Unreviewed, rolling out r226937.
[WebKit-https.git] / JSTests / ChangeLog
1 2018-01-16  Ryan Haddad  <ryanhaddad@apple.com>
2
3         Unreviewed, rolling out r226937.
4
5         Tests added with this change are failing due to a missing
6         exception check.
7
8         Reverted changeset:
9
10         "[JSC] NumberPrototype::extractRadixFromArgs incorrectly cast
11         double to int32_t"
12         https://bugs.webkit.org/show_bug.cgi?id=181182
13         https://trac.webkit.org/changeset/226937
14
15 2018-01-13  Caio Lima  <ticaiolima@gmail.com>
16
17         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
18         https://bugs.webkit.org/show_bug.cgi?id=181182
19
20         Reviewed by Darin Adler.
21
22         * bigIntTests.yaml:
23         * stress/big-int-constructor.js:
24         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
25         (assert):
26         (assertThrowRangeError):
27         * stress/number-prototype-to-string-cast-overflow.js: Added.
28         (assert):
29         (assertThrowRangeError):
30
31 2018-01-12  Saam Barati  <sbarati@apple.com>
32
33         CheckStructure can be incorrectly subsumed by CheckStructureOrEmpty
34         https://bugs.webkit.org/show_bug.cgi?id=181177
35         <rdar://problem/36205704>
36
37         Reviewed by Yusuke Suzuki.
38
39         * stress/check-structure-ir-ensures-empty-does-not-flow-through.js: Added.
40         (runNearStackLimit.t):
41         (runNearStackLimit):
42         (test.f):
43         (test):
44
45 2018-01-12  Saam Barati  <sbarati@apple.com>
46
47         Each variant of a polymorphic inlined call should be exitOK at the top of the block
48         https://bugs.webkit.org/show_bug.cgi?id=181562
49         <rdar://problem/36445624>
50
51         Reviewed by Yusuke Suzuki.
52
53         * stress/each-block-at-top-of-polymorphic-call-inlining-should-be-exitOK.js: Added.
54         (f):
55         (foo):
56
57 2018-01-11  Saam Barati  <sbarati@apple.com>
58
59         When inserting Unreachable in byte code parser we need to flush all the right things
60         https://bugs.webkit.org/show_bug.cgi?id=181509
61         <rdar://problem/36423110>
62
63         Reviewed by Mark Lam.
64
65         * stress/proper-flushing-when-we-insert-unreachable-after-force-exit-in-bytecode-parser.js: Added.
66
67 2018-01-11  Saam Barati  <sbarati@apple.com>
68
69         JITMathIC code in the FTL is wrong when code gets duplicated
70         https://bugs.webkit.org/show_bug.cgi?id=181525
71         <rdar://problem/36351993>
72
73         Reviewed by Michael Saboff and Keith Miller.
74
75         * stress/allow-math-ic-b3-code-duplication.js: Added.
76
77 2018-01-11  Saam Barati  <sbarati@apple.com>
78
79         Our for-in caching is wrong when we add indexed properties on things in the prototype chain
80         https://bugs.webkit.org/show_bug.cgi?id=181508
81
82         Reviewed by Yusuke Suzuki.
83
84         * stress/for-in-prototype-with-indexed-properties-should-prevent-caching.js: Added.
85         (assert):
86         (test1.foo):
87         (test1):
88         (test2.foo):
89         (test2):
90
91 2018-01-09  Mark Lam  <mark.lam@apple.com>
92
93         ASSERTION FAILED: pair.second->m_type & PropertyNode::Getter
94         https://bugs.webkit.org/show_bug.cgi?id=181388
95         <rdar://problem/36349351>
96
97         Reviewed by Saam Barati.
98
99         * stress/regress-181388.js: Added.
100
101 2018-01-08  JF Bastien  <jfbastien@apple.com>
102
103         WebAssembly: mask indexed accesses to Table
104         https://bugs.webkit.org/show_bug.cgi?id=181412
105         <rdar://problem/36363236>
106
107         Reviewed by Saam Barati.
108
109         Update error messages.
110
111         * wasm/js-api/table.js:
112         (assert.throws.WebAssembly.Table.prototype.grow):
113
114 2018-01-08  Ryan Haddad  <ryanhaddad@apple.com>
115
116         Disable SharedArrayBuffer tests missed in r226386.
117         https://bugs.webkit.org/show_bug.cgi?id=181266
118
119         Unreviewed test gardening.
120
121         * test262.yaml:
122
123 2018-01-06  Yusuke Suzuki  <utatane.tea@gmail.com>
124
125         Object.getOwnPropertyNames includes "arguments" and "caller" for bound functions
126         https://bugs.webkit.org/show_bug.cgi?id=181321
127
128         Reviewed by Saam Barati.
129
130         * stress/bound-function-does-not-have-caller-and-arguments.js: Added.
131         (shouldBe):
132         (testFunction):
133         * test262.yaml:
134
135 2018-01-05  Ryan Haddad  <ryanhaddad@apple.com>
136
137         Unreviewed, attempt to fix test262 after r226386.
138
139         * test262.yaml:
140
141 2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>
142
143         [DFG] Define defs for MapSet/SetAdd to participate in CSE
144         https://bugs.webkit.org/show_bug.cgi?id=179911
145
146         Reviewed by Saam Barati.
147
148         In addition to these tests, map-set-cse.js and set-add-cse.js work.
149
150         * stress/map-set-change-get.js: Added.
151         (shouldBe):
152         (test):
153         * stress/map-set-create-bucket.js: Added.
154         (shouldBe):
155         (test):
156         * stress/set-add-create-bucket.js: Added.
157         (shouldBe):
158
159 2018-01-03  Michael Saboff  <msaboff@apple.com>
160
161         Disable SharedArrayBuffers from Web API
162         https://bugs.webkit.org/show_bug.cgi?id=181266
163
164         Reviewed by Saam Barati.
165
166         Disabled SharedArrayBuffer tests.
167
168         * stress/SharedArrayBuffer-opt.js:
169         * stress/SharedArrayBuffer.js:
170         * stress/array-buffer-byte-length.js:
171         * stress/atomics-add-uint32.js:
172         * stress/atomics-known-int-use.js:
173         * stress/atomics-neg-zero.js:
174         * stress/atomics-store-return.js:
175         * stress/lars-sab-workers.js:
176         * stress/regress-159779-1.js:
177         * stress/regress-159779-2.js:
178         * stress/regress-170473.js:
179         * test262.yaml:
180
181 2018-01-03  Caio Lima  <ticaiolima@gmail.com>
182
183         [ESNext][BigInt] Failing test stress/big-int-constructor-oom.js into MIPS
184         https://bugs.webkit.org/show_bug.cgi?id=181258
185
186         Reviewed by Antonio Gomes.
187
188         * stress/big-int-constructor-gc.js:
189         * stress/big-int-constructor-oom.js:
190
191 2018-01-03  Robin Morisset  <rmorisset@apple.com>
192
193         Inlining of a function that ends in op_unreachable crashes
194         https://bugs.webkit.org/show_bug.cgi?id=181027
195
196         Reviewed by Filip Pizlo.
197
198         * stress/inlining-unreachable.js: Added.
199         (bar):
200         (baz):
201         (i.catch):
202
203 2018-01-02  Saam Barati  <sbarati@apple.com>
204
205         Incorrect assertion inside AccessCase
206         https://bugs.webkit.org/show_bug.cgi?id=181200
207         <rdar://problem/35494754>
208
209         Reviewed by Yusuke Suzuki.
210
211         * stress/setter-same-base-and-rhs-invalid-assertion-inside-access-case.js: Added.
212         (ctor):
213         (theFunc):
214         (run):
215
216 2018-01-02  Caio Lima  <ticaiolima@gmail.com>
217
218         [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
219         https://bugs.webkit.org/show_bug.cgi?id=175359
220
221         Reviewed by Yusuke Suzuki.
222
223         * bigIntTests.yaml:
224         * stress/big-int-as-key.js: Added.
225         * stress/big-int-constructor-gc.js: Added.
226         * stress/big-int-constructor-oom.js: Added.
227         * stress/big-int-constructor-properties.js: Added.
228         * stress/big-int-constructor-prototype-prop-descriptor.js: Added.
229         * stress/big-int-constructor-prototype.js: Added.
230         * stress/big-int-constructor.js: Added.
231         * stress/big-int-function-apply.js:
232         * stress/big-int-length.js: Added.
233         * stress/big-int-prop-descriptor.js: Added.
234         * stress/big-int-proto-constructor.js: Added.
235         * stress/big-int-proto-name.js: Added.
236         * stress/big-int-prototype-properties.js: Added.
237         * stress/big-int-prototype-proto.js: Added.
238         * stress/big-int-prototype-value-of.js: Added.
239         * stress/big-int-prototype-symbol-to-string-tag.js: Added.
240         * stress/big-int-prototype-to-string-apply.js: Added.
241         * stress/big-int-to-object.js: Added.
242         * stress/big-int-to-string.js: Added.
243
244 2017-12-28  Saam Barati  <sbarati@apple.com>
245
246         Assertion used to determine if something is an async generator is wrong
247         https://bugs.webkit.org/show_bug.cgi?id=181168
248         <rdar://problem/35640560>
249
250         Reviewed by Yusuke Suzuki.
251
252         * stress/async-generator-assertion.js: Added.
253
254 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
255
256         Skip stress/splay-flash-access tests on memory limited platforms
257         https://bugs.webkit.org/show_bug.cgi?id=181086
258
259         Reviewed by Carlos Alberto Lopez Perez.
260
261         These tests use about 185M of memory, and occasionally get OOM-killed
262         on memory limited platforms.
263
264         * stress/splay-flash-access-1ms.js:
265         * stress/splay-flash-access.js:
266
267 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
268
269         Skip slow jsc tests on embedded platforms
270         https://bugs.webkit.org/show_bug.cgi?id=180937
271
272         Reviewed by Carlos Alberto Lopez Perez.
273
274         The tests typeProfiler/deltablue-for-of.js and
275         typeProfiler/getter-richards.js take a very long time in the
276         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
277         thus always timeout. They should be skipped on these platforms.
278
279         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
280         * typeProfiler/getter-richards.js: Skip on arm*/mips.
281
282 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
283
284         [JSC] Do not check isValid() in op_new_regexp
285         https://bugs.webkit.org/show_bug.cgi?id=180970
286
287         Reviewed by Saam Barati.
288
289         * stress/regexp-syntax-error-invalid-flags.js: Added.
290         (shouldThrow):
291
292 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
293
294         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
295         https://bugs.webkit.org/show_bug.cgi?id=180712
296
297         Reviewed by Michael Catanzaro.
298
299         stress/call-apply-exponential-bytecode-size.js crashes if the
300         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
301         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
302         should skip the test on other platforms.
303
304         * stress/call-apply-exponential-bytecode-size.js:
305
306 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
307
308         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
309         https://bugs.webkit.org/show_bug.cgi?id=179762
310
311         Reviewed by Saam Barati.
312
313         * stress/call-varargs-double-new-array-buffer.js: Added.
314         (assert):
315         (bar):
316         (foo):
317         * stress/call-varargs-spread-new-array-buffer.js: Added.
318         (assert):
319         (bar):
320         (foo):
321         * stress/call-varargs-spread-new-array-buffer2.js: Added.
322         (assert):
323         (bar):
324         (foo):
325         * stress/forward-varargs-double-new-array-buffer.js: Added.
326         (assert):
327         (test.baz):
328         (test.bar):
329         (test.foo):
330         (test):
331         * stress/new-array-buffer-sinking-osrexit.js: Added.
332         (target):
333         (test):
334         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
335         (shouldBe):
336         (test):
337         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
338         (shouldBe):
339         (target):
340         (test):
341         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
342         (assert):
343         (test1.bar):
344         (test1.foo):
345         (test1):
346         (test2.bar):
347         (test2.foo):
348         (test3.baz):
349         (test3.bar):
350         (test3.foo):
351         (test4.baz):
352         (test4.bar):
353         (test4.foo):
354         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
355         (assert):
356         (test.baz):
357         (test.bar):
358         (test.foo):
359         (test):
360         * stress/phantom-new-array-buffer-osr-exit.js: Added.
361         (assert):
362         (baz):
363         (bar):
364         (effects):
365         (foo):
366
367 2017-12-14  Saam Barati  <sbarati@apple.com>
368
369         The CleanUp after LICM is erroneously removing a Check
370         https://bugs.webkit.org/show_bug.cgi?id=180852
371         <rdar://problem/36063494>
372
373         Reviewed by Filip Pizlo.
374
375         * stress/dont-run-cleanup-after-licm.js: Added.
376
377 2017-12-14  Michael Saboff  <msaboff@apple.com>
378
379         REGRESSION (r225695): Repro crash on yahoo login page
380         https://bugs.webkit.org/show_bug.cgi?id=180761
381
382         Reviewed by JF Bastien.
383
384         New regression test.
385
386         * stress/regress-180761.js: Added.
387
388 2017-12-13  Keith Miller  <keith_miller@apple.com>
389
390         JSObjects should have a mask for loading indexed properties
391         https://bugs.webkit.org/show_bug.cgi?id=180768
392
393         Reviewed by Mark Lam.
394
395         * stress/int16-put-by-val-in-and-out-of-bounds.js:
396         (test):
397
398 2017-12-13  Saam Barati  <sbarati@apple.com>
399
400         Arrow functions need their own structure because they have different properties than sloppy functions
401         https://bugs.webkit.org/show_bug.cgi?id=180779
402         <rdar://problem/35814591>
403
404         Reviewed by Mark Lam.
405
406         * stress/arrow-function-needs-its-own-structure.js: Added.
407         (assert):
408         (readPrototype):
409         (noInline.let.f1):
410         (noInline):
411
412 2017-12-13  Saam Barati  <sbarati@apple.com>
413
414         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
415         https://bugs.webkit.org/show_bug.cgi?id=163579
416         <rdar://problem/35455798>
417
418         Reviewed by Mark Lam.
419
420         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
421         (assert):
422         (test1):
423         (i.test1):
424         (i.test1.C):
425         (i.test1.async.foo):
426         (i.test1.foo):
427         (test2):
428
429 2017-12-13  Saam Barati  <sbarati@apple.com>
430
431         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
432         https://bugs.webkit.org/show_bug.cgi?id=180734
433         <rdar://problem/35640547>
434
435         Reviewed by Yusuke Suzuki.
436
437         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
438         (__isPropertyOfType):
439         (__getProperties):
440         (__getObjects):
441         (__getRandomObject):
442         (theClass.):
443         (theClass):
444         (childClass):
445         (counter.catch):
446
447 2017-12-12  Saam Barati  <sbarati@apple.com>
448
449         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
450         https://bugs.webkit.org/show_bug.cgi?id=180725
451         <rdar://problem/35970511>
452
453         Reviewed by Michael Saboff.
454
455         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
456         (f1):
457         (f2):
458         (let.o2.valueOf):
459
460 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
461
462         [JSC] Implement optimized WeakMap and WeakSet
463         https://bugs.webkit.org/show_bug.cgi?id=179929
464
465         Reviewed by Saam Barati.
466
467         * microbenchmarks/weak-map-key.js:
468         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
469         (assert):
470         (objectKey):
471         (let.start.Date.now):
472         * stress/basic-weakmap.js: Added.
473         (shouldBe):
474         (test):
475         * stress/basic-weakset.js: Added.
476         (shouldBe):
477         (test.set new):
478         * stress/weakmap-cse-set-break.js: Added.
479         (shouldBe):
480         (test):
481         * stress/weakmap-cse.js: Added.
482         (shouldBe):
483         (test):
484         * stress/weakmap-gc.js: Added.
485         (test):
486         * stress/weakset-cse-add-break.js: Added.
487         (shouldBe):
488         (test.set new):
489         * stress/weakset-cse.js: Added.
490         (shouldBe):
491         (test.set new):
492         * stress/weakset-gc.js: Added.
493         (test.set add):
494         (test.set new):
495         (test):
496
497 2017-12-12  Saam Barati  <sbarati@apple.com>
498
499         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
500         https://bugs.webkit.org/show_bug.cgi?id=180723
501         <rdar://problem/35859726>
502
503         Reviewed by JF Bastien.
504
505         * stress/get-my-argument-by-val-constant-folding.js: Added.
506         (test):
507         (catch):
508
509 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
510
511         [ESNext][BigInt] Implement BigInt literals and JSBigInt
512         https://bugs.webkit.org/show_bug.cgi?id=179000
513
514         Reviewed by Darin Adler and Yusuke Suzuki.
515
516         * bigIntTests.yaml: Added.
517         * stress/big-int-literal-line-terminator.js: Added.
518         * stress/big-int-literals.js: Added.
519         * stress/big-int-operations-error.js: Added.
520         * stress/big-int-type-of.js: Added.
521         * stress/big-int-white-space-trailing-leading.js: Added.
522         * stress/big-int-function-apply.js: Added.
523
524 2017-12-11  Saam Barati  <sbarati@apple.com>
525
526         We need to disableCaching() in ErrorInstance when we materialize properties
527         https://bugs.webkit.org/show_bug.cgi?id=180343
528         <rdar://problem/35833002>
529
530         Reviewed by Mark Lam.
531
532         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
533         (assert):
534         (makeError):
535         (storeToStack):
536         (storeToStackAlreadyMaterialized):
537
538 2017-12-05  JF Bastien  <jfbastien@apple.com>
539
540         WebAssembly: don't eagerly checksum
541         https://bugs.webkit.org/show_bug.cgi?id=180441
542         <rdar://problem/35156628>
543
544         Reviewed by Saam Barati.
545
546         Checksum is now disabled, so tests only have <?> as the module
547         name.
548
549         * wasm/function-tests/nameSection.js:
550         * wasm/function-tests/stack-overflow.js:
551         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
552         (assertOverflows.assertThrows):
553         (assertOverflows):
554         * wasm/function-tests/stack-trace.js:
555
556 2017-12-04  JF Bastien  <jfbastien@apple.com>
557
558         Proxy all functions, except the $ objects
559         https://bugs.webkit.org/show_bug.cgi?id=180375
560
561         Reviewed by Saam Barati.
562
563         It looks like this test may have broken some executions because I
564         call some internal objects. Explicitly ignore objects whose name
565         starts with "$" because it's a bad idea anyways.
566
567         * stress/proxy-all-the-parameters.js:
568         (generateObjects):
569         (get throw):
570
571 2017-12-04  Saam Barati  <sbarati@apple.com>
572
573         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
574         https://bugs.webkit.org/show_bug.cgi?id=180366
575         <rdar://problem/35685877>
576
577         Reviewed by Michael Saboff.
578
579         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
580         (theParent):
581         (test1.base.getParentStaticValue):
582         (test1.base):
583         (test1.__v_24888.prototype.set prop):
584         (test1.__v_24888):
585         (test2.base.getParentStaticValue):
586         (test2.base):
587         (test2.__v_24888.prototype.set prop):
588         (test2.__v_24888):
589         (test2):
590
591 2017-12-01  JF Bastien  <jfbastien@apple.com>
592
593         Try proxying all function arguments
594         https://bugs.webkit.org/show_bug.cgi?id=180306
595
596         Reviewed by Saam Barati.
597
598         * stress/proxy-all-the-parameters.js: Added.
599         (isPropertyOfType):
600         (getProperties):
601         (generateObjects):
602         (getObjects):
603         (getFunctions):
604         (get throw):
605         (let.o.of.getObjects.let.f.of.getFunctions.catch):
606
607 2017-12-01  JF Bastien  <jfbastien@apple.com>
608
609         JavaScriptCore: missing exception checks in Math functions that take more than one argument
610         https://bugs.webkit.org/show_bug.cgi?id=180297
611         <rdar://problem/35745556>
612
613         Reviewed by Mark Lam.
614
615         * stress/math-exceptions.js: Added.
616         (get try):
617         (catch):
618
619 2017-12-01  JF Bastien  <jfbastien@apple.com>
620
621         JavaScriptCore: add test for weird class static getters
622         https://bugs.webkit.org/show_bug.cgi?id=180281
623         <rdar://problem/35592139>
624
625         Reviewed by Mark Lam.
626
627         I fixed a bug for it in r224927 and didn't add a test. Do so.
628
629         * stress/class-static-get-weird.js: Added.
630         (c.prototype.get name):
631         (c):
632         (c.prototype.get arguments):
633         (c.prototype.get caller):
634         (c.prototype.get length):
635
636 2017-12-01  Saam Barati  <sbarati@apple.com>
637
638         Having a bad time needs to handle ArrayClass indexing type as well
639         https://bugs.webkit.org/show_bug.cgi?id=180274
640         <rdar://problem/35667869>
641
642         Reviewed by Keith Miller and Mark Lam.
643
644         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
645         (assert):
646         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
647         (assert):
648
649 2017-12-01  JF Bastien  <jfbastien@apple.com>
650
651         WebAssembly: restore cached stack limit after out-call
652         https://bugs.webkit.org/show_bug.cgi?id=179106
653         <rdar://problem/35337525>
654
655         Reviewed by Saam Barati.
656
657         * wasm/function-tests/double-instance.js: Added.
658         (const.imp.boom):
659         (const.imp.get callAnother):
660
661 2017-11-30  JF Bastien  <jfbastien@apple.com>
662
663         WebAssembly: improve stack trace
664         https://bugs.webkit.org/show_bug.cgi?id=179343
665
666         Reviewed by Saam Barati.
667
668         Update the tests to follow the new format. Notably, SHA1 module
669         hash is now included in traces, and stubs are properly identified.
670
671         * wasm/assert.js: Add an assertion which matches regular expressions.
672         * wasm/function-tests/nameSection.js:
673         * wasm/function-tests/stack-overflow.js:
674         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
675         (assertOverflows.assertThrows.wasm.1):
676         (assertOverflows.assertThrows.wasm.0):
677         (assertOverflows.assertThrows):
678         (assertOverflows):
679         * wasm/function-tests/stack-trace.js:
680         (import.Builder.from.string_appeared_here.assert): Deleted.
681         * wasm/function-tests/trap-after-cross-instance-call.js:
682         (wasmFrameCountFromError):
683         * wasm/function-tests/trap-load-2.js:
684         (wasmFrameCountFromError):
685         * wasm/function-tests/trap-load.js:
686         (wasmFrameCountFromError):
687
688 2017-11-30  Mark Lam  <mark.lam@apple.com>
689
690         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
691         https://bugs.webkit.org/show_bug.cgi?id=180219
692         <rdar://problem/35696536>
693
694         Reviewed by Filip Pizlo.
695
696         * stress/regress-180219.js: Added.
697
698 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
699
700         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
701         https://bugs.webkit.org/show_bug.cgi?id=180190
702
703         Reviewed by Mark Lam.
704
705         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
706         (shouldBe):
707         (test1):
708         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
709         (shouldBe):
710         (test1):
711         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
712         (shouldBe):
713         (test1):
714         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
715         (shouldBe):
716         (test1):
717         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
718         (shouldBe):
719         (test1):
720         * stress/operation-in-may-have-negative-int32.js: Added.
721         (shouldBe):
722         (test2):
723         * stress/operation-in-negative-int32-cast.js: Added.
724         (shouldBe):
725         (test1):
726
727 2017-11-28  JF Bastien  <jfbastien@apple.com>
728
729         Strict and sloppy functions shouldn't share structure
730         https://bugs.webkit.org/show_bug.cgi?id=180103
731         <rdar://problem/35667847>
732
733         Reviewed by Saam Barati.
734
735         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
736         because the IC was wrong.
737         (foo):
738         (bar):
739         (baz):
740         (catch):
741         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
742         in this patch, but may as well test odd strict mode corner cases.
743         (bar):
744         (baz):
745         (catch):
746         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
747         (foo):
748         (bar):
749         (baz):
750         (catch):
751         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
752         next file, but with invalidation of the FunctionExecutable's
753         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
754         slower path.
755         (foo):
756         (bar.const.x):
757         (bar.const.y):
758         (bar):
759         (catch):
760         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
761         strict nesting works correctly.
762         (foo):
763         (bar.baz):
764         (bar):
765         * stress/strict-function-structure.js: Added. The test used to
766         assert in objectProtoFuncHasOwnProperty.
767         (foo):
768         (bar):
769         (baz):
770         * stress/strict-nested-function-structure.js: Added. Nesting.
771         (foo):
772         (bar):
773         (baz.boo):
774         (baz):
775
776 2017-11-29  Robin Morisset  <rmorisset@apple.com>
777
778         The recursive tail call optimisation is wrong on closures
779         https://bugs.webkit.org/show_bug.cgi?id=179835
780
781         Reviewed by Saam Barati.
782
783         * stress/closure-recursive-tail-call.js: Added.
784         (makeClosure):
785
786 2017-11-27  JF Bastien  <jfbastien@apple.com>
787
788         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
789         https://bugs.webkit.org/show_bug.cgi?id=180051
790         <rdar://problem/35614371>
791
792         Reviewed by Saam Barati.
793
794         * stress/rest-parameter-negative.js: Added.
795         (__f_5484):
796         (catch):
797         (__f_5485):
798         (__v_22598.catch):
799
800 2017-11-27  Saam Barati  <sbarati@apple.com>
801
802         Spread can escape when CreateRest does not
803         https://bugs.webkit.org/show_bug.cgi?id=180057
804         <rdar://problem/35676119>
805
806         Reviewed by JF Bastien.
807
808         * stress/spread-escapes-but-create-rest-does-not.js: Added.
809         (assert):
810         (getProperties):
811         (theFunc):
812         (let.obj.valueOf):
813
814 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
815
816         [DFG] Add NormalizeMapKey DFG IR
817         https://bugs.webkit.org/show_bug.cgi?id=179912
818
819         Reviewed by Saam Barati.
820
821         * stress/map-untyped-normalize-cse.js: Added.
822         (shouldBe):
823         (test):
824         * stress/map-untyped-normalize.js: Added.
825         (shouldBe):
826         (test):
827         * stress/set-untyped-normalize-cse.js: Added.
828         (shouldBe):
829         (set return.set has.set has):
830         * stress/set-untyped-normalize.js: Added.
831         (shouldBe):
832         (set return.set has):
833
834 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
835
836         [FTL] Support DeleteById and DeleteByVal
837         https://bugs.webkit.org/show_bug.cgi?id=180022
838
839         Reviewed by Saam Barati.
840
841         * stress/delete-by-id.js: Added.
842         (shouldBe):
843         (test1):
844         (test2):
845         * stress/delete-by-val-ftl.js: Added.
846         (shouldBe):
847         (test1):
848         (test2):
849
850 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
851
852         [DFG] Introduce {Set,Map,WeakMap}Fields
853         https://bugs.webkit.org/show_bug.cgi?id=179925
854
855         Reviewed by Saam Barati.
856
857         * stress/map-set-clobber-map-get.js: Added.
858         (shouldBe):
859         (test):
860         * stress/map-set-does-not-clobber-set-has.js: Added.
861         (shouldBe):
862         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
863         (shouldBe):
864         (test):
865         * stress/set-add-clobber-set-has.js: Added.
866         (shouldBe):
867         * stress/set-add-does-not-clobber-map-get.js: Added.
868         (shouldBe):
869
870 2017-11-24  Mark Lam  <mark.lam@apple.com>
871
872         Move unsafe jsc shell test functions to the $vm object.
873         https://bugs.webkit.org/show_bug.cgi?id=179980
874
875         Reviewed by Yusuke Suzuki.
876
877         * controlFlowProfiler/driver/driver.js:
878         * controlFlowProfiler/execution-count.js:
879         * controlFlowProfiler/if-statement.js:
880         * controlFlowProfiler/loop-statements.js:
881         * controlFlowProfiler/switch-statements.js:
882         * controlFlowProfiler/test-jit.js:
883         * exceptionFuzz/3d-cube.js:
884         * exceptionFuzz/date-format-xparb.js:
885         * exceptionFuzz/earley-boyer.js:
886         * heapProfiler/basic-edges.js:
887         * heapProfiler/property-edge-types.js:
888         * microbenchmarks/try-get-by-id-basic.js:
889         * microbenchmarks/try-get-by-id-polymorphic.js:
890         * modules/namespace-object-try-get.js:
891         * stress/argument-count-bytecode.js:
892         * stress/argument-intrinsic-basic.js:
893         * stress/argument-intrinsic-inlining-use-caller-arg.js:
894         * stress/argument-intrinsic-inlining-with-result-escape.js:
895         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
896         * stress/argument-intrinsic-inlining-with-vararg.js:
897         * stress/argument-intrinsic-nested-inlining.js:
898         * stress/argument-intrinsic-not-convert-to-get-argument.js:
899         * stress/argument-intrinsic-with-stack-write.js:
900         * stress/arity-mismatch-get-argument.js:
901         * stress/array-message-passing.js:
902         * stress/array-push-with-force-exit.js:
903         * stress/check-dom-with-signature.js:
904         * stress/check-sub-class.js:
905         * stress/compare-eq-incomplete-profile.js:
906         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
907         * stress/do-eval-virtual-call-correctly.js:
908         * stress/dom-jit-with-poly-proto.js:
909         * stress/domjit-exception-ic.js:
910         * stress/domjit-exception.js:
911         * stress/domjit-getter-complex-with-incorrect-object.js:
912         * stress/domjit-getter-complex.js:
913         * stress/domjit-getter-poly.js:
914         * stress/domjit-getter-proto.js:
915         * stress/domjit-getter-super-poly.js:
916         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
917         * stress/domjit-getter-type-check.js:
918         * stress/domjit-getter.js:
919         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
920         * stress/for-in-proxy-target-changed-structure.js:
921         * stress/for-in-proxy.js:
922         * stress/generational-opaque-roots.js:
923         * stress/global-const-redeclaration-setting-2.js:
924         * stress/global-const-redeclaration-setting-3.js:
925         * stress/global-const-redeclaration-setting-4.js:
926         * stress/global-const-redeclaration-setting-5.js:
927         * stress/global-const-redeclaration-setting.js:
928         * stress/import-basic.js:
929         * stress/import-from-eval.js:
930         * stress/import-reject-with-exception.js:
931         * stress/import-syntax.js:
932         * stress/impure-get-own-property-slot-inline-cache.js:
933         * stress/is-constructor.js:
934         * stress/istypedarrayview-intrinsic.js:
935         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
936         * stress/jsc-test-functions-should-be-more-robust.js:
937         * stress/object-toString-with-proxy.js:
938         * stress/poly-proto-custom-value-and-accessor.js:
939         * stress/proxy-inline-cache.js:
940         * stress/re-execute-error-module.js:
941         * stress/regress-150532.js:
942         * stress/regress-156992.js:
943         * stress/regress-179619.js:
944         * stress/resources/shadow-chicken-support.js:
945         * stress/runtime-array.js:
946         * stress/sampling-profiler-microtasks.js:
947         * stress/shadow-chicken-enabled.js:
948         * stress/spread-correct-global-object-on-exception.js:
949         * stress/super-get-by-id.js:
950         * stress/tailCallForwardArguments.js:
951         * stress/to-object-intrinsic-boolean-edge.js:
952         * stress/to-object-intrinsic-null-or-undefined-edge.js:
953         * stress/to-object-intrinsic-number-edge.js:
954         * stress/to-object-intrinsic-object-edge.js:
955         * stress/to-object-intrinsic-string-edge.js:
956         * stress/to-object-intrinsic-symbol-edge.js:
957         * stress/to-object-intrinsic.js:
958         * stress/try-catch-custom-getter-as-get-by-id.js:
959         * stress/try-get-by-id-poly-proto.js:
960         * stress/try-get-by-id-should-spill-registers-dfg.js:
961         * stress/try-get-by-id.js:
962         * typeProfiler/arrow-functions.js:
963         * typeProfiler/basic.js:
964         * typeProfiler/captured.js:
965         * typeProfiler/classes.js:
966         * typeProfiler/dfg-jit-optimizations.js:
967         * typeProfiler/dictionary-mode.js:
968         * typeProfiler/es6-block-scoping.js:
969         * typeProfiler/es6-classes.js:
970         * typeProfiler/inheritance.js:
971         * typeProfiler/int52-dfg.js:
972         * typeProfiler/loop.js:
973         * typeProfiler/optional-fields.js:
974         * typeProfiler/overflow.js:
975         * typeProfiler/return.js:
976         * typeProfiler/symbol.js:
977         * typeProfiler/weird-prototype-chain.js:
978
979 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
980
981         [DFG][FTL] Support MapSet / SetAdd intrinsics
982         https://bugs.webkit.org/show_bug.cgi?id=179858
983
984         Reviewed by Saam Barati.
985
986         * microbenchmarks/map-has-and-set.js: Added.
987         (test):
988         * stress/map-set-check-failure.js: Added.
989         (shouldBe):
990         (shouldThrow):
991         (target):
992         * stress/map-set-cse.js: Added.
993         (shouldBe):
994         (test):
995         * stress/set-add-check-failure.js: Added.
996         (shouldBe):
997         (shouldThrow):
998         (set shouldThrow):
999         * stress/set-add-cse.js: Added.
1000         (shouldBe):
1001
1002 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1003
1004         [JSC] Allow poly proto for intrinsic getters
1005         https://bugs.webkit.org/show_bug.cgi?id=179550
1006
1007         Reviewed by Saam Barati.
1008
1009         This change is also tested by existing tests.
1010
1011             1. stress/intrinsic-getter-with-poly-proto.js
1012             2. stress/poly-proto-intrinsic-getter-correctness.js
1013
1014         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
1015         (shouldBe):
1016         (makePolyProtoObject.foo.C):
1017         (makePolyProtoObject.foo):
1018         (makePolyProtoObject):
1019         (target):
1020         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
1021         (shouldBe):
1022         (makePolyProtoObject.foo.C):
1023         (makePolyProtoObject.foo):
1024         (makePolyProtoObject):
1025         (target):
1026
1027 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
1028
1029         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
1030         https://bugs.webkit.org/show_bug.cgi?id=179744
1031
1032         Reviewed by Michael Catanzaro.
1033
1034         This test uses too much memory for our buildbots on these platforms
1035         and gets OOM-killed.
1036
1037         * stress/unshiftCountSlowCase-correct-postCapacity.js:
1038         Skip if $memoryLimited and linux.
1039
1040 2017-11-17  JF Bastien  <jfbastien@apple.com>
1041
1042         WebAssembly JS API: throw when a promise can't be created
1043         https://bugs.webkit.org/show_bug.cgi?id=179826
1044         <rdar://problem/35455813>
1045
1046         Reviewed by Mark Lam.
1047
1048         Test WebAssembly.{compile,instantiate} where promise creation
1049         fails because of a stack overflow.
1050
1051         * wasm/js-api/promise-stack-overflow.js: Added.
1052         (const.runNearStackLimit.f.const.t):
1053         (async.testCompile):
1054         (async.testInstantiate):
1055
1056 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1057
1058         Unreviewed, mark regress-178385.js as memory exhausting
1059
1060         * stress/regress-178385.js:
1061
1062 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
1063
1064         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
1065
1066         Unreviewed test gardening.
1067
1068         * test262.yaml:
1069
1070 2017-11-16  Robin Morisset  <rmorisset@apple.com>
1071
1072         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
1073         https://bugs.webkit.org/show_bug.cgi?id=179763
1074         <rdar://problem/35550513>
1075
1076         Reviewed by Keith Miller.
1077
1078         Just adding a slightly cleaned-up version of the original fuzzer-found test.
1079
1080         * stress/tdz-this-in-try-catch.js: Added.
1081         (__v_6388):
1082         (__v_6392):
1083
1084 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1085
1086         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
1087         https://bugs.webkit.org/show_bug.cgi?id=179594
1088
1089         Reviewed by Saam Barati.
1090
1091         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
1092         (shouldBe):
1093         (args):
1094         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
1095         (shouldBe):
1096         (args):
1097
1098 2017-11-14  Saam Barati  <sbarati@apple.com>
1099
1100         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
1101         https://bugs.webkit.org/show_bug.cgi?id=179639
1102         <rdar://problem/35513018>
1103
1104         Reviewed by JF Bastien.
1105
1106         * wasm/function-tests/grow-memory-cause-gc.js: Added.
1107         (escape):
1108         (i.func):
1109
1110 2017-11-13  Mark Lam  <mark.lam@apple.com>
1111
1112         Add more overflow check book-keeping for MarkedArgumentBuffer.
1113         https://bugs.webkit.org/show_bug.cgi?id=179634
1114         <rdar://problem/35492517>
1115
1116         Reviewed by Saam Barati.
1117
1118         * stress/regress-179634.js: Added.
1119
1120 2017-11-13  Mark Lam  <mark.lam@apple.com>
1121
1122         Make the jsc shell loadGetterFromGetterSetter() function more robust.
1123         https://bugs.webkit.org/show_bug.cgi?id=179619
1124         <rdar://problem/35492518>
1125
1126         Reviewed by Saam Barati.
1127
1128         * stress/regress-179619.js: Added.
1129
1130 2017-11-12  Mark Lam  <mark.lam@apple.com>
1131
1132         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
1133         https://bugs.webkit.org/show_bug.cgi?id=179562
1134         <rdar://problem/35467022>
1135
1136         Reviewed by Saam Barati.
1137
1138         * regress-179562.js: Added.
1139
1140 2017-11-08  Saam Barati  <sbarati@apple.com>
1141
1142         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
1143         https://bugs.webkit.org/show_bug.cgi?id=177792
1144
1145         Reviewed by Yusuke Suzuki.
1146
1147         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
1148         (assert):
1149         (foo.Foo.prototype.ensureX):
1150         (foo.Foo):
1151         (foo):
1152         (access):
1153
1154 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
1155
1156         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1157         https://bugs.webkit.org/show_bug.cgi?id=178592
1158
1159         Unreviewed test gardening.
1160
1161         * test262.yaml:
1162
1163 2017-11-08  Robin Morisset  <rmorisset@apple.com>
1164
1165         Turn recursive tail calls into loops
1166         https://bugs.webkit.org/show_bug.cgi?id=176601
1167
1168         Reviewed by Saam Barati.
1169
1170         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
1171
1172         Add some simple test that computes factorial in several ways, and other trivial computations.
1173         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1174         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1175         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1176         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1177
1178         * stress/inline-call-to-recursive-tail-call.js: Added.
1179         (factorial.aux):
1180         (factorial):
1181         (factorial2.aux2):
1182         (factorial2.id):
1183         (factorial2):
1184         (factorial3.aux3):
1185         (factorial3):
1186         (aux4):
1187         (factorial4):
1188         (foo):
1189         (auxBar):
1190         (bar):
1191         (test):
1192
1193 2017-11-07  Mark Lam  <mark.lam@apple.com>
1194
1195         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
1196         https://bugs.webkit.org/show_bug.cgi?id=179355
1197         <rdar://problem/35263053>
1198
1199         Reviewed by Saam Barati.
1200
1201         * stress/regress-179355.js: Added.
1202
1203 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1204
1205         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
1206         https://bugs.webkit.org/show_bug.cgi?id=144458
1207
1208         Reviewed by Saam Barati.
1209
1210         * microbenchmarks/dfg-internal-function-call.js: Added.
1211         (target):
1212         * microbenchmarks/dfg-internal-function-construct.js: Added.
1213         (target):
1214         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
1215         (target):
1216         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
1217         (target):
1218         * stress/dfg-internal-function-call.js: Added.
1219         (shouldBe):
1220         (target):
1221         * stress/dfg-internal-function-construct.js: Added.
1222         (shouldBe):
1223         (target):
1224         * stress/internal-function-call.js: Added.
1225         (shouldBe):
1226         * stress/internal-function-construct.js: Added.
1227         (shouldBe):
1228
1229 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
1230
1231         [Win] Skip stress/regress-178385.js.
1232         https://bugs.webkit.org/show_bug.cgi?id=179298
1233
1234         Unreviewed test gardening.
1235
1236         * stress/regress-178385.js:
1237
1238 2017-11-03  Keith Miller  <keith_miller@apple.com>
1239
1240         Add test for ic with side effects
1241         https://bugs.webkit.org/show_bug.cgi?id=179268
1242
1243         Reviewed by Saam Barati.
1244
1245         * stress/put-inline-cache-side-effects.js: Added.
1246         (let.i.of.objs.keys):
1247         (f):
1248
1249 2017-11-03  Mark Lam  <mark.lam@apple.com>
1250
1251         CachedCall (and its clients) needs overflow checks.
1252         https://bugs.webkit.org/show_bug.cgi?id=179185
1253
1254         Reviewed by JF Bastien.
1255
1256         * stress/regress-179185.js: Added.
1257
1258 2017-11-02  Michael Saboff  <msaboff@apple.com>
1259
1260         DFG needs to handle code motion of code in for..in loop bodies
1261         https://bugs.webkit.org/show_bug.cgi?id=179212
1262
1263         Reviewed by Keith Miller.
1264
1265         New regression test.
1266
1267         * stress/for-in-side-effects.js: Added.
1268         (getPrototypeOf):
1269         (reset):
1270         (testWithoutFTL.f):
1271         (testWithoutFTL):
1272         (testWithFTL.f):
1273         (testWithFTL):
1274
1275 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
1276
1277         AI does not correctly model the clobber case of ArithClz32
1278         https://bugs.webkit.org/show_bug.cgi?id=179188
1279
1280         Reviewed by Michael Saboff.
1281
1282         * stress/arith-clz32-effects.js: Added.
1283         (foo):
1284         (valueOf):
1285
1286 2017-11-01  Michael Saboff  <msaboff@apple.com>
1287
1288         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
1289         https://bugs.webkit.org/show_bug.cgi?id=179140
1290
1291         Reviewed by Saam Barati.
1292
1293         New regression test.
1294
1295         * stress/regress-179140.js: Added.
1296         (testWithoutFTL):
1297         (testWithFTL):
1298
1299 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1300
1301         [JSC] Introduce @toObject
1302         https://bugs.webkit.org/show_bug.cgi?id=178726
1303
1304         Reviewed by Saam Barati.
1305
1306         * stress/array-copywithin.js:
1307         (shouldThrow):
1308         * stress/object-constructor-boolean-edge.js: Added.
1309         (shouldBe):
1310         (test):
1311         * stress/object-constructor-global.js: Added.
1312         (shouldBe):
1313         * stress/object-constructor-null-edge.js: Added.
1314         (shouldBe):
1315         (test):
1316         * stress/object-constructor-number-edge.js: Added.
1317         (shouldBe):
1318         (test):
1319         * stress/object-constructor-object-edge.js: Added.
1320         (shouldBe):
1321         (test):
1322         (i.arg):
1323         * stress/object-constructor-string-edge.js: Added.
1324         (shouldBe):
1325         (test):
1326         * stress/object-constructor-symbol-edge.js: Added.
1327         (shouldBe):
1328         (test):
1329         * stress/object-constructor-undefined-edge.js: Added.
1330         (shouldBe):
1331         (test):
1332         * stress/symbol-array-from.js: Added.
1333         (shouldBe):
1334         * stress/to-object-intrinsic-boolean-edge.js: Added.
1335         (shouldBe):
1336         (builtin.createBuiltin):
1337         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
1338         (shouldThrow):
1339         * stress/to-object-intrinsic-number-edge.js: Added.
1340         (shouldBe):
1341         (builtin.createBuiltin):
1342         * stress/to-object-intrinsic-object-edge.js: Added.
1343         (shouldBe):
1344         (builtin.createBuiltin):
1345         (i.arg):
1346         * stress/to-object-intrinsic-string-edge.js: Added.
1347         (shouldBe):
1348         (builtin.createBuiltin):
1349         * stress/to-object-intrinsic-symbol-edge.js: Added.
1350         (shouldBe):
1351         (builtin.createBuiltin):
1352         * stress/to-object-intrinsic.js: Added.
1353         (shouldBe):
1354         (shouldThrow):
1355         (builtin.createBuiltin):
1356
1357 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1358
1359         [DFG][FTL] Introduce StringSlice
1360         https://bugs.webkit.org/show_bug.cgi?id=178934
1361
1362         Reviewed by Saam Barati.
1363
1364         * microbenchmarks/string-slice-empty.js: Added.
1365         (slice):
1366         * microbenchmarks/string-slice-one-char.js: Added.
1367         (slice):
1368         * microbenchmarks/string-slice.js: Added.
1369         (slice):
1370
1371 2017-10-26  Michael Saboff  <msaboff@apple.com>
1372
1373         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
1374         https://bugs.webkit.org/show_bug.cgi?id=178890
1375
1376         Reviewed by Keith Miller.
1377
1378         New regression test.
1379
1380         * stress/regress-178890.js: Added.
1381
1382 2017-10-26  Mark Lam  <mark.lam@apple.com>
1383
1384         JSRopeString::RopeBuilder::append() should check for overflows.
1385         https://bugs.webkit.org/show_bug.cgi?id=178385
1386         <rdar://problem/35027468>
1387
1388         Reviewed by Saam Barati.
1389
1390         * stress/regress-178385.js: Added.
1391
1392 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
1393
1394         Unreviewed, rolling out r223961.
1395
1396         The change that required this has been rolled out.
1397
1398         Reverted changeset:
1399
1400         "Mark test262.yaml/test262/test/language/statements/try/tco-
1401         catch.js as passing."
1402         https://bugs.webkit.org/show_bug.cgi?id=178592
1403         https://trac.webkit.org/changeset/223961
1404
1405 2017-10-25  Commit Queue  <commit-queue@webkit.org>
1406
1407         Unreviewed, rolling out r223691 and r223729.
1408         https://bugs.webkit.org/show_bug.cgi?id=178834
1409
1410         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
1411         by rniwa on #webkit).
1412
1413         Reverted changesets:
1414
1415         "Turn recursive tail calls into loops"
1416         https://bugs.webkit.org/show_bug.cgi?id=176601
1417         https://trac.webkit.org/changeset/223691
1418
1419         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
1420         comparison is always false due to limited range of data type
1421         [-Wtype-limits]"
1422         https://bugs.webkit.org/show_bug.cgi?id=178543
1423         https://trac.webkit.org/changeset/223729
1424
1425 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
1426
1427         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1428         https://bugs.webkit.org/show_bug.cgi?id=178592
1429
1430         Unreviewed test gardening.
1431
1432         * test262.yaml:
1433
1434 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1435
1436         [FTL] Support NewStringObject
1437         https://bugs.webkit.org/show_bug.cgi?id=178737
1438
1439         Reviewed by Saam Barati.
1440
1441         * stress/new-string-object.js: Added.
1442         (shouldBe):
1443         (test):
1444
1445 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1446
1447         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
1448         https://bugs.webkit.org/show_bug.cgi?id=178308
1449
1450         Reviewed by Mark Lam.
1451
1452         * test262.yaml:
1453
1454 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1455
1456         [JSC] Use fastJoin in Array#toString
1457         https://bugs.webkit.org/show_bug.cgi?id=178062
1458
1459         Reviewed by Darin Adler.
1460
1461         * microbenchmarks/contiguous-array-to-string.js: Added.
1462         (target):
1463         * microbenchmarks/double-array-to-string.js: Added.
1464         (target):
1465         * microbenchmarks/int32-array-to-string.js: Added.
1466         (target):
1467
1468 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
1469
1470         stress/check-string-ident.js is improperly skipped
1471         https://bugs.webkit.org/show_bug.cgi?id=178642
1472
1473         Reviewed by Saam Barati.
1474
1475         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
1476         since it enforces the run-jsc-stress-tests script to still set up the
1477         test to run, despite the skip directive that's used before.
1478
1479 2017-10-20  Mark Lam  <mark.lam@apple.com>
1480
1481         Add a test case for r214334.
1482         https://bugs.webkit.org/show_bug.cgi?id=169941
1483         <rdar://problem/31221258>
1484
1485         Reviewed by JF Bastien.
1486
1487         * stress/regress-169941.js: Added.
1488
1489 2017-10-19  JF Bastien  <jfbastien@apple.com>
1490
1491         WebAssembly: no VM / JS version of everything but Instance
1492         https://bugs.webkit.org/show_bug.cgi?id=177473
1493
1494         Reviewed by Filip Pizlo, Saam Barati.
1495
1496         - Exceeding max on memory growth now returns a range error as per
1497         spec. This is a (very minor) breaking change: it used to throw OOM
1498         error. Update the corresponding test.
1499
1500         * wasm/js-api/memory-grow.js:
1501         (assertEq):
1502         * wasm/js-api/table.js:
1503         (assert.throws):
1504
1505 2017-10-19  Mark Lam  <mark.lam@apple.com>
1506
1507         Stringifier::appendStringifiedValue() is missing an exception check.
1508         https://bugs.webkit.org/show_bug.cgi?id=178386
1509         <rdar://problem/35027610>
1510
1511         Reviewed by Saam Barati.
1512
1513         * stress/regress-178386.js: Added.
1514
1515 2017-10-19  Michael Saboff  <msaboff@apple.com>
1516
1517         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1518         https://bugs.webkit.org/show_bug.cgi?id=178521
1519
1520         Reviewed by JF Bastien.
1521
1522         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1523         now passes with the current version (5.0) of the Emoji spec.
1524
1525 2017-10-19  Robin Morisset  <rmorisset@apple.com>
1526
1527         Turn recursive tail calls into loops
1528         https://bugs.webkit.org/show_bug.cgi?id=176601
1529
1530         Reviewed by Saam Barati.
1531
1532         Add some simple test that computes factorial in several ways, and other trivial computations.
1533         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1534         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1535         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1536         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1537
1538         * stress/inline-call-to-recursive-tail-call.js: Added.
1539         (factorial.aux):
1540         (factorial):
1541         (factorial2.aux):
1542         (factorial2.id):
1543         (factorial2):
1544         (factorial3.aux):
1545         (factorial3):
1546         (aux):
1547         (factorial4):
1548         (test):
1549
1550 2017-10-18  Mark Lam  <mark.lam@apple.com>
1551
1552         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1553         https://bugs.webkit.org/show_bug.cgi?id=177600
1554         <rdar://problem/34710985>
1555
1556         Reviewed by Saam Barati.
1557
1558         * stress/regress-177600.js: Added.
1559
1560 2017-10-18  Mark Lam  <mark.lam@apple.com>
1561
1562         The compiler should always register a structure when it adds its transitionWatchPointSet.
1563         https://bugs.webkit.org/show_bug.cgi?id=178420
1564         <rdar://problem/34814024>
1565
1566         Reviewed by Saam Barati and Filip Pizlo.
1567
1568         * stress/regress-178420.js: Added.
1569         (new.Array.10000.map):
1570
1571 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1572
1573         [JSC] __proto__ getter should be fast
1574         https://bugs.webkit.org/show_bug.cgi?id=178067
1575
1576         Reviewed by Saam Barati.
1577
1578         * stress/dfg-object-proto-accessor.js: Added.
1579         (shouldBe):
1580         (shouldThrow):
1581         (target):
1582         * stress/dfg-object-proto-getter.js: Added.
1583         (shouldBe):
1584         (shouldThrow):
1585         (target):
1586         * stress/dfg-object-prototype-of.js: Added.
1587         (shouldBe):
1588         (shouldThrow):
1589         (target):
1590         * stress/dfg-reflect-get-prototype-of.js: Added.
1591         (shouldBe):
1592         (shouldThrow):
1593         (target):
1594         * stress/intrinsic-getter-with-poly-proto.js: Added.
1595         (shouldBe):
1596         (makePolyProtoObject.foo.C):
1597         (makePolyProtoObject.foo):
1598         (makePolyProtoObject):
1599         (target):
1600         * stress/object-get-prototype-of-filtered.js: Added.
1601         (shouldBe):
1602         (shouldThrow):
1603         (target):
1604         (i.Cocoa):
1605         * stress/object-get-prototype-of-mono-proto.js: Added.
1606         (shouldBe):
1607         (makePolyProtoObject.foo.C):
1608         (makePolyProtoObject.foo):
1609         (makePolyProtoObject):
1610         (target):
1611         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1612         (shouldBe):
1613         (makePolyProtoObject.foo.C):
1614         (makePolyProtoObject.foo):
1615         (makePolyProtoObject):
1616         (target):
1617         * stress/object-get-prototype-of-poly-proto.js: Added.
1618         (shouldBe):
1619         (makePolyProtoObject.foo.C):
1620         (makePolyProtoObject.foo):
1621         (makePolyProtoObject):
1622         (target):
1623         * stress/object-proto-getter-filtered.js: Added.
1624         (shouldBe):
1625         (shouldThrow):
1626         (target):
1627         (i.Cocoa):
1628         * stress/object-proto-getter-poly-mono-proto.js: Added.
1629         (shouldBe):
1630         (makePolyProtoObject.foo.C):
1631         (makePolyProtoObject.foo):
1632         (makePolyProtoObject):
1633         (target):
1634         * stress/object-proto-getter-poly-proto.js: Added.
1635         (shouldBe):
1636         (makePolyProtoObject.foo.C):
1637         (makePolyProtoObject.foo):
1638         (makePolyProtoObject):
1639         (target):
1640         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1641         * stress/string-proto.js: Added.
1642         (shouldBe):
1643         (target):
1644
1645 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1646
1647         Unreviewed, rolling out r223523.
1648
1649         A test for this change is failing on debug JSC bots.
1650
1651         Reverted changeset:
1652
1653         "[JSC] __proto__ getter should be fast"
1654         https://bugs.webkit.org/show_bug.cgi?id=178067
1655         https://trac.webkit.org/changeset/223523
1656
1657 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1658
1659         [JSC] __proto__ getter should be fast
1660         https://bugs.webkit.org/show_bug.cgi?id=178067
1661
1662         Reviewed by Saam Barati.
1663
1664         * stress/dfg-object-proto-accessor.js: Added.
1665         (shouldBe):
1666         (shouldThrow):
1667         (target):
1668         * stress/dfg-object-proto-getter.js: Added.
1669         (shouldBe):
1670         (shouldThrow):
1671         (target):
1672         * stress/dfg-object-prototype-of.js: Added.
1673         (shouldBe):
1674         (shouldThrow):
1675         (target):
1676         * stress/dfg-reflect-get-prototype-of.js: Added.
1677         (shouldBe):
1678         (shouldThrow):
1679         (target):
1680         * stress/object-get-prototype-of-filtered.js: Added.
1681         (shouldBe):
1682         (shouldThrow):
1683         (target):
1684         (i.Cocoa):
1685         * stress/object-get-prototype-of-mono-proto.js: Added.
1686         (shouldBe):
1687         (makePolyProtoObject.foo.C):
1688         (makePolyProtoObject.foo):
1689         (makePolyProtoObject):
1690         (target):
1691         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1692         (shouldBe):
1693         (makePolyProtoObject.foo.C):
1694         (makePolyProtoObject.foo):
1695         (makePolyProtoObject):
1696         (target):
1697         * stress/object-get-prototype-of-poly-proto.js: Added.
1698         (shouldBe):
1699         (makePolyProtoObject.foo.C):
1700         (makePolyProtoObject.foo):
1701         (makePolyProtoObject):
1702         (target):
1703         * stress/object-proto-getter-filtered.js: Added.
1704         (shouldBe):
1705         (shouldThrow):
1706         (target):
1707         (i.Cocoa):
1708         * stress/object-proto-getter-poly-mono-proto.js: Added.
1709         (shouldBe):
1710         (makePolyProtoObject.foo.C):
1711         (makePolyProtoObject.foo):
1712         (makePolyProtoObject):
1713         (target):
1714         * stress/object-proto-getter-poly-proto.js: Added.
1715         (shouldBe):
1716         (makePolyProtoObject.foo.C):
1717         (makePolyProtoObject.foo):
1718         (makePolyProtoObject):
1719         (target):
1720         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1721         * stress/string-proto.js: Added.
1722         (shouldBe):
1723         (target):
1724
1725 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1726
1727         Reland "Add Above/Below comparisons for UInt32 patterns"
1728         https://bugs.webkit.org/show_bug.cgi?id=177281
1729
1730         Reviewed by Saam Barati.
1731
1732         * stress/uint32-comparison-jump.js: Added.
1733         (shouldBe):
1734         (above):
1735         (aboveOrEqual):
1736         (below):
1737         (belowOrEqual):
1738         (notAbove):
1739         (notAboveOrEqual):
1740         (notBelow):
1741         (notBelowOrEqual):
1742         * stress/uint32-comparison.js: Added.
1743         (shouldBe):
1744         (above):
1745         (aboveOrEqual):
1746         (below):
1747         (belowOrEqual):
1748         (aboveTest):
1749         (aboveOrEqualTest):
1750         (belowTest):
1751         (belowOrEqualTest):
1752
1753 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1754
1755         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1756         https://bugs.webkit.org/show_bug.cgi?id=178210
1757
1758         Reviewed by Saam Barati.
1759
1760         * wasm/function-tests/trap-from-start-async.js:
1761         (async.StartTrapsAsync):
1762         * wasm/function-tests/trap-from-start.js:
1763         (StartTraps):
1764         * wasm/js-api/web-assembly-function.js:
1765         (assert.eq.Object.getPrototypeOf):
1766         * wasm/js-api/wrapper-function.js:
1767         (return.new.WebAssembly.Module):
1768         (assert.throws.makeInstance): Deleted.
1769         (assert.throws.Bar): Deleted.
1770         (assert.throws): Deleted.
1771
1772 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1773
1774         Enable gigacage on iOS
1775         https://bugs.webkit.org/show_bug.cgi?id=177586
1776
1777         Reviewed by JF Bastien.
1778         
1779         Add tests for when Gigacage gets runtime disabled.
1780
1781         * stress/disable-gigacage-arrays.js: Added.
1782         (foo):
1783         * stress/disable-gigacage-strings.js: Added.
1784         (foo):
1785         * stress/disable-gigacage-typed-arrays.js: Added.
1786         (foo):
1787
1788 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1789
1790         import.meta should not be assignable
1791         https://bugs.webkit.org/show_bug.cgi?id=178202
1792
1793         Reviewed by Saam Barati.
1794
1795         * modules/import-meta-assignment.js: Added.
1796         (shouldThrow):
1797         (SyntaxError.import.meta.can.shouldThrow):
1798
1799 2017-10-11  Saam Barati  <sbarati@apple.com>
1800
1801         Unreviewed. Actually skip certain type profiler tests in debug.
1802
1803         * typeProfiler.yaml:
1804         * typeProfiler/deltablue-for-of.js:
1805         * typeProfiler/getter-richards.js:
1806
1807 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1808
1809         Unreviewed, rolling out r223113 and r223121.
1810         https://bugs.webkit.org/show_bug.cgi?id=178182
1811
1812         Reintroduced 20% regression on Kraken (Requested by rniwa on
1813         #webkit).
1814
1815         Reverted changesets:
1816
1817         "Enable gigacage on iOS"
1818         https://bugs.webkit.org/show_bug.cgi?id=177586
1819         https://trac.webkit.org/changeset/223113
1820
1821         "Use one virtual allocation for all gigacages and their
1822         runways"
1823         https://bugs.webkit.org/show_bug.cgi?id=178050
1824         https://trac.webkit.org/changeset/223121
1825
1826 2017-10-11  Michael Saboff  <msaboff@apple.com>
1827
1828         Disable test262 named capture group tests with direct unicode names and with references before definitions
1829         https://bugs.webkit.org/show_bug.cgi?id=178177
1830
1831         Reviewed by Keith Miller.
1832
1833         Bugs to track fixing these test are:
1834         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1835             "Add support in named capture group identifiers for direct surrogate pairs"
1836         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1837             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1838
1839         * test262.yaml:
1840
1841 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1842
1843         Object properties are undefined in super.call() but not in this.call()
1844         https://bugs.webkit.org/show_bug.cgi?id=177230
1845
1846         Reviewed by Saam Barati.
1847
1848         * stress/super-call-function-subclass.js: Added.
1849         (assert):
1850         (A.prototype.t):
1851         (A):
1852         * stress/super-dot-call-and-apply.js: Added.
1853         (assert):
1854         (A):
1855         (A.prototype.call):
1856         (A.prototype.apply):
1857         (B.prototype.testSuper):
1858         (B):
1859         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1860         (D.prototype.testSuper):
1861         (D):
1862
1863 2017-10-10  Saam Barati  <sbarati@apple.com>
1864
1865         The prototype cache should be aware of the Executable it generates a Structure for
1866         https://bugs.webkit.org/show_bug.cgi?id=177907
1867
1868         Reviewed by Filip Pizlo.
1869
1870         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1871         (assert):
1872         (foo.C):
1873         (foo):
1874         (bar.C):
1875         (bar):
1876         (access):
1877         (makeLongChain):
1878         (accessY):
1879
1880 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1881
1882         `async` should be able to be used as an imported binding name
1883         https://bugs.webkit.org/show_bug.cgi?id=176573
1884
1885         Reviewed by Saam Barati.
1886
1887         * modules/import-default-async.js: Added.
1888         * modules/import-named-async-as.js: Added.
1889         * modules/import-named-async.js: Added.
1890         * modules/import-named-async/target.js: Added.
1891         * modules/import-namespace-async.js: Added.
1892         * test262.yaml:
1893
1894 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1895
1896         Enable gigacage on iOS
1897         https://bugs.webkit.org/show_bug.cgi?id=177586
1898
1899         Reviewed by JF Bastien.
1900         
1901         Add tests for when Gigacage gets runtime disabled.
1902
1903         * stress/disable-gigacage-arrays.js: Added.
1904         (foo):
1905         * stress/disable-gigacage-strings.js: Added.
1906         (foo):
1907         * stress/disable-gigacage-typed-arrays.js: Added.
1908         (foo):
1909
1910 2017-10-09  Michael Saboff  <msaboff@apple.com>
1911
1912         Implement RegExp Unicode property escapes
1913         https://bugs.webkit.org/show_bug.cgi?id=172069
1914
1915         Reviewed by JF Bastien.
1916
1917         Enabled Unicode Property tests.
1918
1919         * test262.yaml:
1920
1921 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1922
1923         Unreviewed, rolling out r223015 and r223025.
1924         https://bugs.webkit.org/show_bug.cgi?id=178093
1925
1926         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1927         #webkit).
1928
1929         Reverted changesets:
1930
1931         "Enable gigacage on iOS"
1932         https://bugs.webkit.org/show_bug.cgi?id=177586
1933         http://trac.webkit.org/changeset/223015
1934
1935         "Unreviewed, disable Gigacage on ARM64 Linux"
1936         https://bugs.webkit.org/show_bug.cgi?id=177586
1937         http://trac.webkit.org/changeset/223025
1938
1939 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1940
1941         Update expectations for test262 tests that pass after r223043.
1942         https://bugs.webkit.org/show_bug.cgi?id=176685
1943
1944         Unreviewed test gardening.
1945
1946         * test262.yaml:
1947
1948 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1949
1950         Unreviewed, rolling out r223022.
1951
1952         This change introduced 18 test262 failures.
1953
1954         Reverted changeset:
1955
1956         "`async` should be able to be used as an imported binding
1957         name"
1958         https://bugs.webkit.org/show_bug.cgi?id=176573
1959         http://trac.webkit.org/changeset/223022
1960
1961 2017-10-09  Saam Barati  <sbarati@apple.com>
1962
1963         3 poly-proto JSC tests timing out on debug after r222827
1964         https://bugs.webkit.org/show_bug.cgi?id=177880
1965         <rdar://problem/34817122>
1966
1967         Unreviewed.
1968
1969         I'm skipping these type profiler tests on debug since they are long running.
1970
1971         * typeProfiler/deltablue-for-of.js:
1972         * typeProfiler/getter-richards.js:
1973
1974 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1975
1976         Safari 10 /11 problem with if (!await get(something)).
1977         https://bugs.webkit.org/show_bug.cgi?id=176685
1978
1979         Reviewed by Saam Barati.
1980
1981         * stress/async-await-basic.js:
1982         (awaitEpression.async):
1983         * stress/async-await-syntax.js:
1984         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1985         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1986
1987 2017-10-08  Saam Barati  <sbarati@apple.com>
1988
1989         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1990
1991         * typeProfiler/deltablue-for-of.js:
1992         * typeProfiler/getter-richards.js:
1993
1994 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1995
1996         `async` should be able to be used as an imported binding name
1997         https://bugs.webkit.org/show_bug.cgi?id=176573
1998
1999         Reviewed by Darin Adler.
2000
2001         * modules/import-default-async.js: Added.
2002         * modules/import-named-async-as.js: Added.
2003         * modules/import-named-async.js: Added.
2004         * modules/import-named-async/target.js: Added.
2005         * modules/import-namespace-async.js: Added.
2006
2007 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
2008
2009         Enable gigacage on iOS
2010         https://bugs.webkit.org/show_bug.cgi?id=177586
2011
2012         Reviewed by JF Bastien.
2013         
2014         Add tests for when Gigacage gets runtime disabled.
2015
2016         * stress/disable-gigacage-arrays.js: Added.
2017         (foo):
2018         * stress/disable-gigacage-strings.js: Added.
2019         (foo):
2020         * stress/disable-gigacage-typed-arrays.js: Added.
2021         (foo):
2022
2023 2017-10-06  Commit Queue  <commit-queue@webkit.org>
2024
2025         Unreviewed, rolling out r222791 and r222873.
2026         https://bugs.webkit.org/show_bug.cgi?id=178031
2027
2028         Caused crashes with workers/wasm LayoutTests (Requested by
2029         ryanhaddad on #webkit).
2030
2031         Reverted changesets:
2032
2033         "WebAssembly: no VM / JS version of everything but Instance"
2034         https://bugs.webkit.org/show_bug.cgi?id=177473
2035         http://trac.webkit.org/changeset/222791
2036
2037         "WebAssembly: address no VM / JS follow-ups"
2038         https://bugs.webkit.org/show_bug.cgi?id=177887
2039         http://trac.webkit.org/changeset/222873
2040
2041 2017-10-05  Saam Barati  <sbarati@apple.com>
2042
2043         Make sure all prototypes under poly proto get added into the VM's prototype map
2044         https://bugs.webkit.org/show_bug.cgi?id=177909
2045
2046         Reviewed by Keith Miller.
2047
2048         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
2049         (assert):
2050         (foo.C):
2051         (foo):
2052         (set x):
2053
2054 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
2055
2056         [JSC] Introduce import.meta
2057         https://bugs.webkit.org/show_bug.cgi?id=177703
2058
2059         Reviewed by Filip Pizlo.
2060
2061         * modules/import-meta-syntax.js: Added.
2062         (shouldThrow):
2063         (shouldNotThrow):
2064         * modules/import-meta.js: Added.
2065         * modules/import-meta/cocoa.js: Added.
2066         * modules/resources/assert.js:
2067         (export.shouldNotThrow):
2068         * stress/import-syntax.js:
2069
2070 2017-10-04  Saam Barati  <sbarati@apple.com>
2071
2072         Make pertinent AccessCases watch the poly proto watchpoint
2073         https://bugs.webkit.org/show_bug.cgi?id=177765
2074
2075         Reviewed by Keith Miller.
2076
2077         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
2078         (assert):
2079         (foo.C):
2080         (foo):
2081         (validate):
2082         * stress/poly-proto-clear-stub.js: Added.
2083         (assert):
2084         (foo.C):
2085         (foo):
2086
2087 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
2088
2089         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
2090
2091         Unreviewed test gardening.
2092
2093         * test262.yaml:
2094
2095 2017-10-04  Saam Barati  <sbarati@apple.com>
2096
2097         3 poly-proto JSC tests timing out on debug after r222827
2098         https://bugs.webkit.org/show_bug.cgi?id=177880
2099
2100         Rubber stamped by Mark Lam.
2101
2102         * microbenchmarks/poly-proto-access.js:
2103         * typeProfiler/deltablue-for-of.js:
2104         * typeProfiler/getter-richards.js:
2105
2106 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
2107
2108         Unreviewed, marking tco-catch.js as a failure after test262 update
2109         https://bugs.webkit.org/show_bug.cgi?id=177859
2110
2111         * test262.yaml:
2112
2113 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2114
2115         Unreviewed, marking one async iterator test262 test failed
2116         https://bugs.webkit.org/show_bug.cgi?id=177859
2117
2118         * test262.yaml:
2119
2120 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2121
2122         [Test262] Update Test262 to Oct 4 version
2123         https://bugs.webkit.org/show_bug.cgi?id=177859
2124
2125         Reviewed by Sam Weinig.
2126
2127         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
2128         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
2129
2130         * test262.yaml:
2131         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
2132         (checkSequence):
2133         * test262/harness/typeCoercion.js:
2134         (testCoercibleToIndexZero):
2135         (testCoercibleToIndexOne):
2136         (testCoercibleToIndexFromIndex):
2137         (testNotCoercibleToIndex.testPrimitiveValue):
2138         (testNotCoercibleToInteger):
2139         (testCoercibleToBigIntZero.testPrimitiveValue):
2140         (testCoercibleToBigIntZero):
2141         (testCoercibleToBigIntOne.testPrimitiveValue):
2142         (testCoercibleToBigIntOne):
2143         (testPrimitiveValue):
2144         (testCoercibleToBigIntFromBigInt):
2145         (testNotCoercibleToBigInt.testPrimitiveValue):
2146         (testNotCoercibleToBigInt.testStringValue):
2147         (testNotCoercibleToBigInt):
2148         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
2149         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
2150         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
2151         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
2152         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
2153         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
2154         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
2155         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
2156         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
2157         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
2158         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
2159         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
2160         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
2161         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
2162         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
2163         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
2164         (testCoercibleToBigIntZero):
2165         (testCoercibleToBigIntOne):
2166         (testNotCoercibleToBigInt):
2167         (MyError): Deleted.
2168         (valueOf): Deleted.
2169         (toString): Deleted.
2170         (Symbol.toPrimitive): Deleted.
2171         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
2172         (testCoercibleToIndexZero):
2173         (testCoercibleToIndexOne):
2174         (testNotCoercibleToIndex):
2175         (MyError): Deleted.
2176         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
2177         (assert.sameValue.BigInt.asIntN.toString): Deleted.
2178         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
2179         (BigInt.asIntN.valueOf): Deleted.
2180         (BigInt.asIntN.toString): Deleted.
2181         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
2182         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
2183         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
2184         (testCoercibleToBigIntZero):
2185         (testCoercibleToBigIntOne):
2186         (testNotCoercibleToBigInt):
2187         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
2188         (testCoercibleToIndexZero):
2189         (testCoercibleToIndexOne):
2190         (testNotCoercibleToIndex):
2191         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
2192         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
2193         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
2194         (bits.valueOf):
2195         (bigint.valueOf):
2196         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
2197         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
2198         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
2199         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
2200         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
2201         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
2202         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
2203         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
2204         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
2205         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
2206         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
2207         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
2208         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
2209         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
2210         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
2211         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
2212         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
2213         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
2214         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
2215         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
2216         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
2217         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
2218         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
2219         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
2220         (replacer):
2221         (BigInt.prototype.toJSON):
2222         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
2223         (replacer):
2224         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
2225         (BigInt.prototype.toJSON):
2226         * test262/test/built-ins/JSON/stringify/bigint.js:
2227         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
2228         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
2229         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
2230         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
2231         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
2232         * test262/test/built-ins/Object/proto-from-ctor.js:
2233         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
2234         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
2235         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
2236         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
2237         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
2238         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
2239         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
2240         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
2241         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
2242         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
2243         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
2244         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
2245         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
2246         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
2247         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
2248         * test262/test/built-ins/Proxy/get-fn-realm.js:
2249         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
2250         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
2251         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
2252         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
2253         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
2254         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
2255         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
2256         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
2257         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
2258         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
2259         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
2260         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
2261         (i6.replace):
2262         (i6b.replace):
2263         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
2264         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
2265         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
2266         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
2267         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
2268         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
2269         * test262/test/built-ins/RegExp/u180e.js: Added.
2270         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
2271         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
2272         * test262/test/built-ins/String/proto-from-ctor-realm.js:
2273         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
2274         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
2275         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
2276         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
2277         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
2278         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
2279         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
2280         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
2281         * test262/test/built-ins/String/prototype/endsWith/length.js:
2282         * test262/test/built-ins/String/prototype/endsWith/name.js:
2283         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
2284         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
2285         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
2286         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
2287         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
2288         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
2289         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
2290         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
2291         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
2292         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
2293         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
2294         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
2295         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
2296         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
2297         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
2298         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
2299         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
2300         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
2301         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
2302         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
2303         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
2304         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
2305         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
2306         * test262/test/built-ins/String/prototype/includes/includes.js:
2307         * test262/test/built-ins/String/prototype/includes/length.js:
2308         * test262/test/built-ins/String/prototype/includes/name.js:
2309         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
2310         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
2311         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
2312         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
2313         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
2314         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
2315         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
2316         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
2317         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
2318         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
2319         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
2320         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
2321         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
2322         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
2323         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
2324         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
2325         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
2326         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
2327         * test262/test/built-ins/String/prototype/trim/u180e.js:
2328         * test262/test/built-ins/Symbol/for/cross-realm.js:
2329         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
2330         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
2331         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
2332         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
2333         * test262/test/built-ins/Symbol/match/cross-realm.js:
2334         * test262/test/built-ins/Symbol/replace/cross-realm.js:
2335         * test262/test/built-ins/Symbol/search/cross-realm.js:
2336         * test262/test/built-ins/Symbol/species/cross-realm.js:
2337         * test262/test/built-ins/Symbol/split/cross-realm.js:
2338         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
2339         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
2340         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
2341         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
2342         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
2343         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
2344         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
2345         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
2346         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
2347         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
2348         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
2349         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
2350         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
2351         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
2352         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
2353         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
2354         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
2355         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
2356         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
2357         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
2358         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
2359         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
2360         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
2361         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
2362         * test262/test/language/comments/mongolian-vowel-separator-single.js:
2363         * test262/test/language/eval-code/indirect/realm.js:
2364         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
2365         (o.get z):
2366         (o.get a):
2367         * test262/test/language/expressions/call/eval-realm-indirect.js:
2368         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
2369         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
2370         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
2371         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
2372         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2373         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
2374         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
2375         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
2376         * test262/test/language/expressions/greater-than/bigint-and-number.js:
2377         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
2378         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
2379         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
2380         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2381         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
2382         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
2383         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
2384         * test262/test/language/expressions/less-than/bigint-and-number.js:
2385         * test262/test/language/expressions/new/non-ctor-err-realm.js:
2386         * test262/test/language/expressions/super/realm.js:
2387         * test262/test/language/expressions/tagged-template/cache-realm.js:
2388         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
2389         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
2390         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
2391         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
2392         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
2393         * test262/test/language/literals/string/mongolian-vowel-separator.js:
2394         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
2395         (o.get z):
2396         (o.get a):
2397         * test262/test/language/statements/for-of/iterator-next-reference.js:
2398         (next):
2399         (iterator.next): Deleted.
2400         (x.of.iterable.): Deleted.
2401         (x.of.iterable.get return): Deleted.
2402         (x.of.iterable.iterator.next): Deleted.
2403         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
2404         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
2405         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
2406         * test262/test/language/white-space/mongolian-vowel-separator.js:
2407         * test262/test262-Revision.txt:
2408
2409 2017-10-03  Saam Barati  <sbarati@apple.com>
2410
2411         Implement polymorphic prototypes
2412         https://bugs.webkit.org/show_bug.cgi?id=176391
2413
2414         Reviewed by Filip Pizlo.
2415
2416         * microbenchmarks/poly-proto-access.js: Added.
2417         (assert):
2418         (foo.C):
2419         (foo.C.prototype.get bar):
2420         (foo):
2421         (bar):
2422         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
2423         (assert):
2424         (makePolyProtoObject.foo.C):
2425         (makePolyProtoObject.foo):
2426         (makePolyProtoObject):
2427         (performSet):
2428         * microbenchmarks/poly-proto-setter-speed.js: Added.
2429         (assert):
2430         (makePolyProtoObject.foo.C):
2431         (makePolyProtoObject.foo.C.prototype.set p):
2432         (makePolyProtoObject.foo):
2433         (makePolyProtoObject):
2434         (performSet):
2435         * stress/constructor-with-return.js:
2436         (i.tests.forEach.Constructor):
2437         (i.tests.forEach):
2438         (tests.forEach.Constructor): Deleted.
2439         (tests.forEach): Deleted.
2440         * stress/dom-jit-with-poly-proto.js: Added.
2441         (assert):
2442         (makePolyProtoObject.foo.C):
2443         (makePolyProtoObject.foo):
2444         (makePolyProtoObject):
2445         (validate):
2446         * stress/poly-proto-custom-value-and-accessor.js: Added.
2447         (assert):
2448         (makePolyProtoObject.foo.C):
2449         (makePolyProtoObject.foo):
2450         (makePolyProtoObject):
2451         (items.forEach):
2452         (set get for):
2453         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
2454         (assert):
2455         (makePolyProtoObject.foo.C):
2456         (makePolyProtoObject.foo):
2457         (makePolyProtoObject):
2458         (foo):
2459         * stress/poly-proto-miss.js: Added.
2460         (makePolyProtoInstanceWithNullPrototype.foo.C):
2461         (makePolyProtoInstanceWithNullPrototype.foo):
2462         (makePolyProtoInstanceWithNullPrototype):
2463         (assert):
2464         (validate):
2465         * stress/poly-proto-op-in-caching.js: Added.
2466         (assert):
2467         (makePolyProtoObject.foo.C):
2468         (makePolyProtoObject.foo):
2469         (makePolyProtoObject):
2470         (validate):
2471         (validate2):
2472         * stress/poly-proto-put-transition.js: Added.
2473         (assert):
2474         (makePolyProtoObject.foo.C):
2475         (makePolyProtoObject.foo):
2476         (makePolyProtoObject):
2477         (performSet):
2478         (i.obj.__proto__.set p):
2479         * stress/poly-proto-set-prototype.js: Added.
2480         (assert):
2481         (let.alternateProto.get x):
2482         (let.alternateProto2.get y):
2483         (let.alternateProto2.get x):
2484         (foo.C):
2485         (foo):
2486         (validate):
2487         * stress/poly-proto-setter.js: Added.
2488         (assert):
2489         (makePolyProtoObject.foo.C):
2490         (makePolyProtoObject.foo.C.prototype.set p):
2491         (makePolyProtoObject.foo.C.prototype.get p):
2492         (makePolyProtoObject.foo):
2493         (makePolyProtoObject):
2494         (performSet):
2495         * stress/poly-proto-using-inheritance.js: Added.
2496         (assert):
2497         (foo.C):
2498         (foo.C.prototype.get baz):
2499         (foo):
2500         (bar.C):
2501         (bar):
2502         (validate):
2503         * stress/primitive-poly-proto.js: Added.
2504         (makePolyProtoInstance.foo.C):
2505         (makePolyProtoInstance.foo):
2506         (makePolyProtoInstance):
2507         (assert):
2508         (validate):
2509         * stress/prototype-is-not-js-object.js: Added.
2510         (foo.bar):
2511         (foo):
2512         (assert):
2513         (validate):
2514         * stress/try-get-by-id-poly-proto.js: Added.
2515         (assert):
2516         (makePolyProtoObject.foo.C):
2517         (makePolyProtoObject.foo):
2518         (makePolyProtoObject):
2519         (tryGetByIdText):
2520         (x.__proto__.get bar):
2521         (validate):
2522         * typeProfiler/overflow.js:
2523
2524 2017-10-03  JF Bastien  <jfbastien@apple.com>
2525
2526         WebAssembly: no VM / JS version of everything but Instance
2527         https://bugs.webkit.org/show_bug.cgi?id=177473
2528
2529         Reviewed by Filip Pizlo.
2530
2531         - Exceeding max on memory growth now returns a range error as per
2532         spec. This is a (very minor) breaking change: it used to throw OOM
2533         error. Update the corresponding test.
2534
2535         * wasm/js-api/memory-grow.js:
2536         (assertEq):
2537         * wasm/js-api/table.js:
2538         (assert.throws):
2539
2540 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
2541
2542         Skip JSC test stress/regress-159779-2.js on debug.
2543         https://bugs.webkit.org/show_bug.cgi?id=177204
2544
2545         Unreviewed test gardening.
2546
2547         * stress/regress-159779-2.js:
2548
2549 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
2550
2551         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2552         https://bugs.webkit.org/show_bug.cgi?id=175642
2553
2554         Reviewed by Darin Adler.
2555
2556         * ChakraCore/test/Function/apply3.baseline-jsc:
2557
2558 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2559
2560         Unreviewed, rolling out r222564.
2561         https://bugs.webkit.org/show_bug.cgi?id=177720
2562
2563         "It regressed JetStream by 2% on iOS caused by a 50%
2564         regression on the bigfib subtest" (Requested by saamyjoon on
2565         #webkit).
2566
2567         Reverted changeset:
2568
2569         "Add Above/Below comparisons for UInt32 patterns"
2570         https://bugs.webkit.org/show_bug.cgi?id=177281
2571         http://trac.webkit.org/changeset/222564
2572
2573 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2574
2575         [DFG] Support ArrayPush with multiple args
2576         https://bugs.webkit.org/show_bug.cgi?id=175823
2577
2578         Reviewed by Saam Barati.
2579
2580         * microbenchmarks/array-push-0.js: Added.
2581         (arrayPush0):
2582         * microbenchmarks/array-push-1.js: Added.
2583         (arrayPush1):
2584         * microbenchmarks/array-push-2.js: Added.
2585         (arrayPush2):
2586         * microbenchmarks/array-push-3.js: Added.
2587         (arrayPush3):
2588         * stress/array-push-multiple-contiguous.js: Added.
2589         (shouldBe):
2590         (test):
2591         * stress/array-push-multiple-double-nan.js: Added.
2592         (shouldBe):
2593         (test):
2594         * stress/array-push-multiple-double.js: Added.
2595         (shouldBe):
2596         (test):
2597         * stress/array-push-multiple-int32.js: Added.
2598         (shouldBe):
2599         (test):
2600         * stress/array-push-multiple-many-contiguous.js: Added.
2601         (shouldBe):
2602         (test):
2603         * stress/array-push-multiple-many-double.js: Added.
2604         (shouldBe):
2605         (test):
2606         * stress/array-push-multiple-many-int32.js: Added.
2607         (shouldBe):
2608         (test):
2609         * stress/array-push-multiple-many-storage.js: Added.
2610         (shouldBe):
2611         (test):
2612         * stress/array-push-multiple-storage.js: Added.
2613         (shouldBe):
2614         (test):
2615         * stress/array-push-with-force-exit.js: Added.
2616         (target.createBuiltin):
2617
2618 2017-09-29  Saam Barati  <sbarati@apple.com>
2619
2620         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2621         https://bugs.webkit.org/show_bug.cgi?id=177639
2622
2623         Reviewed by Geoffrey Garen.
2624
2625         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2626         (assert):
2627         (Class):
2628         (items.forEach):
2629         (set get for):
2630
2631 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2632
2633         Unreviewed, rolling out r222563, r222565, and r222581.
2634         https://bugs.webkit.org/show_bug.cgi?id=177675
2635
2636         "It causes a crash when playing youtube videos" (Requested by
2637         saamyjoon on #webkit).
2638
2639         Reverted changesets:
2640
2641         "[DFG] Support ArrayPush with multiple args"
2642         https://bugs.webkit.org/show_bug.cgi?id=175823
2643         http://trac.webkit.org/changeset/222563
2644
2645         "Unreviewed, build fix after r222563"
2646         https://bugs.webkit.org/show_bug.cgi?id=175823
2647         http://trac.webkit.org/changeset/222565
2648
2649         "Unreviewed, fix x86 breaking due to exhausted registers"
2650         https://bugs.webkit.org/show_bug.cgi?id=175823
2651         http://trac.webkit.org/changeset/222581
2652
2653 2017-09-28  Mark Lam  <mark.lam@apple.com>
2654
2655         test262: Unexpected passes after r222617 and r222618.
2656         https://bugs.webkit.org/show_bug.cgi?id=177622
2657         <rdar://problem/34725960>
2658
2659         Reviewed by Saam Barati.
2660
2661         Update test262.yaml for tests that are now passing.
2662
2663         * test262.yaml:
2664
2665 2017-09-27  Michael Saboff  <msaboff@apple.com>
2666
2667         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2668         https://bugs.webkit.org/show_bug.cgi?id=177570
2669
2670         Reviewed by Filip Pizlo.
2671
2672         New regression test.
2673
2674         * stress/regress-177570.js: Added.
2675
2676 2017-09-28  Michael Saboff  <msaboff@apple.com>
2677
2678         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2679         https://bugs.webkit.org/show_bug.cgi?id=177423
2680
2681         Reviewed by Mark Lam.
2682
2683         Updated regression test.
2684
2685         * stress/regress-177423.js:
2686         (catch):
2687
2688 2017-09-27  Mark Lam  <mark.lam@apple.com>
2689
2690         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2691         https://bugs.webkit.org/show_bug.cgi?id=177584
2692         <rdar://problem/34463903>
2693
2694         Reviewed by Saam Barati.
2695
2696         * stress/regress-177584.js: Added.
2697         (assertEqual):
2698         (Array.prototype.Symbol.species):
2699
2700 2017-09-27  Saam Barati  <sbarati@apple.com>
2701
2702         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2703         https://bugs.webkit.org/show_bug.cgi?id=177523
2704
2705         Reviewed by Mark Lam.
2706
2707         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2708         (assert):
2709         (Test):
2710         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2711         (addMethods):
2712         (i.Test.prototype.propName):
2713
2714 2017-09-27  Mark Lam  <mark.lam@apple.com>
2715
2716         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2717         https://bugs.webkit.org/show_bug.cgi?id=177423
2718         <rdar://problem/34621320>
2719
2720         Reviewed by Keith Miller.
2721
2722         * stress/regress-177423.js: Added.
2723
2724 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2725
2726         Add Above/Below comparisons for UInt32 patterns
2727         https://bugs.webkit.org/show_bug.cgi?id=177281
2728
2729         Reviewed by Saam Barati.
2730
2731         * stress/uint32-comparison-jump.js: Added.
2732         (shouldBe):
2733         (above):
2734         (aboveOrEqual):
2735         (below):
2736         (belowOrEqual):
2737         (notAbove):
2738         (notAboveOrEqual):
2739         (notBelow):
2740         (notBelowOrEqual):
2741         * stress/uint32-comparison.js: Added.
2742         (shouldBe):
2743         (above):
2744         (aboveOrEqual):
2745         (below):
2746         (belowOrEqual):
2747         (aboveTest):
2748         (aboveOrEqualTest):
2749         (belowTest):
2750         (belowOrEqualTest):
2751
2752 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2753
2754         [DFG] Support ArrayPush with multiple args
2755         https://bugs.webkit.org/show_bug.cgi?id=175823
2756
2757         Reviewed by Saam Barati.
2758
2759         * microbenchmarks/array-push-0.js: Added.
2760         (arrayPush0):
2761         * microbenchmarks/array-push-1.js: Added.
2762         (arrayPush1):
2763         * microbenchmarks/array-push-2.js: Added.
2764         (arrayPush2):
2765         * microbenchmarks/array-push-3.js: Added.
2766         (arrayPush3):
2767         * stress/array-push-multiple-contiguous.js: Added.
2768         (shouldBe):
2769         (test):
2770         * stress/array-push-multiple-double-nan.js: Added.
2771         (shouldBe):
2772         (test):
2773         * stress/array-push-multiple-double.js: Added.
2774         (shouldBe):
2775         (test):
2776         * stress/array-push-multiple-int32.js: Added.
2777         (shouldBe):
2778         (test):
2779         * stress/array-push-multiple-many-contiguous.js: Added.
2780         (shouldBe):
2781         (test):
2782         * stress/array-push-multiple-many-double.js: Added.
2783         (shouldBe):
2784         (test):
2785         * stress/array-push-multiple-many-int32.js: Added.
2786         (shouldBe):
2787         (test):
2788         * stress/array-push-multiple-many-storage.js: Added.
2789         (shouldBe):
2790         (test):
2791         * stress/array-push-multiple-storage.js: Added.
2792         (shouldBe):
2793         (test):
2794
2795 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2796
2797         Unreviewed, rolling out r222518.
2798         https://bugs.webkit.org/show_bug.cgi?id=177507
2799
2800         Break the High Sierra build (Requested by yusukesuzuki on
2801         #webkit).
2802
2803         Reverted changeset:
2804
2805         "Add Above/Below comparisons for UInt32 patterns"
2806         https://bugs.webkit.org/show_bug.cgi?id=177281
2807         http://trac.webkit.org/changeset/222518
2808
2809 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2810
2811         Add Above/Below comparisons for UInt32 patterns
2812         https://bugs.webkit.org/show_bug.cgi?id=177281
2813
2814         Reviewed by Saam Barati.
2815
2816         * stress/uint32-comparison-jump.js: Added.
2817         (shouldBe):
2818         (above):
2819         (aboveOrEqual):
2820         (below):
2821         (belowOrEqual):
2822         (notAbove):
2823         (notAboveOrEqual):
2824         (notBelow):
2825         (notBelowOrEqual):
2826         * stress/uint32-comparison.js: Added.
2827         (shouldBe):
2828         (above):
2829         (aboveOrEqual):
2830         (below):
2831         (belowOrEqual):
2832         (aboveTest):
2833         (aboveOrEqualTest):
2834         (belowTest):
2835         (belowOrEqualTest):
2836
2837 2017-09-23  Keith Miller  <keith_miller@apple.com>
2838
2839         Fix infinite looping test262 test
2840         https://bugs.webkit.org/show_bug.cgi?id=177412
2841
2842         Reviewed by Yusuke Suzuki.
2843
2844         This test was poorly designed since failing it would cause the vm
2845         to inifinite loop. I've fixed it locally and will fix it on github pending
2846         the results of next weeks tc39 meeting.
2847
2848         * test262.yaml:
2849         * test262/test/language/statements/for-of/iterator-next-reference.js:
2850
2851 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2852
2853         test262: $.agent became $262.agent in test262 update
2854         https://bugs.webkit.org/show_bug.cgi?id=177407
2855
2856         Reviewed by Yusuke Suzuki.
2857
2858         * test262.yaml:
2859         ~320 tests pass now that we correctly make $262 available.
2860
2861 2017-09-22  Keith Miller  <keith_miller@apple.com>
2862
2863         Speculatively change iteration protocall to use the same next function
2864         https://bugs.webkit.org/show_bug.cgi?id=175653
2865
2866         Reviewed by Saam Barati.
2867
2868         Change test to match the new iteration behavior.
2869
2870         * stress/spread-optimized-properly.js:
2871
2872 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2873
2874         [DFG][FTL] Profile array vector length for array allocation
2875         https://bugs.webkit.org/show_bug.cgi?id=177051
2876
2877         Reviewed by Saam Barati.
2878
2879         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2880         (target):
2881
2882 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2883
2884         Unreviewed, rolling out r222380.
2885         https://bugs.webkit.org/show_bug.cgi?id=177352
2886
2887         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2888         #webkit).
2889
2890         Reverted changeset:
2891
2892         "[DFG][FTL] Profile array vector length for array allocation"
2893         https://bugs.webkit.org/show_bug.cgi?id=177051
2894         http://trac.webkit.org/changeset/222380
2895
2896 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2897
2898         [DFG][FTL] Profile array vector length for array allocation
2899         https://bugs.webkit.org/show_bug.cgi?id=177051
2900
2901         Reviewed by Saam Barati.
2902
2903         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2904         (target):
2905
2906 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2907
2908         Skip new hanging test262 tests.
2909         https://bugs.webkit.org/show_bug.cgi?id=177326
2910
2911         Unreviewed test gardening.
2912
2913         * test262.yaml:
2914
2915 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2916
2917         Mark 6 test262 tests as passing.
2918         https://bugs.webkit.org/show_bug.cgi?id=177307
2919
2920         Unreviewed test gardening.
2921
2922         * test262.yaml:
2923
2924 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2925
2926         Unreviewed follow-up to r222311.
2927
2928         * test262/harness/sta.js:
2929         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2930         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2931         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2932         * test262/test/built-ins/Array/from/elements-added-after.js:
2933         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2934         * test262/test/built-ins/Array/from/elements-updated-after.js:
2935         * test262/test/built-ins/Array/from/from-array.js:
2936         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2937         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2938         * test262/test/built-ins/Array/from/source-array-boundary.js:
2939         * test262/test/built-ins/Array/from/source-object-constructor.js:
2940         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2941         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2942         * test262/test/built-ins/Array/from/source-object-length.js:
2943         * test262/test/built-ins/Array/from/source-object-missing.js:
2944         * test262/test/built-ins/Array/from/source-object-without.js:
2945         * test262/test/built-ins/Array/from/this-null.js:
2946         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2947         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2948         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2949         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2950         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2951         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2952         * test262/test/language/literals/string/7.8.4-1gs.js:
2953         Fix some files that I failed to update when I applied my patch.
2954
2955 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2956
2957         Update test262 tests
2958         https://bugs.webkit.org/show_bug.cgi?id=177220
2959
2960         Reviewed by Saam Barati and Yusuke Suzuki.
2961
2962         * test262.yaml:
2963         * test262/test262-Revision.txt:
2964         New rebaselined expectations for all tests.
2965
2966         * test262/*:
2967         Updated.
2968
2969 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2970
2971         [DFG] Remove ToThis more aggressively
2972         https://bugs.webkit.org/show_bug.cgi?id=177056
2973
2974         Reviewed by Saam Barati.
2975
2976         * stress/generator-with-this-strict.js: Added.
2977         (shouldBe):
2978         (generator):
2979         (target):
2980         * stress/generator-with-this.js: Added.
2981         (shouldBe):
2982         (generator):
2983         (target):
2984
2985 2017-09-17  Michael Saboff  <msaboff@apple.com>
2986
2987         https://bugs.webkit.org/show_bug.cgi?id=177038
2988         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2989
2990         Reviewed by JF Bastien.
2991
2992         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2993         as it dies using too much memory.
2994
2995 2017-09-15  Saam Barati  <sbarati@apple.com>
2996
2997         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2998         https://bugs.webkit.org/show_bug.cgi?id=176981
2999
3000         Reviewed by Yusuke Suzuki.
3001
3002         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
3003         (assert):
3004         (verify):
3005         (func):
3006         (const.bar.createBuiltin):
3007
3008 2017-09-14  Saam Barati  <sbarati@apple.com>
3009
3010         It should be valid to exit before each set when doing arity fixup when inlining
3011         https://bugs.webkit.org/show_bug.cgi?id=176948
3012
3013         Reviewed by Keith Miller.
3014
3015         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
3016         (baz):
3017         (bar):
3018         (foo):
3019
3020 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
3021
3022         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
3023         https://bugs.webkit.org/show_bug.cgi?id=176867
3024
3025         Reviewed by Sam Weinig.
3026
3027         * microbenchmarks/object-get-own-property-symbols.js: Added.
3028         (test):
3029
3030 2017-09-13  Mark Lam  <mark.lam@apple.com>
3031
3032         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
3033         https://bugs.webkit.org/show_bug.cgi?id=176888
3034         <rdar://problem/34381832>
3035
3036         Not reviewed.
3037
3038         * stress/op_mod-ConstVar.js:
3039         * stress/op_mod-VarConst.js:
3040         * stress/op_mod-VarVar.js:
3041
3042 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
3043
3044         Skip 3 op_mod tests on Debug JSC bots.
3045         https://bugs.webkit.org/show_bug.cgi?id=176630
3046
3047         Unreviewed test gardening.
3048
3049         * stress/op_mod-ConstVar.js:
3050         * stress/op_mod-VarConst.js:
3051         * stress/op_mod-VarVar.js:
3052
3053 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3054
3055         [JSC] Fix Array allocation in Object.keys
3056         https://bugs.webkit.org/show_bug.cgi?id=176826
3057
3058         Reviewed by Saam Barati.
3059
3060         * stress/object-own-property-keys.js: Added.
3061         (shouldBe):
3062
3063 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3064
3065         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
3066         https://bugs.webkit.org/show_bug.cgi?id=176010
3067
3068         Reviewed by Filip Pizlo.
3069
3070         * microbenchmarks/weak-map-key.js: Added.
3071         (assert):
3072         (objectKey):
3073         (let.start.Date.now):
3074
3075 2017-09-12  Mark Lam  <mark.lam@apple.com>
3076
3077         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
3078         https://bugs.webkit.org/show_bug.cgi?id=176630
3079
3080         Reviewed by JF Bastien.
3081
3082         Debug builds are just slow, and these tests do a lot.  They pass when I run them
3083         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
3084         a speculative fix for the bots that are seeing these fail.
3085
3086         I also undid the skipping of the op_mod tests for debug builds.
3087
3088         * stress/op_div-ConstVar.js:
3089         * stress/op_div-VarConst.js:
3090         * stress/op_div-VarVar.js:
3091         * stress/op_mod-ConstVar.js:
3092         * stress/op_mod-VarConst.js:
3093         * stress/op_mod-VarVar.js:
3094
3095 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
3096
3097         Skip stress/value-to-boolean.js on Debug bots.
3098         https://bugs.webkit.org/show_bug.cgi?id=176787
3099
3100         Unreviewed test gardening.
3101
3102         * stress/value-to-boolean.js:
3103
3104 2017-09-11  Mark Lam  <mark.lam@apple.com>
3105
3106         Change test expectation for test262/test/language/statements/try/tco-catch.js
3107         https://bugs.webkit.org/show_bug.cgi?id=176749
3108
3109         Rubber stamped by Keith Miller.
3110
3111         It's been failing since at least r221821.  I'm changing the test expectation to
3112         fail to green the bots while I investigate some more.
3113
3114         * test262.yaml:
3115
3116 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
3117
3118         Unreviewed, rolling out r221854.
3119
3120         The test added with this change fails on 32-bit JSC bots.
3121
3122         Reverted changeset:
3123
3124         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
3125         https://bugs.webkit.org/show_bug.cgi?id=176010
3126         http://trac.webkit.org/changeset/221854
3127
3128 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3129
3130         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
3131         https://bugs.webkit.org/show_bug.cgi?id=176010
3132
3133         Reviewed by Filip Pizlo.
3134
3135         * microbenchmarks/weak-map-key.js: Added.
3136         (assert):
3137         (objectKey):
3138         (let.start.Date.now):
3139
3140 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
3141
3142         [JSC] Optimize Object.keys by using careful array allocation
3143         https://bugs.webkit.org/show_bug.cgi?id=176654
3144
3145         Reviewed by Darin Adler.
3146
3147         * microbenchmarks/object-keys.js: Added.
3148         (test):
3149
3150 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
3151
3152         Error should compute .stack and friends lazily
3153         https://bugs.webkit.org/show_bug.cgi?id=176645
3154
3155         Reviewed by Saam Barati.
3156
3157         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
3158         * microbenchmarks/new-error.js: Added.
3159         * microbenchmarks/throw.js: Added.
3160
3161 2017-09-09  Mark Lam  <mark.lam@apple.com>
3162
3163         [Re-landing] Use JIT probes for DFG OSR exit.
3164         https://bugs.webkit.org/show_bug.cgi?id=175144
3165         <rdar://problem/33437050>
3166
3167         Not reviewed.  Original patch reviewed by Saam Barati.
3168
3169         Disable these tests for debug builds because they run too slow with the new OSR exit.
3170
3171         * stress/op_mod-ConstVar.js:
3172         * stress/op_mod-VarConst.js:
3173         * stress/op_mod-VarVar.js:
3174
3175 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3176
3177         [DFG] NewArrayWithSize(size)'s size does not care negative zero
3178         https://bugs.webkit.org/show_bug.cgi?id=176300
3179
3180         Reviewed by Saam Barati.
3181
3182         * stress/new-array-with-size-div.js: Added.
3183         (shouldBe):
3184         (test):
3185         (i.i):
3186
3187 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3188
3189         [DFG] PutByVal with Array::Generic is too generic
3190         https://bugs.webkit.org/show_bug.cgi?id=176345
3191
3192         Reviewed by Filip Pizlo.
3193
3194         * stress/object-assign-symbols.js: Added.
3195         (shouldBe):
3196         (test):
3197         * stress/object-assign.js: Added.
3198         (shouldBe):
3199         (test):
3200         (i.shouldBe.JSON.stringify.test):
3201
3202 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3203
3204         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
3205         https://bugs.webkit.org/show_bug.cgi?id=176590
3206
3207         Reviewed by Saam Barati.
3208
3209         * microbenchmarks/object-iterate-symbols.js: Added.
3210         (test):
3211         * microbenchmarks/object-iterate.js: Added.
3212         (test):
3213         * stress/object-iterate-symbols.js: Added.
3214         (shouldBe):
3215         (test):
3216         * stress/object-iterate.js: Added.
3217         (shouldBe):
3218         (test):
3219
3220 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
3221
3222         [Win32] 10 JSC stress tests are failing.
3223         https://bugs.webkit.org/show_bug.cgi?id=176538
3224
3225         Reviewed by Mark Lam.
3226
3227         Skip tests on Windows to make the bots green.
3228
3229         * ChakraCore.yaml:
3230         * stress/date-relaxed.js:
3231
3232 2017-09-06  Mark Lam  <mark.lam@apple.com>
3233
3234         constructGenericTypedArrayViewWithArguments() is missing an exception check.
3235         https://bugs.webkit.org/show_bug.cgi?id=176485
3236         <rdar://problem/33898874>
3237
3238         Reviewed by Keith Miller.
3239
3240         * stress/regress-176485.js: Added.
3241
3242 2017-09-05  Saam Barati  <sbarati@apple.com>
3243
3244         isNotCellSpeculation is wrong with respect to SpecEmpty
3245         https://bugs.webkit.org/show_bug.cgi?id=176429
3246
3247         Reviewed by Michael Saboff.
3248
3249         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
3250         (Foo):
3251
3252 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
3253
3254         test262: Completion values for control flow do not match the spec
3255         https://bugs.webkit.org/show_bug.cgi?id=171265
3256
3257         Reviewed by Saam Barati.
3258
3259         * stress/completion-value.js:
3260         Condensed test for completion values in top level statements.
3261
3262         * stress/super-get-by-id.js:
3263         ClassDeclaration when evaled no longer produce values. Convert
3264         these to ClassExpressions so they produce the class value.
3265         
3266         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3267         This is a progression for currect spec behavior.
3268
3269         * mozilla/mozilla-tests.yaml:
3270         This test is now outdated, so mark it as failing for that reason.
3271
3272         * test262.yaml:
3273         Passing all "cptn" completion value tests.
3274
3275 2017-09-04  Saam Barati  <sbarati@apple.com>
3276
3277         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
3278         https://bugs.webkit.org/show_bug.cgi?id=176317
3279
3280         Reviewed by Keith Miller.
3281
3282         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
3283         (Foo):
3284
3285 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3286
3287         [DFG][FTL] Efficiently execute number#toString()
3288         https://bugs.webkit.org/show_bug.cgi?id=170007
3289
3290         Reviewed by Keith Miller.
3291
3292         * microbenchmarks/number-to-string-strength-reduction.js: Added.
3293         (test):
3294         * microbenchmarks/number-to-string-with-radix-10.js: Added.
3295         (test):
3296         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
3297         (test):
3298         * microbenchmarks/number-to-string-with-radix.js: Added.
3299         (test):
3300         * stress/number-to-string-strength-reduction.js: Added.
3301         (shouldBe):
3302         (test):
3303         * stress/number-to-string-with-radix-10.js: Added.
3304         (shouldBe):
3305         (test):
3306         * stress/number-to-string-with-radix-cse.js: Added.
3307         (shouldBe):
3308         (test):
3309         * stress/number-to-string-with-radix-invalid.js: Added.
3310         (shouldThrow):
3311         * stress/number-to-string-with-radix-watchpoint.js: Added.
3312         (shouldBe):
3313         (test):
3314         (i.i.1e3.Number.prototype.toString):
3315         * stress/number-to-string-with-radix.js: Added.
3316         (shouldBe):
3317         (test):
3318
3319 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3320
3321         [DFG] Relax arity requirement
3322         https://bugs.webkit.org/show_bug.cgi?id=175523
3323
3324         Reviewed by Saam Barati.
3325
3326         * stress/arity-mismatch-arguments-length.js: Added.
3327         (shouldBe):
3328         (test1):
3329         (test):
3330         * stress/arity-mismatch-get-argument.js: Added.
3331         (shouldBe):
3332         (builtin.createBuiltin):
3333         (test):
3334         * stress/arity-mismatch-inlining-extra-slots.js: Added.
3335         (shouldBe):
3336         (inlineTarget):
3337         (test):
3338         * stress/arity-mismatch-inlining.js: Added.
3339         (shouldBe):
3340         (inlineTarget):
3341         (test):
3342         * stress/arity-mismatch-rest.js: Added.
3343         (shouldBe):
3344         (test2):
3345         (test1):
3346         (test):
3347
3348 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3349
3350         [JSC] Fix "name" and "length" of Proxy revoke function
3351         https://bugs.webkit.org/show_bug.cgi?id=176155
3352
3353         Reviewed by Mark Lam.
3354
3355         * test262.yaml:
3356
3357 2017-08-31  Saam Barati  <sbarati@apple.com>
3358
3359         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
3360         https://bugs.webkit.org/show_bug.cgi?id=176206
3361
3362         Reviewed by Keith Miller.
3363
3364         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
3365         (a):
3366         (b):
3367         (foo):
3368
3369 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
3370
3371         Skip two slow JSC tests after r221422.
3372
3373         Unreviewed test gardening.
3374
3375         * stress/regexp-prototype-match-on-too-long-rope.js:
3376         * stress/regexp-prototype-test-on-too-long-rope.js:
3377
3378 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
3379
3380         Unreviewed, skipping slow tests.
3381         
3382         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
3383         work differently now.
3384
3385         * stress/regexp-prototype-exec-on-too-long-rope.js:
3386         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
3387
3388 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3389
3390         [JSC] Use reifying system for "name" property of builtin JSFunction
3391         https://bugs.webkit.org/show_bug.cgi?id=175260
3392
3393         Reviewed by Saam Barati.
3394
3395         * stress/accessors-get-set-prefix.js:
3396         * stress/builtin-function-name.js: Added.
3397         (shouldBe):
3398         (shouldThrow):
3399         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3400         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3401         * stress/private-name-as-anonymous-builtin.js: Added.
3402         (shouldBe):
3403         (NotPromise):
3404
3405 2017-08-30  Saam Barati  <sbarati@apple.com>
3406
3407         Unreviewed. Make test stop printing.
3408
3409         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
3410
3411 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
3412
3413         Unreviewed, rolling out r221327.
3414
3415         This change caused test262 failures.
3416
3417         Reverted changeset:
3418
3419         "[JSC] Use reifying system for "name" property of builtin
3420         JSFunction"
3421         https://bugs.webkit.org/show_bug.cgi?id=175260
3422         http://trac.webkit.org/changeset/221327
3423
3424 2017-08-30  Saam Barati  <sbarati@apple.com>
3425
3426         semicolon is being interpreted as an = in the LiteralParser
3427         https://bugs.webkit.org/show_bug.cgi?id=176114
3428
3429         Reviewed by Oliver Hunt.
3430
3431         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
3432         * stress/resources/literal-parser-test-case.js: Added.
3433
3434 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3435
3436         [ESNext] Async iteration - Implement async iteration statement: for-await-of
3437         https://bugs.webkit.org/show_bug.cgi?id=166698
3438
3439         Reviewed by Yusuke Suzuki.
3440
3441         * stress/async-iteration-for-await-of-syntax.js: Added.
3442         (assert):
3443         (checkSyntax):
3444         (checkSyntaxError):
3445         (checkSimpleAsyncGeneratorSloppyMode):
3446         (checkSimpleAsyncGeneratorStrictMode):
3447         (checkNestedAsyncGenerators):
3448         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3449         * stress/async-iteration-for-await-of.js: Added.
3450         (assert):
3451         (async.foo):
3452         (async.boo):
3453         (const.boo.async):
3454
3455 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
3456
3457         [JSC] Use reifying system for "name" property of builtin JSFunction
3458         https://bugs.webkit.org/show_bug.cgi?id=175260
3459
3460         Reviewed by Saam Barati.
3461
3462         * stress/accessors-get-set-prefix.js:
3463         * stress/builtin-function-name.js: Added.
3464         (shouldBe):
3465         (shouldThrow):
3466         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3467         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3468
3469 2017-08-25  Saam Barati  <sbarati@apple.com>
3470
3471         Support compiling catch in the DFG
3472         https://bugs.webkit.org/show_bug.cgi?id=174590
3473         <rdar://problem/34047845>
3474
3475         Reviewed by Filip Pizlo.
3476
3477         * microbenchmarks/delta-blue-try-catch.js: Added.
3478         (exception):
3479         (value):
3480         (OrderedCollection):
3481         (OrderedCollection.prototype.add):
3482         (OrderedCollection.prototype.at):
3483         (OrderedCollection.prototype.size):
3484         (OrderedCollection.prototype.removeFirst):
3485         (OrderedCollection.prototype.remove):
3486         (Strength):
3487         (Strength.stronger):
3488         (Strength.weaker):
3489         (Strength.weakestOf):
3490         (Strength.strongest):
3491         (Strength.prototype.nextWeaker):
3492         (Constraint):
3493         (Constraint.prototype.addConstraint):
3494         (Constraint.prototype.satisfy):
3495         (Constraint.prototype.destroyConstraint):
3496         (Constraint.prototype.isInput):
3497         (UnaryConstraint):
3498         (UnaryConstraint.prototype.addToGraph):
3499         (UnaryConstraint.prototype.chooseMethod):
3500         (UnaryConstraint.prototype.isSatisfied):
3501         (UnaryConstraint.prototype.markInputs):
3502         (UnaryConstraint.prototype.output):
3503         (UnaryConstraint.prototype.recalculate):
3504         (UnaryConstraint.prototype.markUnsatisfied):
3505         (UnaryConstraint.prototype.inputsKnown):
3506         (UnaryConstraint.prototype.removeFromGraph):
3507         (StayConstraint):
3508         (StayConstraint.prototype.execute):
3509         (EditConstraint.prototype.isInput):
3510         (EditConstraint.prototype.execute):
3511         (BinaryConstraint):
3512         (BinaryConstraint.prototype.chooseMethod):
3513         (BinaryConstraint.prototype.addToGraph):
3514         (BinaryConstraint.prototype.isSatisfied):
3515         (BinaryConstraint.prototype.markInputs):
3516         (BinaryConstraint.prototype.input):
3517         (BinaryConstraint.prototype.output):
3518         (BinaryConstraint.prototype.recalculate):
3519         (BinaryConstraint.prototype.markUnsatisfied):
3520         (BinaryConstraint.prototype.inputsKnown):
3521         (BinaryConstraint.prototype.removeFromGraph):
3522         (ScaleConstraint):
3523         (ScaleConstraint.prototype.addToGraph):
3524         (ScaleConstraint.prototype.removeFromGraph):
3525         (ScaleConstraint.prototype.markInputs):
3526         (ScaleConstraint.prototype.execute):
3527         (ScaleConstraint.prototype.recalculate):
3528         (EqualityConstraint):
3529         (EqualityConstraint.prototype.execute):
3530         (Variable):
3531         (Variable.prototype.addConstraint):
3532         (Variable.prototype.removeConstraint):
3533         (Planner):
3534         (Planner.prototype.incrementalAdd):
3535         (Planner.prototype.incrementalRemove):
3536         (Planner.prototype.newMark):
3537         (Planner.prototype.makePlan):
3538         (Planner.prototype.extractPlanFromConstraints):
3539         (Planner.prototype.addPropagate):
3540         (Planner.prototype.removePropagateFrom):
3541         (Planner.prototype.addConstraintsConsumingTo):
3542         (Plan):
3543         (Plan.prototype.addConstraint):
3544         (Plan.prototype.size):
3545         (Plan.prototype.constraintAt):
3546         (Plan.prototype.execute):
3547         (chainTest):
3548         (projectionTest):
3549         (change):
3550         (deltaBlue):
3551         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3552         (assert):
3553         (Numbers):
3554         (Numbers.prototype.next):
3555         (return.Transpose):
3556         (return.Transpose.prototype.next):
3557         (transpose):
3558         (verifyEven):
3559         (verifyString):
3560         (foo):
3561         (runIterators):
3562         * microbenchmarks/try-catch-word-count.js: Added.
3563         (let.assert):
3564         (EOF):
3565         (let.texts):
3566         (let.o.apply):
3567         (foo):
3568         (bar):
3569         (f):
3570         (run):
3571         (test1):
3572         (test2):
3573         (test3):
3574         (fn):
3575         (A):
3576         (B):
3577         (A.prototype.getValue):
3578         (B.prototype.getParentValue):
3579         (strlen):
3580         (sum.0):
3581         (test):
3582         (result.test.o):
3583         (set add.set add):
3584         (set forEach):
3585         (stringHash):
3586         (set if):
3587         (testFunction):
3588         (set delete.set has.set add):
3589         * stress/catch-set-argument-speculation-failure.js: Added.
3590         (o):
3591         (e):
3592         (e2):
3593         (escape):
3594         (baz):
3595         (noInline.run):
3596         (noInline):
3597         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3598         (foo):
3599         (e):
3600         (baz):
3601         (bar):
3602
3603 2017-08-24  Commit Queue  <commit-queue@webkit.org>
3604
3605         Unreviewed, rolling out r221119, r221124, and r221143.
3606         https://bugs.webkit.org/show_bug.cgi?id=175973
3607
3608         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3609         on #webkit).
3610
3611         Reverted changesets:
3612
3613         "Support compiling catch in the DFG"
3614         https://bugs.webkit.org/show_bug.cgi?id=174590
3615         http://trac.webkit.org/changeset/221119
3616
3617         "Unreviewed, build fix in GTK port"
3618         https://bugs.webkit.org/show_bug.cgi?id=174590
3619         http://trac.webkit.org/changeset/221124
3620
3621         "DFG::JITCode::osrEntry should get sorted since we perform a
3622         binary search on it"
3623         https://bugs.webkit.org/show_bug.cgi?id=175893
3624         http://trac.webkit.org/changeset/221143
3625
3626 2017-08-24  Michael Saboff  <msaboff@apple.com>
3627
3628         Add support for RegExp "dotAll" flag
3629         https://bugs.webkit.org/show_bug.cgi?id=175924
3630
3631         Reviewed by Keith Miller.
3632
3633         Updated tests for new dotAll ('s' flag) changes.
3634
3635         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3636         * stress/static-getter-in-names.js:
3637
3638 2017-08-24  Mark Lam  <mark.lam@apple.com>
3639
3640         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3641         https://bugs.webkit.org/show_bug.cgi?id=175940
3642         <rdar://problem/29003921>
3643
3644         Reviewed by Saam Barati.
3645
3646         * stress/regress-164081.js: Added.
3647         (shouldEqual):
3648         (testcase):
3649
3650 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3651
3652         Skip flaky JSC test stress/test-finally.js.
3653         https://bugs.webkit.org/show_bug.cgi?id=160283
3654
3655         Unreviewed test gardening.
3656
3657         * stress/test-finally.js:
3658
3659 2017-08-23  Saam Barati  <sbarati@apple.com>
3660
3661         Support compiling catch in the DFG
3662         https://bugs.webkit.org/show_bug.cgi?id=174590
3663
3664         Reviewed by Filip Pizlo.
3665
3666         * microbenchmarks/delta-blue-try-catch.js: Added.
3667         (exception):
3668         (value):
3669         (OrderedCollection):
3670         (OrderedCollection.prototype.add):
3671         (OrderedCollection.prototype.at):
3672         (OrderedCollection.prototype.size):
3673         (OrderedCollection.prototype.removeFirst):
3674         (OrderedCollection.prototype.remove):
3675         (Strength):
3676         (Strength.stronger):
3677         (Strength.weaker):
3678         (Strength.weakestOf):
3679         (Strength.strongest):
3680         (Strength.prototype.nextWeaker):
3681         (Constraint):
3682         (Constraint.prototype.addConstraint):
3683         (Constraint.prototype.satisfy):
3684         (Constraint.prototype.destroyConstraint):
3685         (Constraint.prototype.isInput):
3686         (UnaryConstraint):
3687         (UnaryConstraint.prototype.addToGraph):
3688         (UnaryConstraint.prototype.chooseMethod):
3689         (UnaryConstraint.prototype.isSatisfied):
3690         (UnaryConstraint.prototype.markInputs):
3691         (UnaryConstraint.prototype.output):
3692         (UnaryConstraint.prototype.recalculate):
3693         (UnaryConstraint.prototype.markUnsatisfied):
3694         (UnaryConstraint.prototype.inputsKnown):
3695         (UnaryConstraint.prototype.removeFromGraph):
3696         (StayConstraint):
3697         (StayConstraint.prototype.execute):
3698         (EditConstraint.prototype.isInput):
3699         (EditConstraint.prototype.execute):
3700         (BinaryConstraint):
3701         (BinaryConstraint.prototype.chooseMethod):
3702         (BinaryConstraint.prototype.addToGraph):
3703         (BinaryConstraint.prototype.isSatisfied):
3704         (BinaryConstraint.prototype.markInputs):
3705         (BinaryConstraint.prototype.input):
3706         (BinaryConstraint.prototype.output):
3707         (BinaryConstraint.prototype.recalculate):
3708         (BinaryConstraint.prototype.markUnsatisfied):
3709         (BinaryConstraint.prototype.inputsKnown):
3710         (BinaryConstraint.prototype.removeFromGraph):
3711         (ScaleConstraint):
3712         (ScaleConstraint.prototype.addToGraph):
3713         (ScaleConstraint.prototype.removeFromGraph):
3714         (ScaleConstraint.prototype.markInputs):
3715         (ScaleConstraint.prototype.execute):
3716         (ScaleConstraint.prototype.recalculate):
3717         (EqualityConstraint):
3718         (EqualityConstraint.prototype.execute):
3719         (Variable):
3720         (Variable.prototype.addConstraint):
3721         (Variable.prototype.removeConstraint):
3722         (Planner):
3723         (Planner.prototype.incrementalAdd):
3724         (Planner.prototype.incrementalRemove):
3725         (Planner.prototype.newMark):
3726         (Planner.prototype.makePlan):
3727         (Planner.prototype.extractPlanFromConstraints):
3728         (Planner.prototype.addPropagate):
3729         (Planner.prototype.removePropagateFrom):