305ac086befcb368338311cdf2d29d81906c2976
[WebKit-https.git] / JSTests / ChangeLog
1 2018-01-13  Caio Lima  <ticaiolima@gmail.com>
2
3         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
4         https://bugs.webkit.org/show_bug.cgi?id=181182
5
6         Reviewed by Darin Adler.
7
8         * bigIntTests.yaml:
9         * stress/big-int-constructor.js:
10         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
11         (assert):
12         (assertThrowRangeError):
13         * stress/number-prototype-to-string-cast-overflow.js: Added.
14         (assert):
15         (assertThrowRangeError):
16
17 2018-01-12  Saam Barati  <sbarati@apple.com>
18
19         CheckStructure can be incorrectly subsumed by CheckStructureOrEmpty
20         https://bugs.webkit.org/show_bug.cgi?id=181177
21         <rdar://problem/36205704>
22
23         Reviewed by Yusuke Suzuki.
24
25         * stress/check-structure-ir-ensures-empty-does-not-flow-through.js: Added.
26         (runNearStackLimit.t):
27         (runNearStackLimit):
28         (test.f):
29         (test):
30
31 2018-01-12  Saam Barati  <sbarati@apple.com>
32
33         Each variant of a polymorphic inlined call should be exitOK at the top of the block
34         https://bugs.webkit.org/show_bug.cgi?id=181562
35         <rdar://problem/36445624>
36
37         Reviewed by Yusuke Suzuki.
38
39         * stress/each-block-at-top-of-polymorphic-call-inlining-should-be-exitOK.js: Added.
40         (f):
41         (foo):
42
43 2018-01-11  Saam Barati  <sbarati@apple.com>
44
45         When inserting Unreachable in byte code parser we need to flush all the right things
46         https://bugs.webkit.org/show_bug.cgi?id=181509
47         <rdar://problem/36423110>
48
49         Reviewed by Mark Lam.
50
51         * stress/proper-flushing-when-we-insert-unreachable-after-force-exit-in-bytecode-parser.js: Added.
52
53 2018-01-11  Saam Barati  <sbarati@apple.com>
54
55         JITMathIC code in the FTL is wrong when code gets duplicated
56         https://bugs.webkit.org/show_bug.cgi?id=181525
57         <rdar://problem/36351993>
58
59         Reviewed by Michael Saboff and Keith Miller.
60
61         * stress/allow-math-ic-b3-code-duplication.js: Added.
62
63 2018-01-11  Saam Barati  <sbarati@apple.com>
64
65         Our for-in caching is wrong when we add indexed properties on things in the prototype chain
66         https://bugs.webkit.org/show_bug.cgi?id=181508
67
68         Reviewed by Yusuke Suzuki.
69
70         * stress/for-in-prototype-with-indexed-properties-should-prevent-caching.js: Added.
71         (assert):
72         (test1.foo):
73         (test1):
74         (test2.foo):
75         (test2):
76
77 2018-01-09  Mark Lam  <mark.lam@apple.com>
78
79         ASSERTION FAILED: pair.second->m_type & PropertyNode::Getter
80         https://bugs.webkit.org/show_bug.cgi?id=181388
81         <rdar://problem/36349351>
82
83         Reviewed by Saam Barati.
84
85         * stress/regress-181388.js: Added.
86
87 2018-01-08  JF Bastien  <jfbastien@apple.com>
88
89         WebAssembly: mask indexed accesses to Table
90         https://bugs.webkit.org/show_bug.cgi?id=181412
91         <rdar://problem/36363236>
92
93         Reviewed by Saam Barati.
94
95         Update error messages.
96
97         * wasm/js-api/table.js:
98         (assert.throws.WebAssembly.Table.prototype.grow):
99
100 2018-01-08  Ryan Haddad  <ryanhaddad@apple.com>
101
102         Disable SharedArrayBuffer tests missed in r226386.
103         https://bugs.webkit.org/show_bug.cgi?id=181266
104
105         Unreviewed test gardening.
106
107         * test262.yaml:
108
109 2018-01-06  Yusuke Suzuki  <utatane.tea@gmail.com>
110
111         Object.getOwnPropertyNames includes "arguments" and "caller" for bound functions
112         https://bugs.webkit.org/show_bug.cgi?id=181321
113
114         Reviewed by Saam Barati.
115
116         * stress/bound-function-does-not-have-caller-and-arguments.js: Added.
117         (shouldBe):
118         (testFunction):
119         * test262.yaml:
120
121 2018-01-05  Ryan Haddad  <ryanhaddad@apple.com>
122
123         Unreviewed, attempt to fix test262 after r226386.
124
125         * test262.yaml:
126
127 2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>
128
129         [DFG] Define defs for MapSet/SetAdd to participate in CSE
130         https://bugs.webkit.org/show_bug.cgi?id=179911
131
132         Reviewed by Saam Barati.
133
134         In addition to these tests, map-set-cse.js and set-add-cse.js work.
135
136         * stress/map-set-change-get.js: Added.
137         (shouldBe):
138         (test):
139         * stress/map-set-create-bucket.js: Added.
140         (shouldBe):
141         (test):
142         * stress/set-add-create-bucket.js: Added.
143         (shouldBe):
144
145 2018-01-03  Michael Saboff  <msaboff@apple.com>
146
147         Disable SharedArrayBuffers from Web API
148         https://bugs.webkit.org/show_bug.cgi?id=181266
149
150         Reviewed by Saam Barati.
151
152         Disabled SharedArrayBuffer tests.
153
154         * stress/SharedArrayBuffer-opt.js:
155         * stress/SharedArrayBuffer.js:
156         * stress/array-buffer-byte-length.js:
157         * stress/atomics-add-uint32.js:
158         * stress/atomics-known-int-use.js:
159         * stress/atomics-neg-zero.js:
160         * stress/atomics-store-return.js:
161         * stress/lars-sab-workers.js:
162         * stress/regress-159779-1.js:
163         * stress/regress-159779-2.js:
164         * stress/regress-170473.js:
165         * test262.yaml:
166
167 2018-01-03  Caio Lima  <ticaiolima@gmail.com>
168
169         [ESNext][BigInt] Failing test stress/big-int-constructor-oom.js into MIPS
170         https://bugs.webkit.org/show_bug.cgi?id=181258
171
172         Reviewed by Antonio Gomes.
173
174         * stress/big-int-constructor-gc.js:
175         * stress/big-int-constructor-oom.js:
176
177 2018-01-03  Robin Morisset  <rmorisset@apple.com>
178
179         Inlining of a function that ends in op_unreachable crashes
180         https://bugs.webkit.org/show_bug.cgi?id=181027
181
182         Reviewed by Filip Pizlo.
183
184         * stress/inlining-unreachable.js: Added.
185         (bar):
186         (baz):
187         (i.catch):
188
189 2018-01-02  Saam Barati  <sbarati@apple.com>
190
191         Incorrect assertion inside AccessCase
192         https://bugs.webkit.org/show_bug.cgi?id=181200
193         <rdar://problem/35494754>
194
195         Reviewed by Yusuke Suzuki.
196
197         * stress/setter-same-base-and-rhs-invalid-assertion-inside-access-case.js: Added.
198         (ctor):
199         (theFunc):
200         (run):
201
202 2018-01-02  Caio Lima  <ticaiolima@gmail.com>
203
204         [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
205         https://bugs.webkit.org/show_bug.cgi?id=175359
206
207         Reviewed by Yusuke Suzuki.
208
209         * bigIntTests.yaml:
210         * stress/big-int-as-key.js: Added.
211         * stress/big-int-constructor-gc.js: Added.
212         * stress/big-int-constructor-oom.js: Added.
213         * stress/big-int-constructor-properties.js: Added.
214         * stress/big-int-constructor-prototype-prop-descriptor.js: Added.
215         * stress/big-int-constructor-prototype.js: Added.
216         * stress/big-int-constructor.js: Added.
217         * stress/big-int-function-apply.js:
218         * stress/big-int-length.js: Added.
219         * stress/big-int-prop-descriptor.js: Added.
220         * stress/big-int-proto-constructor.js: Added.
221         * stress/big-int-proto-name.js: Added.
222         * stress/big-int-prototype-properties.js: Added.
223         * stress/big-int-prototype-proto.js: Added.
224         * stress/big-int-prototype-value-of.js: Added.
225         * stress/big-int-prototype-symbol-to-string-tag.js: Added.
226         * stress/big-int-prototype-to-string-apply.js: Added.
227         * stress/big-int-to-object.js: Added.
228         * stress/big-int-to-string.js: Added.
229
230 2017-12-28  Saam Barati  <sbarati@apple.com>
231
232         Assertion used to determine if something is an async generator is wrong
233         https://bugs.webkit.org/show_bug.cgi?id=181168
234         <rdar://problem/35640560>
235
236         Reviewed by Yusuke Suzuki.
237
238         * stress/async-generator-assertion.js: Added.
239
240 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
241
242         Skip stress/splay-flash-access tests on memory limited platforms
243         https://bugs.webkit.org/show_bug.cgi?id=181086
244
245         Reviewed by Carlos Alberto Lopez Perez.
246
247         These tests use about 185M of memory, and occasionally get OOM-killed
248         on memory limited platforms.
249
250         * stress/splay-flash-access-1ms.js:
251         * stress/splay-flash-access.js:
252
253 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
254
255         Skip slow jsc tests on embedded platforms
256         https://bugs.webkit.org/show_bug.cgi?id=180937
257
258         Reviewed by Carlos Alberto Lopez Perez.
259
260         The tests typeProfiler/deltablue-for-of.js and
261         typeProfiler/getter-richards.js take a very long time in the
262         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
263         thus always timeout. They should be skipped on these platforms.
264
265         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
266         * typeProfiler/getter-richards.js: Skip on arm*/mips.
267
268 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
269
270         [JSC] Do not check isValid() in op_new_regexp
271         https://bugs.webkit.org/show_bug.cgi?id=180970
272
273         Reviewed by Saam Barati.
274
275         * stress/regexp-syntax-error-invalid-flags.js: Added.
276         (shouldThrow):
277
278 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
279
280         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
281         https://bugs.webkit.org/show_bug.cgi?id=180712
282
283         Reviewed by Michael Catanzaro.
284
285         stress/call-apply-exponential-bytecode-size.js crashes if the
286         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
287         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
288         should skip the test on other platforms.
289
290         * stress/call-apply-exponential-bytecode-size.js:
291
292 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
293
294         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
295         https://bugs.webkit.org/show_bug.cgi?id=179762
296
297         Reviewed by Saam Barati.
298
299         * stress/call-varargs-double-new-array-buffer.js: Added.
300         (assert):
301         (bar):
302         (foo):
303         * stress/call-varargs-spread-new-array-buffer.js: Added.
304         (assert):
305         (bar):
306         (foo):
307         * stress/call-varargs-spread-new-array-buffer2.js: Added.
308         (assert):
309         (bar):
310         (foo):
311         * stress/forward-varargs-double-new-array-buffer.js: Added.
312         (assert):
313         (test.baz):
314         (test.bar):
315         (test.foo):
316         (test):
317         * stress/new-array-buffer-sinking-osrexit.js: Added.
318         (target):
319         (test):
320         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
321         (shouldBe):
322         (test):
323         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
324         (shouldBe):
325         (target):
326         (test):
327         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
328         (assert):
329         (test1.bar):
330         (test1.foo):
331         (test1):
332         (test2.bar):
333         (test2.foo):
334         (test3.baz):
335         (test3.bar):
336         (test3.foo):
337         (test4.baz):
338         (test4.bar):
339         (test4.foo):
340         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
341         (assert):
342         (test.baz):
343         (test.bar):
344         (test.foo):
345         (test):
346         * stress/phantom-new-array-buffer-osr-exit.js: Added.
347         (assert):
348         (baz):
349         (bar):
350         (effects):
351         (foo):
352
353 2017-12-14  Saam Barati  <sbarati@apple.com>
354
355         The CleanUp after LICM is erroneously removing a Check
356         https://bugs.webkit.org/show_bug.cgi?id=180852
357         <rdar://problem/36063494>
358
359         Reviewed by Filip Pizlo.
360
361         * stress/dont-run-cleanup-after-licm.js: Added.
362
363 2017-12-14  Michael Saboff  <msaboff@apple.com>
364
365         REGRESSION (r225695): Repro crash on yahoo login page
366         https://bugs.webkit.org/show_bug.cgi?id=180761
367
368         Reviewed by JF Bastien.
369
370         New regression test.
371
372         * stress/regress-180761.js: Added.
373
374 2017-12-13  Keith Miller  <keith_miller@apple.com>
375
376         JSObjects should have a mask for loading indexed properties
377         https://bugs.webkit.org/show_bug.cgi?id=180768
378
379         Reviewed by Mark Lam.
380
381         * stress/int16-put-by-val-in-and-out-of-bounds.js:
382         (test):
383
384 2017-12-13  Saam Barati  <sbarati@apple.com>
385
386         Arrow functions need their own structure because they have different properties than sloppy functions
387         https://bugs.webkit.org/show_bug.cgi?id=180779
388         <rdar://problem/35814591>
389
390         Reviewed by Mark Lam.
391
392         * stress/arrow-function-needs-its-own-structure.js: Added.
393         (assert):
394         (readPrototype):
395         (noInline.let.f1):
396         (noInline):
397
398 2017-12-13  Saam Barati  <sbarati@apple.com>
399
400         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
401         https://bugs.webkit.org/show_bug.cgi?id=163579
402         <rdar://problem/35455798>
403
404         Reviewed by Mark Lam.
405
406         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
407         (assert):
408         (test1):
409         (i.test1):
410         (i.test1.C):
411         (i.test1.async.foo):
412         (i.test1.foo):
413         (test2):
414
415 2017-12-13  Saam Barati  <sbarati@apple.com>
416
417         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
418         https://bugs.webkit.org/show_bug.cgi?id=180734
419         <rdar://problem/35640547>
420
421         Reviewed by Yusuke Suzuki.
422
423         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
424         (__isPropertyOfType):
425         (__getProperties):
426         (__getObjects):
427         (__getRandomObject):
428         (theClass.):
429         (theClass):
430         (childClass):
431         (counter.catch):
432
433 2017-12-12  Saam Barati  <sbarati@apple.com>
434
435         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
436         https://bugs.webkit.org/show_bug.cgi?id=180725
437         <rdar://problem/35970511>
438
439         Reviewed by Michael Saboff.
440
441         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
442         (f1):
443         (f2):
444         (let.o2.valueOf):
445
446 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
447
448         [JSC] Implement optimized WeakMap and WeakSet
449         https://bugs.webkit.org/show_bug.cgi?id=179929
450
451         Reviewed by Saam Barati.
452
453         * microbenchmarks/weak-map-key.js:
454         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
455         (assert):
456         (objectKey):
457         (let.start.Date.now):
458         * stress/basic-weakmap.js: Added.
459         (shouldBe):
460         (test):
461         * stress/basic-weakset.js: Added.
462         (shouldBe):
463         (test.set new):
464         * stress/weakmap-cse-set-break.js: Added.
465         (shouldBe):
466         (test):
467         * stress/weakmap-cse.js: Added.
468         (shouldBe):
469         (test):
470         * stress/weakmap-gc.js: Added.
471         (test):
472         * stress/weakset-cse-add-break.js: Added.
473         (shouldBe):
474         (test.set new):
475         * stress/weakset-cse.js: Added.
476         (shouldBe):
477         (test.set new):
478         * stress/weakset-gc.js: Added.
479         (test.set add):
480         (test.set new):
481         (test):
482
483 2017-12-12  Saam Barati  <sbarati@apple.com>
484
485         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
486         https://bugs.webkit.org/show_bug.cgi?id=180723
487         <rdar://problem/35859726>
488
489         Reviewed by JF Bastien.
490
491         * stress/get-my-argument-by-val-constant-folding.js: Added.
492         (test):
493         (catch):
494
495 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
496
497         [ESNext][BigInt] Implement BigInt literals and JSBigInt
498         https://bugs.webkit.org/show_bug.cgi?id=179000
499
500         Reviewed by Darin Adler and Yusuke Suzuki.
501
502         * bigIntTests.yaml: Added.
503         * stress/big-int-literal-line-terminator.js: Added.
504         * stress/big-int-literals.js: Added.
505         * stress/big-int-operations-error.js: Added.
506         * stress/big-int-type-of.js: Added.
507         * stress/big-int-white-space-trailing-leading.js: Added.
508         * stress/big-int-function-apply.js: Added.
509
510 2017-12-11  Saam Barati  <sbarati@apple.com>
511
512         We need to disableCaching() in ErrorInstance when we materialize properties
513         https://bugs.webkit.org/show_bug.cgi?id=180343
514         <rdar://problem/35833002>
515
516         Reviewed by Mark Lam.
517
518         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
519         (assert):
520         (makeError):
521         (storeToStack):
522         (storeToStackAlreadyMaterialized):
523
524 2017-12-05  JF Bastien  <jfbastien@apple.com>
525
526         WebAssembly: don't eagerly checksum
527         https://bugs.webkit.org/show_bug.cgi?id=180441
528         <rdar://problem/35156628>
529
530         Reviewed by Saam Barati.
531
532         Checksum is now disabled, so tests only have <?> as the module
533         name.
534
535         * wasm/function-tests/nameSection.js:
536         * wasm/function-tests/stack-overflow.js:
537         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
538         (assertOverflows.assertThrows):
539         (assertOverflows):
540         * wasm/function-tests/stack-trace.js:
541
542 2017-12-04  JF Bastien  <jfbastien@apple.com>
543
544         Proxy all functions, except the $ objects
545         https://bugs.webkit.org/show_bug.cgi?id=180375
546
547         Reviewed by Saam Barati.
548
549         It looks like this test may have broken some executions because I
550         call some internal objects. Explicitly ignore objects whose name
551         starts with "$" because it's a bad idea anyways.
552
553         * stress/proxy-all-the-parameters.js:
554         (generateObjects):
555         (get throw):
556
557 2017-12-04  Saam Barati  <sbarati@apple.com>
558
559         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
560         https://bugs.webkit.org/show_bug.cgi?id=180366
561         <rdar://problem/35685877>
562
563         Reviewed by Michael Saboff.
564
565         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
566         (theParent):
567         (test1.base.getParentStaticValue):
568         (test1.base):
569         (test1.__v_24888.prototype.set prop):
570         (test1.__v_24888):
571         (test2.base.getParentStaticValue):
572         (test2.base):
573         (test2.__v_24888.prototype.set prop):
574         (test2.__v_24888):
575         (test2):
576
577 2017-12-01  JF Bastien  <jfbastien@apple.com>
578
579         Try proxying all function arguments
580         https://bugs.webkit.org/show_bug.cgi?id=180306
581
582         Reviewed by Saam Barati.
583
584         * stress/proxy-all-the-parameters.js: Added.
585         (isPropertyOfType):
586         (getProperties):
587         (generateObjects):
588         (getObjects):
589         (getFunctions):
590         (get throw):
591         (let.o.of.getObjects.let.f.of.getFunctions.catch):
592
593 2017-12-01  JF Bastien  <jfbastien@apple.com>
594
595         JavaScriptCore: missing exception checks in Math functions that take more than one argument
596         https://bugs.webkit.org/show_bug.cgi?id=180297
597         <rdar://problem/35745556>
598
599         Reviewed by Mark Lam.
600
601         * stress/math-exceptions.js: Added.
602         (get try):
603         (catch):
604
605 2017-12-01  JF Bastien  <jfbastien@apple.com>
606
607         JavaScriptCore: add test for weird class static getters
608         https://bugs.webkit.org/show_bug.cgi?id=180281
609         <rdar://problem/35592139>
610
611         Reviewed by Mark Lam.
612
613         I fixed a bug for it in r224927 and didn't add a test. Do so.
614
615         * stress/class-static-get-weird.js: Added.
616         (c.prototype.get name):
617         (c):
618         (c.prototype.get arguments):
619         (c.prototype.get caller):
620         (c.prototype.get length):
621
622 2017-12-01  Saam Barati  <sbarati@apple.com>
623
624         Having a bad time needs to handle ArrayClass indexing type as well
625         https://bugs.webkit.org/show_bug.cgi?id=180274
626         <rdar://problem/35667869>
627
628         Reviewed by Keith Miller and Mark Lam.
629
630         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
631         (assert):
632         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
633         (assert):
634
635 2017-12-01  JF Bastien  <jfbastien@apple.com>
636
637         WebAssembly: restore cached stack limit after out-call
638         https://bugs.webkit.org/show_bug.cgi?id=179106
639         <rdar://problem/35337525>
640
641         Reviewed by Saam Barati.
642
643         * wasm/function-tests/double-instance.js: Added.
644         (const.imp.boom):
645         (const.imp.get callAnother):
646
647 2017-11-30  JF Bastien  <jfbastien@apple.com>
648
649         WebAssembly: improve stack trace
650         https://bugs.webkit.org/show_bug.cgi?id=179343
651
652         Reviewed by Saam Barati.
653
654         Update the tests to follow the new format. Notably, SHA1 module
655         hash is now included in traces, and stubs are properly identified.
656
657         * wasm/assert.js: Add an assertion which matches regular expressions.
658         * wasm/function-tests/nameSection.js:
659         * wasm/function-tests/stack-overflow.js:
660         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
661         (assertOverflows.assertThrows.wasm.1):
662         (assertOverflows.assertThrows.wasm.0):
663         (assertOverflows.assertThrows):
664         (assertOverflows):
665         * wasm/function-tests/stack-trace.js:
666         (import.Builder.from.string_appeared_here.assert): Deleted.
667         * wasm/function-tests/trap-after-cross-instance-call.js:
668         (wasmFrameCountFromError):
669         * wasm/function-tests/trap-load-2.js:
670         (wasmFrameCountFromError):
671         * wasm/function-tests/trap-load.js:
672         (wasmFrameCountFromError):
673
674 2017-11-30  Mark Lam  <mark.lam@apple.com>
675
676         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
677         https://bugs.webkit.org/show_bug.cgi?id=180219
678         <rdar://problem/35696536>
679
680         Reviewed by Filip Pizlo.
681
682         * stress/regress-180219.js: Added.
683
684 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
685
686         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
687         https://bugs.webkit.org/show_bug.cgi?id=180190
688
689         Reviewed by Mark Lam.
690
691         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
692         (shouldBe):
693         (test1):
694         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
695         (shouldBe):
696         (test1):
697         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
698         (shouldBe):
699         (test1):
700         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
701         (shouldBe):
702         (test1):
703         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
704         (shouldBe):
705         (test1):
706         * stress/operation-in-may-have-negative-int32.js: Added.
707         (shouldBe):
708         (test2):
709         * stress/operation-in-negative-int32-cast.js: Added.
710         (shouldBe):
711         (test1):
712
713 2017-11-28  JF Bastien  <jfbastien@apple.com>
714
715         Strict and sloppy functions shouldn't share structure
716         https://bugs.webkit.org/show_bug.cgi?id=180103
717         <rdar://problem/35667847>
718
719         Reviewed by Saam Barati.
720
721         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
722         because the IC was wrong.
723         (foo):
724         (bar):
725         (baz):
726         (catch):
727         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
728         in this patch, but may as well test odd strict mode corner cases.
729         (bar):
730         (baz):
731         (catch):
732         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
733         (foo):
734         (bar):
735         (baz):
736         (catch):
737         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
738         next file, but with invalidation of the FunctionExecutable's
739         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
740         slower path.
741         (foo):
742         (bar.const.x):
743         (bar.const.y):
744         (bar):
745         (catch):
746         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
747         strict nesting works correctly.
748         (foo):
749         (bar.baz):
750         (bar):
751         * stress/strict-function-structure.js: Added. The test used to
752         assert in objectProtoFuncHasOwnProperty.
753         (foo):
754         (bar):
755         (baz):
756         * stress/strict-nested-function-structure.js: Added. Nesting.
757         (foo):
758         (bar):
759         (baz.boo):
760         (baz):
761
762 2017-11-29  Robin Morisset  <rmorisset@apple.com>
763
764         The recursive tail call optimisation is wrong on closures
765         https://bugs.webkit.org/show_bug.cgi?id=179835
766
767         Reviewed by Saam Barati.
768
769         * stress/closure-recursive-tail-call.js: Added.
770         (makeClosure):
771
772 2017-11-27  JF Bastien  <jfbastien@apple.com>
773
774         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
775         https://bugs.webkit.org/show_bug.cgi?id=180051
776         <rdar://problem/35614371>
777
778         Reviewed by Saam Barati.
779
780         * stress/rest-parameter-negative.js: Added.
781         (__f_5484):
782         (catch):
783         (__f_5485):
784         (__v_22598.catch):
785
786 2017-11-27  Saam Barati  <sbarati@apple.com>
787
788         Spread can escape when CreateRest does not
789         https://bugs.webkit.org/show_bug.cgi?id=180057
790         <rdar://problem/35676119>
791
792         Reviewed by JF Bastien.
793
794         * stress/spread-escapes-but-create-rest-does-not.js: Added.
795         (assert):
796         (getProperties):
797         (theFunc):
798         (let.obj.valueOf):
799
800 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
801
802         [DFG] Add NormalizeMapKey DFG IR
803         https://bugs.webkit.org/show_bug.cgi?id=179912
804
805         Reviewed by Saam Barati.
806
807         * stress/map-untyped-normalize-cse.js: Added.
808         (shouldBe):
809         (test):
810         * stress/map-untyped-normalize.js: Added.
811         (shouldBe):
812         (test):
813         * stress/set-untyped-normalize-cse.js: Added.
814         (shouldBe):
815         (set return.set has.set has):
816         * stress/set-untyped-normalize.js: Added.
817         (shouldBe):
818         (set return.set has):
819
820 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
821
822         [FTL] Support DeleteById and DeleteByVal
823         https://bugs.webkit.org/show_bug.cgi?id=180022
824
825         Reviewed by Saam Barati.
826
827         * stress/delete-by-id.js: Added.
828         (shouldBe):
829         (test1):
830         (test2):
831         * stress/delete-by-val-ftl.js: Added.
832         (shouldBe):
833         (test1):
834         (test2):
835
836 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
837
838         [DFG] Introduce {Set,Map,WeakMap}Fields
839         https://bugs.webkit.org/show_bug.cgi?id=179925
840
841         Reviewed by Saam Barati.
842
843         * stress/map-set-clobber-map-get.js: Added.
844         (shouldBe):
845         (test):
846         * stress/map-set-does-not-clobber-set-has.js: Added.
847         (shouldBe):
848         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
849         (shouldBe):
850         (test):
851         * stress/set-add-clobber-set-has.js: Added.
852         (shouldBe):
853         * stress/set-add-does-not-clobber-map-get.js: Added.
854         (shouldBe):
855
856 2017-11-24  Mark Lam  <mark.lam@apple.com>
857
858         Move unsafe jsc shell test functions to the $vm object.
859         https://bugs.webkit.org/show_bug.cgi?id=179980
860
861         Reviewed by Yusuke Suzuki.
862
863         * controlFlowProfiler/driver/driver.js:
864         * controlFlowProfiler/execution-count.js:
865         * controlFlowProfiler/if-statement.js:
866         * controlFlowProfiler/loop-statements.js:
867         * controlFlowProfiler/switch-statements.js:
868         * controlFlowProfiler/test-jit.js:
869         * exceptionFuzz/3d-cube.js:
870         * exceptionFuzz/date-format-xparb.js:
871         * exceptionFuzz/earley-boyer.js:
872         * heapProfiler/basic-edges.js:
873         * heapProfiler/property-edge-types.js:
874         * microbenchmarks/try-get-by-id-basic.js:
875         * microbenchmarks/try-get-by-id-polymorphic.js:
876         * modules/namespace-object-try-get.js:
877         * stress/argument-count-bytecode.js:
878         * stress/argument-intrinsic-basic.js:
879         * stress/argument-intrinsic-inlining-use-caller-arg.js:
880         * stress/argument-intrinsic-inlining-with-result-escape.js:
881         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
882         * stress/argument-intrinsic-inlining-with-vararg.js:
883         * stress/argument-intrinsic-nested-inlining.js:
884         * stress/argument-intrinsic-not-convert-to-get-argument.js:
885         * stress/argument-intrinsic-with-stack-write.js:
886         * stress/arity-mismatch-get-argument.js:
887         * stress/array-message-passing.js:
888         * stress/array-push-with-force-exit.js:
889         * stress/check-dom-with-signature.js:
890         * stress/check-sub-class.js:
891         * stress/compare-eq-incomplete-profile.js:
892         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
893         * stress/do-eval-virtual-call-correctly.js:
894         * stress/dom-jit-with-poly-proto.js:
895         * stress/domjit-exception-ic.js:
896         * stress/domjit-exception.js:
897         * stress/domjit-getter-complex-with-incorrect-object.js:
898         * stress/domjit-getter-complex.js:
899         * stress/domjit-getter-poly.js:
900         * stress/domjit-getter-proto.js:
901         * stress/domjit-getter-super-poly.js:
902         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
903         * stress/domjit-getter-type-check.js:
904         * stress/domjit-getter.js:
905         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
906         * stress/for-in-proxy-target-changed-structure.js:
907         * stress/for-in-proxy.js:
908         * stress/generational-opaque-roots.js:
909         * stress/global-const-redeclaration-setting-2.js:
910         * stress/global-const-redeclaration-setting-3.js:
911         * stress/global-const-redeclaration-setting-4.js:
912         * stress/global-const-redeclaration-setting-5.js:
913         * stress/global-const-redeclaration-setting.js:
914         * stress/import-basic.js:
915         * stress/import-from-eval.js:
916         * stress/import-reject-with-exception.js:
917         * stress/import-syntax.js:
918         * stress/impure-get-own-property-slot-inline-cache.js:
919         * stress/is-constructor.js:
920         * stress/istypedarrayview-intrinsic.js:
921         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
922         * stress/jsc-test-functions-should-be-more-robust.js:
923         * stress/object-toString-with-proxy.js:
924         * stress/poly-proto-custom-value-and-accessor.js:
925         * stress/proxy-inline-cache.js:
926         * stress/re-execute-error-module.js:
927         * stress/regress-150532.js:
928         * stress/regress-156992.js:
929         * stress/regress-179619.js:
930         * stress/resources/shadow-chicken-support.js:
931         * stress/runtime-array.js:
932         * stress/sampling-profiler-microtasks.js:
933         * stress/shadow-chicken-enabled.js:
934         * stress/spread-correct-global-object-on-exception.js:
935         * stress/super-get-by-id.js:
936         * stress/tailCallForwardArguments.js:
937         * stress/to-object-intrinsic-boolean-edge.js:
938         * stress/to-object-intrinsic-null-or-undefined-edge.js:
939         * stress/to-object-intrinsic-number-edge.js:
940         * stress/to-object-intrinsic-object-edge.js:
941         * stress/to-object-intrinsic-string-edge.js:
942         * stress/to-object-intrinsic-symbol-edge.js:
943         * stress/to-object-intrinsic.js:
944         * stress/try-catch-custom-getter-as-get-by-id.js:
945         * stress/try-get-by-id-poly-proto.js:
946         * stress/try-get-by-id-should-spill-registers-dfg.js:
947         * stress/try-get-by-id.js:
948         * typeProfiler/arrow-functions.js:
949         * typeProfiler/basic.js:
950         * typeProfiler/captured.js:
951         * typeProfiler/classes.js:
952         * typeProfiler/dfg-jit-optimizations.js:
953         * typeProfiler/dictionary-mode.js:
954         * typeProfiler/es6-block-scoping.js:
955         * typeProfiler/es6-classes.js:
956         * typeProfiler/inheritance.js:
957         * typeProfiler/int52-dfg.js:
958         * typeProfiler/loop.js:
959         * typeProfiler/optional-fields.js:
960         * typeProfiler/overflow.js:
961         * typeProfiler/return.js:
962         * typeProfiler/symbol.js:
963         * typeProfiler/weird-prototype-chain.js:
964
965 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
966
967         [DFG][FTL] Support MapSet / SetAdd intrinsics
968         https://bugs.webkit.org/show_bug.cgi?id=179858
969
970         Reviewed by Saam Barati.
971
972         * microbenchmarks/map-has-and-set.js: Added.
973         (test):
974         * stress/map-set-check-failure.js: Added.
975         (shouldBe):
976         (shouldThrow):
977         (target):
978         * stress/map-set-cse.js: Added.
979         (shouldBe):
980         (test):
981         * stress/set-add-check-failure.js: Added.
982         (shouldBe):
983         (shouldThrow):
984         (set shouldThrow):
985         * stress/set-add-cse.js: Added.
986         (shouldBe):
987
988 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
989
990         [JSC] Allow poly proto for intrinsic getters
991         https://bugs.webkit.org/show_bug.cgi?id=179550
992
993         Reviewed by Saam Barati.
994
995         This change is also tested by existing tests.
996
997             1. stress/intrinsic-getter-with-poly-proto.js
998             2. stress/poly-proto-intrinsic-getter-correctness.js
999
1000         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
1001         (shouldBe):
1002         (makePolyProtoObject.foo.C):
1003         (makePolyProtoObject.foo):
1004         (makePolyProtoObject):
1005         (target):
1006         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
1007         (shouldBe):
1008         (makePolyProtoObject.foo.C):
1009         (makePolyProtoObject.foo):
1010         (makePolyProtoObject):
1011         (target):
1012
1013 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
1014
1015         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
1016         https://bugs.webkit.org/show_bug.cgi?id=179744
1017
1018         Reviewed by Michael Catanzaro.
1019
1020         This test uses too much memory for our buildbots on these platforms
1021         and gets OOM-killed.
1022
1023         * stress/unshiftCountSlowCase-correct-postCapacity.js:
1024         Skip if $memoryLimited and linux.
1025
1026 2017-11-17  JF Bastien  <jfbastien@apple.com>
1027
1028         WebAssembly JS API: throw when a promise can't be created
1029         https://bugs.webkit.org/show_bug.cgi?id=179826
1030         <rdar://problem/35455813>
1031
1032         Reviewed by Mark Lam.
1033
1034         Test WebAssembly.{compile,instantiate} where promise creation
1035         fails because of a stack overflow.
1036
1037         * wasm/js-api/promise-stack-overflow.js: Added.
1038         (const.runNearStackLimit.f.const.t):
1039         (async.testCompile):
1040         (async.testInstantiate):
1041
1042 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1043
1044         Unreviewed, mark regress-178385.js as memory exhausting
1045
1046         * stress/regress-178385.js:
1047
1048 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
1049
1050         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
1051
1052         Unreviewed test gardening.
1053
1054         * test262.yaml:
1055
1056 2017-11-16  Robin Morisset  <rmorisset@apple.com>
1057
1058         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
1059         https://bugs.webkit.org/show_bug.cgi?id=179763
1060         <rdar://problem/35550513>
1061
1062         Reviewed by Keith Miller.
1063
1064         Just adding a slightly cleaned-up version of the original fuzzer-found test.
1065
1066         * stress/tdz-this-in-try-catch.js: Added.
1067         (__v_6388):
1068         (__v_6392):
1069
1070 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1071
1072         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
1073         https://bugs.webkit.org/show_bug.cgi?id=179594
1074
1075         Reviewed by Saam Barati.
1076
1077         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
1078         (shouldBe):
1079         (args):
1080         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
1081         (shouldBe):
1082         (args):
1083
1084 2017-11-14  Saam Barati  <sbarati@apple.com>
1085
1086         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
1087         https://bugs.webkit.org/show_bug.cgi?id=179639
1088         <rdar://problem/35513018>
1089
1090         Reviewed by JF Bastien.
1091
1092         * wasm/function-tests/grow-memory-cause-gc.js: Added.
1093         (escape):
1094         (i.func):
1095
1096 2017-11-13  Mark Lam  <mark.lam@apple.com>
1097
1098         Add more overflow check book-keeping for MarkedArgumentBuffer.
1099         https://bugs.webkit.org/show_bug.cgi?id=179634
1100         <rdar://problem/35492517>
1101
1102         Reviewed by Saam Barati.
1103
1104         * stress/regress-179634.js: Added.
1105
1106 2017-11-13  Mark Lam  <mark.lam@apple.com>
1107
1108         Make the jsc shell loadGetterFromGetterSetter() function more robust.
1109         https://bugs.webkit.org/show_bug.cgi?id=179619
1110         <rdar://problem/35492518>
1111
1112         Reviewed by Saam Barati.
1113
1114         * stress/regress-179619.js: Added.
1115
1116 2017-11-12  Mark Lam  <mark.lam@apple.com>
1117
1118         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
1119         https://bugs.webkit.org/show_bug.cgi?id=179562
1120         <rdar://problem/35467022>
1121
1122         Reviewed by Saam Barati.
1123
1124         * regress-179562.js: Added.
1125
1126 2017-11-08  Saam Barati  <sbarati@apple.com>
1127
1128         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
1129         https://bugs.webkit.org/show_bug.cgi?id=177792
1130
1131         Reviewed by Yusuke Suzuki.
1132
1133         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
1134         (assert):
1135         (foo.Foo.prototype.ensureX):
1136         (foo.Foo):
1137         (foo):
1138         (access):
1139
1140 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
1141
1142         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1143         https://bugs.webkit.org/show_bug.cgi?id=178592
1144
1145         Unreviewed test gardening.
1146
1147         * test262.yaml:
1148
1149 2017-11-08  Robin Morisset  <rmorisset@apple.com>
1150
1151         Turn recursive tail calls into loops
1152         https://bugs.webkit.org/show_bug.cgi?id=176601
1153
1154         Reviewed by Saam Barati.
1155
1156         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
1157
1158         Add some simple test that computes factorial in several ways, and other trivial computations.
1159         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1160         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1161         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1162         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1163
1164         * stress/inline-call-to-recursive-tail-call.js: Added.
1165         (factorial.aux):
1166         (factorial):
1167         (factorial2.aux2):
1168         (factorial2.id):
1169         (factorial2):
1170         (factorial3.aux3):
1171         (factorial3):
1172         (aux4):
1173         (factorial4):
1174         (foo):
1175         (auxBar):
1176         (bar):
1177         (test):
1178
1179 2017-11-07  Mark Lam  <mark.lam@apple.com>
1180
1181         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
1182         https://bugs.webkit.org/show_bug.cgi?id=179355
1183         <rdar://problem/35263053>
1184
1185         Reviewed by Saam Barati.
1186
1187         * stress/regress-179355.js: Added.
1188
1189 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1190
1191         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
1192         https://bugs.webkit.org/show_bug.cgi?id=144458
1193
1194         Reviewed by Saam Barati.
1195
1196         * microbenchmarks/dfg-internal-function-call.js: Added.
1197         (target):
1198         * microbenchmarks/dfg-internal-function-construct.js: Added.
1199         (target):
1200         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
1201         (target):
1202         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
1203         (target):
1204         * stress/dfg-internal-function-call.js: Added.
1205         (shouldBe):
1206         (target):
1207         * stress/dfg-internal-function-construct.js: Added.
1208         (shouldBe):
1209         (target):
1210         * stress/internal-function-call.js: Added.
1211         (shouldBe):
1212         * stress/internal-function-construct.js: Added.
1213         (shouldBe):
1214
1215 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
1216
1217         [Win] Skip stress/regress-178385.js.
1218         https://bugs.webkit.org/show_bug.cgi?id=179298
1219
1220         Unreviewed test gardening.
1221
1222         * stress/regress-178385.js:
1223
1224 2017-11-03  Keith Miller  <keith_miller@apple.com>
1225
1226         Add test for ic with side effects
1227         https://bugs.webkit.org/show_bug.cgi?id=179268
1228
1229         Reviewed by Saam Barati.
1230
1231         * stress/put-inline-cache-side-effects.js: Added.
1232         (let.i.of.objs.keys):
1233         (f):
1234
1235 2017-11-03  Mark Lam  <mark.lam@apple.com>
1236
1237         CachedCall (and its clients) needs overflow checks.
1238         https://bugs.webkit.org/show_bug.cgi?id=179185
1239
1240         Reviewed by JF Bastien.
1241
1242         * stress/regress-179185.js: Added.
1243
1244 2017-11-02  Michael Saboff  <msaboff@apple.com>
1245
1246         DFG needs to handle code motion of code in for..in loop bodies
1247         https://bugs.webkit.org/show_bug.cgi?id=179212
1248
1249         Reviewed by Keith Miller.
1250
1251         New regression test.
1252
1253         * stress/for-in-side-effects.js: Added.
1254         (getPrototypeOf):
1255         (reset):
1256         (testWithoutFTL.f):
1257         (testWithoutFTL):
1258         (testWithFTL.f):
1259         (testWithFTL):
1260
1261 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
1262
1263         AI does not correctly model the clobber case of ArithClz32
1264         https://bugs.webkit.org/show_bug.cgi?id=179188
1265
1266         Reviewed by Michael Saboff.
1267
1268         * stress/arith-clz32-effects.js: Added.
1269         (foo):
1270         (valueOf):
1271
1272 2017-11-01  Michael Saboff  <msaboff@apple.com>
1273
1274         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
1275         https://bugs.webkit.org/show_bug.cgi?id=179140
1276
1277         Reviewed by Saam Barati.
1278
1279         New regression test.
1280
1281         * stress/regress-179140.js: Added.
1282         (testWithoutFTL):
1283         (testWithFTL):
1284
1285 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1286
1287         [JSC] Introduce @toObject
1288         https://bugs.webkit.org/show_bug.cgi?id=178726
1289
1290         Reviewed by Saam Barati.
1291
1292         * stress/array-copywithin.js:
1293         (shouldThrow):
1294         * stress/object-constructor-boolean-edge.js: Added.
1295         (shouldBe):
1296         (test):
1297         * stress/object-constructor-global.js: Added.
1298         (shouldBe):
1299         * stress/object-constructor-null-edge.js: Added.
1300         (shouldBe):
1301         (test):
1302         * stress/object-constructor-number-edge.js: Added.
1303         (shouldBe):
1304         (test):
1305         * stress/object-constructor-object-edge.js: Added.
1306         (shouldBe):
1307         (test):
1308         (i.arg):
1309         * stress/object-constructor-string-edge.js: Added.
1310         (shouldBe):
1311         (test):
1312         * stress/object-constructor-symbol-edge.js: Added.
1313         (shouldBe):
1314         (test):
1315         * stress/object-constructor-undefined-edge.js: Added.
1316         (shouldBe):
1317         (test):
1318         * stress/symbol-array-from.js: Added.
1319         (shouldBe):
1320         * stress/to-object-intrinsic-boolean-edge.js: Added.
1321         (shouldBe):
1322         (builtin.createBuiltin):
1323         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
1324         (shouldThrow):
1325         * stress/to-object-intrinsic-number-edge.js: Added.
1326         (shouldBe):
1327         (builtin.createBuiltin):
1328         * stress/to-object-intrinsic-object-edge.js: Added.
1329         (shouldBe):
1330         (builtin.createBuiltin):
1331         (i.arg):
1332         * stress/to-object-intrinsic-string-edge.js: Added.
1333         (shouldBe):
1334         (builtin.createBuiltin):
1335         * stress/to-object-intrinsic-symbol-edge.js: Added.
1336         (shouldBe):
1337         (builtin.createBuiltin):
1338         * stress/to-object-intrinsic.js: Added.
1339         (shouldBe):
1340         (shouldThrow):
1341         (builtin.createBuiltin):
1342
1343 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1344
1345         [DFG][FTL] Introduce StringSlice
1346         https://bugs.webkit.org/show_bug.cgi?id=178934
1347
1348         Reviewed by Saam Barati.
1349
1350         * microbenchmarks/string-slice-empty.js: Added.
1351         (slice):
1352         * microbenchmarks/string-slice-one-char.js: Added.
1353         (slice):
1354         * microbenchmarks/string-slice.js: Added.
1355         (slice):
1356
1357 2017-10-26  Michael Saboff  <msaboff@apple.com>
1358
1359         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
1360         https://bugs.webkit.org/show_bug.cgi?id=178890
1361
1362         Reviewed by Keith Miller.
1363
1364         New regression test.
1365
1366         * stress/regress-178890.js: Added.
1367
1368 2017-10-26  Mark Lam  <mark.lam@apple.com>
1369
1370         JSRopeString::RopeBuilder::append() should check for overflows.
1371         https://bugs.webkit.org/show_bug.cgi?id=178385
1372         <rdar://problem/35027468>
1373
1374         Reviewed by Saam Barati.
1375
1376         * stress/regress-178385.js: Added.
1377
1378 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
1379
1380         Unreviewed, rolling out r223961.
1381
1382         The change that required this has been rolled out.
1383
1384         Reverted changeset:
1385
1386         "Mark test262.yaml/test262/test/language/statements/try/tco-
1387         catch.js as passing."
1388         https://bugs.webkit.org/show_bug.cgi?id=178592
1389         https://trac.webkit.org/changeset/223961
1390
1391 2017-10-25  Commit Queue  <commit-queue@webkit.org>
1392
1393         Unreviewed, rolling out r223691 and r223729.
1394         https://bugs.webkit.org/show_bug.cgi?id=178834
1395
1396         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
1397         by rniwa on #webkit).
1398
1399         Reverted changesets:
1400
1401         "Turn recursive tail calls into loops"
1402         https://bugs.webkit.org/show_bug.cgi?id=176601
1403         https://trac.webkit.org/changeset/223691
1404
1405         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
1406         comparison is always false due to limited range of data type
1407         [-Wtype-limits]"
1408         https://bugs.webkit.org/show_bug.cgi?id=178543
1409         https://trac.webkit.org/changeset/223729
1410
1411 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
1412
1413         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1414         https://bugs.webkit.org/show_bug.cgi?id=178592
1415
1416         Unreviewed test gardening.
1417
1418         * test262.yaml:
1419
1420 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1421
1422         [FTL] Support NewStringObject
1423         https://bugs.webkit.org/show_bug.cgi?id=178737
1424
1425         Reviewed by Saam Barati.
1426
1427         * stress/new-string-object.js: Added.
1428         (shouldBe):
1429         (test):
1430
1431 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1432
1433         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
1434         https://bugs.webkit.org/show_bug.cgi?id=178308
1435
1436         Reviewed by Mark Lam.
1437
1438         * test262.yaml:
1439
1440 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1441
1442         [JSC] Use fastJoin in Array#toString
1443         https://bugs.webkit.org/show_bug.cgi?id=178062
1444
1445         Reviewed by Darin Adler.
1446
1447         * microbenchmarks/contiguous-array-to-string.js: Added.
1448         (target):
1449         * microbenchmarks/double-array-to-string.js: Added.
1450         (target):
1451         * microbenchmarks/int32-array-to-string.js: Added.
1452         (target):
1453
1454 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
1455
1456         stress/check-string-ident.js is improperly skipped
1457         https://bugs.webkit.org/show_bug.cgi?id=178642
1458
1459         Reviewed by Saam Barati.
1460
1461         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
1462         since it enforces the run-jsc-stress-tests script to still set up the
1463         test to run, despite the skip directive that's used before.
1464
1465 2017-10-20  Mark Lam  <mark.lam@apple.com>
1466
1467         Add a test case for r214334.
1468         https://bugs.webkit.org/show_bug.cgi?id=169941
1469         <rdar://problem/31221258>
1470
1471         Reviewed by JF Bastien.
1472
1473         * stress/regress-169941.js: Added.
1474
1475 2017-10-19  JF Bastien  <jfbastien@apple.com>
1476
1477         WebAssembly: no VM / JS version of everything but Instance
1478         https://bugs.webkit.org/show_bug.cgi?id=177473
1479
1480         Reviewed by Filip Pizlo, Saam Barati.
1481
1482         - Exceeding max on memory growth now returns a range error as per
1483         spec. This is a (very minor) breaking change: it used to throw OOM
1484         error. Update the corresponding test.
1485
1486         * wasm/js-api/memory-grow.js:
1487         (assertEq):
1488         * wasm/js-api/table.js:
1489         (assert.throws):
1490
1491 2017-10-19  Mark Lam  <mark.lam@apple.com>
1492
1493         Stringifier::appendStringifiedValue() is missing an exception check.
1494         https://bugs.webkit.org/show_bug.cgi?id=178386
1495         <rdar://problem/35027610>
1496
1497         Reviewed by Saam Barati.
1498
1499         * stress/regress-178386.js: Added.
1500
1501 2017-10-19  Michael Saboff  <msaboff@apple.com>
1502
1503         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1504         https://bugs.webkit.org/show_bug.cgi?id=178521
1505
1506         Reviewed by JF Bastien.
1507
1508         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1509         now passes with the current version (5.0) of the Emoji spec.
1510
1511 2017-10-19  Robin Morisset  <rmorisset@apple.com>
1512
1513         Turn recursive tail calls into loops
1514         https://bugs.webkit.org/show_bug.cgi?id=176601
1515
1516         Reviewed by Saam Barati.
1517
1518         Add some simple test that computes factorial in several ways, and other trivial computations.
1519         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1520         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1521         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1522         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1523
1524         * stress/inline-call-to-recursive-tail-call.js: Added.
1525         (factorial.aux):
1526         (factorial):
1527         (factorial2.aux):
1528         (factorial2.id):
1529         (factorial2):
1530         (factorial3.aux):
1531         (factorial3):
1532         (aux):
1533         (factorial4):
1534         (test):
1535
1536 2017-10-18  Mark Lam  <mark.lam@apple.com>
1537
1538         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1539         https://bugs.webkit.org/show_bug.cgi?id=177600
1540         <rdar://problem/34710985>
1541
1542         Reviewed by Saam Barati.
1543
1544         * stress/regress-177600.js: Added.
1545
1546 2017-10-18  Mark Lam  <mark.lam@apple.com>
1547
1548         The compiler should always register a structure when it adds its transitionWatchPointSet.
1549         https://bugs.webkit.org/show_bug.cgi?id=178420
1550         <rdar://problem/34814024>
1551
1552         Reviewed by Saam Barati and Filip Pizlo.
1553
1554         * stress/regress-178420.js: Added.
1555         (new.Array.10000.map):
1556
1557 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1558
1559         [JSC] __proto__ getter should be fast
1560         https://bugs.webkit.org/show_bug.cgi?id=178067
1561
1562         Reviewed by Saam Barati.
1563
1564         * stress/dfg-object-proto-accessor.js: Added.
1565         (shouldBe):
1566         (shouldThrow):
1567         (target):
1568         * stress/dfg-object-proto-getter.js: Added.
1569         (shouldBe):
1570         (shouldThrow):
1571         (target):
1572         * stress/dfg-object-prototype-of.js: Added.
1573         (shouldBe):
1574         (shouldThrow):
1575         (target):
1576         * stress/dfg-reflect-get-prototype-of.js: Added.
1577         (shouldBe):
1578         (shouldThrow):
1579         (target):
1580         * stress/intrinsic-getter-with-poly-proto.js: Added.
1581         (shouldBe):
1582         (makePolyProtoObject.foo.C):
1583         (makePolyProtoObject.foo):
1584         (makePolyProtoObject):
1585         (target):
1586         * stress/object-get-prototype-of-filtered.js: Added.
1587         (shouldBe):
1588         (shouldThrow):
1589         (target):
1590         (i.Cocoa):
1591         * stress/object-get-prototype-of-mono-proto.js: Added.
1592         (shouldBe):
1593         (makePolyProtoObject.foo.C):
1594         (makePolyProtoObject.foo):
1595         (makePolyProtoObject):
1596         (target):
1597         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1598         (shouldBe):
1599         (makePolyProtoObject.foo.C):
1600         (makePolyProtoObject.foo):
1601         (makePolyProtoObject):
1602         (target):
1603         * stress/object-get-prototype-of-poly-proto.js: Added.
1604         (shouldBe):
1605         (makePolyProtoObject.foo.C):
1606         (makePolyProtoObject.foo):
1607         (makePolyProtoObject):
1608         (target):
1609         * stress/object-proto-getter-filtered.js: Added.
1610         (shouldBe):
1611         (shouldThrow):
1612         (target):
1613         (i.Cocoa):
1614         * stress/object-proto-getter-poly-mono-proto.js: Added.
1615         (shouldBe):
1616         (makePolyProtoObject.foo.C):
1617         (makePolyProtoObject.foo):
1618         (makePolyProtoObject):
1619         (target):
1620         * stress/object-proto-getter-poly-proto.js: Added.
1621         (shouldBe):
1622         (makePolyProtoObject.foo.C):
1623         (makePolyProtoObject.foo):
1624         (makePolyProtoObject):
1625         (target):
1626         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1627         * stress/string-proto.js: Added.
1628         (shouldBe):
1629         (target):
1630
1631 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1632
1633         Unreviewed, rolling out r223523.
1634
1635         A test for this change is failing on debug JSC bots.
1636
1637         Reverted changeset:
1638
1639         "[JSC] __proto__ getter should be fast"
1640         https://bugs.webkit.org/show_bug.cgi?id=178067
1641         https://trac.webkit.org/changeset/223523
1642
1643 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1644
1645         [JSC] __proto__ getter should be fast
1646         https://bugs.webkit.org/show_bug.cgi?id=178067
1647
1648         Reviewed by Saam Barati.
1649
1650         * stress/dfg-object-proto-accessor.js: Added.
1651         (shouldBe):
1652         (shouldThrow):
1653         (target):
1654         * stress/dfg-object-proto-getter.js: Added.
1655         (shouldBe):
1656         (shouldThrow):
1657         (target):
1658         * stress/dfg-object-prototype-of.js: Added.
1659         (shouldBe):
1660         (shouldThrow):
1661         (target):
1662         * stress/dfg-reflect-get-prototype-of.js: Added.
1663         (shouldBe):
1664         (shouldThrow):
1665         (target):
1666         * stress/object-get-prototype-of-filtered.js: Added.
1667         (shouldBe):
1668         (shouldThrow):
1669         (target):
1670         (i.Cocoa):
1671         * stress/object-get-prototype-of-mono-proto.js: Added.
1672         (shouldBe):
1673         (makePolyProtoObject.foo.C):
1674         (makePolyProtoObject.foo):
1675         (makePolyProtoObject):
1676         (target):
1677         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1678         (shouldBe):
1679         (makePolyProtoObject.foo.C):
1680         (makePolyProtoObject.foo):
1681         (makePolyProtoObject):
1682         (target):
1683         * stress/object-get-prototype-of-poly-proto.js: Added.
1684         (shouldBe):
1685         (makePolyProtoObject.foo.C):
1686         (makePolyProtoObject.foo):
1687         (makePolyProtoObject):
1688         (target):
1689         * stress/object-proto-getter-filtered.js: Added.
1690         (shouldBe):
1691         (shouldThrow):
1692         (target):
1693         (i.Cocoa):
1694         * stress/object-proto-getter-poly-mono-proto.js: Added.
1695         (shouldBe):
1696         (makePolyProtoObject.foo.C):
1697         (makePolyProtoObject.foo):
1698         (makePolyProtoObject):
1699         (target):
1700         * stress/object-proto-getter-poly-proto.js: Added.
1701         (shouldBe):
1702         (makePolyProtoObject.foo.C):
1703         (makePolyProtoObject.foo):
1704         (makePolyProtoObject):
1705         (target):
1706         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1707         * stress/string-proto.js: Added.
1708         (shouldBe):
1709         (target):
1710
1711 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1712
1713         Reland "Add Above/Below comparisons for UInt32 patterns"
1714         https://bugs.webkit.org/show_bug.cgi?id=177281
1715
1716         Reviewed by Saam Barati.
1717
1718         * stress/uint32-comparison-jump.js: Added.
1719         (shouldBe):
1720         (above):
1721         (aboveOrEqual):
1722         (below):
1723         (belowOrEqual):
1724         (notAbove):
1725         (notAboveOrEqual):
1726         (notBelow):
1727         (notBelowOrEqual):
1728         * stress/uint32-comparison.js: Added.
1729         (shouldBe):
1730         (above):
1731         (aboveOrEqual):
1732         (below):
1733         (belowOrEqual):
1734         (aboveTest):
1735         (aboveOrEqualTest):
1736         (belowTest):
1737         (belowOrEqualTest):
1738
1739 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1740
1741         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1742         https://bugs.webkit.org/show_bug.cgi?id=178210
1743
1744         Reviewed by Saam Barati.
1745
1746         * wasm/function-tests/trap-from-start-async.js:
1747         (async.StartTrapsAsync):
1748         * wasm/function-tests/trap-from-start.js:
1749         (StartTraps):
1750         * wasm/js-api/web-assembly-function.js:
1751         (assert.eq.Object.getPrototypeOf):
1752         * wasm/js-api/wrapper-function.js:
1753         (return.new.WebAssembly.Module):
1754         (assert.throws.makeInstance): Deleted.
1755         (assert.throws.Bar): Deleted.
1756         (assert.throws): Deleted.
1757
1758 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1759
1760         Enable gigacage on iOS
1761         https://bugs.webkit.org/show_bug.cgi?id=177586
1762
1763         Reviewed by JF Bastien.
1764         
1765         Add tests for when Gigacage gets runtime disabled.
1766
1767         * stress/disable-gigacage-arrays.js: Added.
1768         (foo):
1769         * stress/disable-gigacage-strings.js: Added.
1770         (foo):
1771         * stress/disable-gigacage-typed-arrays.js: Added.
1772         (foo):
1773
1774 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1775
1776         import.meta should not be assignable
1777         https://bugs.webkit.org/show_bug.cgi?id=178202
1778
1779         Reviewed by Saam Barati.
1780
1781         * modules/import-meta-assignment.js: Added.
1782         (shouldThrow):
1783         (SyntaxError.import.meta.can.shouldThrow):
1784
1785 2017-10-11  Saam Barati  <sbarati@apple.com>
1786
1787         Unreviewed. Actually skip certain type profiler tests in debug.
1788
1789         * typeProfiler.yaml:
1790         * typeProfiler/deltablue-for-of.js:
1791         * typeProfiler/getter-richards.js:
1792
1793 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1794
1795         Unreviewed, rolling out r223113 and r223121.
1796         https://bugs.webkit.org/show_bug.cgi?id=178182
1797
1798         Reintroduced 20% regression on Kraken (Requested by rniwa on
1799         #webkit).
1800
1801         Reverted changesets:
1802
1803         "Enable gigacage on iOS"
1804         https://bugs.webkit.org/show_bug.cgi?id=177586
1805         https://trac.webkit.org/changeset/223113
1806
1807         "Use one virtual allocation for all gigacages and their
1808         runways"
1809         https://bugs.webkit.org/show_bug.cgi?id=178050
1810         https://trac.webkit.org/changeset/223121
1811
1812 2017-10-11  Michael Saboff  <msaboff@apple.com>
1813
1814         Disable test262 named capture group tests with direct unicode names and with references before definitions
1815         https://bugs.webkit.org/show_bug.cgi?id=178177
1816
1817         Reviewed by Keith Miller.
1818
1819         Bugs to track fixing these test are:
1820         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1821             "Add support in named capture group identifiers for direct surrogate pairs"
1822         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1823             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1824
1825         * test262.yaml:
1826
1827 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1828
1829         Object properties are undefined in super.call() but not in this.call()
1830         https://bugs.webkit.org/show_bug.cgi?id=177230
1831
1832         Reviewed by Saam Barati.
1833
1834         * stress/super-call-function-subclass.js: Added.
1835         (assert):
1836         (A.prototype.t):
1837         (A):
1838         * stress/super-dot-call-and-apply.js: Added.
1839         (assert):
1840         (A):
1841         (A.prototype.call):
1842         (A.prototype.apply):
1843         (B.prototype.testSuper):
1844         (B):
1845         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1846         (D.prototype.testSuper):
1847         (D):
1848
1849 2017-10-10  Saam Barati  <sbarati@apple.com>
1850
1851         The prototype cache should be aware of the Executable it generates a Structure for
1852         https://bugs.webkit.org/show_bug.cgi?id=177907
1853
1854         Reviewed by Filip Pizlo.
1855
1856         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1857         (assert):
1858         (foo.C):
1859         (foo):
1860         (bar.C):
1861         (bar):
1862         (access):
1863         (makeLongChain):
1864         (accessY):
1865
1866 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1867
1868         `async` should be able to be used as an imported binding name
1869         https://bugs.webkit.org/show_bug.cgi?id=176573
1870
1871         Reviewed by Saam Barati.
1872
1873         * modules/import-default-async.js: Added.
1874         * modules/import-named-async-as.js: Added.
1875         * modules/import-named-async.js: Added.
1876         * modules/import-named-async/target.js: Added.
1877         * modules/import-namespace-async.js: Added.
1878         * test262.yaml:
1879
1880 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1881
1882         Enable gigacage on iOS
1883         https://bugs.webkit.org/show_bug.cgi?id=177586
1884
1885         Reviewed by JF Bastien.
1886         
1887         Add tests for when Gigacage gets runtime disabled.
1888
1889         * stress/disable-gigacage-arrays.js: Added.
1890         (foo):
1891         * stress/disable-gigacage-strings.js: Added.
1892         (foo):
1893         * stress/disable-gigacage-typed-arrays.js: Added.
1894         (foo):
1895
1896 2017-10-09  Michael Saboff  <msaboff@apple.com>
1897
1898         Implement RegExp Unicode property escapes
1899         https://bugs.webkit.org/show_bug.cgi?id=172069
1900
1901         Reviewed by JF Bastien.
1902
1903         Enabled Unicode Property tests.
1904
1905         * test262.yaml:
1906
1907 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1908
1909         Unreviewed, rolling out r223015 and r223025.
1910         https://bugs.webkit.org/show_bug.cgi?id=178093
1911
1912         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1913         #webkit).
1914
1915         Reverted changesets:
1916
1917         "Enable gigacage on iOS"
1918         https://bugs.webkit.org/show_bug.cgi?id=177586
1919         http://trac.webkit.org/changeset/223015
1920
1921         "Unreviewed, disable Gigacage on ARM64 Linux"
1922         https://bugs.webkit.org/show_bug.cgi?id=177586
1923         http://trac.webkit.org/changeset/223025
1924
1925 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1926
1927         Update expectations for test262 tests that pass after r223043.
1928         https://bugs.webkit.org/show_bug.cgi?id=176685
1929
1930         Unreviewed test gardening.
1931
1932         * test262.yaml:
1933
1934 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1935
1936         Unreviewed, rolling out r223022.
1937
1938         This change introduced 18 test262 failures.
1939
1940         Reverted changeset:
1941
1942         "`async` should be able to be used as an imported binding
1943         name"
1944         https://bugs.webkit.org/show_bug.cgi?id=176573
1945         http://trac.webkit.org/changeset/223022
1946
1947 2017-10-09  Saam Barati  <sbarati@apple.com>
1948
1949         3 poly-proto JSC tests timing out on debug after r222827
1950         https://bugs.webkit.org/show_bug.cgi?id=177880
1951         <rdar://problem/34817122>
1952
1953         Unreviewed.
1954
1955         I'm skipping these type profiler tests on debug since they are long running.
1956
1957         * typeProfiler/deltablue-for-of.js:
1958         * typeProfiler/getter-richards.js:
1959
1960 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1961
1962         Safari 10 /11 problem with if (!await get(something)).
1963         https://bugs.webkit.org/show_bug.cgi?id=176685
1964
1965         Reviewed by Saam Barati.
1966
1967         * stress/async-await-basic.js:
1968         (awaitEpression.async):
1969         * stress/async-await-syntax.js:
1970         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1971         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1972
1973 2017-10-08  Saam Barati  <sbarati@apple.com>
1974
1975         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1976
1977         * typeProfiler/deltablue-for-of.js:
1978         * typeProfiler/getter-richards.js:
1979
1980 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1981
1982         `async` should be able to be used as an imported binding name
1983         https://bugs.webkit.org/show_bug.cgi?id=176573
1984
1985         Reviewed by Darin Adler.
1986
1987         * modules/import-default-async.js: Added.
1988         * modules/import-named-async-as.js: Added.
1989         * modules/import-named-async.js: Added.
1990         * modules/import-named-async/target.js: Added.
1991         * modules/import-namespace-async.js: Added.
1992
1993 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1994
1995         Enable gigacage on iOS
1996         https://bugs.webkit.org/show_bug.cgi?id=177586
1997
1998         Reviewed by JF Bastien.
1999         
2000         Add tests for when Gigacage gets runtime disabled.
2001
2002         * stress/disable-gigacage-arrays.js: Added.
2003         (foo):
2004         * stress/disable-gigacage-strings.js: Added.
2005         (foo):
2006         * stress/disable-gigacage-typed-arrays.js: Added.
2007         (foo):
2008
2009 2017-10-06  Commit Queue  <commit-queue@webkit.org>
2010
2011         Unreviewed, rolling out r222791 and r222873.
2012         https://bugs.webkit.org/show_bug.cgi?id=178031
2013
2014         Caused crashes with workers/wasm LayoutTests (Requested by
2015         ryanhaddad on #webkit).
2016
2017         Reverted changesets:
2018
2019         "WebAssembly: no VM / JS version of everything but Instance"
2020         https://bugs.webkit.org/show_bug.cgi?id=177473
2021         http://trac.webkit.org/changeset/222791
2022
2023         "WebAssembly: address no VM / JS follow-ups"
2024         https://bugs.webkit.org/show_bug.cgi?id=177887
2025         http://trac.webkit.org/changeset/222873
2026
2027 2017-10-05  Saam Barati  <sbarati@apple.com>
2028
2029         Make sure all prototypes under poly proto get added into the VM's prototype map
2030         https://bugs.webkit.org/show_bug.cgi?id=177909
2031
2032         Reviewed by Keith Miller.
2033
2034         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
2035         (assert):
2036         (foo.C):
2037         (foo):
2038         (set x):
2039
2040 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
2041
2042         [JSC] Introduce import.meta
2043         https://bugs.webkit.org/show_bug.cgi?id=177703
2044
2045         Reviewed by Filip Pizlo.
2046
2047         * modules/import-meta-syntax.js: Added.
2048         (shouldThrow):
2049         (shouldNotThrow):
2050         * modules/import-meta.js: Added.
2051         * modules/import-meta/cocoa.js: Added.
2052         * modules/resources/assert.js:
2053         (export.shouldNotThrow):
2054         * stress/import-syntax.js:
2055
2056 2017-10-04  Saam Barati  <sbarati@apple.com>
2057
2058         Make pertinent AccessCases watch the poly proto watchpoint
2059         https://bugs.webkit.org/show_bug.cgi?id=177765
2060
2061         Reviewed by Keith Miller.
2062
2063         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
2064         (assert):
2065         (foo.C):
2066         (foo):
2067         (validate):
2068         * stress/poly-proto-clear-stub.js: Added.
2069         (assert):
2070         (foo.C):
2071         (foo):
2072
2073 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
2074
2075         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
2076
2077         Unreviewed test gardening.
2078
2079         * test262.yaml:
2080
2081 2017-10-04  Saam Barati  <sbarati@apple.com>
2082
2083         3 poly-proto JSC tests timing out on debug after r222827
2084         https://bugs.webkit.org/show_bug.cgi?id=177880
2085
2086         Rubber stamped by Mark Lam.
2087
2088         * microbenchmarks/poly-proto-access.js:
2089         * typeProfiler/deltablue-for-of.js:
2090         * typeProfiler/getter-richards.js:
2091
2092 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
2093
2094         Unreviewed, marking tco-catch.js as a failure after test262 update
2095         https://bugs.webkit.org/show_bug.cgi?id=177859
2096
2097         * test262.yaml:
2098
2099 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2100
2101         Unreviewed, marking one async iterator test262 test failed
2102         https://bugs.webkit.org/show_bug.cgi?id=177859
2103
2104         * test262.yaml:
2105
2106 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2107
2108         [Test262] Update Test262 to Oct 4 version
2109         https://bugs.webkit.org/show_bug.cgi?id=177859
2110
2111         Reviewed by Sam Weinig.
2112
2113         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
2114         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
2115
2116         * test262.yaml:
2117         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
2118         (checkSequence):
2119         * test262/harness/typeCoercion.js:
2120         (testCoercibleToIndexZero):
2121         (testCoercibleToIndexOne):
2122         (testCoercibleToIndexFromIndex):
2123         (testNotCoercibleToIndex.testPrimitiveValue):
2124         (testNotCoercibleToInteger):
2125         (testCoercibleToBigIntZero.testPrimitiveValue):
2126         (testCoercibleToBigIntZero):
2127         (testCoercibleToBigIntOne.testPrimitiveValue):
2128         (testCoercibleToBigIntOne):
2129         (testPrimitiveValue):
2130         (testCoercibleToBigIntFromBigInt):
2131         (testNotCoercibleToBigInt.testPrimitiveValue):
2132         (testNotCoercibleToBigInt.testStringValue):
2133         (testNotCoercibleToBigInt):
2134         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
2135         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
2136         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
2137         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
2138         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
2139         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
2140         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
2141         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
2142         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
2143         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
2144         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
2145         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
2146         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
2147         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
2148         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
2149         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
2150         (testCoercibleToBigIntZero):
2151         (testCoercibleToBigIntOne):
2152         (testNotCoercibleToBigInt):
2153         (MyError): Deleted.
2154         (valueOf): Deleted.
2155         (toString): Deleted.
2156         (Symbol.toPrimitive): Deleted.
2157         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
2158         (testCoercibleToIndexZero):
2159         (testCoercibleToIndexOne):
2160         (testNotCoercibleToIndex):
2161         (MyError): Deleted.
2162         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
2163         (assert.sameValue.BigInt.asIntN.toString): Deleted.
2164         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
2165         (BigInt.asIntN.valueOf): Deleted.
2166         (BigInt.asIntN.toString): Deleted.
2167         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
2168         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
2169         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
2170         (testCoercibleToBigIntZero):
2171         (testCoercibleToBigIntOne):
2172         (testNotCoercibleToBigInt):
2173         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
2174         (testCoercibleToIndexZero):
2175         (testCoercibleToIndexOne):
2176         (testNotCoercibleToIndex):
2177         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
2178         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
2179         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
2180         (bits.valueOf):
2181         (bigint.valueOf):
2182         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
2183         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
2184         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
2185         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
2186         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
2187         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
2188         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
2189         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
2190         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
2191         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
2192         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
2193         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
2194         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
2195         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
2196         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
2197         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
2198         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
2199         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
2200         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
2201         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
2202         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
2203         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
2204         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
2205         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
2206         (replacer):
2207         (BigInt.prototype.toJSON):
2208         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
2209         (replacer):
2210         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
2211         (BigInt.prototype.toJSON):
2212         * test262/test/built-ins/JSON/stringify/bigint.js:
2213         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
2214         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
2215         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
2216         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
2217         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
2218         * test262/test/built-ins/Object/proto-from-ctor.js:
2219         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
2220         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
2221         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
2222         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
2223         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
2224         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
2225         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
2226         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
2227         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
2228         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
2229         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
2230         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
2231         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
2232         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
2233         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
2234         * test262/test/built-ins/Proxy/get-fn-realm.js:
2235         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
2236         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
2237         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
2238         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
2239         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
2240         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
2241         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
2242         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
2243         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
2244         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
2245         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
2246         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
2247         (i6.replace):
2248         (i6b.replace):
2249         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
2250         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
2251         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
2252         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
2253         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
2254         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
2255         * test262/test/built-ins/RegExp/u180e.js: Added.
2256         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
2257         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
2258         * test262/test/built-ins/String/proto-from-ctor-realm.js:
2259         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
2260         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
2261         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
2262         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
2263         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
2264         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
2265         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
2266         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
2267         * test262/test/built-ins/String/prototype/endsWith/length.js:
2268         * test262/test/built-ins/String/prototype/endsWith/name.js:
2269         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
2270         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
2271         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
2272         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
2273         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
2274         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
2275         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
2276         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
2277         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
2278         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
2279         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
2280         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
2281         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
2282         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
2283         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
2284         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
2285         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
2286         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
2287         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
2288         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
2289         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
2290         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
2291         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
2292         * test262/test/built-ins/String/prototype/includes/includes.js:
2293         * test262/test/built-ins/String/prototype/includes/length.js:
2294         * test262/test/built-ins/String/prototype/includes/name.js:
2295         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
2296         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
2297         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
2298         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
2299         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
2300         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
2301         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
2302         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
2303         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
2304         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
2305         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
2306         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
2307         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
2308         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
2309         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
2310         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
2311         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
2312         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
2313         * test262/test/built-ins/String/prototype/trim/u180e.js:
2314         * test262/test/built-ins/Symbol/for/cross-realm.js:
2315         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
2316         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
2317         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
2318         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
2319         * test262/test/built-ins/Symbol/match/cross-realm.js:
2320         * test262/test/built-ins/Symbol/replace/cross-realm.js:
2321         * test262/test/built-ins/Symbol/search/cross-realm.js:
2322         * test262/test/built-ins/Symbol/species/cross-realm.js:
2323         * test262/test/built-ins/Symbol/split/cross-realm.js:
2324         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
2325         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
2326         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
2327         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
2328         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
2329         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
2330         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
2331         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
2332         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
2333         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
2334         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
2335         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
2336         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
2337         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
2338         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
2339         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
2340         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
2341         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
2342         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
2343         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
2344         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
2345         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
2346         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
2347         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
2348         * test262/test/language/comments/mongolian-vowel-separator-single.js:
2349         * test262/test/language/eval-code/indirect/realm.js:
2350         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
2351         (o.get z):
2352         (o.get a):
2353         * test262/test/language/expressions/call/eval-realm-indirect.js:
2354         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
2355         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
2356         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
2357         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
2358         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2359         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
2360         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
2361         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
2362         * test262/test/language/expressions/greater-than/bigint-and-number.js:
2363         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
2364         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
2365         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
2366         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2367         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
2368         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
2369         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
2370         * test262/test/language/expressions/less-than/bigint-and-number.js:
2371         * test262/test/language/expressions/new/non-ctor-err-realm.js:
2372         * test262/test/language/expressions/super/realm.js:
2373         * test262/test/language/expressions/tagged-template/cache-realm.js:
2374         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
2375         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
2376         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
2377         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
2378         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
2379         * test262/test/language/literals/string/mongolian-vowel-separator.js:
2380         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
2381         (o.get z):
2382         (o.get a):
2383         * test262/test/language/statements/for-of/iterator-next-reference.js:
2384         (next):
2385         (iterator.next): Deleted.
2386         (x.of.iterable.): Deleted.
2387         (x.of.iterable.get return): Deleted.
2388         (x.of.iterable.iterator.next): Deleted.
2389         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
2390         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
2391         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
2392         * test262/test/language/white-space/mongolian-vowel-separator.js:
2393         * test262/test262-Revision.txt:
2394
2395 2017-10-03  Saam Barati  <sbarati@apple.com>
2396
2397         Implement polymorphic prototypes
2398         https://bugs.webkit.org/show_bug.cgi?id=176391
2399
2400         Reviewed by Filip Pizlo.
2401
2402         * microbenchmarks/poly-proto-access.js: Added.
2403         (assert):
2404         (foo.C):
2405         (foo.C.prototype.get bar):
2406         (foo):
2407         (bar):
2408         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
2409         (assert):
2410         (makePolyProtoObject.foo.C):
2411         (makePolyProtoObject.foo):
2412         (makePolyProtoObject):
2413         (performSet):
2414         * microbenchmarks/poly-proto-setter-speed.js: Added.
2415         (assert):
2416         (makePolyProtoObject.foo.C):
2417         (makePolyProtoObject.foo.C.prototype.set p):
2418         (makePolyProtoObject.foo):
2419         (makePolyProtoObject):
2420         (performSet):
2421         * stress/constructor-with-return.js:
2422         (i.tests.forEach.Constructor):
2423         (i.tests.forEach):
2424         (tests.forEach.Constructor): Deleted.
2425         (tests.forEach): Deleted.
2426         * stress/dom-jit-with-poly-proto.js: Added.
2427         (assert):
2428         (makePolyProtoObject.foo.C):
2429         (makePolyProtoObject.foo):
2430         (makePolyProtoObject):
2431         (validate):
2432         * stress/poly-proto-custom-value-and-accessor.js: Added.
2433         (assert):
2434         (makePolyProtoObject.foo.C):
2435         (makePolyProtoObject.foo):
2436         (makePolyProtoObject):
2437         (items.forEach):
2438         (set get for):
2439         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
2440         (assert):
2441         (makePolyProtoObject.foo.C):
2442         (makePolyProtoObject.foo):
2443         (makePolyProtoObject):
2444         (foo):
2445         * stress/poly-proto-miss.js: Added.
2446         (makePolyProtoInstanceWithNullPrototype.foo.C):
2447         (makePolyProtoInstanceWithNullPrototype.foo):
2448         (makePolyProtoInstanceWithNullPrototype):
2449         (assert):
2450         (validate):
2451         * stress/poly-proto-op-in-caching.js: Added.
2452         (assert):
2453         (makePolyProtoObject.foo.C):
2454         (makePolyProtoObject.foo):
2455         (makePolyProtoObject):
2456         (validate):
2457         (validate2):
2458         * stress/poly-proto-put-transition.js: Added.
2459         (assert):
2460         (makePolyProtoObject.foo.C):
2461         (makePolyProtoObject.foo):
2462         (makePolyProtoObject):
2463         (performSet):
2464         (i.obj.__proto__.set p):
2465         * stress/poly-proto-set-prototype.js: Added.
2466         (assert):
2467         (let.alternateProto.get x):
2468         (let.alternateProto2.get y):
2469         (let.alternateProto2.get x):
2470         (foo.C):
2471         (foo):
2472         (validate):
2473         * stress/poly-proto-setter.js: Added.
2474         (assert):
2475         (makePolyProtoObject.foo.C):
2476         (makePolyProtoObject.foo.C.prototype.set p):
2477         (makePolyProtoObject.foo.C.prototype.get p):
2478         (makePolyProtoObject.foo):
2479         (makePolyProtoObject):
2480         (performSet):
2481         * stress/poly-proto-using-inheritance.js: Added.
2482         (assert):
2483         (foo.C):
2484         (foo.C.prototype.get baz):
2485         (foo):
2486         (bar.C):
2487         (bar):
2488         (validate):
2489         * stress/primitive-poly-proto.js: Added.
2490         (makePolyProtoInstance.foo.C):
2491         (makePolyProtoInstance.foo):
2492         (makePolyProtoInstance):
2493         (assert):
2494         (validate):
2495         * stress/prototype-is-not-js-object.js: Added.
2496         (foo.bar):
2497         (foo):
2498         (assert):
2499         (validate):
2500         * stress/try-get-by-id-poly-proto.js: Added.
2501         (assert):
2502         (makePolyProtoObject.foo.C):
2503         (makePolyProtoObject.foo):
2504         (makePolyProtoObject):
2505         (tryGetByIdText):
2506         (x.__proto__.get bar):
2507         (validate):
2508         * typeProfiler/overflow.js:
2509
2510 2017-10-03  JF Bastien  <jfbastien@apple.com>
2511
2512         WebAssembly: no VM / JS version of everything but Instance
2513         https://bugs.webkit.org/show_bug.cgi?id=177473
2514
2515         Reviewed by Filip Pizlo.
2516
2517         - Exceeding max on memory growth now returns a range error as per
2518         spec. This is a (very minor) breaking change: it used to throw OOM
2519         error. Update the corresponding test.
2520
2521         * wasm/js-api/memory-grow.js:
2522         (assertEq):
2523         * wasm/js-api/table.js:
2524         (assert.throws):
2525
2526 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
2527
2528         Skip JSC test stress/regress-159779-2.js on debug.
2529         https://bugs.webkit.org/show_bug.cgi?id=177204
2530
2531         Unreviewed test gardening.
2532
2533         * stress/regress-159779-2.js:
2534
2535 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
2536
2537         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2538         https://bugs.webkit.org/show_bug.cgi?id=175642
2539
2540         Reviewed by Darin Adler.
2541
2542         * ChakraCore/test/Function/apply3.baseline-jsc:
2543
2544 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2545
2546         Unreviewed, rolling out r222564.
2547         https://bugs.webkit.org/show_bug.cgi?id=177720
2548
2549         "It regressed JetStream by 2% on iOS caused by a 50%
2550         regression on the bigfib subtest" (Requested by saamyjoon on
2551         #webkit).
2552
2553         Reverted changeset:
2554
2555         "Add Above/Below comparisons for UInt32 patterns"
2556         https://bugs.webkit.org/show_bug.cgi?id=177281
2557         http://trac.webkit.org/changeset/222564
2558
2559 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2560
2561         [DFG] Support ArrayPush with multiple args
2562         https://bugs.webkit.org/show_bug.cgi?id=175823
2563
2564         Reviewed by Saam Barati.
2565
2566         * microbenchmarks/array-push-0.js: Added.
2567         (arrayPush0):
2568         * microbenchmarks/array-push-1.js: Added.
2569         (arrayPush1):
2570         * microbenchmarks/array-push-2.js: Added.
2571         (arrayPush2):
2572         * microbenchmarks/array-push-3.js: Added.
2573         (arrayPush3):
2574         * stress/array-push-multiple-contiguous.js: Added.
2575         (shouldBe):
2576         (test):
2577         * stress/array-push-multiple-double-nan.js: Added.
2578         (shouldBe):
2579         (test):
2580         * stress/array-push-multiple-double.js: Added.
2581         (shouldBe):
2582         (test):
2583         * stress/array-push-multiple-int32.js: Added.
2584         (shouldBe):
2585         (test):
2586         * stress/array-push-multiple-many-contiguous.js: Added.
2587         (shouldBe):
2588         (test):
2589         * stress/array-push-multiple-many-double.js: Added.
2590         (shouldBe):
2591         (test):
2592         * stress/array-push-multiple-many-int32.js: Added.
2593         (shouldBe):
2594         (test):
2595         * stress/array-push-multiple-many-storage.js: Added.
2596         (shouldBe):
2597         (test):
2598         * stress/array-push-multiple-storage.js: Added.
2599         (shouldBe):
2600         (test):
2601         * stress/array-push-with-force-exit.js: Added.
2602         (target.createBuiltin):
2603
2604 2017-09-29  Saam Barati  <sbarati@apple.com>
2605
2606         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2607         https://bugs.webkit.org/show_bug.cgi?id=177639
2608
2609         Reviewed by Geoffrey Garen.
2610
2611         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2612         (assert):
2613         (Class):
2614         (items.forEach):
2615         (set get for):
2616
2617 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2618
2619         Unreviewed, rolling out r222563, r222565, and r222581.
2620         https://bugs.webkit.org/show_bug.cgi?id=177675
2621
2622         "It causes a crash when playing youtube videos" (Requested by
2623         saamyjoon on #webkit).
2624
2625         Reverted changesets:
2626
2627         "[DFG] Support ArrayPush with multiple args"
2628         https://bugs.webkit.org/show_bug.cgi?id=175823
2629         http://trac.webkit.org/changeset/222563
2630
2631         "Unreviewed, build fix after r222563"
2632         https://bugs.webkit.org/show_bug.cgi?id=175823
2633         http://trac.webkit.org/changeset/222565
2634
2635         "Unreviewed, fix x86 breaking due to exhausted registers"
2636         https://bugs.webkit.org/show_bug.cgi?id=175823
2637         http://trac.webkit.org/changeset/222581
2638
2639 2017-09-28  Mark Lam  <mark.lam@apple.com>
2640
2641         test262: Unexpected passes after r222617 and r222618.
2642         https://bugs.webkit.org/show_bug.cgi?id=177622
2643         <rdar://problem/34725960>
2644
2645         Reviewed by Saam Barati.
2646
2647         Update test262.yaml for tests that are now passing.
2648
2649         * test262.yaml:
2650
2651 2017-09-27  Michael Saboff  <msaboff@apple.com>
2652
2653         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2654         https://bugs.webkit.org/show_bug.cgi?id=177570
2655
2656         Reviewed by Filip Pizlo.
2657
2658         New regression test.
2659
2660         * stress/regress-177570.js: Added.
2661
2662 2017-09-28  Michael Saboff  <msaboff@apple.com>
2663
2664         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2665         https://bugs.webkit.org/show_bug.cgi?id=177423
2666
2667         Reviewed by Mark Lam.
2668
2669         Updated regression test.
2670
2671         * stress/regress-177423.js:
2672         (catch):
2673
2674 2017-09-27  Mark Lam  <mark.lam@apple.com>
2675
2676         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2677         https://bugs.webkit.org/show_bug.cgi?id=177584
2678         <rdar://problem/34463903>
2679
2680         Reviewed by Saam Barati.
2681
2682         * stress/regress-177584.js: Added.
2683         (assertEqual):
2684         (Array.prototype.Symbol.species):
2685
2686 2017-09-27  Saam Barati  <sbarati@apple.com>
2687
2688         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2689         https://bugs.webkit.org/show_bug.cgi?id=177523
2690
2691         Reviewed by Mark Lam.
2692
2693         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2694         (assert):
2695         (Test):
2696         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2697         (addMethods):
2698         (i.Test.prototype.propName):
2699
2700 2017-09-27  Mark Lam  <mark.lam@apple.com>
2701
2702         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2703         https://bugs.webkit.org/show_bug.cgi?id=177423
2704         <rdar://problem/34621320>
2705
2706         Reviewed by Keith Miller.
2707
2708         * stress/regress-177423.js: Added.
2709
2710 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2711
2712         Add Above/Below comparisons for UInt32 patterns
2713         https://bugs.webkit.org/show_bug.cgi?id=177281
2714
2715         Reviewed by Saam Barati.
2716
2717         * stress/uint32-comparison-jump.js: Added.
2718         (shouldBe):
2719         (above):
2720         (aboveOrEqual):
2721         (below):
2722         (belowOrEqual):
2723         (notAbove):
2724         (notAboveOrEqual):
2725         (notBelow):
2726         (notBelowOrEqual):
2727         * stress/uint32-comparison.js: Added.
2728         (shouldBe):
2729         (above):
2730         (aboveOrEqual):
2731         (below):
2732         (belowOrEqual):
2733         (aboveTest):
2734         (aboveOrEqualTest):
2735         (belowTest):
2736         (belowOrEqualTest):
2737
2738 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2739
2740         [DFG] Support ArrayPush with multiple args
2741         https://bugs.webkit.org/show_bug.cgi?id=175823
2742
2743         Reviewed by Saam Barati.
2744
2745         * microbenchmarks/array-push-0.js: Added.
2746         (arrayPush0):
2747         * microbenchmarks/array-push-1.js: Added.
2748         (arrayPush1):
2749         * microbenchmarks/array-push-2.js: Added.
2750         (arrayPush2):
2751         * microbenchmarks/array-push-3.js: Added.
2752         (arrayPush3):
2753         * stress/array-push-multiple-contiguous.js: Added.
2754         (shouldBe):
2755         (test):
2756         * stress/array-push-multiple-double-nan.js: Added.
2757         (shouldBe):
2758         (test):
2759         * stress/array-push-multiple-double.js: Added.
2760         (shouldBe):
2761         (test):
2762         * stress/array-push-multiple-int32.js: Added.
2763         (shouldBe):
2764         (test):
2765         * stress/array-push-multiple-many-contiguous.js: Added.
2766         (shouldBe):
2767         (test):
2768         * stress/array-push-multiple-many-double.js: Added.
2769         (shouldBe):
2770         (test):
2771         * stress/array-push-multiple-many-int32.js: Added.
2772         (shouldBe):
2773         (test):
2774         * stress/array-push-multiple-many-storage.js: Added.
2775         (shouldBe):
2776         (test):
2777         * stress/array-push-multiple-storage.js: Added.
2778         (shouldBe):
2779         (test):
2780
2781 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2782
2783         Unreviewed, rolling out r222518.
2784         https://bugs.webkit.org/show_bug.cgi?id=177507
2785
2786         Break the High Sierra build (Requested by yusukesuzuki on
2787         #webkit).
2788
2789         Reverted changeset:
2790
2791         "Add Above/Below comparisons for UInt32 patterns"
2792         https://bugs.webkit.org/show_bug.cgi?id=177281
2793         http://trac.webkit.org/changeset/222518
2794
2795 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2796
2797         Add Above/Below comparisons for UInt32 patterns
2798         https://bugs.webkit.org/show_bug.cgi?id=177281
2799
2800         Reviewed by Saam Barati.
2801
2802         * stress/uint32-comparison-jump.js: Added.
2803         (shouldBe):
2804         (above):
2805         (aboveOrEqual):
2806         (below):
2807         (belowOrEqual):
2808         (notAbove):
2809         (notAboveOrEqual):
2810         (notBelow):
2811         (notBelowOrEqual):
2812         * stress/uint32-comparison.js: Added.
2813         (shouldBe):
2814         (above):
2815         (aboveOrEqual):
2816         (below):
2817         (belowOrEqual):
2818         (aboveTest):
2819         (aboveOrEqualTest):
2820         (belowTest):
2821         (belowOrEqualTest):
2822
2823 2017-09-23  Keith Miller  <keith_miller@apple.com>
2824
2825         Fix infinite looping test262 test
2826         https://bugs.webkit.org/show_bug.cgi?id=177412
2827
2828         Reviewed by Yusuke Suzuki.
2829
2830         This test was poorly designed since failing it would cause the vm
2831         to inifinite loop. I've fixed it locally and will fix it on github pending
2832         the results of next weeks tc39 meeting.
2833
2834         * test262.yaml:
2835         * test262/test/language/statements/for-of/iterator-next-reference.js:
2836
2837 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2838
2839         test262: $.agent became $262.agent in test262 update
2840         https://bugs.webkit.org/show_bug.cgi?id=177407
2841
2842         Reviewed by Yusuke Suzuki.
2843
2844         * test262.yaml:
2845         ~320 tests pass now that we correctly make $262 available.
2846
2847 2017-09-22  Keith Miller  <keith_miller@apple.com>
2848
2849         Speculatively change iteration protocall to use the same next function
2850         https://bugs.webkit.org/show_bug.cgi?id=175653
2851
2852         Reviewed by Saam Barati.
2853
2854         Change test to match the new iteration behavior.
2855
2856         * stress/spread-optimized-properly.js:
2857
2858 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2859
2860         [DFG][FTL] Profile array vector length for array allocation
2861         https://bugs.webkit.org/show_bug.cgi?id=177051
2862
2863         Reviewed by Saam Barati.
2864
2865         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2866         (target):
2867
2868 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2869
2870         Unreviewed, rolling out r222380.
2871         https://bugs.webkit.org/show_bug.cgi?id=177352
2872
2873         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2874         #webkit).
2875
2876         Reverted changeset:
2877
2878         "[DFG][FTL] Profile array vector length for array allocation"
2879         https://bugs.webkit.org/show_bug.cgi?id=177051
2880         http://trac.webkit.org/changeset/222380
2881
2882 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2883
2884         [DFG][FTL] Profile array vector length for array allocation
2885         https://bugs.webkit.org/show_bug.cgi?id=177051
2886
2887         Reviewed by Saam Barati.
2888
2889         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2890         (target):
2891
2892 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2893
2894         Skip new hanging test262 tests.
2895         https://bugs.webkit.org/show_bug.cgi?id=177326
2896
2897         Unreviewed test gardening.
2898
2899         * test262.yaml:
2900
2901 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2902
2903         Mark 6 test262 tests as passing.
2904         https://bugs.webkit.org/show_bug.cgi?id=177307
2905
2906         Unreviewed test gardening.
2907
2908         * test262.yaml:
2909
2910 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2911
2912         Unreviewed follow-up to r222311.
2913
2914         * test262/harness/sta.js:
2915         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2916         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2917         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2918         * test262/test/built-ins/Array/from/elements-added-after.js:
2919         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2920         * test262/test/built-ins/Array/from/elements-updated-after.js:
2921         * test262/test/built-ins/Array/from/from-array.js:
2922         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2923         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2924         * test262/test/built-ins/Array/from/source-array-boundary.js:
2925         * test262/test/built-ins/Array/from/source-object-constructor.js:
2926         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2927         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2928         * test262/test/built-ins/Array/from/source-object-length.js:
2929         * test262/test/built-ins/Array/from/source-object-missing.js:
2930         * test262/test/built-ins/Array/from/source-object-without.js:
2931         * test262/test/built-ins/Array/from/this-null.js:
2932         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2933         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2934         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2935         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2936         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2937         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2938         * test262/test/language/literals/string/7.8.4-1gs.js:
2939         Fix some files that I failed to update when I applied my patch.
2940
2941 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2942
2943         Update test262 tests
2944         https://bugs.webkit.org/show_bug.cgi?id=177220
2945
2946         Reviewed by Saam Barati and Yusuke Suzuki.
2947
2948         * test262.yaml:
2949         * test262/test262-Revision.txt:
2950         New rebaselined expectations for all tests.
2951
2952         * test262/*:
2953         Updated.
2954
2955 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2956
2957         [DFG] Remove ToThis more aggressively
2958         https://bugs.webkit.org/show_bug.cgi?id=177056
2959
2960         Reviewed by Saam Barati.
2961
2962         * stress/generator-with-this-strict.js: Added.
2963         (shouldBe):
2964         (generator):
2965         (target):
2966         * stress/generator-with-this.js: Added.
2967         (shouldBe):
2968         (generator):
2969         (target):
2970
2971 2017-09-17  Michael Saboff  <msaboff@apple.com>
2972
2973         https://bugs.webkit.org/show_bug.cgi?id=177038
2974         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2975
2976         Reviewed by JF Bastien.
2977
2978         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2979         as it dies using too much memory.
2980
2981 2017-09-15  Saam Barati  <sbarati@apple.com>
2982
2983         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2984         https://bugs.webkit.org/show_bug.cgi?id=176981
2985
2986         Reviewed by Yusuke Suzuki.
2987
2988         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2989         (assert):
2990         (verify):
2991         (func):
2992         (const.bar.createBuiltin):
2993
2994 2017-09-14  Saam Barati  <sbarati@apple.com>
2995
2996         It should be valid to exit before each set when doing arity fixup when inlining
2997         https://bugs.webkit.org/show_bug.cgi?id=176948
2998
2999         Reviewed by Keith Miller.
3000
3001         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
3002         (baz):
3003         (bar):
3004         (foo):
3005
3006 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
3007
3008         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
3009         https://bugs.webkit.org/show_bug.cgi?id=176867
3010
3011         Reviewed by Sam Weinig.
3012
3013         * microbenchmarks/object-get-own-property-symbols.js: Added.
3014         (test):
3015
3016 2017-09-13  Mark Lam  <mark.lam@apple.com>
3017
3018         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
3019         https://bugs.webkit.org/show_bug.cgi?id=176888
3020         <rdar://problem/34381832>
3021
3022         Not reviewed.
3023
3024         * stress/op_mod-ConstVar.js:
3025         * stress/op_mod-VarConst.js:
3026         * stress/op_mod-VarVar.js:
3027
3028 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
3029
3030         Skip 3 op_mod tests on Debug JSC bots.
3031         https://bugs.webkit.org/show_bug.cgi?id=176630
3032
3033         Unreviewed test gardening.
3034
3035         * stress/op_mod-ConstVar.js:
3036         * stress/op_mod-VarConst.js:
3037         * stress/op_mod-VarVar.js:
3038
3039 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3040
3041         [JSC] Fix Array allocation in Object.keys
3042         https://bugs.webkit.org/show_bug.cgi?id=176826
3043
3044         Reviewed by Saam Barati.
3045
3046         * stress/object-own-property-keys.js: Added.
3047         (shouldBe):
3048
3049 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3050
3051         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
3052         https://bugs.webkit.org/show_bug.cgi?id=176010
3053
3054         Reviewed by Filip Pizlo.
3055
3056         * microbenchmarks/weak-map-key.js: Added.
3057         (assert):
3058         (objectKey):
3059         (let.start.Date.now):
3060
3061 2017-09-12  Mark Lam  <mark.lam@apple.com>
3062
3063         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
3064         https://bugs.webkit.org/show_bug.cgi?id=176630
3065
3066         Reviewed by JF Bastien.
3067
3068         Debug builds are just slow, and these tests do a lot.  They pass when I run them
3069         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
3070         a speculative fix for the bots that are seeing these fail.
3071
3072         I also undid the skipping of the op_mod tests for debug builds.
3073
3074         * stress/op_div-ConstVar.js:
3075         * stress/op_div-VarConst.js:
3076         * stress/op_div-VarVar.js:
3077         * stress/op_mod-ConstVar.js:
3078         * stress/op_mod-VarConst.js:
3079         * stress/op_mod-VarVar.js:
3080
3081 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
3082
3083         Skip stress/value-to-boolean.js on Debug bots.
3084         https://bugs.webkit.org/show_bug.cgi?id=176787
3085
3086         Unreviewed test gardening.
3087
3088         * stress/value-to-boolean.js:
3089
3090 2017-09-11  Mark Lam  <mark.lam@apple.com>
3091
3092         Change test expectation for test262/test/language/statements/try/tco-catch.js
3093         https://bugs.webkit.org/show_bug.cgi?id=176749
3094
3095         Rubber stamped by Keith Miller.
3096
3097         It's been failing since at least r221821.  I'm changing the test expectation to
3098         fail to green the bots while I investigate some more.
3099
3100         * test262.yaml:
3101
3102 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
3103
3104         Unreviewed, rolling out r221854.
3105
3106         The test added with this change fails on 32-bit JSC bots.
3107
3108         Reverted changeset:
3109
3110         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
3111         https://bugs.webkit.org/show_bug.cgi?id=176010
3112         http://trac.webkit.org/changeset/221854
3113
3114 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3115
3116         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
3117         https://bugs.webkit.org/show_bug.cgi?id=176010
3118
3119         Reviewed by Filip Pizlo.
3120
3121         * microbenchmarks/weak-map-key.js: Added.
3122         (assert):
3123         (objectKey):
3124         (let.start.Date.now):
3125
3126 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
3127
3128         [JSC] Optimize Object.keys by using careful array allocation
3129         https://bugs.webkit.org/show_bug.cgi?id=176654
3130
3131         Reviewed by Darin Adler.
3132
3133         * microbenchmarks/object-keys.js: Added.
3134         (test):
3135
3136 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
3137
3138         Error should compute .stack and friends lazily
3139         https://bugs.webkit.org/show_bug.cgi?id=176645
3140
3141         Reviewed by Saam Barati.
3142
3143         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
3144         * microbenchmarks/new-error.js: Added.
3145         * microbenchmarks/throw.js: Added.
3146
3147 2017-09-09  Mark Lam  <mark.lam@apple.com>
3148
3149         [Re-landing] Use JIT probes for DFG OSR exit.
3150         https://bugs.webkit.org/show_bug.cgi?id=175144
3151         <rdar://problem/33437050>
3152
3153         Not reviewed.  Original patch reviewed by Saam Barati.
3154
3155         Disable these tests for debug builds because they run too slow with the new OSR exit.
3156
3157         * stress/op_mod-ConstVar.js:
3158         * stress/op_mod-VarConst.js:
3159         * stress/op_mod-VarVar.js:
3160
3161 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3162
3163         [DFG] NewArrayWithSize(size)'s size does not care negative zero
3164         https://bugs.webkit.org/show_bug.cgi?id=176300
3165
3166         Reviewed by Saam Barati.
3167
3168         * stress/new-array-with-size-div.js: Added.
3169         (shouldBe):
3170         (test):
3171         (i.i):
3172
3173 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3174
3175         [DFG] PutByVal with Array::Generic is too generic
3176         https://bugs.webkit.org/show_bug.cgi?id=176345
3177
3178         Reviewed by Filip Pizlo.
3179
3180         * stress/object-assign-symbols.js: Added.
3181         (shouldBe):
3182         (test):
3183         * stress/object-assign.js: Added.
3184         (shouldBe):
3185         (test):
3186         (i.shouldBe.JSON.stringify.test):
3187
3188 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3189
3190         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
3191         https://bugs.webkit.org/show_bug.cgi?id=176590
3192
3193         Reviewed by Saam Barati.
3194
3195         * microbenchmarks/object-iterate-symbols.js: Added.
3196         (test):
3197         * microbenchmarks/object-iterate.js: Added.
3198         (test):
3199         * stress/object-iterate-symbols.js: Added.
3200         (shouldBe):
3201         (test):
3202         * stress/object-iterate.js: Added.
3203         (shouldBe):
3204         (test):
3205
3206 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
3207
3208         [Win32] 10 JSC stress tests are failing.
3209         https://bugs.webkit.org/show_bug.cgi?id=176538
3210
3211         Reviewed by Mark Lam.
3212
3213         Skip tests on Windows to make the bots green.
3214
3215         * ChakraCore.yaml:
3216         * stress/date-relaxed.js:
3217
3218 2017-09-06  Mark Lam  <mark.lam@apple.com>
3219
3220         constructGenericTypedArrayViewWithArguments() is missing an exception check.
3221         https://bugs.webkit.org/show_bug.cgi?id=176485
3222         <rdar://problem/33898874>
3223
3224         Reviewed by Keith Miller.
3225
3226         * stress/regress-176485.js: Added.
3227
3228 2017-09-05  Saam Barati  <sbarati@apple.com>
3229
3230         isNotCellSpeculation is wrong with respect to SpecEmpty
3231         https://bugs.webkit.org/show_bug.cgi?id=176429
3232
3233         Reviewed by Michael Saboff.
3234
3235         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
3236         (Foo):
3237
3238 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
3239
3240         test262: Completion values for control flow do not match the spec
3241         https://bugs.webkit.org/show_bug.cgi?id=171265
3242
3243         Reviewed by Saam Barati.
3244
3245         * stress/completion-value.js:
3246         Condensed test for completion values in top level statements.
3247
3248         * stress/super-get-by-id.js:
3249         ClassDeclaration when evaled no longer produce values. Convert
3250         these to ClassExpressions so they produce the class value.
3251         
3252         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3253         This is a progression for currect spec behavior.
3254
3255         * mozilla/mozilla-tests.yaml:
3256         This test is now outdated, so mark it as failing for that reason.
3257
3258         * test262.yaml:
3259         Passing all "cptn" completion value tests.
3260
3261 2017-09-04  Saam Barati  <sbarati@apple.com>
3262
3263         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
3264         https://bugs.webkit.org/show_bug.cgi?id=176317
3265
3266         Reviewed by Keith Miller.
3267
3268         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
3269         (Foo):
3270
3271 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3272
3273         [DFG][FTL] Efficiently execute number#toString()
3274         https://bugs.webkit.org/show_bug.cgi?id=170007
3275
3276         Reviewed by Keith Miller.
3277
3278         * microbenchmarks/number-to-string-strength-reduction.js: Added.
3279         (test):
3280         * microbenchmarks/number-to-string-with-radix-10.js: Added.
3281         (test):
3282         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
3283         (test):
3284         * microbenchmarks/number-to-string-with-radix.js: Added.
3285         (test):
3286         * stress/number-to-string-strength-reduction.js: Added.
3287         (shouldBe):
3288         (test):
3289         * stress/number-to-string-with-radix-10.js: Added.
3290         (shouldBe):
3291         (test):
3292         * stress/number-to-string-with-radix-cse.js: Added.
3293         (shouldBe):
3294         (test):
3295         * stress/number-to-string-with-radix-invalid.js: Added.
3296         (shouldThrow):
3297         * stress/number-to-string-with-radix-watchpoint.js: Added.
3298         (shouldBe):
3299         (test):
3300         (i.i.1e3.Number.prototype.toString):
3301         * stress/number-to-string-with-radix.js: Added.
3302         (shouldBe):
3303         (test):
3304
3305 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3306
3307         [DFG] Relax arity requirement
3308         https://bugs.webkit.org/show_bug.cgi?id=175523
3309
3310         Reviewed by Saam Barati.
3311
3312         * stress/arity-mismatch-arguments-length.js: Added.
3313         (shouldBe):
3314         (test1):
3315         (test):
3316         * stress/arity-mismatch-get-argument.js: Added.
3317         (shouldBe):
3318         (builtin.createBuiltin):
3319         (test):
3320         * stress/arity-mismatch-inlining-extra-slots.js: Added.
3321         (shouldBe):
3322         (inlineTarget):
3323         (test):
3324         * stress/arity-mismatch-inlining.js: Added.
3325         (shouldBe):
3326         (inlineTarget):
3327         (test):
3328         * stress/arity-mismatch-rest.js: Added.
3329         (shouldBe):
3330         (test2):
3331         (test1):
3332         (test):
3333
3334 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3335
3336         [JSC] Fix "name" and "length" of Proxy revoke function
3337         https://bugs.webkit.org/show_bug.cgi?id=176155
3338
3339         Reviewed by Mark Lam.
3340
3341         * test262.yaml:
3342
3343 2017-08-31  Saam Barati  <sbarati@apple.com>
3344
3345         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
3346         https://bugs.webkit.org/show_bug.cgi?id=176206
3347
3348         Reviewed by Keith Miller.
3349
3350         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
3351         (a):
3352         (b):
3353         (foo):
3354
3355 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
3356
3357         Skip two slow JSC tests after r221422.
3358
3359         Unreviewed test gardening.
3360
3361         * stress/regexp-prototype-match-on-too-long-rope.js:
3362         * stress/regexp-prototype-test-on-too-long-rope.js:
3363
3364 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
3365
3366         Unreviewed, skipping slow tests.
3367         
3368         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
3369         work differently now.
3370
3371         * stress/regexp-prototype-exec-on-too-long-rope.js:
3372         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
3373
3374 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3375
3376         [JSC] Use reifying system for "name" property of builtin JSFunction
3377         https://bugs.webkit.org/show_bug.cgi?id=175260
3378
3379         Reviewed by Saam Barati.
3380
3381         * stress/accessors-get-set-prefix.js:
3382         * stress/builtin-function-name.js: Added.
3383         (shouldBe):
3384         (shouldThrow):
3385         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3386         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3387         * stress/private-name-as-anonymous-builtin.js: Added.
3388         (shouldBe):
3389         (NotPromise):
3390
3391 2017-08-30  Saam Barati  <sbarati@apple.com>
3392
3393         Unreviewed. Make test stop printing.
3394
3395         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
3396
3397 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
3398
3399         Unreviewed, rolling out r221327.
3400
3401         This change caused test262 failures.
3402
3403         Reverted changeset:
3404
3405         "[JSC] Use reifying system for "name" property of builtin
3406         JSFunction"
3407         https://bugs.webkit.org/show_bug.cgi?id=175260
3408         http://trac.webkit.org/changeset/221327
3409
3410 2017-08-30  Saam Barati  <sbarati@apple.com>
3411
3412         semicolon is being interpreted as an = in the LiteralParser
3413         https://bugs.webkit.org/show_bug.cgi?id=176114
3414
3415         Reviewed by Oliver Hunt.
3416
3417         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
3418         * stress/resources/literal-parser-test-case.js: Added.
3419
3420 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3421
3422         [ESNext] Async iteration - Implement async iteration statement: for-await-of
3423         https://bugs.webkit.org/show_bug.cgi?id=166698
3424
3425         Reviewed by Yusuke Suzuki.
3426
3427         * stress/async-iteration-for-await-of-syntax.js: Added.
3428         (assert):
3429         (checkSyntax):
3430         (checkSyntaxError):
3431         (checkSimpleAsyncGeneratorSloppyMode):
3432         (checkSimpleAsyncGeneratorStrictMode):
3433         (checkNestedAsyncGenerators):
3434         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3435         * stress/async-iteration-for-await-of.js: Added.
3436         (assert):
3437         (async.foo):
3438         (async.boo):
3439         (const.boo.async):
3440
3441 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
3442
3443         [JSC] Use reifying system for "name" property of builtin JSFunction
3444         https://bugs.webkit.org/show_bug.cgi?id=175260
3445
3446         Reviewed by Saam Barati.
3447
3448         * stress/accessors-get-set-prefix.js:
3449         * stress/builtin-function-name.js: Added.
3450         (shouldBe):
3451         (shouldThrow):
3452         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3453         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3454
3455 2017-08-25  Saam Barati  <sbarati@apple.com>
3456
3457         Support compiling catch in the DFG
3458         https://bugs.webkit.org/show_bug.cgi?id=174590
3459         <rdar://problem/34047845>
3460
3461         Reviewed by Filip Pizlo.
3462
3463         * microbenchmarks/delta-blue-try-catch.js: Added.
3464         (exception):
3465         (value):
3466         (OrderedCollection):
3467         (OrderedCollection.prototype.add):
3468         (OrderedCollection.prototype.at):
3469         (OrderedCollection.prototype.size):
3470         (OrderedCollection.prototype.removeFirst):
3471         (OrderedCollection.prototype.remove):
3472         (Strength):
3473         (Strength.stronger):
3474         (Strength.weaker):
3475         (Strength.weakestOf):
3476         (Strength.strongest):
3477         (Strength.prototype.nextWeaker):
3478         (Constraint):
3479         (Constraint.prototype.addConstraint):
3480         (Constraint.prototype.satisfy):
3481         (Constraint.prototype.destroyConstraint):
3482         (Constraint.prototype.isInput):
3483         (UnaryConstraint):
3484         (UnaryConstraint.prototype.addToGraph):
3485         (UnaryConstraint.prototype.chooseMethod):
3486         (UnaryConstraint.prototype.isSatisfied):
3487         (UnaryConstraint.prototype.markInputs):
3488         (UnaryConstraint.prototype.output):
3489         (UnaryConstraint.prototype.recalculate):
3490         (UnaryConstraint.prototype.markUnsatisfied):
3491         (UnaryConstraint.prototype.inputsKnown):
3492         (UnaryConstraint.prototype.removeFromGraph):
3493         (StayConstraint):
3494         (StayConstraint.prototype.execute):
3495         (EditConstraint.prototype.isInput):
3496         (EditConstraint.prototype.execute):
3497         (BinaryConstraint):
3498         (BinaryConstraint.prototype.chooseMethod):
3499         (BinaryConstraint.prototype.addToGraph):
3500         (BinaryConstraint.prototype.isSatisfied):
3501         (BinaryConstraint.prototype.markInputs):
3502         (BinaryConstraint.prototype.input):
3503         (BinaryConstraint.prototype.output):
3504         (BinaryConstraint.prototype.recalculate):
3505         (BinaryConstraint.prototype.markUnsatisfied):
3506         (BinaryConstraint.prototype.inputsKnown):
3507         (BinaryConstraint.prototype.removeFromGraph):
3508         (ScaleConstraint):
3509         (ScaleConstraint.prototype.addToGraph):
3510         (ScaleConstraint.prototype.removeFromGraph):
3511         (ScaleConstraint.prototype.markInputs):
3512         (ScaleConstraint.prototype.execute):
3513         (ScaleConstraint.prototype.recalculate):
3514         (EqualityConstraint):
3515         (EqualityConstraint.prototype.execute):
3516         (Variable):
3517         (Variable.prototype.addConstraint):
3518         (Variable.prototype.removeConstraint):
3519         (Planner):
3520         (Planner.prototype.incrementalAdd):
3521         (Planner.prototype.incrementalRemove):
3522         (Planner.prototype.newMark):
3523         (Planner.prototype.makePlan):
3524         (Planner.prototype.extractPlanFromConstraints):
3525         (Planner.prototype.addPropagate):
3526         (Planner.prototype.removePropagateFrom):
3527         (Planner.prototype.addConstraintsConsumingTo):
3528         (Plan):
3529         (Plan.prototype.addConstraint):
3530         (Plan.prototype.size):
3531         (Plan.prototype.constraintAt):
3532         (Plan.prototype.execute):
3533         (chainTest):
3534         (projectionTest):
3535         (change):
3536         (deltaBlue):
3537         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3538         (assert):
3539         (Numbers):
3540         (Numbers.prototype.next):
3541         (return.Transpose):
3542         (return.Transpose.prototype.next):
3543         (transpose):
3544         (verifyEven):
3545         (verifyString):
3546         (foo):
3547         (runIterators):
3548         * microbenchmarks/try-catch-word-count.js: Added.
3549         (let.assert):
3550         (EOF):
3551         (let.texts):
3552         (let.o.apply):
3553         (foo):
3554         (bar):
3555         (f):
3556         (run):
3557         (test1):
3558         (test2):
3559         (test3):
3560         (fn):
3561         (A):
3562         (B):
3563         (A.prototype.getValue):
3564         (B.prototype.getParentValue):
3565         (strlen):
3566         (sum.0):
3567         (test):
3568         (result.test.o):
3569         (set add.set add):
3570         (set forEach):
3571         (stringHash):
3572         (set if):
3573         (testFunction):
3574         (set delete.set has.set add):
3575         * stress/catch-set-argument-speculation-failure.js: Added.
3576         (o):
3577         (e):
3578         (e2):
3579         (escape):
3580         (baz):
3581         (noInline.run):
3582         (noInline):
3583         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3584         (foo):
3585         (e):
3586         (baz):
3587         (bar):
3588
3589 2017-08-24  Commit Queue  <commit-queue@webkit.org>
3590
3591         Unreviewed, rolling out r221119, r221124, and r221143.
3592         https://bugs.webkit.org/show_bug.cgi?id=175973
3593
3594         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3595         on #webkit).
3596
3597         Reverted changesets:
3598
3599         "Support compiling catch in the DFG"
3600         https://bugs.webkit.org/show_bug.cgi?id=174590
3601         http://trac.webkit.org/changeset/221119
3602
3603         "Unreviewed, build fix in GTK port"
3604         https://bugs.webkit.org/show_bug.cgi?id=174590
3605         http://trac.webkit.org/changeset/221124
3606
3607         "DFG::JITCode::osrEntry should get sorted since we perform a
3608         binary search on it"
3609         https://bugs.webkit.org/show_bug.cgi?id=175893
3610         http://trac.webkit.org/changeset/221143
3611
3612 2017-08-24  Michael Saboff  <msaboff@apple.com>
3613
3614         Add support for RegExp "dotAll" flag
3615         https://bugs.webkit.org/show_bug.cgi?id=175924
3616
3617         Reviewed by Keith Miller.
3618
3619         Updated tests for new dotAll ('s' flag) changes.
3620
3621         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3622         * stress/static-getter-in-names.js:
3623
3624 2017-08-24  Mark Lam  <mark.lam@apple.com>
3625
3626         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3627         https://bugs.webkit.org/show_bug.cgi?id=175940
3628         <rdar://problem/29003921>
3629
3630         Reviewed by Saam Barati.
3631
3632         * stress/regress-164081.js: Added.
3633         (shouldEqual):
3634         (testcase):
3635
3636 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3637
3638         Skip flaky JSC test stress/test-finally.js.
3639         https://bugs.webkit.org/show_bug.cgi?id=160283
3640
3641         Unreviewed test gardening.
3642
3643         * stress/test-finally.js:
3644
3645 2017-08-23  Saam Barati  <sbarati@apple.com>
3646
3647         Support compiling catch in the DFG
3648         https://bugs.webkit.org/show_bug.cgi?id=174590
3649
3650         Reviewed by Filip Pizlo.
3651
3652         * microbenchmarks/delta-blue-try-catch.js: Added.
3653         (exception):
3654         (value):
3655         (OrderedCollection):
3656         (OrderedCollection.prototype.add):
3657         (OrderedCollection.prototype.at):
3658         (OrderedCollection.prototype.size):
3659         (OrderedCollection.prototype.removeFirst):
3660         (OrderedCollection.prototype.remove):
3661         (Strength):
3662         (Strength.stronger):
3663         (Strength.weaker):
3664         (Strength.weakestOf):
3665         (Strength.strongest):
3666         (Strength.prototype.nextWeaker):
3667         (Constraint):
3668         (Constraint.prototype.addConstraint):
3669         (Constraint.prototype.satisfy):
3670         (Constraint.prototype.destroyConstraint):
3671         (Constraint.prototype.isInput):
3672         (UnaryConstraint):
3673         (UnaryConstraint.prototype.addToGraph):
3674         (UnaryConstraint.prototype.chooseMethod):
3675         (UnaryConstraint.prototype.isSatisfied):
3676         (UnaryConstraint.prototype.markInputs):
3677         (UnaryConstraint.prototype.output):
3678         (UnaryConstraint.prototype.recalculate):
3679         (UnaryConstraint.prototype.markUnsatisfied):
3680         (UnaryConstraint.prototype.inputsKnown):
3681         (UnaryConstraint.prototype.removeFromGraph):
3682         (StayConstraint):
3683         (StayConstraint.prototype.execute):
3684         (EditConstraint.prototype.isInput):
3685         (EditConstraint.prototype.execute):
3686         (BinaryConstraint):
3687         (BinaryConstraint.prototype.chooseMethod):
3688         (BinaryConstraint.prototype.addToGraph):
3689         (BinaryConstraint.prototype.isSatisfied):
3690         (BinaryConstraint.prototype.markInputs):
3691         (BinaryConstraint.prototype.input):
3692         (BinaryConstraint.prototype.output):
3693         (BinaryConstraint.prototype.recalculate):
3694         (BinaryConstraint.prototype.markUnsatisfied):
3695         (BinaryConstraint.prototype.inputsKnown):
3696         (BinaryConstraint.prototype.removeFromGraph):
3697         (ScaleConstraint):
3698         (ScaleConstraint.prototype.addToGraph):
3699         (ScaleConstraint.prototype.removeFromGraph):
3700         (ScaleConstraint.prototype.markInputs):
3701         (ScaleConstraint.prototype.execute):
3702         (ScaleConstraint.prototype.recalculate):
3703         (EqualityConstraint):
3704         (EqualityConstraint.prototype.execute):
3705         (Variable):
3706         (Variable.prototype.addConstraint):
3707         (Variable.prototype.removeConstraint):
3708         (Planner):
3709         (Planner.prototype.incrementalAdd):
3710         (Planner.prototype.incrementalRemove):
3711         (Planner.prototype.newMark):
3712         (Planner.prototype.makePlan):
3713         (Planner.prototype.extractPlanFromConstraints):
3714         (Planner.prototype.addPropagate):
3715         (Planner.prototype.removePropagateFrom):
3716         (Planner.prototype.addConstraintsConsumingTo):
3717         (Plan):
3718         (Plan.prototype.addConstraint):
3719         (Plan.prototype.size):
3720         (Plan.prototype.constraintAt):
3721         (Plan.prototype.execute):
3722         (chainTest):
3723         (projectionTest):
3724         (change):
3725         (deltaBlue):
3726         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3727         (assert):
3728         (Numbers):
3729         (Numbers.prototype.next):
3730         (return.Transpose):
3731         (return.Transpose.prototype.next):
3732         (transpose):