Assertion used to determine if something is an async generator is wrong
[WebKit-https.git] / JSTests / ChangeLog
1 2017-12-28  Saam Barati  <sbarati@apple.com>
2
3         Assertion used to determine if something is an async generator is wrong
4         https://bugs.webkit.org/show_bug.cgi?id=181168
5         <rdar://problem/35640560>
6
7         Reviewed by Yusuke Suzuki.
8
9         * stress/async-generator-assertion.js: Added.
10
11 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
12
13         Skip stress/splay-flash-access tests on memory limited platforms
14         https://bugs.webkit.org/show_bug.cgi?id=181086
15
16         Reviewed by Carlos Alberto Lopez Perez.
17
18         These tests use about 185M of memory, and occasionally get OOM-killed
19         on memory limited platforms.
20
21         * stress/splay-flash-access-1ms.js:
22         * stress/splay-flash-access.js:
23
24 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
25
26         Skip slow jsc tests on embedded platforms
27         https://bugs.webkit.org/show_bug.cgi?id=180937
28
29         Reviewed by Carlos Alberto Lopez Perez.
30
31         The tests typeProfiler/deltablue-for-of.js and
32         typeProfiler/getter-richards.js take a very long time in the
33         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
34         thus always timeout. They should be skipped on these platforms.
35
36         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
37         * typeProfiler/getter-richards.js: Skip on arm*/mips.
38
39 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
40
41         [JSC] Do not check isValid() in op_new_regexp
42         https://bugs.webkit.org/show_bug.cgi?id=180970
43
44         Reviewed by Saam Barati.
45
46         * stress/regexp-syntax-error-invalid-flags.js: Added.
47         (shouldThrow):
48
49 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
50
51         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
52         https://bugs.webkit.org/show_bug.cgi?id=180712
53
54         Reviewed by Michael Catanzaro.
55
56         stress/call-apply-exponential-bytecode-size.js crashes if the
57         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
58         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
59         should skip the test on other platforms.
60
61         * stress/call-apply-exponential-bytecode-size.js:
62
63 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
64
65         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
66         https://bugs.webkit.org/show_bug.cgi?id=179762
67
68         Reviewed by Saam Barati.
69
70         * stress/call-varargs-double-new-array-buffer.js: Added.
71         (assert):
72         (bar):
73         (foo):
74         * stress/call-varargs-spread-new-array-buffer.js: Added.
75         (assert):
76         (bar):
77         (foo):
78         * stress/call-varargs-spread-new-array-buffer2.js: Added.
79         (assert):
80         (bar):
81         (foo):
82         * stress/forward-varargs-double-new-array-buffer.js: Added.
83         (assert):
84         (test.baz):
85         (test.bar):
86         (test.foo):
87         (test):
88         * stress/new-array-buffer-sinking-osrexit.js: Added.
89         (target):
90         (test):
91         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
92         (shouldBe):
93         (test):
94         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
95         (shouldBe):
96         (target):
97         (test):
98         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
99         (assert):
100         (test1.bar):
101         (test1.foo):
102         (test1):
103         (test2.bar):
104         (test2.foo):
105         (test3.baz):
106         (test3.bar):
107         (test3.foo):
108         (test4.baz):
109         (test4.bar):
110         (test4.foo):
111         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
112         (assert):
113         (test.baz):
114         (test.bar):
115         (test.foo):
116         (test):
117         * stress/phantom-new-array-buffer-osr-exit.js: Added.
118         (assert):
119         (baz):
120         (bar):
121         (effects):
122         (foo):
123
124 2017-12-14  Saam Barati  <sbarati@apple.com>
125
126         The CleanUp after LICM is erroneously removing a Check
127         https://bugs.webkit.org/show_bug.cgi?id=180852
128         <rdar://problem/36063494>
129
130         Reviewed by Filip Pizlo.
131
132         * stress/dont-run-cleanup-after-licm.js: Added.
133
134 2017-12-14  Michael Saboff  <msaboff@apple.com>
135
136         REGRESSION (r225695): Repro crash on yahoo login page
137         https://bugs.webkit.org/show_bug.cgi?id=180761
138
139         Reviewed by JF Bastien.
140
141         New regression test.
142
143         * stress/regress-180761.js: Added.
144
145 2017-12-13  Keith Miller  <keith_miller@apple.com>
146
147         JSObjects should have a mask for loading indexed properties
148         https://bugs.webkit.org/show_bug.cgi?id=180768
149
150         Reviewed by Mark Lam.
151
152         * stress/int16-put-by-val-in-and-out-of-bounds.js:
153         (test):
154
155 2017-12-13  Saam Barati  <sbarati@apple.com>
156
157         Arrow functions need their own structure because they have different properties than sloppy functions
158         https://bugs.webkit.org/show_bug.cgi?id=180779
159         <rdar://problem/35814591>
160
161         Reviewed by Mark Lam.
162
163         * stress/arrow-function-needs-its-own-structure.js: Added.
164         (assert):
165         (readPrototype):
166         (noInline.let.f1):
167         (noInline):
168
169 2017-12-13  Saam Barati  <sbarati@apple.com>
170
171         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
172         https://bugs.webkit.org/show_bug.cgi?id=163579
173         <rdar://problem/35455798>
174
175         Reviewed by Mark Lam.
176
177         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
178         (assert):
179         (test1):
180         (i.test1):
181         (i.test1.C):
182         (i.test1.async.foo):
183         (i.test1.foo):
184         (test2):
185
186 2017-12-13  Saam Barati  <sbarati@apple.com>
187
188         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
189         https://bugs.webkit.org/show_bug.cgi?id=180734
190         <rdar://problem/35640547>
191
192         Reviewed by Yusuke Suzuki.
193
194         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
195         (__isPropertyOfType):
196         (__getProperties):
197         (__getObjects):
198         (__getRandomObject):
199         (theClass.):
200         (theClass):
201         (childClass):
202         (counter.catch):
203
204 2017-12-12  Saam Barati  <sbarati@apple.com>
205
206         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
207         https://bugs.webkit.org/show_bug.cgi?id=180725
208         <rdar://problem/35970511>
209
210         Reviewed by Michael Saboff.
211
212         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
213         (f1):
214         (f2):
215         (let.o2.valueOf):
216
217 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
218
219         [JSC] Implement optimized WeakMap and WeakSet
220         https://bugs.webkit.org/show_bug.cgi?id=179929
221
222         Reviewed by Saam Barati.
223
224         * microbenchmarks/weak-map-key.js:
225         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
226         (assert):
227         (objectKey):
228         (let.start.Date.now):
229         * stress/basic-weakmap.js: Added.
230         (shouldBe):
231         (test):
232         * stress/basic-weakset.js: Added.
233         (shouldBe):
234         (test.set new):
235         * stress/weakmap-cse-set-break.js: Added.
236         (shouldBe):
237         (test):
238         * stress/weakmap-cse.js: Added.
239         (shouldBe):
240         (test):
241         * stress/weakmap-gc.js: Added.
242         (test):
243         * stress/weakset-cse-add-break.js: Added.
244         (shouldBe):
245         (test.set new):
246         * stress/weakset-cse.js: Added.
247         (shouldBe):
248         (test.set new):
249         * stress/weakset-gc.js: Added.
250         (test.set add):
251         (test.set new):
252         (test):
253
254 2017-12-12  Saam Barati  <sbarati@apple.com>
255
256         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
257         https://bugs.webkit.org/show_bug.cgi?id=180723
258         <rdar://problem/35859726>
259
260         Reviewed by JF Bastien.
261
262         * stress/get-my-argument-by-val-constant-folding.js: Added.
263         (test):
264         (catch):
265
266 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
267
268         [ESNext][BigInt] Implement BigInt literals and JSBigInt
269         https://bugs.webkit.org/show_bug.cgi?id=179000
270
271         Reviewed by Darin Adler and Yusuke Suzuki.
272
273         * bigIntTests.yaml: Added.
274         * stress/big-int-literal-line-terminator.js: Added.
275         * stress/big-int-literals.js: Added.
276         * stress/big-int-operations-error.js: Added.
277         * stress/big-int-type-of.js: Added.
278         * stress/big-int-white-space-trailing-leading.js: Added.
279         * stress/big-int-function-apply.js: Added.
280
281 2017-12-11  Saam Barati  <sbarati@apple.com>
282
283         We need to disableCaching() in ErrorInstance when we materialize properties
284         https://bugs.webkit.org/show_bug.cgi?id=180343
285         <rdar://problem/35833002>
286
287         Reviewed by Mark Lam.
288
289         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
290         (assert):
291         (makeError):
292         (storeToStack):
293         (storeToStackAlreadyMaterialized):
294
295 2017-12-05  JF Bastien  <jfbastien@apple.com>
296
297         WebAssembly: don't eagerly checksum
298         https://bugs.webkit.org/show_bug.cgi?id=180441
299         <rdar://problem/35156628>
300
301         Reviewed by Saam Barati.
302
303         Checksum is now disabled, so tests only have <?> as the module
304         name.
305
306         * wasm/function-tests/nameSection.js:
307         * wasm/function-tests/stack-overflow.js:
308         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
309         (assertOverflows.assertThrows):
310         (assertOverflows):
311         * wasm/function-tests/stack-trace.js:
312
313 2017-12-04  JF Bastien  <jfbastien@apple.com>
314
315         Proxy all functions, except the $ objects
316         https://bugs.webkit.org/show_bug.cgi?id=180375
317
318         Reviewed by Saam Barati.
319
320         It looks like this test may have broken some executions because I
321         call some internal objects. Explicitly ignore objects whose name
322         starts with "$" because it's a bad idea anyways.
323
324         * stress/proxy-all-the-parameters.js:
325         (generateObjects):
326         (get throw):
327
328 2017-12-04  Saam Barati  <sbarati@apple.com>
329
330         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
331         https://bugs.webkit.org/show_bug.cgi?id=180366
332         <rdar://problem/35685877>
333
334         Reviewed by Michael Saboff.
335
336         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
337         (theParent):
338         (test1.base.getParentStaticValue):
339         (test1.base):
340         (test1.__v_24888.prototype.set prop):
341         (test1.__v_24888):
342         (test2.base.getParentStaticValue):
343         (test2.base):
344         (test2.__v_24888.prototype.set prop):
345         (test2.__v_24888):
346         (test2):
347
348 2017-12-01  JF Bastien  <jfbastien@apple.com>
349
350         Try proxying all function arguments
351         https://bugs.webkit.org/show_bug.cgi?id=180306
352
353         Reviewed by Saam Barati.
354
355         * stress/proxy-all-the-parameters.js: Added.
356         (isPropertyOfType):
357         (getProperties):
358         (generateObjects):
359         (getObjects):
360         (getFunctions):
361         (get throw):
362         (let.o.of.getObjects.let.f.of.getFunctions.catch):
363
364 2017-12-01  JF Bastien  <jfbastien@apple.com>
365
366         JavaScriptCore: missing exception checks in Math functions that take more than one argument
367         https://bugs.webkit.org/show_bug.cgi?id=180297
368         <rdar://problem/35745556>
369
370         Reviewed by Mark Lam.
371
372         * stress/math-exceptions.js: Added.
373         (get try):
374         (catch):
375
376 2017-12-01  JF Bastien  <jfbastien@apple.com>
377
378         JavaScriptCore: add test for weird class static getters
379         https://bugs.webkit.org/show_bug.cgi?id=180281
380         <rdar://problem/35592139>
381
382         Reviewed by Mark Lam.
383
384         I fixed a bug for it in r224927 and didn't add a test. Do so.
385
386         * stress/class-static-get-weird.js: Added.
387         (c.prototype.get name):
388         (c):
389         (c.prototype.get arguments):
390         (c.prototype.get caller):
391         (c.prototype.get length):
392
393 2017-12-01  Saam Barati  <sbarati@apple.com>
394
395         Having a bad time needs to handle ArrayClass indexing type as well
396         https://bugs.webkit.org/show_bug.cgi?id=180274
397         <rdar://problem/35667869>
398
399         Reviewed by Keith Miller and Mark Lam.
400
401         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
402         (assert):
403         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
404         (assert):
405
406 2017-12-01  JF Bastien  <jfbastien@apple.com>
407
408         WebAssembly: restore cached stack limit after out-call
409         https://bugs.webkit.org/show_bug.cgi?id=179106
410         <rdar://problem/35337525>
411
412         Reviewed by Saam Barati.
413
414         * wasm/function-tests/double-instance.js: Added.
415         (const.imp.boom):
416         (const.imp.get callAnother):
417
418 2017-11-30  JF Bastien  <jfbastien@apple.com>
419
420         WebAssembly: improve stack trace
421         https://bugs.webkit.org/show_bug.cgi?id=179343
422
423         Reviewed by Saam Barati.
424
425         Update the tests to follow the new format. Notably, SHA1 module
426         hash is now included in traces, and stubs are properly identified.
427
428         * wasm/assert.js: Add an assertion which matches regular expressions.
429         * wasm/function-tests/nameSection.js:
430         * wasm/function-tests/stack-overflow.js:
431         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
432         (assertOverflows.assertThrows.wasm.1):
433         (assertOverflows.assertThrows.wasm.0):
434         (assertOverflows.assertThrows):
435         (assertOverflows):
436         * wasm/function-tests/stack-trace.js:
437         (import.Builder.from.string_appeared_here.assert): Deleted.
438         * wasm/function-tests/trap-after-cross-instance-call.js:
439         (wasmFrameCountFromError):
440         * wasm/function-tests/trap-load-2.js:
441         (wasmFrameCountFromError):
442         * wasm/function-tests/trap-load.js:
443         (wasmFrameCountFromError):
444
445 2017-11-30  Mark Lam  <mark.lam@apple.com>
446
447         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
448         https://bugs.webkit.org/show_bug.cgi?id=180219
449         <rdar://problem/35696536>
450
451         Reviewed by Filip Pizlo.
452
453         * stress/regress-180219.js: Added.
454
455 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
456
457         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
458         https://bugs.webkit.org/show_bug.cgi?id=180190
459
460         Reviewed by Mark Lam.
461
462         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
463         (shouldBe):
464         (test1):
465         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
466         (shouldBe):
467         (test1):
468         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
469         (shouldBe):
470         (test1):
471         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
472         (shouldBe):
473         (test1):
474         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
475         (shouldBe):
476         (test1):
477         * stress/operation-in-may-have-negative-int32.js: Added.
478         (shouldBe):
479         (test2):
480         * stress/operation-in-negative-int32-cast.js: Added.
481         (shouldBe):
482         (test1):
483
484 2017-11-28  JF Bastien  <jfbastien@apple.com>
485
486         Strict and sloppy functions shouldn't share structure
487         https://bugs.webkit.org/show_bug.cgi?id=180103
488         <rdar://problem/35667847>
489
490         Reviewed by Saam Barati.
491
492         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
493         because the IC was wrong.
494         (foo):
495         (bar):
496         (baz):
497         (catch):
498         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
499         in this patch, but may as well test odd strict mode corner cases.
500         (bar):
501         (baz):
502         (catch):
503         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
504         (foo):
505         (bar):
506         (baz):
507         (catch):
508         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
509         next file, but with invalidation of the FunctionExecutable's
510         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
511         slower path.
512         (foo):
513         (bar.const.x):
514         (bar.const.y):
515         (bar):
516         (catch):
517         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
518         strict nesting works correctly.
519         (foo):
520         (bar.baz):
521         (bar):
522         * stress/strict-function-structure.js: Added. The test used to
523         assert in objectProtoFuncHasOwnProperty.
524         (foo):
525         (bar):
526         (baz):
527         * stress/strict-nested-function-structure.js: Added. Nesting.
528         (foo):
529         (bar):
530         (baz.boo):
531         (baz):
532
533 2017-11-29  Robin Morisset  <rmorisset@apple.com>
534
535         The recursive tail call optimisation is wrong on closures
536         https://bugs.webkit.org/show_bug.cgi?id=179835
537
538         Reviewed by Saam Barati.
539
540         * stress/closure-recursive-tail-call.js: Added.
541         (makeClosure):
542
543 2017-11-27  JF Bastien  <jfbastien@apple.com>
544
545         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
546         https://bugs.webkit.org/show_bug.cgi?id=180051
547         <rdar://problem/35614371>
548
549         Reviewed by Saam Barati.
550
551         * stress/rest-parameter-negative.js: Added.
552         (__f_5484):
553         (catch):
554         (__f_5485):
555         (__v_22598.catch):
556
557 2017-11-27  Saam Barati  <sbarati@apple.com>
558
559         Spread can escape when CreateRest does not
560         https://bugs.webkit.org/show_bug.cgi?id=180057
561         <rdar://problem/35676119>
562
563         Reviewed by JF Bastien.
564
565         * stress/spread-escapes-but-create-rest-does-not.js: Added.
566         (assert):
567         (getProperties):
568         (theFunc):
569         (let.obj.valueOf):
570
571 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
572
573         [DFG] Add NormalizeMapKey DFG IR
574         https://bugs.webkit.org/show_bug.cgi?id=179912
575
576         Reviewed by Saam Barati.
577
578         * stress/map-untyped-normalize-cse.js: Added.
579         (shouldBe):
580         (test):
581         * stress/map-untyped-normalize.js: Added.
582         (shouldBe):
583         (test):
584         * stress/set-untyped-normalize-cse.js: Added.
585         (shouldBe):
586         (set return.set has.set has):
587         * stress/set-untyped-normalize.js: Added.
588         (shouldBe):
589         (set return.set has):
590
591 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
592
593         [FTL] Support DeleteById and DeleteByVal
594         https://bugs.webkit.org/show_bug.cgi?id=180022
595
596         Reviewed by Saam Barati.
597
598         * stress/delete-by-id.js: Added.
599         (shouldBe):
600         (test1):
601         (test2):
602         * stress/delete-by-val-ftl.js: Added.
603         (shouldBe):
604         (test1):
605         (test2):
606
607 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
608
609         [DFG] Introduce {Set,Map,WeakMap}Fields
610         https://bugs.webkit.org/show_bug.cgi?id=179925
611
612         Reviewed by Saam Barati.
613
614         * stress/map-set-clobber-map-get.js: Added.
615         (shouldBe):
616         (test):
617         * stress/map-set-does-not-clobber-set-has.js: Added.
618         (shouldBe):
619         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
620         (shouldBe):
621         (test):
622         * stress/set-add-clobber-set-has.js: Added.
623         (shouldBe):
624         * stress/set-add-does-not-clobber-map-get.js: Added.
625         (shouldBe):
626
627 2017-11-24  Mark Lam  <mark.lam@apple.com>
628
629         Move unsafe jsc shell test functions to the $vm object.
630         https://bugs.webkit.org/show_bug.cgi?id=179980
631
632         Reviewed by Yusuke Suzuki.
633
634         * controlFlowProfiler/driver/driver.js:
635         * controlFlowProfiler/execution-count.js:
636         * controlFlowProfiler/if-statement.js:
637         * controlFlowProfiler/loop-statements.js:
638         * controlFlowProfiler/switch-statements.js:
639         * controlFlowProfiler/test-jit.js:
640         * exceptionFuzz/3d-cube.js:
641         * exceptionFuzz/date-format-xparb.js:
642         * exceptionFuzz/earley-boyer.js:
643         * heapProfiler/basic-edges.js:
644         * heapProfiler/property-edge-types.js:
645         * microbenchmarks/try-get-by-id-basic.js:
646         * microbenchmarks/try-get-by-id-polymorphic.js:
647         * modules/namespace-object-try-get.js:
648         * stress/argument-count-bytecode.js:
649         * stress/argument-intrinsic-basic.js:
650         * stress/argument-intrinsic-inlining-use-caller-arg.js:
651         * stress/argument-intrinsic-inlining-with-result-escape.js:
652         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
653         * stress/argument-intrinsic-inlining-with-vararg.js:
654         * stress/argument-intrinsic-nested-inlining.js:
655         * stress/argument-intrinsic-not-convert-to-get-argument.js:
656         * stress/argument-intrinsic-with-stack-write.js:
657         * stress/arity-mismatch-get-argument.js:
658         * stress/array-message-passing.js:
659         * stress/array-push-with-force-exit.js:
660         * stress/check-dom-with-signature.js:
661         * stress/check-sub-class.js:
662         * stress/compare-eq-incomplete-profile.js:
663         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
664         * stress/do-eval-virtual-call-correctly.js:
665         * stress/dom-jit-with-poly-proto.js:
666         * stress/domjit-exception-ic.js:
667         * stress/domjit-exception.js:
668         * stress/domjit-getter-complex-with-incorrect-object.js:
669         * stress/domjit-getter-complex.js:
670         * stress/domjit-getter-poly.js:
671         * stress/domjit-getter-proto.js:
672         * stress/domjit-getter-super-poly.js:
673         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
674         * stress/domjit-getter-type-check.js:
675         * stress/domjit-getter.js:
676         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
677         * stress/for-in-proxy-target-changed-structure.js:
678         * stress/for-in-proxy.js:
679         * stress/generational-opaque-roots.js:
680         * stress/global-const-redeclaration-setting-2.js:
681         * stress/global-const-redeclaration-setting-3.js:
682         * stress/global-const-redeclaration-setting-4.js:
683         * stress/global-const-redeclaration-setting-5.js:
684         * stress/global-const-redeclaration-setting.js:
685         * stress/import-basic.js:
686         * stress/import-from-eval.js:
687         * stress/import-reject-with-exception.js:
688         * stress/import-syntax.js:
689         * stress/impure-get-own-property-slot-inline-cache.js:
690         * stress/is-constructor.js:
691         * stress/istypedarrayview-intrinsic.js:
692         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
693         * stress/jsc-test-functions-should-be-more-robust.js:
694         * stress/object-toString-with-proxy.js:
695         * stress/poly-proto-custom-value-and-accessor.js:
696         * stress/proxy-inline-cache.js:
697         * stress/re-execute-error-module.js:
698         * stress/regress-150532.js:
699         * stress/regress-156992.js:
700         * stress/regress-179619.js:
701         * stress/resources/shadow-chicken-support.js:
702         * stress/runtime-array.js:
703         * stress/sampling-profiler-microtasks.js:
704         * stress/shadow-chicken-enabled.js:
705         * stress/spread-correct-global-object-on-exception.js:
706         * stress/super-get-by-id.js:
707         * stress/tailCallForwardArguments.js:
708         * stress/to-object-intrinsic-boolean-edge.js:
709         * stress/to-object-intrinsic-null-or-undefined-edge.js:
710         * stress/to-object-intrinsic-number-edge.js:
711         * stress/to-object-intrinsic-object-edge.js:
712         * stress/to-object-intrinsic-string-edge.js:
713         * stress/to-object-intrinsic-symbol-edge.js:
714         * stress/to-object-intrinsic.js:
715         * stress/try-catch-custom-getter-as-get-by-id.js:
716         * stress/try-get-by-id-poly-proto.js:
717         * stress/try-get-by-id-should-spill-registers-dfg.js:
718         * stress/try-get-by-id.js:
719         * typeProfiler/arrow-functions.js:
720         * typeProfiler/basic.js:
721         * typeProfiler/captured.js:
722         * typeProfiler/classes.js:
723         * typeProfiler/dfg-jit-optimizations.js:
724         * typeProfiler/dictionary-mode.js:
725         * typeProfiler/es6-block-scoping.js:
726         * typeProfiler/es6-classes.js:
727         * typeProfiler/inheritance.js:
728         * typeProfiler/int52-dfg.js:
729         * typeProfiler/loop.js:
730         * typeProfiler/optional-fields.js:
731         * typeProfiler/overflow.js:
732         * typeProfiler/return.js:
733         * typeProfiler/symbol.js:
734         * typeProfiler/weird-prototype-chain.js:
735
736 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
737
738         [DFG][FTL] Support MapSet / SetAdd intrinsics
739         https://bugs.webkit.org/show_bug.cgi?id=179858
740
741         Reviewed by Saam Barati.
742
743         * microbenchmarks/map-has-and-set.js: Added.
744         (test):
745         * stress/map-set-check-failure.js: Added.
746         (shouldBe):
747         (shouldThrow):
748         (target):
749         * stress/map-set-cse.js: Added.
750         (shouldBe):
751         (test):
752         * stress/set-add-check-failure.js: Added.
753         (shouldBe):
754         (shouldThrow):
755         (set shouldThrow):
756         * stress/set-add-cse.js: Added.
757         (shouldBe):
758
759 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
760
761         [JSC] Allow poly proto for intrinsic getters
762         https://bugs.webkit.org/show_bug.cgi?id=179550
763
764         Reviewed by Saam Barati.
765
766         This change is also tested by existing tests.
767
768             1. stress/intrinsic-getter-with-poly-proto.js
769             2. stress/poly-proto-intrinsic-getter-correctness.js
770
771         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
772         (shouldBe):
773         (makePolyProtoObject.foo.C):
774         (makePolyProtoObject.foo):
775         (makePolyProtoObject):
776         (target):
777         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
778         (shouldBe):
779         (makePolyProtoObject.foo.C):
780         (makePolyProtoObject.foo):
781         (makePolyProtoObject):
782         (target):
783
784 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
785
786         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
787         https://bugs.webkit.org/show_bug.cgi?id=179744
788
789         Reviewed by Michael Catanzaro.
790
791         This test uses too much memory for our buildbots on these platforms
792         and gets OOM-killed.
793
794         * stress/unshiftCountSlowCase-correct-postCapacity.js:
795         Skip if $memoryLimited and linux.
796
797 2017-11-17  JF Bastien  <jfbastien@apple.com>
798
799         WebAssembly JS API: throw when a promise can't be created
800         https://bugs.webkit.org/show_bug.cgi?id=179826
801         <rdar://problem/35455813>
802
803         Reviewed by Mark Lam.
804
805         Test WebAssembly.{compile,instantiate} where promise creation
806         fails because of a stack overflow.
807
808         * wasm/js-api/promise-stack-overflow.js: Added.
809         (const.runNearStackLimit.f.const.t):
810         (async.testCompile):
811         (async.testInstantiate):
812
813 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
814
815         Unreviewed, mark regress-178385.js as memory exhausting
816
817         * stress/regress-178385.js:
818
819 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
820
821         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
822
823         Unreviewed test gardening.
824
825         * test262.yaml:
826
827 2017-11-16  Robin Morisset  <rmorisset@apple.com>
828
829         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
830         https://bugs.webkit.org/show_bug.cgi?id=179763
831         <rdar://problem/35550513>
832
833         Reviewed by Keith Miller.
834
835         Just adding a slightly cleaned-up version of the original fuzzer-found test.
836
837         * stress/tdz-this-in-try-catch.js: Added.
838         (__v_6388):
839         (__v_6392):
840
841 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
842
843         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
844         https://bugs.webkit.org/show_bug.cgi?id=179594
845
846         Reviewed by Saam Barati.
847
848         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
849         (shouldBe):
850         (args):
851         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
852         (shouldBe):
853         (args):
854
855 2017-11-14  Saam Barati  <sbarati@apple.com>
856
857         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
858         https://bugs.webkit.org/show_bug.cgi?id=179639
859         <rdar://problem/35513018>
860
861         Reviewed by JF Bastien.
862
863         * wasm/function-tests/grow-memory-cause-gc.js: Added.
864         (escape):
865         (i.func):
866
867 2017-11-13  Mark Lam  <mark.lam@apple.com>
868
869         Add more overflow check book-keeping for MarkedArgumentBuffer.
870         https://bugs.webkit.org/show_bug.cgi?id=179634
871         <rdar://problem/35492517>
872
873         Reviewed by Saam Barati.
874
875         * stress/regress-179634.js: Added.
876
877 2017-11-13  Mark Lam  <mark.lam@apple.com>
878
879         Make the jsc shell loadGetterFromGetterSetter() function more robust.
880         https://bugs.webkit.org/show_bug.cgi?id=179619
881         <rdar://problem/35492518>
882
883         Reviewed by Saam Barati.
884
885         * stress/regress-179619.js: Added.
886
887 2017-11-12  Mark Lam  <mark.lam@apple.com>
888
889         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
890         https://bugs.webkit.org/show_bug.cgi?id=179562
891         <rdar://problem/35467022>
892
893         Reviewed by Saam Barati.
894
895         * regress-179562.js: Added.
896
897 2017-11-08  Saam Barati  <sbarati@apple.com>
898
899         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
900         https://bugs.webkit.org/show_bug.cgi?id=177792
901
902         Reviewed by Yusuke Suzuki.
903
904         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
905         (assert):
906         (foo.Foo.prototype.ensureX):
907         (foo.Foo):
908         (foo):
909         (access):
910
911 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
912
913         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
914         https://bugs.webkit.org/show_bug.cgi?id=178592
915
916         Unreviewed test gardening.
917
918         * test262.yaml:
919
920 2017-11-08  Robin Morisset  <rmorisset@apple.com>
921
922         Turn recursive tail calls into loops
923         https://bugs.webkit.org/show_bug.cgi?id=176601
924
925         Reviewed by Saam Barati.
926
927         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
928
929         Add some simple test that computes factorial in several ways, and other trivial computations.
930         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
931         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
932         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
933         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
934
935         * stress/inline-call-to-recursive-tail-call.js: Added.
936         (factorial.aux):
937         (factorial):
938         (factorial2.aux2):
939         (factorial2.id):
940         (factorial2):
941         (factorial3.aux3):
942         (factorial3):
943         (aux4):
944         (factorial4):
945         (foo):
946         (auxBar):
947         (bar):
948         (test):
949
950 2017-11-07  Mark Lam  <mark.lam@apple.com>
951
952         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
953         https://bugs.webkit.org/show_bug.cgi?id=179355
954         <rdar://problem/35263053>
955
956         Reviewed by Saam Barati.
957
958         * stress/regress-179355.js: Added.
959
960 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
961
962         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
963         https://bugs.webkit.org/show_bug.cgi?id=144458
964
965         Reviewed by Saam Barati.
966
967         * microbenchmarks/dfg-internal-function-call.js: Added.
968         (target):
969         * microbenchmarks/dfg-internal-function-construct.js: Added.
970         (target):
971         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
972         (target):
973         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
974         (target):
975         * stress/dfg-internal-function-call.js: Added.
976         (shouldBe):
977         (target):
978         * stress/dfg-internal-function-construct.js: Added.
979         (shouldBe):
980         (target):
981         * stress/internal-function-call.js: Added.
982         (shouldBe):
983         * stress/internal-function-construct.js: Added.
984         (shouldBe):
985
986 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
987
988         [Win] Skip stress/regress-178385.js.
989         https://bugs.webkit.org/show_bug.cgi?id=179298
990
991         Unreviewed test gardening.
992
993         * stress/regress-178385.js:
994
995 2017-11-03  Keith Miller  <keith_miller@apple.com>
996
997         Add test for ic with side effects
998         https://bugs.webkit.org/show_bug.cgi?id=179268
999
1000         Reviewed by Saam Barati.
1001
1002         * stress/put-inline-cache-side-effects.js: Added.
1003         (let.i.of.objs.keys):
1004         (f):
1005
1006 2017-11-03  Mark Lam  <mark.lam@apple.com>
1007
1008         CachedCall (and its clients) needs overflow checks.
1009         https://bugs.webkit.org/show_bug.cgi?id=179185
1010
1011         Reviewed by JF Bastien.
1012
1013         * stress/regress-179185.js: Added.
1014
1015 2017-11-02  Michael Saboff  <msaboff@apple.com>
1016
1017         DFG needs to handle code motion of code in for..in loop bodies
1018         https://bugs.webkit.org/show_bug.cgi?id=179212
1019
1020         Reviewed by Keith Miller.
1021
1022         New regression test.
1023
1024         * stress/for-in-side-effects.js: Added.
1025         (getPrototypeOf):
1026         (reset):
1027         (testWithoutFTL.f):
1028         (testWithoutFTL):
1029         (testWithFTL.f):
1030         (testWithFTL):
1031
1032 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
1033
1034         AI does not correctly model the clobber case of ArithClz32
1035         https://bugs.webkit.org/show_bug.cgi?id=179188
1036
1037         Reviewed by Michael Saboff.
1038
1039         * stress/arith-clz32-effects.js: Added.
1040         (foo):
1041         (valueOf):
1042
1043 2017-11-01  Michael Saboff  <msaboff@apple.com>
1044
1045         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
1046         https://bugs.webkit.org/show_bug.cgi?id=179140
1047
1048         Reviewed by Saam Barati.
1049
1050         New regression test.
1051
1052         * stress/regress-179140.js: Added.
1053         (testWithoutFTL):
1054         (testWithFTL):
1055
1056 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1057
1058         [JSC] Introduce @toObject
1059         https://bugs.webkit.org/show_bug.cgi?id=178726
1060
1061         Reviewed by Saam Barati.
1062
1063         * stress/array-copywithin.js:
1064         (shouldThrow):
1065         * stress/object-constructor-boolean-edge.js: Added.
1066         (shouldBe):
1067         (test):
1068         * stress/object-constructor-global.js: Added.
1069         (shouldBe):
1070         * stress/object-constructor-null-edge.js: Added.
1071         (shouldBe):
1072         (test):
1073         * stress/object-constructor-number-edge.js: Added.
1074         (shouldBe):
1075         (test):
1076         * stress/object-constructor-object-edge.js: Added.
1077         (shouldBe):
1078         (test):
1079         (i.arg):
1080         * stress/object-constructor-string-edge.js: Added.
1081         (shouldBe):
1082         (test):
1083         * stress/object-constructor-symbol-edge.js: Added.
1084         (shouldBe):
1085         (test):
1086         * stress/object-constructor-undefined-edge.js: Added.
1087         (shouldBe):
1088         (test):
1089         * stress/symbol-array-from.js: Added.
1090         (shouldBe):
1091         * stress/to-object-intrinsic-boolean-edge.js: Added.
1092         (shouldBe):
1093         (builtin.createBuiltin):
1094         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
1095         (shouldThrow):
1096         * stress/to-object-intrinsic-number-edge.js: Added.
1097         (shouldBe):
1098         (builtin.createBuiltin):
1099         * stress/to-object-intrinsic-object-edge.js: Added.
1100         (shouldBe):
1101         (builtin.createBuiltin):
1102         (i.arg):
1103         * stress/to-object-intrinsic-string-edge.js: Added.
1104         (shouldBe):
1105         (builtin.createBuiltin):
1106         * stress/to-object-intrinsic-symbol-edge.js: Added.
1107         (shouldBe):
1108         (builtin.createBuiltin):
1109         * stress/to-object-intrinsic.js: Added.
1110         (shouldBe):
1111         (shouldThrow):
1112         (builtin.createBuiltin):
1113
1114 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1115
1116         [DFG][FTL] Introduce StringSlice
1117         https://bugs.webkit.org/show_bug.cgi?id=178934
1118
1119         Reviewed by Saam Barati.
1120
1121         * microbenchmarks/string-slice-empty.js: Added.
1122         (slice):
1123         * microbenchmarks/string-slice-one-char.js: Added.
1124         (slice):
1125         * microbenchmarks/string-slice.js: Added.
1126         (slice):
1127
1128 2017-10-26  Michael Saboff  <msaboff@apple.com>
1129
1130         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
1131         https://bugs.webkit.org/show_bug.cgi?id=178890
1132
1133         Reviewed by Keith Miller.
1134
1135         New regression test.
1136
1137         * stress/regress-178890.js: Added.
1138
1139 2017-10-26  Mark Lam  <mark.lam@apple.com>
1140
1141         JSRopeString::RopeBuilder::append() should check for overflows.
1142         https://bugs.webkit.org/show_bug.cgi?id=178385
1143         <rdar://problem/35027468>
1144
1145         Reviewed by Saam Barati.
1146
1147         * stress/regress-178385.js: Added.
1148
1149 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
1150
1151         Unreviewed, rolling out r223961.
1152
1153         The change that required this has been rolled out.
1154
1155         Reverted changeset:
1156
1157         "Mark test262.yaml/test262/test/language/statements/try/tco-
1158         catch.js as passing."
1159         https://bugs.webkit.org/show_bug.cgi?id=178592
1160         https://trac.webkit.org/changeset/223961
1161
1162 2017-10-25  Commit Queue  <commit-queue@webkit.org>
1163
1164         Unreviewed, rolling out r223691 and r223729.
1165         https://bugs.webkit.org/show_bug.cgi?id=178834
1166
1167         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
1168         by rniwa on #webkit).
1169
1170         Reverted changesets:
1171
1172         "Turn recursive tail calls into loops"
1173         https://bugs.webkit.org/show_bug.cgi?id=176601
1174         https://trac.webkit.org/changeset/223691
1175
1176         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
1177         comparison is always false due to limited range of data type
1178         [-Wtype-limits]"
1179         https://bugs.webkit.org/show_bug.cgi?id=178543
1180         https://trac.webkit.org/changeset/223729
1181
1182 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
1183
1184         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1185         https://bugs.webkit.org/show_bug.cgi?id=178592
1186
1187         Unreviewed test gardening.
1188
1189         * test262.yaml:
1190
1191 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1192
1193         [FTL] Support NewStringObject
1194         https://bugs.webkit.org/show_bug.cgi?id=178737
1195
1196         Reviewed by Saam Barati.
1197
1198         * stress/new-string-object.js: Added.
1199         (shouldBe):
1200         (test):
1201
1202 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1203
1204         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
1205         https://bugs.webkit.org/show_bug.cgi?id=178308
1206
1207         Reviewed by Mark Lam.
1208
1209         * test262.yaml:
1210
1211 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1212
1213         [JSC] Use fastJoin in Array#toString
1214         https://bugs.webkit.org/show_bug.cgi?id=178062
1215
1216         Reviewed by Darin Adler.
1217
1218         * microbenchmarks/contiguous-array-to-string.js: Added.
1219         (target):
1220         * microbenchmarks/double-array-to-string.js: Added.
1221         (target):
1222         * microbenchmarks/int32-array-to-string.js: Added.
1223         (target):
1224
1225 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
1226
1227         stress/check-string-ident.js is improperly skipped
1228         https://bugs.webkit.org/show_bug.cgi?id=178642
1229
1230         Reviewed by Saam Barati.
1231
1232         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
1233         since it enforces the run-jsc-stress-tests script to still set up the
1234         test to run, despite the skip directive that's used before.
1235
1236 2017-10-20  Mark Lam  <mark.lam@apple.com>
1237
1238         Add a test case for r214334.
1239         https://bugs.webkit.org/show_bug.cgi?id=169941
1240         <rdar://problem/31221258>
1241
1242         Reviewed by JF Bastien.
1243
1244         * stress/regress-169941.js: Added.
1245
1246 2017-10-19  JF Bastien  <jfbastien@apple.com>
1247
1248         WebAssembly: no VM / JS version of everything but Instance
1249         https://bugs.webkit.org/show_bug.cgi?id=177473
1250
1251         Reviewed by Filip Pizlo, Saam Barati.
1252
1253         - Exceeding max on memory growth now returns a range error as per
1254         spec. This is a (very minor) breaking change: it used to throw OOM
1255         error. Update the corresponding test.
1256
1257         * wasm/js-api/memory-grow.js:
1258         (assertEq):
1259         * wasm/js-api/table.js:
1260         (assert.throws):
1261
1262 2017-10-19  Mark Lam  <mark.lam@apple.com>
1263
1264         Stringifier::appendStringifiedValue() is missing an exception check.
1265         https://bugs.webkit.org/show_bug.cgi?id=178386
1266         <rdar://problem/35027610>
1267
1268         Reviewed by Saam Barati.
1269
1270         * stress/regress-178386.js: Added.
1271
1272 2017-10-19  Michael Saboff  <msaboff@apple.com>
1273
1274         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1275         https://bugs.webkit.org/show_bug.cgi?id=178521
1276
1277         Reviewed by JF Bastien.
1278
1279         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1280         now passes with the current version (5.0) of the Emoji spec.
1281
1282 2017-10-19  Robin Morisset  <rmorisset@apple.com>
1283
1284         Turn recursive tail calls into loops
1285         https://bugs.webkit.org/show_bug.cgi?id=176601
1286
1287         Reviewed by Saam Barati.
1288
1289         Add some simple test that computes factorial in several ways, and other trivial computations.
1290         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1291         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1292         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1293         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1294
1295         * stress/inline-call-to-recursive-tail-call.js: Added.
1296         (factorial.aux):
1297         (factorial):
1298         (factorial2.aux):
1299         (factorial2.id):
1300         (factorial2):
1301         (factorial3.aux):
1302         (factorial3):
1303         (aux):
1304         (factorial4):
1305         (test):
1306
1307 2017-10-18  Mark Lam  <mark.lam@apple.com>
1308
1309         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1310         https://bugs.webkit.org/show_bug.cgi?id=177600
1311         <rdar://problem/34710985>
1312
1313         Reviewed by Saam Barati.
1314
1315         * stress/regress-177600.js: Added.
1316
1317 2017-10-18  Mark Lam  <mark.lam@apple.com>
1318
1319         The compiler should always register a structure when it adds its transitionWatchPointSet.
1320         https://bugs.webkit.org/show_bug.cgi?id=178420
1321         <rdar://problem/34814024>
1322
1323         Reviewed by Saam Barati and Filip Pizlo.
1324
1325         * stress/regress-178420.js: Added.
1326         (new.Array.10000.map):
1327
1328 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1329
1330         [JSC] __proto__ getter should be fast
1331         https://bugs.webkit.org/show_bug.cgi?id=178067
1332
1333         Reviewed by Saam Barati.
1334
1335         * stress/dfg-object-proto-accessor.js: Added.
1336         (shouldBe):
1337         (shouldThrow):
1338         (target):
1339         * stress/dfg-object-proto-getter.js: Added.
1340         (shouldBe):
1341         (shouldThrow):
1342         (target):
1343         * stress/dfg-object-prototype-of.js: Added.
1344         (shouldBe):
1345         (shouldThrow):
1346         (target):
1347         * stress/dfg-reflect-get-prototype-of.js: Added.
1348         (shouldBe):
1349         (shouldThrow):
1350         (target):
1351         * stress/intrinsic-getter-with-poly-proto.js: Added.
1352         (shouldBe):
1353         (makePolyProtoObject.foo.C):
1354         (makePolyProtoObject.foo):
1355         (makePolyProtoObject):
1356         (target):
1357         * stress/object-get-prototype-of-filtered.js: Added.
1358         (shouldBe):
1359         (shouldThrow):
1360         (target):
1361         (i.Cocoa):
1362         * stress/object-get-prototype-of-mono-proto.js: Added.
1363         (shouldBe):
1364         (makePolyProtoObject.foo.C):
1365         (makePolyProtoObject.foo):
1366         (makePolyProtoObject):
1367         (target):
1368         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1369         (shouldBe):
1370         (makePolyProtoObject.foo.C):
1371         (makePolyProtoObject.foo):
1372         (makePolyProtoObject):
1373         (target):
1374         * stress/object-get-prototype-of-poly-proto.js: Added.
1375         (shouldBe):
1376         (makePolyProtoObject.foo.C):
1377         (makePolyProtoObject.foo):
1378         (makePolyProtoObject):
1379         (target):
1380         * stress/object-proto-getter-filtered.js: Added.
1381         (shouldBe):
1382         (shouldThrow):
1383         (target):
1384         (i.Cocoa):
1385         * stress/object-proto-getter-poly-mono-proto.js: Added.
1386         (shouldBe):
1387         (makePolyProtoObject.foo.C):
1388         (makePolyProtoObject.foo):
1389         (makePolyProtoObject):
1390         (target):
1391         * stress/object-proto-getter-poly-proto.js: Added.
1392         (shouldBe):
1393         (makePolyProtoObject.foo.C):
1394         (makePolyProtoObject.foo):
1395         (makePolyProtoObject):
1396         (target):
1397         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1398         * stress/string-proto.js: Added.
1399         (shouldBe):
1400         (target):
1401
1402 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1403
1404         Unreviewed, rolling out r223523.
1405
1406         A test for this change is failing on debug JSC bots.
1407
1408         Reverted changeset:
1409
1410         "[JSC] __proto__ getter should be fast"
1411         https://bugs.webkit.org/show_bug.cgi?id=178067
1412         https://trac.webkit.org/changeset/223523
1413
1414 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1415
1416         [JSC] __proto__ getter should be fast
1417         https://bugs.webkit.org/show_bug.cgi?id=178067
1418
1419         Reviewed by Saam Barati.
1420
1421         * stress/dfg-object-proto-accessor.js: Added.
1422         (shouldBe):
1423         (shouldThrow):
1424         (target):
1425         * stress/dfg-object-proto-getter.js: Added.
1426         (shouldBe):
1427         (shouldThrow):
1428         (target):
1429         * stress/dfg-object-prototype-of.js: Added.
1430         (shouldBe):
1431         (shouldThrow):
1432         (target):
1433         * stress/dfg-reflect-get-prototype-of.js: Added.
1434         (shouldBe):
1435         (shouldThrow):
1436         (target):
1437         * stress/object-get-prototype-of-filtered.js: Added.
1438         (shouldBe):
1439         (shouldThrow):
1440         (target):
1441         (i.Cocoa):
1442         * stress/object-get-prototype-of-mono-proto.js: Added.
1443         (shouldBe):
1444         (makePolyProtoObject.foo.C):
1445         (makePolyProtoObject.foo):
1446         (makePolyProtoObject):
1447         (target):
1448         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1449         (shouldBe):
1450         (makePolyProtoObject.foo.C):
1451         (makePolyProtoObject.foo):
1452         (makePolyProtoObject):
1453         (target):
1454         * stress/object-get-prototype-of-poly-proto.js: Added.
1455         (shouldBe):
1456         (makePolyProtoObject.foo.C):
1457         (makePolyProtoObject.foo):
1458         (makePolyProtoObject):
1459         (target):
1460         * stress/object-proto-getter-filtered.js: Added.
1461         (shouldBe):
1462         (shouldThrow):
1463         (target):
1464         (i.Cocoa):
1465         * stress/object-proto-getter-poly-mono-proto.js: Added.
1466         (shouldBe):
1467         (makePolyProtoObject.foo.C):
1468         (makePolyProtoObject.foo):
1469         (makePolyProtoObject):
1470         (target):
1471         * stress/object-proto-getter-poly-proto.js: Added.
1472         (shouldBe):
1473         (makePolyProtoObject.foo.C):
1474         (makePolyProtoObject.foo):
1475         (makePolyProtoObject):
1476         (target):
1477         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1478         * stress/string-proto.js: Added.
1479         (shouldBe):
1480         (target):
1481
1482 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1483
1484         Reland "Add Above/Below comparisons for UInt32 patterns"
1485         https://bugs.webkit.org/show_bug.cgi?id=177281
1486
1487         Reviewed by Saam Barati.
1488
1489         * stress/uint32-comparison-jump.js: Added.
1490         (shouldBe):
1491         (above):
1492         (aboveOrEqual):
1493         (below):
1494         (belowOrEqual):
1495         (notAbove):
1496         (notAboveOrEqual):
1497         (notBelow):
1498         (notBelowOrEqual):
1499         * stress/uint32-comparison.js: Added.
1500         (shouldBe):
1501         (above):
1502         (aboveOrEqual):
1503         (below):
1504         (belowOrEqual):
1505         (aboveTest):
1506         (aboveOrEqualTest):
1507         (belowTest):
1508         (belowOrEqualTest):
1509
1510 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1511
1512         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1513         https://bugs.webkit.org/show_bug.cgi?id=178210
1514
1515         Reviewed by Saam Barati.
1516
1517         * wasm/function-tests/trap-from-start-async.js:
1518         (async.StartTrapsAsync):
1519         * wasm/function-tests/trap-from-start.js:
1520         (StartTraps):
1521         * wasm/js-api/web-assembly-function.js:
1522         (assert.eq.Object.getPrototypeOf):
1523         * wasm/js-api/wrapper-function.js:
1524         (return.new.WebAssembly.Module):
1525         (assert.throws.makeInstance): Deleted.
1526         (assert.throws.Bar): Deleted.
1527         (assert.throws): Deleted.
1528
1529 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1530
1531         Enable gigacage on iOS
1532         https://bugs.webkit.org/show_bug.cgi?id=177586
1533
1534         Reviewed by JF Bastien.
1535         
1536         Add tests for when Gigacage gets runtime disabled.
1537
1538         * stress/disable-gigacage-arrays.js: Added.
1539         (foo):
1540         * stress/disable-gigacage-strings.js: Added.
1541         (foo):
1542         * stress/disable-gigacage-typed-arrays.js: Added.
1543         (foo):
1544
1545 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1546
1547         import.meta should not be assignable
1548         https://bugs.webkit.org/show_bug.cgi?id=178202
1549
1550         Reviewed by Saam Barati.
1551
1552         * modules/import-meta-assignment.js: Added.
1553         (shouldThrow):
1554         (SyntaxError.import.meta.can.shouldThrow):
1555
1556 2017-10-11  Saam Barati  <sbarati@apple.com>
1557
1558         Unreviewed. Actually skip certain type profiler tests in debug.
1559
1560         * typeProfiler.yaml:
1561         * typeProfiler/deltablue-for-of.js:
1562         * typeProfiler/getter-richards.js:
1563
1564 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1565
1566         Unreviewed, rolling out r223113 and r223121.
1567         https://bugs.webkit.org/show_bug.cgi?id=178182
1568
1569         Reintroduced 20% regression on Kraken (Requested by rniwa on
1570         #webkit).
1571
1572         Reverted changesets:
1573
1574         "Enable gigacage on iOS"
1575         https://bugs.webkit.org/show_bug.cgi?id=177586
1576         https://trac.webkit.org/changeset/223113
1577
1578         "Use one virtual allocation for all gigacages and their
1579         runways"
1580         https://bugs.webkit.org/show_bug.cgi?id=178050
1581         https://trac.webkit.org/changeset/223121
1582
1583 2017-10-11  Michael Saboff  <msaboff@apple.com>
1584
1585         Disable test262 named capture group tests with direct unicode names and with references before definitions
1586         https://bugs.webkit.org/show_bug.cgi?id=178177
1587
1588         Reviewed by Keith Miller.
1589
1590         Bugs to track fixing these test are:
1591         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1592             "Add support in named capture group identifiers for direct surrogate pairs"
1593         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1594             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1595
1596         * test262.yaml:
1597
1598 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1599
1600         Object properties are undefined in super.call() but not in this.call()
1601         https://bugs.webkit.org/show_bug.cgi?id=177230
1602
1603         Reviewed by Saam Barati.
1604
1605         * stress/super-call-function-subclass.js: Added.
1606         (assert):
1607         (A.prototype.t):
1608         (A):
1609         * stress/super-dot-call-and-apply.js: Added.
1610         (assert):
1611         (A):
1612         (A.prototype.call):
1613         (A.prototype.apply):
1614         (B.prototype.testSuper):
1615         (B):
1616         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1617         (D.prototype.testSuper):
1618         (D):
1619
1620 2017-10-10  Saam Barati  <sbarati@apple.com>
1621
1622         The prototype cache should be aware of the Executable it generates a Structure for
1623         https://bugs.webkit.org/show_bug.cgi?id=177907
1624
1625         Reviewed by Filip Pizlo.
1626
1627         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1628         (assert):
1629         (foo.C):
1630         (foo):
1631         (bar.C):
1632         (bar):
1633         (access):
1634         (makeLongChain):
1635         (accessY):
1636
1637 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1638
1639         `async` should be able to be used as an imported binding name
1640         https://bugs.webkit.org/show_bug.cgi?id=176573
1641
1642         Reviewed by Saam Barati.
1643
1644         * modules/import-default-async.js: Added.
1645         * modules/import-named-async-as.js: Added.
1646         * modules/import-named-async.js: Added.
1647         * modules/import-named-async/target.js: Added.
1648         * modules/import-namespace-async.js: Added.
1649         * test262.yaml:
1650
1651 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1652
1653         Enable gigacage on iOS
1654         https://bugs.webkit.org/show_bug.cgi?id=177586
1655
1656         Reviewed by JF Bastien.
1657         
1658         Add tests for when Gigacage gets runtime disabled.
1659
1660         * stress/disable-gigacage-arrays.js: Added.
1661         (foo):
1662         * stress/disable-gigacage-strings.js: Added.
1663         (foo):
1664         * stress/disable-gigacage-typed-arrays.js: Added.
1665         (foo):
1666
1667 2017-10-09  Michael Saboff  <msaboff@apple.com>
1668
1669         Implement RegExp Unicode property escapes
1670         https://bugs.webkit.org/show_bug.cgi?id=172069
1671
1672         Reviewed by JF Bastien.
1673
1674         Enabled Unicode Property tests.
1675
1676         * test262.yaml:
1677
1678 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1679
1680         Unreviewed, rolling out r223015 and r223025.
1681         https://bugs.webkit.org/show_bug.cgi?id=178093
1682
1683         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1684         #webkit).
1685
1686         Reverted changesets:
1687
1688         "Enable gigacage on iOS"
1689         https://bugs.webkit.org/show_bug.cgi?id=177586
1690         http://trac.webkit.org/changeset/223015
1691
1692         "Unreviewed, disable Gigacage on ARM64 Linux"
1693         https://bugs.webkit.org/show_bug.cgi?id=177586
1694         http://trac.webkit.org/changeset/223025
1695
1696 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1697
1698         Update expectations for test262 tests that pass after r223043.
1699         https://bugs.webkit.org/show_bug.cgi?id=176685
1700
1701         Unreviewed test gardening.
1702
1703         * test262.yaml:
1704
1705 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1706
1707         Unreviewed, rolling out r223022.
1708
1709         This change introduced 18 test262 failures.
1710
1711         Reverted changeset:
1712
1713         "`async` should be able to be used as an imported binding
1714         name"
1715         https://bugs.webkit.org/show_bug.cgi?id=176573
1716         http://trac.webkit.org/changeset/223022
1717
1718 2017-10-09  Saam Barati  <sbarati@apple.com>
1719
1720         3 poly-proto JSC tests timing out on debug after r222827
1721         https://bugs.webkit.org/show_bug.cgi?id=177880
1722         <rdar://problem/34817122>
1723
1724         Unreviewed.
1725
1726         I'm skipping these type profiler tests on debug since they are long running.
1727
1728         * typeProfiler/deltablue-for-of.js:
1729         * typeProfiler/getter-richards.js:
1730
1731 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1732
1733         Safari 10 /11 problem with if (!await get(something)).
1734         https://bugs.webkit.org/show_bug.cgi?id=176685
1735
1736         Reviewed by Saam Barati.
1737
1738         * stress/async-await-basic.js:
1739         (awaitEpression.async):
1740         * stress/async-await-syntax.js:
1741         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1742         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1743
1744 2017-10-08  Saam Barati  <sbarati@apple.com>
1745
1746         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1747
1748         * typeProfiler/deltablue-for-of.js:
1749         * typeProfiler/getter-richards.js:
1750
1751 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1752
1753         `async` should be able to be used as an imported binding name
1754         https://bugs.webkit.org/show_bug.cgi?id=176573
1755
1756         Reviewed by Darin Adler.
1757
1758         * modules/import-default-async.js: Added.
1759         * modules/import-named-async-as.js: Added.
1760         * modules/import-named-async.js: Added.
1761         * modules/import-named-async/target.js: Added.
1762         * modules/import-namespace-async.js: Added.
1763
1764 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1765
1766         Enable gigacage on iOS
1767         https://bugs.webkit.org/show_bug.cgi?id=177586
1768
1769         Reviewed by JF Bastien.
1770         
1771         Add tests for when Gigacage gets runtime disabled.
1772
1773         * stress/disable-gigacage-arrays.js: Added.
1774         (foo):
1775         * stress/disable-gigacage-strings.js: Added.
1776         (foo):
1777         * stress/disable-gigacage-typed-arrays.js: Added.
1778         (foo):
1779
1780 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1781
1782         Unreviewed, rolling out r222791 and r222873.
1783         https://bugs.webkit.org/show_bug.cgi?id=178031
1784
1785         Caused crashes with workers/wasm LayoutTests (Requested by
1786         ryanhaddad on #webkit).
1787
1788         Reverted changesets:
1789
1790         "WebAssembly: no VM / JS version of everything but Instance"
1791         https://bugs.webkit.org/show_bug.cgi?id=177473
1792         http://trac.webkit.org/changeset/222791
1793
1794         "WebAssembly: address no VM / JS follow-ups"
1795         https://bugs.webkit.org/show_bug.cgi?id=177887
1796         http://trac.webkit.org/changeset/222873
1797
1798 2017-10-05  Saam Barati  <sbarati@apple.com>
1799
1800         Make sure all prototypes under poly proto get added into the VM's prototype map
1801         https://bugs.webkit.org/show_bug.cgi?id=177909
1802
1803         Reviewed by Keith Miller.
1804
1805         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1806         (assert):
1807         (foo.C):
1808         (foo):
1809         (set x):
1810
1811 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1812
1813         [JSC] Introduce import.meta
1814         https://bugs.webkit.org/show_bug.cgi?id=177703
1815
1816         Reviewed by Filip Pizlo.
1817
1818         * modules/import-meta-syntax.js: Added.
1819         (shouldThrow):
1820         (shouldNotThrow):
1821         * modules/import-meta.js: Added.
1822         * modules/import-meta/cocoa.js: Added.
1823         * modules/resources/assert.js:
1824         (export.shouldNotThrow):
1825         * stress/import-syntax.js:
1826
1827 2017-10-04  Saam Barati  <sbarati@apple.com>
1828
1829         Make pertinent AccessCases watch the poly proto watchpoint
1830         https://bugs.webkit.org/show_bug.cgi?id=177765
1831
1832         Reviewed by Keith Miller.
1833
1834         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1835         (assert):
1836         (foo.C):
1837         (foo):
1838         (validate):
1839         * stress/poly-proto-clear-stub.js: Added.
1840         (assert):
1841         (foo.C):
1842         (foo):
1843
1844 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1845
1846         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1847
1848         Unreviewed test gardening.
1849
1850         * test262.yaml:
1851
1852 2017-10-04  Saam Barati  <sbarati@apple.com>
1853
1854         3 poly-proto JSC tests timing out on debug after r222827
1855         https://bugs.webkit.org/show_bug.cgi?id=177880
1856
1857         Rubber stamped by Mark Lam.
1858
1859         * microbenchmarks/poly-proto-access.js:
1860         * typeProfiler/deltablue-for-of.js:
1861         * typeProfiler/getter-richards.js:
1862
1863 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1864
1865         Unreviewed, marking tco-catch.js as a failure after test262 update
1866         https://bugs.webkit.org/show_bug.cgi?id=177859
1867
1868         * test262.yaml:
1869
1870 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1871
1872         Unreviewed, marking one async iterator test262 test failed
1873         https://bugs.webkit.org/show_bug.cgi?id=177859
1874
1875         * test262.yaml:
1876
1877 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1878
1879         [Test262] Update Test262 to Oct 4 version
1880         https://bugs.webkit.org/show_bug.cgi?id=177859
1881
1882         Reviewed by Sam Weinig.
1883
1884         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1885         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1886
1887         * test262.yaml:
1888         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1889         (checkSequence):
1890         * test262/harness/typeCoercion.js:
1891         (testCoercibleToIndexZero):
1892         (testCoercibleToIndexOne):
1893         (testCoercibleToIndexFromIndex):
1894         (testNotCoercibleToIndex.testPrimitiveValue):
1895         (testNotCoercibleToInteger):
1896         (testCoercibleToBigIntZero.testPrimitiveValue):
1897         (testCoercibleToBigIntZero):
1898         (testCoercibleToBigIntOne.testPrimitiveValue):
1899         (testCoercibleToBigIntOne):
1900         (testPrimitiveValue):
1901         (testCoercibleToBigIntFromBigInt):
1902         (testNotCoercibleToBigInt.testPrimitiveValue):
1903         (testNotCoercibleToBigInt.testStringValue):
1904         (testNotCoercibleToBigInt):
1905         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1906         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1907         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1908         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1909         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1910         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1911         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1912         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1913         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1914         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
1915         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
1916         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
1917         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
1918         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
1919         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
1920         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
1921         (testCoercibleToBigIntZero):
1922         (testCoercibleToBigIntOne):
1923         (testNotCoercibleToBigInt):
1924         (MyError): Deleted.
1925         (valueOf): Deleted.
1926         (toString): Deleted.
1927         (Symbol.toPrimitive): Deleted.
1928         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
1929         (testCoercibleToIndexZero):
1930         (testCoercibleToIndexOne):
1931         (testNotCoercibleToIndex):
1932         (MyError): Deleted.
1933         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
1934         (assert.sameValue.BigInt.asIntN.toString): Deleted.
1935         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
1936         (BigInt.asIntN.valueOf): Deleted.
1937         (BigInt.asIntN.toString): Deleted.
1938         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
1939         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
1940         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
1941         (testCoercibleToBigIntZero):
1942         (testCoercibleToBigIntOne):
1943         (testNotCoercibleToBigInt):
1944         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
1945         (testCoercibleToIndexZero):
1946         (testCoercibleToIndexOne):
1947         (testNotCoercibleToIndex):
1948         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
1949         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
1950         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
1951         (bits.valueOf):
1952         (bigint.valueOf):
1953         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
1954         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
1955         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
1956         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
1957         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
1958         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
1959         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
1960         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
1961         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
1962         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
1963         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
1964         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
1965         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
1966         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
1967         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
1968         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
1969         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
1970         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
1971         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
1972         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
1973         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
1974         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
1975         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
1976         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
1977         (replacer):
1978         (BigInt.prototype.toJSON):
1979         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
1980         (replacer):
1981         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
1982         (BigInt.prototype.toJSON):
1983         * test262/test/built-ins/JSON/stringify/bigint.js:
1984         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
1985         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
1986         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
1987         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
1988         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
1989         * test262/test/built-ins/Object/proto-from-ctor.js:
1990         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
1991         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
1992         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
1993         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
1994         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
1995         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
1996         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
1997         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
1998         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
1999         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
2000         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
2001         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
2002         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
2003         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
2004         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
2005         * test262/test/built-ins/Proxy/get-fn-realm.js:
2006         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
2007         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
2008         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
2009         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
2010         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
2011         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
2012         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
2013         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
2014         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
2015         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
2016         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
2017         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
2018         (i6.replace):
2019         (i6b.replace):
2020         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
2021         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
2022         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
2023         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
2024         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
2025         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
2026         * test262/test/built-ins/RegExp/u180e.js: Added.
2027         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
2028         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
2029         * test262/test/built-ins/String/proto-from-ctor-realm.js:
2030         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
2031         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
2032         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
2033         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
2034         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
2035         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
2036         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
2037         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
2038         * test262/test/built-ins/String/prototype/endsWith/length.js:
2039         * test262/test/built-ins/String/prototype/endsWith/name.js:
2040         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
2041         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
2042         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
2043         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
2044         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
2045         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
2046         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
2047         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
2048         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
2049         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
2050         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
2051         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
2052         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
2053         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
2054         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
2055         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
2056         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
2057         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
2058         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
2059         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
2060         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
2061         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
2062         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
2063         * test262/test/built-ins/String/prototype/includes/includes.js:
2064         * test262/test/built-ins/String/prototype/includes/length.js:
2065         * test262/test/built-ins/String/prototype/includes/name.js:
2066         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
2067         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
2068         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
2069         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
2070         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
2071         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
2072         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
2073         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
2074         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
2075         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
2076         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
2077         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
2078         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
2079         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
2080         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
2081         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
2082         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
2083         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
2084         * test262/test/built-ins/String/prototype/trim/u180e.js:
2085         * test262/test/built-ins/Symbol/for/cross-realm.js:
2086         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
2087         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
2088         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
2089         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
2090         * test262/test/built-ins/Symbol/match/cross-realm.js:
2091         * test262/test/built-ins/Symbol/replace/cross-realm.js:
2092         * test262/test/built-ins/Symbol/search/cross-realm.js:
2093         * test262/test/built-ins/Symbol/species/cross-realm.js:
2094         * test262/test/built-ins/Symbol/split/cross-realm.js:
2095         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
2096         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
2097         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
2098         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
2099         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
2100         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
2101         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
2102         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
2103         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
2104         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
2105         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
2106         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
2107         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
2108         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
2109         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
2110         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
2111         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
2112         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
2113         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
2114         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
2115         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
2116         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
2117         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
2118         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
2119         * test262/test/language/comments/mongolian-vowel-separator-single.js:
2120         * test262/test/language/eval-code/indirect/realm.js:
2121         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
2122         (o.get z):
2123         (o.get a):
2124         * test262/test/language/expressions/call/eval-realm-indirect.js:
2125         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
2126         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
2127         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
2128         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
2129         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2130         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
2131         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
2132         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
2133         * test262/test/language/expressions/greater-than/bigint-and-number.js:
2134         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
2135         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
2136         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
2137         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2138         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
2139         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
2140         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
2141         * test262/test/language/expressions/less-than/bigint-and-number.js:
2142         * test262/test/language/expressions/new/non-ctor-err-realm.js:
2143         * test262/test/language/expressions/super/realm.js:
2144         * test262/test/language/expressions/tagged-template/cache-realm.js:
2145         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
2146         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
2147         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
2148         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
2149         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
2150         * test262/test/language/literals/string/mongolian-vowel-separator.js:
2151         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
2152         (o.get z):
2153         (o.get a):
2154         * test262/test/language/statements/for-of/iterator-next-reference.js:
2155         (next):
2156         (iterator.next): Deleted.
2157         (x.of.iterable.): Deleted.
2158         (x.of.iterable.get return): Deleted.
2159         (x.of.iterable.iterator.next): Deleted.
2160         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
2161         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
2162         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
2163         * test262/test/language/white-space/mongolian-vowel-separator.js:
2164         * test262/test262-Revision.txt:
2165
2166 2017-10-03  Saam Barati  <sbarati@apple.com>
2167
2168         Implement polymorphic prototypes
2169         https://bugs.webkit.org/show_bug.cgi?id=176391
2170
2171         Reviewed by Filip Pizlo.
2172
2173         * microbenchmarks/poly-proto-access.js: Added.
2174         (assert):
2175         (foo.C):
2176         (foo.C.prototype.get bar):
2177         (foo):
2178         (bar):
2179         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
2180         (assert):
2181         (makePolyProtoObject.foo.C):
2182         (makePolyProtoObject.foo):
2183         (makePolyProtoObject):
2184         (performSet):
2185         * microbenchmarks/poly-proto-setter-speed.js: Added.
2186         (assert):
2187         (makePolyProtoObject.foo.C):
2188         (makePolyProtoObject.foo.C.prototype.set p):
2189         (makePolyProtoObject.foo):
2190         (makePolyProtoObject):
2191         (performSet):
2192         * stress/constructor-with-return.js:
2193         (i.tests.forEach.Constructor):
2194         (i.tests.forEach):
2195         (tests.forEach.Constructor): Deleted.
2196         (tests.forEach): Deleted.
2197         * stress/dom-jit-with-poly-proto.js: Added.
2198         (assert):
2199         (makePolyProtoObject.foo.C):
2200         (makePolyProtoObject.foo):
2201         (makePolyProtoObject):
2202         (validate):
2203         * stress/poly-proto-custom-value-and-accessor.js: Added.
2204         (assert):
2205         (makePolyProtoObject.foo.C):
2206         (makePolyProtoObject.foo):
2207         (makePolyProtoObject):
2208         (items.forEach):
2209         (set get for):
2210         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
2211         (assert):
2212         (makePolyProtoObject.foo.C):
2213         (makePolyProtoObject.foo):
2214         (makePolyProtoObject):
2215         (foo):
2216         * stress/poly-proto-miss.js: Added.
2217         (makePolyProtoInstanceWithNullPrototype.foo.C):
2218         (makePolyProtoInstanceWithNullPrototype.foo):
2219         (makePolyProtoInstanceWithNullPrototype):
2220         (assert):
2221         (validate):
2222         * stress/poly-proto-op-in-caching.js: Added.
2223         (assert):
2224         (makePolyProtoObject.foo.C):
2225         (makePolyProtoObject.foo):
2226         (makePolyProtoObject):
2227         (validate):
2228         (validate2):
2229         * stress/poly-proto-put-transition.js: Added.
2230         (assert):
2231         (makePolyProtoObject.foo.C):
2232         (makePolyProtoObject.foo):
2233         (makePolyProtoObject):
2234         (performSet):
2235         (i.obj.__proto__.set p):
2236         * stress/poly-proto-set-prototype.js: Added.
2237         (assert):
2238         (let.alternateProto.get x):
2239         (let.alternateProto2.get y):
2240         (let.alternateProto2.get x):
2241         (foo.C):
2242         (foo):
2243         (validate):
2244         * stress/poly-proto-setter.js: Added.
2245         (assert):
2246         (makePolyProtoObject.foo.C):
2247         (makePolyProtoObject.foo.C.prototype.set p):
2248         (makePolyProtoObject.foo.C.prototype.get p):
2249         (makePolyProtoObject.foo):
2250         (makePolyProtoObject):
2251         (performSet):
2252         * stress/poly-proto-using-inheritance.js: Added.
2253         (assert):
2254         (foo.C):
2255         (foo.C.prototype.get baz):
2256         (foo):
2257         (bar.C):
2258         (bar):
2259         (validate):
2260         * stress/primitive-poly-proto.js: Added.
2261         (makePolyProtoInstance.foo.C):
2262         (makePolyProtoInstance.foo):
2263         (makePolyProtoInstance):
2264         (assert):
2265         (validate):
2266         * stress/prototype-is-not-js-object.js: Added.
2267         (foo.bar):
2268         (foo):
2269         (assert):
2270         (validate):
2271         * stress/try-get-by-id-poly-proto.js: Added.
2272         (assert):
2273         (makePolyProtoObject.foo.C):
2274         (makePolyProtoObject.foo):
2275         (makePolyProtoObject):
2276         (tryGetByIdText):
2277         (x.__proto__.get bar):
2278         (validate):
2279         * typeProfiler/overflow.js:
2280
2281 2017-10-03  JF Bastien  <jfbastien@apple.com>
2282
2283         WebAssembly: no VM / JS version of everything but Instance
2284         https://bugs.webkit.org/show_bug.cgi?id=177473
2285
2286         Reviewed by Filip Pizlo.
2287
2288         - Exceeding max on memory growth now returns a range error as per
2289         spec. This is a (very minor) breaking change: it used to throw OOM
2290         error. Update the corresponding test.
2291
2292         * wasm/js-api/memory-grow.js:
2293         (assertEq):
2294         * wasm/js-api/table.js:
2295         (assert.throws):
2296
2297 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
2298
2299         Skip JSC test stress/regress-159779-2.js on debug.
2300         https://bugs.webkit.org/show_bug.cgi?id=177204
2301
2302         Unreviewed test gardening.
2303
2304         * stress/regress-159779-2.js:
2305
2306 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
2307
2308         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2309         https://bugs.webkit.org/show_bug.cgi?id=175642
2310
2311         Reviewed by Darin Adler.
2312
2313         * ChakraCore/test/Function/apply3.baseline-jsc:
2314
2315 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2316
2317         Unreviewed, rolling out r222564.
2318         https://bugs.webkit.org/show_bug.cgi?id=177720
2319
2320         "It regressed JetStream by 2% on iOS caused by a 50%
2321         regression on the bigfib subtest" (Requested by saamyjoon on
2322         #webkit).
2323
2324         Reverted changeset:
2325
2326         "Add Above/Below comparisons for UInt32 patterns"
2327         https://bugs.webkit.org/show_bug.cgi?id=177281
2328         http://trac.webkit.org/changeset/222564
2329
2330 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2331
2332         [DFG] Support ArrayPush with multiple args
2333         https://bugs.webkit.org/show_bug.cgi?id=175823
2334
2335         Reviewed by Saam Barati.
2336
2337         * microbenchmarks/array-push-0.js: Added.
2338         (arrayPush0):
2339         * microbenchmarks/array-push-1.js: Added.
2340         (arrayPush1):
2341         * microbenchmarks/array-push-2.js: Added.
2342         (arrayPush2):
2343         * microbenchmarks/array-push-3.js: Added.
2344         (arrayPush3):
2345         * stress/array-push-multiple-contiguous.js: Added.
2346         (shouldBe):
2347         (test):
2348         * stress/array-push-multiple-double-nan.js: Added.
2349         (shouldBe):
2350         (test):
2351         * stress/array-push-multiple-double.js: Added.
2352         (shouldBe):
2353         (test):
2354         * stress/array-push-multiple-int32.js: Added.
2355         (shouldBe):
2356         (test):
2357         * stress/array-push-multiple-many-contiguous.js: Added.
2358         (shouldBe):
2359         (test):
2360         * stress/array-push-multiple-many-double.js: Added.
2361         (shouldBe):
2362         (test):
2363         * stress/array-push-multiple-many-int32.js: Added.
2364         (shouldBe):
2365         (test):
2366         * stress/array-push-multiple-many-storage.js: Added.
2367         (shouldBe):
2368         (test):
2369         * stress/array-push-multiple-storage.js: Added.
2370         (shouldBe):
2371         (test):
2372         * stress/array-push-with-force-exit.js: Added.
2373         (target.createBuiltin):
2374
2375 2017-09-29  Saam Barati  <sbarati@apple.com>
2376
2377         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2378         https://bugs.webkit.org/show_bug.cgi?id=177639
2379
2380         Reviewed by Geoffrey Garen.
2381
2382         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2383         (assert):
2384         (Class):
2385         (items.forEach):
2386         (set get for):
2387
2388 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2389
2390         Unreviewed, rolling out r222563, r222565, and r222581.
2391         https://bugs.webkit.org/show_bug.cgi?id=177675
2392
2393         "It causes a crash when playing youtube videos" (Requested by
2394         saamyjoon on #webkit).
2395
2396         Reverted changesets:
2397
2398         "[DFG] Support ArrayPush with multiple args"
2399         https://bugs.webkit.org/show_bug.cgi?id=175823
2400         http://trac.webkit.org/changeset/222563
2401
2402         "Unreviewed, build fix after r222563"
2403         https://bugs.webkit.org/show_bug.cgi?id=175823
2404         http://trac.webkit.org/changeset/222565
2405
2406         "Unreviewed, fix x86 breaking due to exhausted registers"
2407         https://bugs.webkit.org/show_bug.cgi?id=175823
2408         http://trac.webkit.org/changeset/222581
2409
2410 2017-09-28  Mark Lam  <mark.lam@apple.com>
2411
2412         test262: Unexpected passes after r222617 and r222618.
2413         https://bugs.webkit.org/show_bug.cgi?id=177622
2414         <rdar://problem/34725960>
2415
2416         Reviewed by Saam Barati.
2417
2418         Update test262.yaml for tests that are now passing.
2419
2420         * test262.yaml:
2421
2422 2017-09-27  Michael Saboff  <msaboff@apple.com>
2423
2424         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2425         https://bugs.webkit.org/show_bug.cgi?id=177570
2426
2427         Reviewed by Filip Pizlo.
2428
2429         New regression test.
2430
2431         * stress/regress-177570.js: Added.
2432
2433 2017-09-28  Michael Saboff  <msaboff@apple.com>
2434
2435         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2436         https://bugs.webkit.org/show_bug.cgi?id=177423
2437
2438         Reviewed by Mark Lam.
2439
2440         Updated regression test.
2441
2442         * stress/regress-177423.js:
2443         (catch):
2444
2445 2017-09-27  Mark Lam  <mark.lam@apple.com>
2446
2447         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2448         https://bugs.webkit.org/show_bug.cgi?id=177584
2449         <rdar://problem/34463903>
2450
2451         Reviewed by Saam Barati.
2452
2453         * stress/regress-177584.js: Added.
2454         (assertEqual):
2455         (Array.prototype.Symbol.species):
2456
2457 2017-09-27  Saam Barati  <sbarati@apple.com>
2458
2459         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2460         https://bugs.webkit.org/show_bug.cgi?id=177523
2461
2462         Reviewed by Mark Lam.
2463
2464         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2465         (assert):
2466         (Test):
2467         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2468         (addMethods):
2469         (i.Test.prototype.propName):
2470
2471 2017-09-27  Mark Lam  <mark.lam@apple.com>
2472
2473         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2474         https://bugs.webkit.org/show_bug.cgi?id=177423
2475         <rdar://problem/34621320>
2476
2477         Reviewed by Keith Miller.
2478
2479         * stress/regress-177423.js: Added.
2480
2481 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2482
2483         Add Above/Below comparisons for UInt32 patterns
2484         https://bugs.webkit.org/show_bug.cgi?id=177281
2485
2486         Reviewed by Saam Barati.
2487
2488         * stress/uint32-comparison-jump.js: Added.
2489         (shouldBe):
2490         (above):
2491         (aboveOrEqual):
2492         (below):
2493         (belowOrEqual):
2494         (notAbove):
2495         (notAboveOrEqual):
2496         (notBelow):
2497         (notBelowOrEqual):
2498         * stress/uint32-comparison.js: Added.
2499         (shouldBe):
2500         (above):
2501         (aboveOrEqual):
2502         (below):
2503         (belowOrEqual):
2504         (aboveTest):
2505         (aboveOrEqualTest):
2506         (belowTest):
2507         (belowOrEqualTest):
2508
2509 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2510
2511         [DFG] Support ArrayPush with multiple args
2512         https://bugs.webkit.org/show_bug.cgi?id=175823
2513
2514         Reviewed by Saam Barati.
2515
2516         * microbenchmarks/array-push-0.js: Added.
2517         (arrayPush0):
2518         * microbenchmarks/array-push-1.js: Added.
2519         (arrayPush1):
2520         * microbenchmarks/array-push-2.js: Added.
2521         (arrayPush2):
2522         * microbenchmarks/array-push-3.js: Added.
2523         (arrayPush3):
2524         * stress/array-push-multiple-contiguous.js: Added.
2525         (shouldBe):
2526         (test):
2527         * stress/array-push-multiple-double-nan.js: Added.
2528         (shouldBe):
2529         (test):
2530         * stress/array-push-multiple-double.js: Added.
2531         (shouldBe):
2532         (test):
2533         * stress/array-push-multiple-int32.js: Added.
2534         (shouldBe):
2535         (test):
2536         * stress/array-push-multiple-many-contiguous.js: Added.
2537         (shouldBe):
2538         (test):
2539         * stress/array-push-multiple-many-double.js: Added.
2540         (shouldBe):
2541         (test):
2542         * stress/array-push-multiple-many-int32.js: Added.
2543         (shouldBe):
2544         (test):
2545         * stress/array-push-multiple-many-storage.js: Added.
2546         (shouldBe):
2547         (test):
2548         * stress/array-push-multiple-storage.js: Added.
2549         (shouldBe):
2550         (test):
2551
2552 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2553
2554         Unreviewed, rolling out r222518.
2555         https://bugs.webkit.org/show_bug.cgi?id=177507
2556
2557         Break the High Sierra build (Requested by yusukesuzuki on
2558         #webkit).
2559
2560         Reverted changeset:
2561
2562         "Add Above/Below comparisons for UInt32 patterns"
2563         https://bugs.webkit.org/show_bug.cgi?id=177281
2564         http://trac.webkit.org/changeset/222518
2565
2566 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2567
2568         Add Above/Below comparisons for UInt32 patterns
2569         https://bugs.webkit.org/show_bug.cgi?id=177281
2570
2571         Reviewed by Saam Barati.
2572
2573         * stress/uint32-comparison-jump.js: Added.
2574         (shouldBe):
2575         (above):
2576         (aboveOrEqual):
2577         (below):
2578         (belowOrEqual):
2579         (notAbove):
2580         (notAboveOrEqual):
2581         (notBelow):
2582         (notBelowOrEqual):
2583         * stress/uint32-comparison.js: Added.
2584         (shouldBe):
2585         (above):
2586         (aboveOrEqual):
2587         (below):
2588         (belowOrEqual):
2589         (aboveTest):
2590         (aboveOrEqualTest):
2591         (belowTest):
2592         (belowOrEqualTest):
2593
2594 2017-09-23  Keith Miller  <keith_miller@apple.com>
2595
2596         Fix infinite looping test262 test
2597         https://bugs.webkit.org/show_bug.cgi?id=177412
2598
2599         Reviewed by Yusuke Suzuki.
2600
2601         This test was poorly designed since failing it would cause the vm
2602         to inifinite loop. I've fixed it locally and will fix it on github pending
2603         the results of next weeks tc39 meeting.
2604
2605         * test262.yaml:
2606         * test262/test/language/statements/for-of/iterator-next-reference.js:
2607
2608 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2609
2610         test262: $.agent became $262.agent in test262 update
2611         https://bugs.webkit.org/show_bug.cgi?id=177407
2612
2613         Reviewed by Yusuke Suzuki.
2614
2615         * test262.yaml:
2616         ~320 tests pass now that we correctly make $262 available.
2617
2618 2017-09-22  Keith Miller  <keith_miller@apple.com>
2619
2620         Speculatively change iteration protocall to use the same next function
2621         https://bugs.webkit.org/show_bug.cgi?id=175653
2622
2623         Reviewed by Saam Barati.
2624
2625         Change test to match the new iteration behavior.
2626
2627         * stress/spread-optimized-properly.js:
2628
2629 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2630
2631         [DFG][FTL] Profile array vector length for array allocation
2632         https://bugs.webkit.org/show_bug.cgi?id=177051
2633
2634         Reviewed by Saam Barati.
2635
2636         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2637         (target):
2638
2639 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2640
2641         Unreviewed, rolling out r222380.
2642         https://bugs.webkit.org/show_bug.cgi?id=177352
2643
2644         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2645         #webkit).
2646
2647         Reverted changeset:
2648
2649         "[DFG][FTL] Profile array vector length for array allocation"
2650         https://bugs.webkit.org/show_bug.cgi?id=177051
2651         http://trac.webkit.org/changeset/222380
2652
2653 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2654
2655         [DFG][FTL] Profile array vector length for array allocation
2656         https://bugs.webkit.org/show_bug.cgi?id=177051
2657
2658         Reviewed by Saam Barati.
2659
2660         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2661         (target):
2662
2663 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2664
2665         Skip new hanging test262 tests.
2666         https://bugs.webkit.org/show_bug.cgi?id=177326
2667
2668         Unreviewed test gardening.
2669
2670         * test262.yaml:
2671
2672 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2673
2674         Mark 6 test262 tests as passing.
2675         https://bugs.webkit.org/show_bug.cgi?id=177307
2676
2677         Unreviewed test gardening.
2678
2679         * test262.yaml:
2680
2681 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2682
2683         Unreviewed follow-up to r222311.
2684
2685         * test262/harness/sta.js:
2686         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2687         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2688         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2689         * test262/test/built-ins/Array/from/elements-added-after.js:
2690         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2691         * test262/test/built-ins/Array/from/elements-updated-after.js:
2692         * test262/test/built-ins/Array/from/from-array.js:
2693         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2694         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2695         * test262/test/built-ins/Array/from/source-array-boundary.js:
2696         * test262/test/built-ins/Array/from/source-object-constructor.js:
2697         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2698         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2699         * test262/test/built-ins/Array/from/source-object-length.js:
2700         * test262/test/built-ins/Array/from/source-object-missing.js:
2701         * test262/test/built-ins/Array/from/source-object-without.js:
2702         * test262/test/built-ins/Array/from/this-null.js:
2703         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2704         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2705         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2706         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2707         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2708         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2709         * test262/test/language/literals/string/7.8.4-1gs.js:
2710         Fix some files that I failed to update when I applied my patch.
2711
2712 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2713
2714         Update test262 tests
2715         https://bugs.webkit.org/show_bug.cgi?id=177220
2716
2717         Reviewed by Saam Barati and Yusuke Suzuki.
2718
2719         * test262.yaml:
2720         * test262/test262-Revision.txt:
2721         New rebaselined expectations for all tests.
2722
2723         * test262/*:
2724         Updated.
2725
2726 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2727
2728         [DFG] Remove ToThis more aggressively
2729         https://bugs.webkit.org/show_bug.cgi?id=177056
2730
2731         Reviewed by Saam Barati.
2732
2733         * stress/generator-with-this-strict.js: Added.
2734         (shouldBe):
2735         (generator):
2736         (target):
2737         * stress/generator-with-this.js: Added.
2738         (shouldBe):
2739         (generator):
2740         (target):
2741
2742 2017-09-17  Michael Saboff  <msaboff@apple.com>
2743
2744         https://bugs.webkit.org/show_bug.cgi?id=177038
2745         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2746
2747         Reviewed by JF Bastien.
2748
2749         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2750         as it dies using too much memory.
2751
2752 2017-09-15  Saam Barati  <sbarati@apple.com>
2753
2754         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2755         https://bugs.webkit.org/show_bug.cgi?id=176981
2756
2757         Reviewed by Yusuke Suzuki.
2758
2759         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2760         (assert):
2761         (verify):
2762         (func):
2763         (const.bar.createBuiltin):
2764
2765 2017-09-14  Saam Barati  <sbarati@apple.com>
2766
2767         It should be valid to exit before each set when doing arity fixup when inlining
2768         https://bugs.webkit.org/show_bug.cgi?id=176948
2769
2770         Reviewed by Keith Miller.
2771
2772         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2773         (baz):
2774         (bar):
2775         (foo):
2776
2777 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2778
2779         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2780         https://bugs.webkit.org/show_bug.cgi?id=176867
2781
2782         Reviewed by Sam Weinig.
2783
2784         * microbenchmarks/object-get-own-property-symbols.js: Added.
2785         (test):
2786
2787 2017-09-13  Mark Lam  <mark.lam@apple.com>
2788
2789         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2790         https://bugs.webkit.org/show_bug.cgi?id=176888
2791         <rdar://problem/34381832>
2792
2793         Not reviewed.
2794
2795         * stress/op_mod-ConstVar.js:
2796         * stress/op_mod-VarConst.js:
2797         * stress/op_mod-VarVar.js:
2798
2799 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2800
2801         Skip 3 op_mod tests on Debug JSC bots.
2802         https://bugs.webkit.org/show_bug.cgi?id=176630
2803
2804         Unreviewed test gardening.
2805
2806         * stress/op_mod-ConstVar.js:
2807         * stress/op_mod-VarConst.js:
2808         * stress/op_mod-VarVar.js:
2809
2810 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2811
2812         [JSC] Fix Array allocation in Object.keys
2813         https://bugs.webkit.org/show_bug.cgi?id=176826
2814
2815         Reviewed by Saam Barati.
2816
2817         * stress/object-own-property-keys.js: Added.
2818         (shouldBe):
2819
2820 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2821
2822         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2823         https://bugs.webkit.org/show_bug.cgi?id=176010
2824
2825         Reviewed by Filip Pizlo.
2826
2827         * microbenchmarks/weak-map-key.js: Added.
2828         (assert):
2829         (objectKey):
2830         (let.start.Date.now):
2831
2832 2017-09-12  Mark Lam  <mark.lam@apple.com>
2833
2834         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2835         https://bugs.webkit.org/show_bug.cgi?id=176630
2836
2837         Reviewed by JF Bastien.
2838
2839         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2840         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2841         a speculative fix for the bots that are seeing these fail.
2842
2843         I also undid the skipping of the op_mod tests for debug builds.
2844
2845         * stress/op_div-ConstVar.js:
2846         * stress/op_div-VarConst.js:
2847         * stress/op_div-VarVar.js:
2848         * stress/op_mod-ConstVar.js:
2849         * stress/op_mod-VarConst.js:
2850         * stress/op_mod-VarVar.js:
2851
2852 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2853
2854         Skip stress/value-to-boolean.js on Debug bots.
2855         https://bugs.webkit.org/show_bug.cgi?id=176787
2856
2857         Unreviewed test gardening.
2858
2859         * stress/value-to-boolean.js:
2860
2861 2017-09-11  Mark Lam  <mark.lam@apple.com>
2862
2863         Change test expectation for test262/test/language/statements/try/tco-catch.js
2864         https://bugs.webkit.org/show_bug.cgi?id=176749
2865
2866         Rubber stamped by Keith Miller.
2867
2868         It's been failing since at least r221821.  I'm changing the test expectation to
2869         fail to green the bots while I investigate some more.
2870
2871         * test262.yaml:
2872
2873 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2874
2875         Unreviewed, rolling out r221854.
2876
2877         The test added with this change fails on 32-bit JSC bots.
2878
2879         Reverted changeset:
2880
2881         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2882         https://bugs.webkit.org/show_bug.cgi?id=176010
2883         http://trac.webkit.org/changeset/221854
2884
2885 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2886
2887         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2888         https://bugs.webkit.org/show_bug.cgi?id=176010
2889
2890         Reviewed by Filip Pizlo.
2891
2892         * microbenchmarks/weak-map-key.js: Added.
2893         (assert):
2894         (objectKey):
2895         (let.start.Date.now):
2896
2897 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2898
2899         [JSC] Optimize Object.keys by using careful array allocation
2900         https://bugs.webkit.org/show_bug.cgi?id=176654
2901
2902         Reviewed by Darin Adler.
2903
2904         * microbenchmarks/object-keys.js: Added.
2905         (test):
2906
2907 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
2908
2909         Error should compute .stack and friends lazily
2910         https://bugs.webkit.org/show_bug.cgi?id=176645
2911
2912         Reviewed by Saam Barati.
2913
2914         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
2915         * microbenchmarks/new-error.js: Added.
2916         * microbenchmarks/throw.js: Added.
2917
2918 2017-09-09  Mark Lam  <mark.lam@apple.com>
2919
2920         [Re-landing] Use JIT probes for DFG OSR exit.
2921         https://bugs.webkit.org/show_bug.cgi?id=175144
2922         <rdar://problem/33437050>
2923
2924         Not reviewed.  Original patch reviewed by Saam Barati.
2925
2926         Disable these tests for debug builds because they run too slow with the new OSR exit.
2927
2928         * stress/op_mod-ConstVar.js:
2929         * stress/op_mod-VarConst.js:
2930         * stress/op_mod-VarVar.js:
2931
2932 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2933
2934         [DFG] NewArrayWithSize(size)'s size does not care negative zero
2935         https://bugs.webkit.org/show_bug.cgi?id=176300
2936
2937         Reviewed by Saam Barati.
2938
2939         * stress/new-array-with-size-div.js: Added.
2940         (shouldBe):
2941         (test):
2942         (i.i):
2943
2944 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2945
2946         [DFG] PutByVal with Array::Generic is too generic
2947         https://bugs.webkit.org/show_bug.cgi?id=176345
2948
2949         Reviewed by Filip Pizlo.
2950
2951         * stress/object-assign-symbols.js: Added.
2952         (shouldBe):
2953         (test):
2954         * stress/object-assign.js: Added.
2955         (shouldBe):
2956         (test):
2957         (i.shouldBe.JSON.stringify.test):
2958
2959 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2960
2961         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
2962         https://bugs.webkit.org/show_bug.cgi?id=176590
2963
2964         Reviewed by Saam Barati.
2965
2966         * microbenchmarks/object-iterate-symbols.js: Added.
2967         (test):
2968         * microbenchmarks/object-iterate.js: Added.
2969         (test):
2970         * stress/object-iterate-symbols.js: Added.
2971         (shouldBe):
2972         (test):
2973         * stress/object-iterate.js: Added.
2974         (shouldBe):
2975         (test):
2976
2977 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
2978
2979         [Win32] 10 JSC stress tests are failing.
2980         https://bugs.webkit.org/show_bug.cgi?id=176538
2981
2982         Reviewed by Mark Lam.
2983
2984         Skip tests on Windows to make the bots green.
2985
2986         * ChakraCore.yaml:
2987         * stress/date-relaxed.js:
2988
2989 2017-09-06  Mark Lam  <mark.lam@apple.com>
2990
2991         constructGenericTypedArrayViewWithArguments() is missing an exception check.
2992         https://bugs.webkit.org/show_bug.cgi?id=176485
2993         <rdar://problem/33898874>
2994
2995         Reviewed by Keith Miller.
2996
2997         * stress/regress-176485.js: Added.
2998
2999 2017-09-05  Saam Barati  <sbarati@apple.com>
3000
3001         isNotCellSpeculation is wrong with respect to SpecEmpty
3002         https://bugs.webkit.org/show_bug.cgi?id=176429
3003
3004         Reviewed by Michael Saboff.
3005
3006         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
3007         (Foo):
3008
3009 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
3010
3011         test262: Completion values for control flow do not match the spec
3012         https://bugs.webkit.org/show_bug.cgi?id=171265
3013
3014         Reviewed by Saam Barati.
3015
3016         * stress/completion-value.js:
3017         Condensed test for completion values in top level statements.
3018
3019         * stress/super-get-by-id.js:
3020         ClassDeclaration when evaled no longer produce values. Convert
3021         these to ClassExpressions so they produce the class value.
3022         
3023         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3024         This is a progression for currect spec behavior.
3025
3026         * mozilla/mozilla-tests.yaml:
3027         This test is now outdated, so mark it as failing for that reason.
3028
3029         * test262.yaml:
3030         Passing all "cptn" completion value tests.
3031
3032 2017-09-04  Saam Barati  <sbarati@apple.com>
3033
3034         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
3035         https://bugs.webkit.org/show_bug.cgi?id=176317
3036
3037         Reviewed by Keith Miller.
3038
3039         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
3040         (Foo):
3041
3042 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3043
3044         [DFG][FTL] Efficiently execute number#toString()
3045         https://bugs.webkit.org/show_bug.cgi?id=170007
3046
3047         Reviewed by Keith Miller.
3048
3049         * microbenchmarks/number-to-string-strength-reduction.js: Added.
3050         (test):
3051         * microbenchmarks/number-to-string-with-radix-10.js: Added.
3052         (test):
3053         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
3054         (test):
3055         * microbenchmarks/number-to-string-with-radix.js: Added.
3056         (test):
3057         * stress/number-to-string-strength-reduction.js: Added.
3058         (shouldBe):
3059         (test):
3060         * stress/number-to-string-with-radix-10.js: Added.
3061         (shouldBe):
3062         (test):
3063         * stress/number-to-string-with-radix-cse.js: Added.
3064         (shouldBe):
3065         (test):
3066         * stress/number-to-string-with-radix-invalid.js: Added.
3067         (shouldThrow):
3068         * stress/number-to-string-with-radix-watchpoint.js: Added.
3069         (shouldBe):
3070         (test):
3071         (i.i.1e3.Number.prototype.toString):
3072         * stress/number-to-string-with-radix.js: Added.
3073         (shouldBe):
3074         (test):
3075
3076 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3077
3078         [DFG] Relax arity requirement
3079         https://bugs.webkit.org/show_bug.cgi?id=175523
3080
3081         Reviewed by Saam Barati.
3082
3083         * stress/arity-mismatch-arguments-length.js: Added.
3084         (shouldBe):
3085         (test1):
3086         (test):
3087         * stress/arity-mismatch-get-argument.js: Added.
3088         (shouldBe):
3089         (builtin.createBuiltin):
3090         (test):
3091         * stress/arity-mismatch-inlining-extra-slots.js: Added.
3092         (shouldBe):
3093         (inlineTarget):
3094         (test):
3095         * stress/arity-mismatch-inlining.js: Added.
3096         (shouldBe):
3097         (inlineTarget):
3098         (test):
3099         * stress/arity-mismatch-rest.js: Added.
3100         (shouldBe):
3101         (test2):
3102         (test1):
3103         (test):
3104
3105 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3106
3107         [JSC] Fix "name" and "length" of Proxy revoke function
3108         https://bugs.webkit.org/show_bug.cgi?id=176155
3109
3110         Reviewed by Mark Lam.
3111
3112         * test262.yaml:
3113
3114 2017-08-31  Saam Barati  <sbarati@apple.com>
3115
3116         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
3117         https://bugs.webkit.org/show_bug.cgi?id=176206
3118
3119         Reviewed by Keith Miller.
3120
3121         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
3122         (a):
3123         (b):
3124         (foo):
3125
3126 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
3127
3128         Skip two slow JSC tests after r221422.
3129
3130         Unreviewed test gardening.
3131
3132         * stress/regexp-prototype-match-on-too-long-rope.js:
3133         * stress/regexp-prototype-test-on-too-long-rope.js:
3134
3135 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
3136
3137         Unreviewed, skipping slow tests.
3138         
3139         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
3140         work differently now.
3141
3142         * stress/regexp-prototype-exec-on-too-long-rope.js:
3143         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
3144
3145 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3146
3147         [JSC] Use reifying system for "name" property of builtin JSFunction
3148         https://bugs.webkit.org/show_bug.cgi?id=175260
3149
3150         Reviewed by Saam Barati.
3151
3152         * stress/accessors-get-set-prefix.js:
3153         * stress/builtin-function-name.js: Added.
3154         (shouldBe):
3155         (shouldThrow):
3156         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3157         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3158         * stress/private-name-as-anonymous-builtin.js: Added.
3159         (shouldBe):
3160         (NotPromise):
3161
3162 2017-08-30  Saam Barati  <sbarati@apple.com>
3163
3164         Unreviewed. Make test stop printing.
3165
3166         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
3167
3168 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
3169
3170         Unreviewed, rolling out r221327.
3171
3172         This change caused test262 failures.
3173
3174         Reverted changeset:
3175
3176         "[JSC] Use reifying system for "name" property of builtin
3177         JSFunction"
3178         https://bugs.webkit.org/show_bug.cgi?id=175260
3179         http://trac.webkit.org/changeset/221327
3180
3181 2017-08-30  Saam Barati  <sbarati@apple.com>
3182
3183         semicolon is being interpreted as an = in the LiteralParser
3184         https://bugs.webkit.org/show_bug.cgi?id=176114
3185
3186         Reviewed by Oliver Hunt.
3187
3188         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
3189         * stress/resources/literal-parser-test-case.js: Added.
3190
3191 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3192
3193         [ESNext] Async iteration - Implement async iteration statement: for-await-of
3194         https://bugs.webkit.org/show_bug.cgi?id=166698
3195
3196         Reviewed by Yusuke Suzuki.
3197
3198         * stress/async-iteration-for-await-of-syntax.js: Added.
3199         (assert):
3200         (checkSyntax):
3201         (checkSyntaxError):
3202         (checkSimpleAsyncGeneratorSloppyMode):
3203         (checkSimpleAsyncGeneratorStrictMode):
3204         (checkNestedAsyncGenerators):
3205         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3206         * stress/async-iteration-for-await-of.js: Added.
3207         (assert):
3208         (async.foo):
3209         (async.boo):
3210         (const.boo.async):
3211
3212 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
3213
3214         [JSC] Use reifying system for "name" property of builtin JSFunction
3215         https://bugs.webkit.org/show_bug.cgi?id=175260
3216
3217         Reviewed by Saam Barati.
3218
3219         * stress/accessors-get-set-prefix.js:
3220         * stress/builtin-function-name.js: Added.
3221         (shouldBe):
3222         (shouldThrow):
3223         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3224         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3225
3226 2017-08-25  Saam Barati  <sbarati@apple.com>
3227
3228         Support compiling catch in the DFG
3229         https://bugs.webkit.org/show_bug.cgi?id=174590
3230         <rdar://problem/34047845>
3231
3232         Reviewed by Filip Pizlo.
3233
3234         * microbenchmarks/delta-blue-try-catch.js: Added.
3235         (exception):
3236         (value):
3237         (OrderedCollection):
3238         (OrderedCollection.prototype.add):
3239         (OrderedCollection.prototype.at):
3240         (OrderedCollection.prototype.size):
3241         (OrderedCollection.prototype.removeFirst):
3242         (OrderedCollection.prototype.remove):
3243         (Strength):
3244         (Strength.stronger):
3245         (Strength.weaker):
3246         (Strength.weakestOf):
3247         (Strength.strongest):
3248         (Strength.prototype.nextWeaker):
3249         (Constraint):
3250         (Constraint.prototype.addConstraint):
3251         (Constraint.prototype.satisfy):
3252         (Constraint.prototype.destroyConstraint):
3253         (Constraint.prototype.isInput):
3254         (UnaryConstraint):
3255         (UnaryConstraint.prototype.addToGraph):
3256         (UnaryConstraint.prototype.chooseMethod):
3257         (UnaryConstraint.prototype.isSatisfied):
3258         (UnaryConstraint.prototype.markInputs):
3259         (UnaryConstraint.prototype.output):
3260         (UnaryConstraint.prototype.recalculate):
3261         (UnaryConstraint.prototype.markUnsatisfied):
3262         (UnaryConstraint.prototype.inputsKnown):
3263         (UnaryConstraint.prototype.removeFromGraph):
3264         (StayConstraint):
3265         (StayConstraint.prototype.execute):
3266         (EditConstraint.prototype.isInput):
3267         (EditConstraint.prototype.execute):
3268         (BinaryConstraint):
3269         (BinaryConstraint.prototype.chooseMethod):
3270         (BinaryConstraint.prototype.addToGraph):
3271         (BinaryConstraint.prototype.isSatisfied):
3272         (BinaryConstraint.prototype.markInputs):
3273         (BinaryConstraint.prototype.input):
3274         (BinaryConstraint.prototype.output):
3275         (BinaryConstraint.prototype.recalculate):
3276         (BinaryConstraint.prototype.markUnsatisfied):
3277         (BinaryConstraint.prototype.inputsKnown):
3278         (BinaryConstraint.prototype.removeFromGraph):
3279         (ScaleConstraint):
3280         (ScaleConstraint.prototype.addToGraph):
3281         (ScaleConstraint.prototype.removeFromGraph):
3282         (ScaleConstraint.prototype.markInputs):
3283         (ScaleConstraint.prototype.execute):
3284         (ScaleConstraint.prototype.recalculate):
3285         (EqualityConstraint):
3286         (EqualityConstraint.prototype.execute):
3287         (Variable):
3288         (Variable.prototype.addConstraint):
3289         (Variable.prototype.removeConstraint):
3290         (Planner):
3291         (Planner.prototype.incrementalAdd):
3292         (Planner.prototype.incrementalRemove):
3293         (Planner.prototype.newMark):
3294         (Planner.prototype.makePlan):
3295         (Planner.prototype.extractPlanFromConstraints):
3296         (Planner.prototype.addPropagate):
3297         (Planner.prototype.removePropagateFrom):
3298         (Planner.prototype.addConstraintsConsumingTo):
3299         (Plan):
3300         (Plan.prototype.addConstraint):
3301         (Plan.prototype.size):
3302         (Plan.prototype.constraintAt):
3303         (Plan.prototype.execute):
3304         (chainTest):
3305         (projectionTest):
3306         (change):
3307         (deltaBlue):
3308         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3309         (assert):
3310         (Numbers):
3311         (Numbers.prototype.next):
3312         (return.Transpose):
3313         (return.Transpose.prototype.next):
3314         (transpose):
3315         (verifyEven):
3316         (verifyString):
3317         (foo):
3318         (runIterators):
3319         * microbenchmarks/try-catch-word-count.js: Added.
3320         (let.assert):
3321         (EOF):
3322         (let.texts):
3323         (let.o.apply):
3324         (foo):
3325         (bar):
3326         (f):
3327         (run):
3328         (test1):
3329         (test2):
3330         (test3):
3331         (fn):
3332         (A):
3333         (B):
3334         (A.prototype.getValue):
3335         (B.prototype.getParentValue):
3336         (strlen):
3337         (sum.0):
3338         (test):
3339         (result.test.o):
3340         (set add.set add):
3341         (set forEach):
3342         (stringHash):
3343         (set if):
3344         (testFunction):
3345         (set delete.set has.set add):
3346         * stress/catch-set-argument-speculation-failure.js: Added.
3347         (o):
3348         (e):
3349         (e2):
3350         (escape):
3351         (baz):
3352         (noInline.run):
3353         (noInline):
3354         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3355         (foo):
3356         (e):
3357         (baz):
3358         (bar):
3359
3360 2017-08-24  Commit Queue  <commit-queue@webkit.org>
3361
3362         Unreviewed, rolling out r221119, r221124, and r221143.
3363         https://bugs.webkit.org/show_bug.cgi?id=175973
3364
3365         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3366         on #webkit).
3367
3368         Reverted changesets:
3369
3370         "Support compiling catch in the DFG"
3371         https://bugs.webkit.org/show_bug.cgi?id=174590
3372         http://trac.webkit.org/changeset/221119
3373
3374         "Unreviewed, build fix in GTK port"
3375         https://bugs.webkit.org/show_bug.cgi?id=174590
3376         http://trac.webkit.org/changeset/221124
3377
3378         "DFG::JITCode::osrEntry should get sorted since we perform a
3379         binary search on it"
3380         https://bugs.webkit.org/show_bug.cgi?id=175893
3381         http://trac.webkit.org/changeset/221143
3382
3383 2017-08-24  Michael Saboff  <msaboff@apple.com>
3384
3385         Add support for RegExp "dotAll" flag
3386         https://bugs.webkit.org/show_bug.cgi?id=175924
3387
3388         Reviewed by Keith Miller.
3389
3390         Updated tests for new dotAll ('s' flag) changes.
3391
3392         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3393         * stress/static-getter-in-names.js:
3394
3395 2017-08-24  Mark Lam  <mark.lam@apple.com>
3396
3397         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3398         https://bugs.webkit.org/show_bug.cgi?id=175940
3399         <rdar://problem/29003921>
3400
3401         Reviewed by Saam Barati.
3402
3403         * stress/regress-164081.js: Added.
3404         (shouldEqual):
3405         (testcase):
3406
3407 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3408
3409         Skip flaky JSC test stress/test-finally.js.
3410         https://bugs.webkit.org/show_bug.cgi?id=160283
3411
3412         Unreviewed test gardening.
3413
3414         * stress/test-finally.js:
3415
3416 2017-08-23  Saam Barati  <sbarati@apple.com>
3417
3418         Support compiling catch in the DFG
3419         https://bugs.webkit.org/show_bug.cgi?id=174590
3420
3421         Reviewed by Filip Pizlo.
3422
3423         * microbenchmarks/delta-blue-try-catch.js: Added.
3424         (exception):
3425         (value):
3426         (OrderedCollection):
3427         (OrderedCollection.prototype.add):
3428         (OrderedCollection.prototype.at):
3429         (OrderedCollection.prototype.size):
3430         (OrderedCollection.prototype.removeFirst):
3431         (OrderedCollection.prototype.remove):
3432         (Strength):
3433         (Strength.stronger):
3434         (Strength.weaker):
3435         (Strength.weakestOf):
3436         (Strength.strongest):
3437         (Strength.prototype.nextWeaker):
3438         (Constraint):
3439         (Constraint.prototype.addConstraint):
3440         (Constraint.prototype.satisfy):
3441         (Constraint.prototype.destroyConstraint):
3442         (Constraint.prototype.isInput):
3443         (UnaryConstraint):
3444         (UnaryConstraint.prototype.addToGraph):
3445         (UnaryConstraint.prototype.chooseMethod):
3446         (UnaryConstraint.prototype.isSatisfied):
3447         (UnaryConstraint.prototype.markInputs):
3448         (UnaryConstraint.prototype.output):
3449         (UnaryConstraint.prototype.recalculate):
3450         (UnaryConstraint.prototype.markUnsatisfied):
3451         (UnaryConstraint.prototype.inputsKnown):
3452         (UnaryConstraint.prototype.removeFromGraph):
3453         (StayConstraint):
3454         (StayConstraint.prototype.execute):
3455         (EditConstraint.prototype.isInput):
3456         (EditConstraint.prototype.execute):
3457         (BinaryConstraint):
3458         (BinaryConstraint.prototype.chooseMethod):
3459         (BinaryConstraint.prototype.addToGraph):
3460         (BinaryConstraint.prototype.isSatisfied):
3461         (BinaryConstraint.prototype.markInputs):
3462         (BinaryConstraint.prototype.input):
3463         (BinaryConstraint.prototype.output):
3464         (BinaryConstraint.prototype.recalculate):
3465         (BinaryConstraint.prototype.markUnsatisfied):
3466         (BinaryConstraint.prototype.inputsKnown):
3467         (BinaryConstraint.prototype.removeFromGraph):
3468         (ScaleConstraint):
3469         (ScaleConstraint.prototype.addToGraph):
3470         (ScaleConstraint.prototype.removeFromGraph):
3471         (ScaleConstraint.prototype.markInputs):
3472         (ScaleConstraint.prototype.execute):
3473         (ScaleConstraint.prototype.recalculate):
3474         (EqualityConstraint):
3475         (EqualityConstraint.prototype.execute):
3476         (Variable):
3477         (Variable.prototype.addConstraint):
3478         (Variable.prototype.removeConstraint):
3479         (Planner):
3480         (Planner.prototype.incrementalAdd):
3481         (Planner.prototype.incrementalRemove):
3482         (Planner.prototype.newMark):
3483         (Planner.prototype.makePlan):
3484         (Planner.prototype.extractPlanFromConstraints):
3485         (Planner.prototype.addPropagate):
3486         (Planner.prototype.removePropagateFrom):
3487         (Planner.prototype.addConstraintsConsumingTo):
3488         (Plan):
3489         (Plan.prototype.addConstraint):
3490         (Plan.prototype.size):
3491         (Plan.prototype.constraintAt):
3492         (Plan.prototype.execute):
3493         (chainTest):
3494         (projectionTest):
3495         (change):
3496         (deltaBlue):
3497         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3498         (assert):
3499         (Numbers):
3500         (Numbers.prototype.next):
3501         (return.Transpose):
3502         (return.Transpose.prototype.next):
3503         (transpose):
3504         (verifyEven):
3505         (verifyString):
3506         (foo):
3507         (runIterators):
3508         * microbenchmarks/try-catch-word-count.js: Added.
3509         (let.assert):
3510         (EOF):
3511         (let.texts):
3512         (let.o.apply):
3513         (foo):
3514         (bar):
3515         (f):
3516         (run):
3517         (test1):
3518         (test2):
3519         (test3):
3520         (fn):
3521         (A):
3522         (B):
3523         (A.prototype.getValue):
3524         (B.prototype.getParentValue):
3525         (strlen):
3526         (sum.0):
3527         (test):
3528         (result.test.o):
3529         (set add.set add):
3530         (set forEach):
3531         (stringHash):
3532         (set if):
3533         (testFunction):
3534         (set delete.set has.set add):
3535         * stress/catch-set-argument-speculation-failure.js: Added.
3536         (o):
3537         (e):
3538         (e2):
3539         (escape):
3540         (baz):
3541         (noInline.run):
3542         (noInline):
3543         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3544         (foo):
3545         (e):
3546         (baz):
3547         (bar):
3548
3549 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3550
3551         [JSC] Optimize Map iteration with intrinsic
3552         https://bugs.webkit.org/show_bug.cgi?id=174355
3553
3554         Reviewed by Saam Barati.
3555
3556         * stress/map-iterator-result-should-have-expected-shape.js: Added.
3557         (shouldBe):
3558         (throw.new.Error):
3559         * stress/set-iterator-result-should-have-expected-shape.js: Added.
3560         (shouldBe):
3561         (throw.new.Error.let.iterator.set Symbol):
3562         (throw.new.Error.set add):
3563         (let.iterator.set Symbol):
3564
3565 2017-08-23  Robin Morisset  <rmorisset@apple.com>
3566
3567         Add a micro-benchmark for checking that accessing a variable within a 'with'
3568         block does not automatically prevent type prediction.
3569         https://bugs.webkit.org/show_bug.cgi?id=175738
3570
3571         Reviewed by Saam Barati.
3572
3573         * stress/with_and_arith.js: Added.
3574         (with):
3575
3576 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
3577
3578         [ESNext] Async iteration - Implement Async Generator - runtime
3579         https://bugs.webkit.org/show_bug.cgi?id=175240
3580
3581         Reviewed by Yusuke Suzuki.
3582
3583         * stress/async-iteration-async-from-sync.js: Added.
3584         (assert):
3585         (const.Logger):
3586         (this.fullfilled):
3587         (this.fullfilledDone):
3588         (this.rejected):
3589         (this.catched):
3590         (this.isFinal):
3591         (_assertLogger):
3592         (const.assertLogger):
3593         (const.getPromise.promiseHolder.return.new.Promise):
3594         (foo):
3595         (async.boo):
3596         (bar):
3597         (async.baz):
3598         (async.goo):
3599         * stress/async-iteration-basic.js: Added.
3600         (assert):
3601         (const.Logger):
3602         (this.fullfilled):
3603         (this.fullfilledDone):
3604         (this.rejected):
3605         (this.catched):
3606         (this.isFinal):
3607         (_assertLogger):
3608         (const.assertLogger):
3609         (const.getPromise.promiseHolder.return.new.Promise):
3610         (async.generator):
3611         (iterator.next.then):
3612         (async.baz):
3613         (async.boo):
3614         (async.foo):
3615         (async.goo):
3616         (A.prototype.async.foo):
3617         (A.prototype.async.boo):
3618         (A):
3619         (asyncGenExp.async):
3620         (async.joo):
3621         (j.next.then):
3622         (then):
3623         (async.koo):
3624         (async.loo):
3625         (async.moo):
3626         (async.noo):
3627         (async.ooo):
3628         (async.roo):
3629         (async.poo):
3630         (async.soo):
3631         (async.too):
3632         * stress/async-iteration-evaluation.js: Added.
3633         (assert):
3634         (async.foo):
3635         (catch):
3636         * stress/async-iteration-syntax.js:
3637         * stress/async-iteration-yield-promise.js: Added.
3638         (assert):
3639         (const.Logger):
3640         (this.fullfilled):
3641         (this.fullfilledDone):
3642         (this.rejected):
3643         (this.catched):
3644         (this.isFinal):
3645         (_assertLogger):
3646         (const.assertLogger):
3647         (const.getPromise.promiseHolder.return.new.Promise):
3648         (async.foo):
3649         (async.boo):
3650         (async.bar):
3651         * stress/async-iteration-yield-star-interface.js: Added.
3652         (assert):
3653         (const.getPromise.promiseHolder.return.new.Promise):
3654         (const.Logger):
3655         (this.fullfilled):
3656         (this.fullfilledDone):
3657         (this.rejected):
3658         (this.catched):
3659         (this.custom):
3660         (this.isFinal):
3661         (_assertLogger):
3662         (const.assertLogger):
3663         (let.asyncIter.Symbol.asyncIterator):
3664         (let.asyncIter.next):
3665         (let.asyncIter.throw):
3666         (let.asyncIter.return):
3667         (async.foo):
3668         (asyncIter.Symbol.asyncIterator):
3669         (asyncIter.next):
3670         (async.boo):
3671         (asyncIter.return):
3672         (async.bar):
3673         (async.baz):
3674         (async.foobar):
3675         * stress/async-iteration-yield-star.js: Added.
3676         (assert):
3677         (const.Logger):
3678         (this.fullfilled):
3679         (this.fullfilledDone):
3680         (this.rejected):
3681         (this.catched):
3682         (this.custom):
3683         (this.isFinal):
3684         (_assertLogger):
3685         (const.assertLogger):
3686         (const.getPromise.promiseHolder.return.new.Promise):
3687         (async.foo):
3688         (async.boo):
3689         (async.bar):
3690         (async.baz):
3691         (async.joo):
3692         (async.goo):
3693         (async.koo):
3694         (async.loo):
3695         (let.asyncIter.Symbol.asyncIterator):
3696         (let.asyncIter.next):
3697         (let.asyncIter.throw):
3698         (let.asyncIter.return):
3699         (async.moo):
3700         (async.noo):
3701         * test262.yaml:
3702
3703 2017-08-23  JF Bastien  <jfbastien@apple.com>
3704
3705         Fix printing in test
3706
3707         Unreviewed: fixing verbosity, shouldn't have been there.
3708
3709         * wasm/regress/175693.js:
3710         (else.else):
3711         (catch):
3712
3713 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
3714
3715         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
3716         https://bugs.webkit.org/show_bug.cgi?id=172543
3717
3718         Unreviewed test gardening.
3719
3720         * microbenchmarks/generator-with-several-types.js:
3721
3722 2017-08-17  JF Bastien  <jfbastien@apple.com>
3723
3724         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
3725         https://bugs.webkit.org/show_bug.cgi?id=175693
3726         <rdar://problem/33952443>
3727
3728         Reviewed by Saam Barati.
3729