Unreviewed, rolling out r222380.
[WebKit-https.git] / JSTests / ChangeLog
1 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2
3         Unreviewed, rolling out r222380.
4         https://bugs.webkit.org/show_bug.cgi?id=177352
5
6         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
7         #webkit).
8
9         Reverted changeset:
10
11         "[DFG][FTL] Profile array vector length for array allocation"
12         https://bugs.webkit.org/show_bug.cgi?id=177051
13         http://trac.webkit.org/changeset/222380
14
15 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
16
17         [DFG][FTL] Profile array vector length for array allocation
18         https://bugs.webkit.org/show_bug.cgi?id=177051
19
20         Reviewed by Saam Barati.
21
22         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
23         (target):
24
25 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
26
27         Skip new hanging test262 tests.
28         https://bugs.webkit.org/show_bug.cgi?id=177326
29
30         Unreviewed test gardening.
31
32         * test262.yaml:
33
34 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
35
36         Mark 6 test262 tests as passing.
37         https://bugs.webkit.org/show_bug.cgi?id=177307
38
39         Unreviewed test gardening.
40
41         * test262.yaml:
42
43 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
44
45         Unreviewed follow-up to r222311.
46
47         * test262/harness/sta.js:
48         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
49         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
50         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
51         * test262/test/built-ins/Array/from/elements-added-after.js:
52         * test262/test/built-ins/Array/from/elements-deleted-after.js:
53         * test262/test/built-ins/Array/from/elements-updated-after.js:
54         * test262/test/built-ins/Array/from/from-array.js:
55         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
56         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
57         * test262/test/built-ins/Array/from/source-array-boundary.js:
58         * test262/test/built-ins/Array/from/source-object-constructor.js:
59         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
60         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
61         * test262/test/built-ins/Array/from/source-object-length.js:
62         * test262/test/built-ins/Array/from/source-object-missing.js:
63         * test262/test/built-ins/Array/from/source-object-without.js:
64         * test262/test/built-ins/Array/from/this-null.js:
65         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
66         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
67         * test262/test/language/literals/numeric/7.8.3-1gs.js:
68         * test262/test/language/literals/numeric/7.8.3-2gs.js:
69         * test262/test/language/literals/numeric/7.8.3-3gs.js:
70         * test262/test/language/literals/regexp/7.8.5-1gs.js:
71         * test262/test/language/literals/string/7.8.4-1gs.js:
72         Fix some files that I failed to update when I applied my patch.
73
74 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
75
76         Update test262 tests
77         https://bugs.webkit.org/show_bug.cgi?id=177220
78
79         Reviewed by Saam Barati and Yusuke Suzuki.
80
81         * test262.yaml:
82         * test262/test262-Revision.txt:
83         New rebaselined expectations for all tests.
84
85         * test262/*:
86         Updated.
87
88 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
89
90         [DFG] Remove ToThis more aggressively
91         https://bugs.webkit.org/show_bug.cgi?id=177056
92
93         Reviewed by Saam Barati.
94
95         * stress/generator-with-this-strict.js: Added.
96         (shouldBe):
97         (generator):
98         (target):
99         * stress/generator-with-this.js: Added.
100         (shouldBe):
101         (generator):
102         (target):
103
104 2017-09-17  Michael Saboff  <msaboff@apple.com>
105
106         https://bugs.webkit.org/show_bug.cgi?id=177038
107         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
108
109         Reviewed by JF Bastien.
110
111         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
112         as it dies using too much memory.
113
114 2017-09-15  Saam Barati  <sbarati@apple.com>
115
116         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
117         https://bugs.webkit.org/show_bug.cgi?id=176981
118
119         Reviewed by Yusuke Suzuki.
120
121         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
122         (assert):
123         (verify):
124         (func):
125         (const.bar.createBuiltin):
126
127 2017-09-14  Saam Barati  <sbarati@apple.com>
128
129         It should be valid to exit before each set when doing arity fixup when inlining
130         https://bugs.webkit.org/show_bug.cgi?id=176948
131
132         Reviewed by Keith Miller.
133
134         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
135         (baz):
136         (bar):
137         (foo):
138
139 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
140
141         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
142         https://bugs.webkit.org/show_bug.cgi?id=176867
143
144         Reviewed by Sam Weinig.
145
146         * microbenchmarks/object-get-own-property-symbols.js: Added.
147         (test):
148
149 2017-09-13  Mark Lam  <mark.lam@apple.com>
150
151         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
152         https://bugs.webkit.org/show_bug.cgi?id=176888
153         <rdar://problem/34381832>
154
155         Not reviewed.
156
157         * stress/op_mod-ConstVar.js:
158         * stress/op_mod-VarConst.js:
159         * stress/op_mod-VarVar.js:
160
161 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
162
163         Skip 3 op_mod tests on Debug JSC bots.
164         https://bugs.webkit.org/show_bug.cgi?id=176630
165
166         Unreviewed test gardening.
167
168         * stress/op_mod-ConstVar.js:
169         * stress/op_mod-VarConst.js:
170         * stress/op_mod-VarVar.js:
171
172 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
173
174         [JSC] Fix Array allocation in Object.keys
175         https://bugs.webkit.org/show_bug.cgi?id=176826
176
177         Reviewed by Saam Barati.
178
179         * stress/object-own-property-keys.js: Added.
180         (shouldBe):
181
182 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
183
184         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
185         https://bugs.webkit.org/show_bug.cgi?id=176010
186
187         Reviewed by Filip Pizlo.
188
189         * microbenchmarks/weak-map-key.js: Added.
190         (assert):
191         (objectKey):
192         (let.start.Date.now):
193
194 2017-09-12  Mark Lam  <mark.lam@apple.com>
195
196         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
197         https://bugs.webkit.org/show_bug.cgi?id=176630
198
199         Reviewed by JF Bastien.
200
201         Debug builds are just slow, and these tests do a lot.  They pass when I run them
202         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
203         a speculative fix for the bots that are seeing these fail.
204
205         I also undid the skipping of the op_mod tests for debug builds.
206
207         * stress/op_div-ConstVar.js:
208         * stress/op_div-VarConst.js:
209         * stress/op_div-VarVar.js:
210         * stress/op_mod-ConstVar.js:
211         * stress/op_mod-VarConst.js:
212         * stress/op_mod-VarVar.js:
213
214 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
215
216         Skip stress/value-to-boolean.js on Debug bots.
217         https://bugs.webkit.org/show_bug.cgi?id=176787
218
219         Unreviewed test gardening.
220
221         * stress/value-to-boolean.js:
222
223 2017-09-11  Mark Lam  <mark.lam@apple.com>
224
225         Change test expectation for test262/test/language/statements/try/tco-catch.js
226         https://bugs.webkit.org/show_bug.cgi?id=176749
227
228         Rubber stamped by Keith Miller.
229
230         It's been failing since at least r221821.  I'm changing the test expectation to
231         fail to green the bots while I investigate some more.
232
233         * test262.yaml:
234
235 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
236
237         Unreviewed, rolling out r221854.
238
239         The test added with this change fails on 32-bit JSC bots.
240
241         Reverted changeset:
242
243         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
244         https://bugs.webkit.org/show_bug.cgi?id=176010
245         http://trac.webkit.org/changeset/221854
246
247 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
248
249         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
250         https://bugs.webkit.org/show_bug.cgi?id=176010
251
252         Reviewed by Filip Pizlo.
253
254         * microbenchmarks/weak-map-key.js: Added.
255         (assert):
256         (objectKey):
257         (let.start.Date.now):
258
259 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
260
261         [JSC] Optimize Object.keys by using careful array allocation
262         https://bugs.webkit.org/show_bug.cgi?id=176654
263
264         Reviewed by Darin Adler.
265
266         * microbenchmarks/object-keys.js: Added.
267         (test):
268
269 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
270
271         Error should compute .stack and friends lazily
272         https://bugs.webkit.org/show_bug.cgi?id=176645
273
274         Reviewed by Saam Barati.
275
276         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
277         * microbenchmarks/new-error.js: Added.
278         * microbenchmarks/throw.js: Added.
279
280 2017-09-09  Mark Lam  <mark.lam@apple.com>
281
282         [Re-landing] Use JIT probes for DFG OSR exit.
283         https://bugs.webkit.org/show_bug.cgi?id=175144
284         <rdar://problem/33437050>
285
286         Not reviewed.  Original patch reviewed by Saam Barati.
287
288         Disable these tests for debug builds because they run too slow with the new OSR exit.
289
290         * stress/op_mod-ConstVar.js:
291         * stress/op_mod-VarConst.js:
292         * stress/op_mod-VarVar.js:
293
294 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
295
296         [DFG] NewArrayWithSize(size)'s size does not care negative zero
297         https://bugs.webkit.org/show_bug.cgi?id=176300
298
299         Reviewed by Saam Barati.
300
301         * stress/new-array-with-size-div.js: Added.
302         (shouldBe):
303         (test):
304         (i.i):
305
306 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
307
308         [DFG] PutByVal with Array::Generic is too generic
309         https://bugs.webkit.org/show_bug.cgi?id=176345
310
311         Reviewed by Filip Pizlo.
312
313         * stress/object-assign-symbols.js: Added.
314         (shouldBe):
315         (test):
316         * stress/object-assign.js: Added.
317         (shouldBe):
318         (test):
319         (i.shouldBe.JSON.stringify.test):
320
321 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
322
323         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
324         https://bugs.webkit.org/show_bug.cgi?id=176590
325
326         Reviewed by Saam Barati.
327
328         * microbenchmarks/object-iterate-symbols.js: Added.
329         (test):
330         * microbenchmarks/object-iterate.js: Added.
331         (test):
332         * stress/object-iterate-symbols.js: Added.
333         (shouldBe):
334         (test):
335         * stress/object-iterate.js: Added.
336         (shouldBe):
337         (test):
338
339 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
340
341         [Win32] 10 JSC stress tests are failing.
342         https://bugs.webkit.org/show_bug.cgi?id=176538
343
344         Reviewed by Mark Lam.
345
346         Skip tests on Windows to make the bots green.
347
348         * ChakraCore.yaml:
349         * stress/date-relaxed.js:
350
351 2017-09-06  Mark Lam  <mark.lam@apple.com>
352
353         constructGenericTypedArrayViewWithArguments() is missing an exception check.
354         https://bugs.webkit.org/show_bug.cgi?id=176485
355         <rdar://problem/33898874>
356
357         Reviewed by Keith Miller.
358
359         * stress/regress-176485.js: Added.
360
361 2017-09-05  Saam Barati  <sbarati@apple.com>
362
363         isNotCellSpeculation is wrong with respect to SpecEmpty
364         https://bugs.webkit.org/show_bug.cgi?id=176429
365
366         Reviewed by Michael Saboff.
367
368         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
369         (Foo):
370
371 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
372
373         test262: Completion values for control flow do not match the spec
374         https://bugs.webkit.org/show_bug.cgi?id=171265
375
376         Reviewed by Saam Barati.
377
378         * stress/completion-value.js:
379         Condensed test for completion values in top level statements.
380
381         * stress/super-get-by-id.js:
382         ClassDeclaration when evaled no longer produce values. Convert
383         these to ClassExpressions so they produce the class value.
384         
385         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
386         This is a progression for currect spec behavior.
387
388         * mozilla/mozilla-tests.yaml:
389         This test is now outdated, so mark it as failing for that reason.
390
391         * test262.yaml:
392         Passing all "cptn" completion value tests.
393
394 2017-09-04  Saam Barati  <sbarati@apple.com>
395
396         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
397         https://bugs.webkit.org/show_bug.cgi?id=176317
398
399         Reviewed by Keith Miller.
400
401         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
402         (Foo):
403
404 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
405
406         [DFG][FTL] Efficiently execute number#toString()
407         https://bugs.webkit.org/show_bug.cgi?id=170007
408
409         Reviewed by Keith Miller.
410
411         * microbenchmarks/number-to-string-strength-reduction.js: Added.
412         (test):
413         * microbenchmarks/number-to-string-with-radix-10.js: Added.
414         (test):
415         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
416         (test):
417         * microbenchmarks/number-to-string-with-radix.js: Added.
418         (test):
419         * stress/number-to-string-strength-reduction.js: Added.
420         (shouldBe):
421         (test):
422         * stress/number-to-string-with-radix-10.js: Added.
423         (shouldBe):
424         (test):
425         * stress/number-to-string-with-radix-cse.js: Added.
426         (shouldBe):
427         (test):
428         * stress/number-to-string-with-radix-invalid.js: Added.
429         (shouldThrow):
430         * stress/number-to-string-with-radix-watchpoint.js: Added.
431         (shouldBe):
432         (test):
433         (i.i.1e3.Number.prototype.toString):
434         * stress/number-to-string-with-radix.js: Added.
435         (shouldBe):
436         (test):
437
438 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
439
440         [DFG] Relax arity requirement
441         https://bugs.webkit.org/show_bug.cgi?id=175523
442
443         Reviewed by Saam Barati.
444
445         * stress/arity-mismatch-arguments-length.js: Added.
446         (shouldBe):
447         (test1):
448         (test):
449         * stress/arity-mismatch-get-argument.js: Added.
450         (shouldBe):
451         (builtin.createBuiltin):
452         (test):
453         * stress/arity-mismatch-inlining-extra-slots.js: Added.
454         (shouldBe):
455         (inlineTarget):
456         (test):
457         * stress/arity-mismatch-inlining.js: Added.
458         (shouldBe):
459         (inlineTarget):
460         (test):
461         * stress/arity-mismatch-rest.js: Added.
462         (shouldBe):
463         (test2):
464         (test1):
465         (test):
466
467 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
468
469         [JSC] Fix "name" and "length" of Proxy revoke function
470         https://bugs.webkit.org/show_bug.cgi?id=176155
471
472         Reviewed by Mark Lam.
473
474         * test262.yaml:
475
476 2017-08-31  Saam Barati  <sbarati@apple.com>
477
478         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
479         https://bugs.webkit.org/show_bug.cgi?id=176206
480
481         Reviewed by Keith Miller.
482
483         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
484         (a):
485         (b):
486         (foo):
487
488 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
489
490         Skip two slow JSC tests after r221422.
491
492         Unreviewed test gardening.
493
494         * stress/regexp-prototype-match-on-too-long-rope.js:
495         * stress/regexp-prototype-test-on-too-long-rope.js:
496
497 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
498
499         Unreviewed, skipping slow tests.
500         
501         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
502         work differently now.
503
504         * stress/regexp-prototype-exec-on-too-long-rope.js:
505         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
506
507 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
508
509         [JSC] Use reifying system for "name" property of builtin JSFunction
510         https://bugs.webkit.org/show_bug.cgi?id=175260
511
512         Reviewed by Saam Barati.
513
514         * stress/accessors-get-set-prefix.js:
515         * stress/builtin-function-name.js: Added.
516         (shouldBe):
517         (shouldThrow):
518         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
519         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
520         * stress/private-name-as-anonymous-builtin.js: Added.
521         (shouldBe):
522         (NotPromise):
523
524 2017-08-30  Saam Barati  <sbarati@apple.com>
525
526         Unreviewed. Make test stop printing.
527
528         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
529
530 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
531
532         Unreviewed, rolling out r221327.
533
534         This change caused test262 failures.
535
536         Reverted changeset:
537
538         "[JSC] Use reifying system for "name" property of builtin
539         JSFunction"
540         https://bugs.webkit.org/show_bug.cgi?id=175260
541         http://trac.webkit.org/changeset/221327
542
543 2017-08-30  Saam Barati  <sbarati@apple.com>
544
545         semicolon is being interpreted as an = in the LiteralParser
546         https://bugs.webkit.org/show_bug.cgi?id=176114
547
548         Reviewed by Oliver Hunt.
549
550         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
551         * stress/resources/literal-parser-test-case.js: Added.
552
553 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
554
555         [ESNext] Async iteration - Implement async iteration statement: for-await-of
556         https://bugs.webkit.org/show_bug.cgi?id=166698
557
558         Reviewed by Yusuke Suzuki.
559
560         * stress/async-iteration-for-await-of-syntax.js: Added.
561         (assert):
562         (checkSyntax):
563         (checkSyntaxError):
564         (checkSimpleAsyncGeneratorSloppyMode):
565         (checkSimpleAsyncGeneratorStrictMode):
566         (checkNestedAsyncGenerators):
567         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
568         * stress/async-iteration-for-await-of.js: Added.
569         (assert):
570         (async.foo):
571         (async.boo):
572         (const.boo.async):
573
574 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
575
576         [JSC] Use reifying system for "name" property of builtin JSFunction
577         https://bugs.webkit.org/show_bug.cgi?id=175260
578
579         Reviewed by Saam Barati.
580
581         * stress/accessors-get-set-prefix.js:
582         * stress/builtin-function-name.js: Added.
583         (shouldBe):
584         (shouldThrow):
585         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
586         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
587
588 2017-08-25  Saam Barati  <sbarati@apple.com>
589
590         Support compiling catch in the DFG
591         https://bugs.webkit.org/show_bug.cgi?id=174590
592         <rdar://problem/34047845>
593
594         Reviewed by Filip Pizlo.
595
596         * microbenchmarks/delta-blue-try-catch.js: Added.
597         (exception):
598         (value):
599         (OrderedCollection):
600         (OrderedCollection.prototype.add):
601         (OrderedCollection.prototype.at):
602         (OrderedCollection.prototype.size):
603         (OrderedCollection.prototype.removeFirst):
604         (OrderedCollection.prototype.remove):
605         (Strength):
606         (Strength.stronger):
607         (Strength.weaker):
608         (Strength.weakestOf):
609         (Strength.strongest):
610         (Strength.prototype.nextWeaker):
611         (Constraint):
612         (Constraint.prototype.addConstraint):
613         (Constraint.prototype.satisfy):
614         (Constraint.prototype.destroyConstraint):
615         (Constraint.prototype.isInput):
616         (UnaryConstraint):
617         (UnaryConstraint.prototype.addToGraph):
618         (UnaryConstraint.prototype.chooseMethod):
619         (UnaryConstraint.prototype.isSatisfied):
620         (UnaryConstraint.prototype.markInputs):
621         (UnaryConstraint.prototype.output):
622         (UnaryConstraint.prototype.recalculate):
623         (UnaryConstraint.prototype.markUnsatisfied):
624         (UnaryConstraint.prototype.inputsKnown):
625         (UnaryConstraint.prototype.removeFromGraph):
626         (StayConstraint):
627         (StayConstraint.prototype.execute):
628         (EditConstraint.prototype.isInput):
629         (EditConstraint.prototype.execute):
630         (BinaryConstraint):
631         (BinaryConstraint.prototype.chooseMethod):
632         (BinaryConstraint.prototype.addToGraph):
633         (BinaryConstraint.prototype.isSatisfied):
634         (BinaryConstraint.prototype.markInputs):
635         (BinaryConstraint.prototype.input):
636         (BinaryConstraint.prototype.output):
637         (BinaryConstraint.prototype.recalculate):
638         (BinaryConstraint.prototype.markUnsatisfied):
639         (BinaryConstraint.prototype.inputsKnown):
640         (BinaryConstraint.prototype.removeFromGraph):
641         (ScaleConstraint):
642         (ScaleConstraint.prototype.addToGraph):
643         (ScaleConstraint.prototype.removeFromGraph):
644         (ScaleConstraint.prototype.markInputs):
645         (ScaleConstraint.prototype.execute):
646         (ScaleConstraint.prototype.recalculate):
647         (EqualityConstraint):
648         (EqualityConstraint.prototype.execute):
649         (Variable):
650         (Variable.prototype.addConstraint):
651         (Variable.prototype.removeConstraint):
652         (Planner):
653         (Planner.prototype.incrementalAdd):
654         (Planner.prototype.incrementalRemove):
655         (Planner.prototype.newMark):
656         (Planner.prototype.makePlan):
657         (Planner.prototype.extractPlanFromConstraints):
658         (Planner.prototype.addPropagate):
659         (Planner.prototype.removePropagateFrom):
660         (Planner.prototype.addConstraintsConsumingTo):
661         (Plan):
662         (Plan.prototype.addConstraint):
663         (Plan.prototype.size):
664         (Plan.prototype.constraintAt):
665         (Plan.prototype.execute):
666         (chainTest):
667         (projectionTest):
668         (change):
669         (deltaBlue):
670         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
671         (assert):
672         (Numbers):
673         (Numbers.prototype.next):
674         (return.Transpose):
675         (return.Transpose.prototype.next):
676         (transpose):
677         (verifyEven):
678         (verifyString):
679         (foo):
680         (runIterators):
681         * microbenchmarks/try-catch-word-count.js: Added.
682         (let.assert):
683         (EOF):
684         (let.texts):
685         (let.o.apply):
686         (foo):
687         (bar):
688         (f):
689         (run):
690         (test1):
691         (test2):
692         (test3):
693         (fn):
694         (A):
695         (B):
696         (A.prototype.getValue):
697         (B.prototype.getParentValue):
698         (strlen):
699         (sum.0):
700         (test):
701         (result.test.o):
702         (set add.set add):
703         (set forEach):
704         (stringHash):
705         (set if):
706         (testFunction):
707         (set delete.set has.set add):
708         * stress/catch-set-argument-speculation-failure.js: Added.
709         (o):
710         (e):
711         (e2):
712         (escape):
713         (baz):
714         (noInline.run):
715         (noInline):
716         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
717         (foo):
718         (e):
719         (baz):
720         (bar):
721
722 2017-08-24  Commit Queue  <commit-queue@webkit.org>
723
724         Unreviewed, rolling out r221119, r221124, and r221143.
725         https://bugs.webkit.org/show_bug.cgi?id=175973
726
727         "I think it regressed JSBench by 20%" (Requested by saamyjoon
728         on #webkit).
729
730         Reverted changesets:
731
732         "Support compiling catch in the DFG"
733         https://bugs.webkit.org/show_bug.cgi?id=174590
734         http://trac.webkit.org/changeset/221119
735
736         "Unreviewed, build fix in GTK port"
737         https://bugs.webkit.org/show_bug.cgi?id=174590
738         http://trac.webkit.org/changeset/221124
739
740         "DFG::JITCode::osrEntry should get sorted since we perform a
741         binary search on it"
742         https://bugs.webkit.org/show_bug.cgi?id=175893
743         http://trac.webkit.org/changeset/221143
744
745 2017-08-24  Michael Saboff  <msaboff@apple.com>
746
747         Add support for RegExp "dotAll" flag
748         https://bugs.webkit.org/show_bug.cgi?id=175924
749
750         Reviewed by Keith Miller.
751
752         Updated tests for new dotAll ('s' flag) changes.
753
754         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
755         * stress/static-getter-in-names.js:
756
757 2017-08-24  Mark Lam  <mark.lam@apple.com>
758
759         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
760         https://bugs.webkit.org/show_bug.cgi?id=175940
761         <rdar://problem/29003921>
762
763         Reviewed by Saam Barati.
764
765         * stress/regress-164081.js: Added.
766         (shouldEqual):
767         (testcase):
768
769 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
770
771         Skip flaky JSC test stress/test-finally.js.
772         https://bugs.webkit.org/show_bug.cgi?id=160283
773
774         Unreviewed test gardening.
775
776         * stress/test-finally.js:
777
778 2017-08-23  Saam Barati  <sbarati@apple.com>
779
780         Support compiling catch in the DFG
781         https://bugs.webkit.org/show_bug.cgi?id=174590
782
783         Reviewed by Filip Pizlo.
784
785         * microbenchmarks/delta-blue-try-catch.js: Added.
786         (exception):
787         (value):
788         (OrderedCollection):
789         (OrderedCollection.prototype.add):
790         (OrderedCollection.prototype.at):
791         (OrderedCollection.prototype.size):
792         (OrderedCollection.prototype.removeFirst):
793         (OrderedCollection.prototype.remove):
794         (Strength):
795         (Strength.stronger):
796         (Strength.weaker):
797         (Strength.weakestOf):
798         (Strength.strongest):
799         (Strength.prototype.nextWeaker):
800         (Constraint):
801         (Constraint.prototype.addConstraint):
802         (Constraint.prototype.satisfy):
803         (Constraint.prototype.destroyConstraint):
804         (Constraint.prototype.isInput):
805         (UnaryConstraint):
806         (UnaryConstraint.prototype.addToGraph):
807         (UnaryConstraint.prototype.chooseMethod):
808         (UnaryConstraint.prototype.isSatisfied):
809         (UnaryConstraint.prototype.markInputs):
810         (UnaryConstraint.prototype.output):
811         (UnaryConstraint.prototype.recalculate):
812         (UnaryConstraint.prototype.markUnsatisfied):
813         (UnaryConstraint.prototype.inputsKnown):
814         (UnaryConstraint.prototype.removeFromGraph):
815         (StayConstraint):
816         (StayConstraint.prototype.execute):
817         (EditConstraint.prototype.isInput):
818         (EditConstraint.prototype.execute):
819         (BinaryConstraint):
820         (BinaryConstraint.prototype.chooseMethod):
821         (BinaryConstraint.prototype.addToGraph):
822         (BinaryConstraint.prototype.isSatisfied):
823         (BinaryConstraint.prototype.markInputs):
824         (BinaryConstraint.prototype.input):
825         (BinaryConstraint.prototype.output):
826         (BinaryConstraint.prototype.recalculate):
827         (BinaryConstraint.prototype.markUnsatisfied):
828         (BinaryConstraint.prototype.inputsKnown):
829         (BinaryConstraint.prototype.removeFromGraph):
830         (ScaleConstraint):
831         (ScaleConstraint.prototype.addToGraph):
832         (ScaleConstraint.prototype.removeFromGraph):
833         (ScaleConstraint.prototype.markInputs):
834         (ScaleConstraint.prototype.execute):
835         (ScaleConstraint.prototype.recalculate):
836         (EqualityConstraint):
837         (EqualityConstraint.prototype.execute):
838         (Variable):
839         (Variable.prototype.addConstraint):
840         (Variable.prototype.removeConstraint):
841         (Planner):
842         (Planner.prototype.incrementalAdd):
843         (Planner.prototype.incrementalRemove):
844         (Planner.prototype.newMark):
845         (Planner.prototype.makePlan):
846         (Planner.prototype.extractPlanFromConstraints):
847         (Planner.prototype.addPropagate):
848         (Planner.prototype.removePropagateFrom):
849         (Planner.prototype.addConstraintsConsumingTo):
850         (Plan):
851         (Plan.prototype.addConstraint):
852         (Plan.prototype.size):
853         (Plan.prototype.constraintAt):
854         (Plan.prototype.execute):
855         (chainTest):
856         (projectionTest):
857         (change):
858         (deltaBlue):
859         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
860         (assert):
861         (Numbers):
862         (Numbers.prototype.next):
863         (return.Transpose):
864         (return.Transpose.prototype.next):
865         (transpose):
866         (verifyEven):
867         (verifyString):
868         (foo):
869         (runIterators):
870         * microbenchmarks/try-catch-word-count.js: Added.
871         (let.assert):
872         (EOF):
873         (let.texts):
874         (let.o.apply):
875         (foo):
876         (bar):
877         (f):
878         (run):
879         (test1):
880         (test2):
881         (test3):
882         (fn):
883         (A):
884         (B):
885         (A.prototype.getValue):
886         (B.prototype.getParentValue):
887         (strlen):
888         (sum.0):
889         (test):
890         (result.test.o):
891         (set add.set add):
892         (set forEach):
893         (stringHash):
894         (set if):
895         (testFunction):
896         (set delete.set has.set add):
897         * stress/catch-set-argument-speculation-failure.js: Added.
898         (o):
899         (e):
900         (e2):
901         (escape):
902         (baz):
903         (noInline.run):
904         (noInline):
905         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
906         (foo):
907         (e):
908         (baz):
909         (bar):
910
911 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
912
913         [JSC] Optimize Map iteration with intrinsic
914         https://bugs.webkit.org/show_bug.cgi?id=174355
915
916         Reviewed by Saam Barati.
917
918         * stress/map-iterator-result-should-have-expected-shape.js: Added.
919         (shouldBe):
920         (throw.new.Error):
921         * stress/set-iterator-result-should-have-expected-shape.js: Added.
922         (shouldBe):
923         (throw.new.Error.let.iterator.set Symbol):
924         (throw.new.Error.set add):
925         (let.iterator.set Symbol):
926
927 2017-08-23  Robin Morisset  <rmorisset@apple.com>
928
929         Add a micro-benchmark for checking that accessing a variable within a 'with'
930         block does not automatically prevent type prediction.
931         https://bugs.webkit.org/show_bug.cgi?id=175738
932
933         Reviewed by Saam Barati.
934
935         * stress/with_and_arith.js: Added.
936         (with):
937
938 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
939
940         [ESNext] Async iteration - Implement Async Generator - runtime
941         https://bugs.webkit.org/show_bug.cgi?id=175240
942
943         Reviewed by Yusuke Suzuki.
944
945         * stress/async-iteration-async-from-sync.js: Added.
946         (assert):
947         (const.Logger):
948         (this.fullfilled):
949         (this.fullfilledDone):
950         (this.rejected):
951         (this.catched):
952         (this.isFinal):
953         (_assertLogger):
954         (const.assertLogger):
955         (const.getPromise.promiseHolder.return.new.Promise):
956         (foo):
957         (async.boo):
958         (bar):
959         (async.baz):
960         (async.goo):
961         * stress/async-iteration-basic.js: Added.
962         (assert):
963         (const.Logger):
964         (this.fullfilled):
965         (this.fullfilledDone):
966         (this.rejected):
967         (this.catched):
968         (this.isFinal):
969         (_assertLogger):
970         (const.assertLogger):
971         (const.getPromise.promiseHolder.return.new.Promise):
972         (async.generator):
973         (iterator.next.then):
974         (async.baz):
975         (async.boo):
976         (async.foo):
977         (async.goo):
978         (A.prototype.async.foo):
979         (A.prototype.async.boo):
980         (A):
981         (asyncGenExp.async):
982         (async.joo):
983         (j.next.then):
984         (then):
985         (async.koo):
986         (async.loo):
987         (async.moo):
988         (async.noo):
989         (async.ooo):
990         (async.roo):
991         (async.poo):
992         (async.soo):
993         (async.too):
994         * stress/async-iteration-evaluation.js: Added.
995         (assert):
996         (async.foo):
997         (catch):
998         * stress/async-iteration-syntax.js:
999         * stress/async-iteration-yield-promise.js: Added.
1000         (assert):
1001         (const.Logger):
1002         (this.fullfilled):
1003         (this.fullfilledDone):
1004         (this.rejected):
1005         (this.catched):
1006         (this.isFinal):
1007         (_assertLogger):
1008         (const.assertLogger):
1009         (const.getPromise.promiseHolder.return.new.Promise):
1010         (async.foo):
1011         (async.boo):
1012         (async.bar):
1013         * stress/async-iteration-yield-star-interface.js: Added.
1014         (assert):
1015         (const.getPromise.promiseHolder.return.new.Promise):
1016         (const.Logger):
1017         (this.fullfilled):
1018         (this.fullfilledDone):
1019         (this.rejected):
1020         (this.catched):
1021         (this.custom):
1022         (this.isFinal):
1023         (_assertLogger):
1024         (const.assertLogger):
1025         (let.asyncIter.Symbol.asyncIterator):
1026         (let.asyncIter.next):
1027         (let.asyncIter.throw):
1028         (let.asyncIter.return):
1029         (async.foo):
1030         (asyncIter.Symbol.asyncIterator):
1031         (asyncIter.next):
1032         (async.boo):
1033         (asyncIter.return):
1034         (async.bar):
1035         (async.baz):
1036         (async.foobar):
1037         * stress/async-iteration-yield-star.js: Added.
1038         (assert):
1039         (const.Logger):
1040         (this.fullfilled):
1041         (this.fullfilledDone):
1042         (this.rejected):
1043         (this.catched):
1044         (this.custom):
1045         (this.isFinal):
1046         (_assertLogger):
1047         (const.assertLogger):
1048         (const.getPromise.promiseHolder.return.new.Promise):
1049         (async.foo):
1050         (async.boo):
1051         (async.bar):
1052         (async.baz):
1053         (async.joo):
1054         (async.goo):
1055         (async.koo):
1056         (async.loo):
1057         (let.asyncIter.Symbol.asyncIterator):
1058         (let.asyncIter.next):
1059         (let.asyncIter.throw):
1060         (let.asyncIter.return):
1061         (async.moo):
1062         (async.noo):
1063         * test262.yaml:
1064
1065 2017-08-23  JF Bastien  <jfbastien@apple.com>
1066
1067         Fix printing in test
1068
1069         Unreviewed: fixing verbosity, shouldn't have been there.
1070
1071         * wasm/regress/175693.js:
1072         (else.else):
1073         (catch):
1074
1075 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
1076
1077         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
1078         https://bugs.webkit.org/show_bug.cgi?id=172543
1079
1080         Unreviewed test gardening.
1081
1082         * microbenchmarks/generator-with-several-types.js:
1083
1084 2017-08-17  JF Bastien  <jfbastien@apple.com>
1085
1086         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
1087         https://bugs.webkit.org/show_bug.cgi?id=175693
1088         <rdar://problem/33952443>
1089
1090         Reviewed by Saam Barati.
1091
1092         Add a regression directory for WebAssembly tests.
1093
1094         * wasm.yaml:
1095         * wasm/regress/175693.js: Added.
1096         (else.else):
1097         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
1098         (catch):
1099         * wasm/regress/175693.wasm: Added.
1100
1101 2017-08-15  Robin Morisset  <rmorisset@apple.com>
1102
1103         Support the 'with' keyword in FTL.
1104         https://bugs.webkit.org/show_bug.cgi?id=175585
1105
1106         Reviewed by Saam Barati.
1107
1108         Also improve the JSTest/stress/with.js file to test
1109         what happens when non-objects are passed to with.
1110
1111         * stress/with.js:
1112         (foo):
1113         (i.catch):
1114         (i.with): Deleted.
1115
1116 2017-08-14  Keith Miller  <keith_miller@apple.com>
1117
1118         Add testing tool to lie to the DFG about profiles
1119         https://bugs.webkit.org/show_bug.cgi?id=175487
1120
1121         Reviewed by Saam Barati.
1122
1123         * stress/compare-eq-incomplete-profile.js: Added.
1124         (const.test.createBuiltin):
1125
1126 2017-08-14  Robin Morisset  <rmorisset@apple.com>
1127
1128         Support the with keyword in DFG
1129         https://bugs.webkit.org/show_bug.cgi?id=175470
1130
1131         Reviewed by Saam Barati.
1132
1133         Added a new stress-test for the 'with' keyword, that caught a bug in a
1134         previous version of this code.
1135
1136         * stress/with.js: Added.
1137         (i.with):
1138
1139 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
1140
1141         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
1142         https://bugs.webkit.org/show_bug.cgi?id=175544
1143
1144         Unreviewed test gardening.
1145
1146         * ChakraCore.yaml:
1147
1148 2017-08-09  Caitlin Potter  <caitp@igalia.com>
1149
1150         Early error on ANY operator before new.target
1151         https://bugs.webkit.org/show_bug.cgi?id=157970
1152
1153         Reviewed by Saam Barati.
1154
1155         Instead of throwing if any unary operator precedes new.target, only
1156         throw if the unary operator updates the reference.
1157
1158         The following become legal in JSC:
1159
1160         ```
1161         !new.target
1162         ~new.target
1163         typeof new.target
1164         delete new.target
1165         void new.target
1166         ```
1167
1168         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
1169
1170         * stress/new-target-syntax-errors.js:
1171         * stress/new-target.js:
1172
1173 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
1174
1175         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
1176         https://bugs.webkit.org/show_bug.cgi?id=175255
1177
1178         Unreviewed test gardening.
1179
1180         * stress/regress-169783.js:
1181         * wasm/stress/oom.js:
1182
1183 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1184
1185         REGRESSION: 2 test262/test/language/statements/async-function failures
1186         https://bugs.webkit.org/show_bug.cgi?id=175334
1187
1188         Reviewed by Yusuke Suzuki.
1189
1190         Add @skip parameters to tests, and remove test for async iterator from 
1191         async await syntax test because it is already covered by async-iterator-syntax.js
1192
1193         * stress/async-await-syntax.js:
1194         * stress/async-iteration-syntax.js:
1195
1196 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1197
1198         Unreviewed, gardening test262 for Promise resolve / reject function length
1199         https://bugs.webkit.org/show_bug.cgi?id=175333
1200
1201         * test262.yaml:
1202
1203 2017-08-07  Robin Morisset  <rmorisset@apple.com>
1204
1205         GetOwnProperty of TypedArray indexed fields is wrongly configurable
1206         https://bugs.webkit.org/show_bug.cgi?id=175307
1207
1208         Reviewed by Saam Barati.
1209
1210         * stress/typedarray-getownproperty-not-configurable.js: Added.
1211         (assert):
1212         (foo):
1213
1214 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
1215
1216         Promise resolve and reject function should have length = 1
1217         https://bugs.webkit.org/show_bug.cgi?id=175242
1218
1219         Reviewed by Saam Barati.
1220
1221         * stress/builtin-function-length.js: Added.
1222         (shouldBe):
1223         (shouldThrow):
1224         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
1225         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
1226
1227 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
1228
1229         [ESNext] Async iteration - Implement Async Generator - parser
1230         https://bugs.webkit.org/show_bug.cgi?id=175210
1231
1232         Reviewed by Yusuke Suzuki.
1233
1234         * stress/async-await-syntax.js:
1235         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1236         * stress/async-iteration-syntax.js: Added.
1237         (assert):
1238         (checkSyntax):
1239         (checkSyntaxError):
1240         (checkSimpleAsyncGeneratorSloppyMode):
1241         (checkSimpleAsyncGeneratorStrictMode):
1242         (checkNestedAsyncGenerators):
1243         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
1244         * stress/generator-class-methods-syntax.js:
1245
1246 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
1247
1248         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
1249         https://bugs.webkit.org/show_bug.cgi?id=175150
1250
1251         Unreviewed test gardening.
1252
1253         * wasm/js-api/test_memory_constructor.js:
1254
1255 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
1256
1257         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
1258         https://bugs.webkit.org/show_bug.cgi?id=175100
1259
1260         Reviewed by Mark Lam.
1261
1262         The JSC test JSTests/wasm/stress/oom.js tries to use all the
1263         available memory until an out of memory exception happens.
1264
1265         The Linux kernel is more tuned for server workloads than for GUI
1266         responsiveness. When a process tries to use a lot of memory, Linux
1267         will do its best to serve the request. This usually translates to
1268         free physical RAM by writing to disk dirty pages and/or moving out
1269         less recently used pages to swap (disk storage).
1270         Meanwhile it does this, the system will become unresponsive and this
1271         leads to freezes that can last even some minutes on the worst cases.
1272
1273         Therefore, let's skip this test on Linux as it will cause more harm
1274         than good on the Linux bots or on the machines of Linux developers.
1275
1276         * wasm/stress/oom.js:
1277
1278 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
1279
1280         [JSC] Remove unnecessary print from stress\promise-finally.js test
1281         https://bugs.webkit.org/show_bug.cgi?id=175015
1282
1283         Reviewed by Yusuke Suzuki.
1284
1285         * stress/promise-finally.js:
1286         (p.finally):
1287         (then):
1288
1289 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1290
1291         Unreviewed, update test262 results for optional catch binding
1292
1293         * test262.yaml:
1294
1295 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1296
1297         [JSC] Support optional catch binding
1298         https://bugs.webkit.org/show_bug.cgi?id=174981
1299
1300         Reviewed by Saam Barati.
1301
1302         * stress/optional-catch-binding-syntax.js: Added.
1303         (testSyntax):
1304         (testSyntaxError):
1305         (catch.catch):
1306         * stress/optional-catch-binding.js: Added.
1307         (shouldBe):
1308         (throwException):
1309
1310 2017-07-28  Mark Lam  <mark.lam@apple.com>
1311
1312         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
1313         https://bugs.webkit.org/show_bug.cgi?id=174948
1314         <rdar://problem/33495680>
1315
1316         Reviewed by Filip Pizlo.
1317
1318         * stress/regress-174948.js: Added.
1319
1320 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
1321
1322         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
1323         https://bugs.webkit.org/show_bug.cgi?id=174900
1324
1325         Reviewed by Saam Barati.
1326
1327         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
1328         (sideEffect):
1329         (args):
1330         (test):
1331
1332 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1333
1334         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
1335         https://bugs.webkit.org/show_bug.cgi?id=171637
1336
1337         Reviewed by Darin Adler.
1338
1339         * stress/domjit-getter-complex-with-incorrect-object.js:
1340         (i.shouldThrow):
1341         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
1342         (shouldBe):
1343         (i.shouldThrow):
1344
1345 2017-07-26  JF Bastien  <jfbastien@apple.com>
1346
1347         WebAssembly: test throwing out of the start function
1348         https://bugs.webkit.org/show_bug.cgi?id=165714
1349         <rdar://problem/29760251>
1350
1351         Reviewed by Keith Miller.
1352
1353         * wasm/assert.js:
1354         * wasm/function-tests/trap-from-start.js: Added.
1355         (StartTraps):
1356         * wasm/function-tests/trap-from-start-async.js: Added.
1357         (async.StartTrapsAsync):
1358
1359 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1360
1361         [FTL] Arguments elimination is suppressed by unreachable blocks
1362         https://bugs.webkit.org/show_bug.cgi?id=174352
1363
1364         Reviewed by Filip Pizlo.
1365
1366         * stress/arguments-elimination-force-exit.js: Added.
1367         (shouldBe):
1368         (strict):
1369         (sloppy):
1370         * stress/arguments-elimination-throw.js: Added.
1371         (shouldBe):
1372         (shouldThrow):
1373         (sloppy):
1374         (isArguments):
1375
1376 2017-07-13  Mark Lam  <mark.lam@apple.com>
1377
1378         Add some additional test cases for bug 170896.
1379         https://bugs.webkit.org/show_bug.cgi?id=174491
1380
1381         Reviewed by Filip Pizlo.
1382
1383         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
1384         * stress/regress-170896-with-double-shape-profile.js: Added.
1385         (test):
1386         * stress/regress-170896-with-int32-shape-profile.js: Added.
1387         (test):
1388         * stress/regress-170896.js: Removed.
1389
1390 2017-07-13  Saam Barati  <sbarati@apple.com>
1391
1392         Missing exception check in JSObject::hasInstance
1393         https://bugs.webkit.org/show_bug.cgi?id=174455
1394         <rdar://problem/31384608>
1395
1396         Reviewed by Mark Lam.
1397
1398         * stress/has-instance-exception-check.js: Added.
1399         (assert):
1400         (let.getter.Object.getOwnPropertyDescriptor.get foo):
1401
1402 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
1403
1404         [ESnext] Implement Object Spread
1405         https://bugs.webkit.org/show_bug.cgi?id=167963
1406
1407         Reviewed by Saam Barati.
1408
1409         * stress/obj-rest-destructuring-order.js: Added.
1410         (assert):
1411         (o.get z):
1412         (o.get a):
1413         * stress/obj-spread-order.js: Added.
1414         (assert):
1415         (o.get z):
1416         (o.get a):
1417         * stress/object-spread.js: Added.
1418         (let.assert):
1419         (assert.sameValue):
1420         (let.o.get a):
1421         (let.obj.get c):
1422         (cthulhu.get x):
1423         (let.obj.set c):
1424         (calls.o.get z):
1425         (calls.o.get a):
1426         (try.let.obj.get foo):
1427         (get calls):
1428
1429 2017-07-12  Saam Barati  <sbarati@apple.com>
1430
1431         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
1432         https://bugs.webkit.org/show_bug.cgi?id=174411
1433         <rdar://problem/31696186>
1434
1435         Reviewed by Mark Lam.
1436
1437         * stress/generic-arguments-correct-delete-behavior.js: Added.
1438         (assert):
1439         (makeTest):
1440
1441 2017-07-07  Mark Lam  <mark.lam@apple.com>
1442
1443         \n\r is not the same as \r\n.
1444         https://bugs.webkit.org/show_bug.cgi?id=173053
1445
1446         Reviewed by Keith Miller.
1447
1448         * stress/regress-173053.js: Added.
1449         * stress/template-literal-line-terminators.js:
1450
1451 2017-07-06  Saam Barati  <sbarati@apple.com>
1452
1453         We are missing places where we invalidate the for-in context
1454         https://bugs.webkit.org/show_bug.cgi?id=174184
1455
1456         Reviewed by Geoffrey Garen.
1457
1458         * stress/for-in-invalidate-context-weird-assignments.js: Added.
1459         (assert):
1460         (test):
1461
1462 2017-07-05  Saam Barati  <sbarati@apple.com>
1463
1464         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
1465         https://bugs.webkit.org/show_bug.cgi?id=174188
1466         <rdar://problem/30581423>
1467
1468         Reviewed by Mark Lam.
1469
1470         * stress/new-array-having-a-bad-time-double.js: Added.
1471         (assert):
1472         (foo):
1473
1474 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1475
1476         WTF::StringImpl::copyChars segfaults when built with GCC 7
1477         https://bugs.webkit.org/show_bug.cgi?id=173407
1478
1479         Reviewed by Andreas Kling.
1480
1481         * stress/string-repeat-copy-chars-crash.js: Added.
1482         (shouldBe):
1483
1484 2017-07-03  Saam Barati  <sbarati@apple.com>
1485
1486         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
1487
1488         * stress/unshiftCountSlowCase-correct-postCapacity.js:
1489
1490 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1491
1492         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
1493
1494         It requires too much memory.
1495
1496         * stress/dont-reserve-huge-capacity-lexer.js:
1497
1498 2017-06-30  Michael Saboff  <msaboff@apple.com>
1499
1500         Skip a test on ARM64 platform since we run out of address space.
1501
1502         Rubber stamped by Saam Barati.
1503
1504         * stress/dont-reserve-huge-capacity-lexer.js:
1505
1506 2017-06-30  Michael Saboff  <msaboff@apple.com>
1507
1508         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
1509         https://bugs.webkit.org/show_bug.cgi?id=174044
1510
1511         Reviewed by Oliver Hunt.
1512
1513         New regression test.
1514
1515         * stress/regress-174044.js: Added.
1516         (test1):
1517         (test2):
1518
1519 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
1520
1521         RegExpCachedResult::setInput should reify left and right contexts
1522         https://bugs.webkit.org/show_bug.cgi?id=173818
1523
1524         Reviewed by Keith Miller.
1525
1526         * stress/right-left-context-invalidated-by-input.js: Added.
1527         (test.validateContexts):
1528         (test):
1529
1530 2017-06-29  Saam Barati  <sbarati@apple.com>
1531
1532         Calculating postCapacity in unshiftCountSlowCase is wrong
1533         https://bugs.webkit.org/show_bug.cgi?id=173992
1534         <rdar://problem/32283199>
1535
1536         Reviewed by Keith Miller.
1537
1538         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
1539         (temp):
1540
1541 2017-06-29  Commit Queue  <commit-queue@webkit.org>
1542
1543         Unreviewed, rolling out r218512.
1544         https://bugs.webkit.org/show_bug.cgi?id=173981
1545
1546         "It changes the behavior of the JS API's JSEvaluateScript
1547         which breaks TurboTax" (Requested by saamyjoon on #webkit).
1548
1549         Reverted changeset:
1550
1551         "test262: Completion values for control flow do not match the
1552         spec"
1553         https://bugs.webkit.org/show_bug.cgi?id=171265
1554         http://trac.webkit.org/changeset/218512
1555
1556 2017-06-27  JF Bastien  <jfbastien@apple.com>
1557
1558         WebAssembly: running out of executable memory should throw OoM
1559         https://bugs.webkit.org/show_bug.cgi?id=171537
1560         <rdar://problem/32963338>
1561
1562         Reviewed by Saam Barati.
1563
1564         * wasm.yaml:
1565         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
1566         (const.invoke):
1567         (failCount.0.catch):
1568         (failCount.0.module.undefined.catch):
1569         * wasm/lowExecutableMemory/exports-oom.js: Added.
1570         (const.type):
1571         (const.params):
1572         (const.randomProgram):
1573         (failCount.0.catch):
1574         (failCount.0.module.undefined.catch):
1575         * wasm/lowExecutableMemory/imports-oom.js: Added.
1576         (const.type):
1577         (const.params):
1578         (const.randomProgram):
1579         (f.imports.push):
1580         (failCount.0.catch):
1581         (failCount.0.module.undefined.catch):
1582
1583 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
1584
1585         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
1586         https://bugs.webkit.org/show_bug.cgi?id=167962
1587
1588         Reviewed by Saam Barati.
1589
1590         * stress/object-rest-deconstruct.js: Added.
1591         (let.assert):
1592         (let.assertPropDescriptor):
1593         (catch):
1594         (get 3):
1595         (foo):
1596         (let.src.get y):
1597         (let.src.set y):
1598         (let.gen):
1599
1600 2017-06-27  Saam Barati  <sbarati@apple.com>
1601
1602         Function constructor needs to follow the spec and validate parameters and body independently
1603         https://bugs.webkit.org/show_bug.cgi?id=173303
1604         <rdar://problem/32732526>
1605
1606         Reviewed by Keith Miller.
1607
1608         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1609         * stress/function-constructor-semantics.js: Added.
1610         (assert):
1611         (hasSyntaxError):
1612         (foo):
1613         (async.foo):
1614         (testError):
1615         (testOK.toString):
1616         (toString):
1617
1618 2017-06-26  Saam Barati  <sbarati@apple.com>
1619
1620         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
1621         https://bugs.webkit.org/show_bug.cgi?id=173740
1622
1623         Reviewed by Mark Lam.
1624
1625         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
1626         (Array.prototype.Symbol.iterator):
1627
1628 2017-06-26  Saam Barati  <sbarati@apple.com>
1629
1630         Skip a test on 32-bit platforms since we run out of address space.
1631
1632         Rubber stamped by Mark Lam.
1633
1634         * stress/dont-reserve-huge-capacity-lexer.js:
1635
1636 2017-06-26  Saam Barati  <sbarati@apple.com>
1637
1638         Crash in JSC::Lexer<unsigned char>::setCode
1639         https://bugs.webkit.org/show_bug.cgi?id=172754
1640
1641         Reviewed by Mark Lam.
1642
1643         * stress/dont-reserve-huge-capacity-lexer.js: Added.
1644         (catch):
1645
1646 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1647
1648         [JSC] Clean up Object.entries implementation
1649         https://bugs.webkit.org/show_bug.cgi?id=173759
1650
1651         Reviewed by Sam Weinig.
1652
1653         * microbenchmarks/object-entries.js: Added.
1654         (test):
1655
1656 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
1657
1658         Remove Reflect.enumerate
1659         https://bugs.webkit.org/show_bug.cgi?id=173806
1660
1661         Reviewed by Yusuke Suzuki.
1662
1663         * ChakraCore.yaml:
1664         * es6.yaml:
1665         These tests now fail because they use Reflect.enumerate.
1666
1667         * test262.yaml:
1668         This test now passes, it checked that Reflect.enumerate is undefined!
1669
1670         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
1671         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
1672
1673         * stress/reflect-enumerate.js: Removed.
1674         Remove a test solely for Reflect.enumerate.
1675
1676 2017-06-22  Saam Barati  <sbarati@apple.com>
1677
1678         ValueRep(DoubleRep(@v)) can not simply convert to @v
1679         https://bugs.webkit.org/show_bug.cgi?id=173687
1680         <rdar://problem/32855563>
1681
1682         Reviewed by Mark Lam.
1683
1684         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
1685         (i.catch):
1686
1687 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1688
1689         [JSC] Object.values should be implemented in C++
1690         https://bugs.webkit.org/show_bug.cgi?id=173703
1691
1692         Reviewed by Sam Weinig.
1693
1694         * microbenchmarks/object-keys-map-values.js: Added.
1695         (test):
1696         * microbenchmarks/object-values.js: Added.
1697         (test):
1698         * stress/object-values-changing-properties.js: Added.
1699         (shouldBe):
1700         (throw.new.Error.let.source.get x):
1701         (throw.new.Error):
1702         (shouldBe.let.handler.get order):
1703         (get let):
1704         (shouldBe.let.handler.get return):
1705         (let.handler.get order):
1706
1707 2017-06-21  Saam Barati  <sbarati@apple.com>
1708
1709         eval virtual call is incorrect in the baseline JIT
1710         https://bugs.webkit.org/show_bug.cgi?id=173587
1711         <rdar://problem/32867897>
1712
1713         Reviewed by Michael Saboff.
1714
1715         * stress/do-eval-virtual-call-correctly.js: Added.
1716         (assert):
1717         (f):
1718         (i.test):
1719         (catch):
1720
1721 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
1722
1723         Update test262 test expectations after r218581.
1724
1725         Unreviewed test gardening.
1726
1727         * test262.yaml:
1728
1729 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
1730
1731         Revert changes in bug#160417 about extending `null` not being a derived class
1732         https://bugs.webkit.org/show_bug.cgi?id=169293
1733
1734         Reviewed by Saam Barati.
1735
1736         * stress/class-derived-from-null.js:
1737         (assertThrow):
1738         (test1):
1739         (test2):
1740         (test3):
1741         (test4):
1742         (test5):
1743         (test6):
1744
1745 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1746
1747         [DFG] More ArrayIndexOf fixups for various types
1748         https://bugs.webkit.org/show_bug.cgi?id=173176
1749
1750         Reviewed by Saam Barati.
1751
1752         * stress/array-indexof-arraystorage.js: Added.
1753         (shouldBe):
1754         (indexOfInt32Other):
1755         (indexOfInt32Cell):
1756         (indexOfInt32Boolean):
1757         (indexOfDoubleOther):
1758         (indexOfDoubleCell):
1759         (indexOfDoubleBoolean):
1760         (indexOfInt32):
1761         (indexOfDouble):
1762         * stress/array-indexof-constant-folding.js: Added.
1763         (shouldBe):
1764         (indexOfInt32Other):
1765         (indexOfInt32Cell):
1766         (indexOfInt32Boolean):
1767         (indexOfDoubleOther):
1768         (indexOfDoubleCell):
1769         (indexOfDoubleBoolean):
1770         * stress/array-indexof-hole-and-other.js: Added.
1771         (shouldBe):
1772         (indexOf):
1773         * stress/array-indexof-other.js: Added.
1774         (shouldBe):
1775         (indexOfInt32):
1776         (indexOfDouble):
1777         (indexOfString):
1778         (indexOfObject):
1779         * stress/array-indexof-symbol.js: Added.
1780         (shouldBe):
1781         (indexOfInt32):
1782         (indexOfDouble):
1783         (indexOfString):
1784         (indexOfObject):
1785
1786 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
1787
1788         test262: Completion values for control flow do not match the spec
1789         https://bugs.webkit.org/show_bug.cgi?id=171265
1790
1791         Reviewed by Saam Barati.
1792
1793         * stress/completion-value.js:
1794         Condensed test for completion values in top level statements.
1795
1796         * stress/super-get-by-id.js:
1797         ClassDeclaration when evaled no longer produce values. Convert
1798         these to ClassExpressions so they produce the class value.
1799         
1800         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
1801         This is a progression for currect spec behavior.
1802
1803         * mozilla/mozilla-tests.yaml:
1804         This test is now outdated, so mark it as failing for that reason.
1805
1806         * test262.yaml:
1807         Passing all "cptn" completion value tests.
1808
1809 2017-06-17  Keith Miller  <keith_miller@apple.com>
1810
1811         ArrayBuffer constructor needs to create subclass structures before its buffer
1812         https://bugs.webkit.org/show_bug.cgi?id=173510
1813
1814         Reviewed by Yusuke Suzuki.
1815
1816         * test262.yaml:
1817
1818 2017-06-17  Keith Miller  <keith_miller@apple.com>
1819
1820         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
1821         https://bugs.webkit.org/show_bug.cgi?id=173506
1822
1823         Reviewed by Ryosuke Niwa.
1824
1825         Re-baseline tests.
1826
1827         * ChakraCore/test/Function/apply3.baseline-jsc:
1828         * test262.yaml:
1829
1830 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1831
1832         [JSC] Add fast path for Object.assign
1833         https://bugs.webkit.org/show_bug.cgi?id=173416
1834
1835         Reviewed by Mark Lam.
1836
1837         * stress/object-assign-changing-properties.js: Added.
1838         (shouldBe):
1839         (throw.new.Error.let.source.get x):
1840         (throw.new.Error):
1841         (shouldBe.let.source.get x):
1842         (shouldBe.let.target.set x):
1843         (shouldBe.let.target.get x):
1844         * stress/object-assign-proxy.js: Added.
1845         (shouldBe):
1846         (throw.new.Error.let.handler.get order):
1847
1848 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1849
1850         [JSC] Implement Object.assign in C++
1851         https://bugs.webkit.org/show_bug.cgi?id=173414
1852
1853         Reviewed by Saam Barati.
1854
1855         * stress/object-assign-string-first.js: Added.
1856         (shouldBe):
1857         (source.get Symbol):
1858         (source.get 1):
1859         (source.get cocoa):
1860
1861 2017-06-14  JF Bastien  <jfbastien@apple.com>
1862
1863         WebAssembly: remove empty test files
1864         https://bugs.webkit.org/show_bug.cgi?id=173382
1865
1866         Reviewed by Saam Barati.
1867
1868         The following files:
1869                 JSTests/wasm/function-tests/call-indirect-params.js
1870                 JSTests/wasm/function-tests/call-indirect.js
1871                 JSTests/wasm/js-api/call-indirect-results.js
1872         Were changed to empty files in https://trac.webkit.org/changeset/209771
1873
1874         They were testing call_indirect with the wrong semantics, before
1875         we implemented tables. That change implemented tables and
1876         therefore removed the erroneous tests.
1877
1878         We have a few tests for call_indirect which already do the right thing:
1879                 JSTests/wasm/function-tests/context-switch.js
1880                 JSTests/wasm/function-tests/exceptions.js
1881                 JSTests/wasm/function-tests/grow-memory-2.js
1882                 JSTests/wasm/function-tests/stack-overflow.js
1883                 JSTests/wasm/function-tests/table-basic-2.js
1884                 JSTests/wasm/function-tests/table-basic.js
1885                 JSTests/wasm/js-api/call-indirect.js
1886                 JSTests/wasm/js-api/table.js
1887                 JSTests/wasm/js-api/unique-signature.js
1888                 JSTests/wasm/js-api/wrapper-function.js
1889
1890         I also just imported the updated spec tests which, among other
1891         things, test call_indirect:
1892                 core/br.wast
1893                 core/br_table.wast
1894                 core/call_indirect.wast
1895                 core/func.wast
1896                 core/func_ptrs.wast
1897                 core/imports.wast
1898                 core/left-to-right.wast
1899                 core/linking.wast
1900                 core/nop.wast
1901                 core/return.wast
1902                 core/typecheck.wast
1903                 core/unreachable.wast
1904
1905         So I think it's OK to just delete the tests which should just have
1906         been deleted back when tables were added.
1907
1908         * wasm/function-tests/call-indirect-params.js: Removed.
1909         * wasm/function-tests/call-indirect.js: Removed.
1910         * wasm/js-api/call-indirect-results.js: Removed.
1911
1912 2017-06-13  JF Bastien  <jfbastien@apple.com>
1913
1914         WebAssembly: import updated spec tests
1915         https://bugs.webkit.org/show_bug.cgi?id=173287
1916         <rdar://problem/32725975>
1917
1918         Reviewed by Saam Barati.
1919
1920         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
1921         with a few modifications so things work.
1922
1923         Fix a bunch of bugs found through this process, and punt a few tests (which I
1924         marked as blocked by this bug).
1925
1926         Fixes:
1927
1928         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
1929         instead of byte alignment. It was also missing memory-alignment.js despite it
1930         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
1931         pass.
1932
1933         Tables can be imported or in a section. There can be only one, but sections can
1934         be empty. An Elements section can exist if there's no Table, as long as it is
1935         also empty.
1936
1937         Memories can be imported or in a section. There can be only one, but sections
1938         can be empty. A Data section can exist if there's no Memory, as long as it is
1939         also empty.
1940
1941         Prototypes: stringify without .prototype. in the string.
1942
1943         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
1944         not a final size, and throws a RangeError on failure, not a TypeError.
1945
1946         Fix compile / instantiate so the reject the promise if given an argument of the
1947         wrong type (instead of failing instantly).
1948
1949         Fix async on neuter test.
1950
1951         Element section shouldn't affect any Table if any of the elements are out of
1952         bounds. We need to process it in two passes.
1953
1954         Segment section shouldn't affect any Data if any of the segments are out of
1955         bounds. We need to process it in two passes.
1956
1957         Empty data segments are valid, but only when there is no memory. Their index
1958         still gets validated, and has to be zero.
1959
1960         Punts:
1961
1962         Error messages with context, the test seems overly restrictive but this is
1963         minor.
1964
1965         compile/instantiate/validate property descriptors.
1966
1967         UTF-8 bugs.
1968
1969         Temporarily disable NaN tests. We need to go back and implement the following
1970         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
1971         much as getting all the other tests passing.
1972
1973         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
1974         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
1975         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
1976         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
1977         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
1978         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
1979         why they're not allowed.
1980
1981         * wasm.yaml:
1982         * wasm/function-tests/i32-load8-s.js:
1983         * wasm/function-tests/memory-access-past-4gib.js:
1984         (const.op.of.WASM.opcodes):
1985         * wasm/function-tests/memory-alignment.js: Added.
1986         (const.op.of.WASM.opcodes):
1987         * wasm/function-tests/memory-section-and-import.js:
1988         * wasm/js-api/Module-compile.js:
1989         (async.testPromiseAPI):
1990         * wasm/js-api/dont-mmap-zero-byte-memory.js:
1991         (testMems):
1992         * wasm/js-api/element.js:
1993         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
1994         * wasm/js-api/neutered-inputs.js:
1995         (const.testFunction): Deleted.
1996         (const.testConstructor): Deleted.
1997         * wasm/js-api/table.js:
1998         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
1999         (new.WebAssembly.Module):
2000         (assert.throws):
2001         (assertBadTableImport):
2002         (assert.throws.WebAssembly.Table.prototype.grow):
2003         (assertBadTableInstance): Deleted.
2004         * wasm/js-api/test_Data.js:
2005         (DataSectionWithoutMemory):
2006         * wasm/spec-harness/index.js:
2007         (module):
2008         (uniqueTest): Deleted.
2009         (assert_invalid): Deleted.
2010         (assert_soft_invalid): Deleted.
2011         (register): Deleted.
2012         (call): Deleted.
2013         (get instance): Deleted.
2014         (exports): Deleted.
2015         (run): Deleted.
2016         (assert_unlinkable): Deleted.
2017         (assert_uninstantiable): Deleted.
2018         (assert_trap): Deleted.
2019         (try.f): Deleted.
2020         (catch): Deleted.
2021         (assert_exhaustion): Deleted.
2022         (assert_return): Deleted.
2023         (assert_return_nan): Deleted.
2024         * wasm/spec-harness/testharness.css: Removed.
2025         * wasm/spec-harness/testharness.js: Removed.
2026         * wasm/spec-harness/testharnessreport.js: Removed.
2027         * wasm/spec-harness/wasm-constants.js:
2028         (assertTraps):
2029         (assertWasmThrows):
2030         * wasm/spec-harness/wasm-module-builder.js:
2031         (Binary.prototype.emit_section):
2032         (Binary):
2033         (WasmFunctionBuilder.prototype.addBody):
2034         (WasmFunctionBuilder.prototype.end):
2035         (WasmFunctionBuilder):
2036         (WasmModuleBuilder.prototype.stringToBytes):
2037         (WasmModuleBuilder.prototype.addCustomSection):
2038         (WasmModuleBuilder.prototype.addFunctionTableInit):
2039         (WasmModuleBuilder.prototype.appendToTable):
2040         (WasmModuleBuilder.prototype.toArray):
2041         (WasmModuleBuilder.prototype.toBuffer):
2042         (WasmModuleBuilder.prototype.instantiate):
2043         (WasmModuleBuilder):
2044         * wasm/spec-tests/address.wast.js:
2045         * wasm/spec-tests/align.wast.js: Added.
2046         * wasm/spec-tests/binary.wast.js:
2047         * wasm/spec-tests/block.wast.js:
2048         * wasm/spec-tests/br.wast.js:
2049         * wasm/spec-tests/br_if.wast.js:
2050         * wasm/spec-tests/br_table.wast.js:
2051         * wasm/spec-tests/call.wast.js:
2052         * wasm/spec-tests/call_indirect.wast.js:
2053         * wasm/spec-tests/comments.wast.js:
2054         * wasm/spec-tests/const.wast.js: Added.
2055         * wasm/spec-tests/conversions.wast.js: Added.
2056         * wasm/spec-tests/custom_section.wast.js:
2057         * wasm/spec-tests/exports.wast.js:
2058         * wasm/spec-tests/f32.wast.js: Added.
2059         * wasm/spec-tests/f64.wast.js: Added.
2060         * wasm/spec-tests/fac.wast.js:
2061         * wasm/spec-tests/float_exprs.wast.js: Added.
2062         * wasm/spec-tests/float_misc.wast.js: Added.
2063         * wasm/spec-tests/func.wast.js:
2064         * wasm/spec-tests/globals.wast.js:
2065         * wasm/spec-tests/if.wast.js:
2066         * wasm/spec-tests/imports.wast.js:
2067         * wasm/spec-tests/inline-module.wast.js: Added.
2068         * wasm/spec-tests/jsapi.js:
2069         (testJSAPI.test):
2070         (testJSAPI):
2071         * wasm/spec-tests/labels.wast.js:
2072         * wasm/spec-tests/loop.wast.js:
2073         * wasm/spec-tests/memory.wast.js:
2074         * wasm/spec-tests/memory_trap.wast.js: Added.
2075         * wasm/spec-tests/names.wast.js:
2076         * wasm/spec-tests/nop.wast.js:
2077         * wasm/spec-tests/return.wast.js:
2078         * wasm/spec-tests/stack.wast.js:
2079         * wasm/spec-tests/token.wast.js: Added.
2080         * wasm/spec-tests/type.wast.js: Added.
2081         * wasm/spec-tests/typecheck.wast.js:
2082         * wasm/spec-tests/unreachable.wast.js:
2083         * wasm/spec-tests/unreached-invalid.wast.js:
2084         * wasm/spec-tests/unwind.wast.js:
2085         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
2086         * wasm/spec-tests/utf8-import-field.wast.js: Added.
2087         * wasm/spec-tests/utf8-import-module.wast.js: Added.
2088
2089 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
2090
2091         Unreviewed JSC test gardening.
2092
2093         * stress/check-string-ident.js:
2094         * stress/new-largeish-contiguous-array-with-size.js:
2095
2096 2017-06-13  Michael Saboff  <msaboff@apple.com>
2097
2098         DFG doesn't properly handle a property that is change to read only in a prototype
2099         https://bugs.webkit.org/show_bug.cgi?id=173321
2100
2101         Reviewed by Filip Pizlo.
2102
2103         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
2104         * stress/regress-173321.js: Added new regression test.
2105         (shouldBe):
2106         (SimpleObject):
2107         (test):
2108
2109 2017-06-12  Saam Barati  <sbarati@apple.com>
2110
2111         Update test262 test expectation since r218082 makes new tests pass.
2112
2113         * test262.yaml:
2114
2115 2017-06-12  Saam Barati  <sbarati@apple.com>
2116
2117         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
2118         https://bugs.webkit.org/show_bug.cgi?id=172957
2119         <rdar://problem/32602704>
2120
2121         Reviewed by Filip Pizlo.
2122
2123         * stress/spec-empty-flows-through-cell-checks.js: Added.
2124         (A):
2125         (B):
2126         (i.catch):
2127
2128 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
2129
2130         We incorrectly allow escaped characters in keyword tokens
2131         https://bugs.webkit.org/show_bug.cgi?id=171310
2132
2133         Reviewed by Yusuke Suzuki.
2134
2135         * stress/destructuring-assignment-syntax.js:
2136         * stress/error-messages-for-in-operator-should-not-crash.js:
2137         (catch):
2138         * stress/reserved-word-with-escape.js:
2139         (testSyntaxError.String.raw.v):
2140         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
2141         (testSyntaxError.String.raw.a):
2142         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
2143
2144 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2145
2146         [DFG] Add ArrayIndexOf intrinsic
2147         https://bugs.webkit.org/show_bug.cgi?id=172421
2148
2149         Reviewed by Saam Barati.
2150
2151         * stress/array-indexof-array-prototype-change.js: Added.
2152         (shouldBe):
2153         (indexOfInt32):
2154         * stress/array-indexof-have-a-bad-time-getter.js: Added.
2155         (shouldBe):
2156         (indexOfInt32):
2157         * stress/array-indexof-have-a-bad-time.js: Added.
2158         (shouldBe):
2159         (indexOfInt32):
2160         * stress/array-indexof-hole-with-prototype.js: Added.
2161         (shouldBe):
2162         (indexOf):
2163         * stress/array-indexof-hole.js: Added.
2164         (shouldBe):
2165         (indexOf):
2166         * stress/array-indexof-index.js: Added.
2167         (shouldBe):
2168         (indexOfInt32):
2169         (indexOfDouble):
2170         (indexOfString):
2171         (indexOfObject):
2172         (indexOfValue):
2173         * stress/array-indexof-negative-index.js: Added.
2174         (shouldBe):
2175         (indexOfInt32):
2176         (indexOfDouble):
2177         (indexOfString):
2178         (indexOfObject):
2179         (indexOfValue):
2180         * stress/array-indexof-non-int32-start-index.js: Added.
2181         (shouldBe):
2182         (indexOf):
2183         (object.valueOf):
2184         * stress/array-indexof-object-prototype-change.js: Added.
2185         (shouldBe):
2186         (indexOfInt32):
2187         * stress/array-indexof-object.js: Added.
2188         (shouldBe):
2189         (indexOf):
2190         * stress/array-indexof-original-array.js: Added.
2191         (shouldBe):
2192         (indexOfInt32):
2193         * stress/array-indexof-string.js: Added.
2194         (shouldBe):
2195         (indexOf):
2196         * stress/array-indexof-structure-change-convert.js: Added.
2197         (shouldBe):
2198         (indexOf):
2199         * stress/array-indexof-structure-change.js: Added.
2200         (shouldBe):
2201         (indexOf):
2202         * stress/array-indexof.js: Added.
2203         (shouldBe):
2204         (indexOf):
2205
2206 2017-06-11  Keith Miller  <keith_miller@apple.com>
2207
2208         TypedArray constructor with string shouldn't throw
2209         https://bugs.webkit.org/show_bug.cgi?id=173181
2210
2211         Reviewed by JF Bastien.
2212
2213         We should be coercing primitive arguments to numbers in the various
2214         TypedArray constructors.
2215
2216         * stress/typedarray-constructor.js:
2217
2218 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
2219
2220         Unreviewed, update test results part 3
2221         https://bugs.webkit.org/show_bug.cgi?id=173227
2222
2223         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
2224
2225 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2226
2227         Unreviewed, update test results part 2
2228         https://bugs.webkit.org/show_bug.cgi?id=173227
2229
2230         * test262.yaml:
2231
2232 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2233
2234         Unreviewed, update test results
2235         https://bugs.webkit.org/show_bug.cgi?id=173227
2236
2237         * microbenchmarks/string-prototype-search-observable-side-effects.js:
2238         * test262.yaml:
2239
2240 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2241
2242         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
2243         https://bugs.webkit.org/show_bug.cgi?id=173227
2244
2245         Reviewed by Mark Lam.
2246
2247         Update the test.
2248
2249         * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
2250
2251 2017-06-08  Keith Miller  <keith_miller@apple.com>
2252
2253         WebAssembly: We should only create wrappers for functions that can be exported
2254         https://bugs.webkit.org/show_bug.cgi?id=173088
2255
2256         Reviewed by Saam Barati.
2257
2258         Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
2259         on the old testWasmModuleFunctions api, which has been removed.
2260
2261         * wasm/function-tests/copysign.js: Removed.
2262         * wasm/function-tests/ctz.js: Removed.
2263         * wasm/function-tests/drop.js: Removed.
2264         * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
2265         * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
2266         * wasm/function-tests/dumb-less-than-ite.js: Removed.
2267         * wasm/function-tests/eqz.js: Removed.
2268         * wasm/function-tests/i32-trunc-s-f32.js: Removed.
2269         * wasm/function-tests/i32-trunc-s-f64.js: Removed.
2270         * wasm/function-tests/i32-trunc-u-f32.js: Removed.
2271         * wasm/function-tests/i32-trunc-u-f64.js: Removed.
2272         * wasm/function-tests/i64-trunc-s-f32.js: Removed.
2273         * wasm/function-tests/i64-trunc-s-f64.js: Removed.
2274         * wasm/function-tests/i64-trunc-u-f32.js: Removed.
2275         * wasm/function-tests/i64-trunc-u-f64.js: Removed.
2276         * wasm/function-tests/if-then-else-fallthrough.js: Removed.
2277         * wasm/function-tests/if-then-fallthrough.js: Removed.
2278         * wasm/function-tests/int-to-floating-point.js: Removed.
2279         * wasm/function-tests/loop-mult.js:
2280         * wasm/function-tests/loop-sum.js:
2281         * wasm/function-tests/max.js: Removed.
2282         * wasm/function-tests/min.js: Removed.
2283         * wasm/function-tests/nearest.js: Removed.
2284         * wasm/function-tests/nop.js: Removed.
2285         * wasm/function-tests/popcnt.js: Removed.
2286         * wasm/function-tests/ret5.js:
2287         * wasm/function-tests/select.js: Removed.
2288         * wasm/function-tests/tee-local.js: Removed.
2289         * wasm/function-tests/trunc.js: Removed.
2290
2291 2017-06-07  JF Bastien  <jfbastien@apple.com>
2292
2293         WebAssembly: test imports and exports with 16-bit characters
2294         https://bugs.webkit.org/show_bug.cgi?id=165977
2295         <rdar://problem/29760130>
2296
2297         Reviewed by Saam Barati.
2298
2299         The output for import failure was improved, so many tests need to
2300         be updated here. Only one has new tests as noted below.
2301
2302         * wasm/function-tests/memory-import-and-grow.js:
2303         * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
2304         (idxModule):
2305         * wasm/js-api/global-error.js:
2306         (new.Number):
2307         (assert.throws):
2308         * wasm/js-api/table.js:
2309         (assert.throws):
2310         (new.WebAssembly.Table):
2311         * wasm/js-api/test_memory.js:
2312         (test):
2313         * wasm/js-api/wasm-to-wasm-bad-signature.js:
2314         (BadSignatureDropStartParams.):
2315         (BadSignatureDropStartParams):
2316         (BadSignatureDropEndParams.):
2317         (BadSignatureSwapParam.):
2318         (BadSignatureRet.):
2319         * wasm/js-api/web-assembly-instantiate.js:
2320         (assert.asyncTest.async.test):
2321         (assert.asyncTest):
2322         * wasm/js-api/wrapper-function.js:
2323         (return.new.WebAssembly.Module):
2324
2325 2017-06-07  Mark Lam  <mark.lam@apple.com>
2326
2327         Restrict the regress-173035.js test to only run on Darwin x86-64.
2328         https://bugs.webkit.org/show_bug.cgi?id=173075
2329
2330         Reviewed by Saam Barati.
2331
2332         This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
2333         this test will require to succeed.  Here's an example of this failure:
2334         https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
2335
2336         Since the issue is due to allocation of a very large amount of memory, the test
2337         will probably fail on iOS and other platforms as well.  Hence, we should just
2338         skip this test for any platforms that is not Darwin x86-64.
2339
2340         * stress/regress-173035.js:
2341
2342 2017-06-07  Mark Lam  <mark.lam@apple.com>
2343
2344         ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
2345         https://bugs.webkit.org/show_bug.cgi?id=168587
2346
2347         Not reviewed.
2348
2349         Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
2350
2351         * stress/test-finally.js:
2352
2353 2017-06-06  Mark Lam  <mark.lam@apple.com>
2354
2355         Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
2356         https://bugs.webkit.org/show_bug.cgi?id=173035
2357         <rdar://problem/32554593>
2358
2359         Reviewed by Geoffrey Garen and Filip Pizlo.
2360
2361         * stress/regress-173035.js: Added.
2362
2363 2017-06-06  Saam Barati  <sbarati@apple.com>
2364
2365         Make sure we restore SP when doing calls that could be to JS
2366         https://bugs.webkit.org/show_bug.cgi?id=172946
2367         <rdar://problem/32579026>
2368
2369         Reviewed by JF Bastien.
2370
2371         * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
2372         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
2373         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
2374         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
2375         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
2376
2377 2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
2378
2379         Unreviewed rollout r217807. Caused a test to crash.
2380
2381         * heapProfiler/class-names.js: Removed.
2382         * heapProfiler/driver/driver.js:
2383         (CheapHeapSnapshotNode):
2384         (CheapHeapSnapshot):
2385         (createCheapHeapSnapshot):
2386         (HeapSnapshot):
2387         (createHeapSnapshot):
2388         * typeProfiler/inheritance.js:
2389         (wrapper.A):
2390         (wrapper.B):
2391         (wrapper.C):
2392         (wrapper):
2393
2394 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
2395
2396         index out of bound in bytecodebasicblock
2397         https://bugs.webkit.org/show_bug.cgi?id=172963
2398
2399         Reviewed by Saam Barati and Mark Lam.
2400
2401         * stress/dfg-call-class-constructor.js: Added.
2402         (Foo):
2403         (i.catch):
2404
2405 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
2406
2407         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
2408         https://bugs.webkit.org/show_bug.cgi?id=172848
2409         <rdar://problem/25709212>
2410
2411         Reviewed by Saam Barati.
2412
2413         * typeProfiler/inheritance.js:
2414         Rewrite the test slightly for clarity. The hoisting was confusing.
2415
2416         * heapProfiler/class-names.js: Added.
2417         (MyES5Class):
2418         (MyES6Class):
2419         (MyES6Subclass):
2420         Test object types and improved class names.
2421
2422         * heapProfiler/driver/driver.js:
2423         (CheapHeapSnapshotNode):
2424         (CheapHeapSnapshot):
2425         (createCheapHeapSnapshot):
2426         (HeapSnapshot):
2427         (createHeapSnapshot):
2428         Update snapshot parsing from version 1 to version 2.
2429
2430 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2431
2432         ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
2433         https://bugs.webkit.org/show_bug.cgi?id=168844
2434
2435         Reviewed by Saam Barati.
2436
2437         * modules/async-function-export.js: Added.
2438         (f):
2439         (export.async.f):
2440
2441 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2442
2443         ES2015 modules - Export default function hoisting
2444         https://bugs.webkit.org/show_bug.cgi?id=170174
2445
2446         Reviewed by Saam Barati.
2447
2448         This issue itself is solved by fixing function declaration hoisting rules.
2449         This patch just adds the specific test to modules tests to ensure the bug
2450         is fixed.
2451
2452         * modules/export-default-function-hoisting.js: Added.
2453         * modules/export-default-function-hoisting/cappuccino.js: Added.
2454         (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
2455         * modules/export-default-function-hoisting/cocoa.js: Added.
2456         (export.default.drinkCocoa):
2457
2458 2017-06-01  Oleksandr Skachkov  <gskachkov@gmail.com>
2459
2460         Class Proxy can't be extended
2461         https://bugs.webkit.org/show_bug.cgi?id=169040
2462
2463         Reviewed by Saam Barati.
2464
2465         Adding tests that check correctness of Proxy to ES6 `class`
2466         Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
2467
2468         * stress/proxy-class.js: Added.
2469         (assert):
2470         (throw.new.Error.SuperClass):
2471         (throw.new.Error.A):
2472         (throw.new.Error):
2473
2474 2017-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2475
2476         [JSC] Implement String.prototype.concat in JS builtins
2477         https://bugs.webkit.org/show_bug.cgi?id=172798
2478
2479         Reviewed by Sam Weinig.
2480
2481         * microbenchmarks/string-concat-convert.js: Added.
2482         (test):
2483         * microbenchmarks/string-concat-long-convert.js: Added.
2484         (test):
2485         * microbenchmarks/string-concat-long.js: Added.
2486         (test):
2487         * microbenchmarks/string-concat.js: Added.
2488         (test):
2489
2490 2017-05-31  Oleksandr Skachkov  <gskachkov@gmail.com>
2491
2492         Rolling out: Prevent async methods named 'function'
2493         https://bugs.webkit.org/show_bug.cgi?id=172776
2494
2495         Reviewed by Mark Lam.
2496
2497         * stress/async-await-syntax.js:
2498         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2499         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2500         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2501         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2502         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2503
2504 2017-05-31  Ryan Haddad  <ryanhaddad@apple.com>
2505
2506         Skip flaky JSC test stress/test-finally.js
2507         https://bugs.webkit.org/show_bug.cgi?id=168587
2508
2509         Unreviewed test gardening.
2510
2511         * stress/test-finally.js:
2512
2513 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2514
2515         Prevent async methods named 'function' in Object literal
2516         https://bugs.webkit.org/show_bug.cgi?id=172660
2517
2518         Reviewed by Saam Barati.
2519
2520         * stress/async-await-syntax.js:
2521         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2522
2523 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2524
2525         ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
2526         https://bugs.webkit.org/show_bug.cgi?id=171274
2527
2528         Reviewed by Saam Barati.
2529
2530         * stress/async-arrow-functions-lexical-binding-in-class.js:
2531         (shouldBeAsync):
2532         (shouldBeAsyncAndStoreBind):
2533         (promise.new.Promise):
2534         (ChildClass4):
2535         (ChildClass4.prototype.classValue):
2536         (ChildClass4.prototype.get classProperty):
2537         * stress/async-arrow-functions-lexical-super-binding.js:
2538         (A):
2539         (const.childA1.new.prototype.var.f.async):
2540         (const.childA1.new.var):
2541         (const.childA1.new):
2542         (const.childA2.new.prototype.var.f.async):
2543         (const.childA2.new.var):
2544         (const.childA2.new):
2545         (const.childA3.new.prototype.var.f.async):
2546         (const.childA3.new.var):
2547         (const.childA3.new):
2548         (try.childA4.new.prototype.var.f.async):
2549         (try.childA4.new.var):
2550         (try.childA4.new):
2551         (catch):
2552         (const.childA5.new.prototype.var.f.async):
2553         (const.childA5.new.var):
2554         (const.childA5.new):
2555         (checkClass):
2556         (checkClass.new.prototype.var.f.async):
2557         (checkClass.new.var):
2558         (checkClass.new):
2559         (checkClass.new.prototype.method):
2560         (checkClass.new.prototype.prop):
2561
2562 2017-05-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2563
2564         [JSC] Map and Set constructors should have fast path for cloning
2565         https://bugs.webkit.org/show_bug.cgi?id=172413
2566
2567         Reviewed by Saam Barati.
2568
2569         * stress/map-clone-instance-iterator-change.js: Added.
2570         (shouldBe):
2571         (map.Symbol.iterator):
2572         * stress/map-clone-iterator-change.js: Added.
2573         (shouldBe):
2574         (Map.prototype.Symbol.iterator):
2575         * stress/map-clone-next-change.js: Added.
2576         (shouldBe):
2577         (map.Symbol.iterator.__proto__.next):
2578         * stress/map-clone.js: Added.
2579         (shouldBe):
2580         (Map.prototype):
2581         * stress/map-inherit-set.js: Added.
2582         (shouldBe):
2583         (DerivedMap):
2584         (set for):
2585         * stress/set-clone-instance-iterator-change.js: Added.
2586         (shouldBe):
2587         (set Symbol.iterator):
2588         * stress/set-clone-iterator-change.js: Added.
2589         (shouldBe):
2590         (set Set.prototype.Symbol.iterator):
2591         * stress/set-clone-next-change.js: Added.
2592         (shouldBe):
2593         (set Symbol.iterator.__proto__.next):
2594         * stress/set-clone.js: Added.
2595         (shouldBe):
2596         (set Set.prototype.add):
2597         * stress/set-inherit-add.js: Added.
2598         (shouldBe):
2599         (DerivedSet.set add):
2600
2601 2017-05-26  Ryan Haddad  <ryanhaddad@apple.com>
2602
2603         Unreviewed, rolling out r217458.
2604
2605         This change caused 55 JSC test failures.
2606
2607         Reverted changeset:
2608
2609         "Date should use historical data if it's available."
2610         https://bugs.webkit.org/show_bug.cgi?id=172592
2611         http://trac.webkit.org/changeset/217458
2612
2613 2017-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2614
2615         Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
2616         https://bugs.webkit.org/show_bug.cgi?id=167805
2617
2618         Reviewed by Saam Barati.
2619
2620         * modules/module-jit-reachability.js: Added.
2621
2622 2017-05-26  Oleksandr Skachkov  <gskachkov@gmail.com>
2623
2624         Prevent async methods named 'function'
2625         https://bugs.webkit.org/show_bug.cgi?id=172598
2626
2627         Reviewed by Mark Lam.
2628
2629         * stress/async-await-syntax.js:
2630         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2631         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2632         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2633         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2634         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2635
2636 2017-05-25  Keith Miller  <keith_miller@apple.com>
2637
2638         Date should use historical data if it's available.
2639         https://bugs.webkit.org/show_bug.cgi?id=172592
2640
2641         Reviewed by Mark Lam.
2642
2643         Remove parts of the date tests that rely on the absence of
2644         historical data in Date.
2645
2646         * mozilla/ecma/Date/15.9.5.31-1.js:
2647         (getTestCases):
2648         * mozilla/ecma/Date/15.9.5.35-1.js:
2649         (getTestCases):
2650
2651 2017-05-25  Saam Barati  <sbarati@apple.com>
2652
2653         Our for-in optimization in the bytecode generator does its static analysis incorrectly
2654         https://bugs.webkit.org/show_bug.cgi?id=172532
2655         <rdar://problem/32369452>
2656
2657         Reviewed by Mark Lam.
2658
2659         * stress/for-in-invalidation-for-any-write.js: Added.
2660         (assert):
2661         (test):
2662         (test.i):
2663
2664 2017-05-25  Mark Lam  <mark.lam@apple.com>
2665
2666         ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
2667         https://bugs.webkit.org/show_bug.cgi?id=172548
2668         <rdar://problem/31458393>
2669
2670         Reviewed by Filip Pizlo.
2671
2672         * stress/regress-172548.patch: Added.
2673
2674 2017-05-23  Saam Barati  <sbarati@apple.com>
2675
2676         We should not mmap zero bytes for a memory in Wasm
2677         https://bugs.webkit.org/show_bug.cgi?id=172528
2678         <rdar://problem/32257076>
2679
2680         Reviewed by Mark Lam.
2681
2682         * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
2683         (testMems):
2684
2685 2017-05-23  Saam Barati  <sbarati@apple.com>
2686
2687         CFGSimplificationPhase should not merge a block with itself
2688         https://bugs.webkit.org/show_bug.cgi?id=172508
2689         <rdar://problem/28424006>
2690
2691         Reviewed by Keith Miller.
2692
2693         * stress/dont-crash-in-cfg-simplification.js: Added.
2694         (bar):
2695         (baz):
2696         (foo):
2697
2698 2017-05-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2699
2700         [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
2701         https://bugs.webkit.org/show_bug.cgi?id=172216
2702
2703         Reviewed by Saam Barati.
2704
2705         * stress/array-storage-get-by-val.js: Added.
2706         (shouldBe):
2707         (testOutOfBound):
2708         (testInBound):
2709         (testSlowPutOutOfBound):
2710         (testSlowPutInBound):
2711
2712 2017-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2713
2714         Unreviewed, fix commented out tests
2715         https://bugs.webkit.org/show_bug.cgi?id=172225
2716
2717         * stress/get-by-val-string.js:
2718         (object.43):
2719         (Hello):
2720         (Hello.prototype.get 42):
2721         (Hello.prototype.43):
2722         (Derived):
2723         (shouldBe):
2724         (throw.new.Error): Deleted.
2725
2726 2017-05-21  Saam Barati  <sbarati@apple.com>
2727
2728         We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
2729         https://bugs.webkit.org/show_bug.cgi?id=171041
2730         <rdar://problem/32082516>
2731
2732         Reviewed by Yusuke Suzuki.
2733
2734         * stress/lexical-scoping-for-loop.js: Added.
2735         (assert):
2736         (test1):
2737         (test2):
2738         (test3):
2739         (test4):
2740         (test5):
2741         (test6):
2742         (let.test7):
2743         (let.test8):
2744         (let.test9):
2745         (let.test10):
2746         (let.test11):
2747         (let.test12):
2748
2749 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2750
2751         [JSC] Make get_by_val & string "499" to number 499
2752         https://bugs.webkit.org/show_bug.cgi?id=172225
2753
2754         Reviewed by Saam Barati.
2755
2756         * stress/get-by-val-string.js: Added.
2757         (shouldBe):
2758         (shouldThrow):
2759         (object.43):
2760         (Hello):
2761         (Hello.prototype.get 42):
2762         (Hello.prototype.43):
2763         (Derived):
2764
2765 2017-05-19  Mark Lam  <mark.lam@apple.com>
2766
2767         [Re-landing] DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
2768         https://bugs.webkit.org/show_bug.cgi?id=172383
2769         <rdar://problem/31418651>
2770
2771         Reviewed by Filip Pizlo.
2772
2773         * stress/regress-172383.js: Added.
2774
2775 2017-05-19  Ryan Haddad  <ryanhaddad@apple.com>
2776
2777         Unreviewed, rolling out r217156.
2778
2779         This change broke the iOS build.
2780
2781         Reverted changeset:
2782
2783         "DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring
2784         result registers."
2785         https://bugs.webkit.org/show_bug.cgi?id=172383
2786         http://trac.webkit.org/changeset/217156
2787
2788 2017-05-19  Mark Lam  <mark.lam@apple.com>
2789
2790         Add missing exception check.
2791         https://bugs.webkit.org/show_bug.cgi?id=172346
2792         <rdar://problem/32289640>
2793
2794         Reviewed by Geoffrey Garen.
2795
2796         * stress/regress-172346.js: Added.
2797
2798 2017-05-19  Mark Lam  <mark.lam@apple.com>
2799
2800         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
2801         https://bugs.webkit.org/show_bug.cgi?id=172383
2802         <rdar://problem/31418651>
2803
2804         Reviewed by Filip Pizlo.
2805
2806         * stress/regress-172383.js: Added.
2807
2808 2017-05-19  Filip Pizlo  <fpizlo@apple.com>
2809
2810         arrayProtoPrivateFuncConcatMemcpy needs to be down with firstArray being undecided
2811         https://bugs.webkit.org/show_bug.cgi?id=172369
2812
2813         Reviewed by Mark Lam.
2814
2815         * stress/undecided-concat.js: Added.
2816
2817 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2818
2819         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
2820         https://bugs.webkit.org/show_bug.cgi?id=172098
2821
2822         Reviewed by Saam Barati.
2823
2824         * stress/check-sub-class.js: Added.
2825         (shouldBe):
2826         (shouldThrow):
2827         (calling):
2828         (array.forEach):
2829         (i.array.forEach):
2830
2831 2017-05-18  JF Bastien  <jfbastien@apple.com>
2832
2833         WebAssembly: exports is a getter
2834         https://bugs.webkit.org/show_bug.cgi?id=172129
2835
2836         Reviewed by Saam Barati.
2837
2838         Update test to reflect new semantics.
2839
2840         * wasm/js-api/test_basic_api.js:
2841         (const.c.in.constructorProperties.switch):
2842
2843 2017-05-18  Saam Barati  <sbarati@apple.com>
2844
2845         Proxy's [[Get]] passes incorrect receiver
2846         https://bugs.webkit.org/show_bug.cgi?id=164849
2847         <rdar://problem/31767058>
2848
2849         Reviewed by Yusuke Suzuki.
2850
2851         * stress/proxy-get-set-correct-receiver.js: Added.
2852         (assert):
2853         (test):
2854         (test.let.target.set prop):
2855         (test.let.target.get prop):
2856         (test.get let):
2857         * stress/proxy-set.js:
2858         (let.target.get x):
2859         * stress/reflect-set-proxy-set.js:
2860         (let.target.get x):
2861         * stress/reflect-set-receiver-proxy-set.js:
2862         (let.target.get x):
2863
2864 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
2865
2866         Constructor calls set this too early
2867         https://bugs.webkit.org/show_bug.cgi?id=172302
2868
2869         Reviewed by Saam Barati.
2870         
2871         This tests all three kinds of constructs in BytecodeGenerator. All three were previously
2872         wrong.
2873
2874         * stress/construct-overwritten-variable.js: Added.
2875         (new.x.x):
2876         * stress/construct-spread-overwritten-variable-2.js: Added.
2877         (new.x.x):
2878         * stress/construct-spread-overwritten-variable.js: Added.
2879         (new.x.x):
2880
2881 2017-05-18  Saam Barati  <sbarati@apple.com>
2882
2883         WebAssembly: perform stack checks
2884         https://bugs.webkit.org/show_bug.cgi?id=165546
2885         <rdar://problem/29760307>
2886
2887         Reviewed by Filip Pizlo.
2888
2889         * wasm.yaml:
2890         * wasm/function-tests/factorial.js:
2891         * wasm/function-tests/float-sub.js:
2892         * wasm/function-tests/stack-overflow.js: Added.
2893         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2894         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
2895         (assertOverflows.makeInstance):
2896         (assertOverflows.makeInstance2):
2897         (assertOverflows.assertThrows):
2898         (assertOverflows):
2899         (assertThrows.test.makeSignature):
2900         (assertThrows.test.makeInstance):
2901         (assertThrows.test):
2902         (assertThrows):
2903
2904 2017-05-18  Keith Miller  <keith_miller@apple.com>
2905
2906         WebAssembly API: test with neutered inputs
2907         https://bugs.webkit.org/show_bug.cgi?id=163899
2908
2909         Reviewed by JF Bastien.
2910
2911         * wasm/js-api/neutered-inputs.js: Added.
2912         (const.testFunction):
2913         (const.testConstructor):
2914         * wasm/js-api/test_basic_api.js:
2915         (const.c.in.constructorProperties.switch):
2916
2917 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
2918
2919         DFG inlining should be hardened for the no-result case
2920         https://bugs.webkit.org/show_bug.cgi?id=172290
2921
2922         Reviewed by Saam Barati.
2923
2924         * stress/array-constructor-no-result.js: Added.
2925         (foo):
2926         * stress/pow-no-result.js: Added.
2927         (foo):
2928
2929 2017-05-18  Commit Queue  <commit-queue@webkit.org>
2930
2931         Unreviewed, rolling out r217031, r217032, and r217037.
2932         https://bugs.webkit.org/show_bug.cgi?id=172293
2933
2934         cause linking errors in Windows (Requested by yusukesuzuki on
2935         #webkit).
2936
2937         Reverted changesets:
2938
2939         "[JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass"
2940         https://bugs.webkit.org/show_bug.cgi?id=172098
2941         http://trac.webkit.org/changeset/217031
2942
2943         "Unreviewed, rebaseline for newly added ClassInfo"
2944         https://bugs.webkit.org/show_bug.cgi?id=172098
2945         http://trac.webkit.org/changeset/217032
2946
2947         "Unreviewed, fix debug and non-JIT build"
2948         https://bugs.webkit.org/show_bug.cgi?id=172098
2949         http://trac.webkit.org/changeset/217037
2950
2951 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2952
2953         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
2954         https://bugs.webkit.org/show_bug.cgi?id=172098
2955
2956         Reviewed by Saam Barati.
2957
2958         * stress/check-sub-class.js: Added.
2959         (shouldBe):
2960         (shouldThrow):
2961         (calling):
2962         (array.forEach):
2963         (i.array.forEach):
2964
2965 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
2966
2967         Unreviewed, address mlam's review feedback.
2968
2969         * stress/arguments-elimination-varargs-too-many-args-arg-count.js:
2970
2971 2017-05-17  Saam Barati  <sbarati@apple.com>
2972
2973         We don't do context switches for Wasm->Wasm call indirect
2974         https://bugs.webkit.org/show_bug.cgi?id=172188
2975         <rdar://problem/32231828>
2976
2977         Reviewed by Keith Miller.
2978
2979         * wasm/function-tests/context-switch.js: Added.
2980         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2981         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance2):
2982         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.i2.makeInstance2):
2983         (makeInstance):
2984         (makeInstance2):
2985         (assert.eq.makeInstance):
2986         (assert.eq.makeInstance2):
2987         (assert.eq):
2988
2989 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
2990
2991         JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform
2992         https://bugs.webkit.org/show_bug.cgi?id=172208
2993
2994         Reviewed by Saam Barati.
2995
2996         * stress/arguments-elimination-varargs-too-many-args-arg-count.js: Added.
2997         (foo):
2998         (bar):
2999         (baz):
3000
3001 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3002
3003         [DFG] Constant Folding Phase should convert MakeRope("", String) => Identity(String)
3004         https://bugs.webkit.org/show_bug.cgi?id=172115
3005
3006         Reviewed by Saam Barati.
3007
3008         * stress/constant-folding-should-fold-make-rope-with-empty-strings.js: Added.
3009         (shouldBe):
3010         (unknown):
3011         (readWord1):
3012         (readWord2):
3013         (readWord3):
3014         (readWord4):
3015
3016 2017-05-16  JF Bastien  <jfbastien@apple.com>
3017
3018         WebAssembly: add memory fuzzer
3019         https://bugs.webkit.org/show_bug.cgi?id=169976
3020         <rdar://problem/31965328>
3021
3022         Reviewed by Keith Miller.
3023
3024         * wasm/fuzz/memory.js: Added.
3025         (const.insert):
3026         (const.action.string_appeared_here):
3027         (const.performAction):
3028         (catch):
3029
3030 2017-05-16  JF Bastien  <jfbastien@apple.com>
3031
3032         WebAssembly: validate load / store alignment
3033         https://bugs.webkit.org/show_bug.cgi?id=168836
3034         <rdar://problem/31965349>
3035
3036         Reviewed by Keith Miller.
3037
3038         * wasm/WASM.js: fix regular expression greed
3039         * wasm/function-tests/memory-alignment.js: Added.
3040         (const.op.of.WASM.opcodes):
3041         * wasm/wasm.json: fix formatting
3042
3043 2017-05-15  Mark Lam  <mark.lam@apple.com>
3044
3045         Rolling out r214038 and r213697: Crashes when using computed properties with rest destructuring and object spread.
3046         https://bugs.webkit.org/show_bug.cgi?id=172147
3047
3048         Rubber-stamped by Saam Barati.
3049
3050         * stress/object-rest-deconstruct.js: Removed.
3051         * stress/object-spread.js: Removed.
3052
3053 2017-05-11  JF Bastien  <jfbastien@apple.com>
3054
3055         WebAssembly: stop supporting 0xD
3056         https://bugs.webkit.org/show_bug.cgi?id=168788
3057         <rdar://problem/31880922>
3058
3059         Reviewed by Saam Barati.
3060
3061         Test that only version 1 is supported.
3062
3063         * wasm/js-api/version.js: Added.
3064
3065 2017-05-10  JF Bastien  <jfbastien@apple.com>
3066
3067         WebAssemby: builder doesn't do Memory section maximum correctly
3068         https://bugs.webkit.org/show_bug.cgi?id=171931
3069
3070         Reviewed by Keith Miller.
3071
3072         * wasm/Builder.js:
3073         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
3074         * wasm/Builder_WebAssemblyBinary.js:
3075         (const.emitters.Memory):
3076         * wasm/function-tests/memory-grow-invalid.js: Added.
3077
3078 2017-05-10  JF Bastien  <jfbastien@apple.com>
3079
3080         WebAssembly: support name section
3081         https://bugs.webkit.org/show_bug.cgi?id=171263
3082
3083         Reviewed by Keith Miller.
3084
3085         * wasm/function-tests/nameSection.js: Added.
3086         (const.compile):
3087         * wasm/function-tests/nameSection.wasm: Added.
3088         * wasm/function-tests/stack-trace.js: Update format
3089
3090 2017-05-10  Filip Pizlo  <fpizlo@apple.com>
3091
3092         Null pointer dereference in WTF::RefPtr<WTF::StringImpl>::operator!() under slow_path_get_direct_pname
3093         https://bugs.webkit.org/show_bug.cgi?id=171801
3094
3095         Reviewed by Michael Saboff.
3096         
3097         These tests used to crash. The prefix and postfix tests cover different paths, except
3098         postfix-ignored goes down the same path as prefix due to an optimization.
3099
3100         * stress/for-in-postfix-ignored-index.js: Added.
3101         (foo):
3102         * stress/for-in-postfix-index.js: Added.
3103         (foo):
3104         * stress/for-in-prefix-index.js: Added.
3105         (foo):
3106
3107 2017-05-08  Mark Lam  <mark.lam@apple.com>
3108
3109         op_throw_static_error's use of its first operand should be reflected in DFG BytecodeUseDef as well.
3110         https://bugs.webkit.org/show_bug.cgi?id=171786
3111         <rdar://problem/32051023>
3112
3113         Reviewed by Saam Barati.
3114
3115         * stress/bug-171786.js: Added.
3116
3117 2017-05-06  Oleksandr Skachkov  <gskachkov@gmail.com>
3118
3119         [ES6] Arrow function. Issue in access to this after eval('super()') within constructor
3120         https://bugs.webkit.org/show_bug.cgi?id=171543
3121
3122         Reviewed by Saam Barati.
3123
3124         * stress/arrowfunction-lexical-bind-supercall-4.js:
3125         (J):
3126         (K):
3127
3128 2017-05-05  Saam Barati  <sbarati@apple.com>
3129
3130         putDirectIndex does not properly do defineOwnProperty
3131         https://bugs.webkit.org/show_bug.cgi?id=171591
3132         <rdar://problem/31735695>
3133
3134         Reviewed by Geoffrey Garen.
3135
3136         * stress/array-prototype-splice-making-typed-array.js:
3137         (test):
3138         * stress/array-species-config-array-constructor.js:
3139         (shouldThrow):
3140         (test):
3141         * stress/put-direct-index-broken-2.js: Added.
3142         (assert):
3143         (test):
3144         (makeLengthWritable):
3145         (set get restoreOldDesc):
3146         * stress/put-direct-index-broken.js: Added.
3147         (whatToTest):
3148         (tryRunning):
3149         (tryItOut):
3150         * stress/put-indexed-getter-setter.js: Added.
3151         (foo.X.prototype.set 7):
3152         (foo.X.prototype.get 7):
3153         (foo.X):
3154         (foo):
3155
3156 2017-05-04  Yusuke Suzuki  <utatane.tea@gmail.com>
3157
3158         [JSC] Math unary functions should be handled by DFG
3159         https://bugs.webkit.org/show_bug.cgi?id=171269
3160
3161         Reviewed by Saam Barati.
3162
3163         * stress/arith-acos-on-various-types.js: Added.
3164         (let.validInputTypedTestCases.validInputTestCases.map):
3165         (isIdentical):
3166         (opaqueACosNoArgument):
3167         (testNoArgument):
3168         (opaqueAllTypesACos):
3169         (testAllTypesCall):
3170         (testSingleTypeCall):
3171         (testConstant):
3172         (opaqueACosForSideEffects):
3173         (testSideEffect.let.testObject.valueOf):
3174         (testSideEffect):
3175         (opaqueACosForCSE):
3176         (testCSE.let.testObject.valueOf):
3177         (testCSE):
3178         (opaqueACosForDCE):
3179         (testDCE.let.testObject.valueOf):
3180         (testDCE):
3181         (testException.opaqueACosWithException):
3182         (testException):
3183         * stress/arith-acosh-on-various-types.js: Added.
3184         (let.validInputTypedTestCases.validInputTestCases.map):
3185         (isIdentical):
3186         (opaqueACoshNoArgument):
3187         (testNoArgument):
3188         (opaqueAllTypesACosh):
3189         (testAllTypesCall):
3190         (testSingleTypeCall):
3191         (testConstant):
3192         (opaqueACoshForSideEffects):
3193         (testSideEffect.let.testObject.valueOf):
3194         (testSideEffect):
3195         (opaqueACoshForCSE):
3196         (testCSE.let.testObject.valueOf):
3197         (testCSE):
3198         (opaqueACoshForDCE):
3199         (testDCE.let.testObject.valueOf):
3200         (testDCE):
3201         (testException.opaqueACoshWithException):
3202         (testException):
3203         * stress/arith-asin-on-various-types.js: Added.
3204         (let.validInputTypedTestCases.validInputTestCases.map):
3205         (isIdentical):
3206         (opaqueASinNoArgument):
3207         (testNoArgument):
3208         (opaqueAllTypesASin):
3209         (testAllTypesCall):
3210         (testSingleTypeCall):
3211         (testConstant):
3212         (opaqueASinForSideEffects):
3213         (testSideEffect.let.testObject.valueOf):
3214         (testSideEffect):
3215         (opaqueASinForCSE):
3216         (testCSE.let.testObject.valueOf):
3217         (testCSE):
3218         (opaqueASinForDCE):
3219         (testDCE.let.testObject.valueOf):
3220         (testDCE):
3221         (testException.opaqueASinWithException):
3222         (testException):
3223         * stress/arith-asinh-on-various-types.js: Added.
3224         (let.validInputTypedTestCases.validInputTestCases.map):
3225         (isIdentical):
3226         (opaqueASinhNoArgument):
3227         (testNoArgument):
3228         (opaqueAllTypesASinh):
3229         (testAllTypesCall):
3230         (testSingleTypeCall):
3231         (testConstant):
3232         (opaqueASinhForSideEffects):
3233         (testSideEffect.let.testObject.valueOf):
3234         (testSideEffect):
3235         (opaqueASinhForCSE):
3236         (testCSE.let.testObject.valueOf):
3237         (testCSE):
3238         (opaqueASinhForDCE):
3239         (testDCE.let.testObject.valueOf):
3240         (testDCE):
3241         (testException.opaqueASinhWithException):
3242         (testException):
3243         * stress/arith-atan-on-various-types.js: Added.
3244         (let.validInputTypedTestCases.validInputTestCases.map):
3245         (isIdentical):
3246         (opaqueATanNoArgument):
3247         (testNoArgument):
3248         (opaqueAllTypesATan):
3249         (testAllTypesCall):
3250         (testSingleTypeCall):
3251         (testConstant):
3252         (opaqueATanForSideEffects):
3253         (testSideEffect.let.testObject.valueOf):
3254         (testSideEffect):
3255         (opaqueATanForCSE):
3256         (testCSE.let.testObject.valueOf):
3257         (testCSE):
3258         (opaqueATanForDCE):
3259         (testDCE.let.testObject.valueOf):
3260         (testDCE):
3261         (testException.opaqueATanWithException):
3262         (testException):
3263         * stress/arith-atanh-on-various-types.js: Added.
3264         (let.validInputTypedTestCases.validInputTestCases.map):
3265         (isIdentical):
3266         (opaqueATanhNoArgument):
3267         (testNoArgument):
3268         (opaqueAllTypesATanh):
3269         (testAllTypesCall):
3270         (testSingleTypeCall):
3271         (testConstant):
3272         (opaqueATanhForSideEffects):
3273         (testSideEffect.let.testObject.valueOf):
3274         (testSideEffect):
3275         (opaqueATanhForCSE):
3276         (testCSE.let.testObject.valueOf):
3277         (testCSE):
3278         (opaqueATanhForDCE):
3279         (testDCE.let.testObject.valueOf):
3280         (testDCE):
3281         (testException.opaqueATanhWithException):
3282         (testException):
3283         * stress/arith-cbrt-on-various-types.js: Added.
3284         (let.validInputTypedTestCases.validInputTestCases.map):
3285         (isIdentical):
3286         (opaqueCbrtNoArgument):
3287         (testNoArgument):
3288         (opaqueAllTypesCbrt):
3289         (testAllTypesCall):
3290         (testSingleTypeCall):
3291         (testConstant):
3292         (opaqueCbrtForSideEffects):
3293         (testSideEffect.let.testObject.valueOf):
3294         (testSideEffect):
3295         (opaqueCbrtForCSE):
3296         (testCSE.let.testObject.valueOf):
3297         (testCSE):
3298         (opaqueCbrtForDCE):
3299         (testDCE.let.testObject.valueOf):
3300         (testDCE):
3301         (testException.opaqueCbrtWithException):
3302         (testException):
3303         * stress/arith-cosh-on-various-types.js: Added.
3304         (let.validInputTypedTestCases.validInputTestCases.map):
3305         (isIdentical):
3306         (opaqueCoshNoArgument):
3307         (testNoArgument):
3308         (opaqueAllTypesCosh):
3309         (testAllTypesCall):
3310         (testSingleTypeCall):
3311         (testConstant):
3312         (opaqueCoshForSideEffects):
3313         (testSideEffect.let.testObject.valueOf):
3314         (testSideEffect):
3315         (opaqueCoshForCSE):
3316         (testCSE.let.testObject.valueOf):
3317         (testCSE):
3318         (opaqueCoshForDCE):
3319         (testDCE.let.testObject.valueOf):
3320         (testDCE):
3321         (testException.opaqueCoshWithException):
3322         (testException):
3323         * stress/arith-expm1-on-various-types.js: Added.
3324         (let.validInputTypedTestCases.validInputTestCases.map):
3325         (isIdentical):
3326         (opaqueExpm1NoArgument):
3327         (testNoArgument):
3328         (opaqueAllTypesExpm1):
3329         (testAllTypesCall):
3330         (testSingleTypeCall):
3331         (testConstant):
3332         (opaqueExpm1ForSideEffects):
3333         (testSideEffect.let.testObject.valueOf):
3334         (testSideEffect):
3335         (opaqueExpm1ForCSE):
3336         (testCSE.let.testObject.valueOf):
3337         (testCSE):
3338         (opaqueExpm1ForDCE):
3339         (testDCE.let.testObject.valueOf):
3340         (testDCE):
3341         (testException.opaqueExpm1WithException):
3342         (testException):
3343         * stress/arith-log10-on-various-types.js: Added.
3344         (let.validInputTypedTestCases.validInputTestCases.map):
3345         (isIdentical):
3346         (opaqueLog10NoArgument):
3347         (testNoArgument):
3348         (opaqueAllTypesLog10):
3349         (testAllTypesCall):
3350         (testSingleTypeCall):
3351         (testConstant):
3352         (opaqueLog10ForSideEffects):
3353         (testSideEffect.let.testObject.valueOf):
3354         (testSideEffect):
3355         (opaqueLog10ForCSE):
3356         (testCSE.let.testObject.valueOf):
3357         (testCSE):
3358         (opaqueLog10ForDCE):
3359         (testDCE.let.testObject.valueOf):
3360         (testDCE):
3361         (testException.opaqueLog10WithException):
3362         (testException):
3363         * stress/arith-log2-on-various-types.js: Added.
3364         (let.validInputTypedTestCases.validInputTestCases.map):
3365         (isIdentical):
3366         (opaqueLog2NoArgument):
3367         (testNoArgument):
3368         (opaqueAllTypesLog2):
3369         (testAllTypesCall):
3370         (testSingleTypeCall):
3371         (testConstant):
3372         (opaqueLog2ForSideEffects):
3373         (testSideEffect.let.testObject.valueOf):
3374         (testSideEffect):
3375         (opaqueLog2ForCSE):
3376         (testCSE.let.testObject.valueOf):
3377         (testCSE):
3378         (opaqueLog2ForDCE):
3379         (testDCE.let.testObject.valueOf):
3380         (testDCE):
3381         (testException.opaqueLog2WithException):
3382         (testException):
3383         * stress/arith-sinh-on-various-types.js: Added.
3384         (let.validInputTypedTestCases.validInputTestCases.map):
3385         (isIdentical):
3386         (opaqueSinhNoArgument):
3387         (testNoArgument):
3388         (opaqueAllTypesSinh):
3389         (testAllTypesCall):
3390         (testSingleTypeCall):
3391         (testConstant):
3392         (opaqueSinhForSideEffects):
3393         (testSideEffect.let.testObject.valueOf):
3394         (testSideEffect):
3395         (opaqueSinhForCSE):
3396         (testCSE.let.testObject.valueOf):
3397         (testCSE):
3398         (opaqueSinhForDCE):
3399         (testDCE.let.testObject.valueOf):
3400         (testDCE):
3401         (testException.opaqueSinhWithException):
3402         (testException):
3403         * stress/arith-tan-on-various-types.js:
3404         (isIdentical):
3405         * stress/arith-tanh-on-various-types.js: Added.
3406         (let.validInputTypedTestCases.validInputTestCases.map):
3407         (isIdentical):
3408         (opaqueTanhNoArgument):
3409         (testNoArgument):
3410         (opaqueAllTypesTanh):
3411         (testAllTypesCall):
3412         (testSingleTypeCall):
3413         (testConstant):
3414         (opaqueTanhForSideEffects):
3415         (testSideEffect.let.testObject.valueOf):
3416         (testSideEffect):
3417         (opaqueTanhForCSE):
3418         (testCSE.let.testObject.valueOf):
3419         (testCSE):
3420         (opaqueTanhForDCE):
3421         (testDCE.let.testObject.valueOf):
3422         (testDCE):
3423         (testException.opaqueTanhWithException):
3424         (testException):
3425
3426 2017-05-03  Keith Miller  <keith_miller@apple.com>
3427
3428         Array.prototype.sort should also allow a null comparator
3429         https://bugs.webkit.org/show_bug.cgi?id=171621
3430
3431         Reviewed by Michael Saboff.
3432
3433         Add test to make it less likely we revert to the incompatable behavior.
3434         Also, fix now incorrect tests.
3435
3436         * ChakraCore/test/Array/array_sort.baseline-jsc:
3437         * stress/array-sort-bad-comparator.js:
3438         (test):
3439         * stress/sort-null-comparator.js: Added.
3440         (assertEq):
3441
3442 2017-05-03  Caitlin Potter  <caitp@igalia.com>
3443
3444         [JSC] remove unneeded asyncFunctionTests.yaml
3445         https://bugs.webkit.org/show_bug.cgi?id=171611
3446
3447         Reviewed by Yusuke Suzuki.
3448
3449         Async functions have shipped, and those tests are run as part of
3450         JSTests/stress and JSTests/test262.yaml. The file is no longer needed.
3451
3452         * asyncFunctionTests.yaml: Removed.
3453         * stress/async-await-long-loop.js:
3454         * stress/async-await-throw-loop.js:
3455
3456 2017-05-03  Keith Miller  <keith_miller@apple.com>
3457
3458         Different behaviour with the .sort(callback) method (unlike Firefox & Chrome)
3459         https://bugs.webkit.org/show_bug.cgi?id=47825
3460
3461         Reviewed by Saam Barati.
3462
3463         * stress/sorting-boolean-result-comparator.js: Added.
3464         (checkArray):
3465
3466 2017-05-02  David Kilzer  <ddkilzer@apple.com>
3467
3468         check-webkit-style should keep JavaScript test functions in sync
3469         <https://webkit.org/b/171424>
3470
3471         Reviewed by Joseph Pecoraro.
3472
3473         This change makes shouldBe(), shouldNotBe(), shouldNotThrow()
3474         and shouldThrow() in sync with other copies of these methods.
3475
3476         * stress/resources/standalone-pre.js:
3477         (shouldBe): Fix whitespace.  Prefix 'exception' and 'quiet'
3478         variables with underscore.
3479         (shouldThrow): Fix whitespace.
3480
3481 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3482
3483         We initialize functions too early in an eval
3484         https://bugs.webkit.org/show_bug.cgi?id=161099
3485
3486         Reviewed by Saam Barati.
3487
3488         * stress/eval-func-decl-with-let-const-class.js: Added.
3489
3490 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3491
3492         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
3493         https://bugs.webkit.org/show_bug.cgi?id=163208
3494
3495         Reviewed by Saam Barati.
3496
3497         * stress/eval-func-decl-block-scoping-reassign.js: Added.
3498         (assert):
3499         (throw.new.Error.f):
3500         (throw.new.Error):
3501         * stress/eval-func-decl-block-with-remove.js: Added.
3502         (assert):
3503         (foo.boo):
3504         (foo):
3505         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
3506         (assert):
3507         (assertThrow):
3508         (foo):
3509         (boo):
3510         (joo):
3511         (koo):
3512         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
3513         (assert):
3514         (assertThrow):
3515         (foo):
3516         (boo):
3517         (hoo):
3518         (joo):
3519         (koo):
3520         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
3521         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
3522         (assert):
3523         (assertThrow):
3524         (foo):
3525         (boo):
3526         (goo):
3527         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
3528         (assert):
3529         (assertThrow):
3530         (foo):
3531         (boo):
3532         (boo.let.val2):
3533         (boo.let.val3):
3534         * stress/eval-func-decl-in-frozen-global.js: Added.
3535         (assert):
3536         (assertThrow):
3537         (throw.new.Error):
3538         (Object.freeze):
3539         * stress/eval-func-decl-in-global-of-eval.js: Added.
3540         (assert):
3541         (assertThrow):
3542         (bar):
3543         (baz):
3544         (foobar):
3545         * stress/eval-func-decl-in-global.js: Added.
3546         (assert):
3547         (assertThrow):
3548         * stress/eval-func-decl-in-if.js: Added.
3549         (assert):
3550         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
3551         (assert):
3552         (assertThrow):
3553         (foo):
3554         (boo):
3555         (foobar):
3556         (hoo):
3557         (joo):
3558         (koo):
3559         (loo):
3560         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
3561         (assert):
3562         (assertThrow):
3563         (foo):
3564         (boo):
3565         (goo):
3566         * stress/variable-under-tdz-eval-tricky.js:
3567         (assert):
3568         * test262.yaml:
3569
3570 2017-04-27  Mark Lam  <mark.lam@apple.com>
3571
3572         Fix some RELEASE_ASSERT failures caused by OutOfMemoryErrors.
3573         https://bugs.webkit.org/show_bug.cgi?id=171404
3574         <rdar://problem/31876178>
3575
3576         Reviewed by Saam Barati.
3577
3578         * stress/js-fixed-array-out-of-memory.js: Added.
3579
3580 2017-04-27  David Kilzer  <ddkilzer@apple.com>
3581
3582         Enhance shouldBe()/shouldNotBe() to accept anonymous function arguments
3583         <https://webkit.org/b/171362>
3584         <rdar://problem/31867686>
3585
3586         Reviewed by Joseph Pecoraro.
3587
3588         * stress/resources/standalone-pre.js:
3589         (shouldBe):
3590         (shouldNotThrow):
3591         (shouldThrow):
3592         - Update shouldBe() to accept anonymous function arguments.
3593           (The shouldNotBe() function was never copied over.)
3594         - Also fix shouldThrow()/shouldNotThrow() to accept anonymous
3595           function arguments (which were missed in r202609 for Bug
3596           159232).
3597
3598 2017-04-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3599
3600         [JSC] Handle PhantomSpread in LoadVarargs as the same to the others
3601         https://bugs.webkit.org/show_bug.cgi?id=171262
3602
3603         Reviewed by Saam Barati.
3604
3605         * stress/spread-outer-create-rest.js: Added.
3606         (assert):
3607         (foo):
3608         (bar):
3609         (baz):
3610
3611 2017-04-26  Saam Barati  <sbarati@apple.com>
3612
3613         Print Wasm function index in stack trace
3614         https://bugs.webkit.org/show_bug.cgi?id=171349
3615
3616         Reviewed by JF Bastien.
3617
3618         * wasm/function-tests/stack-trace.js: Added.
3619         (import.Builder.from.string_appeared_here.assert):
3620         (let.imp):
3621         * wasm/function-tests/trap-after-cross-instance-call.js:
3622         (wasmFrameCountFromError):
3623         * wasm/function-tests/trap-load-2.js:
3624         (wasmFrameCountFromError):
3625         * wasm/function-tests/trap-load.js:
3626         (wasmFrameCountFromError):
3627
3628 2017-04-26  Saam Barati  <sbarati@apple.com>
3629
3630         ASSERTION FAILED: inIndex != notFound in JSC::invalidParameterInSourceAppender()
3631         https://bugs.webkit.org/show_bug.cgi?id=170924
3632         <rdar://problem/31721052>
3633
3634         Reviewed by Mark Lam.
3635
3636         * stress/error-message-for-function-base-not-found.js: Added.
3637         (assert):
3638         (throw.new.Error):
3639         * stress/error-messages-for-in-operator-should-not-crash.js: Added.
3640         (catch):
3641
3642 2017-04-26  Keith Miller  <keith_miller@apple.com>
3643
3644         WebAssembly: Implement tier up
3645         https://bugs.webkit.org/show_bug.cgi?id=170134
3646
3647         Reviewed by Filip Pizlo.
3648
3649         * wasm/function-tests/trap-after-cross-instance-call.js:
3650         * wasm/tier-up/js-to-wasm.js: Added.
3651         (async.test):
3652         * wasm/tier-up/wasm-to-wasm.js: Added.
3653         (async.test):
3654
3655 2017-04-26  Caitlin Potter  <caitp@igalia.com>
3656
3657         [JSC] Object.keys() must discard property names with no PropertyDescriptor
3658         https://bugs.webkit.org/show_bug.cgi?id=171291
3659
3660         Reviewed by Yusuke Suzuki.
3661
3662         * es6/Proxy_ownKeys_duplicates.js:
3663         * stress/proxy-own-keys.js:
3664         (let.handler.getOwnPropertyDescriptor):
3665         (let.handler.ownKeys):
3666
3667 2017-04-25  Commit Queue  <commit-queue@webkit.org>
3668
3669         Unreviewed, rolling out r215476.
3670         https://bugs.webkit.org/show_bug.cgi?id=171304
3671
3672         "It broke JSBench" (Requested by saamyjoon on #webkit).
3673
3674         Reverted changeset:
3675
3676         "[ES6]. Implement Annex B.3.3 function hoisting rules for
3677         eval"
3678         https://bugs.webkit.org/show_bug.cgi?id=163208
3679         http://trac.webkit.org/changeset/215476
3680
3681 2017-04-25  Saam Barati  <sbarati@apple.com>
3682
3683         JSArray::isArrayPrototypeIteratorProtocolFastAndNonObservable is wrong because it does not do the necessary checks on the base object
3684         https://bugs.webkit.org/show_bug.cgi?id=171150
3685         <rdar://problem/31771880>
3686
3687         Reviewed by Sam Weinig.
3688
3689         * stress/spread-optimized-properly.js: Added.
3690         (assert):
3691         (test):
3692         (shallowEq):
3693         (makeArrayIterator):
3694         (test.bar):
3695         (test.callback):
3696         (test.arr.__proto__.Symbol.iterator):
3697         (test.arr.Symbol.iterator):
3698         (test.get bar):
3699         (test.hackedNext):
3700         (test.test):
3701         (test.):
3702
3703 2017-04-25  Mark Lam  <mark.lam@apple.com>
3704
3705         [Follow up] Array.prototype.slice() should ensure that end >= begin.
3706         https://bugs.webkit.org/show_bug.cgi?id=170989
3707         <rdar://problem/31705652>
3708
3709         Not reviewed.
3710
3711         Follow up to rename a test file that was accidentally named wrongly.
3712
3713         * stress/regress-170989.js: Copied from JSTests/stress/regress-170989.patch.
3714         * stress/regress-170989.patch: Removed.
3715
3716 2017-04-25  Mark Lam  <mark.lam@apple.com>
3717
3718         Array.prototype.slice() should ensure that end >= begin.
3719         https://bugs.webkit.org/show_bug.cgi?id=170989
3720         <rdar://problem/31705652>
3721
3722         Reviewed by Saam Barati.
3723
3724         * stress/regress-170989.patch: Added.
3725
3726 2017-04-25  Mark Lam  <mark.lam@apple.com>
3727
3728         Local CSE wrongly CSEs array accesses with different result types.
3729         https://bugs.webkit.org/show_bug.cgi?id=170990
3730         <rdar://problem/31705945>
3731
3732         Reviewed by Saam Barati.
3733
3734         * stress/regress-170990.js: Added.
3735
3736 2017-04-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3737
3738         WebAssembly: exporting a property with a name that's a number doesn't work
3739         https://bugs.webkit.org/show_bug.cgi?id=168857
3740
3741         Reviewed by JF Bastien.
3742
3743         r213453 allows Wasm instances to expose indexed properties. We activate the tests.
3744
3745         * wasm/js-api/test_Instance.js:
3746         (ExportedNumber):
3747
3748 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3749
3750         test262: test262/test/language/expressions/object/method-definition/early-errors-object-method-duplicate-parameters.js
3751         https://bugs.webkit.org/show_bug.cgi?id=171190
3752
3753         Reviewed by Saam Barati.
3754
3755         * stress/async-await-syntax.js:
3756         * test262.yaml:
3757
3758 2017-04-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3759
3760         [JSC] Use JSFixedArray directly when using call_varargs
3761         https://bugs.webkit.org/show_bug.cgi?id=171057
3762
3763         Reviewed by Saam Barati.
3764
3765         * stress/spread-capture-rest.js: Added.
3766         (shouldBe):
3767         (capture):
3768   &