeset/223729
1171
1172 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
1173
1174         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1175         https://bugs.webkit.org/show_bug.cgi?id=178592
1176
1177         Unreviewed test gardening.
1178
1179         * test262.yaml:
1180
1181 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1182
1183         [FTL] Support NewStringObject
1184         https://bugs.webkit.org/show_bug.cgi?id=178737
1185
1186         Reviewed by Saam Barati.
1187
1188         * stress/new-string-object.js: Added.
1189         (shouldBe):
1190         (test):
1191
1192 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1193
1194         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
1195         https://bugs.webkit.org/show_bug.cgi?id=178308
1196
1197         Reviewed by Mark Lam.
1198
1199         * test262.yaml:
1200
1201 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1202
1203         [JSC] Use fastJoin in Array#toString
1204         https://bugs.webkit.org/show_bug.cgi?id=178062
1205
1206         Reviewed by Darin Adler.
1207
1208         * microbenchmarks/contiguous-array-to-string.js: Added.
1209         (target):
1210         * microbenchmarks/double-array-to-string.js: Added.
1211         (target):
1212         * microbenchmarks/int32-array-to-string.js: Added.
1213         (target):
1214
1215 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
1216
1217         stress/check-string-ident.js is improperly skipped
1218         https://bugs.webkit.org/show_bug.cgi?id=178642
1219
1220         Reviewed by Saam Barati.
1221
1222         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
1223         since it enforces the run-jsc-stress-tests script to still set up the
1224         test to run, despite the skip directive that's used before.
1225
1226 2017-10-20  Mark Lam  <mark.lam@apple.com>
1227
1228         Add a test case for r214334.
1229         https://bugs.webkit.org/show_bug.cgi?id=169941
1230         <rdar://problem/31221258>
1231
1232         Reviewed by JF Bastien.
1233
1234         * stress/regress-169941.js: Added.
1235
1236 2017-10-19  JF Bastien  <jfbastien@apple.com>
1237
1238         WebAssembly: no VM / JS version of everything but Instance
1239         https://bugs.webkit.org/show_bug.cgi?id=177473
1240
1241         Reviewed by Filip Pizlo, Saam Barati.
1242
1243         - Exceeding max on memory growth now returns a range error as per
1244         spec. This is a (very minor) breaking change: it used to throw OOM
1245         error. Update the corresponding test.
1246
1247         * wasm/js-api/memory-grow.js:
1248         (assertEq):
1249         * wasm/js-api/table.js:
1250         (assert.throws):
1251
1252 2017-10-19  Mark Lam  <mark.lam@apple.com>
1253
1254         Stringifier::appendStringifiedValue() is missing an exception check.
1255         https://bugs.webkit.org/show_bug.cgi?id=178386
1256         <rdar://problem/35027610>
1257
1258         Reviewed by Saam Barati.
1259
1260         * stress/regress-178386.js: Added.
1261
1262 2017-10-19  Michael Saboff  <msaboff@apple.com>
1263
1264         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1265         https://bugs.webkit.org/show_bug.cgi?id=178521
1266
1267         Reviewed by JF Bastien.
1268
1269         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1270         now passes with the current version (5.0) of the Emoji spec.
1271
1272 2017-10-19  Robin Morisset  <rmorisset@apple.com>
1273
1274         Turn recursive tail calls into loops
1275         https://bugs.webkit.org/show_bug.cgi?id=176601
1276
1277         Reviewed by Saam Barati.
1278
1279         Add some simple test that computes factorial in several ways, and other trivial computations.
1280         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1281         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1282         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1283         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1284
1285         * stress/inline-call-to-recursive-tail-call.js: Added.
1286         (factorial.aux):
1287         (factorial):
1288         (factorial2.aux):
1289         (factorial2.id):
1290         (factorial2):
1291         (factorial3.aux):
1292         (factorial3):
1293         (aux):
1294         (factorial4):
1295         (test):
1296
1297 2017-10-18  Mark Lam  <mark.lam@apple.com>
1298
1299         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1300         https://bugs.webkit.org/show_bug.cgi?id=177600
1301         <rdar://problem/34710985>
1302
1303         Reviewed by Saam Barati.
1304
1305         * stress/regress-177600.js: Added.
1306
1307 2017-10-18  Mark Lam  <mark.lam@apple.com>
1308
1309         The compiler should always register a structure when it adds its transitionWatchPointSet.
1310         https://bugs.webkit.org/show_bug.cgi?id=178420
1311         <rdar://problem/34814024>
1312
1313         Reviewed by Saam Barati and Filip Pizlo.
1314
1315         * stress/regress-178420.js: Added.
1316         (new.Array.10000.map):
1317
1318 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1319
1320         [JSC] __proto__ getter should be fast
1321         https://bugs.webkit.org/show_bug.cgi?id=178067
1322
1323         Reviewed by Saam Barati.
1324
1325         * stress/dfg-object-proto-accessor.js: Added.
1326         (shouldBe):
1327         (shouldThrow):
1328         (target):
1329         * stress/dfg-object-proto-getter.js: Added.
1330         (shouldBe):
1331         (shouldThrow):
1332         (target):
1333         * stress/dfg-object-prototype-of.js: Added.
1334         (shouldBe):
1335         (shouldThrow):
1336         (target):
1337         * stress/dfg-reflect-get-prototype-of.js: Added.
1338         (shouldBe):
1339         (shouldThrow):
1340         (target):
1341         * stress/intrinsic-getter-with-poly-proto.js: Added.
1342         (shouldBe):
1343         (makePolyProtoObject.foo.C):
1344         (makePolyProtoObject.foo):
1345         (makePolyProtoObject):
1346         (target):
1347         * stress/object-get-prototype-of-filtered.js: Added.
1348         (shouldBe):
1349         (shouldThrow):
1350         (target):
1351         (i.Cocoa):
1352         * stress/object-get-prototype-of-mono-proto.js: Added.
1353         (shouldBe):
1354         (makePolyProtoObject.foo.C):
1355         (makePolyProtoObject.foo):
1356         (makePolyProtoObject):
1357         (target):
1358         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1359         (shouldBe):
1360         (makePolyProtoObject.foo.C):
1361         (makePolyProtoObject.foo):
1362         (makePolyProtoObject):
1363         (target):
1364         * stress/object-get-prototype-of-poly-proto.js: Added.
1365         (shouldBe):
1366         (makePolyProtoObject.foo.C):
1367         (makePolyProtoObject.foo):
1368         (makePolyProtoObject):
1369         (target):
1370         * stress/object-proto-getter-filtered.js: Added.
1371         (shouldBe):
1372         (shouldThrow):
1373         (target):
1374         (i.Cocoa):
1375         * stress/object-proto-getter-poly-mono-proto.js: Added.
1376         (shouldBe):
1377         (makePolyProtoObject.foo.C):
1378         (makePolyProtoObject.foo):
1379         (makePolyProtoObject):
1380         (target):
1381         * stress/object-proto-getter-poly-proto.js: Added.
1382         (shouldBe):
1383         (makePolyProtoObject.foo.C):
1384         (makePolyProtoObject.foo):
1385         (makePolyProtoObject):
1386         (target):
1387         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1388         * stress/string-proto.js: Added.
1389         (shouldBe):
1390         (target):
1391
1392 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1393
1394         Unreviewed, rolling out r223523.
1395
1396         A test for this change is failing on debug JSC bots.
1397
1398         Reverted changeset:
1399
1400         "[JSC] __proto__ getter should be fast"
1401         https://bugs.webkit.org/show_bug.cgi?id=178067
1402         https://trac.webkit.org/changeset/223523
1403
1404 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1405
1406         [JSC] __proto__ getter should be fast
1407         https://bugs.webkit.org/show_bug.cgi?id=178067
1408
1409         Reviewed by Saam Barati.
1410
1411         * stress/dfg-object-proto-accessor.js: Added.
1412         (shouldBe):
1413         (shouldThrow):
1414         (target):
1415         * stress/dfg-object-proto-getter.js: Added.
1416         (shouldBe):
1417         (shouldThrow):
1418         (target):
1419         * stress/dfg-object-prototype-of.js: Added.
1420         (shouldBe):
1421         (shouldThrow):
1422         (target):
1423         * stress/dfg-reflect-get-prototype-of.js: Added.
1424         (shouldBe):
1425         (shouldThrow):
1426         (target):
1427         * stress/object-get-prototype-of-filtered.js: Added.
1428         (shouldBe):
1429         (shouldThrow):
1430         (target):
1431         (i.Cocoa):
1432         * stress/object-get-prototype-of-mono-proto.js: Added.
1433         (shouldBe):
1434         (makePolyProtoObject.foo.C):
1435         (makePolyProtoObject.foo):
1436         (makePolyProtoObject):
1437         (target):
1438         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1439         (shouldBe):
1440         (makePolyProtoObject.foo.C):
1441         (makePolyProtoObject.foo):
1442         (makePolyProtoObject):
1443         (target):
1444         * stress/object-get-prototype-of-poly-proto.js: Added.
1445         (shouldBe):
1446         (makePolyProtoObject.foo.C):
1447         (makePolyProtoObject.foo):
1448         (makePolyProtoObject):
1449         (target):
1450         * stress/object-proto-getter-filtered.js: Added.
1451         (shouldBe):
1452         (shouldThrow):
1453         (target):
1454         (i.Cocoa):
1455         * stress/object-proto-getter-poly-mono-proto.js: Added.
1456         (shouldBe):
1457         (makePolyProtoObject.foo.C):
1458         (makePolyProtoObject.foo):
1459         (makePolyProtoObject):
1460         (target):
1461         * stress/object-proto-getter-poly-proto.js: Added.
1462         (shouldBe):
1463         (makePolyProtoObject.foo.C):
1464         (makePolyProtoObject.foo):
1465         (makePolyProtoObject):
1466         (target):
1467         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1468         * stress/string-proto.js: Added.
1469         (shouldBe):
1470         (target):
1471
1472 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1473
1474         Reland "Add Above/Below comparisons for UInt32 patterns"
1475         https://bugs.webkit.org/show_bug.cgi?id=177281
1476
1477         Reviewed by Saam Barati.
1478
1479         * stress/uint32-comparison-jump.js: Added.
1480         (shouldBe):
1481         (above):
1482         (aboveOrEqual):
1483         (below):
1484         (belowOrEqual):
1485         (notAbove):
1486         (notAboveOrEqual):
1487         (notBelow):
1488         (notBelowOrEqual):
1489         * stress/uint32-comparison.js: Added.
1490         (shouldBe):
1491         (above):
1492         (aboveOrEqual):
1493         (below):
1494         (belowOrEqual):
1495         (aboveTest):
1496         (aboveOrEqualTest):
1497         (belowTest):
1498         (belowOrEqualTest):
1499
1500 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1501
1502         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1503         https://bugs.webkit.org/show_bug.cgi?id=178210
1504
1505         Reviewed by Saam Barati.
1506
1507         * wasm/function-tests/trap-from-start-async.js:
1508         (async.StartTrapsAsync):
1509         * wasm/function-tests/trap-from-start.js:
1510         (StartTraps):
1511         * wasm/js-api/web-assembly-function.js:
1512         (assert.eq.Object.getPrototypeOf):
1513         * wasm/js-api/wrapper-function.js:
1514         (return.new.WebAssembly.Module):
1515         (assert.throws.makeInstance): Deleted.
1516         (assert.throws.Bar): Deleted.
1517         (assert.throws): Deleted.
1518
1519 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1520
1521         Enable gigacage on iOS
1522         https://bugs.webkit.org/show_bug.cgi?id=177586
1523
1524         Reviewed by JF Bastien.
1525         
1526         Add tests for when Gigacage gets runtime disabled.
1527
1528         * stress/disable-gigacage-arrays.js: Added.
1529         (foo):
1530         * stress/disable-gigacage-strings.js: Added.
1531         (foo):
1532         * stress/disable-gigacage-typed-arrays.js: Added.
1533         (foo):
1534
1535 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1536
1537         import.meta should not be assignable
1538         https://bugs.webkit.org/show_bug.cgi?id=178202
1539
1540         Reviewed by Saam Barati.
1541
1542         * modules/import-meta-assignment.js: Added.
1543         (shouldThrow):
1544         (SyntaxError.import.meta.can.shouldThrow):
1545
1546 2017-10-11  Saam Barati  <sbarati@apple.com>
1547
1548         Unreviewed. Actually skip certain type profiler tests in debug.
1549
1550         * typeProfiler.yaml:
1551         * typeProfiler/deltablue-for-of.js:
1552         * typeProfiler/getter-richards.js:
1553
1554 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1555
1556         Unreviewed, rolling out r223113 and r223121.
1557         https://bugs.webkit.org/show_bug.cgi?id=178182
1558
1559         Reintroduced 20% regression on Kraken (Requested by rniwa on
1560         #webkit).
1561
1562         Reverted changesets:
1563
1564         "Enable gigacage on iOS"
1565         https://bugs.webkit.org/show_bug.cgi?id=177586
1566         https://trac.webkit.org/changeset/223113
1567
1568         "Use one virtual allocation for all gigacages and their
1569         runways"
1570         https://bugs.webkit.org/show_bug.cgi?id=178050
1571         https://trac.webkit.org/changeset/223121
1572
1573 2017-10-11  Michael Saboff  <msaboff@apple.com>
1574
1575         Disable test262 named capture group tests with direct unicode names and with references before definitions
1576         https://bugs.webkit.org/show_bug.cgi?id=178177
1577
1578         Reviewed by Keith Miller.
1579
1580         Bugs to track fixing these test are:
1581         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1582             "Add support in named capture group identifiers for direct surrogate pairs"
1583         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1584             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1585
1586         * test262.yaml:
1587
1588 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1589
1590         Object properties are undefined in super.call() but not in this.call()
1591         https://bugs.webkit.org/show_bug.cgi?id=177230
1592
1593         Reviewed by Saam Barati.
1594
1595         * stress/super-call-function-subclass.js: Added.
1596         (assert):
1597         (A.prototype.t):
1598         (A):
1599         * stress/super-dot-call-and-apply.js: Added.
1600         (assert):
1601         (A):
1602         (A.prototype.call):
1603         (A.prototype.apply):
1604         (B.prototype.testSuper):
1605         (B):
1606         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1607         (D.prototype.testSuper):
1608         (D):
1609
1610 2017-10-10  Saam Barati  <sbarati@apple.com>
1611
1612         The prototype cache should be aware of the Executable it generates a Structure for
1613         https://bugs.webkit.org/show_bug.cgi?id=177907
1614
1615         Reviewed by Filip Pizlo.
1616
1617         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1618         (assert):
1619         (foo.C):
1620         (foo):
1621         (bar.C):
1622         (bar):
1623         (access):
1624         (makeLongChain):
1625         (accessY):
1626
1627 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1628
1629         `async` should be able to be used as an imported binding name
1630         https://bugs.webkit.org/show_bug.cgi?id=176573
1631
1632         Reviewed by Saam Barati.
1633
1634         * modules/import-default-async.js: Added.
1635         * modules/import-named-async-as.js: Added.
1636         * modules/import-named-async.js: Added.
1637         * modules/import-named-async/target.js: Added.
1638         * modules/import-namespace-async.js: Added.
1639         * test262.yaml:
1640
1641 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1642
1643         Enable gigacage on iOS
1644         https://bugs.webkit.org/show_bug.cgi?id=177586
1645
1646         Reviewed by JF Bastien.
1647         
1648         Add tests for when Gigacage gets runtime disabled.
1649
1650         * stress/disable-gigacage-arrays.js: Added.
1651         (foo):
1652         * stress/disable-gigacage-strings.js: Added.
1653         (foo):
1654         * stress/disable-gigacage-typed-arrays.js: Added.
1655         (foo):
1656
1657 2017-10-09  Michael Saboff  <msaboff@apple.com>
1658
1659         Implement RegExp Unicode property escapes
1660         https://bugs.webkit.org/show_bug.cgi?id=172069
1661
1662         Reviewed by JF Bastien.
1663
1664         Enabled Unicode Property tests.
1665
1666         * test262.yaml:
1667
1668 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1669
1670         Unreviewed, rolling out r223015 and r223025.
1671         https://bugs.webkit.org/show_bug.cgi?id=178093
1672
1673         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1674         #webkit).
1675
1676         Reverted changesets:
1677
1678         "Enable gigacage on iOS"
1679         https://bugs.webkit.org/show_bug.cgi?id=177586
1680         http://trac.webkit.org/changeset/223015
1681
1682         "Unreviewed, disable Gigacage on ARM64 Linux"
1683         https://bugs.webkit.org/show_bug.cgi?id=177586
1684         http://trac.webkit.org/changeset/223025
1685
1686 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1687
1688         Update expectations for test262 tests that pass after r223043.
1689         https://bugs.webkit.org/show_bug.cgi?id=176685
1690
1691         Unreviewed test gardening.
1692
1693         * test262.yaml:
1694
1695 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1696
1697         Unreviewed, rolling out r223022.
1698
1699         This change introduced 18 test262 failures.
1700
1701         Reverted changeset:
1702
1703         "`async` should be able to be used as an imported binding
1704         name"
1705         https://bugs.webkit.org/show_bug.cgi?id=176573
1706         http://trac.webkit.org/changeset/223022
1707
1708 2017-10-09  Saam Barati  <sbarati@apple.com>
1709
1710         3 poly-proto JSC tests timing out on debug after r222827
1711         https://bugs.webkit.org/show_bug.cgi?id=177880
1712         <rdar://problem/34817122>
1713
1714         Unreviewed.
1715
1716         I'm skipping these type profiler tests on debug since they are long running.
1717
1718         * typeProfiler/deltablue-for-of.js:
1719         * typeProfiler/getter-richards.js:
1720
1721 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1722
1723         Safari 10 /11 problem with if (!await get(something)).
1724         https://bugs.webkit.org/show_bug.cgi?id=176685
1725
1726         Reviewed by Saam Barati.
1727
1728         * stress/async-await-basic.js:
1729         (awaitEpression.async):
1730         * stress/async-await-syntax.js:
1731         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1732         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1733
1734 2017-10-08  Saam Barati  <sbarati@apple.com>
1735
1736         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1737
1738         * typeProfiler/deltablue-for-of.js:
1739         * typeProfiler/getter-richards.js:
1740
1741 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1742
1743         `async` should be able to be used as an imported binding name
1744         https://bugs.webkit.org/show_bug.cgi?id=176573
1745
1746         Reviewed by Darin Adler.
1747
1748         * modules/import-default-async.js: Added.
1749         * modules/import-named-async-as.js: Added.
1750         * modules/import-named-async.js: Added.
1751         * modules/import-named-async/target.js: Added.
1752         * modules/import-namespace-async.js: Added.
1753
1754 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1755
1756         Enable gigacage on iOS
1757         https://bugs.webkit.org/show_bug.cgi?id=177586
1758
1759         Reviewed by JF Bastien.
1760         
1761         Add tests for when Gigacage gets runtime disabled.
1762
1763         * stress/disable-gigacage-arrays.js: Added.
1764         (foo):
1765         * stress/disable-gigacage-strings.js: Added.
1766         (foo):
1767         * stress/disable-gigacage-typed-arrays.js: Added.
1768         (foo):
1769
1770 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1771
1772         Unreviewed, rolling out r222791 and r222873.
1773         https://bugs.webkit.org/show_bug.cgi?id=178031
1774
1775         Caused crashes with workers/wasm LayoutTests (Requested by
1776         ryanhaddad on #webkit).
1777
1778         Reverted changesets:
1779
1780         "WebAssembly: no VM / JS version of everything but Instance"
1781         https://bugs.webkit.org/show_bug.cgi?id=177473
1782         http://trac.webkit.org/changeset/222791
1783
1784         "WebAssembly: address no VM / JS follow-ups"
1785         https://bugs.webkit.org/show_bug.cgi?id=177887
1786         http://trac.webkit.org/changeset/222873
1787
1788 2017-10-05  Saam Barati  <sbarati@apple.com>
1789
1790         Make sure all prototypes under poly proto get added into the VM's prototype map
1791         https://bugs.webkit.org/show_bug.cgi?id=177909
1792
1793         Reviewed by Keith Miller.
1794
1795         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1796         (assert):
1797         (foo.C):
1798         (foo):
1799         (set x):
1800
1801 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1802
1803         [JSC] Introduce import.meta
1804         https://bugs.webkit.org/show_bug.cgi?id=177703
1805
1806         Reviewed by Filip Pizlo.
1807
1808         * modules/import-meta-syntax.js: Added.
1809         (shouldThrow):
1810         (shouldNotThrow):
1811         * modules/import-meta.js: Added.
1812         * modules/import-meta/cocoa.js: Added.
1813         * modules/resources/assert.js:
1814         (export.shouldNotThrow):
1815         * stress/import-syntax.js:
1816
1817 2017-10-04  Saam Barati  <sbarati@apple.com>
1818
1819         Make pertinent AccessCases watch the poly proto watchpoint
1820         https://bugs.webkit.org/show_bug.cgi?id=177765
1821
1822         Reviewed by Keith Miller.
1823
1824         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1825         (assert):
1826         (foo.C):
1827         (foo):
1828         (validate):
1829         * stress/poly-proto-clear-stub.js: Added.
1830         (assert):
1831         (foo.C):
1832         (foo):
1833
1834 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1835
1836         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1837
1838         Unreviewed test gardening.
1839
1840         * test262.yaml:
1841
1842 2017-10-04  Saam Barati  <sbarati@apple.com>
1843
1844         3 poly-proto JSC tests timing out on debug after r222827
1845         https://bugs.webkit.org/show_bug.cgi?id=177880
1846
1847         Rubber stamped by Mark Lam.
1848
1849         * microbenchmarks/poly-proto-access.js:
1850         * typeProfiler/deltablue-for-of.js:
1851         * typeProfiler/getter-richards.js:
1852
1853 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1854
1855         Unreviewed, marking tco-catch.js as a failure after test262 update
1856         https://bugs.webkit.org/show_bug.cgi?id=177859
1857
1858         * test262.yaml:
1859
1860 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1861
1862         Unreviewed, marking one async iterator test262 test failed
1863         https://bugs.webkit.org/show_bug.cgi?id=177859
1864
1865         * test262.yaml:
1866
1867 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1868
1869         [Test262] Update Test262 to Oct 4 version
1870         https://bugs.webkit.org/show_bug.cgi?id=177859
1871
1872         Reviewed by Sam Weinig.
1873
1874         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1875         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1876
1877         * test262.yaml:
1878         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1879         (checkSequence):
1880         * test262/harness/typeCoercion.js:
1881         (testCoercibleToIndexZero):
1882         (testCoercibleToIndexOne):
1883         (testCoercibleToIndexFromIndex):
1884         (testNotCoercibleToIndex.testPrimitiveValue):
1885         (testNotCoercibleToInteger):
1886         (testCoercibleToBigIntZero.testPrimitiveValue):
1887         (testCoercibleToBigIntZero):
1888         (testCoercibleToBigIntOne.testPrimitiveValue):
1889         (testCoercibleToBigIntOne):
1890         (testPrimitiveValue):
1891         (testCoercibleToBigIntFromBigInt):
1892         (testNotCoercibleToBigInt.testPrimitiveValue):
1893         (testNotCoercibleToBigInt.testStringValue):
1894         (testNotCoercibleToBigInt):
1895         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1896         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1897         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1898         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1899         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1900         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1901         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1902         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1903         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1904         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
1905         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
1906         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
1907         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
1908         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
1909         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
1910         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
1911         (testCoercibleToBigIntZero):
1912         (testCoercibleToBigIntOne):
1913         (testNotCoercibleToBigInt):
1914         (MyError): Deleted.
1915         (valueOf): Deleted.
1916         (toString): Deleted.
1917         (Symbol.toPrimitive): Deleted.
1918         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
1919         (testCoercibleToIndexZero):
1920         (testCoercibleToIndexOne):
1921         (testNotCoercibleToIndex):
1922         (MyError): Deleted.
1923         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
1924         (assert.sameValue.BigInt.asIntN.toString): Deleted.
1925         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
1926         (BigInt.asIntN.valueOf): Deleted.
1927         (BigInt.asIntN.toString): Deleted.
1928         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
1929         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
1930         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
1931         (testCoercibleToBigIntZero):
1932         (testCoercibleToBigIntOne):
1933         (testNotCoercibleToBigInt):
1934         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
1935         (testCoercibleToIndexZero):
1936         (testCoercibleToIndexOne):
1937         (testNotCoercibleToIndex):
1938         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
1939         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
1940         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
1941         (bits.valueOf):
1942         (bigint.valueOf):
1943         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
1944         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
1945         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
1946         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
1947         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
1948         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
1949         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
1950         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
1951         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
1952         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
1953         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
1954         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
1955         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
1956         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
1957         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
1958         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
1959         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
1960         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
1961         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
1962         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
1963         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
1964         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
1965         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
1966         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
1967         (replacer):
1968         (BigInt.prototype.toJSON):
1969         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
1970         (replacer):
1971         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
1972         (BigInt.prototype.toJSON):
1973         * test262/test/built-ins/JSON/stringify/bigint.js:
1974         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
1975         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
1976         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
1977         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
1978         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
1979         * test262/test/built-ins/Object/proto-from-ctor.js:
1980         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
1981         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
1982         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
1983         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
1984         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
1985         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
1986         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
1987         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
1988         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
1989         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
1990         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
1991         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
1992         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
1993         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
1994         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
1995         * test262/test/built-ins/Proxy/get-fn-realm.js:
1996         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
1997         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
1998         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
1999         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
2000         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
2001         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
2002         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
2003         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
2004         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
2005         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
2006         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
2007         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
2008         (i6.replace):
2009         (i6b.replace):
2010         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
2011         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
2012         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
2013         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
2014         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
2015         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
2016         * test262/test/built-ins/RegExp/u180e.js: Added.
2017         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
2018         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
2019         * test262/test/built-ins/String/proto-from-ctor-realm.js:
2020         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
2021         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
2022         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
2023         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
2024         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
2025         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
2026         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
2027         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
2028         * test262/test/built-ins/String/prototype/endsWith/length.js:
2029         * test262/test/built-ins/String/prototype/endsWith/name.js:
2030         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
2031         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
2032         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
2033         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
2034         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
2035         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
2036         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
2037         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
2038         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
2039         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
2040         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
2041         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
2042         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
2043         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
2044         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
2045         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
2046         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
2047         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
2048         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
2049         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
2050         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
2051         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
2052         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
2053         * test262/test/built-ins/String/prototype/includes/includes.js:
2054         * test262/test/built-ins/String/prototype/includes/length.js:
2055         * test262/test/built-ins/String/prototype/includes/name.js:
2056         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
2057         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
2058         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
2059         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
2060         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
2061         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
2062         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
2063         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
2064         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
2065         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
2066         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
2067         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
2068         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
2069         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
2070         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
2071         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
2072         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
2073         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
2074         * test262/test/built-ins/String/prototype/trim/u180e.js:
2075         * test262/test/built-ins/Symbol/for/cross-realm.js:
2076         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
2077         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
2078         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
2079         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
2080         * test262/test/built-ins/Symbol/match/cross-realm.js:
2081         * test262/test/built-ins/Symbol/replace/cross-realm.js:
2082         * test262/test/built-ins/Symbol/search/cross-realm.js:
2083         * test262/test/built-ins/Symbol/species/cross-realm.js:
2084         * test262/test/built-ins/Symbol/split/cross-realm.js:
2085         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
2086         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
2087         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
2088         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
2089         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
2090         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
2091         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
2092         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
2093         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
2094         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
2095         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
2096         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
2097         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
2098         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
2099         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
2100         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
2101         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
2102         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
2103         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
2104         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
2105         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
2106         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
2107         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
2108         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
2109         * test262/test/language/comments/mongolian-vowel-separator-single.js:
2110         * test262/test/language/eval-code/indirect/realm.js:
2111         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
2112         (o.get z):
2113         (o.get a):
2114         * test262/test/language/expressions/call/eval-realm-indirect.js:
2115         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
2116         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
2117         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
2118         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
2119         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2120         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
2121         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
2122         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
2123         * test262/test/language/expressions/greater-than/bigint-and-number.js:
2124         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
2125         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
2126         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
2127         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2128         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
2129         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
2130         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
2131         * test262/test/language/expressions/less-than/bigint-and-number.js:
2132         * test262/test/language/expressions/new/non-ctor-err-realm.js:
2133         * test262/test/language/expressions/super/realm.js:
2134         * test262/test/language/expressions/tagged-template/cache-realm.js:
2135         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
2136         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
2137         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
2138         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
2139         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
2140         * test262/test/language/literals/string/mongolian-vowel-separator.js:
2141         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
2142         (o.get z):
2143         (o.get a):
2144         * test262/test/language/statements/for-of/iterator-next-reference.js:
2145         (next):
2146         (iterator.next): Deleted.
2147         (x.of.iterable.): Deleted.
2148         (x.of.iterable.get return): Deleted.
2149         (x.of.iterable.iterator.next): Deleted.
2150         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
2151         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
2152         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
2153         * test262/test/language/white-space/mongolian-vowel-separator.js:
2154         * test262/test262-Revision.txt:
2155
2156 2017-10-03  Saam Barati  <sbarati@apple.com>
2157
2158         Implement polymorphic prototypes
2159         https://bugs.webkit.org/show_bug.cgi?id=176391
2160
2161         Reviewed by Filip Pizlo.
2162
2163         * microbenchmarks/poly-proto-access.js: Added.
2164         (assert):
2165         (foo.C):
2166         (foo.C.prototype.get bar):
2167         (foo):
2168         (bar):
2169         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
2170         (assert):
2171         (makePolyProtoObject.foo.C):
2172         (makePolyProtoObject.foo):
2173         (makePolyProtoObject):
2174         (performSet):
2175         * microbenchmarks/poly-proto-setter-speed.js: Added.
2176         (assert):
2177         (makePolyProtoObject.foo.C):
2178         (makePolyProtoObject.foo.C.prototype.set p):
2179         (makePolyProtoObject.foo):
2180         (makePolyProtoObject):
2181         (performSet):
2182         * stress/constructor-with-return.js:
2183         (i.tests.forEach.Constructor):
2184         (i.tests.forEach):
2185         (tests.forEach.Constructor): Deleted.
2186         (tests.forEach): Deleted.
2187         * stress/dom-jit-with-poly-proto.js: Added.
2188         (assert):
2189         (makePolyProtoObject.foo.C):
2190         (makePolyProtoObject.foo):
2191         (makePolyProtoObject):
2192         (validate):
2193         * stress/poly-proto-custom-value-and-accessor.js: Added.
2194         (assert):
2195         (makePolyProtoObject.foo.C):
2196         (makePolyProtoObject.foo):
2197         (makePolyProtoObject):
2198         (items.forEach):
2199         (set get for):
2200         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
2201         (assert):
2202         (makePolyProtoObject.foo.C):
2203         (makePolyProtoObject.foo):
2204         (makePolyProtoObject):
2205         (foo):
2206         * stress/poly-proto-miss.js: Added.
2207         (makePolyProtoInstanceWithNullPrototype.foo.C):
2208         (makePolyProtoInstanceWithNullPrototype.foo):
2209         (makePolyProtoInstanceWithNullPrototype):
2210         (assert):
2211         (validate):
2212         * stress/poly-proto-op-in-caching.js: Added.
2213         (assert):
2214         (makePolyProtoObject.foo.C):
2215         (makePolyProtoObject.foo):
2216         (makePolyProtoObject):
2217         (validate):
2218         (validate2):
2219         * stress/poly-proto-put-transition.js: Added.
2220         (assert):
2221         (makePolyProtoObject.foo.C):
2222         (makePolyProtoObject.foo):
2223         (makePolyProtoObject):
2224         (performSet):
2225         (i.obj.__proto__.set p):
2226         * stress/poly-proto-set-prototype.js: Added.
2227         (assert):
2228         (let.alternateProto.get x):
2229         (let.alternateProto2.get y):
2230         (let.alternateProto2.get x):
2231         (foo.C):
2232         (foo):
2233         (validate):
2234         * stress/poly-proto-setter.js: Added.
2235         (assert):
2236         (makePolyProtoObject.foo.C):
2237         (makePolyProtoObject.foo.C.prototype.set p):
2238         (makePolyProtoObject.foo.C.prototype.get p):
2239         (makePolyProtoObject.foo):
2240         (makePolyProtoObject):
2241         (performSet):
2242         * stress/poly-proto-using-inheritance.js: Added.
2243         (assert):
2244         (foo.C):
2245         (foo.C.prototype.get baz):
2246         (foo):
2247         (bar.C):
2248         (bar):
2249         (validate):
2250         * stress/primitive-poly-proto.js: Added.
2251         (makePolyProtoInstance.foo.C):
2252         (makePolyProtoInstance.foo):
2253         (makePolyProtoInstance):
2254         (assert):
2255         (validate):
2256         * stress/prototype-is-not-js-object.js: Added.
2257         (foo.bar):
2258         (foo):
2259         (assert):
2260         (validate):
2261         * stress/try-get-by-id-poly-proto.js: Added.
2262         (assert):
2263         (makePolyProtoObject.foo.C):
2264         (makePolyProtoObject.foo):
2265         (makePolyProtoObject):
2266         (tryGetByIdText):
2267         (x.__proto__.get bar):
2268         (validate):
2269         * typeProfiler/overflow.js:
2270
2271 2017-10-03  JF Bastien  <jfbastien@apple.com>
2272
2273         WebAssembly: no VM / JS version of everything but Instance
2274         https://bugs.webkit.org/show_bug.cgi?id=177473
2275
2276         Reviewed by Filip Pizlo.
2277
2278         - Exceeding max on memory growth now returns a range error as per
2279         spec. This is a (very minor) breaking change: it used to throw OOM
2280         error. Update the corresponding test.
2281
2282         * wasm/js-api/memory-grow.js:
2283         (assertEq):
2284         * wasm/js-api/table.js:
2285         (assert.throws):
2286
2287 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
2288
2289         Skip JSC test stress/regress-159779-2.js on debug.
2290         https://bugs.webkit.org/show_bug.cgi?id=177204
2291
2292         Unreviewed test gardening.
2293
2294         * stress/regress-159779-2.js:
2295
2296 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
2297
2298         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2299         https://bugs.webkit.org/show_bug.cgi?id=175642
2300
2301         Reviewed by Darin Adler.
2302
2303         * ChakraCore/test/Function/apply3.baseline-jsc:
2304
2305 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2306
2307         Unreviewed, rolling out r222564.
2308         https://bugs.webkit.org/show_bug.cgi?id=177720
2309
2310         "It regressed JetStream by 2% on iOS caused by a 50%
2311         regression on the bigfib subtest" (Requested by saamyjoon on
2312         #webkit).
2313
2314         Reverted changeset:
2315
2316         "Add Above/Below comparisons for UInt32 patterns"
2317         https://bugs.webkit.org/show_bug.cgi?id=177281
2318         http://trac.webkit.org/changeset/222564
2319
2320 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2321
2322         [DFG] Support ArrayPush with multiple args
2323         https://bugs.webkit.org/show_bug.cgi?id=175823
2324
2325         Reviewed by Saam Barati.
2326
2327         * microbenchmarks/array-push-0.js: Added.
2328         (arrayPush0):
2329         * microbenchmarks/array-push-1.js: Added.
2330         (arrayPush1):
2331         * microbenchmarks/array-push-2.js: Added.
2332         (arrayPush2):
2333         * microbenchmarks/array-push-3.js: Added.
2334         (arrayPush3):
2335         * stress/array-push-multiple-contiguous.js: Added.
2336         (shouldBe):
2337         (test):
2338         * stress/array-push-multiple-double-nan.js: Added.
2339         (shouldBe):
2340         (test):
2341         * stress/array-push-multiple-double.js: Added.
2342         (shouldBe):
2343         (test):
2344         * stress/array-push-multiple-int32.js: Added.
2345         (shouldBe):
2346         (test):
2347         * stress/array-push-multiple-many-contiguous.js: Added.
2348         (shouldBe):
2349         (test):
2350         * stress/array-push-multiple-many-double.js: Added.
2351         (shouldBe):
2352         (test):
2353         * stress/array-push-multiple-many-int32.js: Added.
2354         (shouldBe):
2355         (test):
2356         * stress/array-push-multiple-many-storage.js: Added.
2357         (shouldBe):
2358         (test):
2359         * stress/array-push-multiple-storage.js: Added.
2360         (shouldBe):
2361         (test):
2362         * stress/array-push-with-force-exit.js: Added.
2363         (target.createBuiltin):
2364
2365 2017-09-29  Saam Barati  <sbarati@apple.com>
2366
2367         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2368         https://bugs.webkit.org/show_bug.cgi?id=177639
2369
2370         Reviewed by Geoffrey Garen.
2371
2372         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2373         (assert):
2374         (Class):
2375         (items.forEach):
2376         (set get for):
2377
2378 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2379
2380         Unreviewed, rolling out r222563, r222565, and r222581.
2381         https://bugs.webkit.org/show_bug.cgi?id=177675
2382
2383         "It causes a crash when playing youtube videos" (Requested by
2384         saamyjoon on #webkit).
2385
2386         Reverted changesets:
2387
2388         "[DFG] Support ArrayPush with multiple args"
2389         https://bugs.webkit.org/show_bug.cgi?id=175823
2390         http://trac.webkit.org/changeset/222563
2391
2392         "Unreviewed, build fix after r222563"
2393         https://bugs.webkit.org/show_bug.cgi?id=175823
2394         http://trac.webkit.org/changeset/222565
2395
2396         "Unreviewed, fix x86 breaking due to exhausted registers"
2397         https://bugs.webkit.org/show_bug.cgi?id=175823
2398         http://trac.webkit.org/changeset/222581
2399
2400 2017-09-28  Mark Lam  <mark.lam@apple.com>
2401
2402         test262: Unexpected passes after r222617 and r222618.
2403         https://bugs.webkit.org/show_bug.cgi?id=177622
2404         <rdar://problem/34725960>
2405
2406         Reviewed by Saam Barati.
2407
2408         Update test262.yaml for tests that are now passing.
2409
2410         * test262.yaml:
2411
2412 2017-09-27  Michael Saboff  <msaboff@apple.com>
2413
2414         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2415         https://bugs.webkit.org/show_bug.cgi?id=177570
2416
2417         Reviewed by Filip Pizlo.
2418
2419         New regression test.
2420
2421         * stress/regress-177570.js: Added.
2422
2423 2017-09-28  Michael Saboff  <msaboff@apple.com>
2424
2425         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2426         https://bugs.webkit.org/show_bug.cgi?id=177423
2427
2428         Reviewed by Mark Lam.
2429
2430         Updated regression test.
2431
2432         * stress/regress-177423.js:
2433         (catch):
2434
2435 2017-09-27  Mark Lam  <mark.lam@apple.com>
2436
2437         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2438         https://bugs.webkit.org/show_bug.cgi?id=177584
2439         <rdar://problem/34463903>
2440
2441         Reviewed by Saam Barati.
2442
2443         * stress/regress-177584.js: Added.
2444         (assertEqual):
2445         (Array.prototype.Symbol.species):
2446
2447 2017-09-27  Saam Barati  <sbarati@apple.com>
2448
2449         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2450         https://bugs.webkit.org/show_bug.cgi?id=177523
2451
2452         Reviewed by Mark Lam.
2453
2454         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2455         (assert):
2456         (Test):
2457         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2458         (addMethods):
2459         (i.Test.prototype.propName):
2460
2461 2017-09-27  Mark Lam  <mark.lam@apple.com>
2462
2463         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2464         https://bugs.webkit.org/show_bug.cgi?id=177423
2465         <rdar://problem/34621320>
2466
2467         Reviewed by Keith Miller.
2468
2469         * stress/regress-177423.js: Added.
2470
2471 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2472
2473         Add Above/Below comparisons for UInt32 patterns
2474         https://bugs.webkit.org/show_bug.cgi?id=177281
2475
2476         Reviewed by Saam Barati.
2477
2478         * stress/uint32-comparison-jump.js: Added.
2479         (shouldBe):
2480         (above):
2481         (aboveOrEqual):
2482         (below):
2483         (belowOrEqual):
2484         (notAbove):
2485         (notAboveOrEqual):
2486         (notBelow):
2487         (notBelowOrEqual):
2488         * stress/uint32-comparison.js: Added.
2489         (shouldBe):
2490         (above):
2491         (aboveOrEqual):
2492         (below):
2493         (belowOrEqual):
2494         (aboveTest):
2495         (aboveOrEqualTest):
2496         (belowTest):
2497         (belowOrEqualTest):
2498
2499 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2500
2501         [DFG] Support ArrayPush with multiple args
2502         https://bugs.webkit.org/show_bug.cgi?id=175823
2503
2504         Reviewed by Saam Barati.
2505
2506         * microbenchmarks/array-push-0.js: Added.
2507         (arrayPush0):
2508         * microbenchmarks/array-push-1.js: Added.
2509         (arrayPush1):
2510         * microbenchmarks/array-push-2.js: Added.
2511         (arrayPush2):
2512         * microbenchmarks/array-push-3.js: Added.
2513         (arrayPush3):
2514         * stress/array-push-multiple-contiguous.js: Added.
2515         (shouldBe):
2516         (test):
2517         * stress/array-push-multiple-double-nan.js: Added.
2518         (shouldBe):
2519         (test):
2520         * stress/array-push-multiple-double.js: Added.
2521         (shouldBe):
2522         (test):
2523         * stress/array-push-multiple-int32.js: Added.
2524         (shouldBe):
2525         (test):
2526         * stress/array-push-multiple-many-contiguous.js: Added.
2527         (shouldBe):
2528         (test):
2529         * stress/array-push-multiple-many-double.js: Added.
2530         (shouldBe):
2531         (test):
2532         * stress/array-push-multiple-many-int32.js: Added.
2533         (shouldBe):
2534         (test):
2535         * stress/array-push-multiple-many-storage.js: Added.
2536         (shouldBe):
2537         (test):
2538         * stress/array-push-multiple-storage.js: Added.
2539         (shouldBe):
2540         (test):
2541
2542 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2543
2544         Unreviewed, rolling out r222518.
2545         https://bugs.webkit.org/show_bug.cgi?id=177507
2546
2547         Break the High Sierra build (Requested by yusukesuzuki on
2548         #webkit).
2549
2550         Reverted changeset:
2551
2552         "Add Above/Below comparisons for UInt32 patterns"
2553         https://bugs.webkit.org/show_bug.cgi?id=177281
2554         http://trac.webkit.org/changeset/222518
2555
2556 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2557
2558         Add Above/Below comparisons for UInt32 patterns
2559         https://bugs.webkit.org/show_bug.cgi?id=177281
2560
2561         Reviewed by Saam Barati.
2562
2563         * stress/uint32-comparison-jump.js: Added.
2564         (shouldBe):
2565         (above):
2566         (aboveOrEqual):
2567         (below):
2568         (belowOrEqual):
2569         (notAbove):
2570         (notAboveOrEqual):
2571         (notBelow):
2572         (notBelowOrEqual):
2573         * stress/uint32-comparison.js: Added.
2574         (shouldBe):
2575         (above):
2576         (aboveOrEqual):
2577         (below):
2578         (belowOrEqual):
2579         (aboveTest):
2580         (aboveOrEqualTest):
2581         (belowTest):
2582         (belowOrEqualTest):
2583
2584 2017-09-23  Keith Miller  <keith_miller@apple.com>
2585
2586         Fix infinite looping test262 test
2587         https://bugs.webkit.org/show_bug.cgi?id=177412
2588
2589         Reviewed by Yusuke Suzuki.
2590
2591         This test was poorly designed since failing it would cause the vm
2592         to inifinite loop. I've fixed it locally and will fix it on github pending
2593         the results of next weeks tc39 meeting.
2594
2595         * test262.yaml:
2596         * test262/test/language/statements/for-of/iterator-next-reference.js:
2597
2598 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2599
2600         test262: $.agent became $262.agent in test262 update
2601         https://bugs.webkit.org/show_bug.cgi?id=177407
2602
2603         Reviewed by Yusuke Suzuki.
2604
2605         * test262.yaml:
2606         ~320 tests pass now that we correctly make $262 available.
2607
2608 2017-09-22  Keith Miller  <keith_miller@apple.com>
2609
2610         Speculatively change iteration protocall to use the same next function
2611         https://bugs.webkit.org/show_bug.cgi?id=175653
2612
2613         Reviewed by Saam Barati.
2614
2615         Change test to match the new iteration behavior.
2616
2617         * stress/spread-optimized-properly.js:
2618
2619 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2620
2621         [DFG][FTL] Profile array vector length for array allocation
2622         https://bugs.webkit.org/show_bug.cgi?id=177051
2623
2624         Reviewed by Saam Barati.
2625
2626         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2627         (target):
2628
2629 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2630
2631         Unreviewed, rolling out r222380.
2632         https://bugs.webkit.org/show_bug.cgi?id=177352
2633
2634         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2635         #webkit).
2636
2637         Reverted changeset:
2638
2639         "[DFG][FTL] Profile array vector length for array allocation"
2640         https://bugs.webkit.org/show_bug.cgi?id=177051
2641         http://trac.webkit.org/changeset/222380
2642
2643 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2644
2645         [DFG][FTL] Profile array vector length for array allocation
2646         https://bugs.webkit.org/show_bug.cgi?id=177051
2647
2648         Reviewed by Saam Barati.
2649
2650         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2651         (target):
2652
2653 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2654
2655         Skip new hanging test262 tests.
2656         https://bugs.webkit.org/show_bug.cgi?id=177326
2657
2658         Unreviewed test gardening.
2659
2660         * test262.yaml:
2661
2662 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2663
2664         Mark 6 test262 tests as passing.
2665         https://bugs.webkit.org/show_bug.cgi?id=177307
2666
2667         Unreviewed test gardening.
2668
2669         * test262.yaml:
2670
2671 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2672
2673         Unreviewed follow-up to r222311.
2674
2675         * test262/harness/sta.js:
2676         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2677         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2678         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2679         * test262/test/built-ins/Array/from/elements-added-after.js:
2680         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2681         * test262/test/built-ins/Array/from/elements-updated-after.js:
2682         * test262/test/built-ins/Array/from/from-array.js:
2683         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2684         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2685         * test262/test/built-ins/Array/from/source-array-boundary.js:
2686         * test262/test/built-ins/Array/from/source-object-constructor.js:
2687         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2688         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2689         * test262/test/built-ins/Array/from/source-object-length.js:
2690         * test262/test/built-ins/Array/from/source-object-missing.js:
2691         * test262/test/built-ins/Array/from/source-object-without.js:
2692         * test262/test/built-ins/Array/from/this-null.js:
2693         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2694         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2695         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2696         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2697         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2698         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2699         * test262/test/language/literals/string/7.8.4-1gs.js:
2700         Fix some files that I failed to update when I applied my patch.
2701
2702 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2703
2704         Update test262 tests
2705         https://bugs.webkit.org/show_bug.cgi?id=177220
2706
2707         Reviewed by Saam Barati and Yusuke Suzuki.
2708
2709         * test262.yaml:
2710         * test262/test262-Revision.txt:
2711         New rebaselined expectations for all tests.
2712
2713         * test262/*:
2714         Updated.
2715
2716 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2717
2718         [DFG] Remove ToThis more aggressively
2719         https://bugs.webkit.org/show_bug.cgi?id=177056
2720
2721         Reviewed by Saam Barati.
2722
2723         * stress/generator-with-this-strict.js: Added.
2724         (shouldBe):
2725         (generator):
2726         (target):
2727         * stress/generator-with-this.js: Added.
2728         (shouldBe):
2729         (generator):
2730         (target):
2731
2732 2017-09-17  Michael Saboff  <msaboff@apple.com>
2733
2734         https://bugs.webkit.org/show_bug.cgi?id=177038
2735         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2736
2737         Reviewed by JF Bastien.
2738
2739         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2740         as it dies using too much memory.
2741
2742 2017-09-15  Saam Barati  <sbarati@apple.com>
2743
2744         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2745         https://bugs.webkit.org/show_bug.cgi?id=176981
2746
2747         Reviewed by Yusuke Suzuki.
2748
2749         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2750         (assert):
2751         (verify):
2752         (func):
2753         (const.bar.createBuiltin):
2754
2755 2017-09-14  Saam Barati  <sbarati@apple.com>
2756
2757         It should be valid to exit before each set when doing arity fixup when inlining
2758         https://bugs.webkit.org/show_bug.cgi?id=176948
2759
2760         Reviewed by Keith Miller.
2761
2762         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2763         (baz):
2764         (bar):
2765         (foo):
2766
2767 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2768
2769         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2770         https://bugs.webkit.org/show_bug.cgi?id=176867
2771
2772         Reviewed by Sam Weinig.
2773
2774         * microbenchmarks/object-get-own-property-symbols.js: Added.
2775         (test):
2776
2777 2017-09-13  Mark Lam  <mark.lam@apple.com>
2778
2779         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2780         https://bugs.webkit.org/show_bug.cgi?id=176888
2781         <rdar://problem/34381832>
2782
2783         Not reviewed.
2784
2785         * stress/op_mod-ConstVar.js:
2786         * stress/op_mod-VarConst.js:
2787         * stress/op_mod-VarVar.js:
2788
2789 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2790
2791         Skip 3 op_mod tests on Debug JSC bots.
2792         https://bugs.webkit.org/show_bug.cgi?id=176630
2793
2794         Unreviewed test gardening.
2795
2796         * stress/op_mod-ConstVar.js:
2797         * stress/op_mod-VarConst.js:
2798         * stress/op_mod-VarVar.js:
2799
2800 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2801
2802         [JSC] Fix Array allocation in Object.keys
2803         https://bugs.webkit.org/show_bug.cgi?id=176826
2804
2805         Reviewed by Saam Barati.
2806
2807         * stress/object-own-property-keys.js: Added.
2808         (shouldBe):
2809
2810 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2811
2812         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2813         https://bugs.webkit.org/show_bug.cgi?id=176010
2814
2815         Reviewed by Filip Pizlo.
2816
2817         * microbenchmarks/weak-map-key.js: Added.
2818         (assert):
2819         (objectKey):
2820         (let.start.Date.now):
2821
2822 2017-09-12  Mark Lam  <mark.lam@apple.com>
2823
2824         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2825         https://bugs.webkit.org/show_bug.cgi?id=176630
2826
2827         Reviewed by JF Bastien.
2828
2829         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2830         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2831         a speculative fix for the bots that are seeing these fail.
2832
2833         I also undid the skipping of the op_mod tests for debug builds.
2834
2835         * stress/op_div-ConstVar.js:
2836         * stress/op_div-VarConst.js:
2837         * stress/op_div-VarVar.js:
2838         * stress/op_mod-ConstVar.js:
2839         * stress/op_mod-VarConst.js:
2840         * stress/op_mod-VarVar.js:
2841
2842 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2843
2844         Skip stress/value-to-boolean.js on Debug bots.
2845         https://bugs.webkit.org/show_bug.cgi?id=176787
2846
2847         Unreviewed test gardening.
2848
2849         * stress/value-to-boolean.js:
2850
2851 2017-09-11  Mark Lam  <mark.lam@apple.com>
2852
2853         Change test expectation for test262/test/language/statements/try/tco-catch.js
2854         https://bugs.webkit.org/show_bug.cgi?id=176749
2855
2856         Rubber stamped by Keith Miller.
2857
2858         It's been failing since at least r221821.  I'm changing the test expectation to
2859         fail to green the bots while I investigate some more.
2860
2861         * test262.yaml:
2862
2863 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2864
2865         Unreviewed, rolling out r221854.
2866
2867         The test added with this change fails on 32-bit JSC bots.
2868
2869         Reverted changeset:
2870
2871         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2872         https://bugs.webkit.org/show_bug.cgi?id=176010
2873         http://trac.webkit.org/changeset/221854
2874
2875 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2876
2877         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2878         https://bugs.webkit.org/show_bug.cgi?id=176010
2879
2880         Reviewed by Filip Pizlo.
2881
2882         * microbenchmarks/weak-map-key.js: Added.
2883         (assert):
2884         (objectKey):
2885         (let.start.Date.now):
2886
2887 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2888
2889         [JSC] Optimize Object.keys by using careful array allocation
2890         https://bugs.webkit.org/show_bug.cgi?id=176654
2891
2892         Reviewed by Darin Adler.
2893
2894         * microbenchmarks/object-keys.js: Added.
2895         (test):
2896
2897 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
2898
2899         Error should compute .stack and friends lazily
2900         https://bugs.webkit.org/show_bug.cgi?id=176645
2901
2902         Reviewed by Saam Barati.
2903
2904         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
2905         * microbenchmarks/new-error.js: Added.
2906         * microbenchmarks/throw.js: Added.
2907
2908 2017-09-09  Mark Lam  <mark.lam@apple.com>
2909
2910         [Re-landing] Use JIT probes for DFG OSR exit.
2911         https://bugs.webkit.org/show_bug.cgi?id=175144
2912         <rdar://problem/33437050>
2913
2914         Not reviewed.  Original patch reviewed by Saam Barati.
2915
2916         Disable these tests for debug builds because they run too slow with the new OSR exit.
2917
2918         * stress/op_mod-ConstVar.js:
2919         * stress/op_mod-VarConst.js:
2920         * stress/op_mod-VarVar.js:
2921
2922 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2923
2924         [DFG] NewArrayWithSize(size)'s size does not care negative zero
2925         https://bugs.webkit.org/show_bug.cgi?id=176300
2926
2927         Reviewed by Saam Barati.
2928
2929         * stress/new-array-with-size-div.js: Added.
2930         (shouldBe):
2931         (test):
2932         (i.i):
2933
2934 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2935
2936         [DFG] PutByVal with Array::Generic is too generic
2937         https://bugs.webkit.org/show_bug.cgi?id=176345
2938
2939         Reviewed by Filip Pizlo.
2940
2941         * stress/object-assign-symbols.js: Added.
2942         (shouldBe):
2943         (test):
2944         * stress/object-assign.js: Added.
2945         (shouldBe):
2946         (test):
2947         (i.shouldBe.JSON.stringify.test):
2948
2949 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2950
2951         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
2952         https://bugs.webkit.org/show_bug.cgi?id=176590
2953
2954         Reviewed by Saam Barati.
2955
2956         * microbenchmarks/object-iterate-symbols.js: Added.
2957         (test):
2958         * microbenchmarks/object-iterate.js: Added.
2959         (test):
2960         * stress/object-iterate-symbols.js: Added.
2961         (shouldBe):
2962         (test):
2963         * stress/object-iterate.js: Added.
2964         (shouldBe):
2965         (test):
2966
2967 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
2968
2969         [Win32] 10 JSC stress tests are failing.
2970         https://bugs.webkit.org/show_bug.cgi?id=176538
2971
2972         Reviewed by Mark Lam.
2973
2974         Skip tests on Windows to make the bots green.
2975
2976         * ChakraCore.yaml:
2977         * stress/date-relaxed.js:
2978
2979 2017-09-06  Mark Lam  <mark.lam@apple.com>
2980
2981         constructGenericTypedArrayViewWithArguments() is missing an exception check.
2982         https://bugs.webkit.org/show_bug.cgi?id=176485
2983         <rdar://problem/33898874>
2984
2985         Reviewed by Keith Miller.
2986
2987         * stress/regress-176485.js: Added.
2988
2989 2017-09-05  Saam Barati  <sbarati@apple.com>
2990
2991         isNotCellSpeculation is wrong with respect to SpecEmpty
2992         https://bugs.webkit.org/show_bug.cgi?id=176429
2993
2994         Reviewed by Michael Saboff.
2995
2996         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
2997         (Foo):
2998
2999 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
3000
3001         test262: Completion values for control flow do not match the spec
3002         https://bugs.webkit.org/show_bug.cgi?id=171265
3003
3004         Reviewed by Saam Barati.
3005
3006         * stress/completion-value.js:
3007         Condensed test for completion values in top level statements.
3008
3009         * stress/super-get-by-id.js:
3010         ClassDeclaration when evaled no longer produce values. Convert
3011         these to ClassExpressions so they produce the class value.
3012         
3013         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3014         This is a progression for currect spec behavior.
3015
3016         * mozilla/mozilla-tests.yaml:
3017         This test is now outdated, so mark it as failing for that reason.
3018
3019         * test262.yaml:
3020         Passing all "cptn" completion value tests.
3021
3022 2017-09-04  Saam Barati  <sbarati@apple.com>
3023
3024         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
3025         https://bugs.webkit.org/show_bug.cgi?id=176317
3026
3027         Reviewed by Keith Miller.
3028
3029         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
3030         (Foo):
3031
3032 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3033
3034         [DFG][FTL] Efficiently execute number#toString()
3035         https://bugs.webkit.org/show_bug.cgi?id=170007
3036
3037         Reviewed by Keith Miller.
3038
3039         * microbenchmarks/number-to-string-strength-reduction.js: Added.
3040         (test):
3041         * microbenchmarks/number-to-string-with-radix-10.js: Added.
3042         (test):
3043         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
3044         (test):
3045         * microbenchmarks/number-to-string-with-radix.js: Added.
3046         (test):
3047         * stress/number-to-string-strength-reduction.js: Added.
3048         (shouldBe):
3049         (test):
3050         * stress/number-to-string-with-radix-10.js: Added.
3051         (shouldBe):
3052         (test):
3053         * stress/number-to-string-with-radix-cse.js: Added.
3054         (shouldBe):
3055         (test):
3056         * stress/number-to-string-with-radix-invalid.js: Added.
3057         (shouldThrow):
3058         * stress/number-to-string-with-radix-watchpoint.js: Added.
3059         (shouldBe):
3060         (test):
3061         (i.i.1e3.Number.prototype.toString):
3062         * stress/number-to-string-with-radix.js: Added.
3063         (shouldBe):
3064         (test):
3065
3066 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3067
3068         [DFG] Relax arity requirement
3069         https://bugs.webkit.org/show_bug.cgi?id=175523
3070
3071         Reviewed by Saam Barati.
3072
3073         * stress/arity-mismatch-arguments-length.js: Added.
3074         (shouldBe):
3075         (test1):
3076         (test):
3077         * stress/arity-mismatch-get-argument.js: Added.
3078         (shouldBe):
3079         (builtin.createBuiltin):
3080         (test):
3081         * stress/arity-mismatch-inlining-extra-slots.js: Added.
3082         (shouldBe):
3083         (inlineTarget):
3084         (test):
3085         * stress/arity-mismatch-inlining.js: Added.
3086         (shouldBe):
3087         (inlineTarget):
3088         (test):
3089         * stress/arity-mismatch-rest.js: Added.
3090         (shouldBe):
3091         (test2):
3092         (test1):
3093         (test):
3094
3095 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3096
3097         [JSC] Fix "name" and "length" of Proxy revoke function
3098         https://bugs.webkit.org/show_bug.cgi?id=176155
3099
3100         Reviewed by Mark Lam.
3101
3102         * test262.yaml:
3103
3104 2017-08-31  Saam Barati  <sbarati@apple.com>
3105
3106         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
3107         https://bugs.webkit.org/show_bug.cgi?id=176206
3108
3109         Reviewed by Keith Miller.
3110
3111         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
3112         (a):
3113         (b):
3114         (foo):
3115
3116 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
3117
3118         Skip two slow JSC tests after r221422.
3119
3120         Unreviewed test gardening.
3121
3122         * stress/regexp-prototype-match-on-too-long-rope.js:
3123         * stress/regexp-prototype-test-on-too-long-rope.js:
3124
3125 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
3126
3127         Unreviewed, skipping slow tests.
3128         
3129         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
3130         work differently now.
3131
3132         * stress/regexp-prototype-exec-on-too-long-rope.js:
3133         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
3134
3135 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3136
3137         [JSC] Use reifying system for "name" property of builtin JSFunction
3138         https://bugs.webkit.org/show_bug.cgi?id=175260
3139
3140         Reviewed by Saam Barati.
3141
3142         * stress/accessors-get-set-prefix.js:
3143         * stress/builtin-function-name.js: Added.
3144         (shouldBe):
3145         (shouldThrow):
3146         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3147         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3148         * stress/private-name-as-anonymous-builtin.js: Added.
3149         (shouldBe):
3150         (NotPromise):
3151
3152 2017-08-30  Saam Barati  <sbarati@apple.com>
3153
3154         Unreviewed. Make test stop printing.
3155
3156         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
3157
3158 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
3159
3160         Unreviewed, rolling out r221327.
3161
3162         This change caused test262 failures.
3163
3164         Reverted changeset:
3165
3166         "[JSC] Use reifying system for "name" property of builtin
3167         JSFunction"
3168         https://bugs.webkit.org/show_bug.cgi?id=175260
3169         http://trac.webkit.org/changeset/221327
3170
3171 2017-08-30  Saam Barati  <sbarati@apple.com>
3172
3173         semicolon is being interpreted as an = in the LiteralParser
3174         https://bugs.webkit.org/show_bug.cgi?id=176114
3175
3176         Reviewed by Oliver Hunt.
3177
3178         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
3179         * stress/resources/literal-parser-test-case.js: Added.
3180
3181 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3182
3183         [ESNext] Async iteration - Implement async iteration statement: for-await-of
3184         https://bugs.webkit.org/show_bug.cgi?id=166698
3185
3186         Reviewed by Yusuke Suzuki.
3187
3188         * stress/async-iteration-for-await-of-syntax.js: Added.
3189         (assert):
3190         (checkSyntax):
3191         (checkSyntaxError):
3192         (checkSimpleAsyncGeneratorSloppyMode):
3193         (checkSimpleAsyncGeneratorStrictMode):
3194         (checkNestedAsyncGenerators):
3195         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3196         * stress/async-iteration-for-await-of.js: Added.
3197         (assert):
3198         (async.foo):
3199         (async.boo):
3200         (const.boo.async):
3201
3202 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
3203
3204         [JSC] Use reifying system for "name" property of builtin JSFunction
3205         https://bugs.webkit.org/show_bug.cgi?id=175260
3206
3207         Reviewed by Saam Barati.
3208
3209         * stress/accessors-get-set-prefix.js:
3210         * stress/builtin-function-name.js: Added.
3211         (shouldBe):
3212         (shouldThrow):
3213         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3214         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3215
3216 2017-08-25  Saam Barati  <sbarati@apple.com>
3217
3218         Support compiling catch in the DFG
3219         https://bugs.webkit.org/show_bug.cgi?id=174590
3220         <rdar://problem/34047845>
3221
3222         Reviewed by Filip Pizlo.
3223
3224         * microbenchmarks/delta-blue-try-catch.js: Added.
3225         (exception):
3226         (value):
3227         (OrderedCollection):
3228         (OrderedCollection.prototype.add):
3229         (OrderedCollection.prototype.at):
3230         (OrderedCollection.prototype.size):
3231         (OrderedCollection.prototype.removeFirst):
3232         (OrderedCollection.prototype.remove):
3233         (Strength):
3234         (Strength.stronger):
3235         (Strength.weaker):
3236         (Strength.weakestOf):
3237         (Strength.strongest):
3238         (Strength.prototype.nextWeaker):
3239         (Constraint):
3240         (Constraint.prototype.addConstraint):
3241         (Constraint.prototype.satisfy):
3242         (Constraint.prototype.destroyConstraint):
3243         (Constraint.prototype.isInput):
3244         (UnaryConstraint):
3245         (UnaryConstraint.prototype.addToGraph):
3246         (UnaryConstraint.prototype.chooseMethod):
3247         (UnaryConstraint.prototype.isSatisfied):
3248         (UnaryConstraint.prototype.markInputs):
3249         (UnaryConstraint.prototype.output):
3250         (UnaryConstraint.prototype.recalculate):
3251         (UnaryConstraint.prototype.markUnsatisfied):
3252         (UnaryConstraint.prototype.inputsKnown):
3253         (UnaryConstraint.prototype.removeFromGraph):
3254         (StayConstraint):
3255         (StayConstraint.prototype.execute):
3256         (EditConstraint.prototype.isInput):
3257         (EditConstraint.prototype.execute):
3258         (BinaryConstraint):
3259         (BinaryConstraint.prototype.chooseMethod):
3260         (BinaryConstraint.prototype.addToGraph):
3261         (BinaryConstraint.prototype.isSatisfied):
3262         (BinaryConstraint.prototype.markInputs):
3263         (BinaryConstraint.prototype.input):
3264         (BinaryConstraint.prototype.output):
3265         (BinaryConstraint.prototype.recalculate):
3266         (BinaryConstraint.prototype.markUnsatisfied):
3267         (BinaryConstraint.prototype.inputsKnown):
3268         (BinaryConstraint.prototype.removeFromGraph):
3269         (ScaleConstraint):
3270         (ScaleConstraint.prototype.addToGraph):
3271         (ScaleConstraint.prototype.removeFromGraph):
3272         (ScaleConstraint.prototype.markInputs):
3273         (ScaleConstraint.prototype.execute):
3274         (ScaleConstraint.prototype.recalculate):
3275         (EqualityConstraint):
3276         (EqualityConstraint.prototype.execute):
3277         (Variable):
3278         (Variable.prototype.addConstraint):
3279         (Variable.prototype.removeConstraint):
3280         (Planner):
3281         (Planner.prototype.incrementalAdd):
3282         (Planner.prototype.incrementalRemove):
3283         (Planner.prototype.newMark):
3284         (Planner.prototype.makePlan):
3285         (Planner.prototype.extractPlanFromConstraints):
3286         (Planner.prototype.addPropagate):
3287         (Planner.prototype.removePropagateFrom):
3288         (Planner.prototype.addConstraintsConsumingTo):
3289         (Plan):
3290         (Plan.prototype.addConstraint):
3291         (Plan.prototype.size):
3292         (Plan.prototype.constraintAt):
3293         (Plan.prototype.execute):
3294         (chainTest):
3295         (projectionTest):
3296         (change):
3297         (deltaBlue):
3298         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3299         (assert):
3300         (Numbers):
3301         (Numbers.prototype.next):
3302         (return.Transpose):
3303         (return.Transpose.prototype.next):
3304         (transpose):
3305         (verifyEven):
3306         (verifyString):
3307         (foo):
3308         (runIterators):
3309         * microbenchmarks/try-catch-word-count.js: Added.
3310         (let.assert):
3311         (EOF):
3312         (let.texts):
3313         (let.o.apply):
3314         (foo):
3315         (bar):
3316         (f):
3317         (run):
3318         (test1):
3319         (test2):
3320         (test3):
3321         (fn):
3322         (A):
3323         (B):
3324         (A.prototype.getValue):
3325         (B.prototype.getParentValue):
3326         (strlen):
3327         (sum.0):
3328         (test):
3329         (result.test.o):
3330         (set add.set add):
3331         (set forEach):
3332         (stringHash):
3333         (set if):
3334         (testFunction):
3335         (set delete.set has.set add):
3336         * stress/catch-set-argument-speculation-failure.js: Added.
3337         (o):
3338         (e):
3339         (e2):
3340         (escape):
3341         (baz):
3342         (noInline.run):
3343         (noInline):
3344         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3345         (foo):
3346         (e):
3347         (baz):
3348         (bar):
3349
3350 2017-08-24  Commit Queue  <commit-queue@webkit.org>
3351
3352         Unreviewed, rolling out r221119, r221124, and r221143.
3353         https://bugs.webkit.org/show_bug.cgi?id=175973
3354
3355         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3356         on #webkit).
3357
3358         Reverted changesets:
3359
3360         "Support compiling catch in the DFG"
3361         https://bugs.webkit.org/show_bug.cgi?id=174590
3362         http://trac.webkit.org/changeset/221119
3363
3364         "Unreviewed, build fix in GTK port"
3365         https://bugs.webkit.org/show_bug.cgi?id=174590
3366         http://trac.webkit.org/changeset/221124
3367
3368         "DFG::JITCode::osrEntry should get sorted since we perform a
3369         binary search on it"
3370         https://bugs.webkit.org/show_bug.cgi?id=175893
3371         http://trac.webkit.org/changeset/221143
3372
3373 2017-08-24  Michael Saboff  <msaboff@apple.com>
3374
3375         Add support for RegExp "dotAll" flag
3376         https://bugs.webkit.org/show_bug.cgi?id=175924
3377
3378         Reviewed by Keith Miller.
3379
3380         Updated tests for new dotAll ('s' flag) changes.
3381
3382         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3383         * stress/static-getter-in-names.js:
3384
3385 2017-08-24  Mark Lam  <mark.lam@apple.com>
3386
3387         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3388         https://bugs.webkit.org/show_bug.cgi?id=175940
3389         <rdar://problem/29003921>
3390
3391         Reviewed by Saam Barati.
3392
3393         * stress/regress-164081.js: Added.
3394         (shouldEqual):
3395         (testcase):
3396
3397 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3398
3399         Skip flaky JSC test stress/test-finally.js.
3400         https://bugs.webkit.org/show_bug.cgi?id=160283
3401
3402         Unreviewed test gardening.
3403
3404         * stress/test-finally.js:
3405
3406 2017-08-23  Saam Barati  <sbarati@apple.com>
3407
3408         Support compiling catch in the DFG
3409         https://bugs.webkit.org/show_bug.cgi?id=174590
3410
3411         Reviewed by Filip Pizlo.
3412
3413         * microbenchmarks/delta-blue-try-catch.js: Added.
3414         (exception):
3415         (value):
3416         (OrderedCollection):
3417         (OrderedCollection.prototype.add):
3418         (OrderedCollection.prototype.at):
3419         (OrderedCollection.prototype.size):
3420         (OrderedCollection.prototype.removeFirst):
3421         (OrderedCollection.prototype.remove):
3422         (Strength):
3423         (Strength.stronger):
3424         (Strength.weaker):
3425         (Strength.weakestOf):
3426         (Strength.strongest):
3427         (Strength.prototype.nextWeaker):
3428         (Constraint):
3429         (Constraint.prototype.addConstraint):
3430         (Constraint.prototype.satisfy):
3431         (Constraint.prototype.destroyConstraint):
3432         (Constraint.prototype.isInput):
3433         (UnaryConstraint):
3434         (UnaryConstraint.prototype.addToGraph):
3435         (UnaryConstraint.prototype.chooseMethod):
3436         (UnaryConstraint.prototype.isSatisfied):
3437         (UnaryConstraint.prototype.markInputs):
3438         (UnaryConstraint.prototype.output):
3439         (UnaryConstraint.prototype.recalculate):
3440         (UnaryConstraint.prototype.markUnsatisfied):
3441         (UnaryConstraint.prototype.inputsKnown):
3442         (UnaryConstraint.prototype.removeFromGraph):
3443         (StayConstraint):
3444         (StayConstraint.prototype.execute):
3445         (EditConstraint.prototype.isInput):
3446         (EditConstraint.prototype.execute):
3447         (BinaryConstraint):
3448         (BinaryConstraint.prototype.chooseMethod):
3449         (BinaryConstraint.prototype.addToGraph):
3450         (BinaryConstraint.prototype.isSatisfied):
3451         (BinaryConstraint.prototype.markInputs):
3452         (BinaryConstraint.prototype.input):
3453         (BinaryConstraint.prototype.output):
3454         (BinaryConstraint.prototype.recalculate):
3455         (BinaryConstraint.prototype.markUnsatisfied):
3456         (BinaryConstraint.prototype.inputsKnown):
3457         (BinaryConstraint.prototype.removeFromGraph):
3458         (ScaleConstraint):
3459         (ScaleConstraint.prototype.addToGraph):
3460         (ScaleConstraint.prototype.removeFromGraph):
3461         (ScaleConstraint.prototype.markInputs):
3462         (ScaleConstraint.prototype.execute):
3463         (ScaleConstraint.prototype.recalculate):
3464         (EqualityConstraint):
3465         (EqualityConstraint.prototype.execute):
3466         (Variable):
3467         (Variable.prototype.addConstraint):
3468         (Variable.prototype.removeConstraint):
3469         (Planner):
3470         (Planner.prototype.incrementalAdd):
3471         (Planner.prototype.incrementalRemove):
3472         (Planner.prototype.newMark):
3473         (Planner.prototype.makePlan):
3474         (Planner.prototype.extractPlanFromConstraints):
3475         (Planner.prototype.addPropagate):
3476         (Planner.prototype.removePropagateFrom):
3477         (Planner.prototype.addConstraintsConsumingTo):
3478         (Plan):
3479         (Plan.prototype.addConstraint):
3480         (Plan.prototype.size):
3481         (Plan.prototype.constraintAt):
3482         (Plan.prototype.execute):
3483         (chainTest):
3484         (projectionTest):
3485         (change):
3486         (deltaBlue):
3487         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3488         (assert):
3489         (Numbers):
3490         (Numbers.prototype.next):
3491         (return.Transpose):
3492         (return.Transpose.prototype.next):
3493         (transpose):
3494         (verifyEven):
3495         (verifyString):
3496         (foo):
3497         (runIterators):
3498         * microbenchmarks/try-catch-word-count.js: Added.
3499         (let.assert):
3500         (EOF):
3501         (let.texts):
3502         (let.o.apply):
3503         (foo):
3504         (bar):
3505         (f):
3506         (run):
3507         (test1):
3508         (test2):
3509         (test3):
3510         (fn):
3511         (A):
3512         (B):
3513         (A.prototype.getValue):
3514         (B.prototype.getParentValue):
3515         (strlen):
3516         (sum.0):
3517         (test):
3518         (result.test.o):
3519         (set add.set add):
3520         (set forEach):
3521         (stringHash):
3522         (set if):
3523         (testFunction):
3524         (set delete.set has.set add):
3525         * stress/catch-set-argument-speculation-failure.js: Added.
3526         (o):
3527         (e):
3528         (e2):
3529         (escape):
3530         (baz):
3531         (noInline.run):
3532         (noInline):
3533         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3534         (foo):
3535         (e):
3536         (baz):
3537         (bar):
3538
3539 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3540
3541         [JSC] Optimize Map iteration with intrinsic
3542         https://bugs.webkit.org/show_bug.cgi?id=174355
3543
3544         Reviewed by Saam Barati.
3545
3546         * stress/map-iterator-result-should-have-expected-shape.js: Added.
3547         (shouldBe):
3548         (throw.new.Error):
3549         * stress/set-iterator-result-should-have-expected-shape.js: Added.
3550         (shouldBe):
3551         (throw.new.Error.let.iterator.set Symbol):
3552         (throw.new.Error.set add):
3553         (let.iterator.set Symbol):
3554
3555 2017-08-23  Robin Morisset  <rmorisset@apple.com>
3556
3557         Add a micro-benchmark for checking that accessing a variable within a 'with'
3558         block does not automatically prevent type prediction.
3559         https://bugs.webkit.org/show_bug.cgi?id=175738
3560
3561         Reviewed by Saam Barati.
3562
3563         * stress/with_and_arith.js: Added.
3564         (with):
3565
3566 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
3567
3568         [ESNext] Async iteration - Implement Async Generator - runtime
3569         https://bugs.webkit.org/show_bug.cgi?id=175240
3570
3571         Reviewed by Yusuke Suzuki.
3572
3573         * stress/async-iteration-async-from-sync.js: Added.
3574         (assert):
3575         (const.Logger):
3576         (this.fullfilled):
3577         (this.fullfilledDone):
3578         (this.rejected):
3579         (this.catched):
3580         (this.isFinal):
3581         (_assertLogger):
3582         (const.assertLogger):
3583         (const.getPromise.promiseHolder.return.new.Promise):
3584         (foo):
3585         (async.boo):
3586         (bar):
3587         (async.baz):
3588         (async.goo):
3589         * stress/async-iteration-basic.js: Added.
3590         (assert):
3591         (const.Logger):
3592         (this.fullfilled):
3593         (this.fullfilledDone):
3594         (this.rejected):
3595         (this.catched):
3596         (this.isFinal):
3597         (_assertLogger):
3598         (const.assertLogger):
3599         (const.getPromise.promiseHolder.return.new.Promise):
3600         (async.generator):
3601         (iterator.next.then):
3602         (async.baz):
3603         (async.boo):
3604         (async.foo):
3605         (async.goo):
3606         (A.prototype.async.foo):
3607         (A.prototype.async.boo):
3608         (A):
3609         (asyncGenExp.async):
3610         (async.joo):
3611         (j.next.then):
3612         (then):
3613         (async.koo):
3614         (async.loo):
3615         (async.moo):
3616         (async.noo):
3617         (async.ooo):
3618         (async.roo):
3619         (async.poo):
3620         (async.soo):
3621         (async.too):
3622         * stress/async-iteration-evaluation.js: Added.
3623         (assert):
3624         (async.foo):
3625         (catch):
3626         * stress/async-iteration-syntax.js:
3627         * stress/async-iteration-yield-promise.js: Added.
3628         (assert):
3629         (const.Logger):
3630         (this.fullfilled):
3631         (this.fullfilledDone):
3632         (this.rejected):
3633         (this.catched):
3634         (this.isFinal):
3635         (_assertLogger):
3636         (const.assertLogger):
3637         (const.getPromise.promiseHolder.return.new.Promise):
3638         (async.foo):
3639         (async.boo):
3640         (async.bar):
3641         * stress/async-iteration-yield-star-interface.js: Added.
3642         (assert):
3643         (const.getPromise.promiseHolder.return.new.Promise):
3644         (const.Logger):
3645         (this.fullfilled):
3646         (this.fullfilledDone):
3647         (this.rejected):
3648         (this.catched):
3649         (this.custom):
3650         (this.isFinal):
3651         (_assertLogger):
3652         (const.assertLogger):
3653         (let.asyncIter.Symbol.asyncIterator):
3654         (let.asyncIter.next):
3655         (let.asyncIter.throw):
3656         (let.asyncIter.return):
3657         (async.foo):
3658         (asyncIter.Symbol.asyncIterator):
3659         (asyncIter.next):
3660         (async.boo):
3661         (asyncIter.return):
3662         (async.bar):
3663         (async.baz):
3664         (async.foobar):
3665         * stress/async-iteration-yield-star.js: Added.
3666         (assert):
3667         (const.Logger):
3668         (this.fullfilled):
3669         (this.fullfilledDone):
3670         (this.rejected):
3671         (this.catched):
3672         (this.custom):
3673         (this.isFinal):
3674         (_assertLogger):
3675         (const.assertLogger):
3676         (const.getPromise.promiseHolder.return.new.Promise):
3677         (async.foo):
3678         (async.boo):
3679         (async.bar):
3680         (async.baz):
3681         (async.joo):
3682         (async.goo):
3683         (async.koo):
3684         (async.loo):
3685         (let.asyncIter.Symbol.asyncIterator):
3686         (let.asyncIter.next):
3687         (let.asyncIter.throw):
3688         (let.asyncIter.return):
3689         (async.moo):
3690         (async.noo):
3691         * test262.yaml:
3692
3693 2017-08-23  JF Bastien  <jfbastien@apple.com>
3694
3695         Fix printing in test
3696
3697         Unreviewed: fixing verbosity, shouldn't have been there.
3698
3699         * wasm/regress/175693.js:
3700         (else.else):
3701         (catch):
3702
3703 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
3704
3705         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
3706         https://bugs.webkit.org/show_bug.cgi?id=172543
3707
3708         Unreviewed test gardening.
3709
3710         * microbenchmarks/generator-with-several-types.js:
3711
3712 2017-08-17  JF Bastien  <jfbastien@apple.com>
3713
3714         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
3715         https://bugs.webkit.org/show_bug.cgi?id=175693
3716         <rdar://problem/33952443>
3717
3718         Reviewed by Saam Barati.
3719
3720         Add a regression directory for WebAssembly tests.
3721
3722         * wasm.yaml:
3723         * wasm/regress/175693.js: Added.
3724         (else.else):
3725         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
3726         (catch):
3727         * wasm/regress/175693.wasm: Added.
3728
3729 2017-08-15  Robin Morisset  <rmorisset@apple.com>
3730
3731         Support the 'with' keyword in FTL.
3732         https://bugs.webkit.org/show_bug.cgi?id=175585
3733
3734         Reviewed by Saam Barati.
3735
3736         Also improve the JSTest/stress/with.js file to test
3737         what happens when non-objects are passed to with.
3738
3739         * stress/with.js:
3740         (foo):
3741         (i.catch):
3742         (i.with): Deleted.
3743
3744 2017-08-14  Keith Miller  <keith_miller@apple.com>
3745
3746         Add testing tool to lie to the DFG about profiles
3747         https://bugs.webkit.org/show_bug.cgi?id=175487
3748
3749         Reviewed by Saam Barati.
3750
3751         * stress/compare-eq-incomplete-profile.js: Added.
3752         (const.test.createBuiltin):
3753
3754 2017-08-14  Robin Morisset  <rmorisset@apple.com>
3755
3756         Support the with keyword in DFG
3757         https://bugs.webkit.org/show_bug.cgi?id=175470
3758
3759         Reviewed by Saam Barati.
3760
3761         Added a new stress-test for the 'with' keyword, that caught a bug in a
3762         previous version of this code.
3763
3764         * stress/with.js: Added.
3765         (i.with):
3766
3767 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
3768
3769         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
3770         https://bugs.webkit.org/show_bug.cgi?id=175544
3771
3772         Unreviewed test gardening.
3773
3774         * ChakraCore.yaml:
3775
3776 2017-08-09  Caitlin Potter  <caitp@igalia.com>
3777
3778         Early error on ANY operator before new.target
3779         https://bugs.webkit.org/show_bug.cgi?id=157970
3780
3781         Reviewed by Saam Barati.
3782
3783         Instead of throwing if any unary operator precedes new.target, only
3784         throw if the unary operator updates the reference.
3785
3786         The following become legal in JSC:
3787
3788         ```
3789         !new.target
3790         ~new.target
3791         typeof new.target
3792         delete new.target
3793         void new.target
3794         ```
3795
3796         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
3797
3798         * stress/new-target-syntax-errors.js:
3799         * stress/new-target.js:
3800
3801 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
3802
3803         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
3804         https://bugs.webkit.org/show_bug.cgi?id=175255
3805
3806         Unreviewed test gardening.
3807
3808         * stress/regress-169783.js:
3809         * wasm/stress/oom.js:
3810
3811 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
3812
3813         REGRESSION: 2 test262/test/language/statements/async-function failures
3814         https://bugs.webkit.org/show_bug.cgi?id=175334
3815
3816         Reviewed by Yusuke Suzuki.
3817
3818         Add @skip parameters to tests, and remove test for async iterator from 
3819         async await syntax test because it is already covered by async-iterator-syntax.js
3820
3821         * stress/async-await-syntax.js:
3822         * stress/async-iteration-syntax.js:
3823
3824 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3825
3826         Unreviewed, gardening test262 for Promise resolve / reject function length
3827         https://bugs.webkit.org/show_bug.cgi?id=175333
3828
3829         * test262.yaml:
3830
3831 2017-08-07  Robin Morisset  <rmorisset@apple.com>
3832
3833         GetOwnProperty of TypedArray indexed fields is wrongly configurable
3834         https://bugs.webkit.org/show_bug.cgi?id=175307
3835
3836         Reviewed by Saam Barati.
3837
3838         * stress/typedarray-getownproperty-not-configurable.js: Added.
3839         (assert):
3840         (foo):
3841
3842 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
3843
3844         Promise resolve and reject function should have length = 1
3845         https://bugs.webkit.org/show_bug.cgi?id=175242
3846
3847         Reviewed by Saam Barati.
3848
3849         * stress/builtin-function-length.js: Added.
3850         (shouldBe):
3851         (shouldThrow):
3852         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3853         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3854
3855 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
3856
3857         [ESNext] Async iteration - Implement Async Generator - parser
3858         https://bugs.webkit.org/show_bug.cgi?id=175210
3859
3860         Reviewed by Yusuke Suzuki.
3861
3862         * stress/async-await-syntax.js:
3863         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
3864         * stress/async-iteration-syntax.js: Added.
3865         (assert):
3866         (checkSyntax):
3867         (checkSyntaxError):
3868         (checkSimpleAsyncGeneratorSloppyMode):
3869         (checkSimpleAsyncGeneratorStrictMode):
3870         (checkNestedAsyncGenerators):
3871         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3872         * stress/generator-class-methods-syntax.js:
3873
3874 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3875
3876         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
3877         https://bugs.webkit.org/show_bug.cgi?id=175150
3878
3879         Unreviewed test gardening.
3880
3881         * wasm/js-api/test_memory_constructor.js:
3882
3883 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3884
3885         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
3886         https://bugs.webkit.org/show_bug.cgi?id=175100
3887
3888         Reviewed by Mark Lam.
3889
3890         The JSC test JSTests/wasm/stress/oom.js tries to use all the
3891         available memory until an out of memory exception happens.
3892
3893         The Linux kernel is more tuned for server workloads than for GUI
3894         responsiveness. When a process tries to use a lot of memory, Linux
3895         will do its best to serve the request. This usually translates to
3896         free physical RAM by writing to disk dirty pages and/or moving out
3897         less recently used pages to swap (disk storage).
3898         Meanwhile it does this, the system will become unresponsive and this
3899         leads to freezes that can last even some minutes on the worst cases.
3900
3901         Therefore, let's skip this test on Linux as it will cause more harm
3902         than good on the Linux bots or on the machines of Linux developers.
3903
3904         * wasm/stress/oom.js:
3905
3906 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
3907
3908         [JSC] Remove unnecessary print from stress\promise-finally.js test
3909         https://bugs.webkit.org/show_bug.cgi?id=175015
3910
3911         Reviewed by Yusuke Suzuki.
3912
3913         * stress/promise-finally.js:
3914         (p.finally):
3915         (then):
3916
3917 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3918
3919         Unreviewed, update test262 results for optional catch binding
3920
3921         * test262.yaml:
3922
3923 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3924
3925         [JSC] Support optional catch binding
3926         https://bugs.webkit.org/show_bug.cgi?id=174981
3927
3928         Reviewed by Saam Barati.
3929
3930         * stress/optional-catch-binding-syntax.js: Added.
3931         (testSyntax):
3932         (testSyntaxError):
3933         (catch.catch):
3934         * stress/optional-catch-binding.js: Added.
3935         (shouldBe):
3936         (throwException):
3937
3938 2017-07-28  Mark Lam  <mark.lam@apple.com>
3939
3940         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
3941         https://bugs.webkit.org/show_bug.cgi?id=174948
3942         <rdar://problem/33495680>
3943
3944         Reviewed by Filip Pizlo.
3945
3946         * stress/regress-174948.js: Added.
3947
3948 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
3949
3950         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
3951         https://bugs.webkit.org/show_bug.cgi?id=174900
3952
3953         Reviewed by Saam Barati.
3954
3955         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
3956         (sideEffect):
3957         (args):
3958         (test):
3959
3960 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3961
3962         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
3963         https://bugs.webkit.org/show_bug.cgi?id=171637
3964
3965         Reviewed by Darin Adler.
3966
3967         * stress/domjit-getter-complex-with-incorrect-object.js:
3968         (i.shouldThrow):
3969         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
3970         (shouldBe):
3971         (i.shouldThrow):
3972
3973 2017-07-26  JF Bastien  <jfbastien@apple.com>
3974
3975         WebAssembly: test throwing out of the start function
3976         https://bugs.webkit.org/show_bug.cgi?id=165714
3977         <rdar://problem/29760251>
3978
3979         Reviewed by Keith Miller.
3980
3981         * wasm/assert.js:
3982         * wasm/function-tests/trap-from-start.js: Added.
3983         (StartTraps):
3984         * wasm/function-tests/trap-from-start-async.js: Added.
3985         (async.StartTrapsAsync):
3986
3987 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3988
3989         [FTL] Arguments elimination is suppressed by unreachable blocks
3990         https://bugs.webkit.org/show_bug.cgi?id=174352
3991
3992         Reviewed by Filip Pizlo.
3993
3994         * stress/arguments-elimination-force-exit.js: Added.
3995         (shouldBe):
3996         (strict):
3997         (sloppy):
3998         * stress/arguments-elimination-throw.js: Added.
3999         (shouldBe):
4000         (shouldThrow):
4001         (sloppy):
4002         (isArguments):
4003
4004 2017-07-13  Mark Lam  <mark.lam@apple.com>
4005
4006         Add some additional test cases for bug 170896.
4007         https://bugs.webkit.org/show_bug.cgi?id=174491
4008
4009         Reviewed by Filip Pizlo.
4010
4011         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
4012         * stress/regress-170896-with-double-shape-profile.js: Added.
4013         (test):
4014         * stress/regress-170896-with-int32-shape-profile.js: Added.
4015         (test):
4016         * stress/regress-170896.js: Removed.
4017
4018 2017-07-13  Saam Barati  <sbarati@apple.com>
4019
4020         Missing exception check in JSObject::hasInstance
4021         https://bugs.webkit.org/show_bug.cgi?id=174455
4022         <rdar://problem/31384608>
4023
4024         Reviewed by Mark Lam.
4025
4026         * stress/has-instance-exception-check.js: Added.
4027         (assert):
4028         (let.getter.Object.getOwnPropertyDescriptor.get foo):
4029
4030 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
4031
4032         [ESnext] Implement Object Spread
4033         https://bugs.webkit.org/show_bug.cgi?id=167963
4034
4035         Reviewed by Saam Barati.
4036
4037         * stress/obj-rest-destructuring-order.js: Added.
4038         (assert):
4039         (o.get z):
4040         (o.get a):
4041         * stress/obj-spread-order.js: Added.
4042         (assert):
4043         (o.get z):
4044         (o.get a):
4045         * stress/object-spread.js: Added.
4046         (let.assert):
4047         (assert.sameValue):
4048         (let.o.get a):
4049         (let.obj.get c):
4050         (cthulhu.get x):
4051         (let.obj.set c):
4052         (calls.o.get z):
4053         (calls.o.get a):
4054         (try.let.obj.get foo):
4055         (get calls):
4056
4057 2017-07-12  Saam Barati  <sbarati@apple.com>
4058
4059         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
4060         https://bugs.webkit.org/show_bug.cgi?id=174411
4061         <rdar://problem/31696186>
4062
4063         Reviewed by Mark Lam.
4064
4065         * stress/generic-arguments-correct-delete-behavior.js: Added.
4066         (assert):
4067         (makeTest):
4068
4069 2017-07-07  Mark Lam  <mark.lam@apple.com>
4070
4071         \n\r is not the same as \r\n.
4072         https://bugs.webkit.org/show_bug.cgi?id=173053
4073
4074         Reviewed by Keith Miller.
4075
4076         * stress/regress-173053.js: Added.
4077         * stress/template-literal-line-terminators.js:
4078
4079 2017-07-06  Saam Barati  <sbarati@apple.com>
4080
4081         We are missing places where we invalidate the for-in context
4082         https://bugs.webkit.org/show_bug.cgi?id=174184
4083
4084         Reviewed by Geoffrey Garen.
4085
4086         * stress/for-in-invalidate-context-weird-assignments.js: Added.
4087         (assert):
4088         (test):
4089
4090 2017-07-05  Saam Barati  <sbarati@apple.com>
4091
4092         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
4093         https://bugs.webkit.org/show_bug.cgi?id=174188
4094         <rdar://problem/30581423>
4095
4096         Reviewed by Mark Lam.
4097
4098         * stress/new-array-having-a-bad-time-double.js: Added.
4099         (assert):
4100         (foo):
4101
4102 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
4103
4104         WTF::StringImpl::copyChars segfaults when built with GCC 7
4105         https://bugs.webkit.org/show_bug.cgi?id=173407
4106
4107         Reviewed by Andreas Kling.
4108
4109         * stress/string-repeat-copy-chars-crash.js: Added.
4110         (shouldBe):
4111
4112 2017-07-03  Saam Barati  <sbarati@apple.com>
4113
4114         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
4115
4116         * stress/unshiftCountSlowCase-correct-postCapacity.js:
4117
4118 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
4119
4120         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
4121
4122         It requires too much memory.
4123
4124         * stress/dont-reserve-huge-capacity-lexer.js:
4125
4126 2017-06-30  Michael Saboff  <msaboff@apple.com>
4127
4128         Skip a test on ARM64 platform since we run out of address space.
4129
4130         Rubber stamped by Saam Barati.
4131
4132         * stress/dont-reserve-huge-capacity-lexer.js:
4133
4134 2017-06-30  Michael Saboff  <msaboff@apple.com>
4135
4136         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
4137         https://bugs.webkit.org/show_bug.cgi?id=174044
4138
4139         Reviewed by Oliver Hunt.
4140
4141         New regression test.
4142
4143         * stress/regress-174044.js: Added.
4144         (test1):
4145         (test2):
4146
4147 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
4148
4149         RegExpCachedResult::setInput should reify left and right contexts
4150         https://bugs.webkit.org/show_bug.cgi?id=173818
4151
4152         Reviewed by Keith Miller.
4153
4154         * stress/right-left-context-invalidated-by-input.js: Added.
4155         (test.validateContexts):
4156         (test):
4157
4158 2017-06-29  Saam Barati  <sbarati@apple.com>
4159
4160         Calculating postCapacity in unshiftCountSlowCase is wrong
4161         https://bugs.webkit.org/show_bug.cgi?id=173992
4162         <rdar://problem/32283199>
4163
4164         Reviewed by Keith Miller.
4165
4166         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
4167         (temp):
4168
4169 2017-06-29  Commit Queue  <commit-queue@webkit.org>
4170
4171         Unreviewed, rolling out r218512.
4172         https://bugs.webkit.org/show_bug.cgi?id=173981
4173
4174         "It changes the behavior of the JS API's JSEvaluateScript
4175         which breaks TurboTax" (Requested by saamyjoon on #webkit).
4176
4177         Reverted changeset:
4178
4179         "test262: Completion values for control flow do not match the
4180         spec"
4181         https://bugs.webkit.org/show_bug.cgi?id=171265
4182         http://trac.webkit.org/changeset/218512
4183
4184 2017-06-27  JF Bastien  <jfbastien@apple.com>
4185
4186         WebAssembly: running out of executable memory should throw OoM
4187         https://bugs.webkit.org/show_bug.cgi?id=171537
4188         <rdar://problem/32963338>
4189
4190         Reviewed by Saam Barati.
4191
4192         * wasm.yaml:
4193         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
4194         (const.invoke):
4195         (failCount.0.catch):
4196         (failCount.0.module.undefined.catch):
4197         * wasm/lowExecutableMemory/exports-oom.js: Added.
4198         (const.type):
4199         (const.params):
4200         (const.randomProgram):
4201         (failCount.0.catch):
4202         (failCount.0.module.undefined.catch):
4203         * wasm/lowExecutableMemory/imports-oom.js: Added.
4204         (const.type):
4205         (const.params):
4206         (const.randomProgram):
4207         (f.imports.push):
4208         (failCount.0.catch):
4209         (failCount.0.module.undefined.catch):
4210
4211 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
4212
4213         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
4214         https://bugs.webkit.org/show_bug.cgi?id=167962
4215
4216         Reviewed by Saam Barati.
4217
4218         * stress/object-rest-deconstruct.js: Added.
4219         (let.assert):
4220         (let.assertPropDescriptor):
4221         (catch):
4222         (get 3):
4223         (foo):
4224         (let.src.get y):
4225         (let.src.set y):
4226         (let.gen):
4227
4228 2017-06-27  Saam Barati  <sbarati@apple.com>
4229
4230         Function constructor needs to follow the spec and validate parameters and body independently
4231         https://bugs.webkit.org/show_bug.cgi?id=173303
4232         <rdar://problem/32732526>
4233
4234         Reviewed by Keith Miller.
4235
4236         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
4237         * stress/function-constructor-semantics.js: Added.
4238         (assert):
4239         (hasSyntaxError):
4240         (foo):
4241         (async.foo):
4242         (testError):
4243         (testOK.toString):
4244         (toString):
4245
4246 2017-06-26  Saam Barati  <sbarati@apple.com>
4247
4248         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
4249         https://bugs.webkit.org/show_bug.cgi?id=173740
4250
4251         Reviewed by Mark Lam.
4252
4253         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
4254         (Array.prototype.Symbol.iterator):
4255
4256 2017-06-26  Saam Barati  <sbarati@apple.com>
4257
4258         Skip a test on 32-bit platforms since we run out of address space.
4259
4260         Rubber stamped by Mark Lam.
4261
4262         * stress/dont-reserve-huge-capacity-lexer.js:
4263
4264 2017-06-26  Saam Barati  <sbarati@apple.com>
4265
4266         Crash in JSC::Lexer<unsigned char>::setCode
4267         https://bugs.webkit.org/show_bug.cgi?id=172754
4268
4269         Reviewed by Mark Lam.
4270
4271         * stress/dont-reserve-huge-capacity-lexer.js: Added.
4272         (catch):
4273
4274 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
4275
4276         [JSC] Clean up Object.entries implementation
4277         https://bugs.webkit.org/show_bug.cgi?id=173759
4278
4279         Reviewed by Sam Weinig.
4280
4281         * microbenchmarks/object-entries.js: Added.
4282         (test):
4283
4284 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
4285
4286         Remove Reflect.enumerate
4287         https://bugs.webkit.org/show_bug.cgi?id=173806
4288
4289         Reviewed by Yusuke Suzuki.
4290
4291         * ChakraCore.yaml:
4292         * es6.yaml:
4293         These tests now fail because they use Reflect.enumerate.
4294
4295         * test262.yaml:
4296         This test now passes, it checked that Reflect.enumerate is undefined!
4297
4298         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
4299         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
4300
4301         * stress/reflect-enumerate.js: Removed.
4302         Remove a test solely for Reflect.enumerate.
4303
4304 2017-06-22  Saam Barati  <sbarati@apple.com>
4305
4306         ValueRep(DoubleRep(@v)) can not simply convert to @v
4307         https://bugs.webkit.org/show_bug.cgi?id=173687
4308         <rdar://problem/32855563>
4309
4310         Reviewed by Mark Lam.
4311
4312         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
4313         (i.catch):
4314
4315 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
4316
4317         [JSC] Object.values should be implemented in C++
4318         https://bugs.webkit.org/show_bug.cgi?id=173703
4319
4320         Reviewed by Sam Weinig.
4321
4322         * microbenchmarks/object-keys-map-values.js: Added.
4323         (test):
4324         * microbenchmarks/object-values.js: Added.
4325         (test):
4326         * stress/object-values-changing-properties.js: Added.
4327         (shouldBe):
4328         (throw.new.Error.let.source.get x):
4329         (throw.new.Error):
4330         (shouldBe.let.handler.get order):
4331         (get let):
4332         (shouldBe.let.handler.get return):
4333         (let.handler.get order):
4334
4335 2017-06-21  Saam Barati  <sbarati@apple.com>
4336
4337         eval virtual call is incorrect in the baseline JIT
4338         https://bugs.webkit.org/show_bug.cgi?id=173587
4339         <rdar://problem/32867897>
4340
4341         Reviewed by Michael Saboff.
4342
4343         * stress/do-eval-virtual-call-correctly.js: Added.
4344         (assert):
4345         (f):
4346         (i.test):
4347         (catch):
4348
4349 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
4350
4351         Update test262 test expectations after r218581.
4352
4353         Unreviewed test gardening.
4354
4355         * test262.yaml:
4356
4357 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
4358
4359         Revert changes in bug#160417 about extending `null` not being a derived class
4360         https://bugs.webkit.org/show_bug.cgi?id=169293
4361
4362         Reviewed by Saam Barati.
4363
4364         * stress/class-derived-from-null.js:
4365         (assertThrow):
4366         (test1):
4367         (test2):
4368         (test3):
4369         (test4):
4370         (test5):
4371         (test6):
4372
4373 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
4374
4375         [DFG] More ArrayIndexOf fixups for various types
4376         https://bugs.webkit.org/show_bug.cgi?id=173176
4377
4378         Reviewed by Saam Barati.
4379
4380         * stress/array-indexof-arraystorage.js: Added.
4381         (shouldBe):
4382         (indexOfInt32Other):
4383         (indexOfInt32Cell):
4384         (indexOfInt32Boolean):
4385         (indexOfDoubleOther):
4386         (indexOfDoubleCell):
4387         (indexOfDoubleBoolean):
4388         (indexOfInt32):
4389         (indexOfDouble):
4390         * stress/array-indexof-constant-folding.js: Added.
4391         (shouldBe):
4392         (indexOfInt32Other):
4393         (indexOfInt32Cell):
4394         (indexOfInt32Boolean):
4395         (indexOfDoubleOther):
4396         (indexOfDoubleCell):
4397         (indexOfDoubleBoolean):
4398         * stress/array-indexof-hole-and-other.js: Added.
4399         (shouldBe):
4400         (indexOf):
4401         * stress/array-indexof-other.js: Added.
4402         (shouldBe):
4403         (indexOfInt32):
4404         (indexOfDouble):
4405         (indexOfString):
4406         (indexOfObject):
4407         * stress/array-indexof-symbol.js: Added.
4408         (shouldBe):
4409         (indexOfInt32):
4410         (indexOfDouble):
4411         (indexOfString):
4412         (indexOfObject):
4413
4414 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
4415
4416         test262: Completion values for control flow do not match the spec
4417         https://bugs.webkit.org/show_bug.cgi?id=171265
4418
4419         Reviewed by Saam Barati.
4420
4421         * stress/completion-value.js:
4422         Condensed test for completion values in top level statements.
4423
4424         * stress/super-get-by-id.js:
4425         ClassDeclaration when evaled no longer produce values. Convert
4426         these to ClassExpressions so they produce the class value.
4427         
4428         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
4429         This is a progression for currect spec behavior.
4430
4431         * mozilla/mozilla-tests.yaml:
4432         This test is now outdated, so mark it as failing for that reason.
4433
4434         * test262.yaml:
4435         Passing all "cptn" completion value tests.
4436
4437 2017-06-17  Keith Miller  <keith_miller@apple.com>
4438
4439         ArrayBuffer constructor needs to create subclass structures before its buffer
4440         https://bugs.webkit.org/show_bug.cgi?id=173510
4441
4442         Reviewed by Yusuke Suzuki.
4443
4444         * test262.yaml:
4445
4446 2017-06-17  Keith Miller  <keith_miller@apple.com>
4447
4448         ArrayPrototype me