WebAssembly: JSC::link* shouldn't need a CodeBlock
[WebKit-https.git] / JSTests / ChangeLog
1 2016-12-08  JF Bastien  <jfbastien@apple.com>
2
3         WebAssembly: JSC::link* shouldn't need a CodeBlock
4         https://bugs.webkit.org/show_bug.cgi?id=165591
5
6         Reviewed by Keith Miller.
7
8         test that wasm -> JS works, including the IC
9
10         * wasm/js-api/test_Instance.js:
11         (const.wasmModuleWhichImportJS):
12         (MonomorphicImport):
13         (Polyphic2Import):
14         (Polyphic3Import):
15         (VirtualImport):
16
17 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
18
19         Green the cloop bot by raising this threshold.
20
21         * mozilla/js1_5/Array/regress-101964.js:
22
23 2016-12-08  JF Bastien  <jfbastien@apple.com>
24
25         WebAssembly JS API: wire up Instance imports
26         https://bugs.webkit.org/show_bug.cgi?id=165118
27
28         Reviewed by Saam Barati.
29
30         * wasm/js-api/test_Instance.js: add the test, disabled for now
31
32 2016-12-07  Keith Miller  <keith_miller@apple.com>
33
34         Add more missing trivial wasm ops.
35         https://bugs.webkit.org/show_bug.cgi?id=165564
36
37         Add tests for drop and tee_local.
38
39         Reviewed by Geoffrey Garen.
40
41         * wasm/function-tests/drop.js: Added.
42         * wasm/function-tests/nop.js: Added.
43         * wasm/function-tests/tee-local.js: Added.
44
45 2016-12-06  Keith Miller  <keith_miller@apple.com>
46
47         Add support for truncation operators
48         https://bugs.webkit.org/show_bug.cgi?id=165519
49
50         Reviewed by Geoffrey Garen.
51
52         * wasm/function-tests/i32-trunc-s-f32.js: Added.
53         * wasm/function-tests/i32-trunc-s-f64.js: Added.
54         * wasm/function-tests/i32-trunc-u-f32.js: Added.
55         * wasm/function-tests/i32-trunc-u-f64.js: Added.
56         * wasm/function-tests/i64-trunc-s-f32.js: Added.
57         * wasm/function-tests/i64-trunc-s-f64.js: Added.
58         * wasm/function-tests/i64-trunc-u-f32.js: Added.
59         * wasm/function-tests/i64-trunc-u-f64.js: Added.
60
61 2016-12-06  Mark Lam  <mark.lam@apple.com>
62
63         Introduce the concept of Immutable Prototype Exotic Objects to comply with the spec.
64         https://bugs.webkit.org/show_bug.cgi?id=165227
65         <rdar://problem/29442665>
66
67         Reviewed by Saam Barati.
68
69         * stress/get-from-scope-dynamic-onto-proxy.js:
70         - Updated error message.
71
72         * stress/proxy-dont-infinite-loop.js: Removed.
73         * stress/proxy-json-path.js: Removed.
74         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Removed.
75         - Removed these tests because the issue they are testing relies on being able to
76           set Object.prototype.__proto__ to something else (which is now not possible).
77
78 2016-12-05  Caitlin Potter  <caitp@igalia.com>
79
80         [JSC] report unexpected token when "async" is followed by identifier 
81         https://bugs.webkit.org/show_bug.cgi?id=165091
82
83         Reviewed by Mark Lam.
84
85         * stress/bug-165091.js:
86
87 2016-12-05  Keith Miller  <keith_miller@apple.com>
88
89         Add Wasm i64 to i32 conversion.
90         https://bugs.webkit.org/show_bug.cgi?id=165378
91
92         Reviewed by Filip Pizlo.
93
94         It turns out the wrap operation is just B3's Trunc.
95
96         * wasm/wasm.json:
97
98 2016-12-04  Keith Miller  <keith_miller@apple.com>
99
100         Add support for Wasm ctz and popcnt
101         https://bugs.webkit.org/show_bug.cgi?id=165369
102
103         Reviewed by Saam Barati.
104
105         * wasm/function-tests/ctz.js: Added.
106         * wasm/function-tests/popcnt.js: Added.
107
108 2016-12-03  JF Bastien  <jfbastien@apple.com>
109
110         WebAssembly: update binary format to 0xD version
111         https://bugs.webkit.org/show_bug.cgi?id=165345
112
113         Reviewed by Keith Miller.
114
115         As described in the following PR: https://github.com/WebAssembly/design/pull/836
116         Originally committed in r209175, reverted in r209242, and fixed in r209284.
117
118         * wasm/Builder.js:
119         (const._normalizeFunctionSignature):
120         * wasm/Builder_WebAssemblyBinary.js:
121         (const.emitters.Type):
122         (const.emitters.Code):
123         * wasm/LowLevelBinary.js:
124         (export.default.LowLevelBinary.prototype.block_type):
125         (export.default.LowLevelBinary.prototype.inline_signature_type): Deleted.
126         * wasm/WASM.js:
127         * wasm/js-api/test_basic_api.js:
128         * wasm/self-test/test_BuilderWebAssembly.js:
129         (EmptyModule):
130         (CustomSection):
131         * wasm/self-test/test_WASM.js:
132         * wasm/wasm.json:
133
134 2016-12-02  Keith Miller  <keith_miller@apple.com>
135
136         Add Wasm copysign
137         https://bugs.webkit.org/show_bug.cgi?id=165355
138
139         Reviewed by Filip Pizlo.
140
141         * wasm/function-tests/copysign.js: Added.
142
143 2016-12-03  Commit Queue  <commit-queue@webkit.org>
144
145         Unreviewed, rolling out r209298.
146         https://bugs.webkit.org/show_bug.cgi?id=165359
147
148         broke the build (Requested by smfr on #webkit).
149
150         Reverted changeset:
151
152         "Add Wasm copysign"
153         https://bugs.webkit.org/show_bug.cgi?id=165355
154         http://trac.webkit.org/changeset/209298
155
156 2016-12-02  Keith Miller  <keith_miller@apple.com>
157
158         Add Wasm copysign
159         https://bugs.webkit.org/show_bug.cgi?id=165355
160
161         Reviewed by Filip Pizlo.
162
163         * wasm/function-tests/copysign.js: Added.
164
165 2016-12-02  Keith Miller  <keith_miller@apple.com>
166
167         Unreviewed, fix git having a breakdown over trying to reland a rollout.
168
169 2016-12-02  Keith Miller  <keith_miller@apple.com>
170
171         Add Wasm floating point nearest and trunc
172         https://bugs.webkit.org/show_bug.cgi?id=165339
173
174         Reviewed by Saam Barati.
175
176         * wasm/function-tests/nearest.js: Added.
177         * wasm/function-tests/trunc.js: Added.
178
179 2016-12-02  Caitlin Potter  <caitp@igalia.com>
180
181 [JSC] add additional bit to JSTokenType bitfield
182         https://bugs.webkit.org/show_bug.cgi?id=165091
183
184         Reviewed by Geoffrey Garen.
185
186         * stress/bug-165091.js: Added.
187         (shouldThrowSyntaxError):
188
189 2016-12-02  Commit Queue  <commit-queue@webkit.org>
190
191         Unreviewed, rolling out r209275 and r209276.
192         https://bugs.webkit.org/show_bug.cgi?id=165348
193
194         "broke the arm build" (Requested by keith_miller on #webkit).
195
196         Reverted changesets:
197
198         "Add Wasm floating point nearest and trunc"
199         https://bugs.webkit.org/show_bug.cgi?id=165339
200         http://trac.webkit.org/changeset/209275
201
202         "Unreviewed, forgot to change instruction after renaming."
203         http://trac.webkit.org/changeset/209276
204
205 2016-12-02  Keith Miller  <keith_miller@apple.com>
206
207         Add Wasm floating point nearest and trunc
208         https://bugs.webkit.org/show_bug.cgi?id=165339
209
210         Reviewed by Filip Pizlo.
211
212         * wasm/function-tests/nearest.js: Added.
213         * wasm/function-tests/trunc.js: Added.
214
215 2016-12-02  JF Bastien  <jfbastien@apple.com>
216
217         WebAssembly: revert patch causing odd breakage
218         https://bugs.webkit.org/show_bug.cgi?id=165308
219
220         Unreviewed.
221
222         Bug #164724 seems to cause build issues which I haven't tracked down yet. WasmOps.h can't be found:
223         ./Source/JavaScriptCore/wasm/WasmFormat.h:34:10: fatal error: 'WasmOps.h' file not found
224
225         It's weird since the file is auto-generated and has been for a while. #164724 merely includes it in WasmFormat.h.
226
227         * wasm/Builder.js:
228         (const._normalizeFunctionSignature):
229         * wasm/Builder_WebAssemblyBinary.js:
230         (const.emitters.Type):
231         (const.emitters.Code):
232         * wasm/LowLevelBinary.js:
233         (export.default.LowLevelBinary.prototype.inline_signature_type):
234         (export.default.LowLevelBinary.prototype.block_type): Deleted.
235         * wasm/WASM.js:
236         * wasm/js-api/test_basic_api.js:
237         * wasm/self-test/test_BuilderWebAssembly.js:
238         (EmptyModule):
239         (CustomSection):
240         * wasm/self-test/test_WASM.js:
241         * wasm/wasm.json:
242
243 2016-12-01  Ryan Haddad  <ryanhaddad@apple.com>
244
245         Skip flaky test ChakraCore/test/fieldopts/objtypespec-newobj-invalidation.1.js
246         https://bugs.webkit.org/show_bug.cgi?id=162567
247
248         Reviewed by Saam Barati.
249
250         * ChakraCore.yaml:
251
252 2016-12-01  Keith Miller  <keith_miller@apple.com>
253
254         Add wasm int to floating point opcodes
255         https://bugs.webkit.org/show_bug.cgi?id=165252
256
257         Reviewed by Geoffrey Garen.
258
259         Add tests for Wasm integral to floating point conversion opcodes.
260
261         * wasm/function-tests/int-to-floating-point.js: Added.
262         * wasm/wasm.json:
263
264 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
265
266         Land a test case for <rdar://problem/27889416>
267         https://bugs.webkit.org/show_bug.cgi?id=165272
268
269         Reviewed by Saam Barati.
270
271         * stress/marked-argument-buffer.js: Added.
272         (allocate):
273         (test.o.toString):
274         (test):
275
276 2016-11-29  Per Arne Vollan  <pvollan@apple.com>
277
278         [Win] Skip failing JSC tests.
279         https://bugs.webkit.org/show_bug.cgi?id=165140
280
281         Reviewed by Mark Lam.
282
283         * ChakraCore.yaml:
284         * microbenchmarks/tan.js:
285
286 2016-11-30  JF Bastien  <jfbastien@apple.com>
287
288         WebAssembly builder: don't throw when checker not implemented
289         https://bugs.webkit.org/show_bug.cgi?id=165219
290
291         Reviewed by Mark Lam.
292
293         We should perform whichever checks we've implemented, and assume the rest are OK until bug #163421 is fixed.
294
295         * wasm/Builder.js:
296         * wasm/README.md:
297         * wasm/function-tests/add-12.js:
298         * wasm/function-tests/br-if-loop-less-than.js:
299         * wasm/function-tests/brTableAsIf.js:
300         * wasm/function-tests/brTableManyValues.js:
301         * wasm/function-tests/brTableWithLoop.js:
302         * wasm/function-tests/dumb-eq-if-then-else.js:
303         * wasm/function-tests/dumb-less-than-fallthrough.js:
304         * wasm/function-tests/dumb-less-than-ite.js:
305         * wasm/function-tests/eqz.js:
306         * wasm/function-tests/factorial.js:
307         * wasm/function-tests/float-sub.js:
308         * wasm/function-tests/i32-load.js:
309         * wasm/function-tests/i32-load8-s.js:
310         * wasm/function-tests/if-then-else-fallthrough.js:
311         * wasm/function-tests/if-then-fallthrough.js:
312         * wasm/function-tests/loop-mult.js:
313         * wasm/function-tests/loop-sum.js:
314         * wasm/function-tests/max.js:
315         * wasm/function-tests/min.js:
316         * wasm/function-tests/ret5.js:
317         * wasm/function-tests/select.js:
318         * wasm/self-test/test_BuilderJSON.js:
319
320 2016-11-29  JF Bastien  <jfbastien@apple.com>
321
322         WebAssembly JS API: improve Instance
323         https://bugs.webkit.org/show_bug.cgi?id=164757
324
325         Reviewed by Keith Miller.
326
327         An Instance's `exports` property wasn't populated with exports.
328
329         A follow-up patch will do imports.
330
331         A few things of note:
332
333          - LowLevelBinary: support 3-byte integers.
334          - LowLevelBinary: support proper UTF-8 2003 code points (instead of UTF-16).
335
336         * wasm/Builder.js:
337         * wasm/Builder_WebAssemblyBinary.js: wire up exports, stub other things out some more
338         (const.emitters.Export):
339         * wasm/LowLevelBinary.js:
340         (export.default.LowLevelBinary.prototype.uint24): add, used for UTF-8
341         (export.default.LowLevelBinary.prototype.string): support UTF-8
342         (export.default.LowLevelBinary.prototype.getUint24): add, used for UTF-8
343         (export.default.LowLevelBinary.prototype.getVaruint1): was missing
344         (export.default.LowLevelBinary.prototype.getString): support UTF-8
345         (export.default.LowLevelBinary):
346         * wasm/js-api/test_Instance.js: instance.exports.answer() // <-- this is where the magic of this entire patch is
347         (ExportedAnswerI32):
348         * wasm/js-api/test_basic_api.js: punt test to later
349         (const.c.in.constructorProperties.switch):
350         * wasm/self-test/test_BuilderWebAssembly.js: UTF-8
351         (CustomSection):
352         * wasm/self-test/test_LowLevelBinary_string.js: UTF-8 now works
353         * wasm/self-test/test_LowLevelBinary_uint16.js: was missing one value
354         * wasm/self-test/test_LowLevelBinary_uint24.js: Copied from JSTests/wasm/self-test/test_LowLevelBinary_uint8.js.
355         * wasm/self-test/test_LowLevelBinary_uint8.js: was missing one value
356         * wasm/self-test/test_LowLevelBinary_varuint1.js: Added.
357         * wasm/utilities.js: this `dump` thing was useful
358         (const._dump):
359
360 2016-11-29  Saam Barati  <sbarati@apple.com>
361
362         We should be able optimize the pattern where we spread a function's rest parameter to another call
363         https://bugs.webkit.org/show_bug.cgi?id=163865
364
365         Reviewed by Filip Pizlo.
366
367         * microbenchmarks/default-derived-constructor.js: Added.
368         (createClassHierarchy.let.currentClass):
369         (createClassHierarchy):
370         * stress/call-varargs-spread.js: Added.
371         (assert):
372         (bar):
373         (foo):
374         * stress/load-varargs-on-new-array-with-spread-convert-to-static-loads.js: Added.
375         (assert):
376         (baz):
377         (bar):
378         (foo):
379         * stress/new-array-with-spread-with-normal-spread-and-phantom-spread.js: Added.
380         (assert):
381         (foo):
382         (escape):
383         (bar):
384         * stress/phantom-new-array-with-spread-osr-exit.js: Added.
385         (assert):
386         (baz):
387         (bar):
388         (effects):
389         (foo):
390         * stress/phantom-spread-forward-varargs.js: Added.
391         (assert):
392         (test1.bar):
393         (test1.foo):
394         (test1):
395         (test2.bar):
396         (test2.foo):
397         (test3.baz):
398         (test3.bar):
399         (test3.foo):
400         (test4.baz):
401         (test4.bar):
402         (test4.foo):
403         (test5.baz):
404         (test5.bar):
405         (test5.foo):
406         * stress/phantom-spread-osr-exit.js: Added.
407         (assert):
408         (baz):
409         (bar):
410         (effects):
411         (foo):
412         * stress/spread-call-convert-to-static-call.js: Added.
413         (assert):
414         (baz):
415         (bar):
416         (foo):
417         * stress/spread-forward-call-varargs-stack-overflow.js: Added.
418         (assert):
419         (identity):
420         (bar):
421         (foo):
422         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol-2.js: Added.
423         (assert):
424         (baz.Array.prototype.Symbol.iterator):
425         (baz):
426         (bar):
427         (foo):
428         (test):
429         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol.js: Added.
430         (assert):
431         (baz.Array.prototype.Symbol.iterator):
432         (baz):
433         (bar):
434         (foo):
435         * stress/spread-forward-varargs-stack-overflow.js: Added.
436         (assert):
437         (bar):
438         (foo):
439
440 2016-11-29  Caitlin Potter  <caitp@igalia.com>
441
442         [JSC] always wrap AwaitExpression operand in a new Promise
443         https://bugs.webkit.org/show_bug.cgi?id=165181
444
445         Reviewed by Yusuke Suzuki.
446
447         * stress/async-await-basic.js:
448         (async.awaitedPromisesAreWrapped):
449
450 2016-11-29  Keith Miller  <keith_miller@apple.com>
451
452         Add simple way to implement Wasm ops that require more than one B3 opcode
453         https://bugs.webkit.org/show_bug.cgi?id=165129
454
455         Reviewed by Geoffrey Garen.
456
457         * wasm/function-tests/eqz.js: Added.
458         * wasm/function-tests/max.js: Added.
459         * wasm/function-tests/min.js: Added.
460         * wasm/wasm.json:
461
462 2016-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
463
464         Crash in com.apple.JavaScriptCore: WTF::ThreadSpecific<WTF::WTFThreadData, + 142
465         https://bugs.webkit.org/show_bug.cgi?id=164898
466
467         Reviewed by Darin Adler.
468
469         * stress/tagged-template-registry-key-collect.js: Added.
470         (shouldBe):
471         (tag):
472         (i.eval):
473         * stress/tagged-template-registry-key.js: Added.
474         (shouldBe):
475         (tag):
476         (a):
477         (b):
478
479 2016-11-20  Caitlin Potter  <caitp@igalia.com>
480
481         [JSC] speed up parsing of async functions
482         https://bugs.webkit.org/show_bug.cgi?id=164808
483
484         Reviewed by Yusuke Suzuki.
485
486         Add tests for line terminator following "async" keyword in async
487         function syntax.
488
489         * stress/async-await-syntax.js:
490         (shouldBe):
491
492 2016-11-19  Mark Lam  <mark.lam@apple.com>
493
494         op_mod-* JSC tests needs a longer timeout too.
495         https://bugs.webkit.org/show_bug.cgi?id=164994
496
497         Reviewed by Yusuke Suzuki.
498
499         * stress/op_mod-ConstVar.js:
500         * stress/op_mod-VarConst.js:
501         * stress/op_mod-VarVar.js:
502
503 2016-11-19  Mark Lam  <mark.lam@apple.com>
504
505         Add --timeoutMultiplier option to allow some tests more time to run.
506         https://bugs.webkit.org/show_bug.cgi?id=164951
507
508         Reviewed by Yusuke Suzuki.
509
510         Extended the timeout for these tests by 50% more because they run quite slow on
511         low-end machines.
512
513         * stress/op_div-ConstVar.js:
514         * stress/op_div-VarConst.js:
515         * stress/op_div-VarVar.js:
516
517 2016-11-18  Yusuke Suzuki  <utatane.tea@gmail.com>
518
519         REGRESSION(r208867): JSC test failure: ChakraCore.yaml/ChakraCore/test/strict/05.arguments_sm.js.default
520         https://bugs.webkit.org/show_bug.cgi?id=164929
521
522         Reviewed by Mark Lam.
523
524         ES2017 drops arguments.caller and JavaScriptCore is updated to meet the spec.
525         This patch rebaselines the result of ChakraCore test for JSC.
526
527         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
528
529 2016-11-18  Joseph Pecoraro  <pecoraro@apple.com>
530
531         Web Inspector: Generator functions should have a displayable name when shown in stack traces
532         https://bugs.webkit.org/show_bug.cgi?id=164844
533         <rdar://problem/29300697>
534
535         Reviewed by Yusuke Suzuki.
536
537         * stress/generator-function-name.js:
538         Add another test now that we name the inner generator function
539         that we do not break the lexical resolution of names.
540
541 2016-11-17  Yusuke Suzuki  <utatane.tea@gmail.com>
542
543         [JSC] Drop arguments.caller
544         https://bugs.webkit.org/show_bug.cgi?id=164859
545
546         Reviewed by Saam Barati.
547
548         * stress/strict-mode-arguments-caller.js: Added.
549         (strictArguments):
550         (shouldBe):
551
552 2016-11-17  Keith Miller  <keith_miller@apple.com>
553
554         Add rotate to Wasm
555         https://bugs.webkit.org/show_bug.cgi?id=164871
556
557         Reviewed by Filip Pizlo.
558
559         * wasm/wasm.json:
560
561 2016-11-17  Keith Miller  <keith_miller@apple.com>
562
563         Add sqrt to Wasm
564         https://bugs.webkit.org/show_bug.cgi?id=164877
565
566         Reviewed by Mark Lam.
567
568         B3 already has a Sqrt opcode we just need to map Wasm to it.
569
570         * wasm/wasm.json:
571
572 2016-11-17  Saam Barati  <sbarati@apple.com>
573
574         Remove async/await compile time flag and enable tests
575         https://bugs.webkit.org/show_bug.cgi?id=164828
576         <rdar://problem/28639334>
577
578         Reviewed by Yusuke Suzuki.
579
580         * stress/async-arrow-functions-lexical-arguments-binding.js:
581         * stress/async-arrow-functions-lexical-new.target-binding.js:
582         * stress/async-arrow-functions-lexical-super-binding.js:
583         * stress/async-arrow-functions-lexical-this-binding.js:
584         * stress/async-await-basic.js:
585         * stress/async-await-long-loop.js:
586         * stress/async-await-module-reserved-word.js:
587         * stress/async-await-mozilla.js:
588         (mozSyntaxErrors):
589         * stress/async-await-reserved-word.js:
590         * stress/async-await-syntax.js:
591         * stress/async-await-throw-loop.js:
592         * stress/async-function-create-nobaseline.js:
593         * stress/async-function-create-optimized.js:
594         * stress/async-function-declaration-sinking-no-double-allocate.js:
595         * stress/async-function-declaration-sinking-osrexit.js:
596         * stress/async-function-declaration-sinking-put.js:
597         * stress/async-function-expression-sinking-no-double-allocate.js:
598         * stress/async-function-expression-sinking-osrexit.js:
599         * stress/async-function-expression-sinking-put.js:
600         * test262.yaml:
601
602 2016-11-15  Mark Lam  <mark.lam@apple.com>
603
604         Make JSC test functions more robust.
605         https://bugs.webkit.org/show_bug.cgi?id=164807
606
607         Reviewed by Keith Miller.
608
609         * stress/jsc-test-functions-should-be-more-robust.js: Added.
610
611 2016-11-15  Keith Miller  <keith_miller@apple.com>
612
613         B3 should support UDiv/UMod
614         https://bugs.webkit.org/show_bug.cgi?id=164811
615
616         Reviewed by Filip Pizlo.
617
618         Link new instructions to wasm.
619
620         * wasm/wasm.json:
621
622 2016-11-15  Saam Barati  <sbarati@apple.com>
623
624         Debug JSC test timeout: stress/has-own-property-name-cache-symbols-and-strings.js.ftl-no-cjit-small-pool
625         https://bugs.webkit.org/show_bug.cgi?id=163012
626
627         Unreviewed. This patch makes a test run for less time because it's timing out on the bots.
628
629         * stress/has-own-property-name-cache-symbols-and-strings.js:
630
631 2016-11-15  Mark Lam  <mark.lam@apple.com>
632
633         The jsc shell's setImpureGetterDelegate() should ensure that the set value is an ImpureGetter.
634         https://bugs.webkit.org/show_bug.cgi?id=164781
635         <rdar://problem/28418590>
636
637         Reviewed by Geoffrey Garen and Michael Saboff.
638
639         * stress/jsc-setImpureGetterDelegate-on-bad-type.js: Added.
640
641 2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
642
643         [DOMJIT] Allow using macro assembler scratches in FTL CheckDOM
644         https://bugs.webkit.org/show_bug.cgi?id=164727
645
646         Reviewed by Filip Pizlo.
647
648         * stress/check-dom-with-signature.js: Added.
649         (shouldBe):
650         (calling):
651         (i.array.forEach):
652
653 2016-11-14  Caitlin Potter  <caitp@igalia.com>
654
655         [JSC] do not reference AwaitExpression Promises in async function Promise chain
656         https://bugs.webkit.org/show_bug.cgi?id=164753
657
658         Reviewed by Yusuke Suzuki.
659
660         * asyncFunctionTests.yaml:
661         * stress/async-await-long-loop.js: Added.
662         (shouldBe):
663         (async.longLoop):
664         * stress/async-await-throw-loop.js: Added.
665         (shouldBe):
666         (async.thrower):
667         (async.throwLoop):
668
669 2016-11-14  Keith Miller  <keith_miller@apple.com>
670
671         Add Wasm select
672         https://bugs.webkit.org/show_bug.cgi?id=164743
673
674         Reviewed by Saam Barati.
675
676         * wasm/function-tests/select.js: Added.
677
678 2016-11-14  Caitlin Potter  <caitp@igalia.com>
679
680         [JSC] Handle new_async_func / new_async_func_exp in DFG / FTL
681         https://bugs.webkit.org/show_bug.cgi?id=164037
682
683         Reviewed by Yusuke Suzuki.
684
685         Add tests based on tests from https://trac.webkit.org/changeset/194216.
686
687         * asyncFunctionTests.yaml:
688         * stress/async-function-create-nobaseline.js: Added.
689         * stress/async-function-create-optimized.js: Added.
690         * stress/async-function-declaration-sinking-no-double-allocate.js: Added.
691         * stress/async-function-declaration-sinking-osrexit.js: Added.
692         * stress/async-function-declaration-sinking-put.js: Added.
693         * stress/async-function-expression-sinking-no-double-allocate.js: Added.
694         * stress/async-function-expression-sinking-osrexit.js: Added.
695         * stress/async-function-expression-sinking-put.js: Added.
696
697 2016-11-14  Mark Lam  <mark.lam@apple.com>
698
699         Some of JSStringView::SafeView methods are not idiomatically safe for JSString to StringView conversions.
700         https://bugs.webkit.org/show_bug.cgi?id=164701
701         <rdar://problem/27462104>
702
703         Reviewed by Darin Adler.
704
705         * stress/string-prototype-charCodeAt-on-too-long-rope.js: Added.
706
707 2016-11-14  Mark Lam  <mark.lam@apple.com>
708
709         RegExpObject::exec/match should handle errors gracefully.
710         https://bugs.webkit.org/show_bug.cgi?id=155145
711         <rdar://problem/27435934>
712
713         Reviewed by Keith Miller.
714
715         * stress/regexp-prototype-exec-on-too-long-rope.js: Added.
716         * stress/regexp-prototype-match-on-too-long-rope.js: Added.
717         * stress/regexp-prototype-test-on-too-long-rope.js: Added.
718
719 2016-11-14  Mark Lam  <mark.lam@apple.com>
720
721         Enhance run-jsc-stress-test script to allow optional test specific options to be added for all test run configurations.
722         https://bugs.webkit.org/show_bug.cgi?id=164695
723
724         Reviewed by Keith Miller.
725
726         Replace use of runMisc* test run configurations with equivalents.
727
728         * stress/licm-no-pre-header-nested.js:
729         * stress/licm-no-pre-header.js:
730         * stress/licm-pre-header-cannot-exit-nested.js:
731         * stress/licm-pre-header-cannot-exit.js:
732         * stress/make-dictionary-repatch.js:
733         * stress/retry-cache-later.js:
734         * stress/shadow-chicken-reading-from-scope-after-ftl-osr-exit-bytecode-liveness.js:
735         * stress/slow-path-generator-updating-current-node-dfg.js:
736         * stress/unshift-array-storage.js:
737
738 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
739
740         test262: DataView with explicit undefined byteLength should be the same as it not being present
741         https://bugs.webkit.org/show_bug.cgi?id=164453
742
743         Reviewed by Darin Adler.
744
745         * stress/dataview-construct.js: Added.
746         (assert):
747         (shouldThrow):
748         * test262.yaml:
749
750 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
751
752         test262: DataView get methods should allow for missing offset, set methods should allow for missing value
753         https://bugs.webkit.org/show_bug.cgi?id=164451
754
755         Reviewed by Darin Adler.
756
757         * test262.yaml:
758
759 2016-11-11  Saam Barati  <sbarati@apple.com>
760
761         We should have a more concise way of determining when we're varargs calling a function using rest parameters
762         https://bugs.webkit.org/show_bug.cgi?id=164258
763
764         Reviewed by Yusuke Suzuki.
765
766         * microbenchmarks/call-using-spread.js: Added.
767         (bar):
768         (foo):
769         * microbenchmarks/spread-large-array.js: Added.
770         (foo):
771         (arrays.push):
772         * microbenchmarks/spread-small-array.js: Added.
773         (foo):
774         * stress/spread-array-iterator-watchpoint-2.js: Added.
775         (foo):
776         (arrayIterator.next):
777         * stress/spread-array-iterator-watchpoint.js: Added.
778         (foo):
779         (Array.prototype.Symbol.iterator):
780         * stress/spread-non-array.js: Added.
781         (assert):
782         (foo):
783         (let.customIterator.Symbol.iterator):
784         (bar):
785
786 2016-11-11  Keith Miller  <keith_miller@apple.com>
787
788         Relocate wasm tests and actually add them to the test runner
789         https://bugs.webkit.org/show_bug.cgi?id=164668
790
791         Reviewed by Yusuke Suzuki.
792
793         This moves the Wasm tests from their current location down a level.
794         Without relocating, the tests cannot properly be run by the wasm test runner.
795
796         * wasm.yaml:
797         * wasm/Builder.js: Fix typos, yay lazy synatx checking!
798         * wasm/LowLevelBinary.js: Fix typos, yay lazy synatx checking!
799         (export.default.LowLevelBinary.prototype.get return):
800         * wasm/function-tests/add-12.js: Renamed from JSTests/wasm/js-api/function-tests/add-12.js.
801         * wasm/function-tests/br-if-loop-less-than.js: Renamed from JSTests/wasm/js-api/function-tests/br-if-loop-less-than.js.
802         * wasm/function-tests/brTableAsIf.js: Renamed from JSTests/wasm/js-api/function-tests/brTableAsIf.js.
803         * wasm/function-tests/brTableManyValues.js: Renamed from JSTests/wasm/js-api/function-tests/brTableManyValues.js.
804         * wasm/function-tests/brTableWithLoop.js: Renamed from JSTests/wasm/js-api/function-tests/brTableWithLoop.js.
805         * wasm/function-tests/dumb-eq-if-then-else.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-eq-if-then-else.js.
806         * wasm/function-tests/dumb-less-than-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-fallthrough.js.
807         * wasm/function-tests/dumb-less-than-ite.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-ite.js.
808         * wasm/function-tests/factorial.js: Renamed from JSTests/wasm/js-api/function-tests/factorial.js.
809         * wasm/function-tests/float-sub.js: Renamed from JSTests/wasm/js-api/function-tests/float-sub.js.
810         * wasm/function-tests/i32-load.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load.js.
811         * wasm/function-tests/i32-load8-s.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load8-s.js.
812         * wasm/function-tests/if-then-else-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-else-fallthrough.js.
813         * wasm/function-tests/if-then-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-fallthrough.js.
814         * wasm/function-tests/loop-mult.js: Renamed from JSTests/wasm/js-api/function-tests/loop-mult.js.
815         * wasm/function-tests/loop-sum.js: Renamed from JSTests/wasm/js-api/function-tests/loop-sum.js.
816         * wasm/function-tests/ret5.js: Renamed from JSTests/wasm/js-api/function-tests/ret5.js.
817         * wasm/self-test/test_BuilderJSON.js: Rebasline
818
819 2016-11-11  Keith Miller  <keith_miller@apple.com>
820
821         Move Wasm tests to JS
822         https://bugs.webkit.org/show_bug.cgi?id=164611
823
824         Reviewed by Geoffrey Garen.
825
826         This patch translates most of the tests from testWasm.cpp to the JS testing api. Most of the
827         ommited tests were earliest tests, which tested trivial things, like adding two
828         constants. Some tests are ommited for other reasons, however. These are:
829
830         1) Tests using I64 since the testing api does not yet know how to handle 64-bit numbers.  2)
831         Tests that would validate the memory of the module once wasm was done with it since that's
832         not really possible in JS.
833
834         In order to make such a translation easier this patch also adds some features to the JS
835         testing api:
836
837         1) Blocks can now be done lexically by adding a lambda as the last argument of the block
838         opcode. For example one can do:
839             ...
840             .Block("i32", b => b.I32Const(1) )
841
842         and the nested lambda will automatically have an end attached.
843
844         2) The JS testing api can now handle inline signature types.
845
846         3) Relocate some code to make it easier to follow and prevent 44 space indentation.
847
848         4) Rename varuint/varint to varuint32/varint32, this lets them be directly called from the
849         wasm.json without being remapped.
850
851         5) Add support for Memory and Function sections to the Builder.
852
853         6) Add support for local variables.
854
855         On the JSC side, we needed to expose a new function to validate the compiled wasm code
856         behaves the way we expect. At least until the JS Wasm API is finished. The new validation
857         function, testWasmModuleFunctions, takes an array buffer containing the wasm binary, the
858         number of functions in the blob and tests for each of those functions.
859
860         * wasm/Builder.js:
861         (const._maybeRegisterType):
862         (const): Deleted.
863         (switch.typeof): Deleted.
864         * wasm/Builder_WebAssemblyBinary.js:
865         (const.emitters.Type):
866         (const.emitters.Import):
867         (const.emitters.Function):
868         (const.emitters.Memory):
869         (const.emitters.Code):
870         (export.const.Binary):
871         * wasm/LowLevelBinary.js:
872         (export.default.LowLevelBinary.prototype.get return):
873         (export.default.LowLevelBinary.prototype.varuint32):
874         (export.default.LowLevelBinary.prototype.varint32):
875         (export.default.LowLevelBinary.prototype.varuint1):
876         (export.default.LowLevelBinary.prototype.varint7):
877         (export.default.LowLevelBinary.prototype.varuint7):
878         (export.default.LowLevelBinary.prototype.inline_signature_type):
879         (export.default.LowLevelBinary.prototype.string):
880         (export.default.LowLevelBinary.prototype.getVaruint32):
881         (export.default.LowLevelBinary.prototype.getVarint32):
882         (export.default.LowLevelBinary.prototype.getVaruint7):
883         (export.default.LowLevelBinary.prototype.getString):
884         (export.default.LowLevelBinary):
885         (export.default.LowLevelBinary.prototype.varuint): Deleted.
886         (export.default.LowLevelBinary.prototype.varint): Deleted.
887         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
888         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
889         * wasm/js-api/test_old_tests.js: Added.
890         (ret5):
891         (brTableWithLoop):
892         (brTableManyValues):
893         (run.brTableManyValues.brTableAsIf):
894         (ifThenFallthrough):
895         (ifThenElseFallthrough):
896         (dumbLessThanFallthrough):
897         (run.dumbLessThanFallthrough.floatSub):
898         (run.floatSub.add12):
899         (run.add12.factorial):
900         (i32load):
901         (run.i32load.i32load8s):
902         (run.i32load8s.dumbEqIfThenElse):
903         (run.dumbEqIfThenElse.dumbEqIfThenElse):
904         (run.dumbEqIfThenElse.dumbLessThanIfThenElse):
905         (run.dumbLessThanIfThenElse.loopSum):
906         (run.loopSum.loopMult):
907         (brIfLoopLessThan):
908         (run.brIfLoopLessThan.run):
909         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
910         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
911
912         * wasm/Builder.js:
913         (const._maybeRegisterType):
914         (const): Deleted.
915         (switch.typeof): Deleted.
916         * wasm/Builder_WebAssemblyBinary.js:
917         (const.emitters.Type):
918         (const.emitters.Import):
919         (const.emitters.Function):
920         (const.emitters.Memory):
921         (const.emitters.Code):
922         (export.const.Binary):
923         * wasm/LowLevelBinary.js:
924         (export.default.LowLevelBinary.prototype.get return):
925         (export.default.LowLevelBinary.prototype.varuint32):
926         (export.default.LowLevelBinary.prototype.varint32):
927         (export.default.LowLevelBinary.prototype.varuint1):
928         (export.default.LowLevelBinary.prototype.varint7):
929         (export.default.LowLevelBinary.prototype.varuint7):
930         (export.default.LowLevelBinary.prototype.inline_signature_type):
931         (export.default.LowLevelBinary.prototype.string):
932         (export.default.LowLevelBinary.prototype.getVaruint32):
933         (export.default.LowLevelBinary.prototype.getVarint32):
934         (export.default.LowLevelBinary.prototype.getVaruint7):
935         (export.default.LowLevelBinary.prototype.getString):
936         (export.default.LowLevelBinary):
937         (export.default.LowLevelBinary.prototype.varuint): Deleted.
938         (export.default.LowLevelBinary.prototype.varint): Deleted.
939         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
940         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
941         * wasm/js-api/function-tests/add-12.js: Added.
942         * wasm/js-api/function-tests/br-if-loop-less-than.js: Added.
943         * wasm/js-api/function-tests/brTableAsIf.js: Added.
944         * wasm/js-api/function-tests/brTableManyValues.js: Added.
945         * wasm/js-api/function-tests/brTableWithLoop.js: Added.
946         * wasm/js-api/function-tests/dumb-eq-if-then-else.js: Added.
947         * wasm/js-api/function-tests/dumb-less-than-fallthrough.js: Added.
948         * wasm/js-api/function-tests/dumb-less-than-ite.js: Added.
949         * wasm/js-api/function-tests/factorial.js: Added.
950         * wasm/js-api/function-tests/float-sub.js: Added.
951         * wasm/js-api/function-tests/i32-load.js: Added.
952         * wasm/js-api/function-tests/i32-load8-s.js: Added.
953         * wasm/js-api/function-tests/if-then-else-fallthrough.js: Added.
954         * wasm/js-api/function-tests/if-then-fallthrough.js: Added.
955         * wasm/js-api/function-tests/loop-mult.js: Added.
956         * wasm/js-api/function-tests/loop-sum.js: Added.
957         * wasm/js-api/function-tests/ret5.js: Added.
958         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
959         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
960
961 2016-11-11  Saam Barati  <sbarati@apple.com>
962
963         We recursively grab a lock in the DFGBytecodeParser causing us to deadlock
964         https://bugs.webkit.org/show_bug.cgi?id=164650
965
966         Reviewed by Geoffrey Garen.
967
968         * stress/dont-dead-lock-put-by-val-as-put-by-id.js: Added.
969         (ident):
970         (let.o.set foo):
971         (foo):
972
973 2016-11-11  Chris Dumez  <cdumez@apple.com>
974
975         Unreviewed, rolling out r208584.
976
977         Seems to have regressed Speedometer by 1% on Mac
978
979         Reverted changeset:
980
981         "We should have a more concise way of determining when we're
982         varargs calling a function using rest parameters"
983         https://bugs.webkit.org/show_bug.cgi?id=164258
984         http://trac.webkit.org/changeset/208584
985
986 2016-11-11  Chris Dumez  <cdumez@apple.com>
987
988         Unreviewed, rolling out r208117 and r208160.
989
990         Regressed Speedometer by >1.5%
991
992         Reverted changesets:
993
994         "We should have a way of profiling when a get_by_id is pure
995         and to emit a PureGetById in the DFG/FTL"
996         https://bugs.webkit.org/show_bug.cgi?id=163305
997         http://trac.webkit.org/changeset/208117
998
999         "Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing
1000         out"
1001         https://bugs.webkit.org/show_bug.cgi?id=164227
1002         http://trac.webkit.org/changeset/208160
1003
1004 2016-11-11  Saam Barati  <sbarati@apple.com>
1005
1006         We should have a more concise way of determining when we're varargs calling a function using rest parameters
1007         https://bugs.webkit.org/show_bug.cgi?id=164258
1008
1009         Reviewed by Yusuke Suzuki.
1010
1011         * microbenchmarks/call-using-spread.js: Added.
1012         (bar):
1013         (foo):
1014         * microbenchmarks/spread-large-array.js: Added.
1015         (foo):
1016         (arrays.push):
1017         * microbenchmarks/spread-small-array.js: Added.
1018         (foo):
1019         * stress/spread-array-iterator-watchpoint-2.js: Added.
1020         (foo):
1021         (arrayIterator.next):
1022         * stress/spread-array-iterator-watchpoint.js: Added.
1023         (foo):
1024         (Array.prototype.Symbol.iterator):
1025         * stress/spread-non-array.js: Added.
1026         (assert):
1027         (foo):
1028         (let.customIterator.Symbol.iterator):
1029         (bar):
1030
1031 2016-11-10  Mark Lam  <mark.lam@apple.com>
1032
1033         Fix broken have-a-bad-time-with-arguments.js test.
1034         https://bugs.webkit.org/show_bug.cgi?id=164626
1035
1036         Reviewed by Filip Pizlo.
1037
1038         But also saved a copy of the broken one as broken-have-a-bad-time-with-arguments-for-gc-testing.js
1039         because coincidentally, it stresses the GC in ways that help reveal bugs.
1040
1041         * stress/broken-have-a-bad-time-with-arguments-for-gc-testing.js: Added.
1042         (testFunction):
1043         (warmupFunction):
1044         (let.argsDeclIndex.in.argumentsDecls.let.indexToReturnIndex.in.indicesToReturn.let.insertElementActionIndex.in.insertElementActions.let.tierWarmupCountIndex.in.tierWarmupCounts.let.testArgsIndex.in.testArgsList.catch):
1045         * stress/have-a-bad-time-with-arguments.js:
1046
1047 2016-11-10  JF Bastien  <jfbastien@apple.com>
1048
1049         ASSERTION FAILED: length > offset encountered with wasm.yaml/wasm/js-api/test_Module.js.default-wasm
1050         https://bugs.webkit.org/show_bug.cgi?id=164597
1051
1052         Reviewed by Keith Miller.
1053
1054         Trim the array buffer before returning it: it's optimistically
1055         over-allocated to avoid growing all the time, but when parsed it
1056         can't have extra content.
1057
1058         * wasm/Builder_WebAssemblyBinary.js:
1059         (export.const.Binary):
1060         * wasm/LowLevelBinary.js:
1061         (export.default.LowLevelBinary.prototype.get return):
1062
1063 2016-11-10  Joseph Pecoraro  <pecoraro@apple.com>
1064
1065         test262: DataView / TypedArray methods should throw RangeErrors for negative numbers (ToIndex)
1066         https://bugs.webkit.org/show_bug.cgi?id=164450
1067
1068         Reviewed by Darin Adler.
1069
1070         * stress/dataview-typedarray-toindex.js: Added.
1071         Tests for all cases where ToIndex should be used.
1072
1073         * test262.yaml:
1074         New passing tests.
1075
1076 2016-11-10  Mark Lam  <mark.lam@apple.com>
1077
1078         Graph::methodOfGettingAValueProfileFor() should be returning the profile for the operand node.
1079         https://bugs.webkit.org/show_bug.cgi?id=164600
1080         <rdar://problem/28828676>
1081
1082         Reviewed by Filip Pizlo.
1083
1084         * stress/osr-exit-on-op-negate-should-no-fail-assertions.js: Added.
1085
1086 2016-11-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1087
1088         [JSC] Avoid cloned arguments allocation in ArrayPrototype methods
1089         https://bugs.webkit.org/show_bug.cgi?id=164502
1090
1091         Reviewed by Saam Barati.
1092
1093         * stress/argument-intrinsic-basic.js: Added.
1094         (shouldBe):
1095         (builtin.createBuiltin):
1096         * stress/argument-intrinsic-inlining-with-result-escape.js: Added.
1097         (shouldBe):
1098         (builtin.createBuiltin):
1099         (escape):
1100         * stress/argument-intrinsic-nested-inlining.js: Added.
1101         (shouldBe):
1102         (builtin.createBuiltin):
1103         (builtinCaller1):
1104         (builtinCaller2):
1105         (escape):
1106         * stress/argument-intrinsic-not-convert-to-get-argument.js: Added.
1107         (shouldBe):
1108         (builtin.createBuiltin):
1109         * stress/argument-intrinsic-with-stack-write.js: Added.
1110         (shouldBe):
1111         (builtin.createBuiltin):
1112
1113 2016-11-09  Saam Barati  <sbarati@apple.com>
1114
1115         Math.min()/Math.max() with no arguments is lowered incorrectly in the BytecodeParser
1116         https://bugs.webkit.org/show_bug.cgi?id=164464
1117         <rdar://problem/29131452>
1118
1119         Reviewed by Darin Adler.
1120
1121         * stress/math-max-min-no-arguments.js: Added.
1122         (assert):
1123         (min):
1124         (max):
1125         (test):
1126
1127 2016-11-09  Saam Barati  <sbarati@apple.com>
1128
1129         TypeProfiler and running GC collection on another thread don't play nicely with each other
1130         https://bugs.webkit.org/show_bug.cgi?id=164441
1131         <rdar://problem/29132174>
1132
1133         Reviewed by Geoffrey Garen.
1134
1135         * typeProfiler/type-profiler-gc.js: Added.
1136         (bar):
1137         (foo):
1138
1139 2016-11-04  Mark Lam  <mark.lam@apple.com>
1140
1141         Error description code should be able to handle Symbol values.
1142         https://bugs.webkit.org/show_bug.cgi?id=164436
1143         <rdar://problem/29115583>
1144
1145         Reviewed by Filip Pizlo and Saam Barati.
1146
1147         * stress/error-description-on-symbols-should-not-crash.js: Added.
1148
1149 2016-11-03  Geoffrey Garen  <ggaren@apple.com>
1150
1151         EvalCodeCache should not give up in strict mode and other cases
1152         https://bugs.webkit.org/show_bug.cgi?id=164357
1153
1154         Reviewed by Michael Saboff.
1155
1156         * microbenchmarks/eval-cached.js: Added. 45x faster now.
1157         * stress/eval-cached.js: Added. Try running the same eval text in a bunch
1158         of different scopes and verify that we access the right scope.
1159
1160 2016-11-04  JF Bastien  <jfbastien@apple.com>
1161
1162         WebAssembly JS API: implement more sections
1163         https://bugs.webkit.org/show_bug.cgi?id=164023
1164
1165         Reviewed by Keith Miller.
1166
1167         On the JSC side:
1168
1169          - Put in parser stubs for all WebAssembly sections.
1170          - Parse Import, Export sections.
1171          - Use tryReserveCapacity instead of reserve, and bail out of the parser if it fails. This prevents the parser from bringing everything down when faced with a malicious input.
1172          - Encapsulate all parsed module information into its own structure, making it easier to pass around (from parser to Plan to Module to Instance).
1173          - Create WasmFormat.cpp to hold parsed module information's dtor to avoid including WasmMemory.h needlessly.
1174          - parseCode: avoid overflow through function size.
1175          - Remove all remainders of polyfill-prototype-1, and update license.
1176          - Add missing WasmOps.h and WasmValidateInlines.h auto-generation for cmake build.
1177
1178         On the Builder.js testing side:
1179
1180          - Implement Type, Import (function only), Export (function only) sections.
1181          - Check section order and uniqueness.
1182          - Optionally auto-generate the Type section from subsequent Export / Import / Code entries.
1183          - Allow re-exporting an import.
1184
1185         * wasm/Builder.js: build type, import, and export sections
1186         (const._normalizeFunctionSignature):
1187         * wasm/Builder_WebAssemblyBinary.js: Added. Forked from Builder.js
1188         (const.emitters.Type):
1189         (const.emitters.Import):
1190         (const.emitters.Function):
1191         (const.emitters.Table):
1192         (const.emitters.Memory):
1193         (const.emitters.Global):
1194         (const.emitters.Export):
1195         (const.emitters.Start):
1196         (const.emitters.Element):
1197         (const.emitters.Code):
1198         (const.emitters.Data):
1199         (export.const.Binary):
1200         * wasm/LowLevelBinary.js: Add a few useful outputs
1201         (export.default.LowLevelBinary.prototype.varuint1):
1202         (export.default.LowLevelBinary.prototype.varint7):
1203         * wasm/WASM.js: value type and external kind helpers
1204         * wasm/assert.js: array element-wise equality comparison
1205         (const._eq):
1206         * wasm/js-api/test_Module.js:
1207         (ModuleWithImports):
1208         * wasm/self-test/test_BuilderJSON.js: many more tests for all the new Builder APIs, and update to some older tests which now require a Type section or rejiggered Function signature
1209         (const.assertOpThrows):
1210         (SectionsWithSameCustomName):
1211         (TwoTypeSections):
1212         (EmptyImportSection):
1213         (ImportBeforeTypeSections):
1214         * wasm/self-test/test_BuilderWebAssembly.js: remove a test which wasn't helpful and is now obsolete
1215         (CustomSection):
1216
1217 2016-11-03  Mark Lam  <mark.lam@apple.com>
1218
1219         ClonedArguments need to also support haveABadTime mode.
1220         https://bugs.webkit.org/show_bug.cgi?id=164200
1221         <rdar://problem/27211336>
1222
1223         Reviewed by Geoffrey Garen.
1224
1225         * stress/have-a-bad-time-with-arguments.js: Added.
1226
1227 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
1228
1229         DFG plays fast and loose with the shadow values of a Phi
1230         https://bugs.webkit.org/show_bug.cgi?id=164309
1231
1232         Reviewed by Saam Barati.
1233         
1234         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
1235
1236         * stress/dfg-ssa-swap.js: Added.
1237         (foo):
1238
1239 2016-11-03  Commit Queue  <commit-queue@webkit.org>
1240
1241         Unreviewed, rolling out r208364.
1242         https://bugs.webkit.org/show_bug.cgi?id=164402
1243
1244         broke the build (Requested by smfr on #webkit).
1245
1246         Reverted changeset:
1247
1248         "DFG plays fast and loose with the shadow values of a Phi"
1249         https://bugs.webkit.org/show_bug.cgi?id=164309
1250         http://trac.webkit.org/changeset/208364
1251
1252 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
1253
1254         DFG plays fast and loose with the shadow values of a Phi
1255         https://bugs.webkit.org/show_bug.cgi?id=164309
1256
1257         Reviewed by Saam Barati.
1258         
1259         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
1260
1261         * stress/dfg-ssa-swap.js: Added.
1262         (foo):
1263
1264 2016-11-03  Saam Barati  <sbarati@apple.com>
1265
1266         Asking for a value profile prediction should be defensive against not finding a value profile
1267         https://bugs.webkit.org/show_bug.cgi?id=164306
1268
1269         Reviewed by Mark Lam.
1270
1271         * stress/inlined-tail-call-in-inlined-setter-should-not-crash-when-getting-value-profile.js: Added.
1272         (let.o.set foo):
1273         (bar):
1274
1275 2016-11-02  Saam Barati  <sbarati@apple.com>
1276
1277         Allocation elimination of rest parameter doesn't take into account indexed properties on Array.prototype/Object.prototype
1278         https://bugs.webkit.org/show_bug.cgi?id=164301
1279
1280         Reviewed by Geoffrey Garen.
1281
1282         * stress/rest-parameter-allocation-elimination-watchpoints-2.js: Added.
1283         (assert):
1284         (foo):
1285         * stress/rest-parameter-allocation-elimination-watchpoints-3.js: Added.
1286         (assert):
1287         (foo):
1288         * stress/rest-parameter-allocation-elimination-watchpoints-4.js: Added.
1289         (assert):
1290         (foo):
1291         * stress/rest-parameter-allocation-elimination-watchpoints-5.js: Added.
1292         (assert):
1293         (foo):
1294         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Added.
1295         (assert):
1296         (foo):
1297         * stress/rest-parameter-allocation-elimination-watchpoints.js: Added.
1298         (assert):
1299         (foo):
1300
1301 2016-11-01  Saam Barati  <sbarati@apple.com>
1302
1303         We should be able to eliminate rest parameter allocations
1304         https://bugs.webkit.org/show_bug.cgi?id=163925
1305
1306         Reviewed by Filip Pizlo.
1307
1308         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
1309         (assert):
1310         (test1.bar):
1311         (test1):
1312         (test2.jaz):
1313         (test2.jaz2.kaz):
1314         (test2.jaz2):
1315         (test2):
1316         (test3.foo):
1317         (test3.baz):
1318         (test3.jaz):
1319         (test3):
1320         (test4.baz):
1321         (test4.jaz):
1322         (test4):
1323         (test5.baz):
1324         (test5.jaz):
1325         (test5):
1326         (test6.baz):
1327         (test6.jaz):
1328         (test6):
1329         (test7.baz):
1330         (test7.jaz):
1331         (test7.check):
1332         (test7):
1333         (test8.baz):
1334         (test8.jaz):
1335         (test8.check):
1336         (test8):
1337         (test9.baz):
1338         (test9.jaz):
1339         (test9.check):
1340         (test9):
1341         (test10.baz):
1342         (test10.jaz):
1343         (test10):
1344         (test11.bar):
1345         (test11.foo):
1346         (test11.makeArguments):
1347         (test11.):
1348         (test12):
1349         (test12.bar):
1350         (test12.foo):
1351         (test12.makeArguments):
1352         (test12.):
1353         (test13.bar):
1354         (test13.top):
1355         (test13.foo):
1356         (test13.makeArguments):
1357         (test13.):
1358         (test13):
1359         (test14.bar):
1360         (test14.top):
1361         (test14.foo):
1362         (test14.makeArguments):
1363         (test14.):
1364         (test14):
1365         (test15.bar):
1366         (test15.top):
1367         (test15.foo):
1368         (test15.makeArguments):
1369         (test15.):
1370         (test15):
1371
1372 2016-11-01  Commit Queue  <commit-queue@webkit.org>
1373
1374         Unreviewed, rolling out r208208 and r208210.
1375         https://bugs.webkit.org/show_bug.cgi?id=164276
1376
1377         This change caused 28 JSC test failures. (Requested by
1378         ryanhaddad on #webkit).
1379
1380         Reverted changesets:
1381
1382         "We should be able to eliminate rest parameter allocations"
1383         https://bugs.webkit.org/show_bug.cgi?id=163925
1384         http://trac.webkit.org/changeset/208208
1385
1386         "Fix the EFL build."
1387         http://trac.webkit.org/changeset/208210
1388
1389 2016-10-31  Filip Pizlo  <fpizlo@apple.com>
1390
1391         JSC should support SharedArrayBuffer
1392         https://bugs.webkit.org/show_bug.cgi?id=163986
1393
1394         Reviewed by Keith Miller.
1395         
1396         This adds our own test for the various corner cases of SharedArrayBuffer. This test is meant to
1397         check all of the things that don't require concurrency.
1398
1399         * stress/SharedArrayBuffer.js: Added.
1400         (checkAtomics):
1401         (shouldFail):
1402         (Symbol):
1403         (runAtomic):
1404
1405 2016-10-31  Saam Barati  <sbarati@apple.com>
1406
1407         We should be able to eliminate rest parameter allocations
1408         https://bugs.webkit.org/show_bug.cgi?id=163925
1409
1410         Reviewed by Filip Pizlo.
1411
1412         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
1413         (assert):
1414         (test1.bar):
1415         (test1):
1416         (test2.jaz):
1417         (test2.jaz2.kaz):
1418         (test2.jaz2):
1419         (test2):
1420         (test3.foo):
1421         (test3.baz):
1422         (test3.jaz):
1423         (test3):
1424         (test4.baz):
1425         (test4.jaz):
1426         (test4):
1427         (test5.baz):
1428         (test5.jaz):
1429         (test5):
1430         (test6.baz):
1431         (test6.jaz):
1432         (test6):
1433         (test7.baz):
1434         (test7.jaz):
1435         (test7.check):
1436         (test7):
1437         (test8.baz):
1438         (test8.jaz):
1439         (test8.check):
1440         (test8):
1441         (test9.baz):
1442         (test9.jaz):
1443         (test9.check):
1444         (test9):
1445         (test10.baz):
1446         (test10.jaz):
1447         (test10):
1448         (test11.bar):
1449         (test11.foo):
1450         (test11.makeArguments):
1451         (test11.):
1452         (test12):
1453         (test12.bar):
1454         (test12.foo):
1455         (test12.makeArguments):
1456         (test12.):
1457         (test13.bar):
1458         (test13.top):
1459         (test13.foo):
1460         (test13.makeArguments):
1461         (test13.):
1462         (test13):
1463         (test14.bar):
1464         (test14.top):
1465         (test14.foo):
1466         (test14.makeArguments):
1467         (test14.):
1468         (test14):
1469         (test15.bar):
1470         (test15.top):
1471         (test15.foo):
1472         (test15.makeArguments):
1473         (test15.):
1474         (test15):
1475
1476 2016-10-31  Saam Barati  <sbarati@apple.com>
1477
1478         Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing out
1479         https://bugs.webkit.org/show_bug.cgi?id=164227
1480
1481         Unreviewed timeout fix.
1482
1483         * microbenchmarks/pure-get-by-id-cse-2.js:
1484
1485 2016-10-31  Keith Miller  <keith_miller@apple.com>
1486
1487         autogenerated files from wasm.json should be in derived sources.
1488         https://bugs.webkit.org/show_bug.cgi?id=164152
1489
1490         Reviewed by Filip Pizlo.
1491
1492         Delete generation script since it is no longer used.
1493
1494         * wasm/generate-wasmops-header.js: Removed.
1495
1496 2016-10-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1497
1498         [JSC] JSON.stringify should handle Proxy which is non JSArray but isArray is true
1499         https://bugs.webkit.org/show_bug.cgi?id=164123
1500
1501         Reviewed by Mark Lam.
1502
1503         * stress/json-stringify-with-non-jsarray-array.js: Added.
1504         (shouldBe):
1505         (shouldBe.JSON.stringify.new.Proxy):
1506
1507 2016-10-29  Saam Barati  <sbarati@apple.com>
1508
1509         We should have a way of profiling when a get_by_id is pure and to emit a PureGetById in the DFG/FTL
1510         https://bugs.webkit.org/show_bug.cgi?id=163305
1511
1512         Reviewed by Keith Miller.
1513
1514         * microbenchmarks/pure-get-by-id-cse-2.js: Added.
1515         (foo):
1516         * microbenchmarks/pure-get-by-id-cse.js: Added.
1517         (foo):
1518         * stress/pure-get-by-id-cse-correctness.js: Added.
1519         (assert):
1520         (foo):
1521         * stress/pure-get-by-id-on-non-object.js: Added.
1522         (assert):
1523         (foo):
1524
1525 2016-10-28  Csaba Osztrogonác  <ossy@webkit.org>
1526
1527         Skip JSTests/microbenchmarks/dense-set.js on memory limited devices
1528         https://bugs.webkit.org/show_bug.cgi?id=164128
1529
1530         Reviewed by Mark Lam.
1531
1532         * microbenchmarks/dense-set.js:
1533
1534 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1535
1536         [JSC] implement runtime for async functions
1537         https://bugs.webkit.org/show_bug.cgi?id=163760
1538
1539         Reviewed by Yusuke Suzuki.
1540
1541         * stress/async-await-basic.js: Added.
1542         (shouldBe):
1543         (shouldBeAsync):
1544         (shouldThrow):
1545         (shouldThrowAsync):
1546         (shouldThrowSyntaxError):
1547         (let.AsyncFunction.async):
1548         (async.asyncFunctionForProto):
1549         (Object.getPrototypeOf.async):
1550         (Object.getPrototypeOf.async.method):
1551         (async):
1552         (async.method):
1553         (async.asyncNonConstructorDecl):
1554         (shouldThrow.new.async):
1555         (shouldThrow.new.async.nonConstructor):
1556         (async.asyncDecl):
1557         (async.f):
1558         (MyError):
1559         (async.asyncDeclThrower):
1560         (shouldThrowAsync.async):
1561         (resolveLater):
1562         (rejectLater):
1563         (async.resumeAfterNormal):
1564         (O.async.resumeAfterNormal):
1565         (resumeAfterNormalArrow.async):
1566         (async.resumeAfterThrow):
1567         (O.async.resumeAfterThrow):
1568         (resumeAfterThrowArrow.async):
1569         (catch):
1570         * stress/async-await-module-reserved-word.js: Added.
1571         (shouldThrow):
1572         (SyntaxError.Canstring_appeared_hereawait.checkModuleSyntaxError.String.raw.await):
1573         (checkModuleSyntaxError.String.raw.await):
1574         (checkModuleSyntaxError.String.raw.async.await):
1575         (SyntaxError.Cannot.declare.named):
1576         * stress/async-await-mozilla.js: Added.
1577         (shouldBe):
1578         (shouldBeAsync):
1579         (shouldThrow):
1580         (shouldThrowAsync):
1581         (assert):
1582         (shouldThrowSyntaxError):
1583         (mozSemantics.async.empty):
1584         (mozSemantics.async.simpleReturn):
1585         (mozSemantics.async.simpleAwait):
1586         (mozSemantics.async.simpleAwaitAsync):
1587         (mozSemantics.async.returnOtherAsync):
1588         (mozSemantics.async.simpleThrower):
1589         (mozSemantics.async.delegatedThrower):
1590         (mozSemantics.async.tryCatch):
1591         (mozSemantics.async.tryCatchThrow):
1592         (mozSemantics.async.wellFinally):
1593         (mozSemantics.async.finallyMayFail):
1594         (mozSemantics.async.embedded.async.inner):
1595         (mozSemantics.async.embedded):
1596         (mozSemantics.async.fib):
1597         (mozSemantics.async.isOdd.async.isEven):
1598         (mozSemantics.async.isOdd):
1599         (mozSemantics.hardcoreFib.async.fib2):
1600         (mozSemantics.namedAsyncExpr.async.simple):
1601         (mozSemantics.async.executionOrder.async.first):
1602         (mozSemantics.async.executionOrder.async.second):
1603         (mozSemantics.async.executionOrder.async.third):
1604         (mozSemantics.async.executionOrder):
1605         (mozSemantics.async.miscellaneous):
1606         (mozSemantics.thrower):
1607         (mozSemantics.async.defaultArgs):
1608         (mozSemantics.shouldThrow):
1609         (mozSemantics):
1610         (mozMethods.X):
1611         (mozMethods.X.prototype.async.getValue):
1612         (mozMethods.X.prototype.setValue):
1613         (mozMethods.X.prototype.async.increment):
1614         (mozMethods.X.prototype.async.getBaseClassName):
1615         (mozMethods.X.async.getStaticValue):
1616         (mozMethods.Y.prototype.async.getBaseClassName):
1617         (mozMethods.Y):
1618         (mozFunctionNameInferrence.async.test):
1619         (mozSyntaxErrors):
1620         * stress/async-await-reserved-word.js: Added.
1621         (assert):
1622         (shouldThrowSyntaxError):
1623         (AsyncFunction.async):
1624         * stress/async_arrow_functions_lexical_arguments_binding.js: Added.
1625         (shouldBe):
1626         (shouldBeAsync):
1627         (shouldThrowAsync):
1628         (noArgumentsArrow2.async):
1629         * stress/async_arrow_functions_lexical_new.target_binding.js: Added.
1630         (shouldBe):
1631         (shouldBeAsync):
1632         (shouldThrowAsync):
1633         (C1):
1634         (C2):
1635         (shouldThrowAsync.async):
1636         * stress/async_arrow_functions_lexical_super_binding.js: Added.
1637         (shouldBe):
1638         (shouldBeAsync):
1639         (BaseClass.prototype.baseClassValue):
1640         (BaseClass.prototype.get property):
1641         (BaseClass):
1642         (ChildClass.prototype.asyncSuperProp):
1643         (ChildClass.prototype.asyncSuperProp2):
1644         (ChildClass):
1645         (ChildClass2):
1646         * stress/async_arrow_functions_lexical_this_binding.js: Added.
1647         (shouldBe):
1648         (shouldBeAsync):
1649         (d.y):
1650
1651 2016-10-28  Csaba Osztrogonác  <ossy@webkit.org>
1652
1653         Skip 2 JS stress tests on memory limited devices
1654         https://bugs.webkit.org/show_bug.cgi?id=164125
1655
1656         Unreviewed quick fix to unbreak JSCOnly ARM bots as soon as possible.
1657
1658         * stress/joined-strings-should-not-exceed-max-string-length.js:
1659         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js:
1660
1661 2016-10-27  Caitlin Potter  <caitp@igalia.com>
1662
1663         [JSC] forbid lexical redeclaration of generator formal parameters
1664         https://bugs.webkit.org/show_bug.cgi?id=163930
1665
1666         Reviewed by Yusuke Suzuki.
1667
1668         * stress/async-await-syntax.js:
1669         * stress/generator-syntax.js:
1670         (testSyntaxError.gen):
1671         (testSyntaxError.arguments):
1672         (testSyntaxError.eval):
1673         * test262.yaml:
1674
1675 2016-10-26  JF Bastien  <jfbastien@apple.com>
1676
1677         WebAssembly API: implement Instance
1678
1679         As described in: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblyinstance-objects
1680
1681          - Take ownership of Wasm::Plan's compilation result when successfully creating a JSWebAssemblyModule object.
1682          - Construct a basic Instance with a Module.
1683          - Handle second argument (importObject) of WebAssembly.Instance.
1684          - Add reference text from the spec to WebAssembly.Module's code.
1685          - Expose and test an empty 'exports' ModuleNamespaceObject on WebAssembly.Instance.
1686
1687         The implementation isn't complete yet: it relies on further work for which I've filed bugs.
1688
1689         WebAssembly API: implement Instance
1690         https://bugs.webkit.org/show_bug.cgi?id=163998
1691
1692         Reviewed by Keith Miller.
1693
1694         * wasm/js-api/test_Instance.js: Added.
1695         (EmptyModule): use the Builder, create the simplest Module possible, and create an Instance from it
1696         * wasm/js-api/test_basic_api.js:
1697         (const.c.in.constructorProperties.switch): basic tests of the API
1698
1699 2016-10-26  Mark Lam  <mark.lam@apple.com>
1700
1701         JSGenericTypedArrayView::set() should check for exceptions.
1702         https://bugs.webkit.org/show_bug.cgi?id=164007
1703         <rdar://problem/28853775>
1704
1705         Reviewed by Filip Pizlo.
1706
1707         * stress/typed-array-view-set-should-not-crash-on-exception.js: Added.
1708
1709 2016-10-25  Mark Lam  <mark.lam@apple.com>
1710
1711         String.prototype.replace() should throw an OutOfMemoryError when using too much memory.
1712         https://bugs.webkit.org/show_bug.cgi?id=163996
1713         <rdar://problem/28263117>
1714
1715         Reviewed by Geoffrey Garen.
1716
1717         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: Added.
1718
1719 2016-10-25  Mark Lam  <mark.lam@apple.com>
1720
1721         JSStringJoiner::joinedLength() should limit joined string lengths to INT_MAX.
1722         https://bugs.webkit.org/show_bug.cgi?id=163937
1723         <rdar://problem/28642990>
1724
1725         Reviewed by Geoffrey Garen.
1726
1727         * stress/joined-strings-should-not-exceed-max-string-length.js: Added.
1728
1729 2016-10-25  JF Bastien  <jfbastien@apple.com>
1730
1731         WebAssembly JS API: simple Module test
1732         https://bugs.webkit.org/show_bug.cgi?id=163963
1733
1734         Reviewed by Filip Pizlo.
1735
1736         * wasm/LowLevelBinary.js:
1737         (export.default.LowLevelBinary.prototype.get return): get the ArrayBuffer
1738         (export.default.LowLevelBinary.prototype.hexdump): Deleted.
1739         (export.default.LowLevelBinary.prototype._maybeGrow): Deleted.
1740         * wasm/js-api/test_Module.js: Added.
1741         (EmptyModule): The most basic module possible
1742
1743 2016-10-25  JF Bastien  <jfbastien@apple.com>
1744
1745         WebAssembly JS API: implement Module
1746
1747         This implementation allows us to:
1748          - Syncrhonously create a WebAssembly.Module with a typed array.
1749          - Creates a compilation plan.
1750          - Parse the Module and creates corresponding code.
1751          - Throw WebAssembly.CompileError with mildly helpful [*] error messages on
1752            failure.
1753
1754         Consult the API documentation for expected behavior: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymodule-constructor
1755
1756         For now the implementation discards the generated code.
1757
1758         The next steps will be:
1759          - Expose a Module's exports.
1760          - Implement WebAssembly.Instance, which allows instantiating and running a
1761            compiled Module.
1762          - Beef up the testing infrastructure under JSTests/wasm so that more complex
1763            modules can be created and tested (instead of writing the bits by hand).
1764
1765         This patch also:
1766          - Adds assert.instanceof in assert.js.
1767          - Refactors Wasm::Parser and friends to accept const uint8_t* as well as a
1768            Vector, to avoid copying when invoked synchronously.
1769          - Remove useless Structure from some of the wasm constructors: they're already
1770            on the JSGlobalObject, visited properly and all.
1771          - Fix off-by-one error in parsing: Parser::parseUInt32 failed if the integer
1772            was exactly at end of file.
1773
1774          [*] On error messages while parsing: I filed https://bugs.webkit.org/show_bug.cgi?id=163919
1775
1776         WebAssembly JS API: implement Module
1777         https://bugs.webkit.org/show_bug.cgi?id=163903
1778
1779         Reviewed by Keith Miller.
1780
1781         * wasm/assert.js: use underscore in name, and remove when exporting to avoid clasing with builtin names
1782         (const._notUndef):
1783         (const._isUndef):
1784         (const._eq):
1785         (const._ge):
1786         (const._throws):
1787         * wasm/js-api/test_basic_api.js: test the WebAssembly.Module API
1788         (const.c.in.constructorProperties.switch):
1789
1790 2016-10-25  Keith Miller  <keith_miller@apple.com>
1791
1792         Add trivial Wasm conversion opcodes
1793         https://bugs.webkit.org/show_bug.cgi?id=163950
1794
1795         Reviewed by Filip Pizlo.
1796
1797         This patch differentiates between Wasm opcodes that are trivially mapped to a B3 opcode and
1798         those that are not.  Some of the Wasm opcodes that are currently a non-simple opcode will
1799         become simple as we add B3 opcodes for Wasm operations.  The remaining opcodes will need to
1800         be added via patchpoints in a later patch.
1801
1802         * wasm/generate-wasmops-header.js:
1803         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.Wasm.inline.bool.isSimple):
1804         * wasm/wasm.json:
1805
1806 2016-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1807
1808         Arrow functions with concise bodies cannot return regular expressions
1809         https://bugs.webkit.org/show_bug.cgi?id=163162
1810
1811         Reviewed by Filip Pizlo.
1812
1813         * ChakraCore/test/Operators/instanceof.baseline-jsc:
1814         * ChakraCore/test/Regex/nul_character.baseline-jsc:
1815         * ChakraCore/test/es5/Lex_u3.baseline-jsc:
1816         * stress/parse-regexp-as-token.js: Added.
1817         (shouldBe):
1818
1819 2016-10-24  Keith Miller  <keith_miller@apple.com>
1820
1821         Wasm should support floating point operations.
1822         https://bugs.webkit.org/show_bug.cgi?id=163770
1823
1824         Reviewed by Michael Saboff.
1825
1826         Add appropriate b3op names for floating point wasm bytecodes, where they exist.
1827         Also, fix some WASM => Wasm in WasmOps.h generator script that I missed
1828         the first time I made the change.
1829
1830         * wasm/generate-wasmops-header.js:
1831         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.template.typename.Int.inline.bool.isValidOpType): Deleted.
1832         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.BinaryOpType): Deleted.
1833         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.UnaryOpType): Deleted.
1834         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.LoadOpType): Deleted.
1835         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.StoreOpType): Deleted.
1836         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.undef.CREATE_ENUM_VALUE.inline.bool.isControlOp): Deleted.
1837         * wasm/wasm.json:
1838
1839 2016-10-21  Saam Barati  <sbarati@apple.com>
1840
1841         SpeculativeJIT::compileTryGetById needs to pass in NeedsToSpill along both the cell speculation and untyped speculation path
1842         https://bugs.webkit.org/show_bug.cgi?id=163622
1843
1844         Reviewed by Yusuke Suzuki.
1845
1846         * stress/try-get-by-id-should-spill-registers-dfg.js: Added.
1847         (let.f.createBuiltin):
1848
1849 2016-10-21  Caitlin Potter  <caitp@igalia.com>
1850
1851         [JSC] don't crash when arguments to `new Function()` produce unexpected AST
1852         https://bugs.webkit.org/show_bug.cgi?id=163748
1853
1854         Reviewed by Mark Lam.
1855
1856         * stress/regress-163748.js: Added.
1857         (assert):
1858         (shouldThrowSyntaxError):
1859         (GeneratorFunction):
1860
1861 2016-10-20  Keith Miller  <keith_miller@apple.com>
1862
1863         Add support for WASM calls
1864         https://bugs.webkit.org/show_bug.cgi?id=161727
1865
1866         Reviewed by Filip Pizlo and Michael Saboff.
1867
1868         Add members of the Call category to the WASMOps special group.
1869
1870         * wasm/generate-wasmops-header.js:
1871
1872 2016-10-20  Yusuke Suzuki  <utatane.tea@gmail.com>
1873
1874         [JSC] Drop isEnvironmentRecord type info flag and use JSType information instead
1875         https://bugs.webkit.org/show_bug.cgi?id=163761
1876
1877         Reviewed by Keith Miller.
1878
1879         * modules/string-prototype-module-scope.js: Added.
1880         (shouldBe):
1881         (catch):
1882         (refer):
1883         * stress/string-prototype-scopes-global-lexical-environment-strict.js: Added.
1884         (shouldBe):
1885         (catch):
1886         * stress/string-prototype-scopes-global-lexical-environment.js: Added.
1887         (shouldBe):
1888         (catch):
1889         * stress/string-prototype-scopes-strict.js: Added.
1890         (shouldBe):
1891         (catch):
1892         (try.refer):
1893         (refer):
1894         * stress/string-prototype-scopes.js: Added.
1895         (shouldBe):
1896         (catch):
1897         (try.refer):
1898         (refer):
1899         (object.toString):
1900         (with):
1901
1902 2016-10-20  JF Bastien  <jfbastien@apple.com>
1903
1904         WebAssembly API: implement exception constructors properly
1905
1906          - Rename WebAssemblyObject to JSWebAssembly for consistency.
1907          - WebAssembly object now has its own prototype: add WebAssemblyPrototype, and
1908            use it to register JSWebAssembly's function properties through auto-generated
1909            .lut.h, instead of manually.
1910          - The error constructors used to throw (e.g. `new WebAssembly.CompileError()`).
1911          - Register WebAssembly's constructors from the global object, and hold a
1912            reference to their structure and prototype so that invoking the constructor
1913            can use the structure directly from the global object.
1914          - Add a prototype base field to global object creation. Previous ones all had
1915            Object's prototype as their base, but WebAssembly's error constructors have
1916            Error as their base.
1917          - Test for the error object's correctness.
1918          - Add missing #if ENABLE(WEBASSEMBLY)
1919
1920         WebAssembly API: implement exception constructors properly
1921         https://bugs.webkit.org/show_bug.cgi?id=163699
1922
1923         Reviewed by Keith Miller.
1924
1925         * wasm/js-api/test_basic_api.js:
1926         (const.c.in.constructorProperties): more tests
1927
1928 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1929
1930         [JSC] disallow references to `await` in AsyncFunction formal parameters
1931         https://bugs.webkit.org/show_bug.cgi?id=163694
1932
1933         Reviewed by Saam Barati.
1934
1935         * stress/async-await-syntax.js:
1936
1937 2016-10-20  Keith Miller  <keith_miller@apple.com>
1938
1939         Invalid assertion in arguments elimination
1940         https://bugs.webkit.org/show_bug.cgi?id=163740
1941         <rdar://problem/27911462>
1942
1943         Reviewed by Michael Saboff.
1944
1945         * stress/direct-arguments-osr-entry.js: Added.
1946         (foo.):
1947         (foo):
1948
1949 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1950
1951         [JSC] throw TypeError when constructing dynamically created JSGeneratorFunction
1952         https://bugs.webkit.org/show_bug.cgi?id=163714
1953
1954         Reviewed by Mark Lam.
1955
1956         Add missing test coverage that dynamically created
1957         JSGeneratorFunctions can not be constructed.
1958
1959         * stress/generator-function-constructor.js:
1960         (shouldThrow):
1961
1962 2016-10-19  JF Bastien  <jfbastien@apple.com>
1963
1964         JavaScript WebAssembly API: baby steps
1965
1966          - Expand WebAssembly constructors into their own files. This requires a lot of
1967            boilerplate, as well as adding the .lut.h files. All of the
1968            JSWebAssembly*.{h,cpp}, as well as Constructor and Prototype files, are
1969            currently the same between the 4 specified WebAssembly constructors. It'll be
1970            easy to implement individual functions on constructed objects as per the
1971            spec, and have each of these files diverge. The error constructors are also
1972            similar, except that their instance derives from ErrorInstance.
1973          - Use constructor macro when initializing the global object.
1974          - Dramatically improve testing of the WebAssembly API by checking for
1975            properties specified in the spec [*].
1976          - Clean up assert.js' exception testing.
1977          - Fix a copy-paste bug in wasm.json: floating-point const return values were
1978            swapped.
1979
1980         [*] https://github.com/WebAssembly/design/blob/master/JS.md
1981
1982         Implement more of the JavaScript WebAssembly API
1983         https://bugs.webkit.org/show_bug.cgi?id=163571
1984
1985         Reviewed by Keith Miller.
1986
1987         * wasm/assert.js:
1988         (export.const.isUndef): add this useful helper
1989         (export.const.throws): fold other throw checks into this one, and check message as well
1990         * wasm/js-api/test_basic_api.js:
1991         (const.checkOwnPropertyDescriptor): check own property descriptor follows the spec
1992         * wasm/self-test/test_BuilderJSON.js:
1993         (const.assertOpThrows): use new assert API
1994         (CheckedOpcodeArgumentsTooMany): ditto
1995         (CheckedOpcodeArgumentsNotEnough): ditto
1996         (CallInvalid): ditto
1997         (I32ConstInvalid): ditto
1998         (F32ConstInvalid): ditto (and this caugth the JSON copy-paste bug)
1999         (F64ConstInvalid): ditto
2000         * wasm/self-test/test_LowLevelBinary_varint.js: use new assert API
2001         * wasm/self-test/test_LowLevelBinary_varuint.js: use new assert API
2002         * wasm/utilities.js: add "global" object, used in basic API test (to access global.WebAssembly).
2003         * wasm/wasm.json: fix copy-paste
2004
2005 2016-10-19  Caitlin Potter  <caitp@igalia.com>
2006
2007         [JSC] forbid "use strict" directive in generator functions with non-simple parameters
2008         https://bugs.webkit.org/show_bug.cgi?id=163683
2009
2010         Reviewed by Geoffrey Garen.
2011
2012         Update various generator*-non-simple-param.js tests to be passing.
2013
2014         * test262.yaml:
2015
2016 2016-10-18  Mark Lam  <mark.lam@apple.com>
2017
2018         Invoking Object.prototype.__proto__ accessors directly should throw a TypeError.
2019         https://bugs.webkit.org/show_bug.cgi?id=154377
2020         <rdar://problem/27330808>
2021
2022         Reviewed by Filip Pizlo and Saam Barati.
2023
2024         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js: Added.
2025
2026 2016-10-18  Keith Miller  <keith_miller@apple.com>
2027
2028         GetByVal to GetById conversion in the DFG is incorrect for getters with control flow
2029         https://bugs.webkit.org/show_bug.cgi?id=163629
2030
2031         Reviewed by Yusuke Suzuki.
2032
2033         * stress/get-by-val-to-id-with-getter.js: Added.
2034         (foo):
2035         (o.get hello):
2036
2037 2016-10-15  Filip Pizlo  <fpizlo@apple.com>
2038
2039         DFG and FTL should be able to use DirectCall ICs when they proved the callee or its executable
2040         https://bugs.webkit.org/show_bug.cgi?id=163371
2041
2042         Reviewed by Geoffrey Garen and Saam Barati.
2043         
2044         Add microbenchmarks for all of the cases that this patch optimizes.
2045
2046         * microbenchmarks/direct-call-arity-mismatch.js: Added.
2047         (foo):
2048         (bar):
2049         * microbenchmarks/direct-call.js: Added.
2050         (foo):
2051         (bar):
2052         * microbenchmarks/direct-construct-arity-mismatch.js: Added.
2053         (Foo):
2054         (bar):
2055         * microbenchmarks/direct-construct.js: Added.
2056         (Foo):
2057         (bar):
2058         * microbenchmarks/direct-tail-call-arity-mismatch.js: Added.
2059         (foo):
2060         (bar):
2061         * microbenchmarks/direct-tail-call-inlined-caller-arity-mismatch.js: Added.
2062         (foo):
2063         (bar):
2064         (baz):
2065         * microbenchmarks/direct-tail-call-inlined-caller.js: Added.
2066         (foo):
2067         (bar):
2068         (baz):
2069         * microbenchmarks/direct-tail-call.js: Added.
2070         (foo):
2071         (bar):
2072
2073 2016-10-18  Caitlin Potter  <caitp@igalia.com>
2074
2075         [JSC] ES6 Method functions should not have prototype
2076         https://bugs.webkit.org/show_bug.cgi?id=162530
2077
2078         Reviewed by Saam Barati.
2079
2080         Fix test262 expectations about MethodDefinitions
2081
2082         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
2083         * stress/reflect-set.js:
2084         * test262.yaml:
2085
2086 2016-10-17  Keith Miller  <keith_miller@apple.com>
2087
2088         Add support for WASM Memory.
2089         https://bugs.webkit.org/show_bug.cgi?id=161710
2090
2091         Reviewed by Geoffrey Garen.
2092
2093         Add store and load opcodes to wasm.json. Additionally, add new
2094         enums for those opcodes in the generator.
2095
2096         * stress/wasm/generate-wasmops-header.js:
2097         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.LoadOpType):
2098         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.StoreOpType):
2099
2100 2016-10-17  Saam Barati  <sbarati@apple.com>
2101
2102         Add more tests for the double->String conversion in ValueAdd constant folding
2103         https://bugs.webkit.org/show_bug.cgi?id=163517
2104
2105         Reviewed by Yusuke Suzuki.
2106
2107         * microbenchmarks/string-add-constant-folding.js:
2108         (test):
2109
2110 2016-10-17  JF Bastien  <jfbastien@apple.com>
2111
2112         WebAssembly JS API: implement basic stub
2113
2114         Implement the global WebAssembly JavaScript object, and its constructor +
2115         function properties as described in:
2116           https://github.com/WebAssembly/design/blob/master/JS.md
2117
2118         These don't do anything at the moment, the parent bug will take care of adding
2119         more functionality and associated tests.
2120
2121         WebAssembly JS API: implement basic stub
2122         https://bugs.webkit.org/show_bug.cgi?id=163404
2123
2124         Reviewed by Keith Miller.
2125
2126         * wasm.yaml:
2127         * wasm/js-api/test_basic_api.js: Added.
2128         (const.f.of.functionProperties.WebAssembly.f.undefined.throw.new.Error.Couldn.const.c.of.constructorProperties.WebAssembly.c.undefined.throw.new.Error.Couldn):
2129         (const.c.of.constructorProperties.catch):
2130
2131 2016-10-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2132
2133         [DOMJIT] Use DOMJIT::Patchpoint in IC
2134         https://bugs.webkit.org/show_bug.cgi?id=163223
2135
2136         Reviewed by Saam Barati.
2137
2138         * stress/domjit-exception-ic.js: Added.
2139         (shouldBe):
2140         (access):
2141         * stress/domjit-exception.js: Added.
2142         (shouldBe):
2143         (access):
2144         * stress/domjit-getter-complex-with-incorrect-object.js: Added.
2145         (shouldThrow):
2146         (access):
2147         (i.shouldThrow):
2148         * stress/domjit-getter-complex.js: Added.
2149         (shouldBe):
2150         (access):
2151         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js: Added.
2152         (assert):
2153         (bar):
2154         (foo):
2155
2156 2016-10-15  Saam Barati  <sbarati@apple.com>
2157
2158         Assertion failed under operationToLowerCase with a rope with zero length
2159         https://bugs.webkit.org/show_bug.cgi?id=163314
2160
2161         Reviewed by Mark Lam.
2162
2163         * stress/to-lower-case-intrinsic-on-empty-rope.js: Added.
2164         (assert):
2165         (returnRope.helper):
2166         (returnRope):
2167         (lower):
2168
2169 2016-10-14  Benjamin Poulain  <bpoulain@apple.com>
2170
2171         [JSC] op_negate should with any type
2172         https://bugs.webkit.org/show_bug.cgi?id=162587
2173
2174         Reviewed by Saam Barati.
2175
2176         * stress/arith-abs-to-arith-negate-range-optimizaton.js: Added.
2177         Cover OSR Exits when converting Math.abs() into ArithNegate.
2178
2179         * stress/arith-negate-on-various-types.js: Added.
2180         Cover ArithNegate with all types.
2181
2182 2016-10-14  JF Bastien  <jfbastien@apple.com>
2183
2184         Basic WebAssembly testing
2185
2186         Create a small DSL in JavaScript which can build WebAssembly binary modules based on the JSON description of the format as described in:
2187         https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md
2188
2189         This DSL can then be used to write small text description of valid and invalid WebAssembly binaries, making testing the JSC implementation much easier.
2190
2191         Details and example in README.md.
2192
2193         Basic WebAssembly testing
2194         https://bugs.webkit.org/show_bug.cgi?id=163267
2195
2196         Reviewed by Keith Miller.
2197
2198         * stress/wasm/wasm.json: Removed.
2199         * wasm.yaml: Added.
2200         * wasm/Builder.js: Added.
2201         (const._isValidValue):
2202         (const._BuildWebAssemblyBinary):
2203         (export.default.Builder):
2204         (export.default.Builder.prototype.setChecked):
2205         (export.default.Builder.prototype.setPreamble):
2206         (export.default.Builder.prototype._registerSectionBuilders.switch.case.string_appeared_here.this.section):
2207         (export.default.Builder.prototype._registerSectionBuilders.this.Unknown):
2208         (export.default.Builder.prototype._registerSectionBuilders):
2209         (export.default.Builder.prototype._addSection):
2210         (export.default.Builder.prototype.optimize):
2211         (export.default.Builder.prototype.json):
2212         (export.default.Builder.prototype.AsmJS):
2213         (export.default.Builder.prototype.WebAssembly):
2214         * wasm/LowLevelBinary.js: Added.
2215         (const._getterRangeCheck):
2216         (const._hexdump):
2217         (export.default.LowLevelBinary):
2218         (export.default.LowLevelBinary.prototype.newPatchable):
2219         (export.default.LowLevelBinary.prototype.hexdump):
2220         (export.default.LowLevelBinary.prototype._maybeGrow):
2221         (export.default.LowLevelBinary.prototype._push8):
2222         (export.default.LowLevelBinary.prototype.uint8):
2223         (export.default.LowLevelBinary.prototype.uint16):
2224         (export.default.LowLevelBinary.prototype.uint32):
2225         (export.default.LowLevelBinary.prototype.varuint):
2226         (export.default.LowLevelBinary.prototype.varint):
2227         (export.default.LowLevelBinary.prototype.varuint7):
2228         (export.default.LowLevelBinary.prototype.string):
2229         (export.default.LowLevelBinary.prototype.getSize):
2230         (export.default.LowLevelBinary.prototype.getUint8):
2231         (export.default.LowLevelBinary.prototype.getUint16):
2232         (export.default.LowLevelBinary.prototype.getUint32):
2233         (export.default.LowLevelBinary.prototype.getVaruint):
2234         (export.default.LowLevelBinary.prototype.getVarint):
2235         (export.default.LowLevelBinary.prototype.getVaruint7):
2236         (export.default.LowLevelBinary.prototype.getString):
2237         (PatchableLowLevelBinary):
2238         (PatchableLowLevelBinary.prototype._push8):
2239         (PatchableLowLevelBinary.prototype.apply):
2240         * wasm/README.md: Added.
2241         * wasm/WASM.js: Added.
2242         * wasm/assert.js: Added.
2243         (export.const.notUndef):
2244         (export.const.eq):
2245         (export.const.ge):
2246         (export.const.throwsError):
2247         (export.const.throwsRangeError):
2248         * wasm/generate-wasmops-header.js: Renamed from JSTests/stress/wasm/generate-wasmops-header.js.
2249         * wasm/self-test/test_BuilderJSON.js: Added.
2250         (const.assertOpThrows):
2251         (EmptyModule):
2252         (CustomMagicNumber):
2253         (CustomVersion):
2254         (CustomSection):
2255         (CustomSectionAllBytes):
2256         (CustomSectionInvalidByte):
2257         (TwoCustomSections):
2258         (EmptyCodeSection):
2259         (CodeSectionWithEmptyFunction):
2260         (CodeSectionWithEmptyFunctionWithParameters):
2261         (InvalidFunctionParameters):
2262         (SimpleFunction):
2263         (TwoSimpleFunctions):
2264         (TwoBuildersAtTheSameTime):
2265         (CheckedOpcodeArgumentsTooMany):
2266         (CheckedOpcodeArgumentsNotEnough):
2267         (CallNoArguments):
2268         (CallInvalid):
2269         (I32ConstInvalid):
2270         (F32ConstInvalid):
2271         (F64ConstInvalid):
2272         (CallManyFromStack):
2273         (OpcodeAdd):
2274         (OpcodeUnreachable):
2275         (OpcodeUnreachableCombinations):
2276         (OpcodeSelect):
2277         * wasm/self-test/test_BuilderWebAssembly.js: Added.
2278         (EmptyModule):
2279         (CustomSection):
2280         (Basic):
2281         * wasm/self-test/test_LowLevelBinary_encode.js: Added.
2282         * wasm/self-test/test_LowLevelBinary_string.js: Added.
2283         * wasm/self-test/test_LowLevelBinary_uint16.js: Added.
2284         * wasm/self-test/test_LowLevelBinary_uint32.js: Added.
2285         * wasm/self-test/test_LowLevelBinary_uint8.js: Added.
2286         * wasm/self-test/test_LowLevelBinary_varint.js: Added.
2287         * wasm/self-test/test_LowLevelBinary_varuint.js: Added.
2288         * wasm/self-test/test_LowLevelBinary_varuint7.js: Added.
2289         * wasm/self-test/test_WASM.js: Added.
2290         * wasm/test.sh: Added.
2291         * wasm/utilities.js: Added.
2292         (const._read.filename.switch):
2293         (const._load.filename.switch):
2294         (const._json.filename.switch):
2295         * wasm/wasm.json: Added.
2296
2297 2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
2298
2299         test262: @isConstructor incorrectly thinks Math.cos is a constructor
2300         https://bugs.webkit.org/show_bug.cgi?id=163437
2301
2302         Reviewed by Saam Barati.
2303
2304         * stress/is-constructor.js: Added.
2305         (assert):
2306         (prototype.assert):
2307         New test to cover the @isConstructor builtin.
2308
2309         * test262.yaml:
2310         Test now passes.
2311
2312 2016-10-14  Ryan Haddad  <ryanhaddad@apple.com>
2313
2314         Unreviewed, rolling out r207322.
2315
2316         This change caused JSC test failures
2317
2318         Reverted changeset:
2319
2320         "Fix Array.prototype.splice ES6 compliance."
2321         https://bugs.webkit.org/show_bug.cgi?id=163372
2322         http://trac.webkit.org/changeset/207322
2323
2324 2016-10-14  Mark Lam  <mark.lam@apple.com>
2325
2326         JSON.parse should not modify frozen objects.
2327         https://bugs.webkit.org/show_bug.cgi?id=163430
2328
2329         Reviewed by Saam Barati.
2330
2331         * stress/json-parse-on-frozen-object.js: Added.
2332
2333 2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
2334
2335         test262: Failure with RegExp.prototype.compile when pattern is undefined
2336         https://bugs.webkit.org/show_bug.cgi?id=163431
2337
2338         Reviewed by Yusuke Suzuki.
2339
2340         * test262.yaml:
2341
2342 2016-10-13  Joseph Pecoraro  <pecoraro@apple.com>
2343
2344         Exception message for expressions with multiple bracket accesses is inconsistent / incorrect
2345         https://bugs.webkit.org/show_bug.cgi?id=163426
2346
2347         Reviewed by Geoffrey Garen.
2348
2349         * ChakraCore/test/Error/CallNonFunction_3.baseline-jsc:
2350         * ChakraCore/test/Object/null.baseline-jsc:
2351         * stress/exception-in-to-property-key-should-be-handled-early.js:
2352         Better exception messages.
2353
2354 2016-10-13  Mark Lam  <mark.lam@apple.com>
2355
2356         Fix Array.prototype.splice ES6 compliance.
2357         https://bugs.webkit.org/show_bug.cgi?id=163372
2358
2359         Reviewed by Geoffrey Garen and Yusuke Suzuki.
2360
2361         * stress/array-splice-on-frozen-object.js: Added.
2362
2363 2016-10-12  Keith Miller  <keith_miller@apple.com>
2364
2365         Handle non-function, non-undefined comparator in Array.prototype.sort
2366         https://bugs.webkit.org/show_bug.cgi?id=163085
2367
2368         Reviewed by Yusuke Suzuki.
2369
2370         * ChakraCore/test/Array/array_sort.baseline-jsc:
2371         * stress/array-sort-bad-comparator.js: Added.
2372         (test):
2373
2374 2016-10-12  Mark Lam  <mark.lam@apple.com>
2375
2376         Array.prototype.slice should not modify frozen objects.
2377         https://bugs.webkit.org/show_bug.cgi?id=163338
2378
2379         Reviewed by Filip Pizlo.
2380
2381         * stress/array-slice-on-frozen-object.js: Added.
2382
2383 2016-10-11  Mark Lam  <mark.lam@apple.com>
2384
2385         Array.prototype.concat should not modify frozen objects.
2386         https://bugs.webkit.org/show_bug.cgi?id=163302
2387
2388         Reviewed by Filip Pizlo.
2389
2390         * stress/array-concat-on-frozen-object.js: Added.
2391
2392 2016-10-11  Saam Barati  <sbarati@apple.com>
2393
2394         ValueAdd should be constant folded if the operands are constant String,Primitive or Primitive,String
2395         https://bugs.webkit.org/show_bug.cgi?id=163182
2396
2397         Reviewed by Filip Pizlo.
2398
2399         * microbenchmarks/string-add-constant-folding.js: Added.
2400         (assert):
2401         (runTests):
2402         (add):
2403         (test):
2404
2405 2016-10-07  Mark Lam  <mark.lam@apple.com>
2406
2407         Object.freeze() and seal() should throw if [[PreventExtensions]]() fails.
2408         https://bugs.webkit.org/show_bug.cgi?id=163160
2409
2410         Reviewed by Saam Barati.
2411
2412         * stress/object-freeze-with-proxy-preventExtensions.js: Added.
2413         * stress/object-seal-with-proxy-preventExtensions.js: Added.
2414
2415 2016-10-05  Yusuke Suzuki  <utatane.tea@gmail.com>
2416
2417         [DOMJIT] Add initial CheckDOM and CallDOM implementations
2418         https://bugs.webkit.org/show_bug.cgi?id=162941
2419
2420         Reviewed by Filip Pizlo.
2421
2422         * stress/domjit-getter-poly.js: Added.
2423         (shouldBe):
2424         (access):
2425         * stress/domjit-getter-proto.js: Added.
2426         (shouldBe):
2427         (access):
2428         * stress/domjit-getter-super-poly.js: Added.
2429         (shouldBe):
2430         (access):
2431         * stress/domjit-getter.js: Added.
2432         (shouldBe):
2433         (access):
2434
2435 2016-10-04  Saam Barati  <sbarati@apple.com>
2436
2437         String.prototype.toLowerCase should be a DFG/FTL intrinsic
2438         https://bugs.webkit.org/show_bug.cgi?id=162887
2439
2440         Reviewed by Filip Pizlo and Yusuke Suzuki.
2441
2442         * microbenchmarks/to-lower-case.js: Added.
2443         (assert):
2444         (foo):
2445         (bar):
2446         * stress/to-lower-case.js: Added.
2447         (assert):
2448         (foo):
2449
2450 2016-10-04  JF Bastien  <jfbastien@apple.com>
2451
2452         WebAssembly: handle a few corner cases
2453         https://bugs.webkit.org/show_bug.cgi?id=162884
2454
2455         Reviewed by Keith Miller.
2456
2457         * stress/wasm/generate-wasmops-header.js:
2458         (const.opcodeIterator): max opcode value
2459
2460 2016-10-03  JF Bastien  <jfbastien@apple.com>
2461
2462         Auto-generate WASMOps.h, share with testing JSON file
2463         https://bugs.webkit.org/show_bug.cgi?id=162870
2464
2465         Reviewed by Keith Miller.
2466
2467         * stress/wasm/to-c++.js: Added. Generates WASMOps.h, siilar to the current one but with more data.
2468         (const.opcode_iterator):
2469         (opcode_macroizer):
2470         * stress/wasm/wasm.json: Added. Data from 0xC binary format version.
2471
2472 2016-10-03  Saam Barati  <sbarati@apple.com>
2473
2474         MapHash should speculate on the type of its child node
2475         https://bugs.webkit.org/show_bug.cgi?id=161922
2476
2477         Reviewed by Filip Pizlo.
2478
2479         * microbenchmarks/map-key-well-typed.js: Added.
2480         (assert):
2481         (intKey):
2482         (doubleKey):
2483         (objectKey):
2484         (stringKey):
2485         (booleanKey):
2486         (symbolKey):
2487         (cellKey):
2488         (assert.doubleKey):
2489         (assert.booleanKey):
2490
2491 2016-10-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2492
2493         [ES6] GeneratorFunction (a.k.a. GeneratorWrapperFunction)'s prototype object does not have constructor property
2494         https://bugs.webkit.org/show_bug.cgi?id=162849
2495
2496         Reviewed by Geoffrey Garen.
2497
2498         * test262.yaml:
2499
2500 2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
2501
2502         [ES6] Align attributes of Generator related properties to spec
2503         https://bugs.webkit.org/show_bug.cgi?id=162839
2504
2505         Reviewed by Saam Barati.
2506
2507         * test262.yaml:
2508
2509 2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
2510
2511         [ES6] GeneratorFunction constructor should instantiate generator function
2512         https://bugs.webkit.org/show_bug.cgi?id=162838
2513
2514         Reviewed by Saam Barati.
2515
2516         * stress/generator-function-constructor-is-subclassible.js: Added.
2517         (shouldBe):
2518         (GeneratorFunction):
2519         (prototype.hello):
2520         * stress/generator-function-constructor.js:
2521         * test262.yaml:
2522
2523 2016-09-30  Saam Barati  <sbarati@apple.com>
2524
2525         Arrow functions should not allow duplicate parameter names
2526         https://bugs.webkit.org/show_bug.cgi?id=162741
2527
2528         Reviewed by Filip Pizlo.
2529
2530         * test262.yaml:
2531
2532 2016-09-30  Saam Barati  <sbarati@apple.com>
2533
2534         Make some microbenchmarks run for less time.
2535
2536         Rubber stamped by Filip Pizlo.
2537
2538         * microbenchmarks/bound-function-construction-performance.js:
2539         (foo):
2540         * microbenchmarks/getter-richards-try-catch.js:
2541
2542 2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
2543
2544         Arrow functions do not infer name from computed property but normal functions do
2545         https://bugs.webkit.org/show_bug.cgi?id=162720
2546
2547         Reviewed by Saam Barati.
2548
2549         * stress/inferred-names.js:
2550
2551 2016-09-29  Mark Lam  <mark.lam@apple.com>
2552
2553         Break some slow running tests into smaller bits so they don't time out.
2554         https://bugs.webkit.org/show_bug.cgi?id=162743
2555
2556         Reviewed by Keith Miller.
2557
2558         The following tests have shown to be slow running:
2559             op_div.js
2560             op_lshift.js
2561             op_mod.js
2562             op_mul.js
2563             op_rshift.js
2564             op_sub.js
2565             op_urshift
2566
2567         These tests auto-generate permutations of values to apply to binary operations.
2568         They also test the operations with 3 permutations of value types:
2569             1. VarVar - both operands variables
2570             2. VarConst - variable operand 1, constant / literal operand 2
2571             3. ConstVar - constant / literal operand 1, variable operand 2
2572
2573         We can prevent these tests from timing out by breaking each up to only run 1 of
2574         the 3 permutations of value types.
2575
2576         * stress/op_div-ConstVar.js: Added.
2577         * stress/op_div-VarConst.js: Added.
2578         * stress/op_div-VarVar.js: Copied from JSTests/stress/op_div.js.
2579         (o1.valueOf): Deleted.
2580         * stress/op_div.js: Removed.
2581         * stress/op_lshift-ConstVar.js: Added.
2582         * stress/op_lshift-VarConst.js: Added.
2583         * stress/op_lshift-VarVar.js: Copied from JSTests/stress/op_lshift.js.
2584         (o1.valueOf): Deleted.
2585         * stress/op_lshift.js: Removed.
2586         * stress/op_mod-ConstVar.js: Added.
2587         * stress/op_mod-VarConst.js: Added.
2588         * stress/op_mod-VarVar.js: Copied from JSTests/stress/op_mod.js.
2589         (o1.valueOf): Deleted.
2590         * stress/op_mod.js: Removed.
2591         * stress/op_mul-ConstVar.js: Added.
2592         * stress/op_mul-VarConst.js: Added.
2593         * stress/op_mul-VarVar.js: Copied from JSTests/stress/op_mul.js.
2594         (o1.valueOf): Deleted.
2595         * stress/op_mul.js: Removed.
2596         * stress/op_rshift-ConstVar.js: Added.
2597         * stress/op_rshift-VarConst.js: Added.
2598         * stress/op_rshift-VarVar.js: Copied from JSTests/stress/op_rshift.js.
2599         (o1.valueOf): Deleted.
2600         * stress/op_rshift.js: Removed.
2601         * stress/op_sub-ConstVar.js: Added.
2602         * stress/op_sub-VarConst.js: Added.
2603         * stress/op_sub-VarVar.js: Copied from JSTests/stress/op_sub.js.
2604         (o1.valueOf): Deleted.
2605         * stress/op_sub.js: Removed.
2606         * stress/op_urshift-ConstVar.js: Added.
2607         * stress/op_urshift-VarConst.js: Added.
2608         * stress/op_urshift-VarVar.js: Copied from JSTests/stress/op_urshift.js.
2609         (o1.valueOf): Deleted.
2610         * stress/op_urshift.js: Removed.
2611         * stress/resources/binary-op-values.js: Added.
2612         (o1.valueOf):
2613
2614 2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
2615
2616         test262: class and function names should be inferred in assignment
2617         https://bugs.webkit.org/show_bug.cgi?id=146262
2618
2619         Reviewed by Saam Barati.
2620
2621         * stress/arrowfunction-name.js: Added.
2622         Quick tests for arrow function names.
2623
2624         * stress/inferred-names.js: Added.
2625         General test for inferred function names.
2626
2627         * test262.yaml:
2628         Pass many tests checking inferred function names.
2629
2630 2016-09-29  Saam Barati  <sbarati@apple.com>
2631
2632         We don't properly propagate non-simple-parameter-list when parsing a setter
2633         https://bugs.webkit.org/show_bug.cgi?id=160483
2634
2635         Reviewed by Joseph Pecoraro.
2636
2637         * test262.yaml:
2638
2639 2016-09-28  Saam Barati  <sbarati@apple.com>
2640
2641         stringProtoFuncRepeatCharacter will return `null` when it should not
2642         https://bugs.webkit.org/show_bug.cgi?id=161944
2643
2644         Reviewed by Yusuke Suzuki.
2645
2646         * stress/pad-start-calls-repeat-character-with-double.js: Added.
2647         (logLinesWithContext):
2648
2649 2016-09-27  Filip Pizlo  <fpizlo@apple.com>
2650
2651         B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64
2652         https://bugs.webkit.org/show_bug.cgi?id=162644
2653
2654         Reviewed by Keith Miller.
2655
2656         * stress/chill-mod-chill-mod.js: Added.
2657         (foo):
2658
2659 2016-09-26  Csaba Osztrogonác  <oszi@inf.u-szeged.hu>
2660
2661         Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
2662         https://bugs.webkit.org/show_bug.cgi?id=162386
2663
2664         Unreviewed, relanding r206317 after typo fix.
2665
2666         * stress/string-joining-long-strings-should-not-crash.js:
2667
2668 2016-09-24  Caitlin Potter  <caitp@igalia.com>
2669
2670         [JSTests] fix test262 expectations following r206333
2671         https://bugs.webkit.org/show_bug.cgi?id=162533
2672
2673         Reviewed by Yusuke Suzuki.
2674
2675         * test262.yaml:
2676
2677 2016-09-23  Caitlin Potter  <caitp@igalia.com>
2678
2679         [JSC] Implement parsing of Async Functions
2680         https://bugs.webkit.org/show_bug.cgi?id=161409
2681
2682         Reviewed by Yusuke Suzuki.
2683
2684         * stress/async-await-syntax.js: Added.
2685         (testSyntax):
2686         (testSyntaxError):
2687         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2688         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2689         (testTopLevelAsyncAwaitSyntaxStrictMode):
2690         (testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2691         (testNestedAsyncAwaitSyntax.async):
2692         (testNestedAsyncAwaitSyntax.foo):
2693         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2694
2695 2016-09-23  Ryan Haddad  <ryanhaddad@apple.com>
2696
2697         Unreviewed, rolling out r206317.
2698
2699         This change caused timeouts on El Capitan Release JSC tests
2700
2701         Reverted changeset:
2702
2703         "Skip stress/string-joining-long-strings-should-not-crash.js
2704         on memory limited devices"
2705         https://bugs.webkit.org/show_bug.cgi?id=162386
2706         http://trac.webkit.org/changeset/206317
2707
2708 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
2709
2710         Skip mozilla-tests.yaml/js1_5/Array/regress-157652 on memory limited devices
2711         https://bugs.webkit.org/show_bug.cgi?id=162381
2712
2713         Reviewed by Mark Lam.
2714
2715         * mozilla/mozilla-tests.yaml:
2716
2717 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
2718
2719         Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
2720         https://bugs.webkit.org/show_bug.cgi?id=162386
2721
2722         Reviewed by Mark Lam.
2723
2724         * stress/string-joining-long-strings-should-not-crash.js:
2725
2726 2016-09-22  Benjamin Poulain  <bpoulain@apple.com>
2727
2728         [JSC] Use an inline cache to generate op_negate
2729         https://bugs.webkit.org/show_bug.cgi?id=162371
2730
2731         Reviewed by Saam Barati.
2732
2733         * stress/op-negate-inline-cache.js: Added.
2734
2735 2016-09-22  Mark Lam  <mark.lam@apple.com>
2736
2737         Array.prototype.join should do overflow checks on string joins.
2738         https://bugs.webkit.org/show_bug.cgi?id=162459
2739
2740         Reviewed by Saam Barati.
2741
2742         * stress/array-join-on-strings-need-overflow-checks.js: Added.
2743         (assert):
2744         (catch):
2745
2746 2016-09-22  Joseph Pecoraro  <pecoraro@apple.com>
2747
2748         test262: Function length should be number of parameters before parameters with default values
2749         https://bugs.webkit.org/show_bug.cgi?id=162377
2750
2751         Reviewed by Saam Barati.
2752
2753         * stress/es6-default-parameters.js:
2754         Add our own tests for function lengths with default parameters.
2755
2756         * test262.yaml:
2757         We now pass all dflt-length tests.
2758
2759 2016-09-20  Benjamin Poulain  <bpoulain@apple.com>
2760
2761         [JSC] Do not use EagerRun on tests counting recompilation
2762         https://bugs.webkit.org/show_bug.cgi?id=162248
2763
2764         Reviewed by Geoffrey Garen.
2765
2766         This patch adds defaultNoEagerRun to all the tests
2767         for which recompilation is the symptom of a bug.
2768         The reason is that an OSR Exit can be unrelated to the tested
2769         nodes when we are running in Eager mode.
2770
2771         * stress/arith-abs-on-various-types.js:
2772         * stress/arith-ceil-on-various-types.js:
2773         * stress/arith-clz32-on-various-types.js:
2774         * stress/arith-cos-on-various-types.js:
2775         * stress/arith-floor-on-various-types.js:
2776         * stress/arith-fround-on-various-types.js:
2777         * stress/arith-log-on-various-types.js:
2778         * stress/arith-round-on-various-types.js:
2779         * stress/arith-sin-on-various-types.js:
2780         * stress/arith-sqrt-on-various-types.js:
2781         * stress/arith-tan-on-various-types.js:
2782         * stress/arith-trunc-on-various-types.js:
2783
2784         * stress/compare-strict-eq-on-various-types.js:
2785         (testAllTypesCall):
2786         The value 2 came from the other tests.
2787         CompareStrictEq supports many more cases, the worst case
2788         is bool->int->int52->number->polymorphic.
2789
2790 2016-09-20  Filip Pizlo  <fpizlo@apple.com>
2791
2792         Make MarkedBlock state tracking support overlapped allocation and marking state
2793         https://bugs.webkit.org/show_bug.cgi?id=161581
2794
2795         Reviewed by Geoffrey Garen.
2796         
2797         Add a microbenchmark for why we want to reclaim empty blocks from other allocators.
2798
2799         * microbenchmarks/switching-size-classes.js: Added.
2800
2801 2016-09-20  Saam Barati  <sbarati@apple.com>
2802
2803         Unreviewed, added test for x86 32-bit failure for HasOwnProperty node in DFG.
2804
2805         * stress/has-own-property-called-on-non-object.js: Added.
2806         (let.objs):
2807         (new.String):
2808         (foo):
2809
2810 2016-09-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2811
2812         [JSC] Add `typeof value === "symbol"` handling to bytecode compiler
2813         https://bugs.webkit.org/show_bug.cgi?id=162253
2814
2815         Reviewed by Sam Weinig.
2816
2817         * microbenchmarks/is-symbol-mixed.js: Added.
2818         (isSymbol):
2819         (i.let.pair.of.list.String):
2820         * microbenchmarks/is-symbol.js: Added.
2821         (isSymbol):
2822
2823 2016-09-19  Saam Barati  <sbarati@apple.com>
2824
2825         Make HasOwnProperty faster
2826         https://bugs.webkit.org/show_bug.cgi?id=161708
2827
2828         Reviewed by Geoffrey Garen.
2829
2830         * microbenchmarks/has-own-property-name-cache.js: Added.
2831         (foo):
2832         * stress/has-own-property-cache-basics.js: Added.
2833         (assert):
2834         (foo):
2835         * stress/has-own-property-name-cache-string-keys.js: Added.
2836         (assert):
2837         (foo):
2838         * stress/has-own-property-name-cache-symbol-keys.js: Added.
2839         (assert):
2840         (foo):
2841         * stress/has-own-property-name-cache-symbols-and-strings.js: Added.
2842         (assert):
2843         (foo):
2844
2845 2016-09-19  Benjamin Poulain  <bpoulain@apple.com>
2846
2847         [JSC] Make the rounding-related nodes support any type
2848         https://bugs.webkit.org/show_bug.cgi?id=161895
2849
2850         Reviewed by Geoffrey Garen.
2851
2852         * stress/arith-ceil-on-various-types.js: Added.
2853         * stress/arith-floor-on-various-types.js: Added.
2854         * stress/arith-round-on-various-types.js: Added.
2855         * stress/arith-trunc-on-various-types.js: Added.
2856
2857 2016-09-18  Yusuke Suzuki  <utatane.tea@gmail.com>
2858
2859         [JSC] Do not need to use defineProperty to define methods for object literals
2860         https://bugs.webkit.org/show_bug.cgi?id=162111
2861
2862         Reviewed by Saam Barati.
2863
2864         * stress/object-literal-methods.js: Added.
2865         (shouldBe):
2866         (throw.new.Error.let.object.get name):
2867         (throw.new.Error):
2868         (shouldBe.let.object.get name):
2869         (shouldBe.let.object.get prototype):
2870         (shouldBe.let.object.get 42):
2871
2872 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2873
2874         [DFG] Introduce IsCellWithType node and unify IsJSArray, IsRegExpObject and newly added IsProxyObject
2875         https://bugs.webkit.org/show_bug.cgi?id=162000
2876
2877         Reviewed by Filip Pizlo.
2878
2879         * microbenchmarks/is-array-for-array.js: Added.
2880         (isArray):
2881         * microbenchmarks/is-array-for-mixed-case.js: Added.
2882         (isArray):
2883         * microbenchmarks/is-array-for-non-array-object.js: Added.
2884         (isArray):
2885         * microbenchmarks/is-array-for-proxy.js: Added.
2886         (isArray):
2887         (isArray.proxy.throw.new.Error.isArray):
2888         (isArray.proxy.throw.new.Error):
2889
2890 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2891
2892         Unreviewed, gardening test262 results
2893
2894         Some tests are now passed with JSC, but marked as failed.
2895
2896         * test262.yaml:
2897
2898 2016-09-16  Joseph Pecoraro  <pecoraro@apple.com>
2899
2900         test262: Various Constructors length properties should be configurable
2901         https://bugs.webkit.org/show_bug.cgi?id=161998
2902
2903         Reviewed by Saam Barati.
2904
2905         * test262.yaml:
2906
2907 2016-09-15  Commit Queue  <commit-queue@webkit.org>
2908
2909         Unreviewed, rolling out r205931.
2910         https://bugs.webkit.org/show_bug.cgi?id=162021
2911
2912         Tests for this change fail on 32-bit JSC bots (Requested by
2913         ryanhaddad on #webkit).
2914
2915         Reverted changeset:
2916
2917         "[JSC] Make the rounding-related nodes support any type"
2918         https://bugs.webkit.org/show_bug.cgi?id=161895
2919         http://trac.webkit.org/changeset/205931
2920
2921 2016-09-15  Joseph Pecoraro  <pecoraro@apple.com>
2922
2923         test262: Should be a SyntaxError for duplicate parameter names in function with default parameters
2924         https://bugs.webkit.org/show_bug.cgi?id=162013
2925
2926         Reviewed by Saam Barati.
2927
2928         * stress/es6-default-parameters.js:
2929         * test262.yaml:
2930
2931 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2932
2933         ASSERT_NOT_REACHED when using spread inside an array literal with Function.prototype.apply
2934         https://bugs.webkit.org/show_bug.cgi?id=162003
2935
2936         Reviewed by Saam Barati.
2937
2938         * stress/spread-calling.js:
2939         * test262.yaml:
2940
2941 2016-09-14  Michael Saboff  <msaboff@apple.com>
2942
2943         YARR doesn't check for invalid flags for literal regular expressions
2944         https://bugs.webkit.org/show_bug.cgi?id=161995
2945
2946         Reviewed by Mark Lam.
2947
2948         New test.
2949
2950         * stress/regress-161995.js: Added.
2951         (testStatic):
2952         (catch):
2953
2954 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2955
2956         test262: TypedArray constructors length should be 3 and configurable
2957         https://bugs.webkit.org/show_bug.cgi?id=161955
2958
2959         Reviewed by Mark Lam.
2960
2961         * test262.yaml:
2962
2963 2016-09-14  Benjamin Poulain  <bpoulain@apple.com>
2964
2965         [JSC] Make the rounding-related nodes support any type
2966         https://bugs.webkit.org/show_bug.cgi?id=161895
2967
2968         Reviewed by Geoffrey Garen.
2969
2970         * stress/arith-ceil-on-various-types.js: Added.
2971         * stress/arith-floor-on-various-types.js: Added.
2972         * stress/arith-round-on-various-types.js: Added.
2973         * stress/arith-trunc-on-various-types.js: Added.
2974
2975 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2976
2977         TaggedTemplateString function calls should emit tail position calls
2978         https://bugs.webkit.org/show_bug.cgi?id=161948
2979
2980         Reviewed by Yusuke Suzuki.
2981
2982         * stress/tail-call-recognize.js:
2983         (runTests):
2984         Ensure a tagged template string function call is tail call.
2985
2986         * test262.yaml:
2987         These now pass.
2988
2989 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2990
2991         test262: Array.prototype.slice should always set length
2992         https://bugs.webkit.org/show_bug.cgi?id=161953
2993
2994         Reviewed by Mark Lam.
2995
2996         * test262.yaml:
2997
2998 2016-09-13  JF Bastien  <jfbastien@apple.com>
2999
3000         Support jsc shell builtin `read`
3001         https://bugs.webkit.org/show_bug.cgi?id=161662
3002
3003         Reviewed by Keith Miller.
3004
3005         * stress/jsc-read.js: Added.
3006         (test): test `read` and `readFile` shell builtins, in string and binary mode.
3007
3008 2016-09-12  Skachkov Oleksandr  <gskachkov@gmail.com>
3009
3010         ES6: Classes: Should be allowed to create a static method with name "arguments"
3011         https://bugs.webkit.org/show_bug.cgi?id=152985
3012
3013         Reviewed by Keith Miller.
3014
3015         * test262.yaml:
3016
3017 2016-09-12  Saam Barati  <sbarati@apple.com>
3018
3019         Speed up Function.prototype.bind a bit by making it a builtin
3020         https://bugs.webkit.org/show_bug.cgi?id=161879
3021
3022         Reviewed by Filip Pizlo.
3023
3024         * microbenchmarks/function-bind-inlining.js: Added.
3025         (assert):
3026         (test):
3027         (test2):
3028         (foo):
3029         * microbenchmarks/function-bind-no-inlining.js: Added.
3030         (assert):
3031         (test):
3032         (test2):
3033         (foo):
3034
3035 2016-09-12  Saam Barati  <sbarati@apple.com>
3036
3037         HashMapImpl should take into account m_deleteCount in its load factor and it should be able to rehash the table to be smaller
3038         https://bugs.webkit.org/show_bug.cgi?id=161640
3039
3040         Reviewed by Geoffrey Garen.
3041
3042         * microbenchmarks/map-rehash.js: Added.
3043         * stress/map-delete.js: Added.
3044         (assert):
3045         * stress/map-rehash-2.js: Added.
3046         (assert):
3047         * stress/map-rehash.js: Added.
3048         (assert):
3049
3050 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3051
3052         Unreviewed, fix tests for different libm environments
3053         https://bugs.webkit.org/show_bug.cgi?id=161857
3054
3055         * stress/ftl-arithtan.js:
3056
3057 2016-09-12  Benjamin Poulain  <bpoulain@apple.com>
3058
3059         [JSC] Use GetArrayLength for JSArray.length even when the array type is undecided
3060         https://bugs.webkit.org/show_bug.cgi?id=161671
3061
3062         Reviewed by Geoffrey Garen.
3063
3064         * stress/get-array-length-on-undecided.js: Added.
3065
3066 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3067
3068         [DFG][FTL] Add ArithTan
3069         https://bugs.webkit.org/show_bug.cgi?id=161857
3070
3071         Reviewed by Filip Pizlo.
3072
3073         * microbenchmarks/tan.js: Added.
3074         * stress/arith-tan-on-various-types.js: Added.
3075         (let.validInputTypedTestCases.validInputTestCases.map):
3076         (isIdentical):
3077         (opaqueTanNoArgument):
3078         (testNoArgument):
3079         (opaqueAllTypesTan):
3080         (testAllTypesCall):
3081         (testTangleTypeCall):
3082         (testConstant):
3083         (opaqueTanForSideEffects):
3084         (testSideEffect.let.testObject.valueOf):
3085         (testSideEffect):
3086         (opaqueTanForCSE):
3087         (testCSE.let.testObject.valueOf):
3088         (testCSE):
3089         (opaqueTanForDCE):
3090         (testDCE.let.testObject.valueOf):
3091         (testDCE):
3092         (testException.opaqueTanWithException):
3093         (testException):
3094         * stress/ftl-arithtan.js: Added.
3095         (foo):
3096
3097 2016-09-12  Saam Barati  <sbarati@apple.com>
3098
3099         MapHash should do constant folding when it has a constant argument and its legal to hash that value
3100         https://bugs.webkit.org/show_bug.cgi?id=161639
3101
3102         Reviewed by Filip Pizlo.
3103
3104         * microbenchmarks/map-constant-key.js: Added.
3105         (assert):
3106         (test):
3107         (foo):
3108
3109 2016-09-12  Michael Saboff  <msaboff@apple.com>
3110
3111         JSC test timeout: ChakraCore.yaml/ChakraCore/test/Bugs/bug56026_trycatch.js.default
3112         https://bugs.webkit.org/show_bug.cgi?id=161863
3113
3114         Reviewed by Saam Barati.
3115
3116         * ChakraCore.yaml:
3117         Disabled Bugs/bug56026_trycatch.js.
3118
3119 2016-09-09  Michael Saboff  <msaboff@apple.com>
3120
3121         Unreviewed, rolling r205759 back in with a fix.
3122
3123         The expectation file, JSTests/ChakraCore/test/Lib/tostring.baseline-jsc,
3124         should be named "toString.baseline-jsc".
3125
3126         * ChakraCore/test/Lib/toString.baseline-jsc: Copied from JSTests/ChakraCore/test/Lib/tostring.baseline-jsc.
3127         * ChakraCore/test/Lib/tostring.baseline-jsc: Removed.
3128
3129 2016-09-09  Michael Saboff  <msaboff@apple.com>
3130
3131         Disable three flakey Chakra Tests
3132         https://bugs.webkit.org/show_bug.cgi?id=161807
3133
3134         Reviewed by Saam Barati.
3135
3136         * ChakraCore.yaml: Disabled the flakey tests
3137         ChakraCore/test/Array/protoLookup_native.js
3138         ChakraCore/test/LetConst/delete.js
3139         ChakraCore/test/fieldopts/fieldhoist_sideeffect.js
3140
3141 2016-09-08  Saam Barati  <sbarati@apple.com>
3142
3143         We should inline operationConvertJSValueToBoolean into JIT code
3144         https://bugs.webkit.org/show_bug.cgi?id=161729
3145
3146         Reviewed by Filip Pizlo.
3147
3148         * stress/value-to-boolean.js: Added.
3149         (assert):
3150         (test1):
3151         (test2):
3152         (test3):
3153
3154 2016-09-08  Mark Lam  <mark.lam@apple.com>
3155
3156         REGRESSION (r205569?): 32-bit JSC test timeout: stress/rest-parameter-many-arguments.js.dfg-maximal-flush-validate-no-cjit
3157         https://bugs.webkit.org/show_bug.cgi?id=161756
3158
3159         Reviewed by Saam Barati.
3160
3161         It looks like the 32-bit JSC bot is just too slow at running this test with the
3162         dfg-maximal-flush-validate-no-cjit configuration.  We'll try excluding that
3163         configuration.
3164
3165         * stress/rest-parameter-many-arguments.js:
3166
3167 2016-09-08  JF Bastien  <jfbastien@apple.com>
3168
3169         Delete older WebAssembly tests
3170         https://bugs.webkit.org/show_bug.cgi?id=161758
3171
3172         Reviewed by Filip Pizlo.
3173
3174         They're not running, rely on the older polyfill prototype, and the older code was deleted in: https://trac.webkit.org/changeset/204180
3175
3176         * stress/wasm-arithmetic-float32.js: Removed.
3177         * stress/wasm-arithmetic-float64.js: Removed.
3178         * stress/wasm-arithmetic-int32.js: Removed.
3179         * stress/wasm-calls.js: Removed.
3180         * stress/wasm-comma.js: Removed.
3181         * stress/wasm-control-flow.js: Removed.
3182         * stress/wasm-globals.js: Removed.
3183         * stress/wasm-linear-memory.js: Removed.
3184         * stress/wasm-locals.js: Removed.
3185         * stress/wasm-relational.js: Removed.
3186         * stress/wasm-type-conversion.js: Removed.
3187         * stress/wasm/arithmetic-float32.wasm: Removed.
3188         * stress/wasm/arithmetic-float64.wasm: Removed.
3189         * stress/wasm/arithmetic-int32.wasm: Removed.
3190         * stress/wasm/calls.wasm: Removed.
3191         * stress/wasm/comma.wasm: Removed.
3192         * stress/wasm/control-flow.wasm: Removed.
3193         * stress/wasm/globals.wasm: Removed.
3194         * stress/wasm/linear-memory.wasm: Removed.
3195         * stress/wasm/locals.wasm: Removed.
3196         * stress/wasm/relational.wasm: Removed.
3197         * stress/wasm/type-conversion.wasm: Removed.
3198
3199 2016-09-08  Per Arne Vollan  <pvollan@apple.com>
3200
3201         [Win] Exception fuzz tests fail
3202         https://bugs.webkit.org/show_bug.cgi?id=140928
3203
3204         Reviewed by Mark Lam.
3205
3206         Unskip tests.
3207
3208         * exceptionFuzz.yaml:
3209
3210 2016-09-06  Saam Barati  <sbarati@apple.com>
3211
3212         ProxyObject's structure should not have ObjectPrototype as its prototype and it should not have special behavior for intercepting "__proto__"
3213         https://bugs.webkit.org/show_bug.cgi?id=161558
3214
3215         Reviewed by Benjamin Poulain.
3216
3217         * stress/proxy-get-prototype-of.js:
3218         * stress/proxy-set-prototype-of.js:
3219         (let.handler.setPrototypeOf): Deleted.
3220         * stress/proxy-underscore-proto.js: Added.
3221         (assert):
3222
3223 2016-09-06  Saam Barati  <sbarati@apple.com>
3224
3225         Make JSMap and JSSet faster
3226         https://bugs.webkit.org/show_bug.cgi?id=160989
3227
3228         Reviewed by Filip Pizlo.
3229
3230         * microbenchmarks/dense-set.js: Added.
3231         (bench):
3232         * microbenchmarks/large-map-iteration-with-additions.js: Added.
3233         (bar):
3234         (foo):
3235         * microbenchmarks/large-map-iteration-with-mutation.js: Added.
3236         (bar):
3237         (foo):
3238         * microbenchmarks/large-map-iteration.js: Added.
3239         (bar):
3240         (foo):
3241         * microbenchmarks/map-get-get-cse.js: Added.
3242         (bar):
3243         (foo):
3244         * microbenchmarks/map-has-get-cse-opportunity.js: Added.
3245         (bar):
3246         (foo):
3247         * microbenchmarks/sparse-set.js: Added.
3248         (bench):
3249         * stress/map-cse-correctness.js: Added.
3250         (assert):
3251         (testHas):
3252         (testGet):
3253         (foo):
3254         * stress/map-iteration.js: Added.
3255         (assert):
3256         (test1):
3257         (test2):
3258         (test3):
3259         (test4):
3260         (test5):
3261         (test6):
3262         (test7):
3263         (test8):
3264         (test9):
3265         (test10):
3266         (test11):
3267         (test12):
3268         (test13):
3269         (test14):
3270         (test15):
3271         (test16):
3272         (test17):
3273         (test18):
3274
3275 2016-09-06  Benjamin Poulain  <bpoulain@apple.com>
3276
3277         [JSC] Make ArithClz32 work with Cell arguments
3278         https://bugs.webkit.org/show_bug.cgi?id=161369
3279
3280         Reviewed by Geoffrey Garen.
3281
3282         * stress/arith-clz32-on-various-types.js: Added.
3283
3284 2016-09-06  Commit Queue  <commit-queue@webkit.org>
3285
3286         Unreviewed, rolling out r205504.
3287         https://bugs.webkit.org/show_bug.cgi?id=161645
3288
3289         Broke the iOS device build (Requested by ryanhaddad on
3290         #webkit).
3291
3292         Reverted changeset:
3293
3294         "Make JSMap and JSSet faster"
3295         https://bugs.webkit.org/show_bug.cgi?id=160989
3296         http://trac.webkit.org/changeset/205504
3297
3298 2016-09-06  Saam Barati  <sbarati@apple.com>
3299
3300         Make JSMap and JSSet faster
3301         https://bugs.webkit.org/show_bug.cgi?id=160989
3302
3303         Reviewed by Filip Pizlo.
3304
3305         * microbenchmarks/dense-set.js: Added.
3306         (bench):
3307         * microbenchmarks/large-map-iteration-with-additions.js: Added.
3308         (bar):
3309         (foo):
3310         * microbenchmarks/large-map-iteration-with-mutation.js: Added.
3311         (bar):
3312         (foo):
3313         * microbenchmarks/large-map-iteration.js: Added.
3314         (bar):
3315         (foo):
3316         * microbenchmarks/map-get-get-cse.js: Added.
3317         (bar):
3318         (foo):
3319         * microbenchmarks/map-has-get-cse-opportunity.js: Added.
3320         (bar):
3321         (foo):
3322         * microbenchmarks/sparse-set.js: Added.
3323         (bench):
3324         * stress/map-cse-correctness.js: Added.
3325         (assert):
3326         (testHas):
3327         (testGet):
3328         (foo):
3329         * stress/map-iteration.js: Added.
3330         (assert):
3331         (test1):
3332         (test2):
3333         (test3):
3334         (test4):
3335         (test5):
3336         (test6):
3337         (test7):
3338         (test8):
3339         (test9):
3340         (test10):
3341         (test11):
3342         (test12):
3343         (test13):
3344         (test14):
3345         (test15):
3346         (test16):
3347         (test17):
3348         (test18):
3349
3350 2016-08-31  Filip Pizlo  <fpizlo@apple.com>
3351
3352         Butterflies should be allocated in Auxiliary MarkedSpace instead of CopiedSpace and we should rewrite as much of the GC as needed to make this not a regression
3353         https://bugs.webkit.org/show_bug.cgi?id=160125
3354
3355         Reviewed by Geoffrey Garen and Keith Miller.
3356         
3357         Most of the things I did properly covered by existing tests, but I found some simple cases of
3358         unshifting that had sketchy coverage.
3359
3360         * stress/array-storage-array-unshift.js: Added.
3361         * stress/contiguous-array-unshift.js: Added.
3362         * stress/double-array-unshift.js: Added.
3363         * stress/int32-array-unshift.js: Added.
3364
3365 2016-09-02  Michael Saboff  <msaboff@apple.com>
3366
3367         Unreviewed fix after importing Chakra test
3368
3369         * ChakraCore.yaml: Skipped ChakraCore/test/UnifiedRegex/crazy.js because the original
3370         test contained tab characters.  I removed the tabs before landing.  This test depended
3371         on the tab characters and now fails after they were removed.
3372         test.
3373
3374 2016-09-01  Michael Saboff  <msaboff@apple.com>
3375
3376         Import Chakra tests to JSC
3377         https://bugs.webkit.org/show_bug.cgi?id=154697
3378
3379         Reviewed by Saam Barati.
3380
3381         Added Chakra tests.  All these tests are under Chakra/test.  This is the same layout
3382         for tests in the Chakra tree.
3383
3384         Created a ChakraCore.yaml file to be used with run-jsc-stress-tests.  This file contains
3385         the tests that are run when the original Chakra runtests.py script is run.  That script
3386         is the test driver for *nix platforms and does not attempt to run all tests or all
3387         variations of tests.  The runtest.py driver consults rlexe.xml files in each test
3388         subdirectory to determine the test to run, the options to pass to the test and how to
3389         determine pass/fail of the test.  With runtests.py as the start, tests that didn't
3390         pass directly where either skipped, with a message describing why or through 
3391         adjustments to the test infrastructure, as described below, where made to pass.
3392         
3393         The only modification to the test infrastrucutre are:
3394
3395          1) Added simple mapping of Chakra expected exception text to JSC expected text in
3396             test/UnitTestFramework/UnitTestFramework.js.  It would make sense to also
3397             map some JSC specific exception text to more generic text for the cases where
3398             that text contains indetifier names or other source specific strings and the
3399             Chakra equivolent exception texts are generic.  
3400  
3401          2) Created JSC specific expected text files where it is clear that the text work
3402             as expected on JSC but the test output is different.  Typically the differences
3403             fall into three categories, different exception output, different output from
3404             toString() of a function, slight numeric differences, and test that rely on
3405             iteration order.
3406
3407          3) Stripped the CR's from the CR-LF line terminations of the files.  
3408
3409         No actual test .js files were modified.
3410
3411         * ChakraCore: Added.
3412         * ChakraCore.yaml: Added.
3413         * ChakraCore/CONTRIBUTING.md: Added.
3414         * ChakraCore/LICENSE.txt: Added.
3415         * ChakraCore/README.md: Added.
3416         * ChakraCore/THIRD-PARTY-NOTICES.txt: Added.
3417         * ChakraCore/test: Added this directory and the tests included therein.
3418
3419 2016-09-01  JF Bastien  <jfbastien@apple.com>
3420
3421         GetByIdWithThis/GetByValWithThis should have ValueProfiles so that they can predict their result types
3422         https://bugs.webkit.org/show_bug.cgi?id=160922
3423
3424         Reviewed by Keith Miller.
3425
3426         Benchmark GetBy{Id,Val}WithThis in monomorphic and polymorphic uses.
3427         The value profile is used by the calc functions, which do some mild math with the result.
3428         These benchmarks get ~4% faster with value profiling.
3429
3430         * microbenchmarks/super-get-by-id-with-this-monomorphic.js: Added.
3431         (A):
3432         (A.prototype.set value):
3433         (A.prototype.get value):
3434         (B.prototype.set value):
3435         (B.prototype.get value):
3436         (B):
3437         (const.bench):
3438         * microbenchmarks/super-get-by-id-with-this-polymorphic.js: Added.
3439         (A):
3440         (A.prototype.set value):
3441         (A.prototype.get value):
3442         (B.prototype.set value):
3443         (B.prototype.get value):
3444         (B):
3445         (const.bench):
3446         * microbenchmarks/super-get-by-val-with-this-monomorphic.js: Added.
3447         (value):
3448         (A):
3449         (A.prototype.set v):
3450         (A.prototype.get v):
3451         (B.prototype.set v):
3452         (B.prototype.get v):
3453         (B):
3454         (const.bench):
3455         * microbenchmarks/super-get-by-val-with-this-polymorphic.js: Added.
3456         (value):
3457         (A):
3458         (A.prototype.set v):
3459         (A.prototype.get v):
3460         (B.prototype.set v):
3461         (B.prototype.get v):
3462         (B):
3463         (const.bench):
3464
3465 2016-09-01  Benjamin Poulain  <bpoulain@apple.com>
3466
3467         arith-abs-on-various-types.js is flaky
3468
3469         Unreviewed.
3470
3471         * stress/arith-abs-on-various-types.js:
3472         Two compilation is too small for the worst case.
3473         Math.abs() can be typed integer->number->untyped if we are very unlucky.
3474
3475 2016-09-01  Filip Pizlo  <fpizlo@apple.com>
3476
3477         ObjectAllocationSinkingPhase::insertOSRHintsForUpdate() fails to emit updated hints in some cases
3478         https://bugs.webkit.org/show_bug.cgi?id=161492
3479
3480         Reviewed by Mark Lam.
3481         
3482         This bug affected function->activation references but not object->object field references,
3483         because object->object field references are !neededForMaterialization(). So, the object
3484         test always passed but the activation/function test used to always fail. It passes now.
3485
3486         * stress/materialize-activation-referenced-from-phantom-function.js: Added.
3487         (bar):
3488         (inc):
3489         (dec):
3490         (foo):
3491         (test):
3492         * stress/materialize-object-referenced-from-phantom-object.js: Added.
3493         (bar):
3494         (foo):
3495         (test):
3496
3497 2016-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3498
3499         stress/random-53bit.js.ftl-no-cjit-no-inline-validate sometimes fails
3500         https://bugs.webkit.org/show_bug.cgi?id=161436
3501
3502         Reviewed by Filip Pizlo.
3503
3504         The test checks Math.random() correctly produces 53bit random values.
3505         The test can fail by design, but this should be fairly rare.
3506
3507         However, when introducing, we wrap the `test()` with 1e4 to ensure the FTL compilation, and this
3508         increases the failure rate. By increasing the MAX in the test, we make the failures much more rare case.
3509
3510         And we also add getRandomSeed() and setRandomSeed(seed) JSC shell helpers to dump more useful information
3511         and reproduce the situation easily.
3512
3513         * stress/random-53bit.js:
3514         (test):
3515
3516 2016-08-29  Benjamin Poulain  <bpoulain@apple.com>
3517
3518         [JSC] Improve ArithAbs with polymorphic input
3519         https://bugs.webkit.org/show_bug.cgi?id=161286
3520
3521         Reviewed by Saam Barati.
3522
3523         * stress/arith-abs-on-various-types.js: Added.
3524         New tests.
3525
3526         * stress/arith-cos-on-various-types.js:
3527         * stress/arith-fround-on-various-types.js:
3528         * stress/arith-log-on-various-types.js:
3529         * stress/arith-sin-on-various-types.js:
3530         * stress/arith-sqrt-on-various-types.js:
3531         Extend the existing tests to cover the DCE case.
3532
3533 2016-08-26  Benjamin Poulain  <benjamin@webkit.org>
3534
3535         [JSC] Implement CompareStrictEq(String, Untyped) in FTL
3536         https://bugs.webkit.org/show_bug.cgi?id=161229
3537
3538         Reviewed by Geoffrey Garen.
3539
3540         * stress/compare-strict-eq-on-various-types.js: Added.
3541
3542 2016-08-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3543
3544         [ES6] newPromiseCapabilities should check the given argument is constructor
3545         https://bugs.webkit.org/show_bug.cgi?id=161226
3546
3547         Reviewed by Mark Lam.
3548
3549         The arrow function should not be a constructor. So the error should be raised.
3550
3551         * stress/new-promise-capabilities-requires-constructor.js: Added.
3552         (shouldThrow):
3553
3554 2016-08-25  Benjamin Poulain  <bpoulain@apple.com>
3555
3556         [JSC] Clean up the abstract interpreter for cos/sin/sqrt/fround/log
3557         https://bugs.webkit.org/show_bug.cgi?id=161181
3558
3559         Reviewed by Geoffrey Garen.
3560
3561         Extend the tests to constants.
3562         Add no-argument cases where needed.
3563
3564         * stress/arith-cos-on-various-types.js:
3565         * stress/arith-fround-on-various-types.js:
3566         * stress/arith-log-on-various-types.js:
3567         * stress/arith-sin-on-various-types.js:
3568         * stress/arith-sqrt-on-various-types.js:
3569
3570 2016-08-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3571
3572         [DFG][FTL] Implement ES6 Generators in DFG / FTL
3573         https://bugs.webkit.org/show_bug.cgi?id=152723
3574
3575         Reviewed by Filip Pizlo.
3576
3577         * stress/generator-fib-ftl-and-array.js: Added.
3578         (fib):
3579         * stress/generator-fib-ftl-and-object.js: Added.
3580         (fib):
3581         * stress/generator-fib-ftl-and-string.js: Added.
3582         (fib):
3583         * stress/generator-fib-ftl.js: Added.
3584         (fib):
3585         * stress/generator-frame-empty.js: Added.
3586         (shouldThrow):
3587         (shouldThrow.fib):
3588         * stress/generator-reduced-save-point-put-to-scope.js: Added.
3589         (shouldBe):
3590         (gen):
3591         * stress/generator-transfer-register-beyond-mutiple-yields.js: Added.
3592         (shouldBe):
3593         (gen):
3594
3595 2016-08-25  JF Bastien  <jfbastien@apple.com>
3596
3597         TryGetById should have a ValueProfile so that it can predict its output type
3598         https://bugs.webkit.org/show_bug.cgi?id=160921
3599
3600         Reviewed by Saam Barati.
3601
3602         * microbenchmarks/try-get-by-id-basic.js: Added.
3603         (const.check):
3604         (const.bench.f.const.fooPlusBar.createBuiltin):
3605         * microbenchmarks/try-get-by-id-polymorphic.js: Added.
3606         (const.check):
3607         (fooPlusBar.createBuiltin):
3608         (bench):
3609
3610 2016-08-25  Caio Lima  <ticaiolima@gmail.com>
3611
3612         NewRegexp should not prevent inlining
3613         https://bugs.webkit.org/show_bug.cgi?id=154808
3614
3615         Reviewed by Geoffrey Garen.
3616
3617         Added test where functions with NewRegExp can be inlined right now.
3618
3619         * stress/new-regex-inline.js: Added.
3620         (assert):
3621         (testRegexpInline):
3622         (toInlineGlobal):
3623         (withRegexp):
3624         (inlineRegexpNotGlobal):
3625         (toInlineRecursive):
3626         (regexpContainsRecursive):
3627
3628 2016-08-24  Benjamin Poulain  <benjamin@webkit.org>
3629
3630         [JSC] Make FRound work with any type
3631         https://bugs.webkit.org/show_bug.cgi?id=161129
3632
3633         Reviewed by Geoffrey Garen.
3634
3635         * stress/arith-fround-on-various-types.js: Added.
3636
3637 2016-08-24  Filip Pizlo  <fpizlo@apple.com>
3638
3639         Unreviewed, roll out r204901, r204897, r204866, r204856, r204854.
3640
3641         * stress/array-storage-array-unshift.js: Removed.
3642         * stress/contiguous-array-unshift.js: Removed.
3643         * stress/double-array-unshift.js: Removed.
3644         * stress/int32-array-unshift.js: Removed.
3645
3646 2016-08-24  Skachkov Oleksandr  <gskachkov@gmail.com>
3647
3648         [ES2016] Allow assignment in for-in head in not-strict mode
3649         https://bugs.webkit.org/show_bug.cgi?id=160955
3650
3651         Reviewed by Saam Barati.
3652
3653         * stress/for-in-tests.js:
3654         (foo):
3655         (boo):
3656         (catch):
3657
3658 2016-08-23  Benjamin Poulain  <benjamin@webkit.org>
3659
3660         [JSC] Make ArithLog works with any type
3661         https://bugs.webkit.org/show_bug.cgi?id=161110
3662
3663         Reviewed by Geoffrey Garen.
3664
3665         * stress/arith-log-on-various-types.js: Added.
3666
3667 2016-08-23  Saam Barati  <sbarati@apple.com>
3668
3669         JSC should have a "microbenchmarks" directory instead of "regress" directory
3670         https://bugs.webkit.org/show_bug.cgi?id=161096
3671
3672         Rubber stamped by Mark Lam.
3673
3674         * microbenchmarks: Copied from LayoutTests/js/regress/script-tests.
3675
3676 2016-08-23  Keith Miller  <keith_miller@apple.com>
3677
3678         %TypedArray%.prototype.slice needs to check that the source and destination have not been detached.
3679         https://bugs.webkit.org/show_bug.cgi?id=161031
3680         <rdar://problem/27937019>
3681
3682         Reviewed by Geoffrey Garen.
3683
3684         * stress/typedarray-slice.js:
3685         (get let):
3686         (get try):
3687         (testSpeciesWithTransferring):
3688
3689 2016-08-22  Filip Pizlo  <fpizlo@apple.com>
3690
3691         Butterflies should be allocated in Auxiliary MarkedSpace instead of CopiedSpace and we should rewrite as much of the GC as needed to make this not a regression
3692         https://bugs.webkit.org/show_bug.cgi?id=160125
3693
3694         Reviewed by Geoffrey Garen.
3695         
3696         Most of the things I did properly covered by existing tests, but I found some simple cases of
3697         unshifting that had sketchy coverage.
3698
3699         * stress/array-storage-array-unshift.js: Added.
3700         * stress/contiguous-array-unshift.js: Added.
3701         * stress/double-array-unshift.js: Added.
3702         * stress/int32-array-unshift.js: Added.
3703
3704 2016-08-23  Keith Miller  <keith_miller@apple.com>
3705
3706         Update/add new test262 tests
3707         https://bugs.webkit.org/show_bug.cgi?id=161098
3708
3709         Reviewed by Saam Barati.
3710
3711         * test262.yaml:
3712         * test262/test/annexB/language/statements/for-in/bare-initializer.js: Added.
3713         * test262/test/annexB/language/statements/for-in/const-initializer.js: Added.
3714         * test262/test/annexB/language/statements/for-in/let-initializer.js: Added.
3715         * test262/test/annexB/language/statements/for-in/nonstrict-initializer.js: Added.