32e07e2964fa78229fdae71f148f2b559887e507
[WebKit-https.git] / JSTests / ChangeLog
1 2018-01-05  Ryan Haddad  <ryanhaddad@apple.com>
2
3         Unreviewed, attempt to fix test262 after r226386.
4
5         * test262.yaml:
6
7 2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>
8
9         [DFG] Define defs for MapSet/SetAdd to participate in CSE
10         https://bugs.webkit.org/show_bug.cgi?id=179911
11
12         Reviewed by Saam Barati.
13
14         In addition to these tests, map-set-cse.js and set-add-cse.js work.
15
16         * stress/map-set-change-get.js: Added.
17         (shouldBe):
18         (test):
19         * stress/map-set-create-bucket.js: Added.
20         (shouldBe):
21         (test):
22         * stress/set-add-create-bucket.js: Added.
23         (shouldBe):
24
25 2018-01-03  Michael Saboff  <msaboff@apple.com>
26
27         Disable SharedArrayBuffers from Web API
28         https://bugs.webkit.org/show_bug.cgi?id=181266
29
30         Reviewed by Saam Barati.
31
32         Disabled SharedArrayBuffer tests.
33
34         * stress/SharedArrayBuffer-opt.js:
35         * stress/SharedArrayBuffer.js:
36         * stress/array-buffer-byte-length.js:
37         * stress/atomics-add-uint32.js:
38         * stress/atomics-known-int-use.js:
39         * stress/atomics-neg-zero.js:
40         * stress/atomics-store-return.js:
41         * stress/lars-sab-workers.js:
42         * stress/regress-159779-1.js:
43         * stress/regress-159779-2.js:
44         * stress/regress-170473.js:
45         * test262.yaml:
46
47 2018-01-03  Caio Lima  <ticaiolima@gmail.com>
48
49         [ESNext][BigInt] Failing test stress/big-int-constructor-oom.js into MIPS
50         https://bugs.webkit.org/show_bug.cgi?id=181258
51
52         Reviewed by Antonio Gomes.
53
54         * stress/big-int-constructor-gc.js:
55         * stress/big-int-constructor-oom.js:
56
57 2018-01-03  Robin Morisset  <rmorisset@apple.com>
58
59         Inlining of a function that ends in op_unreachable crashes
60         https://bugs.webkit.org/show_bug.cgi?id=181027
61
62         Reviewed by Filip Pizlo.
63
64         * stress/inlining-unreachable.js: Added.
65         (bar):
66         (baz):
67         (i.catch):
68
69 2018-01-02  Saam Barati  <sbarati@apple.com>
70
71         Incorrect assertion inside AccessCase
72         https://bugs.webkit.org/show_bug.cgi?id=181200
73         <rdar://problem/35494754>
74
75         Reviewed by Yusuke Suzuki.
76
77         * stress/setter-same-base-and-rhs-invalid-assertion-inside-access-case.js: Added.
78         (ctor):
79         (theFunc):
80         (run):
81
82 2018-01-02  Caio Lima  <ticaiolima@gmail.com>
83
84         [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
85         https://bugs.webkit.org/show_bug.cgi?id=175359
86
87         Reviewed by Yusuke Suzuki.
88
89         * bigIntTests.yaml:
90         * stress/big-int-as-key.js: Added.
91         * stress/big-int-constructor-gc.js: Added.
92         * stress/big-int-constructor-oom.js: Added.
93         * stress/big-int-constructor-properties.js: Added.
94         * stress/big-int-constructor-prototype-prop-descriptor.js: Added.
95         * stress/big-int-constructor-prototype.js: Added.
96         * stress/big-int-constructor.js: Added.
97         * stress/big-int-function-apply.js:
98         * stress/big-int-length.js: Added.
99         * stress/big-int-prop-descriptor.js: Added.
100         * stress/big-int-proto-constructor.js: Added.
101         * stress/big-int-proto-name.js: Added.
102         * stress/big-int-prototype-properties.js: Added.
103         * stress/big-int-prototype-proto.js: Added.
104         * stress/big-int-prototype-value-of.js: Added.
105         * stress/big-int-prototype-symbol-to-string-tag.js: Added.
106         * stress/big-int-prototype-to-string-apply.js: Added.
107         * stress/big-int-to-object.js: Added.
108         * stress/big-int-to-string.js: Added.
109
110 2017-12-28  Saam Barati  <sbarati@apple.com>
111
112         Assertion used to determine if something is an async generator is wrong
113         https://bugs.webkit.org/show_bug.cgi?id=181168
114         <rdar://problem/35640560>
115
116         Reviewed by Yusuke Suzuki.
117
118         * stress/async-generator-assertion.js: Added.
119
120 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
121
122         Skip stress/splay-flash-access tests on memory limited platforms
123         https://bugs.webkit.org/show_bug.cgi?id=181086
124
125         Reviewed by Carlos Alberto Lopez Perez.
126
127         These tests use about 185M of memory, and occasionally get OOM-killed
128         on memory limited platforms.
129
130         * stress/splay-flash-access-1ms.js:
131         * stress/splay-flash-access.js:
132
133 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
134
135         Skip slow jsc tests on embedded platforms
136         https://bugs.webkit.org/show_bug.cgi?id=180937
137
138         Reviewed by Carlos Alberto Lopez Perez.
139
140         The tests typeProfiler/deltablue-for-of.js and
141         typeProfiler/getter-richards.js take a very long time in the
142         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
143         thus always timeout. They should be skipped on these platforms.
144
145         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
146         * typeProfiler/getter-richards.js: Skip on arm*/mips.
147
148 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
149
150         [JSC] Do not check isValid() in op_new_regexp
151         https://bugs.webkit.org/show_bug.cgi?id=180970
152
153         Reviewed by Saam Barati.
154
155         * stress/regexp-syntax-error-invalid-flags.js: Added.
156         (shouldThrow):
157
158 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
159
160         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
161         https://bugs.webkit.org/show_bug.cgi?id=180712
162
163         Reviewed by Michael Catanzaro.
164
165         stress/call-apply-exponential-bytecode-size.js crashes if the
166         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
167         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
168         should skip the test on other platforms.
169
170         * stress/call-apply-exponential-bytecode-size.js:
171
172 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
173
174         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
175         https://bugs.webkit.org/show_bug.cgi?id=179762
176
177         Reviewed by Saam Barati.
178
179         * stress/call-varargs-double-new-array-buffer.js: Added.
180         (assert):
181         (bar):
182         (foo):
183         * stress/call-varargs-spread-new-array-buffer.js: Added.
184         (assert):
185         (bar):
186         (foo):
187         * stress/call-varargs-spread-new-array-buffer2.js: Added.
188         (assert):
189         (bar):
190         (foo):
191         * stress/forward-varargs-double-new-array-buffer.js: Added.
192         (assert):
193         (test.baz):
194         (test.bar):
195         (test.foo):
196         (test):
197         * stress/new-array-buffer-sinking-osrexit.js: Added.
198         (target):
199         (test):
200         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
201         (shouldBe):
202         (test):
203         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
204         (shouldBe):
205         (target):
206         (test):
207         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
208         (assert):
209         (test1.bar):
210         (test1.foo):
211         (test1):
212         (test2.bar):
213         (test2.foo):
214         (test3.baz):
215         (test3.bar):
216         (test3.foo):
217         (test4.baz):
218         (test4.bar):
219         (test4.foo):
220         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
221         (assert):
222         (test.baz):
223         (test.bar):
224         (test.foo):
225         (test):
226         * stress/phantom-new-array-buffer-osr-exit.js: Added.
227         (assert):
228         (baz):
229         (bar):
230         (effects):
231         (foo):
232
233 2017-12-14  Saam Barati  <sbarati@apple.com>
234
235         The CleanUp after LICM is erroneously removing a Check
236         https://bugs.webkit.org/show_bug.cgi?id=180852
237         <rdar://problem/36063494>
238
239         Reviewed by Filip Pizlo.
240
241         * stress/dont-run-cleanup-after-licm.js: Added.
242
243 2017-12-14  Michael Saboff  <msaboff@apple.com>
244
245         REGRESSION (r225695): Repro crash on yahoo login page
246         https://bugs.webkit.org/show_bug.cgi?id=180761
247
248         Reviewed by JF Bastien.
249
250         New regression test.
251
252         * stress/regress-180761.js: Added.
253
254 2017-12-13  Keith Miller  <keith_miller@apple.com>
255
256         JSObjects should have a mask for loading indexed properties
257         https://bugs.webkit.org/show_bug.cgi?id=180768
258
259         Reviewed by Mark Lam.
260
261         * stress/int16-put-by-val-in-and-out-of-bounds.js:
262         (test):
263
264 2017-12-13  Saam Barati  <sbarati@apple.com>
265
266         Arrow functions need their own structure because they have different properties than sloppy functions
267         https://bugs.webkit.org/show_bug.cgi?id=180779
268         <rdar://problem/35814591>
269
270         Reviewed by Mark Lam.
271
272         * stress/arrow-function-needs-its-own-structure.js: Added.
273         (assert):
274         (readPrototype):
275         (noInline.let.f1):
276         (noInline):
277
278 2017-12-13  Saam Barati  <sbarati@apple.com>
279
280         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
281         https://bugs.webkit.org/show_bug.cgi?id=163579
282         <rdar://problem/35455798>
283
284         Reviewed by Mark Lam.
285
286         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
287         (assert):
288         (test1):
289         (i.test1):
290         (i.test1.C):
291         (i.test1.async.foo):
292         (i.test1.foo):
293         (test2):
294
295 2017-12-13  Saam Barati  <sbarati@apple.com>
296
297         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
298         https://bugs.webkit.org/show_bug.cgi?id=180734
299         <rdar://problem/35640547>
300
301         Reviewed by Yusuke Suzuki.
302
303         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
304         (__isPropertyOfType):
305         (__getProperties):
306         (__getObjects):
307         (__getRandomObject):
308         (theClass.):
309         (theClass):
310         (childClass):
311         (counter.catch):
312
313 2017-12-12  Saam Barati  <sbarati@apple.com>
314
315         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
316         https://bugs.webkit.org/show_bug.cgi?id=180725
317         <rdar://problem/35970511>
318
319         Reviewed by Michael Saboff.
320
321         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
322         (f1):
323         (f2):
324         (let.o2.valueOf):
325
326 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
327
328         [JSC] Implement optimized WeakMap and WeakSet
329         https://bugs.webkit.org/show_bug.cgi?id=179929
330
331         Reviewed by Saam Barati.
332
333         * microbenchmarks/weak-map-key.js:
334         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
335         (assert):
336         (objectKey):
337         (let.start.Date.now):
338         * stress/basic-weakmap.js: Added.
339         (shouldBe):
340         (test):
341         * stress/basic-weakset.js: Added.
342         (shouldBe):
343         (test.set new):
344         * stress/weakmap-cse-set-break.js: Added.
345         (shouldBe):
346         (test):
347         * stress/weakmap-cse.js: Added.
348         (shouldBe):
349         (test):
350         * stress/weakmap-gc.js: Added.
351         (test):
352         * stress/weakset-cse-add-break.js: Added.
353         (shouldBe):
354         (test.set new):
355         * stress/weakset-cse.js: Added.
356         (shouldBe):
357         (test.set new):
358         * stress/weakset-gc.js: Added.
359         (test.set add):
360         (test.set new):
361         (test):
362
363 2017-12-12  Saam Barati  <sbarati@apple.com>
364
365         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
366         https://bugs.webkit.org/show_bug.cgi?id=180723
367         <rdar://problem/35859726>
368
369         Reviewed by JF Bastien.
370
371         * stress/get-my-argument-by-val-constant-folding.js: Added.
372         (test):
373         (catch):
374
375 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
376
377         [ESNext][BigInt] Implement BigInt literals and JSBigInt
378         https://bugs.webkit.org/show_bug.cgi?id=179000
379
380         Reviewed by Darin Adler and Yusuke Suzuki.
381
382         * bigIntTests.yaml: Added.
383         * stress/big-int-literal-line-terminator.js: Added.
384         * stress/big-int-literals.js: Added.
385         * stress/big-int-operations-error.js: Added.
386         * stress/big-int-type-of.js: Added.
387         * stress/big-int-white-space-trailing-leading.js: Added.
388         * stress/big-int-function-apply.js: Added.
389
390 2017-12-11  Saam Barati  <sbarati@apple.com>
391
392         We need to disableCaching() in ErrorInstance when we materialize properties
393         https://bugs.webkit.org/show_bug.cgi?id=180343
394         <rdar://problem/35833002>
395
396         Reviewed by Mark Lam.
397
398         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
399         (assert):
400         (makeError):
401         (storeToStack):
402         (storeToStackAlreadyMaterialized):
403
404 2017-12-05  JF Bastien  <jfbastien@apple.com>
405
406         WebAssembly: don't eagerly checksum
407         https://bugs.webkit.org/show_bug.cgi?id=180441
408         <rdar://problem/35156628>
409
410         Reviewed by Saam Barati.
411
412         Checksum is now disabled, so tests only have <?> as the module
413         name.
414
415         * wasm/function-tests/nameSection.js:
416         * wasm/function-tests/stack-overflow.js:
417         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
418         (assertOverflows.assertThrows):
419         (assertOverflows):
420         * wasm/function-tests/stack-trace.js:
421
422 2017-12-04  JF Bastien  <jfbastien@apple.com>
423
424         Proxy all functions, except the $ objects
425         https://bugs.webkit.org/show_bug.cgi?id=180375
426
427         Reviewed by Saam Barati.
428
429         It looks like this test may have broken some executions because I
430         call some internal objects. Explicitly ignore objects whose name
431         starts with "$" because it's a bad idea anyways.
432
433         * stress/proxy-all-the-parameters.js:
434         (generateObjects):
435         (get throw):
436
437 2017-12-04  Saam Barati  <sbarati@apple.com>
438
439         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
440         https://bugs.webkit.org/show_bug.cgi?id=180366
441         <rdar://problem/35685877>
442
443         Reviewed by Michael Saboff.
444
445         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
446         (theParent):
447         (test1.base.getParentStaticValue):
448         (test1.base):
449         (test1.__v_24888.prototype.set prop):
450         (test1.__v_24888):
451         (test2.base.getParentStaticValue):
452         (test2.base):
453         (test2.__v_24888.prototype.set prop):
454         (test2.__v_24888):
455         (test2):
456
457 2017-12-01  JF Bastien  <jfbastien@apple.com>
458
459         Try proxying all function arguments
460         https://bugs.webkit.org/show_bug.cgi?id=180306
461
462         Reviewed by Saam Barati.
463
464         * stress/proxy-all-the-parameters.js: Added.
465         (isPropertyOfType):
466         (getProperties):
467         (generateObjects):
468         (getObjects):
469         (getFunctions):
470         (get throw):
471         (let.o.of.getObjects.let.f.of.getFunctions.catch):
472
473 2017-12-01  JF Bastien  <jfbastien@apple.com>
474
475         JavaScriptCore: missing exception checks in Math functions that take more than one argument
476         https://bugs.webkit.org/show_bug.cgi?id=180297
477         <rdar://problem/35745556>
478
479         Reviewed by Mark Lam.
480
481         * stress/math-exceptions.js: Added.
482         (get try):
483         (catch):
484
485 2017-12-01  JF Bastien  <jfbastien@apple.com>
486
487         JavaScriptCore: add test for weird class static getters
488         https://bugs.webkit.org/show_bug.cgi?id=180281
489         <rdar://problem/35592139>
490
491         Reviewed by Mark Lam.
492
493         I fixed a bug for it in r224927 and didn't add a test. Do so.
494
495         * stress/class-static-get-weird.js: Added.
496         (c.prototype.get name):
497         (c):
498         (c.prototype.get arguments):
499         (c.prototype.get caller):
500         (c.prototype.get length):
501
502 2017-12-01  Saam Barati  <sbarati@apple.com>
503
504         Having a bad time needs to handle ArrayClass indexing type as well
505         https://bugs.webkit.org/show_bug.cgi?id=180274
506         <rdar://problem/35667869>
507
508         Reviewed by Keith Miller and Mark Lam.
509
510         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
511         (assert):
512         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
513         (assert):
514
515 2017-12-01  JF Bastien  <jfbastien@apple.com>
516
517         WebAssembly: restore cached stack limit after out-call
518         https://bugs.webkit.org/show_bug.cgi?id=179106
519         <rdar://problem/35337525>
520
521         Reviewed by Saam Barati.
522
523         * wasm/function-tests/double-instance.js: Added.
524         (const.imp.boom):
525         (const.imp.get callAnother):
526
527 2017-11-30  JF Bastien  <jfbastien@apple.com>
528
529         WebAssembly: improve stack trace
530         https://bugs.webkit.org/show_bug.cgi?id=179343
531
532         Reviewed by Saam Barati.
533
534         Update the tests to follow the new format. Notably, SHA1 module
535         hash is now included in traces, and stubs are properly identified.
536
537         * wasm/assert.js: Add an assertion which matches regular expressions.
538         * wasm/function-tests/nameSection.js:
539         * wasm/function-tests/stack-overflow.js:
540         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
541         (assertOverflows.assertThrows.wasm.1):
542         (assertOverflows.assertThrows.wasm.0):
543         (assertOverflows.assertThrows):
544         (assertOverflows):
545         * wasm/function-tests/stack-trace.js:
546         (import.Builder.from.string_appeared_here.assert): Deleted.
547         * wasm/function-tests/trap-after-cross-instance-call.js:
548         (wasmFrameCountFromError):
549         * wasm/function-tests/trap-load-2.js:
550         (wasmFrameCountFromError):
551         * wasm/function-tests/trap-load.js:
552         (wasmFrameCountFromError):
553
554 2017-11-30  Mark Lam  <mark.lam@apple.com>
555
556         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
557         https://bugs.webkit.org/show_bug.cgi?id=180219
558         <rdar://problem/35696536>
559
560         Reviewed by Filip Pizlo.
561
562         * stress/regress-180219.js: Added.
563
564 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
565
566         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
567         https://bugs.webkit.org/show_bug.cgi?id=180190
568
569         Reviewed by Mark Lam.
570
571         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
572         (shouldBe):
573         (test1):
574         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
575         (shouldBe):
576         (test1):
577         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
578         (shouldBe):
579         (test1):
580         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
581         (shouldBe):
582         (test1):
583         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
584         (shouldBe):
585         (test1):
586         * stress/operation-in-may-have-negative-int32.js: Added.
587         (shouldBe):
588         (test2):
589         * stress/operation-in-negative-int32-cast.js: Added.
590         (shouldBe):
591         (test1):
592
593 2017-11-28  JF Bastien  <jfbastien@apple.com>
594
595         Strict and sloppy functions shouldn't share structure
596         https://bugs.webkit.org/show_bug.cgi?id=180103
597         <rdar://problem/35667847>
598
599         Reviewed by Saam Barati.
600
601         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
602         because the IC was wrong.
603         (foo):
604         (bar):
605         (baz):
606         (catch):
607         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
608         in this patch, but may as well test odd strict mode corner cases.
609         (bar):
610         (baz):
611         (catch):
612         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
613         (foo):
614         (bar):
615         (baz):
616         (catch):
617         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
618         next file, but with invalidation of the FunctionExecutable's
619         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
620         slower path.
621         (foo):
622         (bar.const.x):
623         (bar.const.y):
624         (bar):
625         (catch):
626         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
627         strict nesting works correctly.
628         (foo):
629         (bar.baz):
630         (bar):
631         * stress/strict-function-structure.js: Added. The test used to
632         assert in objectProtoFuncHasOwnProperty.
633         (foo):
634         (bar):
635         (baz):
636         * stress/strict-nested-function-structure.js: Added. Nesting.
637         (foo):
638         (bar):
639         (baz.boo):
640         (baz):
641
642 2017-11-29  Robin Morisset  <rmorisset@apple.com>
643
644         The recursive tail call optimisation is wrong on closures
645         https://bugs.webkit.org/show_bug.cgi?id=179835
646
647         Reviewed by Saam Barati.
648
649         * stress/closure-recursive-tail-call.js: Added.
650         (makeClosure):
651
652 2017-11-27  JF Bastien  <jfbastien@apple.com>
653
654         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
655         https://bugs.webkit.org/show_bug.cgi?id=180051
656         <rdar://problem/35614371>
657
658         Reviewed by Saam Barati.
659
660         * stress/rest-parameter-negative.js: Added.
661         (__f_5484):
662         (catch):
663         (__f_5485):
664         (__v_22598.catch):
665
666 2017-11-27  Saam Barati  <sbarati@apple.com>
667
668         Spread can escape when CreateRest does not
669         https://bugs.webkit.org/show_bug.cgi?id=180057
670         <rdar://problem/35676119>
671
672         Reviewed by JF Bastien.
673
674         * stress/spread-escapes-but-create-rest-does-not.js: Added.
675         (assert):
676         (getProperties):
677         (theFunc):
678         (let.obj.valueOf):
679
680 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
681
682         [DFG] Add NormalizeMapKey DFG IR
683         https://bugs.webkit.org/show_bug.cgi?id=179912
684
685         Reviewed by Saam Barati.
686
687         * stress/map-untyped-normalize-cse.js: Added.
688         (shouldBe):
689         (test):
690         * stress/map-untyped-normalize.js: Added.
691         (shouldBe):
692         (test):
693         * stress/set-untyped-normalize-cse.js: Added.
694         (shouldBe):
695         (set return.set has.set has):
696         * stress/set-untyped-normalize.js: Added.
697         (shouldBe):
698         (set return.set has):
699
700 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
701
702         [FTL] Support DeleteById and DeleteByVal
703         https://bugs.webkit.org/show_bug.cgi?id=180022
704
705         Reviewed by Saam Barati.
706
707         * stress/delete-by-id.js: Added.
708         (shouldBe):
709         (test1):
710         (test2):
711         * stress/delete-by-val-ftl.js: Added.
712         (shouldBe):
713         (test1):
714         (test2):
715
716 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
717
718         [DFG] Introduce {Set,Map,WeakMap}Fields
719         https://bugs.webkit.org/show_bug.cgi?id=179925
720
721         Reviewed by Saam Barati.
722
723         * stress/map-set-clobber-map-get.js: Added.
724         (shouldBe):
725         (test):
726         * stress/map-set-does-not-clobber-set-has.js: Added.
727         (shouldBe):
728         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
729         (shouldBe):
730         (test):
731         * stress/set-add-clobber-set-has.js: Added.
732         (shouldBe):
733         * stress/set-add-does-not-clobber-map-get.js: Added.
734         (shouldBe):
735
736 2017-11-24  Mark Lam  <mark.lam@apple.com>
737
738         Move unsafe jsc shell test functions to the $vm object.
739         https://bugs.webkit.org/show_bug.cgi?id=179980
740
741         Reviewed by Yusuke Suzuki.
742
743         * controlFlowProfiler/driver/driver.js:
744         * controlFlowProfiler/execution-count.js:
745         * controlFlowProfiler/if-statement.js:
746         * controlFlowProfiler/loop-statements.js:
747         * controlFlowProfiler/switch-statements.js:
748         * controlFlowProfiler/test-jit.js:
749         * exceptionFuzz/3d-cube.js:
750         * exceptionFuzz/date-format-xparb.js:
751         * exceptionFuzz/earley-boyer.js:
752         * heapProfiler/basic-edges.js:
753         * heapProfiler/property-edge-types.js:
754         * microbenchmarks/try-get-by-id-basic.js:
755         * microbenchmarks/try-get-by-id-polymorphic.js:
756         * modules/namespace-object-try-get.js:
757         * stress/argument-count-bytecode.js:
758         * stress/argument-intrinsic-basic.js:
759         * stress/argument-intrinsic-inlining-use-caller-arg.js:
760         * stress/argument-intrinsic-inlining-with-result-escape.js:
761         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
762         * stress/argument-intrinsic-inlining-with-vararg.js:
763         * stress/argument-intrinsic-nested-inlining.js:
764         * stress/argument-intrinsic-not-convert-to-get-argument.js:
765         * stress/argument-intrinsic-with-stack-write.js:
766         * stress/arity-mismatch-get-argument.js:
767         * stress/array-message-passing.js:
768         * stress/array-push-with-force-exit.js:
769         * stress/check-dom-with-signature.js:
770         * stress/check-sub-class.js:
771         * stress/compare-eq-incomplete-profile.js:
772         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
773         * stress/do-eval-virtual-call-correctly.js:
774         * stress/dom-jit-with-poly-proto.js:
775         * stress/domjit-exception-ic.js:
776         * stress/domjit-exception.js:
777         * stress/domjit-getter-complex-with-incorrect-object.js:
778         * stress/domjit-getter-complex.js:
779         * stress/domjit-getter-poly.js:
780         * stress/domjit-getter-proto.js:
781         * stress/domjit-getter-super-poly.js:
782         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
783         * stress/domjit-getter-type-check.js:
784         * stress/domjit-getter.js:
785         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
786         * stress/for-in-proxy-target-changed-structure.js:
787         * stress/for-in-proxy.js:
788         * stress/generational-opaque-roots.js:
789         * stress/global-const-redeclaration-setting-2.js:
790         * stress/global-const-redeclaration-setting-3.js:
791         * stress/global-const-redeclaration-setting-4.js:
792         * stress/global-const-redeclaration-setting-5.js:
793         * stress/global-const-redeclaration-setting.js:
794         * stress/import-basic.js:
795         * stress/import-from-eval.js:
796         * stress/import-reject-with-exception.js:
797         * stress/import-syntax.js:
798         * stress/impure-get-own-property-slot-inline-cache.js:
799         * stress/is-constructor.js:
800         * stress/istypedarrayview-intrinsic.js:
801         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
802         * stress/jsc-test-functions-should-be-more-robust.js:
803         * stress/object-toString-with-proxy.js:
804         * stress/poly-proto-custom-value-and-accessor.js:
805         * stress/proxy-inline-cache.js:
806         * stress/re-execute-error-module.js:
807         * stress/regress-150532.js:
808         * stress/regress-156992.js:
809         * stress/regress-179619.js:
810         * stress/resources/shadow-chicken-support.js:
811         * stress/runtime-array.js:
812         * stress/sampling-profiler-microtasks.js:
813         * stress/shadow-chicken-enabled.js:
814         * stress/spread-correct-global-object-on-exception.js:
815         * stress/super-get-by-id.js:
816         * stress/tailCallForwardArguments.js:
817         * stress/to-object-intrinsic-boolean-edge.js:
818         * stress/to-object-intrinsic-null-or-undefined-edge.js:
819         * stress/to-object-intrinsic-number-edge.js:
820         * stress/to-object-intrinsic-object-edge.js:
821         * stress/to-object-intrinsic-string-edge.js:
822         * stress/to-object-intrinsic-symbol-edge.js:
823         * stress/to-object-intrinsic.js:
824         * stress/try-catch-custom-getter-as-get-by-id.js:
825         * stress/try-get-by-id-poly-proto.js:
826         * stress/try-get-by-id-should-spill-registers-dfg.js:
827         * stress/try-get-by-id.js:
828         * typeProfiler/arrow-functions.js:
829         * typeProfiler/basic.js:
830         * typeProfiler/captured.js:
831         * typeProfiler/classes.js:
832         * typeProfiler/dfg-jit-optimizations.js:
833         * typeProfiler/dictionary-mode.js:
834         * typeProfiler/es6-block-scoping.js:
835         * typeProfiler/es6-classes.js:
836         * typeProfiler/inheritance.js:
837         * typeProfiler/int52-dfg.js:
838         * typeProfiler/loop.js:
839         * typeProfiler/optional-fields.js:
840         * typeProfiler/overflow.js:
841         * typeProfiler/return.js:
842         * typeProfiler/symbol.js:
843         * typeProfiler/weird-prototype-chain.js:
844
845 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
846
847         [DFG][FTL] Support MapSet / SetAdd intrinsics
848         https://bugs.webkit.org/show_bug.cgi?id=179858
849
850         Reviewed by Saam Barati.
851
852         * microbenchmarks/map-has-and-set.js: Added.
853         (test):
854         * stress/map-set-check-failure.js: Added.
855         (shouldBe):
856         (shouldThrow):
857         (target):
858         * stress/map-set-cse.js: Added.
859         (shouldBe):
860         (test):
861         * stress/set-add-check-failure.js: Added.
862         (shouldBe):
863         (shouldThrow):
864         (set shouldThrow):
865         * stress/set-add-cse.js: Added.
866         (shouldBe):
867
868 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
869
870         [JSC] Allow poly proto for intrinsic getters
871         https://bugs.webkit.org/show_bug.cgi?id=179550
872
873         Reviewed by Saam Barati.
874
875         This change is also tested by existing tests.
876
877             1. stress/intrinsic-getter-with-poly-proto.js
878             2. stress/poly-proto-intrinsic-getter-correctness.js
879
880         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
881         (shouldBe):
882         (makePolyProtoObject.foo.C):
883         (makePolyProtoObject.foo):
884         (makePolyProtoObject):
885         (target):
886         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
887         (shouldBe):
888         (makePolyProtoObject.foo.C):
889         (makePolyProtoObject.foo):
890         (makePolyProtoObject):
891         (target):
892
893 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
894
895         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
896         https://bugs.webkit.org/show_bug.cgi?id=179744
897
898         Reviewed by Michael Catanzaro.
899
900         This test uses too much memory for our buildbots on these platforms
901         and gets OOM-killed.
902
903         * stress/unshiftCountSlowCase-correct-postCapacity.js:
904         Skip if $memoryLimited and linux.
905
906 2017-11-17  JF Bastien  <jfbastien@apple.com>
907
908         WebAssembly JS API: throw when a promise can't be created
909         https://bugs.webkit.org/show_bug.cgi?id=179826
910         <rdar://problem/35455813>
911
912         Reviewed by Mark Lam.
913
914         Test WebAssembly.{compile,instantiate} where promise creation
915         fails because of a stack overflow.
916
917         * wasm/js-api/promise-stack-overflow.js: Added.
918         (const.runNearStackLimit.f.const.t):
919         (async.testCompile):
920         (async.testInstantiate):
921
922 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
923
924         Unreviewed, mark regress-178385.js as memory exhausting
925
926         * stress/regress-178385.js:
927
928 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
929
930         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
931
932         Unreviewed test gardening.
933
934         * test262.yaml:
935
936 2017-11-16  Robin Morisset  <rmorisset@apple.com>
937
938         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
939         https://bugs.webkit.org/show_bug.cgi?id=179763
940         <rdar://problem/35550513>
941
942         Reviewed by Keith Miller.
943
944         Just adding a slightly cleaned-up version of the original fuzzer-found test.
945
946         * stress/tdz-this-in-try-catch.js: Added.
947         (__v_6388):
948         (__v_6392):
949
950 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
951
952         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
953         https://bugs.webkit.org/show_bug.cgi?id=179594
954
955         Reviewed by Saam Barati.
956
957         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
958         (shouldBe):
959         (args):
960         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
961         (shouldBe):
962         (args):
963
964 2017-11-14  Saam Barati  <sbarati@apple.com>
965
966         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
967         https://bugs.webkit.org/show_bug.cgi?id=179639
968         <rdar://problem/35513018>
969
970         Reviewed by JF Bastien.
971
972         * wasm/function-tests/grow-memory-cause-gc.js: Added.
973         (escape):
974         (i.func):
975
976 2017-11-13  Mark Lam  <mark.lam@apple.com>
977
978         Add more overflow check book-keeping for MarkedArgumentBuffer.
979         https://bugs.webkit.org/show_bug.cgi?id=179634
980         <rdar://problem/35492517>
981
982         Reviewed by Saam Barati.
983
984         * stress/regress-179634.js: Added.
985
986 2017-11-13  Mark Lam  <mark.lam@apple.com>
987
988         Make the jsc shell loadGetterFromGetterSetter() function more robust.
989         https://bugs.webkit.org/show_bug.cgi?id=179619
990         <rdar://problem/35492518>
991
992         Reviewed by Saam Barati.
993
994         * stress/regress-179619.js: Added.
995
996 2017-11-12  Mark Lam  <mark.lam@apple.com>
997
998         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
999         https://bugs.webkit.org/show_bug.cgi?id=179562
1000         <rdar://problem/35467022>
1001
1002         Reviewed by Saam Barati.
1003
1004         * regress-179562.js: Added.
1005
1006 2017-11-08  Saam Barati  <sbarati@apple.com>
1007
1008         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
1009         https://bugs.webkit.org/show_bug.cgi?id=177792
1010
1011         Reviewed by Yusuke Suzuki.
1012
1013         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
1014         (assert):
1015         (foo.Foo.prototype.ensureX):
1016         (foo.Foo):
1017         (foo):
1018         (access):
1019
1020 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
1021
1022         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1023         https://bugs.webkit.org/show_bug.cgi?id=178592
1024
1025         Unreviewed test gardening.
1026
1027         * test262.yaml:
1028
1029 2017-11-08  Robin Morisset  <rmorisset@apple.com>
1030
1031         Turn recursive tail calls into loops
1032         https://bugs.webkit.org/show_bug.cgi?id=176601
1033
1034         Reviewed by Saam Barati.
1035
1036         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
1037
1038         Add some simple test that computes factorial in several ways, and other trivial computations.
1039         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1040         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1041         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1042         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1043
1044         * stress/inline-call-to-recursive-tail-call.js: Added.
1045         (factorial.aux):
1046         (factorial):
1047         (factorial2.aux2):
1048         (factorial2.id):
1049         (factorial2):
1050         (factorial3.aux3):
1051         (factorial3):
1052         (aux4):
1053         (factorial4):
1054         (foo):
1055         (auxBar):
1056         (bar):
1057         (test):
1058
1059 2017-11-07  Mark Lam  <mark.lam@apple.com>
1060
1061         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
1062         https://bugs.webkit.org/show_bug.cgi?id=179355
1063         <rdar://problem/35263053>
1064
1065         Reviewed by Saam Barati.
1066
1067         * stress/regress-179355.js: Added.
1068
1069 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1070
1071         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
1072         https://bugs.webkit.org/show_bug.cgi?id=144458
1073
1074         Reviewed by Saam Barati.
1075
1076         * microbenchmarks/dfg-internal-function-call.js: Added.
1077         (target):
1078         * microbenchmarks/dfg-internal-function-construct.js: Added.
1079         (target):
1080         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
1081         (target):
1082         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
1083         (target):
1084         * stress/dfg-internal-function-call.js: Added.
1085         (shouldBe):
1086         (target):
1087         * stress/dfg-internal-function-construct.js: Added.
1088         (shouldBe):
1089         (target):
1090         * stress/internal-function-call.js: Added.
1091         (shouldBe):
1092         * stress/internal-function-construct.js: Added.
1093         (shouldBe):
1094
1095 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
1096
1097         [Win] Skip stress/regress-178385.js.
1098         https://bugs.webkit.org/show_bug.cgi?id=179298
1099
1100         Unreviewed test gardening.
1101
1102         * stress/regress-178385.js:
1103
1104 2017-11-03  Keith Miller  <keith_miller@apple.com>
1105
1106         Add test for ic with side effects
1107         https://bugs.webkit.org/show_bug.cgi?id=179268
1108
1109         Reviewed by Saam Barati.
1110
1111         * stress/put-inline-cache-side-effects.js: Added.
1112         (let.i.of.objs.keys):
1113         (f):
1114
1115 2017-11-03  Mark Lam  <mark.lam@apple.com>
1116
1117         CachedCall (and its clients) needs overflow checks.
1118         https://bugs.webkit.org/show_bug.cgi?id=179185
1119
1120         Reviewed by JF Bastien.
1121
1122         * stress/regress-179185.js: Added.
1123
1124 2017-11-02  Michael Saboff  <msaboff@apple.com>
1125
1126         DFG needs to handle code motion of code in for..in loop bodies
1127         https://bugs.webkit.org/show_bug.cgi?id=179212
1128
1129         Reviewed by Keith Miller.
1130
1131         New regression test.
1132
1133         * stress/for-in-side-effects.js: Added.
1134         (getPrototypeOf):
1135         (reset):
1136         (testWithoutFTL.f):
1137         (testWithoutFTL):
1138         (testWithFTL.f):
1139         (testWithFTL):
1140
1141 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
1142
1143         AI does not correctly model the clobber case of ArithClz32
1144         https://bugs.webkit.org/show_bug.cgi?id=179188
1145
1146         Reviewed by Michael Saboff.
1147
1148         * stress/arith-clz32-effects.js: Added.
1149         (foo):
1150         (valueOf):
1151
1152 2017-11-01  Michael Saboff  <msaboff@apple.com>
1153
1154         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
1155         https://bugs.webkit.org/show_bug.cgi?id=179140
1156
1157         Reviewed by Saam Barati.
1158
1159         New regression test.
1160
1161         * stress/regress-179140.js: Added.
1162         (testWithoutFTL):
1163         (testWithFTL):
1164
1165 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1166
1167         [JSC] Introduce @toObject
1168         https://bugs.webkit.org/show_bug.cgi?id=178726
1169
1170         Reviewed by Saam Barati.
1171
1172         * stress/array-copywithin.js:
1173         (shouldThrow):
1174         * stress/object-constructor-boolean-edge.js: Added.
1175         (shouldBe):
1176         (test):
1177         * stress/object-constructor-global.js: Added.
1178         (shouldBe):
1179         * stress/object-constructor-null-edge.js: Added.
1180         (shouldBe):
1181         (test):
1182         * stress/object-constructor-number-edge.js: Added.
1183         (shouldBe):
1184         (test):
1185         * stress/object-constructor-object-edge.js: Added.
1186         (shouldBe):
1187         (test):
1188         (i.arg):
1189         * stress/object-constructor-string-edge.js: Added.
1190         (shouldBe):
1191         (test):
1192         * stress/object-constructor-symbol-edge.js: Added.
1193         (shouldBe):
1194         (test):
1195         * stress/object-constructor-undefined-edge.js: Added.
1196         (shouldBe):
1197         (test):
1198         * stress/symbol-array-from.js: Added.
1199         (shouldBe):
1200         * stress/to-object-intrinsic-boolean-edge.js: Added.
1201         (shouldBe):
1202         (builtin.createBuiltin):
1203         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
1204         (shouldThrow):
1205         * stress/to-object-intrinsic-number-edge.js: Added.
1206         (shouldBe):
1207         (builtin.createBuiltin):
1208         * stress/to-object-intrinsic-object-edge.js: Added.
1209         (shouldBe):
1210         (builtin.createBuiltin):
1211         (i.arg):
1212         * stress/to-object-intrinsic-string-edge.js: Added.
1213         (shouldBe):
1214         (builtin.createBuiltin):
1215         * stress/to-object-intrinsic-symbol-edge.js: Added.
1216         (shouldBe):
1217         (builtin.createBuiltin):
1218         * stress/to-object-intrinsic.js: Added.
1219         (shouldBe):
1220         (shouldThrow):
1221         (builtin.createBuiltin):
1222
1223 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1224
1225         [DFG][FTL] Introduce StringSlice
1226         https://bugs.webkit.org/show_bug.cgi?id=178934
1227
1228         Reviewed by Saam Barati.
1229
1230         * microbenchmarks/string-slice-empty.js: Added.
1231         (slice):
1232         * microbenchmarks/string-slice-one-char.js: Added.
1233         (slice):
1234         * microbenchmarks/string-slice.js: Added.
1235         (slice):
1236
1237 2017-10-26  Michael Saboff  <msaboff@apple.com>
1238
1239         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
1240         https://bugs.webkit.org/show_bug.cgi?id=178890
1241
1242         Reviewed by Keith Miller.
1243
1244         New regression test.
1245
1246         * stress/regress-178890.js: Added.
1247
1248 2017-10-26  Mark Lam  <mark.lam@apple.com>
1249
1250         JSRopeString::RopeBuilder::append() should check for overflows.
1251         https://bugs.webkit.org/show_bug.cgi?id=178385
1252         <rdar://problem/35027468>
1253
1254         Reviewed by Saam Barati.
1255
1256         * stress/regress-178385.js: Added.
1257
1258 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
1259
1260         Unreviewed, rolling out r223961.
1261
1262         The change that required this has been rolled out.
1263
1264         Reverted changeset:
1265
1266         "Mark test262.yaml/test262/test/language/statements/try/tco-
1267         catch.js as passing."
1268         https://bugs.webkit.org/show_bug.cgi?id=178592
1269         https://trac.webkit.org/changeset/223961
1270
1271 2017-10-25  Commit Queue  <commit-queue@webkit.org>
1272
1273         Unreviewed, rolling out r223691 and r223729.
1274         https://bugs.webkit.org/show_bug.cgi?id=178834
1275
1276         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
1277         by rniwa on #webkit).
1278
1279         Reverted changesets:
1280
1281         "Turn recursive tail calls into loops"
1282         https://bugs.webkit.org/show_bug.cgi?id=176601
1283         https://trac.webkit.org/changeset/223691
1284
1285         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
1286         comparison is always false due to limited range of data type
1287         [-Wtype-limits]"
1288         https://bugs.webkit.org/show_bug.cgi?id=178543
1289         https://trac.webkit.org/changeset/223729
1290
1291 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
1292
1293         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1294         https://bugs.webkit.org/show_bug.cgi?id=178592
1295
1296         Unreviewed test gardening.
1297
1298         * test262.yaml:
1299
1300 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1301
1302         [FTL] Support NewStringObject
1303         https://bugs.webkit.org/show_bug.cgi?id=178737
1304
1305         Reviewed by Saam Barati.
1306
1307         * stress/new-string-object.js: Added.
1308         (shouldBe):
1309         (test):
1310
1311 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1312
1313         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
1314         https://bugs.webkit.org/show_bug.cgi?id=178308
1315
1316         Reviewed by Mark Lam.
1317
1318         * test262.yaml:
1319
1320 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1321
1322         [JSC] Use fastJoin in Array#toString
1323         https://bugs.webkit.org/show_bug.cgi?id=178062
1324
1325         Reviewed by Darin Adler.
1326
1327         * microbenchmarks/contiguous-array-to-string.js: Added.
1328         (target):
1329         * microbenchmarks/double-array-to-string.js: Added.
1330         (target):
1331         * microbenchmarks/int32-array-to-string.js: Added.
1332         (target):
1333
1334 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
1335
1336         stress/check-string-ident.js is improperly skipped
1337         https://bugs.webkit.org/show_bug.cgi?id=178642
1338
1339         Reviewed by Saam Barati.
1340
1341         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
1342         since it enforces the run-jsc-stress-tests script to still set up the
1343         test to run, despite the skip directive that's used before.
1344
1345 2017-10-20  Mark Lam  <mark.lam@apple.com>
1346
1347         Add a test case for r214334.
1348         https://bugs.webkit.org/show_bug.cgi?id=169941
1349         <rdar://problem/31221258>
1350
1351         Reviewed by JF Bastien.
1352
1353         * stress/regress-169941.js: Added.
1354
1355 2017-10-19  JF Bastien  <jfbastien@apple.com>
1356
1357         WebAssembly: no VM / JS version of everything but Instance
1358         https://bugs.webkit.org/show_bug.cgi?id=177473
1359
1360         Reviewed by Filip Pizlo, Saam Barati.
1361
1362         - Exceeding max on memory growth now returns a range error as per
1363         spec. This is a (very minor) breaking change: it used to throw OOM
1364         error. Update the corresponding test.
1365
1366         * wasm/js-api/memory-grow.js:
1367         (assertEq):
1368         * wasm/js-api/table.js:
1369         (assert.throws):
1370
1371 2017-10-19  Mark Lam  <mark.lam@apple.com>
1372
1373         Stringifier::appendStringifiedValue() is missing an exception check.
1374         https://bugs.webkit.org/show_bug.cgi?id=178386
1375         <rdar://problem/35027610>
1376
1377         Reviewed by Saam Barati.
1378
1379         * stress/regress-178386.js: Added.
1380
1381 2017-10-19  Michael Saboff  <msaboff@apple.com>
1382
1383         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1384         https://bugs.webkit.org/show_bug.cgi?id=178521
1385
1386         Reviewed by JF Bastien.
1387
1388         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1389         now passes with the current version (5.0) of the Emoji spec.
1390
1391 2017-10-19  Robin Morisset  <rmorisset@apple.com>
1392
1393         Turn recursive tail calls into loops
1394         https://bugs.webkit.org/show_bug.cgi?id=176601
1395
1396         Reviewed by Saam Barati.
1397
1398         Add some simple test that computes factorial in several ways, and other trivial computations.
1399         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1400         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1401         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1402         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1403
1404         * stress/inline-call-to-recursive-tail-call.js: Added.
1405         (factorial.aux):
1406         (factorial):
1407         (factorial2.aux):
1408         (factorial2.id):
1409         (factorial2):
1410         (factorial3.aux):
1411         (factorial3):
1412         (aux):
1413         (factorial4):
1414         (test):
1415
1416 2017-10-18  Mark Lam  <mark.lam@apple.com>
1417
1418         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1419         https://bugs.webkit.org/show_bug.cgi?id=177600
1420         <rdar://problem/34710985>
1421
1422         Reviewed by Saam Barati.
1423
1424         * stress/regress-177600.js: Added.
1425
1426 2017-10-18  Mark Lam  <mark.lam@apple.com>
1427
1428         The compiler should always register a structure when it adds its transitionWatchPointSet.
1429         https://bugs.webkit.org/show_bug.cgi?id=178420
1430         <rdar://problem/34814024>
1431
1432         Reviewed by Saam Barati and Filip Pizlo.
1433
1434         * stress/regress-178420.js: Added.
1435         (new.Array.10000.map):
1436
1437 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1438
1439         [JSC] __proto__ getter should be fast
1440         https://bugs.webkit.org/show_bug.cgi?id=178067
1441
1442         Reviewed by Saam Barati.
1443
1444         * stress/dfg-object-proto-accessor.js: Added.
1445         (shouldBe):
1446         (shouldThrow):
1447         (target):
1448         * stress/dfg-object-proto-getter.js: Added.
1449         (shouldBe):
1450         (shouldThrow):
1451         (target):
1452         * stress/dfg-object-prototype-of.js: Added.
1453         (shouldBe):
1454         (shouldThrow):
1455         (target):
1456         * stress/dfg-reflect-get-prototype-of.js: Added.
1457         (shouldBe):
1458         (shouldThrow):
1459         (target):
1460         * stress/intrinsic-getter-with-poly-proto.js: Added.
1461         (shouldBe):
1462         (makePolyProtoObject.foo.C):
1463         (makePolyProtoObject.foo):
1464         (makePolyProtoObject):
1465         (target):
1466         * stress/object-get-prototype-of-filtered.js: Added.
1467         (shouldBe):
1468         (shouldThrow):
1469         (target):
1470         (i.Cocoa):
1471         * stress/object-get-prototype-of-mono-proto.js: Added.
1472         (shouldBe):
1473         (makePolyProtoObject.foo.C):
1474         (makePolyProtoObject.foo):
1475         (makePolyProtoObject):
1476         (target):
1477         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1478         (shouldBe):
1479         (makePolyProtoObject.foo.C):
1480         (makePolyProtoObject.foo):
1481         (makePolyProtoObject):
1482         (target):
1483         * stress/object-get-prototype-of-poly-proto.js: Added.
1484         (shouldBe):
1485         (makePolyProtoObject.foo.C):
1486         (makePolyProtoObject.foo):
1487         (makePolyProtoObject):
1488         (target):
1489         * stress/object-proto-getter-filtered.js: Added.
1490         (shouldBe):
1491         (shouldThrow):
1492         (target):
1493         (i.Cocoa):
1494         * stress/object-proto-getter-poly-mono-proto.js: Added.
1495         (shouldBe):
1496         (makePolyProtoObject.foo.C):
1497         (makePolyProtoObject.foo):
1498         (makePolyProtoObject):
1499         (target):
1500         * stress/object-proto-getter-poly-proto.js: Added.
1501         (shouldBe):
1502         (makePolyProtoObject.foo.C):
1503         (makePolyProtoObject.foo):
1504         (makePolyProtoObject):
1505         (target):
1506         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1507         * stress/string-proto.js: Added.
1508         (shouldBe):
1509         (target):
1510
1511 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1512
1513         Unreviewed, rolling out r223523.
1514
1515         A test for this change is failing on debug JSC bots.
1516
1517         Reverted changeset:
1518
1519         "[JSC] __proto__ getter should be fast"
1520         https://bugs.webkit.org/show_bug.cgi?id=178067
1521         https://trac.webkit.org/changeset/223523
1522
1523 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1524
1525         [JSC] __proto__ getter should be fast
1526         https://bugs.webkit.org/show_bug.cgi?id=178067
1527
1528         Reviewed by Saam Barati.
1529
1530         * stress/dfg-object-proto-accessor.js: Added.
1531         (shouldBe):
1532         (shouldThrow):
1533         (target):
1534         * stress/dfg-object-proto-getter.js: Added.
1535         (shouldBe):
1536         (shouldThrow):
1537         (target):
1538         * stress/dfg-object-prototype-of.js: Added.
1539         (shouldBe):
1540         (shouldThrow):
1541         (target):
1542         * stress/dfg-reflect-get-prototype-of.js: Added.
1543         (shouldBe):
1544         (shouldThrow):
1545         (target):
1546         * stress/object-get-prototype-of-filtered.js: Added.
1547         (shouldBe):
1548         (shouldThrow):
1549         (target):
1550         (i.Cocoa):
1551         * stress/object-get-prototype-of-mono-proto.js: Added.
1552         (shouldBe):
1553         (makePolyProtoObject.foo.C):
1554         (makePolyProtoObject.foo):
1555         (makePolyProtoObject):
1556         (target):
1557         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1558         (shouldBe):
1559         (makePolyProtoObject.foo.C):
1560         (makePolyProtoObject.foo):
1561         (makePolyProtoObject):
1562         (target):
1563         * stress/object-get-prototype-of-poly-proto.js: Added.
1564         (shouldBe):
1565         (makePolyProtoObject.foo.C):
1566         (makePolyProtoObject.foo):
1567         (makePolyProtoObject):
1568         (target):
1569         * stress/object-proto-getter-filtered.js: Added.
1570         (shouldBe):
1571         (shouldThrow):
1572         (target):
1573         (i.Cocoa):
1574         * stress/object-proto-getter-poly-mono-proto.js: Added.
1575         (shouldBe):
1576         (makePolyProtoObject.foo.C):
1577         (makePolyProtoObject.foo):
1578         (makePolyProtoObject):
1579         (target):
1580         * stress/object-proto-getter-poly-proto.js: Added.
1581         (shouldBe):
1582         (makePolyProtoObject.foo.C):
1583         (makePolyProtoObject.foo):
1584         (makePolyProtoObject):
1585         (target):
1586         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1587         * stress/string-proto.js: Added.
1588         (shouldBe):
1589         (target):
1590
1591 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1592
1593         Reland "Add Above/Below comparisons for UInt32 patterns"
1594         https://bugs.webkit.org/show_bug.cgi?id=177281
1595
1596         Reviewed by Saam Barati.
1597
1598         * stress/uint32-comparison-jump.js: Added.
1599         (shouldBe):
1600         (above):
1601         (aboveOrEqual):
1602         (below):
1603         (belowOrEqual):
1604         (notAbove):
1605         (notAboveOrEqual):
1606         (notBelow):
1607         (notBelowOrEqual):
1608         * stress/uint32-comparison.js: Added.
1609         (shouldBe):
1610         (above):
1611         (aboveOrEqual):
1612         (below):
1613         (belowOrEqual):
1614         (aboveTest):
1615         (aboveOrEqualTest):
1616         (belowTest):
1617         (belowOrEqualTest):
1618
1619 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1620
1621         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1622         https://bugs.webkit.org/show_bug.cgi?id=178210
1623
1624         Reviewed by Saam Barati.
1625
1626         * wasm/function-tests/trap-from-start-async.js:
1627         (async.StartTrapsAsync):
1628         * wasm/function-tests/trap-from-start.js:
1629         (StartTraps):
1630         * wasm/js-api/web-assembly-function.js:
1631         (assert.eq.Object.getPrototypeOf):
1632         * wasm/js-api/wrapper-function.js:
1633         (return.new.WebAssembly.Module):
1634         (assert.throws.makeInstance): Deleted.
1635         (assert.throws.Bar): Deleted.
1636         (assert.throws): Deleted.
1637
1638 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1639
1640         Enable gigacage on iOS
1641         https://bugs.webkit.org/show_bug.cgi?id=177586
1642
1643         Reviewed by JF Bastien.
1644         
1645         Add tests for when Gigacage gets runtime disabled.
1646
1647         * stress/disable-gigacage-arrays.js: Added.
1648         (foo):
1649         * stress/disable-gigacage-strings.js: Added.
1650         (foo):
1651         * stress/disable-gigacage-typed-arrays.js: Added.
1652         (foo):
1653
1654 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1655
1656         import.meta should not be assignable
1657         https://bugs.webkit.org/show_bug.cgi?id=178202
1658
1659         Reviewed by Saam Barati.
1660
1661         * modules/import-meta-assignment.js: Added.
1662         (shouldThrow):
1663         (SyntaxError.import.meta.can.shouldThrow):
1664
1665 2017-10-11  Saam Barati  <sbarati@apple.com>
1666
1667         Unreviewed. Actually skip certain type profiler tests in debug.
1668
1669         * typeProfiler.yaml:
1670         * typeProfiler/deltablue-for-of.js:
1671         * typeProfiler/getter-richards.js:
1672
1673 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1674
1675         Unreviewed, rolling out r223113 and r223121.
1676         https://bugs.webkit.org/show_bug.cgi?id=178182
1677
1678         Reintroduced 20% regression on Kraken (Requested by rniwa on
1679         #webkit).
1680
1681         Reverted changesets:
1682
1683         "Enable gigacage on iOS"
1684         https://bugs.webkit.org/show_bug.cgi?id=177586
1685         https://trac.webkit.org/changeset/223113
1686
1687         "Use one virtual allocation for all gigacages and their
1688         runways"
1689         https://bugs.webkit.org/show_bug.cgi?id=178050
1690         https://trac.webkit.org/changeset/223121
1691
1692 2017-10-11  Michael Saboff  <msaboff@apple.com>
1693
1694         Disable test262 named capture group tests with direct unicode names and with references before definitions
1695         https://bugs.webkit.org/show_bug.cgi?id=178177
1696
1697         Reviewed by Keith Miller.
1698
1699         Bugs to track fixing these test are:
1700         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1701             "Add support in named capture group identifiers for direct surrogate pairs"
1702         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1703             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1704
1705         * test262.yaml:
1706
1707 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1708
1709         Object properties are undefined in super.call() but not in this.call()
1710         https://bugs.webkit.org/show_bug.cgi?id=177230
1711
1712         Reviewed by Saam Barati.
1713
1714         * stress/super-call-function-subclass.js: Added.
1715         (assert):
1716         (A.prototype.t):
1717         (A):
1718         * stress/super-dot-call-and-apply.js: Added.
1719         (assert):
1720         (A):
1721         (A.prototype.call):
1722         (A.prototype.apply):
1723         (B.prototype.testSuper):
1724         (B):
1725         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1726         (D.prototype.testSuper):
1727         (D):
1728
1729 2017-10-10  Saam Barati  <sbarati@apple.com>
1730
1731         The prototype cache should be aware of the Executable it generates a Structure for
1732         https://bugs.webkit.org/show_bug.cgi?id=177907
1733
1734         Reviewed by Filip Pizlo.
1735
1736         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1737         (assert):
1738         (foo.C):
1739         (foo):
1740         (bar.C):
1741         (bar):
1742         (access):
1743         (makeLongChain):
1744         (accessY):
1745
1746 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1747
1748         `async` should be able to be used as an imported binding name
1749         https://bugs.webkit.org/show_bug.cgi?id=176573
1750
1751         Reviewed by Saam Barati.
1752
1753         * modules/import-default-async.js: Added.
1754         * modules/import-named-async-as.js: Added.
1755         * modules/import-named-async.js: Added.
1756         * modules/import-named-async/target.js: Added.
1757         * modules/import-namespace-async.js: Added.
1758         * test262.yaml:
1759
1760 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1761
1762         Enable gigacage on iOS
1763         https://bugs.webkit.org/show_bug.cgi?id=177586
1764
1765         Reviewed by JF Bastien.
1766         
1767         Add tests for when Gigacage gets runtime disabled.
1768
1769         * stress/disable-gigacage-arrays.js: Added.
1770         (foo):
1771         * stress/disable-gigacage-strings.js: Added.
1772         (foo):
1773         * stress/disable-gigacage-typed-arrays.js: Added.
1774         (foo):
1775
1776 2017-10-09  Michael Saboff  <msaboff@apple.com>
1777
1778         Implement RegExp Unicode property escapes
1779         https://bugs.webkit.org/show_bug.cgi?id=172069
1780
1781         Reviewed by JF Bastien.
1782
1783         Enabled Unicode Property tests.
1784
1785         * test262.yaml:
1786
1787 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1788
1789         Unreviewed, rolling out r223015 and r223025.
1790         https://bugs.webkit.org/show_bug.cgi?id=178093
1791
1792         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1793         #webkit).
1794
1795         Reverted changesets:
1796
1797         "Enable gigacage on iOS"
1798         https://bugs.webkit.org/show_bug.cgi?id=177586
1799         http://trac.webkit.org/changeset/223015
1800
1801         "Unreviewed, disable Gigacage on ARM64 Linux"
1802         https://bugs.webkit.org/show_bug.cgi?id=177586
1803         http://trac.webkit.org/changeset/223025
1804
1805 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1806
1807         Update expectations for test262 tests that pass after r223043.
1808         https://bugs.webkit.org/show_bug.cgi?id=176685
1809
1810         Unreviewed test gardening.
1811
1812         * test262.yaml:
1813
1814 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1815
1816         Unreviewed, rolling out r223022.
1817
1818         This change introduced 18 test262 failures.
1819
1820         Reverted changeset:
1821
1822         "`async` should be able to be used as an imported binding
1823         name"
1824         https://bugs.webkit.org/show_bug.cgi?id=176573
1825         http://trac.webkit.org/changeset/223022
1826
1827 2017-10-09  Saam Barati  <sbarati@apple.com>
1828
1829         3 poly-proto JSC tests timing out on debug after r222827
1830         https://bugs.webkit.org/show_bug.cgi?id=177880
1831         <rdar://problem/34817122>
1832
1833         Unreviewed.
1834
1835         I'm skipping these type profiler tests on debug since they are long running.
1836
1837         * typeProfiler/deltablue-for-of.js:
1838         * typeProfiler/getter-richards.js:
1839
1840 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1841
1842         Safari 10 /11 problem with if (!await get(something)).
1843         https://bugs.webkit.org/show_bug.cgi?id=176685
1844
1845         Reviewed by Saam Barati.
1846
1847         * stress/async-await-basic.js:
1848         (awaitEpression.async):
1849         * stress/async-await-syntax.js:
1850         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1851         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1852
1853 2017-10-08  Saam Barati  <sbarati@apple.com>
1854
1855         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1856
1857         * typeProfiler/deltablue-for-of.js:
1858         * typeProfiler/getter-richards.js:
1859
1860 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1861
1862         `async` should be able to be used as an imported binding name
1863         https://bugs.webkit.org/show_bug.cgi?id=176573
1864
1865         Reviewed by Darin Adler.
1866
1867         * modules/import-default-async.js: Added.
1868         * modules/import-named-async-as.js: Added.
1869         * modules/import-named-async.js: Added.
1870         * modules/import-named-async/target.js: Added.
1871         * modules/import-namespace-async.js: Added.
1872
1873 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1874
1875         Enable gigacage on iOS
1876         https://bugs.webkit.org/show_bug.cgi?id=177586
1877
1878         Reviewed by JF Bastien.
1879         
1880         Add tests for when Gigacage gets runtime disabled.
1881
1882         * stress/disable-gigacage-arrays.js: Added.
1883         (foo):
1884         * stress/disable-gigacage-strings.js: Added.
1885         (foo):
1886         * stress/disable-gigacage-typed-arrays.js: Added.
1887         (foo):
1888
1889 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1890
1891         Unreviewed, rolling out r222791 and r222873.
1892         https://bugs.webkit.org/show_bug.cgi?id=178031
1893
1894         Caused crashes with workers/wasm LayoutTests (Requested by
1895         ryanhaddad on #webkit).
1896
1897         Reverted changesets:
1898
1899         "WebAssembly: no VM / JS version of everything but Instance"
1900         https://bugs.webkit.org/show_bug.cgi?id=177473
1901         http://trac.webkit.org/changeset/222791
1902
1903         "WebAssembly: address no VM / JS follow-ups"
1904         https://bugs.webkit.org/show_bug.cgi?id=177887
1905         http://trac.webkit.org/changeset/222873
1906
1907 2017-10-05  Saam Barati  <sbarati@apple.com>
1908
1909         Make sure all prototypes under poly proto get added into the VM's prototype map
1910         https://bugs.webkit.org/show_bug.cgi?id=177909
1911
1912         Reviewed by Keith Miller.
1913
1914         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1915         (assert):
1916         (foo.C):
1917         (foo):
1918         (set x):
1919
1920 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1921
1922         [JSC] Introduce import.meta
1923         https://bugs.webkit.org/show_bug.cgi?id=177703
1924
1925         Reviewed by Filip Pizlo.
1926
1927         * modules/import-meta-syntax.js: Added.
1928         (shouldThrow):
1929         (shouldNotThrow):
1930         * modules/import-meta.js: Added.
1931         * modules/import-meta/cocoa.js: Added.
1932         * modules/resources/assert.js:
1933         (export.shouldNotThrow):
1934         * stress/import-syntax.js:
1935
1936 2017-10-04  Saam Barati  <sbarati@apple.com>
1937
1938         Make pertinent AccessCases watch the poly proto watchpoint
1939         https://bugs.webkit.org/show_bug.cgi?id=177765
1940
1941         Reviewed by Keith Miller.
1942
1943         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1944         (assert):
1945         (foo.C):
1946         (foo):
1947         (validate):
1948         * stress/poly-proto-clear-stub.js: Added.
1949         (assert):
1950         (foo.C):
1951         (foo):
1952
1953 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1954
1955         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1956
1957         Unreviewed test gardening.
1958
1959         * test262.yaml:
1960
1961 2017-10-04  Saam Barati  <sbarati@apple.com>
1962
1963         3 poly-proto JSC tests timing out on debug after r222827
1964         https://bugs.webkit.org/show_bug.cgi?id=177880
1965
1966         Rubber stamped by Mark Lam.
1967
1968         * microbenchmarks/poly-proto-access.js:
1969         * typeProfiler/deltablue-for-of.js:
1970         * typeProfiler/getter-richards.js:
1971
1972 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1973
1974         Unreviewed, marking tco-catch.js as a failure after test262 update
1975         https://bugs.webkit.org/show_bug.cgi?id=177859
1976
1977         * test262.yaml:
1978
1979 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1980
1981         Unreviewed, marking one async iterator test262 test failed
1982         https://bugs.webkit.org/show_bug.cgi?id=177859
1983
1984         * test262.yaml:
1985
1986 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1987
1988         [Test262] Update Test262 to Oct 4 version
1989         https://bugs.webkit.org/show_bug.cgi?id=177859
1990
1991         Reviewed by Sam Weinig.
1992
1993         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1994         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1995
1996         * test262.yaml:
1997         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1998         (checkSequence):
1999         * test262/harness/typeCoercion.js:
2000         (testCoercibleToIndexZero):
2001         (testCoercibleToIndexOne):
2002         (testCoercibleToIndexFromIndex):
2003         (testNotCoercibleToIndex.testPrimitiveValue):
2004         (testNotCoercibleToInteger):
2005         (testCoercibleToBigIntZero.testPrimitiveValue):
2006         (testCoercibleToBigIntZero):
2007         (testCoercibleToBigIntOne.testPrimitiveValue):
2008         (testCoercibleToBigIntOne):
2009         (testPrimitiveValue):
2010         (testCoercibleToBigIntFromBigInt):
2011         (testNotCoercibleToBigInt.testPrimitiveValue):
2012         (testNotCoercibleToBigInt.testStringValue):
2013         (testNotCoercibleToBigInt):
2014         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
2015         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
2016         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
2017         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
2018         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
2019         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
2020         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
2021         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
2022         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
2023         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
2024         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
2025         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
2026         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
2027         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
2028         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
2029         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
2030         (testCoercibleToBigIntZero):
2031         (testCoercibleToBigIntOne):
2032         (testNotCoercibleToBigInt):
2033         (MyError): Deleted.
2034         (valueOf): Deleted.
2035         (toString): Deleted.
2036         (Symbol.toPrimitive): Deleted.
2037         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
2038         (testCoercibleToIndexZero):
2039         (testCoercibleToIndexOne):
2040         (testNotCoercibleToIndex):
2041         (MyError): Deleted.
2042         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
2043         (assert.sameValue.BigInt.asIntN.toString): Deleted.
2044         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
2045         (BigInt.asIntN.valueOf): Deleted.
2046         (BigInt.asIntN.toString): Deleted.
2047         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
2048         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
2049         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
2050         (testCoercibleToBigIntZero):
2051         (testCoercibleToBigIntOne):
2052         (testNotCoercibleToBigInt):
2053         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
2054         (testCoercibleToIndexZero):
2055         (testCoercibleToIndexOne):
2056         (testNotCoercibleToIndex):
2057         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
2058         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
2059         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
2060         (bits.valueOf):
2061         (bigint.valueOf):
2062         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
2063         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
2064         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
2065         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
2066         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
2067         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
2068         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
2069         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
2070         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
2071         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
2072         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
2073         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
2074         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
2075         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
2076         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
2077         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
2078         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
2079         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
2080         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
2081         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
2082         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
2083         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
2084         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
2085         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
2086         (replacer):
2087         (BigInt.prototype.toJSON):
2088         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
2089         (replacer):
2090         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
2091         (BigInt.prototype.toJSON):
2092         * test262/test/built-ins/JSON/stringify/bigint.js:
2093         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
2094         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
2095         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
2096         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
2097         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
2098         * test262/test/built-ins/Object/proto-from-ctor.js:
2099         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
2100         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
2101         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
2102         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
2103         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
2104         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
2105         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
2106         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
2107         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
2108         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
2109         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
2110         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
2111         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
2112         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
2113         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
2114         * test262/test/built-ins/Proxy/get-fn-realm.js:
2115         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
2116         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
2117         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
2118         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
2119         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
2120         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
2121         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
2122         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
2123         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
2124         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
2125         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
2126         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
2127         (i6.replace):
2128         (i6b.replace):
2129         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
2130         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
2131         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
2132         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
2133         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
2134         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
2135         * test262/test/built-ins/RegExp/u180e.js: Added.
2136         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
2137         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
2138         * test262/test/built-ins/String/proto-from-ctor-realm.js:
2139         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
2140         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
2141         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
2142         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
2143         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
2144         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
2145         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
2146         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
2147         * test262/test/built-ins/String/prototype/endsWith/length.js:
2148         * test262/test/built-ins/String/prototype/endsWith/name.js:
2149         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
2150         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
2151         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
2152         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
2153         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
2154         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
2155         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
2156         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
2157         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
2158         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
2159         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
2160         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
2161         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
2162         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
2163         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
2164         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
2165         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
2166         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
2167         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
2168         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
2169         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
2170         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
2171         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
2172         * test262/test/built-ins/String/prototype/includes/includes.js:
2173         * test262/test/built-ins/String/prototype/includes/length.js:
2174         * test262/test/built-ins/String/prototype/includes/name.js:
2175         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
2176         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
2177         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
2178         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
2179         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
2180         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
2181         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
2182         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
2183         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
2184         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
2185         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
2186         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
2187         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
2188         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
2189         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
2190         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
2191         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
2192         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
2193         * test262/test/built-ins/String/prototype/trim/u180e.js:
2194         * test262/test/built-ins/Symbol/for/cross-realm.js:
2195         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
2196         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
2197         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
2198         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
2199         * test262/test/built-ins/Symbol/match/cross-realm.js:
2200         * test262/test/built-ins/Symbol/replace/cross-realm.js:
2201         * test262/test/built-ins/Symbol/search/cross-realm.js:
2202         * test262/test/built-ins/Symbol/species/cross-realm.js:
2203         * test262/test/built-ins/Symbol/split/cross-realm.js:
2204         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
2205         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
2206         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
2207         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
2208         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
2209         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
2210         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
2211         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
2212         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
2213         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
2214         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
2215         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
2216         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
2217         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
2218         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
2219         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
2220         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
2221         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
2222         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
2223         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
2224         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
2225         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
2226         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
2227         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
2228         * test262/test/language/comments/mongolian-vowel-separator-single.js:
2229         * test262/test/language/eval-code/indirect/realm.js:
2230         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
2231         (o.get z):
2232         (o.get a):
2233         * test262/test/language/expressions/call/eval-realm-indirect.js:
2234         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
2235         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
2236         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
2237         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
2238         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2239         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
2240         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
2241         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
2242         * test262/test/language/expressions/greater-than/bigint-and-number.js:
2243         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
2244         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
2245         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
2246         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2247         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
2248         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
2249         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
2250         * test262/test/language/expressions/less-than/bigint-and-number.js:
2251         * test262/test/language/expressions/new/non-ctor-err-realm.js:
2252         * test262/test/language/expressions/super/realm.js:
2253         * test262/test/language/expressions/tagged-template/cache-realm.js:
2254         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
2255         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
2256         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
2257         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
2258         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
2259         * test262/test/language/literals/string/mongolian-vowel-separator.js:
2260         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
2261         (o.get z):
2262         (o.get a):
2263         * test262/test/language/statements/for-of/iterator-next-reference.js:
2264         (next):
2265         (iterator.next): Deleted.
2266         (x.of.iterable.): Deleted.
2267         (x.of.iterable.get return): Deleted.
2268         (x.of.iterable.iterator.next): Deleted.
2269         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
2270         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
2271         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
2272         * test262/test/language/white-space/mongolian-vowel-separator.js:
2273         * test262/test262-Revision.txt:
2274
2275 2017-10-03  Saam Barati  <sbarati@apple.com>
2276
2277         Implement polymorphic prototypes
2278         https://bugs.webkit.org/show_bug.cgi?id=176391
2279
2280         Reviewed by Filip Pizlo.
2281
2282         * microbenchmarks/poly-proto-access.js: Added.
2283         (assert):
2284         (foo.C):
2285         (foo.C.prototype.get bar):
2286         (foo):
2287         (bar):
2288         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
2289         (assert):
2290         (makePolyProtoObject.foo.C):
2291         (makePolyProtoObject.foo):
2292         (makePolyProtoObject):
2293         (performSet):
2294         * microbenchmarks/poly-proto-setter-speed.js: Added.
2295         (assert):
2296         (makePolyProtoObject.foo.C):
2297         (makePolyProtoObject.foo.C.prototype.set p):
2298         (makePolyProtoObject.foo):
2299         (makePolyProtoObject):
2300         (performSet):
2301         * stress/constructor-with-return.js:
2302         (i.tests.forEach.Constructor):
2303         (i.tests.forEach):
2304         (tests.forEach.Constructor): Deleted.
2305         (tests.forEach): Deleted.
2306         * stress/dom-jit-with-poly-proto.js: Added.
2307         (assert):
2308         (makePolyProtoObject.foo.C):
2309         (makePolyProtoObject.foo):
2310         (makePolyProtoObject):
2311         (validate):
2312         * stress/poly-proto-custom-value-and-accessor.js: Added.
2313         (assert):
2314         (makePolyProtoObject.foo.C):
2315         (makePolyProtoObject.foo):
2316         (makePolyProtoObject):
2317         (items.forEach):
2318         (set get for):
2319         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
2320         (assert):
2321         (makePolyProtoObject.foo.C):
2322         (makePolyProtoObject.foo):
2323         (makePolyProtoObject):
2324         (foo):
2325         * stress/poly-proto-miss.js: Added.
2326         (makePolyProtoInstanceWithNullPrototype.foo.C):
2327         (makePolyProtoInstanceWithNullPrototype.foo):
2328         (makePolyProtoInstanceWithNullPrototype):
2329         (assert):
2330         (validate):
2331         * stress/poly-proto-op-in-caching.js: Added.
2332         (assert):
2333         (makePolyProtoObject.foo.C):
2334         (makePolyProtoObject.foo):
2335         (makePolyProtoObject):
2336         (validate):
2337         (validate2):
2338         * stress/poly-proto-put-transition.js: Added.
2339         (assert):
2340         (makePolyProtoObject.foo.C):
2341         (makePolyProtoObject.foo):
2342         (makePolyProtoObject):
2343         (performSet):
2344         (i.obj.__proto__.set p):
2345         * stress/poly-proto-set-prototype.js: Added.
2346         (assert):
2347         (let.alternateProto.get x):
2348         (let.alternateProto2.get y):
2349         (let.alternateProto2.get x):
2350         (foo.C):
2351         (foo):
2352         (validate):
2353         * stress/poly-proto-setter.js: Added.
2354         (assert):
2355         (makePolyProtoObject.foo.C):
2356         (makePolyProtoObject.foo.C.prototype.set p):
2357         (makePolyProtoObject.foo.C.prototype.get p):
2358         (makePolyProtoObject.foo):
2359         (makePolyProtoObject):
2360         (performSet):
2361         * stress/poly-proto-using-inheritance.js: Added.
2362         (assert):
2363         (foo.C):
2364         (foo.C.prototype.get baz):
2365         (foo):
2366         (bar.C):
2367         (bar):
2368         (validate):
2369         * stress/primitive-poly-proto.js: Added.
2370         (makePolyProtoInstance.foo.C):
2371         (makePolyProtoInstance.foo):
2372         (makePolyProtoInstance):
2373         (assert):
2374         (validate):
2375         * stress/prototype-is-not-js-object.js: Added.
2376         (foo.bar):
2377         (foo):
2378         (assert):
2379         (validate):
2380         * stress/try-get-by-id-poly-proto.js: Added.
2381         (assert):
2382         (makePolyProtoObject.foo.C):
2383         (makePolyProtoObject.foo):
2384         (makePolyProtoObject):
2385         (tryGetByIdText):
2386         (x.__proto__.get bar):
2387         (validate):
2388         * typeProfiler/overflow.js:
2389
2390 2017-10-03  JF Bastien  <jfbastien@apple.com>
2391
2392         WebAssembly: no VM / JS version of everything but Instance
2393         https://bugs.webkit.org/show_bug.cgi?id=177473
2394
2395         Reviewed by Filip Pizlo.
2396
2397         - Exceeding max on memory growth now returns a range error as per
2398         spec. This is a (very minor) breaking change: it used to throw OOM
2399         error. Update the corresponding test.
2400
2401         * wasm/js-api/memory-grow.js:
2402         (assertEq):
2403         * wasm/js-api/table.js:
2404         (assert.throws):
2405
2406 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
2407
2408         Skip JSC test stress/regress-159779-2.js on debug.
2409         https://bugs.webkit.org/show_bug.cgi?id=177204
2410
2411         Unreviewed test gardening.
2412
2413         * stress/regress-159779-2.js:
2414
2415 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
2416
2417         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2418         https://bugs.webkit.org/show_bug.cgi?id=175642
2419
2420         Reviewed by Darin Adler.
2421
2422         * ChakraCore/test/Function/apply3.baseline-jsc:
2423
2424 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2425
2426         Unreviewed, rolling out r222564.
2427         https://bugs.webkit.org/show_bug.cgi?id=177720
2428
2429         "It regressed JetStream by 2% on iOS caused by a 50%
2430         regression on the bigfib subtest" (Requested by saamyjoon on
2431         #webkit).
2432
2433         Reverted changeset:
2434
2435         "Add Above/Below comparisons for UInt32 patterns"
2436         https://bugs.webkit.org/show_bug.cgi?id=177281
2437         http://trac.webkit.org/changeset/222564
2438
2439 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2440
2441         [DFG] Support ArrayPush with multiple args
2442         https://bugs.webkit.org/show_bug.cgi?id=175823
2443
2444         Reviewed by Saam Barati.
2445
2446         * microbenchmarks/array-push-0.js: Added.
2447         (arrayPush0):
2448         * microbenchmarks/array-push-1.js: Added.
2449         (arrayPush1):
2450         * microbenchmarks/array-push-2.js: Added.
2451         (arrayPush2):
2452         * microbenchmarks/array-push-3.js: Added.
2453         (arrayPush3):
2454         * stress/array-push-multiple-contiguous.js: Added.
2455         (shouldBe):
2456         (test):
2457         * stress/array-push-multiple-double-nan.js: Added.
2458         (shouldBe):
2459         (test):
2460         * stress/array-push-multiple-double.js: Added.
2461         (shouldBe):
2462         (test):
2463         * stress/array-push-multiple-int32.js: Added.
2464         (shouldBe):
2465         (test):
2466         * stress/array-push-multiple-many-contiguous.js: Added.
2467         (shouldBe):
2468         (test):
2469         * stress/array-push-multiple-many-double.js: Added.
2470         (shouldBe):
2471         (test):
2472         * stress/array-push-multiple-many-int32.js: Added.
2473         (shouldBe):
2474         (test):
2475         * stress/array-push-multiple-many-storage.js: Added.
2476         (shouldBe):
2477         (test):
2478         * stress/array-push-multiple-storage.js: Added.
2479         (shouldBe):
2480         (test):
2481         * stress/array-push-with-force-exit.js: Added.
2482         (target.createBuiltin):
2483
2484 2017-09-29  Saam Barati  <sbarati@apple.com>
2485
2486         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2487         https://bugs.webkit.org/show_bug.cgi?id=177639
2488
2489         Reviewed by Geoffrey Garen.
2490
2491         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2492         (assert):
2493         (Class):
2494         (items.forEach):
2495         (set get for):
2496
2497 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2498
2499         Unreviewed, rolling out r222563, r222565, and r222581.
2500         https://bugs.webkit.org/show_bug.cgi?id=177675
2501
2502         "It causes a crash when playing youtube videos" (Requested by
2503         saamyjoon on #webkit).
2504
2505         Reverted changesets:
2506
2507         "[DFG] Support ArrayPush with multiple args"
2508         https://bugs.webkit.org/show_bug.cgi?id=175823
2509         http://trac.webkit.org/changeset/222563
2510
2511         "Unreviewed, build fix after r222563"
2512         https://bugs.webkit.org/show_bug.cgi?id=175823
2513         http://trac.webkit.org/changeset/222565
2514
2515         "Unreviewed, fix x86 breaking due to exhausted registers"
2516         https://bugs.webkit.org/show_bug.cgi?id=175823
2517         http://trac.webkit.org/changeset/222581
2518
2519 2017-09-28  Mark Lam  <mark.lam@apple.com>
2520
2521         test262: Unexpected passes after r222617 and r222618.
2522         https://bugs.webkit.org/show_bug.cgi?id=177622
2523         <rdar://problem/34725960>
2524
2525         Reviewed by Saam Barati.
2526
2527         Update test262.yaml for tests that are now passing.
2528
2529         * test262.yaml:
2530
2531 2017-09-27  Michael Saboff  <msaboff@apple.com>
2532
2533         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2534         https://bugs.webkit.org/show_bug.cgi?id=177570
2535
2536         Reviewed by Filip Pizlo.
2537
2538         New regression test.
2539
2540         * stress/regress-177570.js: Added.
2541
2542 2017-09-28  Michael Saboff  <msaboff@apple.com>
2543
2544         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2545         https://bugs.webkit.org/show_bug.cgi?id=177423
2546
2547         Reviewed by Mark Lam.
2548
2549         Updated regression test.
2550
2551         * stress/regress-177423.js:
2552         (catch):
2553
2554 2017-09-27  Mark Lam  <mark.lam@apple.com>
2555
2556         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2557         https://bugs.webkit.org/show_bug.cgi?id=177584
2558         <rdar://problem/34463903>
2559
2560         Reviewed by Saam Barati.
2561
2562         * stress/regress-177584.js: Added.
2563         (assertEqual):
2564         (Array.prototype.Symbol.species):
2565
2566 2017-09-27  Saam Barati  <sbarati@apple.com>
2567
2568         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2569         https://bugs.webkit.org/show_bug.cgi?id=177523
2570
2571         Reviewed by Mark Lam.
2572
2573         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2574         (assert):
2575         (Test):
2576         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2577         (addMethods):
2578         (i.Test.prototype.propName):
2579
2580 2017-09-27  Mark Lam  <mark.lam@apple.com>
2581
2582         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2583         https://bugs.webkit.org/show_bug.cgi?id=177423
2584         <rdar://problem/34621320>
2585
2586         Reviewed by Keith Miller.
2587
2588         * stress/regress-177423.js: Added.
2589
2590 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2591
2592         Add Above/Below comparisons for UInt32 patterns
2593         https://bugs.webkit.org/show_bug.cgi?id=177281
2594
2595         Reviewed by Saam Barati.
2596
2597         * stress/uint32-comparison-jump.js: Added.
2598         (shouldBe):
2599         (above):
2600         (aboveOrEqual):
2601         (below):
2602         (belowOrEqual):
2603         (notAbove):
2604         (notAboveOrEqual):
2605         (notBelow):
2606         (notBelowOrEqual):
2607         * stress/uint32-comparison.js: Added.
2608         (shouldBe):
2609         (above):
2610         (aboveOrEqual):
2611         (below):
2612         (belowOrEqual):
2613         (aboveTest):
2614         (aboveOrEqualTest):
2615         (belowTest):
2616         (belowOrEqualTest):
2617
2618 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2619
2620         [DFG] Support ArrayPush with multiple args
2621         https://bugs.webkit.org/show_bug.cgi?id=175823
2622
2623         Reviewed by Saam Barati.
2624
2625         * microbenchmarks/array-push-0.js: Added.
2626         (arrayPush0):
2627         * microbenchmarks/array-push-1.js: Added.
2628         (arrayPush1):
2629         * microbenchmarks/array-push-2.js: Added.
2630         (arrayPush2):
2631         * microbenchmarks/array-push-3.js: Added.
2632         (arrayPush3):
2633         * stress/array-push-multiple-contiguous.js: Added.
2634         (shouldBe):
2635         (test):
2636         * stress/array-push-multiple-double-nan.js: Added.
2637         (shouldBe):
2638         (test):
2639         * stress/array-push-multiple-double.js: Added.
2640         (shouldBe):
2641         (test):
2642         * stress/array-push-multiple-int32.js: Added.
2643         (shouldBe):
2644         (test):
2645         * stress/array-push-multiple-many-contiguous.js: Added.
2646         (shouldBe):
2647         (test):
2648         * stress/array-push-multiple-many-double.js: Added.
2649         (shouldBe):
2650         (test):
2651         * stress/array-push-multiple-many-int32.js: Added.
2652         (shouldBe):
2653         (test):
2654         * stress/array-push-multiple-many-storage.js: Added.
2655         (shouldBe):
2656         (test):
2657         * stress/array-push-multiple-storage.js: Added.
2658         (shouldBe):
2659         (test):
2660
2661 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2662
2663         Unreviewed, rolling out r222518.
2664         https://bugs.webkit.org/show_bug.cgi?id=177507
2665
2666         Break the High Sierra build (Requested by yusukesuzuki on
2667         #webkit).
2668
2669         Reverted changeset:
2670
2671         "Add Above/Below comparisons for UInt32 patterns"
2672         https://bugs.webkit.org/show_bug.cgi?id=177281
2673         http://trac.webkit.org/changeset/222518
2674
2675 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2676
2677         Add Above/Below comparisons for UInt32 patterns
2678         https://bugs.webkit.org/show_bug.cgi?id=177281
2679
2680         Reviewed by Saam Barati.
2681
2682         * stress/uint32-comparison-jump.js: Added.
2683         (shouldBe):
2684         (above):
2685         (aboveOrEqual):
2686         (below):
2687         (belowOrEqual):
2688         (notAbove):
2689         (notAboveOrEqual):
2690         (notBelow):
2691         (notBelowOrEqual):
2692         * stress/uint32-comparison.js: Added.
2693         (shouldBe):
2694         (above):
2695         (aboveOrEqual):
2696         (below):
2697         (belowOrEqual):
2698         (aboveTest):
2699         (aboveOrEqualTest):
2700         (belowTest):
2701         (belowOrEqualTest):
2702
2703 2017-09-23  Keith Miller  <keith_miller@apple.com>
2704
2705         Fix infinite looping test262 test
2706         https://bugs.webkit.org/show_bug.cgi?id=177412
2707
2708         Reviewed by Yusuke Suzuki.
2709
2710         This test was poorly designed since failing it would cause the vm
2711         to inifinite loop. I've fixed it locally and will fix it on github pending
2712         the results of next weeks tc39 meeting.
2713
2714         * test262.yaml:
2715         * test262/test/language/statements/for-of/iterator-next-reference.js:
2716
2717 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2718
2719         test262: $.agent became $262.agent in test262 update
2720         https://bugs.webkit.org/show_bug.cgi?id=177407
2721
2722         Reviewed by Yusuke Suzuki.
2723
2724         * test262.yaml:
2725         ~320 tests pass now that we correctly make $262 available.
2726
2727 2017-09-22  Keith Miller  <keith_miller@apple.com>
2728
2729         Speculatively change iteration protocall to use the same next function
2730         https://bugs.webkit.org/show_bug.cgi?id=175653
2731
2732         Reviewed by Saam Barati.
2733
2734         Change test to match the new iteration behavior.
2735
2736         * stress/spread-optimized-properly.js:
2737
2738 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2739
2740         [DFG][FTL] Profile array vector length for array allocation
2741         https://bugs.webkit.org/show_bug.cgi?id=177051
2742
2743         Reviewed by Saam Barati.
2744
2745         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2746         (target):
2747
2748 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2749
2750         Unreviewed, rolling out r222380.
2751         https://bugs.webkit.org/show_bug.cgi?id=177352
2752
2753         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2754         #webkit).
2755
2756         Reverted changeset:
2757
2758         "[DFG][FTL] Profile array vector length for array allocation"
2759         https://bugs.webkit.org/show_bug.cgi?id=177051
2760         http://trac.webkit.org/changeset/222380
2761
2762 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2763
2764         [DFG][FTL] Profile array vector length for array allocation
2765         https://bugs.webkit.org/show_bug.cgi?id=177051
2766
2767         Reviewed by Saam Barati.
2768
2769         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2770         (target):
2771
2772 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2773
2774         Skip new hanging test262 tests.
2775         https://bugs.webkit.org/show_bug.cgi?id=177326
2776
2777         Unreviewed test gardening.
2778
2779         * test262.yaml:
2780
2781 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2782
2783         Mark 6 test262 tests as passing.
2784         https://bugs.webkit.org/show_bug.cgi?id=177307
2785
2786         Unreviewed test gardening.
2787
2788         * test262.yaml:
2789
2790 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2791
2792         Unreviewed follow-up to r222311.
2793
2794         * test262/harness/sta.js:
2795         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2796         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2797         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2798         * test262/test/built-ins/Array/from/elements-added-after.js:
2799         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2800         * test262/test/built-ins/Array/from/elements-updated-after.js:
2801         * test262/test/built-ins/Array/from/from-array.js:
2802         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2803         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2804         * test262/test/built-ins/Array/from/source-array-boundary.js:
2805         * test262/test/built-ins/Array/from/source-object-constructor.js:
2806         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2807         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2808         * test262/test/built-ins/Array/from/source-object-length.js:
2809         * test262/test/built-ins/Array/from/source-object-missing.js:
2810         * test262/test/built-ins/Array/from/source-object-without.js:
2811         * test262/test/built-ins/Array/from/this-null.js:
2812         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2813         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2814         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2815         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2816         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2817         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2818         * test262/test/language/literals/string/7.8.4-1gs.js:
2819         Fix some files that I failed to update when I applied my patch.
2820
2821 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2822
2823         Update test262 tests
2824         https://bugs.webkit.org/show_bug.cgi?id=177220
2825
2826         Reviewed by Saam Barati and Yusuke Suzuki.
2827
2828         * test262.yaml:
2829         * test262/test262-Revision.txt:
2830         New rebaselined expectations for all tests.
2831
2832         * test262/*:
2833         Updated.
2834
2835 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2836
2837         [DFG] Remove ToThis more aggressively
2838         https://bugs.webkit.org/show_bug.cgi?id=177056
2839
2840         Reviewed by Saam Barati.
2841
2842         * stress/generator-with-this-strict.js: Added.
2843         (shouldBe):
2844         (generator):
2845         (target):
2846         * stress/generator-with-this.js: Added.
2847         (shouldBe):
2848         (generator):
2849         (target):
2850
2851 2017-09-17  Michael Saboff  <msaboff@apple.com>
2852
2853         https://bugs.webkit.org/show_bug.cgi?id=177038
2854         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2855
2856         Reviewed by JF Bastien.
2857
2858         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2859         as it dies using too much memory.
2860
2861 2017-09-15  Saam Barati  <sbarati@apple.com>
2862
2863         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2864         https://bugs.webkit.org/show_bug.cgi?id=176981
2865
2866         Reviewed by Yusuke Suzuki.
2867
2868         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2869         (assert):
2870         (verify):
2871         (func):
2872         (const.bar.createBuiltin):
2873
2874 2017-09-14  Saam Barati  <sbarati@apple.com>
2875
2876         It should be valid to exit before each set when doing arity fixup when inlining
2877         https://bugs.webkit.org/show_bug.cgi?id=176948
2878
2879         Reviewed by Keith Miller.
2880
2881         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2882         (baz):
2883         (bar):
2884         (foo):
2885
2886 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2887
2888         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2889         https://bugs.webkit.org/show_bug.cgi?id=176867
2890
2891         Reviewed by Sam Weinig.
2892
2893         * microbenchmarks/object-get-own-property-symbols.js: Added.
2894         (test):
2895
2896 2017-09-13  Mark Lam  <mark.lam@apple.com>
2897
2898         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2899         https://bugs.webkit.org/show_bug.cgi?id=176888
2900         <rdar://problem/34381832>
2901
2902         Not reviewed.
2903
2904         * stress/op_mod-ConstVar.js:
2905         * stress/op_mod-VarConst.js:
2906         * stress/op_mod-VarVar.js:
2907
2908 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2909
2910         Skip 3 op_mod tests on Debug JSC bots.
2911         https://bugs.webkit.org/show_bug.cgi?id=176630
2912
2913         Unreviewed test gardening.
2914
2915         * stress/op_mod-ConstVar.js:
2916         * stress/op_mod-VarConst.js:
2917         * stress/op_mod-VarVar.js:
2918
2919 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2920
2921         [JSC] Fix Array allocation in Object.keys
2922         https://bugs.webkit.org/show_bug.cgi?id=176826
2923
2924         Reviewed by Saam Barati.
2925
2926         * stress/object-own-property-keys.js: Added.
2927         (shouldBe):
2928
2929 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2930
2931         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2932         https://bugs.webkit.org/show_bug.cgi?id=176010
2933
2934         Reviewed by Filip Pizlo.
2935
2936         * microbenchmarks/weak-map-key.js: Added.
2937         (assert):
2938         (objectKey):
2939         (let.start.Date.now):
2940
2941 2017-09-12  Mark Lam  <mark.lam@apple.com>
2942
2943         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2944         https://bugs.webkit.org/show_bug.cgi?id=176630
2945
2946         Reviewed by JF Bastien.
2947
2948         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2949         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2950         a speculative fix for the bots that are seeing these fail.
2951
2952         I also undid the skipping of the op_mod tests for debug builds.
2953
2954         * stress/op_div-ConstVar.js:
2955         * stress/op_div-VarConst.js:
2956         * stress/op_div-VarVar.js:
2957         * stress/op_mod-ConstVar.js:
2958         * stress/op_mod-VarConst.js:
2959         * stress/op_mod-VarVar.js:
2960
2961 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2962
2963         Skip stress/value-to-boolean.js on Debug bots.
2964         https://bugs.webkit.org/show_bug.cgi?id=176787
2965
2966         Unreviewed test gardening.
2967
2968         * stress/value-to-boolean.js:
2969
2970 2017-09-11  Mark Lam  <mark.lam@apple.com>
2971
2972         Change test expectation for test262/test/language/statements/try/tco-catch.js
2973         https://bugs.webkit.org/show_bug.cgi?id=176749
2974
2975         Rubber stamped by Keith Miller.
2976
2977         It's been failing since at least r221821.  I'm changing the test expectation to
2978         fail to green the bots while I investigate some more.
2979
2980         * test262.yaml:
2981
2982 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2983
2984         Unreviewed, rolling out r221854.
2985
2986         The test added with this change fails on 32-bit JSC bots.
2987
2988         Reverted changeset:
2989
2990         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2991         https://bugs.webkit.org/show_bug.cgi?id=176010
2992         http://trac.webkit.org/changeset/221854
2993
2994 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2995
2996         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2997         https://bugs.webkit.org/show_bug.cgi?id=176010
2998
2999         Reviewed by Filip Pizlo.
3000
3001         * microbenchmarks/weak-map-key.js: Added.
3002         (assert):
3003         (objectKey):
3004         (let.start.Date.now):
3005
3006 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
3007
3008         [JSC] Optimize Object.keys by using careful array allocation
3009         https://bugs.webkit.org/show_bug.cgi?id=176654
3010
3011         Reviewed by Darin Adler.
3012
3013         * microbenchmarks/object-keys.js: Added.
3014         (test):
3015
3016 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
3017
3018         Error should compute .stack and friends lazily
3019         https://bugs.webkit.org/show_bug.cgi?id=176645
3020
3021         Reviewed by Saam Barati.
3022
3023         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
3024         * microbenchmarks/new-error.js: Added.
3025         * microbenchmarks/throw.js: Added.
3026
3027 2017-09-09  Mark Lam  <mark.lam@apple.com>
3028
3029         [Re-landing] Use JIT probes for DFG OSR exit.
3030         https://bugs.webkit.org/show_bug.cgi?id=175144
3031         <rdar://problem/33437050>
3032
3033         Not reviewed.  Original patch reviewed by Saam Barati.
3034
3035         Disable these tests for debug builds because they run too slow with the new OSR exit.
3036
3037         * stress/op_mod-ConstVar.js:
3038         * stress/op_mod-VarConst.js:
3039         * stress/op_mod-VarVar.js:
3040
3041 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3042
3043         [DFG] NewArrayWithSize(size)'s size does not care negative zero
3044         https://bugs.webkit.org/show_bug.cgi?id=176300
3045
3046         Reviewed by Saam Barati.
3047
3048         * stress/new-array-with-size-div.js: Added.
3049         (shouldBe):
3050         (test):
3051         (i.i):
3052
3053 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3054
3055         [DFG] PutByVal with Array::Generic is too generic
3056         https://bugs.webkit.org/show_bug.cgi?id=176345
3057
3058         Reviewed by Filip Pizlo.
3059
3060         * stress/object-assign-symbols.js: Added.
3061         (shouldBe):
3062         (test):
3063         * stress/object-assign.js: Added.
3064         (shouldBe):
3065         (test):
3066         (i.shouldBe.JSON.stringify.test):
3067
3068 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3069
3070         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
3071         https://bugs.webkit.org/show_bug.cgi?id=176590
3072
3073         Reviewed by Saam Barati.
3074
3075         * microbenchmarks/object-iterate-symbols.js: Added.
3076         (test):
3077         * microbenchmarks/object-iterate.js: Added.
3078         (test):
3079         * stress/object-iterate-symbols.js: Added.
3080         (shouldBe):
3081         (test):
3082         * stress/object-iterate.js: Added.
3083         (shouldBe):
3084         (test):
3085
3086 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
3087
3088         [Win32] 10 JSC stress tests are failing.
3089         https://bugs.webkit.org/show_bug.cgi?id=176538
3090
3091         Reviewed by Mark Lam.
3092
3093         Skip tests on Windows to make the bots green.
3094
3095         * ChakraCore.yaml:
3096         * stress/date-relaxed.js:
3097
3098 2017-09-06  Mark Lam  <mark.lam@apple.com>
3099
3100         constructGenericTypedArrayViewWithArguments() is missing an exception check.
3101         https://bugs.webkit.org/show_bug.cgi?id=176485
3102         <rdar://problem/33898874>
3103
3104         Reviewed by Keith Miller.
3105
3106         * stress/regress-176485.js: Added.
3107
3108 2017-09-05  Saam Barati  <sbarati@apple.com>
3109
3110         isNotCellSpeculation is wrong with respect to SpecEmpty
3111         https://bugs.webkit.org/show_bug.cgi?id=176429
3112
3113         Reviewed by Michael Saboff.
3114
3115         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
3116         (Foo):
3117
3118 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
3119
3120         test262: Completion values for control flow do not match the spec
3121         https://bugs.webkit.org/show_bug.cgi?id=171265
3122
3123         Reviewed by Saam Barati.
3124
3125         * stress/completion-value.js:
3126         Condensed test for completion values in top level statements.
3127
3128         * stress/super-get-by-id.js:
3129         ClassDeclaration when evaled no longer produce values. Convert
3130         these to ClassExpressions so they produce the class value.
3131         
3132         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3133         This is a progression for currect spec behavior.
3134
3135         * mozilla/mozilla-tests.yaml:
3136         This test is now outdated, so mark it as failing for that reason.
3137
3138         * test262.yaml:
3139         Passing all "cptn" completion value tests.
3140
3141 2017-09-04  Saam Barati  <sbarati@apple.com>
3142
3143         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
3144         https://bugs.webkit.org/show_bug.cgi?id=176317
3145
3146         Reviewed by Keith Miller.
3147
3148         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
3149         (Foo):
3150
3151 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3152
3153         [DFG][FTL] Efficiently execute number#toString()
3154         https://bugs.webkit.org/show_bug.cgi?id=170007
3155
3156         Reviewed by Keith Miller.
3157
3158         * microbenchmarks/number-to-string-strength-reduction.js: Added.
3159         (test):
3160         * microbenchmarks/number-to-string-with-radix-10.js: Added.
3161         (test):
3162         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
3163         (test):
3164         * microbenchmarks/number-to-string-with-radix.js: Added.
3165         (test):
3166         * stress/number-to-string-strength-reduction.js: Added.
3167         (shouldBe):
3168         (test):
3169         * stress/number-to-string-with-radix-10.js: Added.
3170         (shouldBe):
3171         (test):
3172         * stress/number-to-string-with-radix-cse.js: Added.
3173         (shouldBe):
3174         (test):
3175         * stress/number-to-string-with-radix-invalid.js: Added.
3176         (shouldThrow):
3177         * stress/number-to-string-with-radix-watchpoint.js: Added.
3178         (shouldBe):
3179         (test):
3180         (i.i.1e3.Number.prototype.toString):
3181         * stress/number-to-string-with-radix.js: Added.
3182         (shouldBe):
3183         (test):
3184
3185 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3186
3187         [DFG] Relax arity requirement
3188         https://bugs.webkit.org/show_bug.cgi?id=175523
3189
3190         Reviewed by Saam Barati.
3191
3192         * stress/arity-mismatch-arguments-length.js: Added.
3193         (shouldBe):
3194         (test1):
3195         (test):
3196         * stress/arity-mismatch-get-argument.js: Added.
3197         (shouldBe):
3198         (builtin.createBuiltin):
3199         (test):
3200         * stress/arity-mismatch-inlining-extra-slots.js: Added.
3201         (shouldBe):
3202         (inlineTarget):
3203         (test):
3204         * stress/arity-mismatch-inlining.js: Added.
3205         (shouldBe):
3206         (inlineTarget):
3207         (test):
3208         * stress/arity-mismatch-rest.js: Added.
3209         (shouldBe):
3210         (test2):
3211         (test1):
3212         (test):
3213
3214 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3215
3216         [JSC] Fix "name" and "length" of Proxy revoke function
3217         https://bugs.webkit.org/show_bug.cgi?id=176155
3218
3219         Reviewed by Mark Lam.
3220
3221         * test262.yaml:
3222
3223 2017-08-31  Saam Barati  <sbarati@apple.com>
3224
3225         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
3226         https://bugs.webkit.org/show_bug.cgi?id=176206
3227
3228         Reviewed by Keith Miller.
3229
3230         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
3231         (a):
3232         (b):
3233         (foo):
3234
3235 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
3236
3237         Skip two slow JSC tests after r221422.
3238
3239         Unreviewed test gardening.
3240
3241         * stress/regexp-prototype-match-on-too-long-rope.js:
3242         * stress/regexp-prototype-test-on-too-long-rope.js:
3243
3244 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
3245
3246         Unreviewed, skipping slow tests.
3247         
3248         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
3249         work differently now.
3250
3251         * stress/regexp-prototype-exec-on-too-long-rope.js:
3252         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
3253
3254 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3255
3256         [JSC] Use reifying system for "name" property of builtin JSFunction
3257         https://bugs.webkit.org/show_bug.cgi?id=175260
3258
3259         Reviewed by Saam Barati.
3260
3261         * stress/accessors-get-set-prefix.js:
3262         * stress/builtin-function-name.js: Added.
3263         (shouldBe):
3264         (shouldThrow):
3265         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3266         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3267         * stress/private-name-as-anonymous-builtin.js: Added.
3268         (shouldBe):
3269         (NotPromise):
3270
3271 2017-08-30  Saam Barati  <sbarati@apple.com>
3272
3273         Unreviewed. Make test stop printing.
3274
3275         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
3276
3277 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
3278
3279         Unreviewed, rolling out r221327.
3280
3281         This change caused test262 failures.
3282
3283         Reverted changeset:
3284
3285         "[JSC] Use reifying system for "name" property of builtin
3286         JSFunction"
3287         https://bugs.webkit.org/show_bug.cgi?id=175260
3288         http://trac.webkit.org/changeset/221327
3289
3290 2017-08-30  Saam Barati  <sbarati@apple.com>
3291
3292         semicolon is being interpreted as an = in the LiteralParser
3293         https://bugs.webkit.org/show_bug.cgi?id=176114
3294
3295         Reviewed by Oliver Hunt.
3296
3297         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
3298         * stress/resources/literal-parser-test-case.js: Added.
3299
3300 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3301
3302         [ESNext] Async iteration - Implement async iteration statement: for-await-of
3303         https://bugs.webkit.org/show_bug.cgi?id=166698
3304
3305         Reviewed by Yusuke Suzuki.
3306
3307         * stress/async-iteration-for-await-of-syntax.js: Added.
3308         (assert):
3309         (checkSyntax):
3310         (checkSyntaxError):
3311         (checkSimpleAsyncGeneratorSloppyMode):
3312         (checkSimpleAsyncGeneratorStrictMode):
3313         (checkNestedAsyncGenerators):
3314         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3315         * stress/async-iteration-for-await-of.js: Added.
3316         (assert):
3317         (async.foo):
3318         (async.boo):
3319         (const.boo.async):
3320
3321 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
3322
3323         [JSC] Use reifying system for "name" property of builtin JSFunction
3324         https://bugs.webkit.org/show_bug.cgi?id=175260
3325
3326         Reviewed by Saam Barati.
3327
3328         * stress/accessors-get-set-prefix.js:
3329         * stress/builtin-function-name.js: Added.
3330         (shouldBe):
3331         (shouldThrow):
3332         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3333         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3334
3335 2017-08-25  Saam Barati  <sbarati@apple.com>
3336
3337         Support compiling catch in the DFG
3338         https://bugs.webkit.org/show_bug.cgi?id=174590
3339         <rdar://problem/34047845>
3340
3341         Reviewed by Filip Pizlo.
3342
3343         * microbenchmarks/delta-blue-try-catch.js: Added.
3344         (exception):
3345         (value):
3346         (OrderedCollection):
3347         (OrderedCollection.prototype.add):
3348         (OrderedCollection.prototype.at):
3349         (OrderedCollection.prototype.size):
3350         (OrderedCollection.prototype.removeFirst):
3351         (OrderedCollection.prototype.remove):
3352         (Strength):
3353         (Strength.stronger):
3354         (Strength.weaker):
3355         (Strength.weakestOf):
3356         (Strength.strongest):
3357         (Strength.prototype.nextWeaker):
3358         (Constraint):
3359         (Constraint.prototype.addConstraint):
3360         (Constraint.prototype.satisfy):
3361         (Constraint.prototype.destroyConstraint):
3362         (Constraint.prototype.isInput):
3363         (UnaryConstraint):
3364         (UnaryConstraint.prototype.addToGraph):
3365         (UnaryConstraint.prototype.chooseMethod):
3366         (UnaryConstraint.prototype.isSatisfied):
3367         (UnaryConstraint.prototype.markInputs):
3368         (UnaryConstraint.prototype.output):
3369         (UnaryConstraint.prototype.recalculate):
3370         (UnaryConstraint.prototype.markUnsatisfied):
3371         (UnaryConstraint.prototype.inputsKnown):
3372         (UnaryConstraint.prototype.removeFromGraph):
3373         (StayConstraint):
3374         (StayConstraint.prototype.execute):
3375         (EditConstraint.prototype.isInput):
3376         (EditConstraint.prototype.execute):
3377         (BinaryConstraint):
3378         (BinaryConstraint.prototype.chooseMethod):
3379         (BinaryConstraint.prototype.addToGraph):
3380         (BinaryConstraint.prototype.isSatisfied):
3381         (BinaryConstraint.prototype.markInputs):
3382         (BinaryConstraint.prototype.input):
3383         (BinaryConstraint.prototype.output):
3384         (BinaryConstraint.prototype.recalculate):
3385         (BinaryConstraint.prototype.markUnsatisfied):
3386         (BinaryConstraint.prototype.inputsKnown):
3387         (BinaryConstraint.prototype.removeFromGraph):
3388         (ScaleConstraint):
3389         (ScaleConstraint.prototype.addToGraph):
3390         (ScaleConstraint.prototype.removeFromGraph):
3391         (ScaleConstraint.prototype.markInputs):
3392         (ScaleConstraint.prototype.execute):
3393         (ScaleConstraint.prototype.recalculate):
3394         (EqualityConstraint):
3395         (EqualityConstraint.prototype.execute):
3396         (Variable):
3397         (Variable.prototype.addConstraint):
3398         (Variable.prototype.removeConstraint):
3399         (Planner):
3400         (Planner.prototype.incrementalAdd):
3401         (Planner.prototype.incrementalRemove):
3402         (Planner.prototype.newMark):
3403         (Planner.prototype.makePlan):
3404         (Planner.prototype.extractPlanFromConstraints):
3405         (Planner.prototype.addPropagate):
3406         (Planner.prototype.removePropagateFrom):
3407         (Planner.prototype.addConstraintsConsumingTo):
3408         (Plan):
3409         (Plan.prototype.addConstraint):
3410         (Plan.prototype.size):
3411         (Plan.prototype.constraintAt):
3412         (Plan.prototype.execute):
3413         (chainTest):
3414         (projectionTest):
3415         (change):
3416         (deltaBlue):
3417         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3418         (assert):
3419         (Numbers):
3420         (Numbers.prototype.next):
3421         (return.Transpose):
3422         (return.Transpose.prototype.next):
3423         (transpose):
3424         (verifyEven):
3425         (verifyString):
3426         (foo):
3427         (runIterators):
3428         * microbenchmarks/try-catch-word-count.js: Added.
3429         (let.assert):
3430         (EOF):
3431         (let.texts):
3432         (let.o.apply):
3433         (foo):
3434         (bar):
3435         (f):
3436         (run):
3437         (test1):
3438         (test2):
3439         (test3):
3440         (fn):
3441         (A):
3442         (B):
3443         (A.prototype.getValue):
3444         (B.prototype.getParentValue):
3445         (strlen):
3446         (sum.0):
3447         (test):
3448         (result.test.o):
3449         (set add.set add):
3450         (set forEach):
3451         (stringHash):
3452         (set if):
3453         (testFunction):
3454         (set delete.set has.set add):
3455         * stress/catch-set-argument-speculation-failure.js: Added.
3456         (o):
3457         (e):
3458         (e2):
3459         (escape):
3460         (baz):
3461         (noInline.run):
3462         (noInline):
3463         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3464         (foo):
3465         (e):
3466         (baz):
3467         (bar):
3468
3469 2017-08-24  Commit Queue  <commit-queue@webkit.org>
3470
3471         Unreviewed, rolling out r221119, r221124, and r221143.
3472         https://bugs.webkit.org/show_bug.cgi?id=175973
3473
3474         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3475         on #webkit).
3476
3477         Reverted changesets:
3478
3479         "Support compiling catch in the DFG"
3480         https://bugs.webkit.org/show_bug.cgi?id=174590
3481         http://trac.webkit.org/changeset/221119
3482
3483         "Unreviewed, build fix in GTK port"
3484         https://bugs.webkit.org/show_bug.cgi?id=174590
3485         http://trac.webkit.org/changeset/221124
3486
3487         "DFG::JITCode::osrEntry should get sorted since we perform a
3488         binary search on it"
3489         https://bugs.webkit.org/show_bug.cgi?id=175893
3490         http://trac.webkit.org/changeset/221143
3491
3492 2017-08-24  Michael Saboff  <msaboff@apple.com>
3493
3494         Add support for RegExp "dotAll" flag
3495         https://bugs.webkit.org/show_bug.cgi?id=175924
3496
3497         Reviewed by Keith Miller.
3498
3499         Updated tests for new dotAll ('s' flag) changes.
3500
3501         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3502         * stress/static-getter-in-names.js:
3503
3504 2017-08-24  Mark Lam  <mark.lam@apple.com>
3505
3506         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3507         https://bugs.webkit.org/show_bug.cgi?id=175940
3508         <rdar://problem/29003921>
3509
3510         Reviewed by Saam Barati.
3511
3512         * stress/regress-164081.js: Added.
3513         (shouldEqual):
3514         (testcase):
3515
3516 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3517
3518         Skip flaky JSC test stress/test-finally.js.
3519         https://bugs.webkit.org/show_bug.cgi?id=160283
3520
3521         Unreviewed test gardening.
3522
3523         * stress/test-finally.js:
3524
3525 2017-08-23  Saam Barati  <sbarati@apple.com>
3526
3527         Support compiling catch in the DFG
3528         https://bugs.webkit.org/show_bug.cgi?id=174590
3529
3530         Reviewed by Filip Pizlo.
3531
3532         * microbenchmarks/delta-blue-try-catch.js: Added.
3533         (exception):
3534         (value):
3535         (OrderedCollection):
3536         (OrderedCollection.prototype.add):
3537         (OrderedCollection.prototype.at):
3538         (OrderedCollection.prototype.size):
3539         (OrderedCollection.prototype.removeFirst):
3540         (OrderedCollection.prototype.remove):
3541         (Strength):
3542         (Strength.stronger):
3543         (Strength.weaker):
3544         (Strength.weakestOf):
3545         (Strength.strongest):
3546         (Strength.prototype.nextWeaker):
3547         (Constraint):
3548         (Constraint.prototype.addConstraint):
3549         (Constraint.prototype.satisfy):
3550         (Constraint.prototype.destroyConstraint):
3551         (Constraint.prototype.isInput):
3552         (UnaryConstraint):
3553         (UnaryConstraint.prototype.addToGraph):
3554         (UnaryConstraint.prototype.chooseMethod):
3555         (UnaryConstraint.prototype.isSatisfied):
3556         (UnaryConstraint.prototype.markInputs):
3557         (UnaryConstraint.prototype.output):
3558         (UnaryConstraint.prototype.recalculate):
3559         (UnaryConstraint.prototype.markUnsatisfied):
3560         (UnaryConstraint.prototype.inputsKnown):
3561         (UnaryConstraint.prototype.removeFromGraph):
3562         (StayConstraint):
3563         (StayConstraint.prototype.execute):
3564         (EditConstraint.prototype.isInput):
3565         (EditConstraint.prototype.execute):
3566         (BinaryConstraint):
3567         (BinaryConstraint.prototype.chooseMethod):
3568         (BinaryConstraint.prototype.addToGraph):
3569         (BinaryConstraint.prototype.isSatisfied):
3570         (BinaryConstraint.prototype.markInputs):
3571         (BinaryConstraint.prototype.input):
3572         (BinaryConstraint.prototype.output):
3573         (BinaryConstraint.prototype.recalculate):
3574         (BinaryConstraint.prototype.markUnsatisfied):
3575         (BinaryConstraint.prototype.inputsKnown):
3576         (BinaryConstraint.prototype.removeFromGraph):
3577         (ScaleConstraint):
3578         (ScaleConstraint.prototype.addToGraph):
3579         (ScaleConstraint.prototype.removeFromGraph):
3580         (ScaleConstraint.prototype.markInputs):
3581         (ScaleConstraint.prototype.execute):
3582         (ScaleConstraint.prototype.recalculate):
3583         (EqualityConstraint):
3584         (EqualityConstraint.prototype.execute):
3585         (Variable):
3586         (Variable.prototype.addConstraint):
3587         (Variable.prototype.removeConstraint):
3588         (Planner):
3589         (Planner.prototype.incrementalAdd):
3590         (Planner.prototype.incrementalRemove):
3591         (Planner.prototype.newMark):
3592         (Planner.prototype.makePlan):
3593         (Planner.prototype.extractPlanFromConstraints):
3594         (Planner.prototype.addPropagate):
3595         (Planner.prototype.removePropagateFrom):
3596         (Planner.prototype.addConstraintsConsumingTo):
3597         (Plan):
3598         (Plan.prototype.addConstraint):
3599         (Plan.prototype.size):
3600         (Plan.prototype.constraintAt):
3601         (Plan.prototype.execute):
3602         (chainTest):
3603         (projectionTest):
3604         (change):
3605         (deltaBlue):
3606         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3607         (assert):
3608         (Numbers):
3609         (Numbers.prototype.next):
3610         (return.Transpose):
3611         (return.Transpose.prototype.next):
3612         (transpose):
3613         (verifyEven):
3614         (verifyString):
3615         (foo):
3616         (runIterators):
3617         * microbenchmarks/try-catch-word-count.js: Added.
3618         (let.assert):
3619         (EOF):
3620         (let.texts):
3621         (let.o.apply):
3622         (foo):
3623         (bar):
3624         (f):
3625         (run):
3626         (test1):
3627         (test2):
3628         (test3):
3629         (fn):
3630         (A):
3631         (B):
3632         (A.prototype.getValue):
3633         (B.prototype.getParentValue):
3634         (strlen):
3635         (sum.0):
3636         (test):
3637         (result.test.o):
3638         (set add.set add):
3639         (set forEach):
3640         (stringHash):
3641         (set if):
3642         (testFunction):
3643         (set delete.set has.set add):
3644         * stress/catch-set-argument-speculation-failure.js: Added.
3645         (o):
3646         (e):
3647         (e2):
3648         (escape):
3649         (baz):
3650         (noInline.run):
3651         (noInline):
3652         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3653         (foo):
3654         (e):
3655         (baz):
3656         (bar):
3657
3658 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3659
3660         [JSC] Optimize Map iteration with intrinsic
3661         https://bugs.webkit.org/show_bug.cgi?id=174355
3662
3663         Reviewed by Saam Barati.
3664
3665         * stress/map-iterator-result-should-have-expected-shape.js: Added.
3666         (shouldBe):
3667         (throw.new.Error):
3668         * stress/set-iterator-result-should-have-expected-shape.js: Added.
3669         (shouldBe):
3670         (throw.new.Error.let.iterator.set Symbol):
3671         (throw.new.Error.set add):
3672         (let.iterator.set Symbol):
3673
3674 2017-08-23  Robin Morisset  <rmorisset@apple.com>
3675
3676         Add a micro-benchmark for checking that accessing a variable within a 'with'
3677         block does not automatically prevent type prediction.
3678         https://bugs.webkit.org/show_bug.cgi?id=175738
3679
3680         Reviewed by Saam Barati.
3681
3682         * stress/with_and_arith.js: Added.
3683         (with):
3684
3685 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
3686
3687         [ESNext] Async iteration - Implement Async Generator - runtime
3688         https://bugs.webkit.org/show_bug.cgi?id=175240
3689
3690         Reviewed by Yusuke Suzuki.
3691
3692         * stress/async-iteration-async-from-sync.js: Added.
3693         (assert):
3694         (const.Logger):
3695         (this.fullfilled):
3696         (this.fullfilledDone):
3697         (this.rejected):
3698         (this.catched):
3699         (this.isFinal):
3700         (_assertLogger):
3701         (const.assertLogger):
3702         (const.getPromise.promiseHolder.return.new.Promise):
3703         (foo):
3704         (async.boo):
3705         (bar):
3706         (async.baz):
3707         (async.goo):
3708         * stress/async-iteration-basic.js: Added.
3709         (assert):
3710         (const.Logger):
3711         (this.fullfilled):
3712         (this.fullfilledDone):
3713         (this.rejected):
3714         (this.catched):
3715         (this.isFinal):
3716         (_assertLogger):
3717         (const.assertLogger):
3718         (const.getPromise.promiseHolder.return.new.Promise):
3719         (async.generator):
3720         (iterator.next.then):
3721         (async.baz):
3722         (async.boo):
3723         (async.foo):
3724         (async.goo):
3725         (A.prototype.async.foo):
3726         (A.prototype.async.boo):
3727         (A):
3728         (asyncGenExp.async):
3729         (async.joo):
3730         (j.next.then):
3731         (then):
3732         (async.koo):
3733         (async.loo):
3734         (async.moo):
3735         (async.noo):
3736         (async.ooo):
3737         (async.roo):
3738         (async.poo):
3739         (async.soo):
3740         (async.too):
3741         * stress/async-iteration-evaluation.js: Added.
3742         (assert):
3743         (async.foo):
3744         (catch):
3745         * stress/async-iteration-syntax.js:
3746         * stress/async-iteration-yield-promise.js: Added.
3747         (assert):
3748         (const.Logger):
3749         (this.fullfilled):
3750         (this.fullfilledDone):
3751         (this.rejected):
3752         (this.catched):
3753         (this.isFinal):
3754         (_assertLogger):
3755         (const.assertLogger):
3756         (const.getPromise.promiseHolder.return.new.Promise):
3757         (async.foo):
3758         (async.boo):
3759         (async.bar):
3760         * stress/async-iteration-yield-star-interface.js: Added.
3761         (assert):
3762         (const.getPromise.promiseHolder.return.new.Promise):
3763         (const.Logger):
3764         (this.fullfilled):
3765         (this.fullfilledDone):
3766         (this.rejected):
3767         (this.catched):
3768         (this.custom):
3769         (this.isFinal):
3770         (_assertLogger):
3771         (const.assertLogger):
3772         (let.asyncIter.Symbol.asyncIterator):
3773         (let.asyncIter.next):
3774         (let.asyncIter.throw):
3775         (let.asyncIter.return):
3776         (async.foo):
3777         (asyncIter.Symbol.asyncIterator):
3778         (asyncIter.next):
3779         (async.boo):
3780         (asyncIter.return):
3781         (async.bar):
3782         (async.baz):
3783         (async.foobar):
3784         * stress/async-iteration-yield-star.js: Added.
3785         (assert):
3786         (const.Logger):
3787         (this.fullfilled):
3788         (this.fullfilledDone):
3789         (this.rejected):
3790         (this.catched):
3791         (this.custom):
3792         (this.isFinal):
3793         (_assertLogger):
3794         (const.assertLogger):
3795         (const.getPromise.promiseHolder.return.new.Promise):
3796         (async.foo):
3797         (async.boo):
3798         (async.bar):
3799         (async.baz):
3800         (async.joo):
3801         (async.goo):
3802         (async.koo):
3803         (async.loo):
3804         (let.asyncIter.Symbol.asyncIterator):
3805         (let.asyncIter.next):
3806         (let.asyncIter.throw):
3807         (let.asyncIter.return):
3808         (async.moo):
3809         (async.noo):
3810         * test262.yaml:
3811
3812 2017-08-23  JF Bastien  <jfbastien@apple.com>
3813
3814         Fix printing in test
3815
3816         Unreviewed: fixing verbosity, shouldn't have been there.
3817
3818         * wasm/regress/175693.js:
3819         (else.else):
3820         (catch):
3821
3822 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
3823
3824         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
3825         https://bugs.webkit.org/show_bug.cgi?id=172543
3826
3827         Unreviewed test gardening.
3828
3829         * microbenchmarks/generator-with-several-types.js:
3830
3831 2017-08-17  JF Bastien  <jfbastien@apple.com>
3832
3833         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
3834         https://bugs.webkit.org/show_bug.cgi?id=175693
3835         <rdar://problem/33952443>
3836
3837         Reviewed by Saam Barati.
3838
3839         Add a regression directory for WebAssembly tests.
3840
3841         * wasm.yaml:
3842         * wasm/regress/175693.js: Added.
3843         (else.else):
3844         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
3845         (catch):
3846         * wasm/regress/175693.wasm: Added.
3847
3848 2017-08-15  Robin Morisset  <rmorisset@apple.com>
3849
3850         Support the 'with' keyword in FTL.
3851         https://bugs.webkit.org/show_bug.cgi?id=175585
3852
3853         Reviewed by Saam Barati.
3854
3855         Also improve the JSTest/stress/with.js file to test
3856         what happens when non-objects are passed to with.
3857
3858         * stress/with.js:
3859         (foo):
3860         (i.catch):
3861         (i.with): Deleted.
3862
3863 2017-08-14  Keith Miller  <keith_miller@apple.com>
3864
3865         Add testing tool to lie to the DFG about profiles
3866         https://bugs.webkit.org/show_bug.cgi?id=175487
3867
3868         Reviewed by Saam Barati.
3869
3870         * stress/compare-eq-incomplete-profile.js: Added.
3871         (const.test.createBuiltin):
3872
3873 2017-08-14  Robin Morisset  <rmorisset@apple.com>
3874
3875         Support the with keyword in DFG
3876         https://bugs.webkit.org/show_bug.cgi?id=175470
3877
3878         Reviewed by Saam Barati.
3879
3880         Added a new stress-test for the 'with' keyword, that caught a bug in a
3881         previous version of this code.
3882
3883         * stress/with.js: Added.
3884         (i.with):
3885
3886 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
3887
3888         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
3889         https://bugs.webkit.org/show_bug.cgi?id=175544
3890
3891         Unreviewed test gardening.
3892
3893         * ChakraCore.yaml:
3894
3895 2017-08-09  Caitlin Potter  <caitp@igalia.com>
3896
3897         Early error on ANY operator before new.target
3898         https://bugs.webkit.org/show_bug.cgi?id=157970
3899
3900         Reviewed by Saam Barati.
3901
3902         Instead of throwing if any unary operator precedes new.target, only
3903         throw if the unary operator updates the reference.
3904
3905         The following become legal in JSC:
3906
3907         ```
3908         !new.target
3909         ~new.target
3910         typeof new.target
3911         delete new.target
3912         void new.target
3913         ```
3914
3915         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
3916
3917         * stress/new-target-syntax-errors.js:
3918         * stress/new-target.js:
3919
3920 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
3921
3922         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
3923         https://bugs.webkit.org/show_bug.cgi?id=175255
3924
3925         Unreviewed test gardening.
3926
3927         * stress/regress-169783.js:
3928         * wasm/stress/oom.js:
3929
3930 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
3931
3932         REGRESSION: 2 test262/test/language/statements/async-function failures
3933         https://bugs.webkit.org/show_bug.cgi?id=175334
3934
3935         Reviewed by Yusuke Suzuki.
3936
3937         Add @skip parameters to tests, and remove test for async iterator from 
3938         async await syntax test because it is already covered by async-iterator-syntax.js
3939
3940         * stress/async-await-syntax.js:
3941         * stress/async-iteration-syntax.js:
3942
3943 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3944
3945         Unreviewed, gardening test262 for Promise resolve / reject function length
3946         https://bugs.webkit.org/show_bug.cgi?id=175333
3947
3948         * test262.yaml:
3949
3950 2017-08-07  Robin Morisset  <rmorisset@apple.com>
3951
3952         GetOwnProperty of TypedArray indexed fields is wrongly configurable
3953         https://bugs.webkit.org/show_bug.cgi?id=175307
3954
3955         Reviewed by Saam Barati.
3956
3957         * stress/typedarray-getownproperty-not-configurable.js: Added.
3958         (assert):
3959         (foo):
3960
3961 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
3962
3963         Promise resolve and reject function should have length = 1
3964         https://bugs.webkit.org/show_bug.cgi?id=175242
3965
3966         Reviewed by Saam Barati.
3967
3968         * stress/builtin-function-length.js: Added.
3969         (shouldBe):
3970         (shouldThrow):
3971         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3972         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3973
3974 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
3975
3976         [ESNext] Async iteration - Implement Async Generator - parser
3977         https://bugs.webkit.org/show_bug.cgi?id=175210
3978
3979         Reviewed by Yusuke Suzuki.
3980
3981         * stress/async-await-syntax.js:
3982         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
3983         * stress/async-iteration-syntax.js: Added.
3984         (assert):
3985         (checkSyntax):
3986         (checkSyntaxError):
3987         (checkSimpleAsyncGeneratorSloppyMode):
3988         (checkSimpleAsyncGeneratorStrictMode):
3989         (checkNestedAsyncGenerators):
3990         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3991         * stress/generator-class-methods-syntax.js:
3992
3993 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3994
3995         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
3996         https://bugs.webkit.org/show_bug.cgi?id=175150
3997
3998         Unreviewed test gardening.
3999
4000         * wasm/js-api/test_memory_constructor.js:
4001
4002 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
4003
4004         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
4005         https://bugs.webkit.org/show_bug.cgi?id=175100
4006
4007         Reviewed by Mark Lam.
4008
4009         The JSC test JSTests/wasm/stress/oom.js tries to use all the
4010         available memory until an out of memory exception happens.
4011
4012         The Linux kernel is more tuned for server workloads than for GUI
4013         responsiveness. When a process tries to use a lot of memory, Linux
4014         will do its best to serve the request. This usually translates to
4015         free physical RAM by writing to disk dirty pages and/or moving out
4016         less recently used pages to swap (disk storage).
4017         Meanwhile it does this, the system will become unresponsive and this
4018         leads to freezes that can last even some minutes on the worst cases.
4019
4020         Therefore, let's skip this test on Linux as it will cause more harm
4021         than good on the Linux bots or on the machines of Linux developers.
4022
4023         * wasm/stress/oom.js:
4024
4025 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
4026
4027         [JSC] Remove unnecessary print from stress\promise-finally.js test
4028         https://bugs.webkit.org/show_bug.cgi?id=175015
4029
4030         Reviewed by Yusuke Suzuki.
4031
4032         * stress/promise-finally.js:
4033         (p.finally):
4034         (then):
4035
4036 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
4037
4038         Unreviewed, update test262 results for optional catch binding
4039
4040         * test262.yaml:
4041
4042 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
4043
4044         [JSC] Support optional catch binding
4045         https://bugs.webkit.org/show_bug.cgi?id=174981
4046
4047         Reviewed by Saam Barati.
4048
4049         * stress/optional-catch-binding-syntax.js: Added.
4050         (testSyntax):
4051         (testSyntaxError):
4052         (catch.catch):
4053         * stress/optional-catch-binding.js: Added.
4054         (shouldBe):
4055         (throwException):
4056
4057 2017-07-28  Mark Lam  <mark.lam@apple.com>
4058
4059         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
4060         https://bugs.webkit.org/show_bug.cgi?id=174948
4061         <rdar://problem/33495680>
4062
4063         Reviewed by Filip Pizlo.
4064
4065         * stress/regress-174948.js: Added.
4066
4067 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
4068
4069         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
4070         https://bugs.webkit.org/show_bug.cgi?id=174900
4071
4072         Reviewed by Saam Barati.
4073
4074         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
4075         (sideEffect):
4076         (args):
4077         (test):
4078
4079 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
4080
4081         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
4082         https://bugs.webkit.org/show_bug.cgi?id=171637
4083
4084         Reviewed by Darin Adler.
4085
4086         * stress/domjit-getter-complex-with-incorrect-object.js:
4087         (i.shouldThrow):
4088         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
4089         (shouldBe):
4090         (i.shouldThrow):
4091
4092 2017-07-26  JF Bastien  <jfbastien@apple.com>
4093
4094         WebAssembly: test throwing out of the start function
4095         https://bugs.webkit.org/show_bug.cgi?id=165714
4096         <rdar://problem/29760251>
4097
4098         Reviewed by Keith Miller.
4099
4100         * wasm/assert.js:
4101         * wasm/function-tests/trap-from-start.js: Added.
4102         (StartTraps):
4103         * wasm/function-tests/trap-from-start-async.js: Added.
4104         (async.StartTrapsAsync):
4105
4106 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
4107
4108         [FTL] Arguments elimination is suppressed by unreachable blocks
4109         https://bugs.webkit.org/show_bug.cgi?id=174352
4110
4111         Reviewed by Filip Pizlo.
4112
4113         * stress/arguments-elimination-force-exit.js: Added.
4114         (shouldBe):
4115         (strict):
4116         (sloppy):
4117         * stress/arguments-elimination-throw.js: Added.
4118         (shouldBe):
4119         (shouldThrow):
4120         (sloppy):
4121         (isArguments):
4122
4123 2017-07-13  Mark Lam  <mark.lam@apple.com>
4124
4125         Add some additional test cases for bug 170896.
4126         https://bugs.webkit.org/show_bug.cgi?id=174491
4127
4128         Reviewed by Filip Pizlo.
4129
4130         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
4131         * stress/regress-170896-with-double-shape-profile.js: Added.
4132         (test):
4133         * stress/regress-170896-with-int32-shape-profile.js: Added.
4134         (test):
4135         * stress/regress-170896.js: Removed.
4136
4137 2017-07-13  Saam Barati  <sbarati@apple.com>
4138
4139         Missing exception check in JSObject::hasInstance
4140         https://bugs.webkit.org/show_bug.cgi?id=174455
4141         <rdar://problem/31384608>
4142
4143         Reviewed by Mark Lam.
4144
4145         * stress/has-instance-exception-check.js: Added.
4146         (assert):
4147         (let.getter.Object.getOwnPropertyDescriptor.get foo):
4148
4149 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
4150
4151         [ESnext] Implement Object Spread
4152         https://bugs.webkit.org/show_bug.cgi?id=167963
4153
4154         Reviewed by Saam Barati.
4155
4156         * stress/obj-rest-destructuring-order.js: Added.
4157         (assert):
4158         (o.get z):
4159         (o.get a):
4160         * stress/obj-spread-order.js: Added.
4161         (assert):
4162         (o.get z):
4163         (o.get a):
4164         * stress/object-spread.js: Added.
4165         (let.assert):
4166         (assert.sameValue):
4167         (let.o.get a):
4168         (let.obj.get c):
4169         (cthulhu.get x):
4170         (let.obj.set c):
4171         (calls.o.get z):
4172         (calls.o.get a):
4173         (try.let.obj.get foo):
4174         (get calls):
4175
4176 2017-07-12  Saam Barati  <sbarati@apple.com>
4177
4178         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
4179         https://bugs.webkit.org/show_bug.cgi?id=174411
4180         <rdar://problem/31696186>
4181
4182         Reviewed by Mark Lam.
4183
4184         * stress/generic-arguments-correct-delete-behavior.js: Added.
4185         (assert):
4186         (makeTest):
4187
4188 2017-07-07  Mark Lam  <mark.lam@apple.com>
4189
4190         \n\r is not the same as \r\n.
4191         https://bugs.webkit.org/show_bug.cgi?id=173053
4192
4193         Reviewed by Keith Miller.
4194
4195         * stress/regress-173053.js: Added.
4196         * stress/template-literal-line-terminators.js:
4197
4198 2017-07-06  Saam Barati  <sbarati@apple.com>
4199
4200         We are missing places where we invalidate the for-in context
4201         https://bugs.webkit.org/show_bug.cgi?id=174184
4202
4203         Reviewed by Geoffrey Garen.
4204
4205         * stress/for-in-invalidate-context-weird-assignments.js: Added.
4206         (assert):
4207         (test):
4208
4209 2017-07-05  Saam Barati  <sbarati@apple.com>
4210
4211         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
4212         https://bugs.webkit.org/show_bug.cgi?id=174188
4213         <rdar://problem/30581423>
4214
4215         Reviewed by Mark Lam.
4216
4217         * stress/new-array-having-a-bad-time-double.js: Added.
4218         (assert):
4219         (foo):
4220
4221 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
4222
4223         WTF::StringImpl::copyChars segfaults when built with GCC 7
4224         https://bugs.webkit.org/show_bug.cgi?id=173407
4225
4226         Reviewed by Andreas Kling.
4227
4228         * stress/string-repeat-copy-chars-crash.js: Added.
4229         (shouldBe):
4230
4231 2017-07-03  Saam Barati  <sbarati@apple.com>
4232
4233         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
4234
4235         * stress/unshiftCountSlowCase-correct-postCapacity.js:
4236
4237 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
4238
4239         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
4240
4241         It requires too much memory.
4242
4243         * stress/dont-reserve-huge-capacity-lexer.js:
4244
4245 2017-06-30  Michael Saboff  <msaboff@apple.com>
4246
4247         Skip a test on ARM64 platform since we run out of address space.
4248
4249         Rubber stamped by Saam Barati.
4250
4251         * stress/dont-reserve-huge-capacity-lexer.js:
4252
4253 2017-06-30  Michael Saboff  <msaboff@apple.com>
4254
4255         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
4256         https://bugs.webkit.org/show_bug.cgi?id=174044
4257
4258         Reviewed by Oliver Hunt.
4259
4260         New regression test.
4261
4262         * stress/regress-174044.js: Added.
4263         (test1):
4264         (test2):
4265
4266 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
4267
4268         RegExpCachedResult::setInput should reify left and right contexts
4269         https://bugs.webkit.org/show_bug.cgi?id=173818
4270
4271         Reviewed by Keith Miller.
4272
4273         * stress/right-left-context-invalidated-by-input.js: Added.
4274         (test.validateContexts):
4275         (test):
4276
4277 2017-06-29  Saam Barati  <sbarati@apple.com>
4278
4279         Calculating postCapacity in unshiftCountSlowCase is wrong
4280         https://bugs.webkit.org/show_bug.cgi?id=173992
4281         <rdar://problem/32283199>
4282
4283         Reviewed by Keith Miller.
4284
4285         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
4286         (temp):
4287
4288 2017-06-29  Commit Queue  <commit-queue@webkit.org>
4289
4290         Unreviewed, rolling out r218512.
4291         https://bugs.webkit.org/show_bug.cgi?id=173981
4292
4293         "It changes the behavior of the JS API's JSEvaluateScript
4294         which breaks TurboTax" (Requested by saamyjoon on #webkit).
4295
4296         Reverted changeset:
4297
4298         "test262: Completion values for control flow do not match the
4299         spec"
4300         https://bugs.webkit.org/show_bug.cgi?id=171265
4301         http://trac.webkit.org/changeset/218512
4302
4303 2017-06-27  JF Bastien  <jfbastien@apple.com>
4304
4305         WebAssembly: running out of executable memory should throw OoM
4306         https://bugs.webkit.org/show_bug.cgi?id=171537
4307         <rdar://problem/32963338>
4308
4309         Reviewed by Saam Barati.
4310
4311         * wasm.yaml:
4312         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
4313         (const.invoke):
4314         (failCount.0.catch):
4315         (failCount.0.module.undefined.catch):
4316         * wasm/lowExecutableMemory/exports-oom.js: Added.
4317         (const.type):
4318         (const.params):
4319         (const.randomProgram):
4320         (failCount.0.catch):
4321         (failCount.0.module.undefined.catch):
4322         * wasm/lowExecutableMemory/imports-oom.js: Added.
4323         (const.type):
4324         (const.params):
4325         (const.randomProgram):
4326         (f.imports.push):
4327         (failCount.0.catch):
4328         (failCount.0.module.undefined.catch):
4329
4330 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
4331
4332         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
4333         https://bugs.webkit.org/show_bug.cgi?id=167962
4334
4335         Reviewed by Saam Barati.
4336
4337         * stress/object-rest-deconstruct.js: Added.
4338         (let.assert):
4339         (let.assertPropDescriptor):
4340         (catch):
4341         (get 3):
4342         (foo):
4343         (let.src.get y):
4344         (let.src.set y):
4345         (let.gen):
4346
4347 2017-06-27  Saam Barati  <sbarati@apple.com>
4348
4349         Function constructor needs to follow the spec and validate parameters and body independently
4350         https://bugs.webkit.org/show_bug.cgi?id=173303
4351         <rdar://problem/32732526>
4352
4353         Reviewed by Keith Miller.
4354
4355         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
4356         * stress/function-constructor-semantics.js: Added.
4357         (assert):
4358         (hasSyntaxError):
4359         (foo):
4360         (async.foo):
4361         (testError):
4362         (testOK.toString):
4363         (toString):
4364
4365 2017-06-26  Saam Barati  <sbarati@apple.com>
4366
4367         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
4368         https://bugs.webkit.org/show_bug.cgi?id=173740
4369
4370         Reviewed by Mark Lam.
4371
4372         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
4373         (Array.prototype.Symbol.iterator):
4374
4375 2017-06-26  Saam Barati  <sbarati@apple.com>
4376
4377         Skip a test on 32-bit platforms since we run out of address space.
4378
4379         Rubber stamped by Mark Lam.
4380
4381         * stress/dont-reserve-huge-capacity-lexer.js:
4382
4383 2017-06-26  Saam Barati  <sbarati@apple.com>
4384
4385         Crash in JSC::Lexer<unsigned char>::setCode
4386         https://bugs.webkit.org/show_bug.cgi?id=172754
4387
4388         Reviewed by Mark Lam.
4389
4390         * stress/dont-reserve-huge-capacity-lexer.js: Added.
4391         (catch):
4392
4393 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
4394
4395         [JSC] Clean up Object.entries implementation
4396         https://bugs.webkit.org/show_bug.cgi?id=173759
4397
4398         Reviewed by Sam Weinig.
4399
4400         * microbenchmarks/object-entries.js: Added.
4401         (test):
4402
4403 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
4404
4405         Remove Reflect.enumerate
4406         https://bugs.webkit.org/show_bug.cgi?id=173806
4407
4408         Reviewed by Yusuke Suzuki.
4409
4410         * ChakraCore.yaml:
4411         * es6.yaml:
4412         These tests now fail because they use Reflect.enumerate.
4413
4414         * test262.yaml:
4415         This test now passes, it checked that Reflect.enumerate is undefined!
4416
4417         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
4418         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
4419
4420         * stress/reflect-enumerate.js: Removed.
4421         Remove a test solely for Reflect.enumerate.
4422
4423 2017-06-22  Saam Barati  <sbarati@apple.com>
4424
4425         ValueRep(DoubleRep(@v)) can not simply convert to @v
4426         https://bugs.webkit.org/show_bug.cgi?id=173687
4427         <rdar://problem/32855563>
4428
4429         Reviewed by Mark Lam.
4430
4431         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
4432         (i.catch):
4433
4434 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
4435
4436         [JSC] Object.values should be implemented in C++
4437         https://bugs.webkit.org/show_bug.cgi?id=173703
4438
4439         Reviewed by Sam Weinig.
4440
4441         * microbenchmarks/object-keys-map-values.js: Added.
4442         (test):
4443         * microbenchmarks/object-values.js: Added.
4444         (test):
4445         * stress/object-values-changing-properties.js: Added.
4446         (shouldBe):