[FTL] Support DeleteById and DeleteByVal
[WebKit-https.git] / JSTests / ChangeLog
1 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2
3         [FTL] Support DeleteById and DeleteByVal
4         https://bugs.webkit.org/show_bug.cgi?id=180022
5
6         Reviewed by Saam Barati.
7
8         * stress/delete-by-id.js: Added.
9         (shouldBe):
10         (test1):
11         (test2):
12         * stress/delete-by-val-ftl.js: Added.
13         (shouldBe):
14         (test1):
15         (test2):
16
17 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
18
19         [DFG] Introduce {Set,Map,WeakMap}Fields
20         https://bugs.webkit.org/show_bug.cgi?id=179925
21
22         Reviewed by Saam Barati.
23
24         * stress/map-set-clobber-map-get.js: Added.
25         (shouldBe):
26         (test):
27         * stress/map-set-does-not-clobber-set-has.js: Added.
28         (shouldBe):
29         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
30         (shouldBe):
31         (test):
32         * stress/set-add-clobber-set-has.js: Added.
33         (shouldBe):
34         * stress/set-add-does-not-clobber-map-get.js: Added.
35         (shouldBe):
36
37 2017-11-24  Mark Lam  <mark.lam@apple.com>
38
39         Move unsafe jsc shell test functions to the $vm object.
40         https://bugs.webkit.org/show_bug.cgi?id=179980
41
42         Reviewed by Yusuke Suzuki.
43
44         * controlFlowProfiler/driver/driver.js:
45         * controlFlowProfiler/execution-count.js:
46         * controlFlowProfiler/if-statement.js:
47         * controlFlowProfiler/loop-statements.js:
48         * controlFlowProfiler/switch-statements.js:
49         * controlFlowProfiler/test-jit.js:
50         * exceptionFuzz/3d-cube.js:
51         * exceptionFuzz/date-format-xparb.js:
52         * exceptionFuzz/earley-boyer.js:
53         * heapProfiler/basic-edges.js:
54         * heapProfiler/property-edge-types.js:
55         * microbenchmarks/try-get-by-id-basic.js:
56         * microbenchmarks/try-get-by-id-polymorphic.js:
57         * modules/namespace-object-try-get.js:
58         * stress/argument-count-bytecode.js:
59         * stress/argument-intrinsic-basic.js:
60         * stress/argument-intrinsic-inlining-use-caller-arg.js:
61         * stress/argument-intrinsic-inlining-with-result-escape.js:
62         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
63         * stress/argument-intrinsic-inlining-with-vararg.js:
64         * stress/argument-intrinsic-nested-inlining.js:
65         * stress/argument-intrinsic-not-convert-to-get-argument.js:
66         * stress/argument-intrinsic-with-stack-write.js:
67         * stress/arity-mismatch-get-argument.js:
68         * stress/array-message-passing.js:
69         * stress/array-push-with-force-exit.js:
70         * stress/check-dom-with-signature.js:
71         * stress/check-sub-class.js:
72         * stress/compare-eq-incomplete-profile.js:
73         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
74         * stress/do-eval-virtual-call-correctly.js:
75         * stress/dom-jit-with-poly-proto.js:
76         * stress/domjit-exception-ic.js:
77         * stress/domjit-exception.js:
78         * stress/domjit-getter-complex-with-incorrect-object.js:
79         * stress/domjit-getter-complex.js:
80         * stress/domjit-getter-poly.js:
81         * stress/domjit-getter-proto.js:
82         * stress/domjit-getter-super-poly.js:
83         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
84         * stress/domjit-getter-type-check.js:
85         * stress/domjit-getter.js:
86         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
87         * stress/for-in-proxy-target-changed-structure.js:
88         * stress/for-in-proxy.js:
89         * stress/generational-opaque-roots.js:
90         * stress/global-const-redeclaration-setting-2.js:
91         * stress/global-const-redeclaration-setting-3.js:
92         * stress/global-const-redeclaration-setting-4.js:
93         * stress/global-const-redeclaration-setting-5.js:
94         * stress/global-const-redeclaration-setting.js:
95         * stress/import-basic.js:
96         * stress/import-from-eval.js:
97         * stress/import-reject-with-exception.js:
98         * stress/import-syntax.js:
99         * stress/impure-get-own-property-slot-inline-cache.js:
100         * stress/is-constructor.js:
101         * stress/istypedarrayview-intrinsic.js:
102         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
103         * stress/jsc-test-functions-should-be-more-robust.js:
104         * stress/object-toString-with-proxy.js:
105         * stress/poly-proto-custom-value-and-accessor.js:
106         * stress/proxy-inline-cache.js:
107         * stress/re-execute-error-module.js:
108         * stress/regress-150532.js:
109         * stress/regress-156992.js:
110         * stress/regress-179619.js:
111         * stress/resources/shadow-chicken-support.js:
112         * stress/runtime-array.js:
113         * stress/sampling-profiler-microtasks.js:
114         * stress/shadow-chicken-enabled.js:
115         * stress/spread-correct-global-object-on-exception.js:
116         * stress/super-get-by-id.js:
117         * stress/tailCallForwardArguments.js:
118         * stress/to-object-intrinsic-boolean-edge.js:
119         * stress/to-object-intrinsic-null-or-undefined-edge.js:
120         * stress/to-object-intrinsic-number-edge.js:
121         * stress/to-object-intrinsic-object-edge.js:
122         * stress/to-object-intrinsic-string-edge.js:
123         * stress/to-object-intrinsic-symbol-edge.js:
124         * stress/to-object-intrinsic.js:
125         * stress/try-catch-custom-getter-as-get-by-id.js:
126         * stress/try-get-by-id-poly-proto.js:
127         * stress/try-get-by-id-should-spill-registers-dfg.js:
128         * stress/try-get-by-id.js:
129         * typeProfiler/arrow-functions.js:
130         * typeProfiler/basic.js:
131         * typeProfiler/captured.js:
132         * typeProfiler/classes.js:
133         * typeProfiler/dfg-jit-optimizations.js:
134         * typeProfiler/dictionary-mode.js:
135         * typeProfiler/es6-block-scoping.js:
136         * typeProfiler/es6-classes.js:
137         * typeProfiler/inheritance.js:
138         * typeProfiler/int52-dfg.js:
139         * typeProfiler/loop.js:
140         * typeProfiler/optional-fields.js:
141         * typeProfiler/overflow.js:
142         * typeProfiler/return.js:
143         * typeProfiler/symbol.js:
144         * typeProfiler/weird-prototype-chain.js:
145
146 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
147
148         [DFG][FTL] Support MapSet / SetAdd intrinsics
149         https://bugs.webkit.org/show_bug.cgi?id=179858
150
151         Reviewed by Saam Barati.
152
153         * microbenchmarks/map-has-and-set.js: Added.
154         (test):
155         * stress/map-set-check-failure.js: Added.
156         (shouldBe):
157         (shouldThrow):
158         (target):
159         * stress/map-set-cse.js: Added.
160         (shouldBe):
161         (test):
162         * stress/set-add-check-failure.js: Added.
163         (shouldBe):
164         (shouldThrow):
165         (set shouldThrow):
166         * stress/set-add-cse.js: Added.
167         (shouldBe):
168
169 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
170
171         [JSC] Allow poly proto for intrinsic getters
172         https://bugs.webkit.org/show_bug.cgi?id=179550
173
174         Reviewed by Saam Barati.
175
176         This change is also tested by existing tests.
177
178             1. stress/intrinsic-getter-with-poly-proto.js
179             2. stress/poly-proto-intrinsic-getter-correctness.js
180
181         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
182         (shouldBe):
183         (makePolyProtoObject.foo.C):
184         (makePolyProtoObject.foo):
185         (makePolyProtoObject):
186         (target):
187         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
188         (shouldBe):
189         (makePolyProtoObject.foo.C):
190         (makePolyProtoObject.foo):
191         (makePolyProtoObject):
192         (target):
193
194 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
195
196         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
197         https://bugs.webkit.org/show_bug.cgi?id=179744
198
199         Reviewed by Michael Catanzaro.
200
201         This test uses too much memory for our buildbots on these platforms
202         and gets OOM-killed.
203
204         * stress/unshiftCountSlowCase-correct-postCapacity.js:
205         Skip if $memoryLimited and linux.
206
207 2017-11-17  JF Bastien  <jfbastien@apple.com>
208
209         WebAssembly JS API: throw when a promise can't be created
210         https://bugs.webkit.org/show_bug.cgi?id=179826
211         <rdar://problem/35455813>
212
213         Reviewed by Mark Lam.
214
215         Test WebAssembly.{compile,instantiate} where promise creation
216         fails because of a stack overflow.
217
218         * wasm/js-api/promise-stack-overflow.js: Added.
219         (const.runNearStackLimit.f.const.t):
220         (async.testCompile):
221         (async.testInstantiate):
222
223 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
224
225         Unreviewed, mark regress-178385.js as memory exhausting
226
227         * stress/regress-178385.js:
228
229 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
230
231         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
232
233         Unreviewed test gardening.
234
235         * test262.yaml:
236
237 2017-11-16  Robin Morisset  <rmorisset@apple.com>
238
239         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
240         https://bugs.webkit.org/show_bug.cgi?id=179763
241         <rdar://problem/35550513>
242
243         Reviewed by Keith Miller.
244
245         Just adding a slightly cleaned-up version of the original fuzzer-found test.
246
247         * stress/tdz-this-in-try-catch.js: Added.
248         (__v_6388):
249         (__v_6392):
250
251 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
252
253         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
254         https://bugs.webkit.org/show_bug.cgi?id=179594
255
256         Reviewed by Saam Barati.
257
258         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
259         (shouldBe):
260         (args):
261         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
262         (shouldBe):
263         (args):
264
265 2017-11-14  Saam Barati  <sbarati@apple.com>
266
267         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
268         https://bugs.webkit.org/show_bug.cgi?id=179639
269         <rdar://problem/35513018>
270
271         Reviewed by JF Bastien.
272
273         * wasm/function-tests/grow-memory-cause-gc.js: Added.
274         (escape):
275         (i.func):
276
277 2017-11-13  Mark Lam  <mark.lam@apple.com>
278
279         Add more overflow check book-keeping for MarkedArgumentBuffer.
280         https://bugs.webkit.org/show_bug.cgi?id=179634
281         <rdar://problem/35492517>
282
283         Reviewed by Saam Barati.
284
285         * stress/regress-179634.js: Added.
286
287 2017-11-13  Mark Lam  <mark.lam@apple.com>
288
289         Make the jsc shell loadGetterFromGetterSetter() function more robust.
290         https://bugs.webkit.org/show_bug.cgi?id=179619
291         <rdar://problem/35492518>
292
293         Reviewed by Saam Barati.
294
295         * stress/regress-179619.js: Added.
296
297 2017-11-12  Mark Lam  <mark.lam@apple.com>
298
299         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
300         https://bugs.webkit.org/show_bug.cgi?id=179562
301         <rdar://problem/35467022>
302
303         Reviewed by Saam Barati.
304
305         * regress-179562.js: Added.
306
307 2017-11-08  Saam Barati  <sbarati@apple.com>
308
309         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
310         https://bugs.webkit.org/show_bug.cgi?id=177792
311
312         Reviewed by Yusuke Suzuki.
313
314         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
315         (assert):
316         (foo.Foo.prototype.ensureX):
317         (foo.Foo):
318         (foo):
319         (access):
320
321 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
322
323         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
324         https://bugs.webkit.org/show_bug.cgi?id=178592
325
326         Unreviewed test gardening.
327
328         * test262.yaml:
329
330 2017-11-08  Robin Morisset  <rmorisset@apple.com>
331
332         Turn recursive tail calls into loops
333         https://bugs.webkit.org/show_bug.cgi?id=176601
334
335         Reviewed by Saam Barati.
336
337         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
338
339         Add some simple test that computes factorial in several ways, and other trivial computations.
340         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
341         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
342         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
343         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
344
345         * stress/inline-call-to-recursive-tail-call.js: Added.
346         (factorial.aux):
347         (factorial):
348         (factorial2.aux2):
349         (factorial2.id):
350         (factorial2):
351         (factorial3.aux3):
352         (factorial3):
353         (aux4):
354         (factorial4):
355         (foo):
356         (auxBar):
357         (bar):
358         (test):
359
360 2017-11-07  Mark Lam  <mark.lam@apple.com>
361
362         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
363         https://bugs.webkit.org/show_bug.cgi?id=179355
364         <rdar://problem/35263053>
365
366         Reviewed by Saam Barati.
367
368         * stress/regress-179355.js: Added.
369
370 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
371
372         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
373         https://bugs.webkit.org/show_bug.cgi?id=144458
374
375         Reviewed by Saam Barati.
376
377         * microbenchmarks/dfg-internal-function-call.js: Added.
378         (target):
379         * microbenchmarks/dfg-internal-function-construct.js: Added.
380         (target):
381         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
382         (target):
383         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
384         (target):
385         * stress/dfg-internal-function-call.js: Added.
386         (shouldBe):
387         (target):
388         * stress/dfg-internal-function-construct.js: Added.
389         (shouldBe):
390         (target):
391         * stress/internal-function-call.js: Added.
392         (shouldBe):
393         * stress/internal-function-construct.js: Added.
394         (shouldBe):
395
396 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
397
398         [Win] Skip stress/regress-178385.js.
399         https://bugs.webkit.org/show_bug.cgi?id=179298
400
401         Unreviewed test gardening.
402
403         * stress/regress-178385.js:
404
405 2017-11-03  Keith Miller  <keith_miller@apple.com>
406
407         Add test for ic with side effects
408         https://bugs.webkit.org/show_bug.cgi?id=179268
409
410         Reviewed by Saam Barati.
411
412         * stress/put-inline-cache-side-effects.js: Added.
413         (let.i.of.objs.keys):
414         (f):
415
416 2017-11-03  Mark Lam  <mark.lam@apple.com>
417
418         CachedCall (and its clients) needs overflow checks.
419         https://bugs.webkit.org/show_bug.cgi?id=179185
420
421         Reviewed by JF Bastien.
422
423         * stress/regress-179185.js: Added.
424
425 2017-11-02  Michael Saboff  <msaboff@apple.com>
426
427         DFG needs to handle code motion of code in for..in loop bodies
428         https://bugs.webkit.org/show_bug.cgi?id=179212
429
430         Reviewed by Keith Miller.
431
432         New regression test.
433
434         * stress/for-in-side-effects.js: Added.
435         (getPrototypeOf):
436         (reset):
437         (testWithoutFTL.f):
438         (testWithoutFTL):
439         (testWithFTL.f):
440         (testWithFTL):
441
442 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
443
444         AI does not correctly model the clobber case of ArithClz32
445         https://bugs.webkit.org/show_bug.cgi?id=179188
446
447         Reviewed by Michael Saboff.
448
449         * stress/arith-clz32-effects.js: Added.
450         (foo):
451         (valueOf):
452
453 2017-11-01  Michael Saboff  <msaboff@apple.com>
454
455         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
456         https://bugs.webkit.org/show_bug.cgi?id=179140
457
458         Reviewed by Saam Barati.
459
460         New regression test.
461
462         * stress/regress-179140.js: Added.
463         (testWithoutFTL):
464         (testWithFTL):
465
466 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
467
468         [JSC] Introduce @toObject
469         https://bugs.webkit.org/show_bug.cgi?id=178726
470
471         Reviewed by Saam Barati.
472
473         * stress/array-copywithin.js:
474         (shouldThrow):
475         * stress/object-constructor-boolean-edge.js: Added.
476         (shouldBe):
477         (test):
478         * stress/object-constructor-global.js: Added.
479         (shouldBe):
480         * stress/object-constructor-null-edge.js: Added.
481         (shouldBe):
482         (test):
483         * stress/object-constructor-number-edge.js: Added.
484         (shouldBe):
485         (test):
486         * stress/object-constructor-object-edge.js: Added.
487         (shouldBe):
488         (test):
489         (i.arg):
490         * stress/object-constructor-string-edge.js: Added.
491         (shouldBe):
492         (test):
493         * stress/object-constructor-symbol-edge.js: Added.
494         (shouldBe):
495         (test):
496         * stress/object-constructor-undefined-edge.js: Added.
497         (shouldBe):
498         (test):
499         * stress/symbol-array-from.js: Added.
500         (shouldBe):
501         * stress/to-object-intrinsic-boolean-edge.js: Added.
502         (shouldBe):
503         (builtin.createBuiltin):
504         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
505         (shouldThrow):
506         * stress/to-object-intrinsic-number-edge.js: Added.
507         (shouldBe):
508         (builtin.createBuiltin):
509         * stress/to-object-intrinsic-object-edge.js: Added.
510         (shouldBe):
511         (builtin.createBuiltin):
512         (i.arg):
513         * stress/to-object-intrinsic-string-edge.js: Added.
514         (shouldBe):
515         (builtin.createBuiltin):
516         * stress/to-object-intrinsic-symbol-edge.js: Added.
517         (shouldBe):
518         (builtin.createBuiltin):
519         * stress/to-object-intrinsic.js: Added.
520         (shouldBe):
521         (shouldThrow):
522         (builtin.createBuiltin):
523
524 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
525
526         [DFG][FTL] Introduce StringSlice
527         https://bugs.webkit.org/show_bug.cgi?id=178934
528
529         Reviewed by Saam Barati.
530
531         * microbenchmarks/string-slice-empty.js: Added.
532         (slice):
533         * microbenchmarks/string-slice-one-char.js: Added.
534         (slice):
535         * microbenchmarks/string-slice.js: Added.
536         (slice):
537
538 2017-10-26  Michael Saboff  <msaboff@apple.com>
539
540         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
541         https://bugs.webkit.org/show_bug.cgi?id=178890
542
543         Reviewed by Keith Miller.
544
545         New regression test.
546
547         * stress/regress-178890.js: Added.
548
549 2017-10-26  Mark Lam  <mark.lam@apple.com>
550
551         JSRopeString::RopeBuilder::append() should check for overflows.
552         https://bugs.webkit.org/show_bug.cgi?id=178385
553         <rdar://problem/35027468>
554
555         Reviewed by Saam Barati.
556
557         * stress/regress-178385.js: Added.
558
559 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
560
561         Unreviewed, rolling out r223961.
562
563         The change that required this has been rolled out.
564
565         Reverted changeset:
566
567         "Mark test262.yaml/test262/test/language/statements/try/tco-
568         catch.js as passing."
569         https://bugs.webkit.org/show_bug.cgi?id=178592
570         https://trac.webkit.org/changeset/223961
571
572 2017-10-25  Commit Queue  <commit-queue@webkit.org>
573
574         Unreviewed, rolling out r223691 and r223729.
575         https://bugs.webkit.org/show_bug.cgi?id=178834
576
577         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
578         by rniwa on #webkit).
579
580         Reverted changesets:
581
582         "Turn recursive tail calls into loops"
583         https://bugs.webkit.org/show_bug.cgi?id=176601
584         https://trac.webkit.org/changeset/223691
585
586         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
587         comparison is always false due to limited range of data type
588         [-Wtype-limits]"
589         https://bugs.webkit.org/show_bug.cgi?id=178543
590         https://trac.webkit.org/changeset/223729
591
592 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
593
594         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
595         https://bugs.webkit.org/show_bug.cgi?id=178592
596
597         Unreviewed test gardening.
598
599         * test262.yaml:
600
601 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
602
603         [FTL] Support NewStringObject
604         https://bugs.webkit.org/show_bug.cgi?id=178737
605
606         Reviewed by Saam Barati.
607
608         * stress/new-string-object.js: Added.
609         (shouldBe):
610         (test):
611
612 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
613
614         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
615         https://bugs.webkit.org/show_bug.cgi?id=178308
616
617         Reviewed by Mark Lam.
618
619         * test262.yaml:
620
621 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
622
623         [JSC] Use fastJoin in Array#toString
624         https://bugs.webkit.org/show_bug.cgi?id=178062
625
626         Reviewed by Darin Adler.
627
628         * microbenchmarks/contiguous-array-to-string.js: Added.
629         (target):
630         * microbenchmarks/double-array-to-string.js: Added.
631         (target):
632         * microbenchmarks/int32-array-to-string.js: Added.
633         (target):
634
635 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
636
637         stress/check-string-ident.js is improperly skipped
638         https://bugs.webkit.org/show_bug.cgi?id=178642
639
640         Reviewed by Saam Barati.
641
642         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
643         since it enforces the run-jsc-stress-tests script to still set up the
644         test to run, despite the skip directive that's used before.
645
646 2017-10-20  Mark Lam  <mark.lam@apple.com>
647
648         Add a test case for r214334.
649         https://bugs.webkit.org/show_bug.cgi?id=169941
650         <rdar://problem/31221258>
651
652         Reviewed by JF Bastien.
653
654         * stress/regress-169941.js: Added.
655
656 2017-10-19  JF Bastien  <jfbastien@apple.com>
657
658         WebAssembly: no VM / JS version of everything but Instance
659         https://bugs.webkit.org/show_bug.cgi?id=177473
660
661         Reviewed by Filip Pizlo, Saam Barati.
662
663         - Exceeding max on memory growth now returns a range error as per
664         spec. This is a (very minor) breaking change: it used to throw OOM
665         error. Update the corresponding test.
666
667         * wasm/js-api/memory-grow.js:
668         (assertEq):
669         * wasm/js-api/table.js:
670         (assert.throws):
671
672 2017-10-19  Mark Lam  <mark.lam@apple.com>
673
674         Stringifier::appendStringifiedValue() is missing an exception check.
675         https://bugs.webkit.org/show_bug.cgi?id=178386
676         <rdar://problem/35027610>
677
678         Reviewed by Saam Barati.
679
680         * stress/regress-178386.js: Added.
681
682 2017-10-19  Michael Saboff  <msaboff@apple.com>
683
684         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
685         https://bugs.webkit.org/show_bug.cgi?id=178521
686
687         Reviewed by JF Bastien.
688
689         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
690         now passes with the current version (5.0) of the Emoji spec.
691
692 2017-10-19  Robin Morisset  <rmorisset@apple.com>
693
694         Turn recursive tail calls into loops
695         https://bugs.webkit.org/show_bug.cgi?id=176601
696
697         Reviewed by Saam Barati.
698
699         Add some simple test that computes factorial in several ways, and other trivial computations.
700         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
701         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
702         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
703         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
704
705         * stress/inline-call-to-recursive-tail-call.js: Added.
706         (factorial.aux):
707         (factorial):
708         (factorial2.aux):
709         (factorial2.id):
710         (factorial2):
711         (factorial3.aux):
712         (factorial3):
713         (aux):
714         (factorial4):
715         (test):
716
717 2017-10-18  Mark Lam  <mark.lam@apple.com>
718
719         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
720         https://bugs.webkit.org/show_bug.cgi?id=177600
721         <rdar://problem/34710985>
722
723         Reviewed by Saam Barati.
724
725         * stress/regress-177600.js: Added.
726
727 2017-10-18  Mark Lam  <mark.lam@apple.com>
728
729         The compiler should always register a structure when it adds its transitionWatchPointSet.
730         https://bugs.webkit.org/show_bug.cgi?id=178420
731         <rdar://problem/34814024>
732
733         Reviewed by Saam Barati and Filip Pizlo.
734
735         * stress/regress-178420.js: Added.
736         (new.Array.10000.map):
737
738 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
739
740         [JSC] __proto__ getter should be fast
741         https://bugs.webkit.org/show_bug.cgi?id=178067
742
743         Reviewed by Saam Barati.
744
745         * stress/dfg-object-proto-accessor.js: Added.
746         (shouldBe):
747         (shouldThrow):
748         (target):
749         * stress/dfg-object-proto-getter.js: Added.
750         (shouldBe):
751         (shouldThrow):
752         (target):
753         * stress/dfg-object-prototype-of.js: Added.
754         (shouldBe):
755         (shouldThrow):
756         (target):
757         * stress/dfg-reflect-get-prototype-of.js: Added.
758         (shouldBe):
759         (shouldThrow):
760         (target):
761         * stress/intrinsic-getter-with-poly-proto.js: Added.
762         (shouldBe):
763         (makePolyProtoObject.foo.C):
764         (makePolyProtoObject.foo):
765         (makePolyProtoObject):
766         (target):
767         * stress/object-get-prototype-of-filtered.js: Added.
768         (shouldBe):
769         (shouldThrow):
770         (target):
771         (i.Cocoa):
772         * stress/object-get-prototype-of-mono-proto.js: Added.
773         (shouldBe):
774         (makePolyProtoObject.foo.C):
775         (makePolyProtoObject.foo):
776         (makePolyProtoObject):
777         (target):
778         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
779         (shouldBe):
780         (makePolyProtoObject.foo.C):
781         (makePolyProtoObject.foo):
782         (makePolyProtoObject):
783         (target):
784         * stress/object-get-prototype-of-poly-proto.js: Added.
785         (shouldBe):
786         (makePolyProtoObject.foo.C):
787         (makePolyProtoObject.foo):
788         (makePolyProtoObject):
789         (target):
790         * stress/object-proto-getter-filtered.js: Added.
791         (shouldBe):
792         (shouldThrow):
793         (target):
794         (i.Cocoa):
795         * stress/object-proto-getter-poly-mono-proto.js: Added.
796         (shouldBe):
797         (makePolyProtoObject.foo.C):
798         (makePolyProtoObject.foo):
799         (makePolyProtoObject):
800         (target):
801         * stress/object-proto-getter-poly-proto.js: Added.
802         (shouldBe):
803         (makePolyProtoObject.foo.C):
804         (makePolyProtoObject.foo):
805         (makePolyProtoObject):
806         (target):
807         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
808         * stress/string-proto.js: Added.
809         (shouldBe):
810         (target):
811
812 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
813
814         Unreviewed, rolling out r223523.
815
816         A test for this change is failing on debug JSC bots.
817
818         Reverted changeset:
819
820         "[JSC] __proto__ getter should be fast"
821         https://bugs.webkit.org/show_bug.cgi?id=178067
822         https://trac.webkit.org/changeset/223523
823
824 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
825
826         [JSC] __proto__ getter should be fast
827         https://bugs.webkit.org/show_bug.cgi?id=178067
828
829         Reviewed by Saam Barati.
830
831         * stress/dfg-object-proto-accessor.js: Added.
832         (shouldBe):
833         (shouldThrow):
834         (target):
835         * stress/dfg-object-proto-getter.js: Added.
836         (shouldBe):
837         (shouldThrow):
838         (target):
839         * stress/dfg-object-prototype-of.js: Added.
840         (shouldBe):
841         (shouldThrow):
842         (target):
843         * stress/dfg-reflect-get-prototype-of.js: Added.
844         (shouldBe):
845         (shouldThrow):
846         (target):
847         * stress/object-get-prototype-of-filtered.js: Added.
848         (shouldBe):
849         (shouldThrow):
850         (target):
851         (i.Cocoa):
852         * stress/object-get-prototype-of-mono-proto.js: Added.
853         (shouldBe):
854         (makePolyProtoObject.foo.C):
855         (makePolyProtoObject.foo):
856         (makePolyProtoObject):
857         (target):
858         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
859         (shouldBe):
860         (makePolyProtoObject.foo.C):
861         (makePolyProtoObject.foo):
862         (makePolyProtoObject):
863         (target):
864         * stress/object-get-prototype-of-poly-proto.js: Added.
865         (shouldBe):
866         (makePolyProtoObject.foo.C):
867         (makePolyProtoObject.foo):
868         (makePolyProtoObject):
869         (target):
870         * stress/object-proto-getter-filtered.js: Added.
871         (shouldBe):
872         (shouldThrow):
873         (target):
874         (i.Cocoa):
875         * stress/object-proto-getter-poly-mono-proto.js: Added.
876         (shouldBe):
877         (makePolyProtoObject.foo.C):
878         (makePolyProtoObject.foo):
879         (makePolyProtoObject):
880         (target):
881         * stress/object-proto-getter-poly-proto.js: Added.
882         (shouldBe):
883         (makePolyProtoObject.foo.C):
884         (makePolyProtoObject.foo):
885         (makePolyProtoObject):
886         (target):
887         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
888         * stress/string-proto.js: Added.
889         (shouldBe):
890         (target):
891
892 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
893
894         Reland "Add Above/Below comparisons for UInt32 patterns"
895         https://bugs.webkit.org/show_bug.cgi?id=177281
896
897         Reviewed by Saam Barati.
898
899         * stress/uint32-comparison-jump.js: Added.
900         (shouldBe):
901         (above):
902         (aboveOrEqual):
903         (below):
904         (belowOrEqual):
905         (notAbove):
906         (notAboveOrEqual):
907         (notBelow):
908         (notBelowOrEqual):
909         * stress/uint32-comparison.js: Added.
910         (shouldBe):
911         (above):
912         (aboveOrEqual):
913         (below):
914         (belowOrEqual):
915         (aboveTest):
916         (aboveOrEqualTest):
917         (belowTest):
918         (belowOrEqualTest):
919
920 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
921
922         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
923         https://bugs.webkit.org/show_bug.cgi?id=178210
924
925         Reviewed by Saam Barati.
926
927         * wasm/function-tests/trap-from-start-async.js:
928         (async.StartTrapsAsync):
929         * wasm/function-tests/trap-from-start.js:
930         (StartTraps):
931         * wasm/js-api/web-assembly-function.js:
932         (assert.eq.Object.getPrototypeOf):
933         * wasm/js-api/wrapper-function.js:
934         (return.new.WebAssembly.Module):
935         (assert.throws.makeInstance): Deleted.
936         (assert.throws.Bar): Deleted.
937         (assert.throws): Deleted.
938
939 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
940
941         Enable gigacage on iOS
942         https://bugs.webkit.org/show_bug.cgi?id=177586
943
944         Reviewed by JF Bastien.
945         
946         Add tests for when Gigacage gets runtime disabled.
947
948         * stress/disable-gigacage-arrays.js: Added.
949         (foo):
950         * stress/disable-gigacage-strings.js: Added.
951         (foo):
952         * stress/disable-gigacage-typed-arrays.js: Added.
953         (foo):
954
955 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
956
957         import.meta should not be assignable
958         https://bugs.webkit.org/show_bug.cgi?id=178202
959
960         Reviewed by Saam Barati.
961
962         * modules/import-meta-assignment.js: Added.
963         (shouldThrow):
964         (SyntaxError.import.meta.can.shouldThrow):
965
966 2017-10-11  Saam Barati  <sbarati@apple.com>
967
968         Unreviewed. Actually skip certain type profiler tests in debug.
969
970         * typeProfiler.yaml:
971         * typeProfiler/deltablue-for-of.js:
972         * typeProfiler/getter-richards.js:
973
974 2017-10-11  Commit Queue  <commit-queue@webkit.org>
975
976         Unreviewed, rolling out r223113 and r223121.
977         https://bugs.webkit.org/show_bug.cgi?id=178182
978
979         Reintroduced 20% regression on Kraken (Requested by rniwa on
980         #webkit).
981
982         Reverted changesets:
983
984         "Enable gigacage on iOS"
985         https://bugs.webkit.org/show_bug.cgi?id=177586
986         https://trac.webkit.org/changeset/223113
987
988         "Use one virtual allocation for all gigacages and their
989         runways"
990         https://bugs.webkit.org/show_bug.cgi?id=178050
991         https://trac.webkit.org/changeset/223121
992
993 2017-10-11  Michael Saboff  <msaboff@apple.com>
994
995         Disable test262 named capture group tests with direct unicode names and with references before definitions
996         https://bugs.webkit.org/show_bug.cgi?id=178177
997
998         Reviewed by Keith Miller.
999
1000         Bugs to track fixing these test are:
1001         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1002             "Add support in named capture group identifiers for direct surrogate pairs"
1003         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1004             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1005
1006         * test262.yaml:
1007
1008 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1009
1010         Object properties are undefined in super.call() but not in this.call()
1011         https://bugs.webkit.org/show_bug.cgi?id=177230
1012
1013         Reviewed by Saam Barati.
1014
1015         * stress/super-call-function-subclass.js: Added.
1016         (assert):
1017         (A.prototype.t):
1018         (A):
1019         * stress/super-dot-call-and-apply.js: Added.
1020         (assert):
1021         (A):
1022         (A.prototype.call):
1023         (A.prototype.apply):
1024         (B.prototype.testSuper):
1025         (B):
1026         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1027         (D.prototype.testSuper):
1028         (D):
1029
1030 2017-10-10  Saam Barati  <sbarati@apple.com>
1031
1032         The prototype cache should be aware of the Executable it generates a Structure for
1033         https://bugs.webkit.org/show_bug.cgi?id=177907
1034
1035         Reviewed by Filip Pizlo.
1036
1037         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1038         (assert):
1039         (foo.C):
1040         (foo):
1041         (bar.C):
1042         (bar):
1043         (access):
1044         (makeLongChain):
1045         (accessY):
1046
1047 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1048
1049         `async` should be able to be used as an imported binding name
1050         https://bugs.webkit.org/show_bug.cgi?id=176573
1051
1052         Reviewed by Saam Barati.
1053
1054         * modules/import-default-async.js: Added.
1055         * modules/import-named-async-as.js: Added.
1056         * modules/import-named-async.js: Added.
1057         * modules/import-named-async/target.js: Added.
1058         * modules/import-namespace-async.js: Added.
1059         * test262.yaml:
1060
1061 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1062
1063         Enable gigacage on iOS
1064         https://bugs.webkit.org/show_bug.cgi?id=177586
1065
1066         Reviewed by JF Bastien.
1067         
1068         Add tests for when Gigacage gets runtime disabled.
1069
1070         * stress/disable-gigacage-arrays.js: Added.
1071         (foo):
1072         * stress/disable-gigacage-strings.js: Added.
1073         (foo):
1074         * stress/disable-gigacage-typed-arrays.js: Added.
1075         (foo):
1076
1077 2017-10-09  Michael Saboff  <msaboff@apple.com>
1078
1079         Implement RegExp Unicode property escapes
1080         https://bugs.webkit.org/show_bug.cgi?id=172069
1081
1082         Reviewed by JF Bastien.
1083
1084         Enabled Unicode Property tests.
1085
1086         * test262.yaml:
1087
1088 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1089
1090         Unreviewed, rolling out r223015 and r223025.
1091         https://bugs.webkit.org/show_bug.cgi?id=178093
1092
1093         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1094         #webkit).
1095
1096         Reverted changesets:
1097
1098         "Enable gigacage on iOS"
1099         https://bugs.webkit.org/show_bug.cgi?id=177586
1100         http://trac.webkit.org/changeset/223015
1101
1102         "Unreviewed, disable Gigacage on ARM64 Linux"
1103         https://bugs.webkit.org/show_bug.cgi?id=177586
1104         http://trac.webkit.org/changeset/223025
1105
1106 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1107
1108         Update expectations for test262 tests that pass after r223043.
1109         https://bugs.webkit.org/show_bug.cgi?id=176685
1110
1111         Unreviewed test gardening.
1112
1113         * test262.yaml:
1114
1115 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1116
1117         Unreviewed, rolling out r223022.
1118
1119         This change introduced 18 test262 failures.
1120
1121         Reverted changeset:
1122
1123         "`async` should be able to be used as an imported binding
1124         name"
1125         https://bugs.webkit.org/show_bug.cgi?id=176573
1126         http://trac.webkit.org/changeset/223022
1127
1128 2017-10-09  Saam Barati  <sbarati@apple.com>
1129
1130         3 poly-proto JSC tests timing out on debug after r222827
1131         https://bugs.webkit.org/show_bug.cgi?id=177880
1132         <rdar://problem/34817122>
1133
1134         Unreviewed.
1135
1136         I'm skipping these type profiler tests on debug since they are long running.
1137
1138         * typeProfiler/deltablue-for-of.js:
1139         * typeProfiler/getter-richards.js:
1140
1141 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1142
1143         Safari 10 /11 problem with if (!await get(something)).
1144         https://bugs.webkit.org/show_bug.cgi?id=176685
1145
1146         Reviewed by Saam Barati.
1147
1148         * stress/async-await-basic.js:
1149         (awaitEpression.async):
1150         * stress/async-await-syntax.js:
1151         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1152         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1153
1154 2017-10-08  Saam Barati  <sbarati@apple.com>
1155
1156         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1157
1158         * typeProfiler/deltablue-for-of.js:
1159         * typeProfiler/getter-richards.js:
1160
1161 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1162
1163         `async` should be able to be used as an imported binding name
1164         https://bugs.webkit.org/show_bug.cgi?id=176573
1165
1166         Reviewed by Darin Adler.
1167
1168         * modules/import-default-async.js: Added.
1169         * modules/import-named-async-as.js: Added.
1170         * modules/import-named-async.js: Added.
1171         * modules/import-named-async/target.js: Added.
1172         * modules/import-namespace-async.js: Added.
1173
1174 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1175
1176         Enable gigacage on iOS
1177         https://bugs.webkit.org/show_bug.cgi?id=177586
1178
1179         Reviewed by JF Bastien.
1180         
1181         Add tests for when Gigacage gets runtime disabled.
1182
1183         * stress/disable-gigacage-arrays.js: Added.
1184         (foo):
1185         * stress/disable-gigacage-strings.js: Added.
1186         (foo):
1187         * stress/disable-gigacage-typed-arrays.js: Added.
1188         (foo):
1189
1190 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1191
1192         Unreviewed, rolling out r222791 and r222873.
1193         https://bugs.webkit.org/show_bug.cgi?id=178031
1194
1195         Caused crashes with workers/wasm LayoutTests (Requested by
1196         ryanhaddad on #webkit).
1197
1198         Reverted changesets:
1199
1200         "WebAssembly: no VM / JS version of everything but Instance"
1201         https://bugs.webkit.org/show_bug.cgi?id=177473
1202         http://trac.webkit.org/changeset/222791
1203
1204         "WebAssembly: address no VM / JS follow-ups"
1205         https://bugs.webkit.org/show_bug.cgi?id=177887
1206         http://trac.webkit.org/changeset/222873
1207
1208 2017-10-05  Saam Barati  <sbarati@apple.com>
1209
1210         Make sure all prototypes under poly proto get added into the VM's prototype map
1211         https://bugs.webkit.org/show_bug.cgi?id=177909
1212
1213         Reviewed by Keith Miller.
1214
1215         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1216         (assert):
1217         (foo.C):
1218         (foo):
1219         (set x):
1220
1221 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1222
1223         [JSC] Introduce import.meta
1224         https://bugs.webkit.org/show_bug.cgi?id=177703
1225
1226         Reviewed by Filip Pizlo.
1227
1228         * modules/import-meta-syntax.js: Added.
1229         (shouldThrow):
1230         (shouldNotThrow):
1231         * modules/import-meta.js: Added.
1232         * modules/import-meta/cocoa.js: Added.
1233         * modules/resources/assert.js:
1234         (export.shouldNotThrow):
1235         * stress/import-syntax.js:
1236
1237 2017-10-04  Saam Barati  <sbarati@apple.com>
1238
1239         Make pertinent AccessCases watch the poly proto watchpoint
1240         https://bugs.webkit.org/show_bug.cgi?id=177765
1241
1242         Reviewed by Keith Miller.
1243
1244         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1245         (assert):
1246         (foo.C):
1247         (foo):
1248         (validate):
1249         * stress/poly-proto-clear-stub.js: Added.
1250         (assert):
1251         (foo.C):
1252         (foo):
1253
1254 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1255
1256         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1257
1258         Unreviewed test gardening.
1259
1260         * test262.yaml:
1261
1262 2017-10-04  Saam Barati  <sbarati@apple.com>
1263
1264         3 poly-proto JSC tests timing out on debug after r222827
1265         https://bugs.webkit.org/show_bug.cgi?id=177880
1266
1267         Rubber stamped by Mark Lam.
1268
1269         * microbenchmarks/poly-proto-access.js:
1270         * typeProfiler/deltablue-for-of.js:
1271         * typeProfiler/getter-richards.js:
1272
1273 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1274
1275         Unreviewed, marking tco-catch.js as a failure after test262 update
1276         https://bugs.webkit.org/show_bug.cgi?id=177859
1277
1278         * test262.yaml:
1279
1280 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1281
1282         Unreviewed, marking one async iterator test262 test failed
1283         https://bugs.webkit.org/show_bug.cgi?id=177859
1284
1285         * test262.yaml:
1286
1287 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1288
1289         [Test262] Update Test262 to Oct 4 version
1290         https://bugs.webkit.org/show_bug.cgi?id=177859
1291
1292         Reviewed by Sam Weinig.
1293
1294         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1295         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1296
1297         * test262.yaml:
1298         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1299         (checkSequence):
1300         * test262/harness/typeCoercion.js:
1301         (testCoercibleToIndexZero):
1302         (testCoercibleToIndexOne):
1303         (testCoercibleToIndexFromIndex):
1304         (testNotCoercibleToIndex.testPrimitiveValue):
1305         (testNotCoercibleToInteger):
1306         (testCoercibleToBigIntZero.testPrimitiveValue):
1307         (testCoercibleToBigIntZero):
1308         (testCoercibleToBigIntOne.testPrimitiveValue):
1309         (testCoercibleToBigIntOne):
1310         (testPrimitiveValue):
1311         (testCoercibleToBigIntFromBigInt):
1312         (testNotCoercibleToBigInt.testPrimitiveValue):
1313         (testNotCoercibleToBigInt.testStringValue):
1314         (testNotCoercibleToBigInt):
1315         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1316         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1317         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1318         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1319         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1320         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1321         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1322         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1323         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1324         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
1325         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
1326         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
1327         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
1328         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
1329         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
1330         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
1331         (testCoercibleToBigIntZero):
1332         (testCoercibleToBigIntOne):
1333         (testNotCoercibleToBigInt):
1334         (MyError): Deleted.
1335         (valueOf): Deleted.
1336         (toString): Deleted.
1337         (Symbol.toPrimitive): Deleted.
1338         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
1339         (testCoercibleToIndexZero):
1340         (testCoercibleToIndexOne):
1341         (testNotCoercibleToIndex):
1342         (MyError): Deleted.
1343         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
1344         (assert.sameValue.BigInt.asIntN.toString): Deleted.
1345         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
1346         (BigInt.asIntN.valueOf): Deleted.
1347         (BigInt.asIntN.toString): Deleted.
1348         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
1349         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
1350         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
1351         (testCoercibleToBigIntZero):
1352         (testCoercibleToBigIntOne):
1353         (testNotCoercibleToBigInt):
1354         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
1355         (testCoercibleToIndexZero):
1356         (testCoercibleToIndexOne):
1357         (testNotCoercibleToIndex):
1358         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
1359         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
1360         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
1361         (bits.valueOf):
1362         (bigint.valueOf):
1363         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
1364         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
1365         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
1366         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
1367         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
1368         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
1369         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
1370         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
1371         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
1372         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
1373         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
1374         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
1375         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
1376         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
1377         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
1378         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
1379         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
1380         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
1381         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
1382         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
1383         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
1384         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
1385         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
1386         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
1387         (replacer):
1388         (BigInt.prototype.toJSON):
1389         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
1390         (replacer):
1391         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
1392         (BigInt.prototype.toJSON):
1393         * test262/test/built-ins/JSON/stringify/bigint.js:
1394         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
1395         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
1396         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
1397         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
1398         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
1399         * test262/test/built-ins/Object/proto-from-ctor.js:
1400         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
1401         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
1402         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
1403         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
1404         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
1405         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
1406         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
1407         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
1408         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
1409         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
1410         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
1411         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
1412         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
1413         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
1414         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
1415         * test262/test/built-ins/Proxy/get-fn-realm.js:
1416         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
1417         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
1418         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
1419         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
1420         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
1421         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
1422         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
1423         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
1424         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
1425         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
1426         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
1427         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
1428         (i6.replace):
1429         (i6b.replace):
1430         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
1431         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
1432         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
1433         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
1434         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
1435         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
1436         * test262/test/built-ins/RegExp/u180e.js: Added.
1437         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
1438         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
1439         * test262/test/built-ins/String/proto-from-ctor-realm.js:
1440         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
1441         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
1442         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
1443         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
1444         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
1445         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
1446         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
1447         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
1448         * test262/test/built-ins/String/prototype/endsWith/length.js:
1449         * test262/test/built-ins/String/prototype/endsWith/name.js:
1450         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
1451         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
1452         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
1453         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
1454         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
1455         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
1456         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
1457         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
1458         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
1459         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
1460         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
1461         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
1462         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
1463         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
1464         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
1465         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
1466         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
1467         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
1468         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
1469         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
1470         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
1471         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
1472         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
1473         * test262/test/built-ins/String/prototype/includes/includes.js:
1474         * test262/test/built-ins/String/prototype/includes/length.js:
1475         * test262/test/built-ins/String/prototype/includes/name.js:
1476         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
1477         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
1478         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
1479         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
1480         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
1481         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
1482         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
1483         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
1484         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
1485         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
1486         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
1487         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
1488         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
1489         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
1490         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
1491         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
1492         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
1493         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
1494         * test262/test/built-ins/String/prototype/trim/u180e.js:
1495         * test262/test/built-ins/Symbol/for/cross-realm.js:
1496         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
1497         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
1498         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
1499         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
1500         * test262/test/built-ins/Symbol/match/cross-realm.js:
1501         * test262/test/built-ins/Symbol/replace/cross-realm.js:
1502         * test262/test/built-ins/Symbol/search/cross-realm.js:
1503         * test262/test/built-ins/Symbol/species/cross-realm.js:
1504         * test262/test/built-ins/Symbol/split/cross-realm.js:
1505         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
1506         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
1507         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
1508         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
1509         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
1510         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
1511         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
1512         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
1513         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
1514         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
1515         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
1516         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
1517         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
1518         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
1519         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
1520         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
1521         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
1522         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
1523         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
1524         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
1525         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
1526         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
1527         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
1528         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
1529         * test262/test/language/comments/mongolian-vowel-separator-single.js:
1530         * test262/test/language/eval-code/indirect/realm.js:
1531         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
1532         (o.get z):
1533         (o.get a):
1534         * test262/test/language/expressions/call/eval-realm-indirect.js:
1535         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
1536         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
1537         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
1538         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
1539         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
1540         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
1541         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
1542         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
1543         * test262/test/language/expressions/greater-than/bigint-and-number.js:
1544         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
1545         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
1546         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
1547         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
1548         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
1549         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
1550         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
1551         * test262/test/language/expressions/less-than/bigint-and-number.js:
1552         * test262/test/language/expressions/new/non-ctor-err-realm.js:
1553         * test262/test/language/expressions/super/realm.js:
1554         * test262/test/language/expressions/tagged-template/cache-realm.js:
1555         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
1556         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
1557         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
1558         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
1559         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
1560         * test262/test/language/literals/string/mongolian-vowel-separator.js:
1561         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
1562         (o.get z):
1563         (o.get a):
1564         * test262/test/language/statements/for-of/iterator-next-reference.js:
1565         (next):
1566         (iterator.next): Deleted.
1567         (x.of.iterable.): Deleted.
1568         (x.of.iterable.get return): Deleted.
1569         (x.of.iterable.iterator.next): Deleted.
1570         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
1571         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
1572         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
1573         * test262/test/language/white-space/mongolian-vowel-separator.js:
1574         * test262/test262-Revision.txt:
1575
1576 2017-10-03  Saam Barati  <sbarati@apple.com>
1577
1578         Implement polymorphic prototypes
1579         https://bugs.webkit.org/show_bug.cgi?id=176391
1580
1581         Reviewed by Filip Pizlo.
1582
1583         * microbenchmarks/poly-proto-access.js: Added.
1584         (assert):
1585         (foo.C):
1586         (foo.C.prototype.get bar):
1587         (foo):
1588         (bar):
1589         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
1590         (assert):
1591         (makePolyProtoObject.foo.C):
1592         (makePolyProtoObject.foo):
1593         (makePolyProtoObject):
1594         (performSet):
1595         * microbenchmarks/poly-proto-setter-speed.js: Added.
1596         (assert):
1597         (makePolyProtoObject.foo.C):
1598         (makePolyProtoObject.foo.C.prototype.set p):
1599         (makePolyProtoObject.foo):
1600         (makePolyProtoObject):
1601         (performSet):
1602         * stress/constructor-with-return.js:
1603         (i.tests.forEach.Constructor):
1604         (i.tests.forEach):
1605         (tests.forEach.Constructor): Deleted.
1606         (tests.forEach): Deleted.
1607         * stress/dom-jit-with-poly-proto.js: Added.
1608         (assert):
1609         (makePolyProtoObject.foo.C):
1610         (makePolyProtoObject.foo):
1611         (makePolyProtoObject):
1612         (validate):
1613         * stress/poly-proto-custom-value-and-accessor.js: Added.
1614         (assert):
1615         (makePolyProtoObject.foo.C):
1616         (makePolyProtoObject.foo):
1617         (makePolyProtoObject):
1618         (items.forEach):
1619         (set get for):
1620         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
1621         (assert):
1622         (makePolyProtoObject.foo.C):
1623         (makePolyProtoObject.foo):
1624         (makePolyProtoObject):
1625         (foo):
1626         * stress/poly-proto-miss.js: Added.
1627         (makePolyProtoInstanceWithNullPrototype.foo.C):
1628         (makePolyProtoInstanceWithNullPrototype.foo):
1629         (makePolyProtoInstanceWithNullPrototype):
1630         (assert):
1631         (validate):
1632         * stress/poly-proto-op-in-caching.js: Added.
1633         (assert):
1634         (makePolyProtoObject.foo.C):
1635         (makePolyProtoObject.foo):
1636         (makePolyProtoObject):
1637         (validate):
1638         (validate2):
1639         * stress/poly-proto-put-transition.js: Added.
1640         (assert):
1641         (makePolyProtoObject.foo.C):
1642         (makePolyProtoObject.foo):
1643         (makePolyProtoObject):
1644         (performSet):
1645         (i.obj.__proto__.set p):
1646         * stress/poly-proto-set-prototype.js: Added.
1647         (assert):
1648         (let.alternateProto.get x):
1649         (let.alternateProto2.get y):
1650         (let.alternateProto2.get x):
1651         (foo.C):
1652         (foo):
1653         (validate):
1654         * stress/poly-proto-setter.js: Added.
1655         (assert):
1656         (makePolyProtoObject.foo.C):
1657         (makePolyProtoObject.foo.C.prototype.set p):
1658         (makePolyProtoObject.foo.C.prototype.get p):
1659         (makePolyProtoObject.foo):
1660         (makePolyProtoObject):
1661         (performSet):
1662         * stress/poly-proto-using-inheritance.js: Added.
1663         (assert):
1664         (foo.C):
1665         (foo.C.prototype.get baz):
1666         (foo):
1667         (bar.C):
1668         (bar):
1669         (validate):
1670         * stress/primitive-poly-proto.js: Added.
1671         (makePolyProtoInstance.foo.C):
1672         (makePolyProtoInstance.foo):
1673         (makePolyProtoInstance):
1674         (assert):
1675         (validate):
1676         * stress/prototype-is-not-js-object.js: Added.
1677         (foo.bar):
1678         (foo):
1679         (assert):
1680         (validate):
1681         * stress/try-get-by-id-poly-proto.js: Added.
1682         (assert):
1683         (makePolyProtoObject.foo.C):
1684         (makePolyProtoObject.foo):
1685         (makePolyProtoObject):
1686         (tryGetByIdText):
1687         (x.__proto__.get bar):
1688         (validate):
1689         * typeProfiler/overflow.js:
1690
1691 2017-10-03  JF Bastien  <jfbastien@apple.com>
1692
1693         WebAssembly: no VM / JS version of everything but Instance
1694         https://bugs.webkit.org/show_bug.cgi?id=177473
1695
1696         Reviewed by Filip Pizlo.
1697
1698         - Exceeding max on memory growth now returns a range error as per
1699         spec. This is a (very minor) breaking change: it used to throw OOM
1700         error. Update the corresponding test.
1701
1702         * wasm/js-api/memory-grow.js:
1703         (assertEq):
1704         * wasm/js-api/table.js:
1705         (assert.throws):
1706
1707 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
1708
1709         Skip JSC test stress/regress-159779-2.js on debug.
1710         https://bugs.webkit.org/show_bug.cgi?id=177204
1711
1712         Unreviewed test gardening.
1713
1714         * stress/regress-159779-2.js:
1715
1716 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
1717
1718         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
1719         https://bugs.webkit.org/show_bug.cgi?id=175642
1720
1721         Reviewed by Darin Adler.
1722
1723         * ChakraCore/test/Function/apply3.baseline-jsc:
1724
1725 2017-10-01  Commit Queue  <commit-queue@webkit.org>
1726
1727         Unreviewed, rolling out r222564.
1728         https://bugs.webkit.org/show_bug.cgi?id=177720
1729
1730         "It regressed JetStream by 2% on iOS caused by a 50%
1731         regression on the bigfib subtest" (Requested by saamyjoon on
1732         #webkit).
1733
1734         Reverted changeset:
1735
1736         "Add Above/Below comparisons for UInt32 patterns"
1737         https://bugs.webkit.org/show_bug.cgi?id=177281
1738         http://trac.webkit.org/changeset/222564
1739
1740 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1741
1742         [DFG] Support ArrayPush with multiple args
1743         https://bugs.webkit.org/show_bug.cgi?id=175823
1744
1745         Reviewed by Saam Barati.
1746
1747         * microbenchmarks/array-push-0.js: Added.
1748         (arrayPush0):
1749         * microbenchmarks/array-push-1.js: Added.
1750         (arrayPush1):
1751         * microbenchmarks/array-push-2.js: Added.
1752         (arrayPush2):
1753         * microbenchmarks/array-push-3.js: Added.
1754         (arrayPush3):
1755         * stress/array-push-multiple-contiguous.js: Added.
1756         (shouldBe):
1757         (test):
1758         * stress/array-push-multiple-double-nan.js: Added.
1759         (shouldBe):
1760         (test):
1761         * stress/array-push-multiple-double.js: Added.
1762         (shouldBe):
1763         (test):
1764         * stress/array-push-multiple-int32.js: Added.
1765         (shouldBe):
1766         (test):
1767         * stress/array-push-multiple-many-contiguous.js: Added.
1768         (shouldBe):
1769         (test):
1770         * stress/array-push-multiple-many-double.js: Added.
1771         (shouldBe):
1772         (test):
1773         * stress/array-push-multiple-many-int32.js: Added.
1774         (shouldBe):
1775         (test):
1776         * stress/array-push-multiple-many-storage.js: Added.
1777         (shouldBe):
1778         (test):
1779         * stress/array-push-multiple-storage.js: Added.
1780         (shouldBe):
1781         (test):
1782         * stress/array-push-with-force-exit.js: Added.
1783         (target.createBuiltin):
1784
1785 2017-09-29  Saam Barati  <sbarati@apple.com>
1786
1787         Custom GetterSetterAccessCase does not use the correct slotBase when making call
1788         https://bugs.webkit.org/show_bug.cgi?id=177639
1789
1790         Reviewed by Geoffrey Garen.
1791
1792         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
1793         (assert):
1794         (Class):
1795         (items.forEach):
1796         (set get for):
1797
1798 2017-09-29  Commit Queue  <commit-queue@webkit.org>
1799
1800         Unreviewed, rolling out r222563, r222565, and r222581.
1801         https://bugs.webkit.org/show_bug.cgi?id=177675
1802
1803         "It causes a crash when playing youtube videos" (Requested by
1804         saamyjoon on #webkit).
1805
1806         Reverted changesets:
1807
1808         "[DFG] Support ArrayPush with multiple args"
1809         https://bugs.webkit.org/show_bug.cgi?id=175823
1810         http://trac.webkit.org/changeset/222563
1811
1812         "Unreviewed, build fix after r222563"
1813         https://bugs.webkit.org/show_bug.cgi?id=175823
1814         http://trac.webkit.org/changeset/222565
1815
1816         "Unreviewed, fix x86 breaking due to exhausted registers"
1817         https://bugs.webkit.org/show_bug.cgi?id=175823
1818         http://trac.webkit.org/changeset/222581
1819
1820 2017-09-28  Mark Lam  <mark.lam@apple.com>
1821
1822         test262: Unexpected passes after r222617 and r222618.
1823         https://bugs.webkit.org/show_bug.cgi?id=177622
1824         <rdar://problem/34725960>
1825
1826         Reviewed by Saam Barati.
1827
1828         Update test262.yaml for tests that are now passing.
1829
1830         * test262.yaml:
1831
1832 2017-09-27  Michael Saboff  <msaboff@apple.com>
1833
1834         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
1835         https://bugs.webkit.org/show_bug.cgi?id=177570
1836
1837         Reviewed by Filip Pizlo.
1838
1839         New regression test.
1840
1841         * stress/regress-177570.js: Added.
1842
1843 2017-09-28  Michael Saboff  <msaboff@apple.com>
1844
1845         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
1846         https://bugs.webkit.org/show_bug.cgi?id=177423
1847
1848         Reviewed by Mark Lam.
1849
1850         Updated regression test.
1851
1852         * stress/regress-177423.js:
1853         (catch):
1854
1855 2017-09-27  Mark Lam  <mark.lam@apple.com>
1856
1857         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
1858         https://bugs.webkit.org/show_bug.cgi?id=177584
1859         <rdar://problem/34463903>
1860
1861         Reviewed by Saam Barati.
1862
1863         * stress/regress-177584.js: Added.
1864         (assertEqual):
1865         (Array.prototype.Symbol.species):
1866
1867 2017-09-27  Saam Barati  <sbarati@apple.com>
1868
1869         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
1870         https://bugs.webkit.org/show_bug.cgi?id=177523
1871
1872         Reviewed by Mark Lam.
1873
1874         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
1875         (assert):
1876         (Test):
1877         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
1878         (addMethods):
1879         (i.Test.prototype.propName):
1880
1881 2017-09-27  Mark Lam  <mark.lam@apple.com>
1882
1883         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
1884         https://bugs.webkit.org/show_bug.cgi?id=177423
1885         <rdar://problem/34621320>
1886
1887         Reviewed by Keith Miller.
1888
1889         * stress/regress-177423.js: Added.
1890
1891 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1892
1893         Add Above/Below comparisons for UInt32 patterns
1894         https://bugs.webkit.org/show_bug.cgi?id=177281
1895
1896         Reviewed by Saam Barati.
1897
1898         * stress/uint32-comparison-jump.js: Added.
1899         (shouldBe):
1900         (above):
1901         (aboveOrEqual):
1902         (below):
1903         (belowOrEqual):
1904         (notAbove):
1905         (notAboveOrEqual):
1906         (notBelow):
1907         (notBelowOrEqual):
1908         * stress/uint32-comparison.js: Added.
1909         (shouldBe):
1910         (above):
1911         (aboveOrEqual):
1912         (below):
1913         (belowOrEqual):
1914         (aboveTest):
1915         (aboveOrEqualTest):
1916         (belowTest):
1917         (belowOrEqualTest):
1918
1919 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
1920
1921         [DFG] Support ArrayPush with multiple args
1922         https://bugs.webkit.org/show_bug.cgi?id=175823
1923
1924         Reviewed by Saam Barati.
1925
1926         * microbenchmarks/array-push-0.js: Added.
1927         (arrayPush0):
1928         * microbenchmarks/array-push-1.js: Added.
1929         (arrayPush1):
1930         * microbenchmarks/array-push-2.js: Added.
1931         (arrayPush2):
1932         * microbenchmarks/array-push-3.js: Added.
1933         (arrayPush3):
1934         * stress/array-push-multiple-contiguous.js: Added.
1935         (shouldBe):
1936         (test):
1937         * stress/array-push-multiple-double-nan.js: Added.
1938         (shouldBe):
1939         (test):
1940         * stress/array-push-multiple-double.js: Added.
1941         (shouldBe):
1942         (test):
1943         * stress/array-push-multiple-int32.js: Added.
1944         (shouldBe):
1945         (test):
1946         * stress/array-push-multiple-many-contiguous.js: Added.
1947         (shouldBe):
1948         (test):
1949         * stress/array-push-multiple-many-double.js: Added.
1950         (shouldBe):
1951         (test):
1952         * stress/array-push-multiple-many-int32.js: Added.
1953         (shouldBe):
1954         (test):
1955         * stress/array-push-multiple-many-storage.js: Added.
1956         (shouldBe):
1957         (test):
1958         * stress/array-push-multiple-storage.js: Added.
1959         (shouldBe):
1960         (test):
1961
1962 2017-09-26  Commit Queue  <commit-queue@webkit.org>
1963
1964         Unreviewed, rolling out r222518.
1965         https://bugs.webkit.org/show_bug.cgi?id=177507
1966
1967         Break the High Sierra build (Requested by yusukesuzuki on
1968         #webkit).
1969
1970         Reverted changeset:
1971
1972         "Add Above/Below comparisons for UInt32 patterns"
1973         https://bugs.webkit.org/show_bug.cgi?id=177281
1974         http://trac.webkit.org/changeset/222518
1975
1976 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1977
1978         Add Above/Below comparisons for UInt32 patterns
1979         https://bugs.webkit.org/show_bug.cgi?id=177281
1980
1981         Reviewed by Saam Barati.
1982
1983         * stress/uint32-comparison-jump.js: Added.
1984         (shouldBe):
1985         (above):
1986         (aboveOrEqual):
1987         (below):
1988         (belowOrEqual):
1989         (notAbove):
1990         (notAboveOrEqual):
1991         (notBelow):
1992         (notBelowOrEqual):
1993         * stress/uint32-comparison.js: Added.
1994         (shouldBe):
1995         (above):
1996         (aboveOrEqual):
1997         (below):
1998         (belowOrEqual):
1999         (aboveTest):
2000         (aboveOrEqualTest):
2001         (belowTest):
2002         (belowOrEqualTest):
2003
2004 2017-09-23  Keith Miller  <keith_miller@apple.com>
2005
2006         Fix infinite looping test262 test
2007         https://bugs.webkit.org/show_bug.cgi?id=177412
2008
2009         Reviewed by Yusuke Suzuki.
2010
2011         This test was poorly designed since failing it would cause the vm
2012         to inifinite loop. I've fixed it locally and will fix it on github pending
2013         the results of next weeks tc39 meeting.
2014
2015         * test262.yaml:
2016         * test262/test/language/statements/for-of/iterator-next-reference.js:
2017
2018 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2019
2020         test262: $.agent became $262.agent in test262 update
2021         https://bugs.webkit.org/show_bug.cgi?id=177407
2022
2023         Reviewed by Yusuke Suzuki.
2024
2025         * test262.yaml:
2026         ~320 tests pass now that we correctly make $262 available.
2027
2028 2017-09-22  Keith Miller  <keith_miller@apple.com>
2029
2030         Speculatively change iteration protocall to use the same next function
2031         https://bugs.webkit.org/show_bug.cgi?id=175653
2032
2033         Reviewed by Saam Barati.
2034
2035         Change test to match the new iteration behavior.
2036
2037         * stress/spread-optimized-properly.js:
2038
2039 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2040
2041         [DFG][FTL] Profile array vector length for array allocation
2042         https://bugs.webkit.org/show_bug.cgi?id=177051
2043
2044         Reviewed by Saam Barati.
2045
2046         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2047         (target):
2048
2049 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2050
2051         Unreviewed, rolling out r222380.
2052         https://bugs.webkit.org/show_bug.cgi?id=177352
2053
2054         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2055         #webkit).
2056
2057         Reverted changeset:
2058
2059         "[DFG][FTL] Profile array vector length for array allocation"
2060         https://bugs.webkit.org/show_bug.cgi?id=177051
2061         http://trac.webkit.org/changeset/222380
2062
2063 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2064
2065         [DFG][FTL] Profile array vector length for array allocation
2066         https://bugs.webkit.org/show_bug.cgi?id=177051
2067
2068         Reviewed by Saam Barati.
2069
2070         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2071         (target):
2072
2073 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2074
2075         Skip new hanging test262 tests.
2076         https://bugs.webkit.org/show_bug.cgi?id=177326
2077
2078         Unreviewed test gardening.
2079
2080         * test262.yaml:
2081
2082 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2083
2084         Mark 6 test262 tests as passing.
2085         https://bugs.webkit.org/show_bug.cgi?id=177307
2086
2087         Unreviewed test gardening.
2088
2089         * test262.yaml:
2090
2091 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2092
2093         Unreviewed follow-up to r222311.
2094
2095         * test262/harness/sta.js:
2096         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2097         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2098         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2099         * test262/test/built-ins/Array/from/elements-added-after.js:
2100         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2101         * test262/test/built-ins/Array/from/elements-updated-after.js:
2102         * test262/test/built-ins/Array/from/from-array.js:
2103         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2104         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2105         * test262/test/built-ins/Array/from/source-array-boundary.js:
2106         * test262/test/built-ins/Array/from/source-object-constructor.js:
2107         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2108         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2109         * test262/test/built-ins/Array/from/source-object-length.js:
2110         * test262/test/built-ins/Array/from/source-object-missing.js:
2111         * test262/test/built-ins/Array/from/source-object-without.js:
2112         * test262/test/built-ins/Array/from/this-null.js:
2113         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2114         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2115         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2116         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2117         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2118         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2119         * test262/test/language/literals/string/7.8.4-1gs.js:
2120         Fix some files that I failed to update when I applied my patch.
2121
2122 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2123
2124         Update test262 tests
2125         https://bugs.webkit.org/show_bug.cgi?id=177220
2126
2127         Reviewed by Saam Barati and Yusuke Suzuki.
2128
2129         * test262.yaml:
2130         * test262/test262-Revision.txt:
2131         New rebaselined expectations for all tests.
2132
2133         * test262/*:
2134         Updated.
2135
2136 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2137
2138         [DFG] Remove ToThis more aggressively
2139         https://bugs.webkit.org/show_bug.cgi?id=177056
2140
2141         Reviewed by Saam Barati.
2142
2143         * stress/generator-with-this-strict.js: Added.
2144         (shouldBe):
2145         (generator):
2146         (target):
2147         * stress/generator-with-this.js: Added.
2148         (shouldBe):
2149         (generator):
2150         (target):
2151
2152 2017-09-17  Michael Saboff  <msaboff@apple.com>
2153
2154         https://bugs.webkit.org/show_bug.cgi?id=177038
2155         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2156
2157         Reviewed by JF Bastien.
2158
2159         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2160         as it dies using too much memory.
2161
2162 2017-09-15  Saam Barati  <sbarati@apple.com>
2163
2164         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2165         https://bugs.webkit.org/show_bug.cgi?id=176981
2166
2167         Reviewed by Yusuke Suzuki.
2168
2169         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2170         (assert):
2171         (verify):
2172         (func):
2173         (const.bar.createBuiltin):
2174
2175 2017-09-14  Saam Barati  <sbarati@apple.com>
2176
2177         It should be valid to exit before each set when doing arity fixup when inlining
2178         https://bugs.webkit.org/show_bug.cgi?id=176948
2179
2180         Reviewed by Keith Miller.
2181
2182         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2183         (baz):
2184         (bar):
2185         (foo):
2186
2187 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2188
2189         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2190         https://bugs.webkit.org/show_bug.cgi?id=176867
2191
2192         Reviewed by Sam Weinig.
2193
2194         * microbenchmarks/object-get-own-property-symbols.js: Added.
2195         (test):
2196
2197 2017-09-13  Mark Lam  <mark.lam@apple.com>
2198
2199         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2200         https://bugs.webkit.org/show_bug.cgi?id=176888
2201         <rdar://problem/34381832>
2202
2203         Not reviewed.
2204
2205         * stress/op_mod-ConstVar.js:
2206         * stress/op_mod-VarConst.js:
2207         * stress/op_mod-VarVar.js:
2208
2209 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2210
2211         Skip 3 op_mod tests on Debug JSC bots.
2212         https://bugs.webkit.org/show_bug.cgi?id=176630
2213
2214         Unreviewed test gardening.
2215
2216         * stress/op_mod-ConstVar.js:
2217         * stress/op_mod-VarConst.js:
2218         * stress/op_mod-VarVar.js:
2219
2220 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2221
2222         [JSC] Fix Array allocation in Object.keys
2223         https://bugs.webkit.org/show_bug.cgi?id=176826
2224
2225         Reviewed by Saam Barati.
2226
2227         * stress/object-own-property-keys.js: Added.
2228         (shouldBe):
2229
2230 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2231
2232         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2233         https://bugs.webkit.org/show_bug.cgi?id=176010
2234
2235         Reviewed by Filip Pizlo.
2236
2237         * microbenchmarks/weak-map-key.js: Added.
2238         (assert):
2239         (objectKey):
2240         (let.start.Date.now):
2241
2242 2017-09-12  Mark Lam  <mark.lam@apple.com>
2243
2244         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2245         https://bugs.webkit.org/show_bug.cgi?id=176630
2246
2247         Reviewed by JF Bastien.
2248
2249         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2250         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2251         a speculative fix for the bots that are seeing these fail.
2252
2253         I also undid the skipping of the op_mod tests for debug builds.
2254
2255         * stress/op_div-ConstVar.js:
2256         * stress/op_div-VarConst.js:
2257         * stress/op_div-VarVar.js:
2258         * stress/op_mod-ConstVar.js:
2259         * stress/op_mod-VarConst.js:
2260         * stress/op_mod-VarVar.js:
2261
2262 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2263
2264         Skip stress/value-to-boolean.js on Debug bots.
2265         https://bugs.webkit.org/show_bug.cgi?id=176787
2266
2267         Unreviewed test gardening.
2268
2269         * stress/value-to-boolean.js:
2270
2271 2017-09-11  Mark Lam  <mark.lam@apple.com>
2272
2273         Change test expectation for test262/test/language/statements/try/tco-catch.js
2274         https://bugs.webkit.org/show_bug.cgi?id=176749
2275
2276         Rubber stamped by Keith Miller.
2277
2278         It's been failing since at least r221821.  I'm changing the test expectation to
2279         fail to green the bots while I investigate some more.
2280
2281         * test262.yaml:
2282
2283 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2284
2285         Unreviewed, rolling out r221854.
2286
2287         The test added with this change fails on 32-bit JSC bots.
2288
2289         Reverted changeset:
2290
2291         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2292         https://bugs.webkit.org/show_bug.cgi?id=176010
2293         http://trac.webkit.org/changeset/221854
2294
2295 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2296
2297         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2298         https://bugs.webkit.org/show_bug.cgi?id=176010
2299
2300         Reviewed by Filip Pizlo.
2301
2302         * microbenchmarks/weak-map-key.js: Added.
2303         (assert):
2304         (objectKey):
2305         (let.start.Date.now):
2306
2307 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2308
2309         [JSC] Optimize Object.keys by using careful array allocation
2310         https://bugs.webkit.org/show_bug.cgi?id=176654
2311
2312         Reviewed by Darin Adler.
2313
2314         * microbenchmarks/object-keys.js: Added.
2315         (test):
2316
2317 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
2318
2319         Error should compute .stack and friends lazily
2320         https://bugs.webkit.org/show_bug.cgi?id=176645
2321
2322         Reviewed by Saam Barati.
2323
2324         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
2325         * microbenchmarks/new-error.js: Added.
2326         * microbenchmarks/throw.js: Added.
2327
2328 2017-09-09  Mark Lam  <mark.lam@apple.com>
2329
2330         [Re-landing] Use JIT probes for DFG OSR exit.
2331         https://bugs.webkit.org/show_bug.cgi?id=175144
2332         <rdar://problem/33437050>
2333
2334         Not reviewed.  Original patch reviewed by Saam Barati.
2335
2336         Disable these tests for debug builds because they run too slow with the new OSR exit.
2337
2338         * stress/op_mod-ConstVar.js:
2339         * stress/op_mod-VarConst.js:
2340         * stress/op_mod-VarVar.js:
2341
2342 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2343
2344         [DFG] NewArrayWithSize(size)'s size does not care negative zero
2345         https://bugs.webkit.org/show_bug.cgi?id=176300
2346
2347         Reviewed by Saam Barati.
2348
2349         * stress/new-array-with-size-div.js: Added.
2350         (shouldBe):
2351         (test):
2352         (i.i):
2353
2354 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2355
2356         [DFG] PutByVal with Array::Generic is too generic
2357         https://bugs.webkit.org/show_bug.cgi?id=176345
2358
2359         Reviewed by Filip Pizlo.
2360
2361         * stress/object-assign-symbols.js: Added.
2362         (shouldBe):
2363         (test):
2364         * stress/object-assign.js: Added.
2365         (shouldBe):
2366         (test):
2367         (i.shouldBe.JSON.stringify.test):
2368
2369 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2370
2371         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
2372         https://bugs.webkit.org/show_bug.cgi?id=176590
2373
2374         Reviewed by Saam Barati.
2375
2376         * microbenchmarks/object-iterate-symbols.js: Added.
2377         (test):
2378         * microbenchmarks/object-iterate.js: Added.
2379         (test):
2380         * stress/object-iterate-symbols.js: Added.
2381         (shouldBe):
2382         (test):
2383         * stress/object-iterate.js: Added.
2384         (shouldBe):
2385         (test):
2386
2387 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
2388
2389         [Win32] 10 JSC stress tests are failing.
2390         https://bugs.webkit.org/show_bug.cgi?id=176538
2391
2392         Reviewed by Mark Lam.
2393
2394         Skip tests on Windows to make the bots green.
2395
2396         * ChakraCore.yaml:
2397         * stress/date-relaxed.js:
2398
2399 2017-09-06  Mark Lam  <mark.lam@apple.com>
2400
2401         constructGenericTypedArrayViewWithArguments() is missing an exception check.
2402         https://bugs.webkit.org/show_bug.cgi?id=176485
2403         <rdar://problem/33898874>
2404
2405         Reviewed by Keith Miller.
2406
2407         * stress/regress-176485.js: Added.
2408
2409 2017-09-05  Saam Barati  <sbarati@apple.com>
2410
2411         isNotCellSpeculation is wrong with respect to SpecEmpty
2412         https://bugs.webkit.org/show_bug.cgi?id=176429
2413
2414         Reviewed by Michael Saboff.
2415
2416         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
2417         (Foo):
2418
2419 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
2420
2421         test262: Completion values for control flow do not match the spec
2422         https://bugs.webkit.org/show_bug.cgi?id=171265
2423
2424         Reviewed by Saam Barati.
2425
2426         * stress/completion-value.js:
2427         Condensed test for completion values in top level statements.
2428
2429         * stress/super-get-by-id.js:
2430         ClassDeclaration when evaled no longer produce values. Convert
2431         these to ClassExpressions so they produce the class value.
2432         
2433         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
2434         This is a progression for currect spec behavior.
2435
2436         * mozilla/mozilla-tests.yaml:
2437         This test is now outdated, so mark it as failing for that reason.
2438
2439         * test262.yaml:
2440         Passing all "cptn" completion value tests.
2441
2442 2017-09-04  Saam Barati  <sbarati@apple.com>
2443
2444         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
2445         https://bugs.webkit.org/show_bug.cgi?id=176317
2446
2447         Reviewed by Keith Miller.
2448
2449         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
2450         (Foo):
2451
2452 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2453
2454         [DFG][FTL] Efficiently execute number#toString()
2455         https://bugs.webkit.org/show_bug.cgi?id=170007
2456
2457         Reviewed by Keith Miller.
2458
2459         * microbenchmarks/number-to-string-strength-reduction.js: Added.
2460         (test):
2461         * microbenchmarks/number-to-string-with-radix-10.js: Added.
2462         (test):
2463         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
2464         (test):
2465         * microbenchmarks/number-to-string-with-radix.js: Added.
2466         (test):
2467         * stress/number-to-string-strength-reduction.js: Added.
2468         (shouldBe):
2469         (test):
2470         * stress/number-to-string-with-radix-10.js: Added.
2471         (shouldBe):
2472         (test):
2473         * stress/number-to-string-with-radix-cse.js: Added.
2474         (shouldBe):
2475         (test):
2476         * stress/number-to-string-with-radix-invalid.js: Added.
2477         (shouldThrow):
2478         * stress/number-to-string-with-radix-watchpoint.js: Added.
2479         (shouldBe):
2480         (test):
2481         (i.i.1e3.Number.prototype.toString):
2482         * stress/number-to-string-with-radix.js: Added.
2483         (shouldBe):
2484         (test):
2485
2486 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2487
2488         [DFG] Relax arity requirement
2489         https://bugs.webkit.org/show_bug.cgi?id=175523
2490
2491         Reviewed by Saam Barati.
2492
2493         * stress/arity-mismatch-arguments-length.js: Added.
2494         (shouldBe):
2495         (test1):
2496         (test):
2497         * stress/arity-mismatch-get-argument.js: Added.
2498         (shouldBe):
2499         (builtin.createBuiltin):
2500         (test):
2501         * stress/arity-mismatch-inlining-extra-slots.js: Added.
2502         (shouldBe):
2503         (inlineTarget):
2504         (test):
2505         * stress/arity-mismatch-inlining.js: Added.
2506         (shouldBe):
2507         (inlineTarget):
2508         (test):
2509         * stress/arity-mismatch-rest.js: Added.
2510         (shouldBe):
2511         (test2):
2512         (test1):
2513         (test):
2514
2515 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2516
2517         [JSC] Fix "name" and "length" of Proxy revoke function
2518         https://bugs.webkit.org/show_bug.cgi?id=176155
2519
2520         Reviewed by Mark Lam.
2521
2522         * test262.yaml:
2523
2524 2017-08-31  Saam Barati  <sbarati@apple.com>
2525
2526         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
2527         https://bugs.webkit.org/show_bug.cgi?id=176206
2528
2529         Reviewed by Keith Miller.
2530
2531         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
2532         (a):
2533         (b):
2534         (foo):
2535
2536 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
2537
2538         Skip two slow JSC tests after r221422.
2539
2540         Unreviewed test gardening.
2541
2542         * stress/regexp-prototype-match-on-too-long-rope.js:
2543         * stress/regexp-prototype-test-on-too-long-rope.js:
2544
2545 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
2546
2547         Unreviewed, skipping slow tests.
2548         
2549         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
2550         work differently now.
2551
2552         * stress/regexp-prototype-exec-on-too-long-rope.js:
2553         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
2554
2555 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2556
2557         [JSC] Use reifying system for "name" property of builtin JSFunction
2558         https://bugs.webkit.org/show_bug.cgi?id=175260
2559
2560         Reviewed by Saam Barati.
2561
2562         * stress/accessors-get-set-prefix.js:
2563         * stress/builtin-function-name.js: Added.
2564         (shouldBe):
2565         (shouldThrow):
2566         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2567         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2568         * stress/private-name-as-anonymous-builtin.js: Added.
2569         (shouldBe):
2570         (NotPromise):
2571
2572 2017-08-30  Saam Barati  <sbarati@apple.com>
2573
2574         Unreviewed. Make test stop printing.
2575
2576         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
2577
2578 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
2579
2580         Unreviewed, rolling out r221327.
2581
2582         This change caused test262 failures.
2583
2584         Reverted changeset:
2585
2586         "[JSC] Use reifying system for "name" property of builtin
2587         JSFunction"
2588         https://bugs.webkit.org/show_bug.cgi?id=175260
2589         http://trac.webkit.org/changeset/221327
2590
2591 2017-08-30  Saam Barati  <sbarati@apple.com>
2592
2593         semicolon is being interpreted as an = in the LiteralParser
2594         https://bugs.webkit.org/show_bug.cgi?id=176114
2595
2596         Reviewed by Oliver Hunt.
2597
2598         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
2599         * stress/resources/literal-parser-test-case.js: Added.
2600
2601 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2602
2603         [ESNext] Async iteration - Implement async iteration statement: for-await-of
2604         https://bugs.webkit.org/show_bug.cgi?id=166698
2605
2606         Reviewed by Yusuke Suzuki.
2607
2608         * stress/async-iteration-for-await-of-syntax.js: Added.
2609         (assert):
2610         (checkSyntax):
2611         (checkSyntaxError):
2612         (checkSimpleAsyncGeneratorSloppyMode):
2613         (checkSimpleAsyncGeneratorStrictMode):
2614         (checkNestedAsyncGenerators):
2615         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2616         * stress/async-iteration-for-await-of.js: Added.
2617         (assert):
2618         (async.foo):
2619         (async.boo):
2620         (const.boo.async):
2621
2622 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2623
2624         [JSC] Use reifying system for "name" property of builtin JSFunction
2625         https://bugs.webkit.org/show_bug.cgi?id=175260
2626
2627         Reviewed by Saam Barati.
2628
2629         * stress/accessors-get-set-prefix.js:
2630         * stress/builtin-function-name.js: Added.
2631         (shouldBe):
2632         (shouldThrow):
2633         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2634         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2635
2636 2017-08-25  Saam Barati  <sbarati@apple.com>
2637
2638         Support compiling catch in the DFG
2639         https://bugs.webkit.org/show_bug.cgi?id=174590
2640         <rdar://problem/34047845>
2641
2642         Reviewed by Filip Pizlo.
2643
2644         * microbenchmarks/delta-blue-try-catch.js: Added.
2645         (exception):
2646         (value):
2647         (OrderedCollection):
2648         (OrderedCollection.prototype.add):
2649         (OrderedCollection.prototype.at):
2650         (OrderedCollection.prototype.size):
2651         (OrderedCollection.prototype.removeFirst):
2652         (OrderedCollection.prototype.remove):
2653         (Strength):
2654         (Strength.stronger):
2655         (Strength.weaker):
2656         (Strength.weakestOf):
2657         (Strength.strongest):
2658         (Strength.prototype.nextWeaker):
2659         (Constraint):
2660         (Constraint.prototype.addConstraint):
2661         (Constraint.prototype.satisfy):
2662         (Constraint.prototype.destroyConstraint):
2663         (Constraint.prototype.isInput):
2664         (UnaryConstraint):
2665         (UnaryConstraint.prototype.addToGraph):
2666         (UnaryConstraint.prototype.chooseMethod):
2667         (UnaryConstraint.prototype.isSatisfied):
2668         (UnaryConstraint.prototype.markInputs):
2669         (UnaryConstraint.prototype.output):
2670         (UnaryConstraint.prototype.recalculate):
2671         (UnaryConstraint.prototype.markUnsatisfied):
2672         (UnaryConstraint.prototype.inputsKnown):
2673         (UnaryConstraint.prototype.removeFromGraph):
2674         (StayConstraint):
2675         (StayConstraint.prototype.execute):
2676         (EditConstraint.prototype.isInput):
2677         (EditConstraint.prototype.execute):
2678         (BinaryConstraint):
2679         (BinaryConstraint.prototype.chooseMethod):
2680         (BinaryConstraint.prototype.addToGraph):
2681         (BinaryConstraint.prototype.isSatisfied):
2682         (BinaryConstraint.prototype.markInputs):
2683         (BinaryConstraint.prototype.input):
2684         (BinaryConstraint.prototype.output):
2685         (BinaryConstraint.prototype.recalculate):
2686         (BinaryConstraint.prototype.markUnsatisfied):
2687         (BinaryConstraint.prototype.inputsKnown):
2688         (BinaryConstraint.prototype.removeFromGraph):
2689         (ScaleConstraint):
2690         (ScaleConstraint.prototype.addToGraph):
2691         (ScaleConstraint.prototype.removeFromGraph):
2692         (ScaleConstraint.prototype.markInputs):
2693         (ScaleConstraint.prototype.execute):
2694         (ScaleConstraint.prototype.recalculate):
2695         (EqualityConstraint):
2696         (EqualityConstraint.prototype.execute):
2697         (Variable):
2698         (Variable.prototype.addConstraint):
2699         (Variable.prototype.removeConstraint):
2700         (Planner):
2701         (Planner.prototype.incrementalAdd):
2702         (Planner.prototype.incrementalRemove):
2703         (Planner.prototype.newMark):
2704         (Planner.prototype.makePlan):
2705         (Planner.prototype.extractPlanFromConstraints):
2706         (Planner.prototype.addPropagate):
2707         (Planner.prototype.removePropagateFrom):
2708         (Planner.prototype.addConstraintsConsumingTo):
2709         (Plan):
2710         (Plan.prototype.addConstraint):
2711         (Plan.prototype.size):
2712         (Plan.prototype.constraintAt):
2713         (Plan.prototype.execute):
2714         (chainTest):
2715         (projectionTest):
2716         (change):
2717         (deltaBlue):
2718         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2719         (assert):
2720         (Numbers):
2721         (Numbers.prototype.next):
2722         (return.Transpose):
2723         (return.Transpose.prototype.next):
2724         (transpose):
2725         (verifyEven):
2726         (verifyString):
2727         (foo):
2728         (runIterators):
2729         * microbenchmarks/try-catch-word-count.js: Added.
2730         (let.assert):
2731         (EOF):
2732         (let.texts):
2733         (let.o.apply):
2734         (foo):
2735         (bar):
2736         (f):
2737         (run):
2738         (test1):
2739         (test2):
2740         (test3):
2741         (fn):
2742         (A):
2743         (B):
2744         (A.prototype.getValue):
2745         (B.prototype.getParentValue):
2746         (strlen):
2747         (sum.0):
2748         (test):
2749         (result.test.o):
2750         (set add.set add):
2751         (set forEach):
2752         (stringHash):
2753         (set if):
2754         (testFunction):
2755         (set delete.set has.set add):
2756         * stress/catch-set-argument-speculation-failure.js: Added.
2757         (o):
2758         (e):
2759         (e2):
2760         (escape):
2761         (baz):
2762         (noInline.run):
2763         (noInline):
2764         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2765         (foo):
2766         (e):
2767         (baz):
2768         (bar):
2769
2770 2017-08-24  Commit Queue  <commit-queue@webkit.org>
2771
2772         Unreviewed, rolling out r221119, r221124, and r221143.
2773         https://bugs.webkit.org/show_bug.cgi?id=175973
2774
2775         "I think it regressed JSBench by 20%" (Requested by saamyjoon
2776         on #webkit).
2777
2778         Reverted changesets:
2779
2780         "Support compiling catch in the DFG"
2781         https://bugs.webkit.org/show_bug.cgi?id=174590
2782         http://trac.webkit.org/changeset/221119
2783
2784         "Unreviewed, build fix in GTK port"
2785         https://bugs.webkit.org/show_bug.cgi?id=174590
2786         http://trac.webkit.org/changeset/221124
2787
2788         "DFG::JITCode::osrEntry should get sorted since we perform a
2789         binary search on it"
2790         https://bugs.webkit.org/show_bug.cgi?id=175893
2791         http://trac.webkit.org/changeset/221143
2792
2793 2017-08-24  Michael Saboff  <msaboff@apple.com>
2794
2795         Add support for RegExp "dotAll" flag
2796         https://bugs.webkit.org/show_bug.cgi?id=175924
2797
2798         Reviewed by Keith Miller.
2799
2800         Updated tests for new dotAll ('s' flag) changes.
2801
2802         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
2803         * stress/static-getter-in-names.js:
2804
2805 2017-08-24  Mark Lam  <mark.lam@apple.com>
2806
2807         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
2808         https://bugs.webkit.org/show_bug.cgi?id=175940
2809         <rdar://problem/29003921>
2810
2811         Reviewed by Saam Barati.
2812
2813         * stress/regress-164081.js: Added.
2814         (shouldEqual):
2815         (testcase):
2816
2817 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
2818
2819         Skip flaky JSC test stress/test-finally.js.
2820         https://bugs.webkit.org/show_bug.cgi?id=160283
2821
2822         Unreviewed test gardening.
2823
2824         * stress/test-finally.js:
2825
2826 2017-08-23  Saam Barati  <sbarati@apple.com>
2827
2828         Support compiling catch in the DFG
2829         https://bugs.webkit.org/show_bug.cgi?id=174590
2830
2831         Reviewed by Filip Pizlo.
2832
2833         * microbenchmarks/delta-blue-try-catch.js: Added.
2834         (exception):
2835         (value):
2836         (OrderedCollection):
2837         (OrderedCollection.prototype.add):
2838         (OrderedCollection.prototype.at):
2839         (OrderedCollection.prototype.size):
2840         (OrderedCollection.prototype.removeFirst):
2841         (OrderedCollection.prototype.remove):
2842         (Strength):
2843         (Strength.stronger):
2844         (Strength.weaker):
2845         (Strength.weakestOf):
2846         (Strength.strongest):
2847         (Strength.prototype.nextWeaker):
2848         (Constraint):
2849         (Constraint.prototype.addConstraint):
2850         (Constraint.prototype.satisfy):
2851         (Constraint.prototype.destroyConstraint):
2852         (Constraint.prototype.isInput):
2853         (UnaryConstraint):
2854         (UnaryConstraint.prototype.addToGraph):
2855         (UnaryConstraint.prototype.chooseMethod):
2856         (UnaryConstraint.prototype.isSatisfied):
2857         (UnaryConstraint.prototype.markInputs):
2858         (UnaryConstraint.prototype.output):
2859         (UnaryConstraint.prototype.recalculate):
2860         (UnaryConstraint.prototype.markUnsatisfied):
2861         (UnaryConstraint.prototype.inputsKnown):
2862         (UnaryConstraint.prototype.removeFromGraph):
2863         (StayConstraint):
2864         (StayConstraint.prototype.execute):
2865         (EditConstraint.prototype.isInput):
2866         (EditConstraint.prototype.execute):
2867         (BinaryConstraint):
2868         (BinaryConstraint.prototype.chooseMethod):
2869         (BinaryConstraint.prototype.addToGraph):
2870         (BinaryConstraint.prototype.isSatisfied):
2871         (BinaryConstraint.prototype.markInputs):
2872         (BinaryConstraint.prototype.input):
2873         (BinaryConstraint.prototype.output):
2874         (BinaryConstraint.prototype.recalculate):
2875         (BinaryConstraint.prototype.markUnsatisfied):
2876         (BinaryConstraint.prototype.inputsKnown):
2877         (BinaryConstraint.prototype.removeFromGraph):
2878         (ScaleConstraint):
2879         (ScaleConstraint.prototype.addToGraph):
2880         (ScaleConstraint.prototype.removeFromGraph):
2881         (ScaleConstraint.prototype.markInputs):
2882         (ScaleConstraint.prototype.execute):
2883         (ScaleConstraint.prototype.recalculate):
2884         (EqualityConstraint):
2885         (EqualityConstraint.prototype.execute):
2886         (Variable):
2887         (Variable.prototype.addConstraint):
2888         (Variable.prototype.removeConstraint):
2889         (Planner):
2890         (Planner.prototype.incrementalAdd):
2891         (Planner.prototype.incrementalRemove):
2892         (Planner.prototype.newMark):
2893         (Planner.prototype.makePlan):
2894         (Planner.prototype.extractPlanFromConstraints):
2895         (Planner.prototype.addPropagate):
2896         (Planner.prototype.removePropagateFrom):
2897         (Planner.prototype.addConstraintsConsumingTo):
2898         (Plan):
2899         (Plan.prototype.addConstraint):
2900         (Plan.prototype.size):
2901         (Plan.prototype.constraintAt):
2902         (Plan.prototype.execute):
2903         (chainTest):
2904         (projectionTest):
2905         (change):
2906         (deltaBlue):
2907         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2908         (assert):
2909         (Numbers):
2910         (Numbers.prototype.next):
2911         (return.Transpose):
2912         (return.Transpose.prototype.next):
2913         (transpose):
2914         (verifyEven):
2915         (verifyString):
2916         (foo):
2917         (runIterators):
2918         * microbenchmarks/try-catch-word-count.js: Added.
2919         (let.assert):
2920         (EOF):
2921         (let.texts):
2922         (let.o.apply):
2923         (foo):
2924         (bar):
2925         (f):
2926         (run):
2927         (test1):
2928         (test2):
2929         (test3):
2930         (fn):
2931         (A):
2932         (B):
2933         (A.prototype.getValue):
2934         (B.prototype.getParentValue):
2935         (strlen):
2936         (sum.0):
2937         (test):
2938         (result.test.o):
2939         (set add.set add):
2940         (set forEach):
2941         (stringHash):
2942         (set if):
2943         (testFunction):
2944         (set delete.set has.set add):
2945         * stress/catch-set-argument-speculation-failure.js: Added.
2946         (o):
2947         (e):
2948         (e2):
2949         (escape):
2950         (baz):
2951         (noInline.run):
2952         (noInline):
2953         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2954         (foo):
2955         (e):
2956         (baz):
2957         (bar):
2958
2959 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2960
2961         [JSC] Optimize Map iteration with intrinsic
2962         https://bugs.webkit.org/show_bug.cgi?id=174355
2963
2964         Reviewed by Saam Barati.
2965
2966         * stress/map-iterator-result-should-have-expected-shape.js: Added.
2967         (shouldBe):
2968         (throw.new.Error):
2969         * stress/set-iterator-result-should-have-expected-shape.js: Added.
2970         (shouldBe):
2971         (throw.new.Error.let.iterator.set Symbol):
2972         (throw.new.Error.set add):
2973         (let.iterator.set Symbol):
2974
2975 2017-08-23  Robin Morisset  <rmorisset@apple.com>
2976
2977         Add a micro-benchmark for checking that accessing a variable within a 'with'
2978         block does not automatically prevent type prediction.
2979         https://bugs.webkit.org/show_bug.cgi?id=175738
2980
2981         Reviewed by Saam Barati.
2982
2983         * stress/with_and_arith.js: Added.
2984         (with):
2985
2986 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
2987
2988         [ESNext] Async iteration - Implement Async Generator - runtime
2989         https://bugs.webkit.org/show_bug.cgi?id=175240
2990
2991         Reviewed by Yusuke Suzuki.
2992
2993         * stress/async-iteration-async-from-sync.js: Added.
2994         (assert):
2995         (const.Logger):
2996         (this.fullfilled):
2997         (this.fullfilledDone):
2998         (this.rejected):
2999         (this.catched):
3000         (this.isFinal):
3001         (_assertLogger):
3002         (const.assertLogger):
3003         (const.getPromise.promiseHolder.return.new.Promise):
3004         (foo):
3005         (async.boo):
3006         (bar):
3007         (async.baz):
3008         (async.goo):
3009         * stress/async-iteration-basic.js: Added.
3010         (assert):
3011         (const.Logger):
3012         (this.fullfilled):
3013         (this.fullfilledDone):
3014         (this.rejected):
3015         (this.catched):
3016         (this.isFinal):
3017         (_assertLogger):
3018         (const.assertLogger):
3019         (const.getPromise.promiseHolder.return.new.Promise):
3020         (async.generator):
3021         (iterator.next.then):
3022         (async.baz):
3023         (async.boo):
3024         (async.foo):
3025         (async.goo):
3026         (A.prototype.async.foo):
3027         (A.prototype.async.boo):
3028         (A):
3029         (asyncGenExp.async):
3030         (async.joo):
3031         (j.next.then):
3032         (then):
3033         (async.koo):
3034         (async.loo):
3035         (async.moo):
3036         (async.noo):
3037         (async.ooo):
3038         (async.roo):
3039         (async.poo):
3040         (async.soo):
3041         (async.too):
3042         * stress/async-iteration-evaluation.js: Added.
3043         (assert):
3044         (async.foo):
3045         (catch):
3046         * stress/async-iteration-syntax.js:
3047         * stress/async-iteration-yield-promise.js: Added.
3048         (assert):
3049         (const.Logger):
3050         (this.fullfilled):
3051         (this.fullfilledDone):
3052         (this.rejected):
3053         (this.catched):
3054         (this.isFinal):
3055         (_assertLogger):
3056         (const.assertLogger):
3057         (const.getPromise.promiseHolder.return.new.Promise):
3058         (async.foo):
3059         (async.boo):
3060         (async.bar):
3061         * stress/async-iteration-yield-star-interface.js: Added.
3062         (assert):
3063         (const.getPromise.promiseHolder.return.new.Promise):
3064         (const.Logger):
3065         (this.fullfilled):
3066         (this.fullfilledDone):
3067         (this.rejected):
3068         (this.catched):
3069         (this.custom):
3070         (this.isFinal):
3071         (_assertLogger):
3072         (const.assertLogger):
3073         (let.asyncIter.Symbol.asyncIterator):
3074         (let.asyncIter.next):
3075         (let.asyncIter.throw):
3076         (let.asyncIter.return):
3077         (async.foo):
3078         (asyncIter.Symbol.asyncIterator):
3079         (asyncIter.next):
3080         (async.boo):
3081         (asyncIter.return):
3082         (async.bar):
3083         (async.baz):
3084         (async.foobar):
3085         * stress/async-iteration-yield-star.js: Added.
3086         (assert):
3087         (const.Logger):
3088         (this.fullfilled):
3089         (this.fullfilledDone):
3090         (this.rejected):
3091         (this.catched):
3092         (this.custom):
3093         (this.isFinal):
3094         (_assertLogger):
3095         (const.assertLogger):
3096         (const.getPromise.promiseHolder.return.new.Promise):
3097         (async.foo):
3098         (async.boo):
3099         (async.bar):
3100         (async.baz):
3101         (async.joo):
3102         (async.goo):
3103         (async.koo):
3104         (async.loo):
3105         (let.asyncIter.Symbol.asyncIterator):
3106         (let.asyncIter.next):
3107         (let.asyncIter.throw):
3108         (let.asyncIter.return):
3109         (async.moo):
3110         (async.noo):
3111         * test262.yaml:
3112
3113 2017-08-23  JF Bastien  <jfbastien@apple.com>
3114
3115         Fix printing in test
3116
3117         Unreviewed: fixing verbosity, shouldn't have been there.
3118
3119         * wasm/regress/175693.js:
3120         (else.else):
3121         (catch):
3122
3123 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
3124
3125         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
3126         https://bugs.webkit.org/show_bug.cgi?id=172543
3127
3128         Unreviewed test gardening.
3129
3130         * microbenchmarks/generator-with-several-types.js:
3131
3132 2017-08-17  JF Bastien  <jfbastien@apple.com>
3133
3134         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
3135         https://bugs.webkit.org/show_bug.cgi?id=175693
3136         <rdar://problem/33952443>
3137
3138         Reviewed by Saam Barati.
3139
3140         Add a regression directory for WebAssembly tests.
3141
3142         * wasm.yaml:
3143         * wasm/regress/175693.js: Added.
3144         (else.else):
3145         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
3146         (catch):
3147         * wasm/regress/175693.wasm: Added.
3148
3149 2017-08-15  Robin Morisset  <rmorisset@apple.com>
3150
3151         Support the 'with' keyword in FTL.
3152         https://bugs.webkit.org/show_bug.cgi?id=175585
3153
3154         Reviewed by Saam Barati.
3155
3156         Also improve the JSTest/stress/with.js file to test
3157         what happens when non-objects are passed to with.
3158
3159         * stress/with.js:
3160         (foo):
3161         (i.catch):
3162         (i.with): Deleted.
3163
3164 2017-08-14  Keith Miller  <keith_miller@apple.com>
3165
3166         Add testing tool to lie to the DFG about profiles
3167         https://bugs.webkit.org/show_bug.cgi?id=175487
3168
3169         Reviewed by Saam Barati.
3170
3171         * stress/compare-eq-incomplete-profile.js: Added.
3172         (const.test.createBuiltin):
3173
3174 2017-08-14  Robin Morisset  <rmorisset@apple.com>
3175
3176         Support the with keyword in DFG
3177         https://bugs.webkit.org/show_bug.cgi?id=175470
3178
3179         Reviewed by Saam Barati.
3180
3181         Added a new stress-test for the 'with' keyword, that caught a bug in a
3182         previous version of this code.
3183
3184         * stress/with.js: Added.
3185         (i.with):
3186
3187 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
3188
3189         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
3190         https://bugs.webkit.org/show_bug.cgi?id=175544
3191
3192         Unreviewed test gardening.
3193
3194         * ChakraCore.yaml:
3195
3196 2017-08-09  Caitlin Potter  <caitp@igalia.com>
3197
3198         Early error on ANY operator before new.target
3199         https://bugs.webkit.org/show_bug.cgi?id=157970
3200
3201         Reviewed by Saam Barati.
3202
3203         Instead of throwing if any unary operator precedes new.target, only
3204         throw if the unary operator updates the reference.
3205
3206         The following become legal in JSC:
3207
3208         ```
3209         !new.target
3210         ~new.target
3211         typeof new.target
3212         delete new.target
3213         void new.target
3214         ```
3215
3216         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
3217
3218         * stress/new-target-syntax-errors.js:
3219         * stress/new-target.js:
3220
3221 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
3222
3223         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
3224         https://bugs.webkit.org/show_bug.cgi?id=175255
3225
3226         Unreviewed test gardening.
3227
3228         * stress/regress-169783.js:
3229         * wasm/stress/oom.js:
3230
3231 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
3232
3233         REGRESSION: 2 test262/test/language/statements/async-function failures
3234         https://bugs.webkit.org/show_bug.cgi?id=175334
3235
3236         Reviewed by Yusuke Suzuki.
3237
3238         Add @skip parameters to tests, and remove test for async iterator from 
3239         async await syntax test because it is already covered by async-iterator-syntax.js
3240
3241         * stress/async-await-syntax.js:
3242         * stress/async-iteration-syntax.js:
3243
3244 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3245
3246         Unreviewed, gardening test262 for Promise resolve / reject function length
3247         https://bugs.webkit.org/show_bug.cgi?id=175333
3248
3249         * test262.yaml:
3250
3251 2017-08-07  Robin Morisset  <rmorisset@apple.com>
3252
3253         GetOwnProperty of TypedArray indexed fields is wrongly configurable
3254         https://bugs.webkit.org/show_bug.cgi?id=175307
3255
3256         Reviewed by Saam Barati.
3257
3258         * stress/typedarray-getownproperty-not-configurable.js: Added.
3259         (assert):
3260         (foo):
3261
3262 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
3263
3264         Promise resolve and reject function should have length = 1
3265         https://bugs.webkit.org/show_bug.cgi?id=175242
3266
3267         Reviewed by Saam Barati.
3268
3269         * stress/builtin-function-length.js: Added.
3270         (shouldBe):
3271         (shouldThrow):
3272         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3273         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3274
3275 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
3276
3277         [ESNext] Async iteration - Implement Async Generator - parser
3278         https://bugs.webkit.org/show_bug.cgi?id=175210
3279
3280         Reviewed by Yusuke Suzuki.
3281
3282         * stress/async-await-syntax.js:
3283         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
3284         * stress/async-iteration-syntax.js: Added.
3285         (assert):
3286         (checkSyntax):
3287         (checkSyntaxError):
3288         (checkSimpleAsyncGeneratorSloppyMode):
3289         (checkSimpleAsyncGeneratorStrictMode):
3290         (checkNestedAsyncGenerators):
3291         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3292         * stress/generator-class-methods-syntax.js:
3293
3294 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3295
3296         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
3297         https://bugs.webkit.org/show_bug.cgi?id=175150
3298
3299         Unreviewed test gardening.
3300
3301         * wasm/js-api/test_memory_constructor.js:
3302
3303 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3304
3305         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
3306         https://bugs.webkit.org/show_bug.cgi?id=175100
3307
3308         Reviewed by Mark Lam.
3309
3310         The JSC test JSTests/wasm/stress/oom.js tries to use all the
3311         available memory until an out of memory exception happens.
3312
3313         The Linux kernel is more tuned for server workloads than for GUI
3314         responsiveness. When a process tries to use a lot of memory, Linux
3315         will do its best to serve the request. This usually translates to
3316         free physical RAM by writing to disk dirty pages and/or moving out
3317         less recently used pages to swap (disk storage).
3318         Meanwhile it does this, the system will become unresponsive and this
3319         leads to freezes that can last even some minutes on the worst cases.
3320
3321         Therefore, let's skip this test on Linux as it will cause more harm
3322         than good on the Linux bots or on the machines of Linux developers.
3323
3324         * wasm/stress/oom.js:
3325
3326 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
3327
3328         [JSC] Remove unnecessary print from stress\promise-finally.js test
3329         https://bugs.webkit.org/show_bug.cgi?id=175015
3330
3331         Reviewed by Yusuke Suzuki.
3332
3333         * stress/promise-finally.js:
3334         (p.finally):
3335         (then):
3336
3337 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3338
3339         Unreviewed, update test262 results for optional catch binding
3340
3341         * test262.yaml:
3342
3343 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3344
3345         [JSC] Support optional catch binding
3346         https://bugs.webkit.org/show_bug.cgi?id=174981
3347
3348         Reviewed by Saam Barati.
3349
3350         * stress/optional-catch-binding-syntax.js: Added.
3351         (testSyntax):
3352         (testSyntaxError):
3353         (catch.catch):
3354         * stress/optional-catch-binding.js: Added.
3355         (shouldBe):
3356         (throwException):
3357
3358 2017-07-28  Mark Lam  <mark.lam@apple.com>
3359
3360         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
3361         https://bugs.webkit.org/show_bug.cgi?id=174948
3362         <rdar://problem/33495680>
3363
3364         Reviewed by Filip Pizlo.
3365
3366         * stress/regress-174948.js: Added.
3367
3368 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
3369
3370         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
3371         https://bugs.webkit.org/show_bug.cgi?id=174900
3372
3373         Reviewed by Saam Barati.
3374
3375         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
3376         (sideEffect):
3377         (args):
3378         (test):
3379
3380 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3381
3382         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
3383         https://bugs.webkit.org/show_bug.cgi?id=171637
3384
3385         Reviewed by Darin Adler.
3386
3387         * stress/domjit-getter-complex-with-incorrect-object.js:
3388         (i.shouldThrow):
3389         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
3390         (shouldBe):
3391         (i.shouldThrow):
3392
3393 2017-07-26  JF Bastien  <jfbastien@apple.com>
3394
3395         WebAssembly: test throwing out of the start function
3396         https://bugs.webkit.org/show_bug.cgi?id=165714
3397         <rdar://problem/29760251>
3398
3399         Reviewed by Keith Miller.
3400
3401         * wasm/assert.js:
3402         * wasm/function-tests/trap-from-start.js: Added.
3403         (StartTraps):
3404         * wasm/function-tests/trap-from-start-async.js: Added.
3405         (async.StartTrapsAsync):
3406
3407 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3408
3409         [FTL] Arguments elimination is suppressed by unreachable blocks
3410         https://bugs.webkit.org/show_bug.cgi?id=174352
3411
3412         Reviewed by Filip Pizlo.
3413
3414         * stress/arguments-elimination-force-exit.js: Added.
3415         (shouldBe):
3416         (strict):
3417         (sloppy):
3418         * stress/arguments-elimination-throw.js: Added.
3419         (shouldBe):
3420         (shouldThrow):
3421         (sloppy):
3422         (isArguments):
3423
3424 2017-07-13  Mark Lam  <mark.lam@apple.com>
3425
3426         Add some additional test cases for bug 170896.
3427         https://bugs.webkit.org/show_bug.cgi?id=174491
3428
3429         Reviewed by Filip Pizlo.
3430
3431         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
3432         * stress/regress-170896-with-double-shape-profile.js: Added.
3433         (test):
3434         * stress/regress-170896-with-int32-shape-profile.js: Added.
3435         (test):
3436         * stress/regress-170896.js: Removed.
3437
3438 2017-07-13  Saam Barati  <sbarati@apple.com>
3439
3440         Missing exception check in JSObject::hasInstance
3441         https://bugs.webkit.org/show_bug.cgi?id=174455
3442         <rdar://problem/31384608>
3443
3444         Reviewed by Mark Lam.
3445
3446         * stress/has-instance-exception-check.js: Added.
3447         (assert):
3448         (let.getter.Object.getOwnPropertyDescriptor.get foo):
3449
3450 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
3451
3452         [ESnext] Implement Object Spread
3453         https://bugs.webkit.org/show_bug.cgi?id=167963
3454
3455         Reviewed by Saam Barati.
3456
3457         * stress/obj-rest-destructuring-order.js: Added.
3458         (assert):
3459         (o.get z):
3460         (o.get a):
3461         * stress/obj-spread-order.js: Added.
3462         (assert):
3463         (o.get z):
3464         (o.get a):
3465         * stress/object-spread.js: Added.
3466         (let.assert):
3467         (assert.sameValue):
3468         (let.o.get a):
3469         (let.obj.get c):
3470         (cthulhu.get x):
3471         (let.obj.set c):
3472         (calls.o.get z):
3473         (calls.o.get a):
3474         (try.let.obj.get foo):
3475         (get calls):
3476
3477 2017-07-12  Saam Barati  <sbarati@apple.com>
3478
3479         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
3480         https://bugs.webkit.org/show_bug.cgi?id=174411
3481         <rdar://problem/31696186>
3482
3483         Reviewed by Mark Lam.
3484
3485         * stress/generic-arguments-correct-delete-behavior.js: Added.
3486         (assert):
3487         (makeTest):
3488
3489 2017-07-07  Mark Lam  <mark.lam@apple.com>
3490
3491         \n\r is not the same as \r\n.
3492         https://bugs.webkit.org/show_bug.cgi?id=173053
3493
3494         Reviewed by Keith Miller.
3495
3496         * stress/regress-173053.js: Added.
3497         * stress/template-literal-line-terminators.js:
3498
3499 2017-07-06  Saam Barati  <sbarati@apple.com>
3500
3501         We are missing places where we invalidate the for-in context
3502         https://bugs.webkit.org/show_bug.cgi?id=174184
3503
3504         Reviewed by Geoffrey Garen.
3505
3506         * stress/for-in-invalidate-context-weird-assignments.js: Added.
3507         (assert):
3508         (test):
3509
3510 2017-07-05  Saam Barati  <sbarati@apple.com>
3511
3512         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
3513         https://bugs.webkit.org/show_bug.cgi?id=174188
3514         <rdar://problem/30581423>
3515
3516         Reviewed by Mark Lam.
3517
3518         * stress/new-array-having-a-bad-time-double.js: Added.
3519         (assert):
3520         (foo):
3521
3522 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
3523
3524         WTF::StringImpl::copyChars segfaults when built with GCC 7
3525         https://bugs.webkit.org/show_bug.cgi?id=173407
3526
3527         Reviewed by Andreas Kling.
3528
3529         * stress/string-repeat-copy-chars-crash.js: Added.
3530         (shouldBe):
3531
3532 2017-07-03  Saam Barati  <sbarati@apple.com>
3533
3534         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
3535
3536         * stress/unshiftCountSlowCase-correct-postCapacity.js:
3537
3538 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3539
3540         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
3541
3542         It requires too much memory.
3543
3544         * stress/dont-reserve-huge-capacity-lexer.js:
3545
3546 2017-06-30  Michael Saboff  <msaboff@apple.com>
3547
3548         Skip a test on ARM64 platform since we run out of address space.
3549
3550         Rubber stamped by Saam Barati.
3551
3552         * stress/dont-reserve-huge-capacity-lexer.js:
3553
3554 2017-06-30  Michael Saboff  <msaboff@apple.com>
3555
3556         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
3557         https://bugs.webkit.org/show_bug.cgi?id=174044
3558
3559         Reviewed by Oliver Hunt.
3560
3561         New regression test.
3562
3563         * stress/regress-174044.js: Added.
3564         (test1):
3565         (test2):
3566
3567 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
3568
3569         RegExpCachedResult::setInput should reify left and right contexts
3570         https://bugs.webkit.org/show_bug.cgi?id=173818
3571
3572         Reviewed by Keith Miller.
3573
3574         * stress/right-left-context-invalidated-by-input.js: Added.
3575         (test.validateContexts):
3576         (test):
3577
3578 2017-06-29  Saam Barati  <sbarati@apple.com>
3579
3580         Calculating postCapacity in unshiftCountSlowCase is wrong
3581         https://bugs.webkit.org/show_bug.cgi?id=173992
3582         <rdar://problem/32283199>
3583
3584         Reviewed by Keith Miller.
3585
3586         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
3587         (temp):
3588
3589 2017-06-29  Commit Queue  <commit-queue@webkit.org>
3590
3591         Unreviewed, rolling out r218512.
3592         https://bugs.webkit.org/show_bug.cgi?id=173981
3593
3594         "It changes the behavior of the JS API's JSEvaluateScript
3595         which breaks TurboTax" (Requested by saamyjoon on #webkit).
3596
3597         Reverted changeset:
3598
3599         "test262: Completion values for control flow do not match the
3600         spec"
3601         https://bugs.webkit.org/show_bug.cgi?id=171265
3602         http://trac.webkit.org/changeset/218512
3603
3604 2017-06-27  JF Bastien  <jfbastien@apple.com>
3605
3606         WebAssembly: running out of executable memory should throw OoM
3607         https://bugs.webkit.org/show_bug.cgi?id=171537
3608         <rdar://problem/32963338>
3609
3610         Reviewed by Saam Barati.
3611
3612         * wasm.yaml:
3613         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
3614         (const.invoke):
3615         (failCount.0.catch):
3616         (failCount.0.module.undefined.catch):
3617         * wasm/lowExecutableMemory/exports-oom.js: Added.
3618         (const.type):
3619         (const.params):
3620         (const.randomProgram):
3621         (failCount.0.catch):
3622         (failCount.0.module.undefined.catch):
3623         * wasm/lowExecutableMemory/imports-oom.js: Added.
3624         (const.type):
3625         (const.params):
3626         (const.randomProgram):
3627         (f.imports.push):
3628         (failCount.0.catch):
3629         (failCount.0.module.undefined.catch):
3630
3631 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
3632
3633         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
3634         https://bugs.webkit.org/show_bug.cgi?id=167962
3635
3636         Reviewed by Saam Barati.
3637
3638         * stress/object-rest-deconstruct.js: Added.
3639         (let.assert):
3640         (let.assertPropDescriptor):
3641         (catch):
3642         (get 3):
3643         (foo):
3644         (let.src.get y):
3645         (let.src.set y):
3646         (let.gen):
3647
3648 2017-06-27  Saam Barati  <sbarati@apple.com>
3649
3650         Function constructor needs to follow the spec and validate parameters and body independently
3651         https://bugs.webkit.org/show_bug.cgi?id=173303
3652         <rdar://problem/32732526>
3653
3654         Reviewed by Keith Miller.
3655
3656         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
3657         * stress/function-constructor-semantics.js: Added.
3658         (assert):
3659         (hasSyntaxError):
3660         (foo):
3661         (async.foo):
3662         (testError):
3663         (testOK.toString):
3664         (toString):
3665
3666 2017-06-26  Saam Barati  <sbarati@apple.com>
3667
3668         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
3669         https://bugs.webkit.org/show_bug.cgi?id=173740
3670
3671         Reviewed by Mark Lam.
3672
3673         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
3674         (Array.prototype.Symbol.iterator):
3675
3676 2017-06-26  Saam Barati  <sbarati@apple.com>
3677
3678         Skip a test on 32-bit platforms since we run out of address space.
3679
3680         Rubber stamped by Mark Lam.
3681
3682         * stress/dont-reserve-huge-capacity-lexer.js:
3683
3684 2017-06-26  Saam Barati  <sbarati@apple.com>
3685
3686         Crash in JSC::Lexer<unsigned char>::setCode
3687         https://bugs.webkit.org/show_bug.cgi?id=172754
3688
3689         Reviewed by Mark Lam.
3690
3691         * stress/dont-reserve-huge-capacity-lexer.js: Added.
3692         (catch):
3693
3694 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3695
3696         [JSC] Clean up Object.entries implementation
3697         https://bugs.webkit.org/show_bug.cgi?id=173759
3698
3699         Reviewed by Sam Weinig.
3700
3701         * microbenchmarks/object-entries.js: Added.
3702         (test):
3703
3704 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
3705
3706         Remove Reflect.enumerate
3707         https://bugs.webkit.org/show_bug.cgi?id=173806
3708
3709         Reviewed by Yusuke Suzuki.
3710
3711         * ChakraCore.yaml:
3712         * es6.yaml:
3713         These tests now fail because they use Reflect.enumerate.
3714
3715         * test262.yaml:
3716         This test now passes, it checked that Reflect.enumerate is undefined!
3717
3718         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
3719         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
3720
3721         * stress/reflect-enumerate.js: Removed.
3722         Remove a test solely for Reflect.enumerate.
3723
3724 2017-06-22  Saam Barati  <sbarati@apple.com>
3725
3726         ValueRep(DoubleRep(@v)) can not simply convert to @v
3727         https://bugs.webkit.org/show_bug.cgi?id=173687
3728         <rdar://problem/32855563>
3729
3730         Reviewed by Mark Lam.
3731
3732         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
3733         (i.catch):
3734
3735 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
3736
3737