Merge the latest version of Speedometer 2.0 to browserbench.org against at r221056.
[WebKit-https.git] / JSTests / ChangeLog
1 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
2
3         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
4         https://bugs.webkit.org/show_bug.cgi?id=172543
5
6         Unreviewed test gardening.
7
8         * microbenchmarks/generator-with-several-types.js:
9
10 2017-08-17  JF Bastien  <jfbastien@apple.com>
11
12         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
13         https://bugs.webkit.org/show_bug.cgi?id=175693
14         <rdar://problem/33952443>
15
16         Reviewed by Saam Barati.
17
18         Add a regression directory for WebAssembly tests.
19
20         * wasm.yaml:
21         * wasm/regress/175693.js: Added.
22         (else.else):
23         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
24         (catch):
25         * wasm/regress/175693.wasm: Added.
26
27 2017-08-15  Robin Morisset  <rmorisset@apple.com>
28
29         Support the 'with' keyword in FTL.
30         https://bugs.webkit.org/show_bug.cgi?id=175585
31
32         Reviewed by Saam Barati.
33
34         Also improve the JSTest/stress/with.js file to test
35         what happens when non-objects are passed to with.
36
37         * stress/with.js:
38         (foo):
39         (i.catch):
40         (i.with): Deleted.
41
42 2017-08-14  Keith Miller  <keith_miller@apple.com>
43
44         Add testing tool to lie to the DFG about profiles
45         https://bugs.webkit.org/show_bug.cgi?id=175487
46
47         Reviewed by Saam Barati.
48
49         * stress/compare-eq-incomplete-profile.js: Added.
50         (const.test.createBuiltin):
51
52 2017-08-14  Robin Morisset  <rmorisset@apple.com>
53
54         Support the with keyword in DFG
55         https://bugs.webkit.org/show_bug.cgi?id=175470
56
57         Reviewed by Saam Barati.
58
59         Added a new stress-test for the 'with' keyword, that caught a bug in a
60         previous version of this code.
61
62         * stress/with.js: Added.
63         (i.with):
64
65 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
66
67         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
68         https://bugs.webkit.org/show_bug.cgi?id=175544
69
70         Unreviewed test gardening.
71
72         * ChakraCore.yaml:
73
74 2017-08-09  Caitlin Potter  <caitp@igalia.com>
75
76         Early error on ANY operator before new.target
77         https://bugs.webkit.org/show_bug.cgi?id=157970
78
79         Reviewed by Saam Barati.
80
81         Instead of throwing if any unary operator precedes new.target, only
82         throw if the unary operator updates the reference.
83
84         The following become legal in JSC:
85
86         ```
87         !new.target
88         ~new.target
89         typeof new.target
90         delete new.target
91         void new.target
92         ```
93
94         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
95
96         * stress/new-target-syntax-errors.js:
97         * stress/new-target.js:
98
99 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
100
101         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
102         https://bugs.webkit.org/show_bug.cgi?id=175255
103
104         Unreviewed test gardening.
105
106         * stress/regress-169783.js:
107         * wasm/stress/oom.js:
108
109 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
110
111         REGRESSION: 2 test262/test/language/statements/async-function failures
112         https://bugs.webkit.org/show_bug.cgi?id=175334
113
114         Reviewed by Yusuke Suzuki.
115
116         Add @skip parameters to tests, and remove test for async iterator from 
117         async await syntax test because it is already covered by async-iterator-syntax.js
118
119         * stress/async-await-syntax.js:
120         * stress/async-iteration-syntax.js:
121
122 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
123
124         Unreviewed, gardening test262 for Promise resolve / reject function length
125         https://bugs.webkit.org/show_bug.cgi?id=175333
126
127         * test262.yaml:
128
129 2017-08-07  Robin Morisset  <rmorisset@apple.com>
130
131         GetOwnProperty of TypedArray indexed fields is wrongly configurable
132         https://bugs.webkit.org/show_bug.cgi?id=175307
133
134         Reviewed by Saam Barati.
135
136         * stress/typedarray-getownproperty-not-configurable.js: Added.
137         (assert):
138         (foo):
139
140 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
141
142         Promise resolve and reject function should have length = 1
143         https://bugs.webkit.org/show_bug.cgi?id=175242
144
145         Reviewed by Saam Barati.
146
147         * stress/builtin-function-length.js: Added.
148         (shouldBe):
149         (shouldThrow):
150         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
151         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
152
153 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
154
155         [ESNext] Async iteration - Implement Async Generator - parser
156         https://bugs.webkit.org/show_bug.cgi?id=175210
157
158         Reviewed by Yusuke Suzuki.
159
160         * stress/async-await-syntax.js:
161         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
162         * stress/async-iteration-syntax.js: Added.
163         (assert):
164         (checkSyntax):
165         (checkSyntaxError):
166         (checkSimpleAsyncGeneratorSloppyMode):
167         (checkSimpleAsyncGeneratorStrictMode):
168         (checkNestedAsyncGenerators):
169         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
170         * stress/generator-class-methods-syntax.js:
171
172 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
173
174         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
175         https://bugs.webkit.org/show_bug.cgi?id=175150
176
177         Unreviewed test gardening.
178
179         * wasm/js-api/test_memory_constructor.js:
180
181 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
182
183         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
184         https://bugs.webkit.org/show_bug.cgi?id=175100
185
186         Reviewed by Mark Lam.
187
188         The JSC test JSTests/wasm/stress/oom.js tries to use all the
189         available memory until an out of memory exception happens.
190
191         The Linux kernel is more tuned for server workloads than for GUI
192         responsiveness. When a process tries to use a lot of memory, Linux
193         will do its best to serve the request. This usually translates to
194         free physical RAM by writing to disk dirty pages and/or moving out
195         less recently used pages to swap (disk storage).
196         Meanwhile it does this, the system will become unresponsive and this
197         leads to freezes that can last even some minutes on the worst cases.
198
199         Therefore, let's skip this test on Linux as it will cause more harm
200         than good on the Linux bots or on the machines of Linux developers.
201
202         * wasm/stress/oom.js:
203
204 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
205
206         [JSC] Remove unnecessary print from stress\promise-finally.js test
207         https://bugs.webkit.org/show_bug.cgi?id=175015
208
209         Reviewed by Yusuke Suzuki.
210
211         * stress/promise-finally.js:
212         (p.finally):
213         (then):
214
215 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
216
217         Unreviewed, update test262 results for optional catch binding
218
219         * test262.yaml:
220
221 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
222
223         [JSC] Support optional catch binding
224         https://bugs.webkit.org/show_bug.cgi?id=174981
225
226         Reviewed by Saam Barati.
227
228         * stress/optional-catch-binding-syntax.js: Added.
229         (testSyntax):
230         (testSyntaxError):
231         (catch.catch):
232         * stress/optional-catch-binding.js: Added.
233         (shouldBe):
234         (throwException):
235
236 2017-07-28  Mark Lam  <mark.lam@apple.com>
237
238         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
239         https://bugs.webkit.org/show_bug.cgi?id=174948
240         <rdar://problem/33495680>
241
242         Reviewed by Filip Pizlo.
243
244         * stress/regress-174948.js: Added.
245
246 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
247
248         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
249         https://bugs.webkit.org/show_bug.cgi?id=174900
250
251         Reviewed by Saam Barati.
252
253         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
254         (sideEffect):
255         (args):
256         (test):
257
258 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
259
260         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
261         https://bugs.webkit.org/show_bug.cgi?id=171637
262
263         Reviewed by Darin Adler.
264
265         * stress/domjit-getter-complex-with-incorrect-object.js:
266         (i.shouldThrow):
267         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
268         (shouldBe):
269         (i.shouldThrow):
270
271 2017-07-26  JF Bastien  <jfbastien@apple.com>
272
273         WebAssembly: test throwing out of the start function
274         https://bugs.webkit.org/show_bug.cgi?id=165714
275         <rdar://problem/29760251>
276
277         Reviewed by Keith Miller.
278
279         * wasm/assert.js:
280         * wasm/function-tests/trap-from-start.js: Added.
281         (StartTraps):
282         * wasm/function-tests/trap-from-start-async.js: Added.
283         (async.StartTrapsAsync):
284
285 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
286
287         [FTL] Arguments elimination is suppressed by unreachable blocks
288         https://bugs.webkit.org/show_bug.cgi?id=174352
289
290         Reviewed by Filip Pizlo.
291
292         * stress/arguments-elimination-force-exit.js: Added.
293         (shouldBe):
294         (strict):
295         (sloppy):
296         * stress/arguments-elimination-throw.js: Added.
297         (shouldBe):
298         (shouldThrow):
299         (sloppy):
300         (isArguments):
301
302 2017-07-13  Mark Lam  <mark.lam@apple.com>
303
304         Add some additional test cases for bug 170896.
305         https://bugs.webkit.org/show_bug.cgi?id=174491
306
307         Reviewed by Filip Pizlo.
308
309         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
310         * stress/regress-170896-with-double-shape-profile.js: Added.
311         (test):
312         * stress/regress-170896-with-int32-shape-profile.js: Added.
313         (test):
314         * stress/regress-170896.js: Removed.
315
316 2017-07-13  Saam Barati  <sbarati@apple.com>
317
318         Missing exception check in JSObject::hasInstance
319         https://bugs.webkit.org/show_bug.cgi?id=174455
320         <rdar://problem/31384608>
321
322         Reviewed by Mark Lam.
323
324         * stress/has-instance-exception-check.js: Added.
325         (assert):
326         (let.getter.Object.getOwnPropertyDescriptor.get foo):
327
328 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
329
330         [ESnext] Implement Object Spread
331         https://bugs.webkit.org/show_bug.cgi?id=167963
332
333         Reviewed by Saam Barati.
334
335         * stress/obj-rest-destructuring-order.js: Added.
336         (assert):
337         (o.get z):
338         (o.get a):
339         * stress/obj-spread-order.js: Added.
340         (assert):
341         (o.get z):
342         (o.get a):
343         * stress/object-spread.js: Added.
344         (let.assert):
345         (assert.sameValue):
346         (let.o.get a):
347         (let.obj.get c):
348         (cthulhu.get x):
349         (let.obj.set c):
350         (calls.o.get z):
351         (calls.o.get a):
352         (try.let.obj.get foo):
353         (get calls):
354
355 2017-07-12  Saam Barati  <sbarati@apple.com>
356
357         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
358         https://bugs.webkit.org/show_bug.cgi?id=174411
359         <rdar://problem/31696186>
360
361         Reviewed by Mark Lam.
362
363         * stress/generic-arguments-correct-delete-behavior.js: Added.
364         (assert):
365         (makeTest):
366
367 2017-07-07  Mark Lam  <mark.lam@apple.com>
368
369         \n\r is not the same as \r\n.
370         https://bugs.webkit.org/show_bug.cgi?id=173053
371
372         Reviewed by Keith Miller.
373
374         * stress/regress-173053.js: Added.
375         * stress/template-literal-line-terminators.js:
376
377 2017-07-06  Saam Barati  <sbarati@apple.com>
378
379         We are missing places where we invalidate the for-in context
380         https://bugs.webkit.org/show_bug.cgi?id=174184
381
382         Reviewed by Geoffrey Garen.
383
384         * stress/for-in-invalidate-context-weird-assignments.js: Added.
385         (assert):
386         (test):
387
388 2017-07-05  Saam Barati  <sbarati@apple.com>
389
390         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
391         https://bugs.webkit.org/show_bug.cgi?id=174188
392         <rdar://problem/30581423>
393
394         Reviewed by Mark Lam.
395
396         * stress/new-array-having-a-bad-time-double.js: Added.
397         (assert):
398         (foo):
399
400 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
401
402         WTF::StringImpl::copyChars segfaults when built with GCC 7
403         https://bugs.webkit.org/show_bug.cgi?id=173407
404
405         Reviewed by Andreas Kling.
406
407         * stress/string-repeat-copy-chars-crash.js: Added.
408         (shouldBe):
409
410 2017-07-03  Saam Barati  <sbarati@apple.com>
411
412         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
413
414         * stress/unshiftCountSlowCase-correct-postCapacity.js:
415
416 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
417
418         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
419
420         It requires too much memory.
421
422         * stress/dont-reserve-huge-capacity-lexer.js:
423
424 2017-06-30  Michael Saboff  <msaboff@apple.com>
425
426         Skip a test on ARM64 platform since we run out of address space.
427
428         Rubber stamped by Saam Barati.
429
430         * stress/dont-reserve-huge-capacity-lexer.js:
431
432 2017-06-30  Michael Saboff  <msaboff@apple.com>
433
434         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
435         https://bugs.webkit.org/show_bug.cgi?id=174044
436
437         Reviewed by Oliver Hunt.
438
439         New regression test.
440
441         * stress/regress-174044.js: Added.
442         (test1):
443         (test2):
444
445 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
446
447         RegExpCachedResult::setInput should reify left and right contexts
448         https://bugs.webkit.org/show_bug.cgi?id=173818
449
450         Reviewed by Keith Miller.
451
452         * stress/right-left-context-invalidated-by-input.js: Added.
453         (test.validateContexts):
454         (test):
455
456 2017-06-29  Saam Barati  <sbarati@apple.com>
457
458         Calculating postCapacity in unshiftCountSlowCase is wrong
459         https://bugs.webkit.org/show_bug.cgi?id=173992
460         <rdar://problem/32283199>
461
462         Reviewed by Keith Miller.
463
464         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
465         (temp):
466
467 2017-06-29  Commit Queue  <commit-queue@webkit.org>
468
469         Unreviewed, rolling out r218512.
470         https://bugs.webkit.org/show_bug.cgi?id=173981
471
472         "It changes the behavior of the JS API's JSEvaluateScript
473         which breaks TurboTax" (Requested by saamyjoon on #webkit).
474
475         Reverted changeset:
476
477         "test262: Completion values for control flow do not match the
478         spec"
479         https://bugs.webkit.org/show_bug.cgi?id=171265
480         http://trac.webkit.org/changeset/218512
481
482 2017-06-27  JF Bastien  <jfbastien@apple.com>
483
484         WebAssembly: running out of executable memory should throw OoM
485         https://bugs.webkit.org/show_bug.cgi?id=171537
486         <rdar://problem/32963338>
487
488         Reviewed by Saam Barati.
489
490         * wasm.yaml:
491         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
492         (const.invoke):
493         (failCount.0.catch):
494         (failCount.0.module.undefined.catch):
495         * wasm/lowExecutableMemory/exports-oom.js: Added.
496         (const.type):
497         (const.params):
498         (const.randomProgram):
499         (failCount.0.catch):
500         (failCount.0.module.undefined.catch):
501         * wasm/lowExecutableMemory/imports-oom.js: Added.
502         (const.type):
503         (const.params):
504         (const.randomProgram):
505         (f.imports.push):
506         (failCount.0.catch):
507         (failCount.0.module.undefined.catch):
508
509 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
510
511         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
512         https://bugs.webkit.org/show_bug.cgi?id=167962
513
514         Reviewed by Saam Barati.
515
516         * stress/object-rest-deconstruct.js: Added.
517         (let.assert):
518         (let.assertPropDescriptor):
519         (catch):
520         (get 3):
521         (foo):
522         (let.src.get y):
523         (let.src.set y):
524         (let.gen):
525
526 2017-06-27  Saam Barati  <sbarati@apple.com>
527
528         Function constructor needs to follow the spec and validate parameters and body independently
529         https://bugs.webkit.org/show_bug.cgi?id=173303
530         <rdar://problem/32732526>
531
532         Reviewed by Keith Miller.
533
534         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
535         * stress/function-constructor-semantics.js: Added.
536         (assert):
537         (hasSyntaxError):
538         (foo):
539         (async.foo):
540         (testError):
541         (testOK.toString):
542         (toString):
543
544 2017-06-26  Saam Barati  <sbarati@apple.com>
545
546         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
547         https://bugs.webkit.org/show_bug.cgi?id=173740
548
549         Reviewed by Mark Lam.
550
551         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
552         (Array.prototype.Symbol.iterator):
553
554 2017-06-26  Saam Barati  <sbarati@apple.com>
555
556         Skip a test on 32-bit platforms since we run out of address space.
557
558         Rubber stamped by Mark Lam.
559
560         * stress/dont-reserve-huge-capacity-lexer.js:
561
562 2017-06-26  Saam Barati  <sbarati@apple.com>
563
564         Crash in JSC::Lexer<unsigned char>::setCode
565         https://bugs.webkit.org/show_bug.cgi?id=172754
566
567         Reviewed by Mark Lam.
568
569         * stress/dont-reserve-huge-capacity-lexer.js: Added.
570         (catch):
571
572 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
573
574         [JSC] Clean up Object.entries implementation
575         https://bugs.webkit.org/show_bug.cgi?id=173759
576
577         Reviewed by Sam Weinig.
578
579         * microbenchmarks/object-entries.js: Added.
580         (test):
581
582 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
583
584         Remove Reflect.enumerate
585         https://bugs.webkit.org/show_bug.cgi?id=173806
586
587         Reviewed by Yusuke Suzuki.
588
589         * ChakraCore.yaml:
590         * es6.yaml:
591         These tests now fail because they use Reflect.enumerate.
592
593         * test262.yaml:
594         This test now passes, it checked that Reflect.enumerate is undefined!
595
596         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
597         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
598
599         * stress/reflect-enumerate.js: Removed.
600         Remove a test solely for Reflect.enumerate.
601
602 2017-06-22  Saam Barati  <sbarati@apple.com>
603
604         ValueRep(DoubleRep(@v)) can not simply convert to @v
605         https://bugs.webkit.org/show_bug.cgi?id=173687
606         <rdar://problem/32855563>
607
608         Reviewed by Mark Lam.
609
610         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
611         (i.catch):
612
613 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
614
615         [JSC] Object.values should be implemented in C++
616         https://bugs.webkit.org/show_bug.cgi?id=173703
617
618         Reviewed by Sam Weinig.
619
620         * microbenchmarks/object-keys-map-values.js: Added.
621         (test):
622         * microbenchmarks/object-values.js: Added.
623         (test):
624         * stress/object-values-changing-properties.js: Added.
625         (shouldBe):
626         (throw.new.Error.let.source.get x):
627         (throw.new.Error):
628         (shouldBe.let.handler.get order):
629         (get let):
630         (shouldBe.let.handler.get return):
631         (let.handler.get order):
632
633 2017-06-21  Saam Barati  <sbarati@apple.com>
634
635         eval virtual call is incorrect in the baseline JIT
636         https://bugs.webkit.org/show_bug.cgi?id=173587
637         <rdar://problem/32867897>
638
639         Reviewed by Michael Saboff.
640
641         * stress/do-eval-virtual-call-correctly.js: Added.
642         (assert):
643         (f):
644         (i.test):
645         (catch):
646
647 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
648
649         Update test262 test expectations after r218581.
650
651         Unreviewed test gardening.
652
653         * test262.yaml:
654
655 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
656
657         Revert changes in bug#160417 about extending `null` not being a derived class
658         https://bugs.webkit.org/show_bug.cgi?id=169293
659
660         Reviewed by Saam Barati.
661
662         * stress/class-derived-from-null.js:
663         (assertThrow):
664         (test1):
665         (test2):
666         (test3):
667         (test4):
668         (test5):
669         (test6):
670
671 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
672
673         [DFG] More ArrayIndexOf fixups for various types
674         https://bugs.webkit.org/show_bug.cgi?id=173176
675
676         Reviewed by Saam Barati.
677
678         * stress/array-indexof-arraystorage.js: Added.
679         (shouldBe):
680         (indexOfInt32Other):
681         (indexOfInt32Cell):
682         (indexOfInt32Boolean):
683         (indexOfDoubleOther):
684         (indexOfDoubleCell):
685         (indexOfDoubleBoolean):
686         (indexOfInt32):
687         (indexOfDouble):
688         * stress/array-indexof-constant-folding.js: Added.
689         (shouldBe):
690         (indexOfInt32Other):
691         (indexOfInt32Cell):
692         (indexOfInt32Boolean):
693         (indexOfDoubleOther):
694         (indexOfDoubleCell):
695         (indexOfDoubleBoolean):
696         * stress/array-indexof-hole-and-other.js: Added.
697         (shouldBe):
698         (indexOf):
699         * stress/array-indexof-other.js: Added.
700         (shouldBe):
701         (indexOfInt32):
702         (indexOfDouble):
703         (indexOfString):
704         (indexOfObject):
705         * stress/array-indexof-symbol.js: Added.
706         (shouldBe):
707         (indexOfInt32):
708         (indexOfDouble):
709         (indexOfString):
710         (indexOfObject):
711
712 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
713
714         test262: Completion values for control flow do not match the spec
715         https://bugs.webkit.org/show_bug.cgi?id=171265
716
717         Reviewed by Saam Barati.
718
719         * stress/completion-value.js:
720         Condensed test for completion values in top level statements.
721
722         * stress/super-get-by-id.js:
723         ClassDeclaration when evaled no longer produce values. Convert
724         these to ClassExpressions so they produce the class value.
725         
726         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
727         This is a progression for currect spec behavior.
728
729         * mozilla/mozilla-tests.yaml:
730         This test is now outdated, so mark it as failing for that reason.
731
732         * test262.yaml:
733         Passing all "cptn" completion value tests.
734
735 2017-06-17  Keith Miller  <keith_miller@apple.com>
736
737         ArrayBuffer constructor needs to create subclass structures before its buffer
738         https://bugs.webkit.org/show_bug.cgi?id=173510
739
740         Reviewed by Yusuke Suzuki.
741
742         * test262.yaml:
743
744 2017-06-17  Keith Miller  <keith_miller@apple.com>
745
746         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
747         https://bugs.webkit.org/show_bug.cgi?id=173506
748
749         Reviewed by Ryosuke Niwa.
750
751         Re-baseline tests.
752
753         * ChakraCore/test/Function/apply3.baseline-jsc:
754         * test262.yaml:
755
756 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
757
758         [JSC] Add fast path for Object.assign
759         https://bugs.webkit.org/show_bug.cgi?id=173416
760
761         Reviewed by Mark Lam.
762
763         * stress/object-assign-changing-properties.js: Added.
764         (shouldBe):
765         (throw.new.Error.let.source.get x):
766         (throw.new.Error):
767         (shouldBe.let.source.get x):
768         (shouldBe.let.target.set x):
769         (shouldBe.let.target.get x):
770         * stress/object-assign-proxy.js: Added.
771         (shouldBe):
772         (throw.new.Error.let.handler.get order):
773
774 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
775
776         [JSC] Implement Object.assign in C++
777         https://bugs.webkit.org/show_bug.cgi?id=173414
778
779         Reviewed by Saam Barati.
780
781         * stress/object-assign-string-first.js: Added.
782         (shouldBe):
783         (source.get Symbol):
784         (source.get 1):
785         (source.get cocoa):
786
787 2017-06-14  JF Bastien  <jfbastien@apple.com>
788
789         WebAssembly: remove empty test files
790         https://bugs.webkit.org/show_bug.cgi?id=173382
791
792         Reviewed by Saam Barati.
793
794         The following files:
795                 JSTests/wasm/function-tests/call-indirect-params.js
796                 JSTests/wasm/function-tests/call-indirect.js
797                 JSTests/wasm/js-api/call-indirect-results.js
798         Were changed to empty files in https://trac.webkit.org/changeset/209771
799
800         They were testing call_indirect with the wrong semantics, before
801         we implemented tables. That change implemented tables and
802         therefore removed the erroneous tests.
803
804         We have a few tests for call_indirect which already do the right thing:
805                 JSTests/wasm/function-tests/context-switch.js
806                 JSTests/wasm/function-tests/exceptions.js
807                 JSTests/wasm/function-tests/grow-memory-2.js
808                 JSTests/wasm/function-tests/stack-overflow.js
809                 JSTests/wasm/function-tests/table-basic-2.js
810                 JSTests/wasm/function-tests/table-basic.js
811                 JSTests/wasm/js-api/call-indirect.js
812                 JSTests/wasm/js-api/table.js
813                 JSTests/wasm/js-api/unique-signature.js
814                 JSTests/wasm/js-api/wrapper-function.js
815
816         I also just imported the updated spec tests which, among other
817         things, test call_indirect:
818                 core/br.wast
819                 core/br_table.wast
820                 core/call_indirect.wast
821                 core/func.wast
822                 core/func_ptrs.wast
823                 core/imports.wast
824                 core/left-to-right.wast
825                 core/linking.wast
826                 core/nop.wast
827                 core/return.wast
828                 core/typecheck.wast
829                 core/unreachable.wast
830
831         So I think it's OK to just delete the tests which should just have
832         been deleted back when tables were added.
833
834         * wasm/function-tests/call-indirect-params.js: Removed.
835         * wasm/function-tests/call-indirect.js: Removed.
836         * wasm/js-api/call-indirect-results.js: Removed.
837
838 2017-06-13  JF Bastien  <jfbastien@apple.com>
839
840         WebAssembly: import updated spec tests
841         https://bugs.webkit.org/show_bug.cgi?id=173287
842         <rdar://problem/32725975>
843
844         Reviewed by Saam Barati.
845
846         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
847         with a few modifications so things work.
848
849         Fix a bunch of bugs found through this process, and punt a few tests (which I
850         marked as blocked by this bug).
851
852         Fixes:
853
854         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
855         instead of byte alignment. It was also missing memory-alignment.js despite it
856         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
857         pass.
858
859         Tables can be imported or in a section. There can be only one, but sections can
860         be empty. An Elements section can exist if there's no Table, as long as it is
861         also empty.
862
863         Memories can be imported or in a section. There can be only one, but sections
864         can be empty. A Data section can exist if there's no Memory, as long as it is
865         also empty.
866
867         Prototypes: stringify without .prototype. in the string.
868
869         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
870         not a final size, and throws a RangeError on failure, not a TypeError.
871
872         Fix compile / instantiate so the reject the promise if given an argument of the
873         wrong type (instead of failing instantly).
874
875         Fix async on neuter test.
876
877         Element section shouldn't affect any Table if any of the elements are out of
878         bounds. We need to process it in two passes.
879
880         Segment section shouldn't affect any Data if any of the segments are out of
881         bounds. We need to process it in two passes.
882
883         Empty data segments are valid, but only when there is no memory. Their index
884         still gets validated, and has to be zero.
885
886         Punts:
887
888         Error messages with context, the test seems overly restrictive but this is
889         minor.
890
891         compile/instantiate/validate property descriptors.
892
893         UTF-8 bugs.
894
895         Temporarily disable NaN tests. We need to go back and implement the following
896         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
897         much as getting all the other tests passing.
898
899         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
900         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
901         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
902         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
903         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
904         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
905         why they're not allowed.
906
907         * wasm.yaml:
908         * wasm/function-tests/i32-load8-s.js:
909         * wasm/function-tests/memory-access-past-4gib.js:
910         (const.op.of.WASM.opcodes):
911         * wasm/function-tests/memory-alignment.js: Added.
912         (const.op.of.WASM.opcodes):
913         * wasm/function-tests/memory-section-and-import.js:
914         * wasm/js-api/Module-compile.js:
915         (async.testPromiseAPI):
916         * wasm/js-api/dont-mmap-zero-byte-memory.js:
917         (testMems):
918         * wasm/js-api/element.js:
919         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
920         * wasm/js-api/neutered-inputs.js:
921         (const.testFunction): Deleted.
922         (const.testConstructor): Deleted.
923         * wasm/js-api/table.js:
924         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
925         (new.WebAssembly.Module):
926         (assert.throws):
927         (assertBadTableImport):
928         (assert.throws.WebAssembly.Table.prototype.grow):
929         (assertBadTableInstance): Deleted.
930         * wasm/js-api/test_Data.js:
931         (DataSectionWithoutMemory):
932         * wasm/spec-harness/index.js:
933         (module):
934         (uniqueTest): Deleted.
935         (assert_invalid): Deleted.
936         (assert_soft_invalid): Deleted.
937         (register): Deleted.
938         (call): Deleted.
939         (get instance): Deleted.
940         (exports): Deleted.
941         (run): Deleted.
942         (assert_unlinkable): Deleted.
943         (assert_uninstantiable): Deleted.
944         (assert_trap): Deleted.
945         (try.f): Deleted.
946         (catch): Deleted.
947         (assert_exhaustion): Deleted.
948         (assert_return): Deleted.
949         (assert_return_nan): Deleted.
950         * wasm/spec-harness/testharness.css: Removed.
951         * wasm/spec-harness/testharness.js: Removed.
952         * wasm/spec-harness/testharnessreport.js: Removed.
953         * wasm/spec-harness/wasm-constants.js:
954         (assertTraps):
955         (assertWasmThrows):
956         * wasm/spec-harness/wasm-module-builder.js:
957         (Binary.prototype.emit_section):
958         (Binary):
959         (WasmFunctionBuilder.prototype.addBody):
960         (WasmFunctionBuilder.prototype.end):
961         (WasmFunctionBuilder):
962         (WasmModuleBuilder.prototype.stringToBytes):
963         (WasmModuleBuilder.prototype.addCustomSection):
964         (WasmModuleBuilder.prototype.addFunctionTableInit):
965         (WasmModuleBuilder.prototype.appendToTable):
966         (WasmModuleBuilder.prototype.toArray):
967         (WasmModuleBuilder.prototype.toBuffer):
968         (WasmModuleBuilder.prototype.instantiate):
969         (WasmModuleBuilder):
970         * wasm/spec-tests/address.wast.js:
971         * wasm/spec-tests/align.wast.js: Added.
972         * wasm/spec-tests/binary.wast.js:
973         * wasm/spec-tests/block.wast.js:
974         * wasm/spec-tests/br.wast.js:
975         * wasm/spec-tests/br_if.wast.js:
976         * wasm/spec-tests/br_table.wast.js:
977         * wasm/spec-tests/call.wast.js:
978         * wasm/spec-tests/call_indirect.wast.js:
979         * wasm/spec-tests/comments.wast.js:
980         * wasm/spec-tests/const.wast.js: Added.
981         * wasm/spec-tests/conversions.wast.js: Added.
982         * wasm/spec-tests/custom_section.wast.js:
983         * wasm/spec-tests/exports.wast.js:
984         * wasm/spec-tests/f32.wast.js: Added.
985         * wasm/spec-tests/f64.wast.js: Added.
986         * wasm/spec-tests/fac.wast.js:
987         * wasm/spec-tests/float_exprs.wast.js: Added.
988         * wasm/spec-tests/float_misc.wast.js: Added.
989         * wasm/spec-tests/func.wast.js:
990         * wasm/spec-tests/globals.wast.js:
991         * wasm/spec-tests/if.wast.js:
992         * wasm/spec-tests/imports.wast.js:
993         * wasm/spec-tests/inline-module.wast.js: Added.
994         * wasm/spec-tests/jsapi.js:
995         (testJSAPI.test):
996         (testJSAPI):
997         * wasm/spec-tests/labels.wast.js:
998         * wasm/spec-tests/loop.wast.js:
999         * wasm/spec-tests/memory.wast.js:
1000         * wasm/spec-tests/memory_trap.wast.js: Added.
1001         * wasm/spec-tests/names.wast.js:
1002         * wasm/spec-tests/nop.wast.js:
1003         * wasm/spec-tests/return.wast.js:
1004         * wasm/spec-tests/stack.wast.js:
1005         * wasm/spec-tests/token.wast.js: Added.
1006         * wasm/spec-tests/type.wast.js: Added.
1007         * wasm/spec-tests/typecheck.wast.js:
1008         * wasm/spec-tests/unreachable.wast.js:
1009         * wasm/spec-tests/unreached-invalid.wast.js:
1010         * wasm/spec-tests/unwind.wast.js:
1011         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
1012         * wasm/spec-tests/utf8-import-field.wast.js: Added.
1013         * wasm/spec-tests/utf8-import-module.wast.js: Added.
1014
1015 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
1016
1017         Unreviewed JSC test gardening.
1018
1019         * stress/check-string-ident.js:
1020         * stress/new-largeish-contiguous-array-with-size.js:
1021
1022 2017-06-13  Michael Saboff  <msaboff@apple.com>
1023
1024         DFG doesn't properly handle a property that is change to read only in a prototype
1025         https://bugs.webkit.org/show_bug.cgi?id=173321
1026
1027         Reviewed by Filip Pizlo.
1028
1029         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
1030         * stress/regress-173321.js: Added new regression test.
1031         (shouldBe):
1032         (SimpleObject):
1033         (test):
1034
1035 2017-06-12  Saam Barati  <sbarati@apple.com>
1036
1037         Update test262 test expectation since r218082 makes new tests pass.
1038
1039         * test262.yaml:
1040
1041 2017-06-12  Saam Barati  <sbarati@apple.com>
1042
1043         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
1044         https://bugs.webkit.org/show_bug.cgi?id=172957
1045         <rdar://problem/32602704>
1046
1047         Reviewed by Filip Pizlo.
1048
1049         * stress/spec-empty-flows-through-cell-checks.js: Added.
1050         (A):
1051         (B):
1052         (i.catch):
1053
1054 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
1055
1056         We incorrectly allow escaped characters in keyword tokens
1057         https://bugs.webkit.org/show_bug.cgi?id=171310
1058
1059         Reviewed by Yusuke Suzuki.
1060
1061         * stress/destructuring-assignment-syntax.js:
1062         * stress/error-messages-for-in-operator-should-not-crash.js:
1063         (catch):
1064         * stress/reserved-word-with-escape.js:
1065         (testSyntaxError.String.raw.v):
1066         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
1067         (testSyntaxError.String.raw.a):
1068         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
1069
1070 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1071
1072         [DFG] Add ArrayIndexOf intrinsic
1073         https://bugs.webkit.org/show_bug.cgi?id=172421
1074
1075         Reviewed by Saam Barati.
1076
1077         * stress/array-indexof-array-prototype-change.js: Added.
1078         (shouldBe):
1079         (indexOfInt32):
1080         * stress/array-indexof-have-a-bad-time-getter.js: Added.
1081         (shouldBe):
1082         (indexOfInt32):
1083         * stress/array-indexof-have-a-bad-time.js: Added.
1084         (shouldBe):
1085         (indexOfInt32):
1086         * stress/array-indexof-hole-with-prototype.js: Added.
1087         (shouldBe):
1088         (indexOf):
1089         * stress/array-indexof-hole.js: Added.
1090         (shouldBe):
1091         (indexOf):
1092         * stress/array-indexof-index.js: Added.
1093         (shouldBe):
1094         (indexOfInt32):
1095         (indexOfDouble):
1096         (indexOfString):
1097         (indexOfObject):
1098         (indexOfValue):
1099         * stress/array-indexof-negative-index.js: Added.
1100         (shouldBe):
1101         (indexOfInt32):
1102         (indexOfDouble):
1103         (indexOfString):
1104         (indexOfObject):
1105         (indexOfValue):
1106         * stress/array-indexof-non-int32-start-index.js: Added.
1107         (shouldBe):
1108         (indexOf):
1109         (object.valueOf):
1110         * stress/array-indexof-object-prototype-change.js: Added.
1111         (shouldBe):
1112         (indexOfInt32):
1113         * stress/array-indexof-object.js: Added.
1114         (shouldBe):
1115         (indexOf):
1116         * stress/array-indexof-original-array.js: Added.
1117         (shouldBe):
1118         (indexOfInt32):
1119         * stress/array-indexof-string.js: Added.
1120         (shouldBe):
1121         (indexOf):
1122         * stress/array-indexof-structure-change-convert.js: Added.
1123         (shouldBe):
1124         (indexOf):
1125         * stress/array-indexof-structure-change.js: Added.
1126         (shouldBe):
1127         (indexOf):
1128         * stress/array-indexof.js: Added.
1129         (shouldBe):
1130         (indexOf):
1131
1132 2017-06-11  Keith Miller  <keith_miller@apple.com>
1133
1134         TypedArray constructor with string shouldn't throw
1135         https://bugs.webkit.org/show_bug.cgi?id=173181
1136
1137         Reviewed by JF Bastien.
1138
1139         We should be coercing primitive arguments to numbers in the various
1140         TypedArray constructors.
1141
1142         * stress/typedarray-constructor.js:
1143
1144 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1145
1146         Unreviewed, update test results part 3
1147         https://bugs.webkit.org/show_bug.cgi?id=173227
1148
1149         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
1150
1151 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1152
1153         Unreviewed, update test results part 2
1154         https://bugs.webkit.org/show_bug.cgi?id=173227
1155
1156         * test262.yaml:
1157
1158 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1159
1160         Unreviewed, update test results
1161         https://bugs.webkit.org/show_bug.cgi?id=173227
1162
1163         * microbenchmarks/string-prototype-search-observable-side-effects.js:
1164         * test262.yaml:
1165
1166 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1167
1168         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
1169         https://bugs.webkit.org/show_bug.cgi?id=173227
1170
1171         Reviewed by Mark Lam.
1172
1173         Update the test.
1174
1175         * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
1176
1177 2017-06-08  Keith Miller  <keith_miller@apple.com>
1178
1179         WebAssembly: We should only create wrappers for functions that can be exported
1180         https://bugs.webkit.org/show_bug.cgi?id=173088
1181
1182         Reviewed by Saam Barati.
1183
1184         Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
1185         on the old testWasmModuleFunctions api, which has been removed.
1186
1187         * wasm/function-tests/copysign.js: Removed.
1188         * wasm/function-tests/ctz.js: Removed.
1189         * wasm/function-tests/drop.js: Removed.
1190         * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
1191         * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
1192         * wasm/function-tests/dumb-less-than-ite.js: Removed.
1193         * wasm/function-tests/eqz.js: Removed.
1194         * wasm/function-tests/i32-trunc-s-f32.js: Removed.
1195         * wasm/function-tests/i32-trunc-s-f64.js: Removed.
1196         * wasm/function-tests/i32-trunc-u-f32.js: Removed.
1197         * wasm/function-tests/i32-trunc-u-f64.js: Removed.
1198         * wasm/function-tests/i64-trunc-s-f32.js: Removed.
1199         * wasm/function-tests/i64-trunc-s-f64.js: Removed.
1200         * wasm/function-tests/i64-trunc-u-f32.js: Removed.
1201         * wasm/function-tests/i64-trunc-u-f64.js: Removed.
1202         * wasm/function-tests/if-then-else-fallthrough.js: Removed.
1203         * wasm/function-tests/if-then-fallthrough.js: Removed.
1204         * wasm/function-tests/int-to-floating-point.js: Removed.
1205         * wasm/function-tests/loop-mult.js:
1206         * wasm/function-tests/loop-sum.js:
1207         * wasm/function-tests/max.js: Removed.
1208         * wasm/function-tests/min.js: Removed.
1209         * wasm/function-tests/nearest.js: Removed.
1210         * wasm/function-tests/nop.js: Removed.
1211         * wasm/function-tests/popcnt.js: Removed.
1212         * wasm/function-tests/ret5.js:
1213         * wasm/function-tests/select.js: Removed.
1214         * wasm/function-tests/tee-local.js: Removed.
1215         * wasm/function-tests/trunc.js: Removed.
1216
1217 2017-06-07  JF Bastien  <jfbastien@apple.com>
1218
1219         WebAssembly: test imports and exports with 16-bit characters
1220         https://bugs.webkit.org/show_bug.cgi?id=165977
1221         <rdar://problem/29760130>
1222
1223         Reviewed by Saam Barati.
1224
1225         The output for import failure was improved, so many tests need to
1226         be updated here. Only one has new tests as noted below.
1227
1228         * wasm/function-tests/memory-import-and-grow.js:
1229         * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
1230         (idxModule):
1231         * wasm/js-api/global-error.js:
1232         (new.Number):
1233         (assert.throws):
1234         * wasm/js-api/table.js:
1235         (assert.throws):
1236         (new.WebAssembly.Table):
1237         * wasm/js-api/test_memory.js:
1238         (test):
1239         * wasm/js-api/wasm-to-wasm-bad-signature.js:
1240         (BadSignatureDropStartParams.):
1241         (BadSignatureDropStartParams):
1242         (BadSignatureDropEndParams.):
1243         (BadSignatureSwapParam.):
1244         (BadSignatureRet.):
1245         * wasm/js-api/web-assembly-instantiate.js:
1246         (assert.asyncTest.async.test):
1247         (assert.asyncTest):
1248         * wasm/js-api/wrapper-function.js:
1249         (return.new.WebAssembly.Module):
1250
1251 2017-06-07  Mark Lam  <mark.lam@apple.com>
1252
1253         Restrict the regress-173035.js test to only run on Darwin x86-64.
1254         https://bugs.webkit.org/show_bug.cgi?id=173075
1255
1256         Reviewed by Saam Barati.
1257
1258         This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
1259         this test will require to succeed.  Here's an example of this failure:
1260         https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
1261
1262         Since the issue is due to allocation of a very large amount of memory, the test
1263         will probably fail on iOS and other platforms as well.  Hence, we should just
1264         skip this test for any platforms that is not Darwin x86-64.
1265
1266         * stress/regress-173035.js:
1267
1268 2017-06-07  Mark Lam  <mark.lam@apple.com>
1269
1270         ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
1271         https://bugs.webkit.org/show_bug.cgi?id=168587
1272
1273         Not reviewed.
1274
1275         Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
1276
1277         * stress/test-finally.js:
1278
1279 2017-06-06  Mark Lam  <mark.lam@apple.com>
1280
1281         Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
1282         https://bugs.webkit.org/show_bug.cgi?id=173035
1283         <rdar://problem/32554593>
1284
1285         Reviewed by Geoffrey Garen and Filip Pizlo.
1286
1287         * stress/regress-173035.js: Added.
1288
1289 2017-06-06  Saam Barati  <sbarati@apple.com>
1290
1291         Make sure we restore SP when doing calls that could be to JS
1292         https://bugs.webkit.org/show_bug.cgi?id=172946
1293         <rdar://problem/32579026>
1294
1295         Reviewed by JF Bastien.
1296
1297         * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
1298         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
1299         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
1300         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
1301         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
1302
1303 2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
1304
1305         Unreviewed rollout r217807. Caused a test to crash.
1306
1307         * heapProfiler/class-names.js: Removed.
1308         * heapProfiler/driver/driver.js:
1309         (CheapHeapSnapshotNode):
1310         (CheapHeapSnapshot):
1311         (createCheapHeapSnapshot):
1312         (HeapSnapshot):
1313         (createHeapSnapshot):
1314         * typeProfiler/inheritance.js:
1315         (wrapper.A):
1316         (wrapper.B):
1317         (wrapper.C):
1318         (wrapper):
1319
1320 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
1321
1322         index out of bound in bytecodebasicblock
1323         https://bugs.webkit.org/show_bug.cgi?id=172963
1324
1325         Reviewed by Saam Barati and Mark Lam.
1326
1327         * stress/dfg-call-class-constructor.js: Added.
1328         (Foo):
1329         (i.catch):
1330
1331 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
1332
1333         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
1334         https://bugs.webkit.org/show_bug.cgi?id=172848
1335         <rdar://problem/25709212>
1336
1337         Reviewed by Saam Barati.
1338
1339         * typeProfiler/inheritance.js:
1340         Rewrite the test slightly for clarity. The hoisting was confusing.
1341
1342         * heapProfiler/class-names.js: Added.
1343         (MyES5Class):
1344         (MyES6Class):
1345         (MyES6Subclass):
1346         Test object types and improved class names.
1347
1348         * heapProfiler/driver/driver.js:
1349         (CheapHeapSnapshotNode):
1350         (CheapHeapSnapshot):
1351         (createCheapHeapSnapshot):
1352         (HeapSnapshot):
1353         (createHeapSnapshot):
1354         Update snapshot parsing from version 1 to version 2.
1355
1356 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
1357
1358         ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
1359         https://bugs.webkit.org/show_bug.cgi?id=168844
1360
1361         Reviewed by Saam Barati.
1362
1363         * modules/async-function-export.js: Added.
1364         (f):
1365         (export.async.f):
1366
1367 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
1368
1369         ES2015 modules - Export default function hoisting
1370         https://bugs.webkit.org/show_bug.cgi?id=170174
1371
1372         Reviewed by Saam Barati.
1373
1374         This issue itself is solved by fixing function declaration hoisting rules.
1375         This patch just adds the specific test to modules tests to ensure the bug
1376         is fixed.
1377
1378         * modules/export-default-function-hoisting.js: Added.
1379         * modules/export-default-function-hoisting/cappuccino.js: Added.
1380         (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
1381         * modules/export-default-function-hoisting/cocoa.js: Added.
1382         (export.default.drinkCocoa):
1383
1384 2017-06-01  Oleksandr Skachkov  <gskachkov@gmail.com>
1385
1386         Class Proxy can't be extended
1387         https://bugs.webkit.org/show_bug.cgi?id=169040
1388
1389         Reviewed by Saam Barati.
1390
1391         Adding tests that check correctness of Proxy to ES6 `class`
1392         Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
1393
1394         * stress/proxy-class.js: Added.
1395         (assert):
1396         (throw.new.Error.SuperClass):
1397         (throw.new.Error.A):
1398         (throw.new.Error):
1399
1400 2017-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1401
1402         [JSC] Implement String.prototype.concat in JS builtins
1403         https://bugs.webkit.org/show_bug.cgi?id=172798
1404
1405         Reviewed by Sam Weinig.
1406
1407         * microbenchmarks/string-concat-convert.js: Added.
1408         (test):
1409         * microbenchmarks/string-concat-long-convert.js: Added.
1410         (test):
1411         * microbenchmarks/string-concat-long.js: Added.
1412         (test):
1413         * microbenchmarks/string-concat.js: Added.
1414         (test):
1415
1416 2017-05-31  Oleksandr Skachkov  <gskachkov@gmail.com>
1417
1418         Rolling out: Prevent async methods named 'function'
1419         https://bugs.webkit.org/show_bug.cgi?id=172776
1420
1421         Reviewed by Mark Lam.
1422
1423         * stress/async-await-syntax.js:
1424         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1425         (testTopLevelAsyncAwaitSyntaxSloppyMode):
1426         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
1427         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1428         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
1429
1430 2017-05-31  Ryan Haddad  <ryanhaddad@apple.com>
1431
1432         Skip flaky JSC test stress/test-finally.js
1433         https://bugs.webkit.org/show_bug.cgi?id=168587
1434
1435         Unreviewed test gardening.
1436
1437         * stress/test-finally.js:
1438
1439 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
1440
1441         Prevent async methods named 'function' in Object literal
1442         https://bugs.webkit.org/show_bug.cgi?id=172660
1443
1444         Reviewed by Saam Barati.
1445
1446         * stress/async-await-syntax.js:
1447         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
1448
1449 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
1450
1451         ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
1452         https://bugs.webkit.org/show_bug.cgi?id=171274
1453
1454         Reviewed by Saam Barati.
1455
1456         * stress/async-arrow-functions-lexical-binding-in-class.js:
1457         (shouldBeAsync):
1458         (shouldBeAsyncAndStoreBind):
1459         (promise.new.Promise):
1460         (ChildClass4):
1461         (ChildClass4.prototype.classValue):
1462         (ChildClass4.prototype.get classProperty):
1463         * stress/async-arrow-functions-lexical-super-binding.js:
1464         (A):
1465         (const.childA1.new.prototype.var.f.async):
1466         (const.childA1.new.var):
1467         (const.childA1.new):
1468         (const.childA2.new.prototype.var.f.async):
1469         (const.childA2.new.var):
1470         (const.childA2.new):
1471         (const.childA3.new.prototype.var.f.async):
1472         (const.childA3.new.var):
1473         (const.childA3.new):
1474         (try.childA4.new.prototype.var.f.async):
1475         (try.childA4.new.var):
1476         (try.childA4.new):
1477         (catch):
1478         (const.childA5.new.prototype.var.f.async):
1479         (const.childA5.new.var):
1480         (const.childA5.new):
1481         (checkClass):
1482         (checkClass.new.prototype.var.f.async):
1483         (checkClass.new.var):
1484         (checkClass.new):
1485         (checkClass.new.prototype.method):
1486         (checkClass.new.prototype.prop):
1487
1488 2017-05-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1489
1490         [JSC] Map and Set constructors should have fast path for cloning
1491         https://bugs.webkit.org/show_bug.cgi?id=172413
1492
1493         Reviewed by Saam Barati.
1494
1495         * stress/map-clone-instance-iterator-change.js: Added.
1496         (shouldBe):
1497         (map.Symbol.iterator):
1498         * stress/map-clone-iterator-change.js: Added.
1499         (shouldBe):
1500         (Map.prototype.Symbol.iterator):
1501         * stress/map-clone-next-change.js: Added.
1502         (shouldBe):
1503         (map.Symbol.iterator.__proto__.next):
1504         * stress/map-clone.js: Added.
1505         (shouldBe):
1506         (Map.prototype):
1507         * stress/map-inherit-set.js: Added.
1508         (shouldBe):
1509         (DerivedMap):
1510         (set for):
1511         * stress/set-clone-instance-iterator-change.js: Added.
1512         (shouldBe):
1513         (set Symbol.iterator):
1514         * stress/set-clone-iterator-change.js: Added.
1515         (shouldBe):
1516         (set Set.prototype.Symbol.iterator):
1517         * stress/set-clone-next-change.js: Added.
1518         (shouldBe):
1519         (set Symbol.iterator.__proto__.next):
1520         * stress/set-clone.js: Added.
1521         (shouldBe):
1522         (set Set.prototype.add):
1523         * stress/set-inherit-add.js: Added.
1524         (shouldBe):
1525         (DerivedSet.set add):
1526
1527 2017-05-26  Ryan Haddad  <ryanhaddad@apple.com>
1528
1529         Unreviewed, rolling out r217458.
1530
1531         This change caused 55 JSC test failures.
1532
1533         Reverted changeset:
1534
1535         "Date should use historical data if it's available."
1536         https://bugs.webkit.org/show_bug.cgi?id=172592
1537         http://trac.webkit.org/changeset/217458
1538
1539 2017-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1540
1541         Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
1542         https://bugs.webkit.org/show_bug.cgi?id=167805
1543
1544         Reviewed by Saam Barati.
1545
1546         * modules/module-jit-reachability.js: Added.
1547
1548 2017-05-26  Oleksandr Skachkov  <gskachkov@gmail.com>
1549
1550         Prevent async methods named 'function'
1551         https://bugs.webkit.org/show_bug.cgi?id=172598
1552
1553         Reviewed by Mark Lam.
1554
1555         * stress/async-await-syntax.js:
1556         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1557         (testTopLevelAsyncAwaitSyntaxSloppyMode):
1558         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
1559         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1560         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
1561
1562 2017-05-25  Keith Miller  <keith_miller@apple.com>
1563
1564         Date should use historical data if it's available.
1565         https://bugs.webkit.org/show_bug.cgi?id=172592
1566
1567         Reviewed by Mark Lam.
1568
1569         Remove parts of the date tests that rely on the absence of
1570         historical data in Date.
1571
1572         * mozilla/ecma/Date/15.9.5.31-1.js:
1573         (getTestCases):
1574         * mozilla/ecma/Date/15.9.5.35-1.js:
1575         (getTestCases):
1576
1577 2017-05-25  Saam Barati  <sbarati@apple.com>
1578
1579         Our for-in optimization in the bytecode generator does its static analysis incorrectly
1580         https://bugs.webkit.org/show_bug.cgi?id=172532
1581         <rdar://problem/32369452>
1582
1583         Reviewed by Mark Lam.
1584
1585         * stress/for-in-invalidation-for-any-write.js: Added.
1586         (assert):
1587         (test):
1588         (test.i):
1589
1590 2017-05-25  Mark Lam  <mark.lam@apple.com>
1591
1592         ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
1593         https://bugs.webkit.org/show_bug.cgi?id=172548
1594         <rdar://problem/31458393>
1595
1596         Reviewed by Filip Pizlo.
1597
1598         * stress/regress-172548.patch: Added.
1599
1600 2017-05-23  Saam Barati  <sbarati@apple.com>
1601
1602         We should not mmap zero bytes for a memory in Wasm
1603         https://bugs.webkit.org/show_bug.cgi?id=172528
1604         <rdar://problem/32257076>
1605
1606         Reviewed by Mark Lam.
1607
1608         * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
1609         (testMems):
1610
1611 2017-05-23  Saam Barati  <sbarati@apple.com>
1612
1613         CFGSimplificationPhase should not merge a block with itself
1614         https://bugs.webkit.org/show_bug.cgi?id=172508
1615         <rdar://problem/28424006>
1616
1617         Reviewed by Keith Miller.
1618
1619         * stress/dont-crash-in-cfg-simplification.js: Added.
1620         (bar):
1621         (baz):
1622         (foo):
1623
1624 2017-05-20  Yusuke Suzuki  <utatane.tea@gmail.com>
1625
1626         [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
1627         https://bugs.webkit.org/show_bug.cgi?id=172216
1628
1629         Reviewed by Saam Barati.
1630
1631         * stress/array-storage-get-by-val.js: Added.
1632         (shouldBe):
1633         (testOutOfBound):
1634         (testInBound):
1635         (testSlowPutOutOfBound):
1636         (testSlowPutInBound):
1637
1638 2017-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1639
1640         Unreviewed, fix commented out tests
1641         https://bugs.webkit.org/show_bug.cgi?id=172225
1642
1643         * stress/get-by-val-string.js:
1644         (object.43):
1645         (Hello):
1646         (Hello.prototype.get 42):
1647         (Hello.prototype.43):
1648         (Derived):
1649         (shouldBe):
1650         (throw.new.Error): Deleted.
1651
1652 2017-05-21  Saam Barati  <sbarati@apple.com>
1653
1654         We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
1655         https://bugs.webkit.org/show_bug.cgi?id=171041
1656         <rdar://problem/32082516>
1657
1658         Reviewed by Yusuke Suzuki.
1659
1660         * stress/lexical-scoping-for-loop.js: Added.
1661         (assert):
1662         (test1):
1663         (test2):
1664         (test3):
1665         (test4):
1666         (test5):
1667         (test6):
1668         (let.test7):
1669         (let.test8):
1670         (let.test9):
1671         (let.test10):
1672         (let.test11):
1673         (let.test12):
1674
1675 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
1676
1677         [JSC] Make get_by_val & string "499" to number 499
1678         https://bugs.webkit.org/show_bug.cgi?id=172225
1679
1680         Reviewed by Saam Barati.
1681
1682         * stress/get-by-val-string.js: Added.
1683         (shouldBe):
1684         (shouldThrow):
1685         (object.43):
1686         (Hello):
1687         (Hello.prototype.get 42):
1688         (Hello.prototype.43):
1689         (Derived):
1690
1691 2017-05-19  Mark Lam  <mark.lam@apple.com>
1692
1693         [Re-landing] DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
1694         https://bugs.webkit.org/show_bug.cgi?id=172383
1695         <rdar://problem/31418651>
1696
1697         Reviewed by Filip Pizlo.
1698
1699         * stress/regress-172383.js: Added.
1700
1701 2017-05-19  Ryan Haddad  <ryanhaddad@apple.com>
1702
1703         Unreviewed, rolling out r217156.
1704
1705         This change broke the iOS build.
1706
1707         Reverted changeset:
1708
1709         "DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring
1710         result registers."
1711         https://bugs.webkit.org/show_bug.cgi?id=172383
1712         http://trac.webkit.org/changeset/217156
1713
1714 2017-05-19  Mark Lam  <mark.lam@apple.com>
1715
1716         Add missing exception check.
1717         https://bugs.webkit.org/show_bug.cgi?id=172346
1718         <rdar://problem/32289640>
1719
1720         Reviewed by Geoffrey Garen.
1721
1722         * stress/regress-172346.js: Added.
1723
1724 2017-05-19  Mark Lam  <mark.lam@apple.com>
1725
1726         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
1727         https://bugs.webkit.org/show_bug.cgi?id=172383
1728         <rdar://problem/31418651>
1729
1730         Reviewed by Filip Pizlo.
1731
1732         * stress/regress-172383.js: Added.
1733
1734 2017-05-19  Filip Pizlo  <fpizlo@apple.com>
1735
1736         arrayProtoPrivateFuncConcatMemcpy needs to be down with firstArray being undecided
1737         https://bugs.webkit.org/show_bug.cgi?id=172369
1738
1739         Reviewed by Mark Lam.
1740
1741         * stress/undecided-concat.js: Added.
1742
1743 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
1744
1745         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
1746         https://bugs.webkit.org/show_bug.cgi?id=172098
1747
1748         Reviewed by Saam Barati.
1749
1750         * stress/check-sub-class.js: Added.
1751         (shouldBe):
1752         (shouldThrow):
1753         (calling):
1754         (array.forEach):
1755         (i.array.forEach):
1756
1757 2017-05-18  JF Bastien  <jfbastien@apple.com>
1758
1759         WebAssembly: exports is a getter
1760         https://bugs.webkit.org/show_bug.cgi?id=172129
1761
1762         Reviewed by Saam Barati.
1763
1764         Update test to reflect new semantics.
1765
1766         * wasm/js-api/test_basic_api.js:
1767         (const.c.in.constructorProperties.switch):
1768
1769 2017-05-18  Saam Barati  <sbarati@apple.com>
1770
1771         Proxy's [[Get]] passes incorrect receiver
1772         https://bugs.webkit.org/show_bug.cgi?id=164849
1773         <rdar://problem/31767058>
1774
1775         Reviewed by Yusuke Suzuki.
1776
1777         * stress/proxy-get-set-correct-receiver.js: Added.
1778         (assert):
1779         (test):
1780         (test.let.target.set prop):
1781         (test.let.target.get prop):
1782         (test.get let):
1783         * stress/proxy-set.js:
1784         (let.target.get x):
1785         * stress/reflect-set-proxy-set.js:
1786         (let.target.get x):
1787         * stress/reflect-set-receiver-proxy-set.js:
1788         (let.target.get x):
1789
1790 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
1791
1792         Constructor calls set this too early
1793         https://bugs.webkit.org/show_bug.cgi?id=172302
1794
1795         Reviewed by Saam Barati.
1796         
1797         This tests all three kinds of constructs in BytecodeGenerator. All three were previously
1798         wrong.
1799
1800         * stress/construct-overwritten-variable.js: Added.
1801         (new.x.x):
1802         * stress/construct-spread-overwritten-variable-2.js: Added.
1803         (new.x.x):
1804         * stress/construct-spread-overwritten-variable.js: Added.
1805         (new.x.x):
1806
1807 2017-05-18  Saam Barati  <sbarati@apple.com>
1808
1809         WebAssembly: perform stack checks
1810         https://bugs.webkit.org/show_bug.cgi?id=165546
1811         <rdar://problem/29760307>
1812
1813         Reviewed by Filip Pizlo.
1814
1815         * wasm.yaml:
1816         * wasm/function-tests/factorial.js:
1817         * wasm/function-tests/float-sub.js:
1818         * wasm/function-tests/stack-overflow.js: Added.
1819         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
1820         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
1821         (assertOverflows.makeInstance):
1822         (assertOverflows.makeInstance2):
1823         (assertOverflows.assertThrows):
1824         (assertOverflows):
1825         (assertThrows.test.makeSignature):
1826         (assertThrows.test.makeInstance):
1827         (assertThrows.test):
1828         (assertThrows):
1829
1830 2017-05-18  Keith Miller  <keith_miller@apple.com>
1831
1832         WebAssembly API: test with neutered inputs
1833         https://bugs.webkit.org/show_bug.cgi?id=163899
1834
1835         Reviewed by JF Bastien.
1836
1837         * wasm/js-api/neutered-inputs.js: Added.
1838         (const.testFunction):
1839         (const.testConstructor):
1840         * wasm/js-api/test_basic_api.js:
1841         (const.c.in.constructorProperties.switch):
1842
1843 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
1844
1845         DFG inlining should be hardened for the no-result case
1846         https://bugs.webkit.org/show_bug.cgi?id=172290
1847
1848         Reviewed by Saam Barati.
1849
1850         * stress/array-constructor-no-result.js: Added.
1851         (foo):
1852         * stress/pow-no-result.js: Added.
1853         (foo):
1854
1855 2017-05-18  Commit Queue  <commit-queue@webkit.org>
1856
1857         Unreviewed, rolling out r217031, r217032, and r217037.
1858         https://bugs.webkit.org/show_bug.cgi?id=172293
1859
1860         cause linking errors in Windows (Requested by yusukesuzuki on
1861         #webkit).
1862
1863         Reverted changesets:
1864
1865         "[JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass"
1866         https://bugs.webkit.org/show_bug.cgi?id=172098
1867         http://trac.webkit.org/changeset/217031
1868
1869         "Unreviewed, rebaseline for newly added ClassInfo"
1870         https://bugs.webkit.org/show_bug.cgi?id=172098
1871         http://trac.webkit.org/changeset/217032
1872
1873         "Unreviewed, fix debug and non-JIT build"
1874         https://bugs.webkit.org/show_bug.cgi?id=172098
1875         http://trac.webkit.org/changeset/217037
1876
1877 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1878
1879         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
1880         https://bugs.webkit.org/show_bug.cgi?id=172098
1881
1882         Reviewed by Saam Barati.
1883
1884         * stress/check-sub-class.js: Added.
1885         (shouldBe):
1886         (shouldThrow):
1887         (calling):
1888         (array.forEach):
1889         (i.array.forEach):
1890
1891 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
1892
1893         Unreviewed, address mlam's review feedback.
1894
1895         * stress/arguments-elimination-varargs-too-many-args-arg-count.js:
1896
1897 2017-05-17  Saam Barati  <sbarati@apple.com>
1898
1899         We don't do context switches for Wasm->Wasm call indirect
1900         https://bugs.webkit.org/show_bug.cgi?id=172188
1901         <rdar://problem/32231828>
1902
1903         Reviewed by Keith Miller.
1904
1905         * wasm/function-tests/context-switch.js: Added.
1906         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
1907         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance2):
1908         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.i2.makeInstance2):
1909         (makeInstance):
1910         (makeInstance2):
1911         (assert.eq.makeInstance):
1912         (assert.eq.makeInstance2):
1913         (assert.eq):
1914
1915 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
1916
1917         JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform
1918         https://bugs.webkit.org/show_bug.cgi?id=172208
1919
1920         Reviewed by Saam Barati.
1921
1922         * stress/arguments-elimination-varargs-too-many-args-arg-count.js: Added.
1923         (foo):
1924         (bar):
1925         (baz):
1926
1927 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1928
1929         [DFG] Constant Folding Phase should convert MakeRope("", String) => Identity(String)
1930         https://bugs.webkit.org/show_bug.cgi?id=172115
1931
1932         Reviewed by Saam Barati.
1933
1934         * stress/constant-folding-should-fold-make-rope-with-empty-strings.js: Added.
1935         (shouldBe):
1936         (unknown):
1937         (readWord1):
1938         (readWord2):
1939         (readWord3):
1940         (readWord4):
1941
1942 2017-05-16  JF Bastien  <jfbastien@apple.com>
1943
1944         WebAssembly: add memory fuzzer
1945         https://bugs.webkit.org/show_bug.cgi?id=169976
1946         <rdar://problem/31965328>
1947
1948         Reviewed by Keith Miller.
1949
1950         * wasm/fuzz/memory.js: Added.
1951         (const.insert):
1952         (const.action.string_appeared_here):
1953         (const.performAction):
1954         (catch):
1955
1956 2017-05-16  JF Bastien  <jfbastien@apple.com>
1957
1958         WebAssembly: validate load / store alignment
1959         https://bugs.webkit.org/show_bug.cgi?id=168836
1960         <rdar://problem/31965349>
1961
1962         Reviewed by Keith Miller.
1963
1964         * wasm/WASM.js: fix regular expression greed
1965         * wasm/function-tests/memory-alignment.js: Added.
1966         (const.op.of.WASM.opcodes):
1967         * wasm/wasm.json: fix formatting
1968
1969 2017-05-15  Mark Lam  <mark.lam@apple.com>
1970
1971         Rolling out r214038 and r213697: Crashes when using computed properties with rest destructuring and object spread.
1972         https://bugs.webkit.org/show_bug.cgi?id=172147
1973
1974         Rubber-stamped by Saam Barati.
1975
1976         * stress/object-rest-deconstruct.js: Removed.
1977         * stress/object-spread.js: Removed.
1978
1979 2017-05-11  JF Bastien  <jfbastien@apple.com>
1980
1981         WebAssembly: stop supporting 0xD
1982         https://bugs.webkit.org/show_bug.cgi?id=168788
1983         <rdar://problem/31880922>
1984
1985         Reviewed by Saam Barati.
1986
1987         Test that only version 1 is supported.
1988
1989         * wasm/js-api/version.js: Added.
1990
1991 2017-05-10  JF Bastien  <jfbastien@apple.com>
1992
1993         WebAssemby: builder doesn't do Memory section maximum correctly
1994         https://bugs.webkit.org/show_bug.cgi?id=171931
1995
1996         Reviewed by Keith Miller.
1997
1998         * wasm/Builder.js:
1999         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
2000         * wasm/Builder_WebAssemblyBinary.js:
2001         (const.emitters.Memory):
2002         * wasm/function-tests/memory-grow-invalid.js: Added.
2003
2004 2017-05-10  JF Bastien  <jfbastien@apple.com>
2005
2006         WebAssembly: support name section
2007         https://bugs.webkit.org/show_bug.cgi?id=171263
2008
2009         Reviewed by Keith Miller.
2010
2011         * wasm/function-tests/nameSection.js: Added.
2012         (const.compile):
2013         * wasm/function-tests/nameSection.wasm: Added.
2014         * wasm/function-tests/stack-trace.js: Update format
2015
2016 2017-05-10  Filip Pizlo  <fpizlo@apple.com>
2017
2018         Null pointer dereference in WTF::RefPtr<WTF::StringImpl>::operator!() under slow_path_get_direct_pname
2019         https://bugs.webkit.org/show_bug.cgi?id=171801
2020
2021         Reviewed by Michael Saboff.
2022         
2023         These tests used to crash. The prefix and postfix tests cover different paths, except
2024         postfix-ignored goes down the same path as prefix due to an optimization.
2025
2026         * stress/for-in-postfix-ignored-index.js: Added.
2027         (foo):
2028         * stress/for-in-postfix-index.js: Added.
2029         (foo):
2030         * stress/for-in-prefix-index.js: Added.
2031         (foo):
2032
2033 2017-05-08  Mark Lam  <mark.lam@apple.com>
2034
2035         op_throw_static_error's use of its first operand should be reflected in DFG BytecodeUseDef as well.
2036         https://bugs.webkit.org/show_bug.cgi?id=171786
2037         <rdar://problem/32051023>
2038
2039         Reviewed by Saam Barati.
2040
2041         * stress/bug-171786.js: Added.
2042
2043 2017-05-06  Oleksandr Skachkov  <gskachkov@gmail.com>
2044
2045         [ES6] Arrow function. Issue in access to this after eval('super()') within constructor
2046         https://bugs.webkit.org/show_bug.cgi?id=171543
2047
2048         Reviewed by Saam Barati.
2049
2050         * stress/arrowfunction-lexical-bind-supercall-4.js:
2051         (J):
2052         (K):
2053
2054 2017-05-05  Saam Barati  <sbarati@apple.com>
2055
2056         putDirectIndex does not properly do defineOwnProperty
2057         https://bugs.webkit.org/show_bug.cgi?id=171591
2058         <rdar://problem/31735695>
2059
2060         Reviewed by Geoffrey Garen.
2061
2062         * stress/array-prototype-splice-making-typed-array.js:
2063         (test):
2064         * stress/array-species-config-array-constructor.js:
2065         (shouldThrow):
2066         (test):
2067         * stress/put-direct-index-broken-2.js: Added.
2068         (assert):
2069         (test):
2070         (makeLengthWritable):
2071         (set get restoreOldDesc):
2072         * stress/put-direct-index-broken.js: Added.
2073         (whatToTest):
2074         (tryRunning):
2075         (tryItOut):
2076         * stress/put-indexed-getter-setter.js: Added.
2077         (foo.X.prototype.set 7):
2078         (foo.X.prototype.get 7):
2079         (foo.X):
2080         (foo):
2081
2082 2017-05-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2083
2084         [JSC] Math unary functions should be handled by DFG
2085         https://bugs.webkit.org/show_bug.cgi?id=171269
2086
2087         Reviewed by Saam Barati.
2088
2089         * stress/arith-acos-on-various-types.js: Added.
2090         (let.validInputTypedTestCases.validInputTestCases.map):
2091         (isIdentical):
2092         (opaqueACosNoArgument):
2093         (testNoArgument):
2094         (opaqueAllTypesACos):
2095         (testAllTypesCall):
2096         (testSingleTypeCall):
2097         (testConstant):
2098         (opaqueACosForSideEffects):
2099         (testSideEffect.let.testObject.valueOf):
2100         (testSideEffect):
2101         (opaqueACosForCSE):
2102         (testCSE.let.testObject.valueOf):
2103         (testCSE):
2104         (opaqueACosForDCE):
2105         (testDCE.let.testObject.valueOf):
2106         (testDCE):
2107         (testException.opaqueACosWithException):
2108         (testException):
2109         * stress/arith-acosh-on-various-types.js: Added.
2110         (let.validInputTypedTestCases.validInputTestCases.map):
2111         (isIdentical):
2112         (opaqueACoshNoArgument):
2113         (testNoArgument):
2114         (opaqueAllTypesACosh):
2115         (testAllTypesCall):
2116         (testSingleTypeCall):
2117         (testConstant):
2118         (opaqueACoshForSideEffects):
2119         (testSideEffect.let.testObject.valueOf):
2120         (testSideEffect):
2121         (opaqueACoshForCSE):
2122         (testCSE.let.testObject.valueOf):
2123         (testCSE):
2124         (opaqueACoshForDCE):
2125         (testDCE.let.testObject.valueOf):
2126         (testDCE):
2127         (testException.opaqueACoshWithException):
2128         (testException):
2129         * stress/arith-asin-on-various-types.js: Added.
2130         (let.validInputTypedTestCases.validInputTestCases.map):
2131         (isIdentical):
2132         (opaqueASinNoArgument):
2133         (testNoArgument):
2134         (opaqueAllTypesASin):
2135         (testAllTypesCall):
2136         (testSingleTypeCall):
2137         (testConstant):
2138         (opaqueASinForSideEffects):
2139         (testSideEffect.let.testObject.valueOf):
2140         (testSideEffect):
2141         (opaqueASinForCSE):
2142         (testCSE.let.testObject.valueOf):
2143         (testCSE):
2144         (opaqueASinForDCE):
2145         (testDCE.let.testObject.valueOf):
2146         (testDCE):
2147         (testException.opaqueASinWithException):
2148         (testException):
2149         * stress/arith-asinh-on-various-types.js: Added.
2150         (let.validInputTypedTestCases.validInputTestCases.map):
2151         (isIdentical):
2152         (opaqueASinhNoArgument):
2153         (testNoArgument):
2154         (opaqueAllTypesASinh):
2155         (testAllTypesCall):
2156         (testSingleTypeCall):
2157         (testConstant):
2158         (opaqueASinhForSideEffects):
2159         (testSideEffect.let.testObject.valueOf):
2160         (testSideEffect):
2161         (opaqueASinhForCSE):
2162         (testCSE.let.testObject.valueOf):
2163         (testCSE):
2164         (opaqueASinhForDCE):
2165         (testDCE.let.testObject.valueOf):
2166         (testDCE):
2167         (testException.opaqueASinhWithException):
2168         (testException):
2169         * stress/arith-atan-on-various-types.js: Added.
2170         (let.validInputTypedTestCases.validInputTestCases.map):
2171         (isIdentical):
2172         (opaqueATanNoArgument):
2173         (testNoArgument):
2174         (opaqueAllTypesATan):
2175         (testAllTypesCall):
2176         (testSingleTypeCall):
2177         (testConstant):
2178         (opaqueATanForSideEffects):
2179         (testSideEffect.let.testObject.valueOf):
2180         (testSideEffect):
2181         (opaqueATanForCSE):
2182         (testCSE.let.testObject.valueOf):
2183         (testCSE):
2184         (opaqueATanForDCE):
2185         (testDCE.let.testObject.valueOf):
2186         (testDCE):
2187         (testException.opaqueATanWithException):
2188         (testException):
2189         * stress/arith-atanh-on-various-types.js: Added.
2190         (let.validInputTypedTestCases.validInputTestCases.map):
2191         (isIdentical):
2192         (opaqueATanhNoArgument):
2193         (testNoArgument):
2194         (opaqueAllTypesATanh):
2195         (testAllTypesCall):
2196         (testSingleTypeCall):
2197         (testConstant):
2198         (opaqueATanhForSideEffects):
2199         (testSideEffect.let.testObject.valueOf):
2200         (testSideEffect):
2201         (opaqueATanhForCSE):
2202         (testCSE.let.testObject.valueOf):
2203         (testCSE):
2204         (opaqueATanhForDCE):
2205         (testDCE.let.testObject.valueOf):
2206         (testDCE):
2207         (testException.opaqueATanhWithException):
2208         (testException):
2209         * stress/arith-cbrt-on-various-types.js: Added.
2210         (let.validInputTypedTestCases.validInputTestCases.map):
2211         (isIdentical):
2212         (opaqueCbrtNoArgument):
2213         (testNoArgument):
2214         (opaqueAllTypesCbrt):
2215         (testAllTypesCall):
2216         (testSingleTypeCall):
2217         (testConstant):
2218         (opaqueCbrtForSideEffects):
2219         (testSideEffect.let.testObject.valueOf):
2220         (testSideEffect):
2221         (opaqueCbrtForCSE):
2222         (testCSE.let.testObject.valueOf):
2223         (testCSE):
2224         (opaqueCbrtForDCE):
2225         (testDCE.let.testObject.valueOf):
2226         (testDCE):
2227         (testException.opaqueCbrtWithException):
2228         (testException):
2229         * stress/arith-cosh-on-various-types.js: Added.
2230         (let.validInputTypedTestCases.validInputTestCases.map):
2231         (isIdentical):
2232         (opaqueCoshNoArgument):
2233         (testNoArgument):
2234         (opaqueAllTypesCosh):
2235         (testAllTypesCall):
2236         (testSingleTypeCall):
2237         (testConstant):
2238         (opaqueCoshForSideEffects):
2239         (testSideEffect.let.testObject.valueOf):
2240         (testSideEffect):
2241         (opaqueCoshForCSE):
2242         (testCSE.let.testObject.valueOf):
2243         (testCSE):
2244         (opaqueCoshForDCE):
2245         (testDCE.let.testObject.valueOf):
2246         (testDCE):
2247         (testException.opaqueCoshWithException):
2248         (testException):
2249         * stress/arith-expm1-on-various-types.js: Added.
2250         (let.validInputTypedTestCases.validInputTestCases.map):
2251         (isIdentical):
2252         (opaqueExpm1NoArgument):
2253         (testNoArgument):
2254         (opaqueAllTypesExpm1):
2255         (testAllTypesCall):
2256         (testSingleTypeCall):
2257         (testConstant):
2258         (opaqueExpm1ForSideEffects):
2259         (testSideEffect.let.testObject.valueOf):
2260         (testSideEffect):
2261         (opaqueExpm1ForCSE):
2262         (testCSE.let.testObject.valueOf):
2263         (testCSE):
2264         (opaqueExpm1ForDCE):
2265         (testDCE.let.testObject.valueOf):
2266         (testDCE):
2267         (testException.opaqueExpm1WithException):
2268         (testException):
2269         * stress/arith-log10-on-various-types.js: Added.
2270         (let.validInputTypedTestCases.validInputTestCases.map):
2271         (isIdentical):
2272         (opaqueLog10NoArgument):
2273         (testNoArgument):
2274         (opaqueAllTypesLog10):
2275         (testAllTypesCall):
2276         (testSingleTypeCall):
2277         (testConstant):
2278         (opaqueLog10ForSideEffects):
2279         (testSideEffect.let.testObject.valueOf):
2280         (testSideEffect):
2281         (opaqueLog10ForCSE):
2282         (testCSE.let.testObject.valueOf):
2283         (testCSE):
2284         (opaqueLog10ForDCE):
2285         (testDCE.let.testObject.valueOf):
2286         (testDCE):
2287         (testException.opaqueLog10WithException):
2288         (testException):
2289         * stress/arith-log2-on-various-types.js: Added.
2290         (let.validInputTypedTestCases.validInputTestCases.map):
2291         (isIdentical):
2292         (opaqueLog2NoArgument):
2293         (testNoArgument):
2294         (opaqueAllTypesLog2):
2295         (testAllTypesCall):
2296         (testSingleTypeCall):
2297         (testConstant):
2298         (opaqueLog2ForSideEffects):
2299         (testSideEffect.let.testObject.valueOf):
2300         (testSideEffect):
2301         (opaqueLog2ForCSE):
2302         (testCSE.let.testObject.valueOf):
2303         (testCSE):
2304         (opaqueLog2ForDCE):
2305         (testDCE.let.testObject.valueOf):
2306         (testDCE):
2307         (testException.opaqueLog2WithException):
2308         (testException):
2309         * stress/arith-sinh-on-various-types.js: Added.
2310         (let.validInputTypedTestCases.validInputTestCases.map):
2311         (isIdentical):
2312         (opaqueSinhNoArgument):
2313         (testNoArgument):
2314         (opaqueAllTypesSinh):
2315         (testAllTypesCall):
2316         (testSingleTypeCall):
2317         (testConstant):
2318         (opaqueSinhForSideEffects):
2319         (testSideEffect.let.testObject.valueOf):
2320         (testSideEffect):
2321         (opaqueSinhForCSE):
2322         (testCSE.let.testObject.valueOf):
2323         (testCSE):
2324         (opaqueSinhForDCE):
2325         (testDCE.let.testObject.valueOf):
2326         (testDCE):
2327         (testException.opaqueSinhWithException):
2328         (testException):
2329         * stress/arith-tan-on-various-types.js:
2330         (isIdentical):
2331         * stress/arith-tanh-on-various-types.js: Added.
2332         (let.validInputTypedTestCases.validInputTestCases.map):
2333         (isIdentical):
2334         (opaqueTanhNoArgument):
2335         (testNoArgument):
2336         (opaqueAllTypesTanh):
2337         (testAllTypesCall):
2338         (testSingleTypeCall):
2339         (testConstant):
2340         (opaqueTanhForSideEffects):
2341         (testSideEffect.let.testObject.valueOf):
2342         (testSideEffect):
2343         (opaqueTanhForCSE):
2344         (testCSE.let.testObject.valueOf):
2345         (testCSE):
2346         (opaqueTanhForDCE):
2347         (testDCE.let.testObject.valueOf):
2348         (testDCE):
2349         (testException.opaqueTanhWithException):
2350         (testException):
2351
2352 2017-05-03  Keith Miller  <keith_miller@apple.com>
2353
2354         Array.prototype.sort should also allow a null comparator
2355         https://bugs.webkit.org/show_bug.cgi?id=171621
2356
2357         Reviewed by Michael Saboff.
2358
2359         Add test to make it less likely we revert to the incompatable behavior.
2360         Also, fix now incorrect tests.
2361
2362         * ChakraCore/test/Array/array_sort.baseline-jsc:
2363         * stress/array-sort-bad-comparator.js:
2364         (test):
2365         * stress/sort-null-comparator.js: Added.
2366         (assertEq):
2367
2368 2017-05-03  Caitlin Potter  <caitp@igalia.com>
2369
2370         [JSC] remove unneeded asyncFunctionTests.yaml
2371         https://bugs.webkit.org/show_bug.cgi?id=171611
2372
2373         Reviewed by Yusuke Suzuki.
2374
2375         Async functions have shipped, and those tests are run as part of
2376         JSTests/stress and JSTests/test262.yaml. The file is no longer needed.
2377
2378         * asyncFunctionTests.yaml: Removed.
2379         * stress/async-await-long-loop.js:
2380         * stress/async-await-throw-loop.js:
2381
2382 2017-05-03  Keith Miller  <keith_miller@apple.com>
2383
2384         Different behaviour with the .sort(callback) method (unlike Firefox & Chrome)
2385         https://bugs.webkit.org/show_bug.cgi?id=47825
2386
2387         Reviewed by Saam Barati.
2388
2389         * stress/sorting-boolean-result-comparator.js: Added.
2390         (checkArray):
2391
2392 2017-05-02  David Kilzer  <ddkilzer@apple.com>
2393
2394         check-webkit-style should keep JavaScript test functions in sync
2395         <https://webkit.org/b/171424>
2396
2397         Reviewed by Joseph Pecoraro.
2398
2399         This change makes shouldBe(), shouldNotBe(), shouldNotThrow()
2400         and shouldThrow() in sync with other copies of these methods.
2401
2402         * stress/resources/standalone-pre.js:
2403         (shouldBe): Fix whitespace.  Prefix 'exception' and 'quiet'
2404         variables with underscore.
2405         (shouldThrow): Fix whitespace.
2406
2407 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2408
2409         We initialize functions too early in an eval
2410         https://bugs.webkit.org/show_bug.cgi?id=161099
2411
2412         Reviewed by Saam Barati.
2413
2414         * stress/eval-func-decl-with-let-const-class.js: Added.
2415
2416 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2417
2418         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
2419         https://bugs.webkit.org/show_bug.cgi?id=163208
2420
2421         Reviewed by Saam Barati.
2422
2423         * stress/eval-func-decl-block-scoping-reassign.js: Added.
2424         (assert):
2425         (throw.new.Error.f):
2426         (throw.new.Error):
2427         * stress/eval-func-decl-block-with-remove.js: Added.
2428         (assert):
2429         (foo.boo):
2430         (foo):
2431         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
2432         (assert):
2433         (assertThrow):
2434         (foo):
2435         (boo):
2436         (joo):
2437         (koo):
2438         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
2439         (assert):
2440         (assertThrow):
2441         (foo):
2442         (boo):
2443         (hoo):
2444         (joo):
2445         (koo):
2446         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
2447         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
2448         (assert):
2449         (assertThrow):
2450         (foo):
2451         (boo):
2452         (goo):
2453         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
2454         (assert):
2455         (assertThrow):
2456         (foo):
2457         (boo):
2458         (boo.let.val2):
2459         (boo.let.val3):
2460         * stress/eval-func-decl-in-frozen-global.js: Added.
2461         (assert):
2462         (assertThrow):
2463         (throw.new.Error):
2464         (Object.freeze):
2465         * stress/eval-func-decl-in-global-of-eval.js: Added.
2466         (assert):
2467         (assertThrow):
2468         (bar):
2469         (baz):
2470         (foobar):
2471         * stress/eval-func-decl-in-global.js: Added.
2472         (assert):
2473         (assertThrow):
2474         * stress/eval-func-decl-in-if.js: Added.
2475         (assert):
2476         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
2477         (assert):
2478         (assertThrow):
2479         (foo):
2480         (boo):
2481         (foobar):
2482         (hoo):
2483         (joo):
2484         (koo):
2485         (loo):
2486         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
2487         (assert):
2488         (assertThrow):
2489         (foo):
2490         (boo):
2491         (goo):
2492         * stress/variable-under-tdz-eval-tricky.js:
2493         (assert):
2494         * test262.yaml:
2495
2496 2017-04-27  Mark Lam  <mark.lam@apple.com>
2497
2498         Fix some RELEASE_ASSERT failures caused by OutOfMemoryErrors.
2499         https://bugs.webkit.org/show_bug.cgi?id=171404
2500         <rdar://problem/31876178>
2501
2502         Reviewed by Saam Barati.
2503
2504         * stress/js-fixed-array-out-of-memory.js: Added.
2505
2506 2017-04-27  David Kilzer  <ddkilzer@apple.com>
2507
2508         Enhance shouldBe()/shouldNotBe() to accept anonymous function arguments
2509         <https://webkit.org/b/171362>
2510         <rdar://problem/31867686>
2511
2512         Reviewed by Joseph Pecoraro.
2513
2514         * stress/resources/standalone-pre.js:
2515         (shouldBe):
2516         (shouldNotThrow):
2517         (shouldThrow):
2518         - Update shouldBe() to accept anonymous function arguments.
2519           (The shouldNotBe() function was never copied over.)
2520         - Also fix shouldThrow()/shouldNotThrow() to accept anonymous
2521           function arguments (which were missed in r202609 for Bug
2522           159232).
2523
2524 2017-04-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2525
2526         [JSC] Handle PhantomSpread in LoadVarargs as the same to the others
2527         https://bugs.webkit.org/show_bug.cgi?id=171262
2528
2529         Reviewed by Saam Barati.
2530
2531         * stress/spread-outer-create-rest.js: Added.
2532         (assert):
2533         (foo):
2534         (bar):
2535         (baz):
2536
2537 2017-04-26  Saam Barati  <sbarati@apple.com>
2538
2539         Print Wasm function index in stack trace
2540         https://bugs.webkit.org/show_bug.cgi?id=171349
2541
2542         Reviewed by JF Bastien.
2543
2544         * wasm/function-tests/stack-trace.js: Added.
2545         (import.Builder.from.string_appeared_here.assert):
2546         (let.imp):
2547         * wasm/function-tests/trap-after-cross-instance-call.js:
2548         (wasmFrameCountFromError):
2549         * wasm/function-tests/trap-load-2.js:
2550         (wasmFrameCountFromError):
2551         * wasm/function-tests/trap-load.js:
2552         (wasmFrameCountFromError):
2553
2554 2017-04-26  Saam Barati  <sbarati@apple.com>
2555
2556         ASSERTION FAILED: inIndex != notFound in JSC::invalidParameterInSourceAppender()
2557         https://bugs.webkit.org/show_bug.cgi?id=170924
2558         <rdar://problem/31721052>
2559
2560         Reviewed by Mark Lam.
2561
2562         * stress/error-message-for-function-base-not-found.js: Added.
2563         (assert):
2564         (throw.new.Error):
2565         * stress/error-messages-for-in-operator-should-not-crash.js: Added.
2566         (catch):
2567
2568 2017-04-26  Keith Miller  <keith_miller@apple.com>
2569
2570         WebAssembly: Implement tier up
2571         https://bugs.webkit.org/show_bug.cgi?id=170134
2572
2573         Reviewed by Filip Pizlo.
2574
2575         * wasm/function-tests/trap-after-cross-instance-call.js:
2576         * wasm/tier-up/js-to-wasm.js: Added.
2577         (async.test):
2578         * wasm/tier-up/wasm-to-wasm.js: Added.
2579         (async.test):
2580
2581 2017-04-26  Caitlin Potter  <caitp@igalia.com>
2582
2583         [JSC] Object.keys() must discard property names with no PropertyDescriptor
2584         https://bugs.webkit.org/show_bug.cgi?id=171291
2585
2586         Reviewed by Yusuke Suzuki.
2587
2588         * es6/Proxy_ownKeys_duplicates.js:
2589         * stress/proxy-own-keys.js:
2590         (let.handler.getOwnPropertyDescriptor):
2591         (let.handler.ownKeys):
2592
2593 2017-04-25  Commit Queue  <commit-queue@webkit.org>
2594
2595         Unreviewed, rolling out r215476.
2596         https://bugs.webkit.org/show_bug.cgi?id=171304
2597
2598         "It broke JSBench" (Requested by saamyjoon on #webkit).
2599
2600         Reverted changeset:
2601
2602         "[ES6]. Implement Annex B.3.3 function hoisting rules for
2603         eval"
2604         https://bugs.webkit.org/show_bug.cgi?id=163208
2605         http://trac.webkit.org/changeset/215476
2606
2607 2017-04-25  Saam Barati  <sbarati@apple.com>
2608
2609         JSArray::isArrayPrototypeIteratorProtocolFastAndNonObservable is wrong because it does not do the necessary checks on the base object
2610         https://bugs.webkit.org/show_bug.cgi?id=171150
2611         <rdar://problem/31771880>
2612
2613         Reviewed by Sam Weinig.
2614
2615         * stress/spread-optimized-properly.js: Added.
2616         (assert):
2617         (test):
2618         (shallowEq):
2619         (makeArrayIterator):
2620         (test.bar):
2621         (test.callback):
2622         (test.arr.__proto__.Symbol.iterator):
2623         (test.arr.Symbol.iterator):
2624         (test.get bar):
2625         (test.hackedNext):
2626         (test.test):
2627         (test.):
2628
2629 2017-04-25  Mark Lam  <mark.lam@apple.com>
2630
2631         [Follow up] Array.prototype.slice() should ensure that end >= begin.
2632         https://bugs.webkit.org/show_bug.cgi?id=170989
2633         <rdar://problem/31705652>
2634
2635         Not reviewed.
2636
2637         Follow up to rename a test file that was accidentally named wrongly.
2638
2639         * stress/regress-170989.js: Copied from JSTests/stress/regress-170989.patch.
2640         * stress/regress-170989.patch: Removed.
2641
2642 2017-04-25  Mark Lam  <mark.lam@apple.com>
2643
2644         Array.prototype.slice() should ensure that end >= begin.
2645         https://bugs.webkit.org/show_bug.cgi?id=170989
2646         <rdar://problem/31705652>
2647
2648         Reviewed by Saam Barati.
2649
2650         * stress/regress-170989.patch: Added.
2651
2652 2017-04-25  Mark Lam  <mark.lam@apple.com>
2653
2654         Local CSE wrongly CSEs array accesses with different result types.
2655         https://bugs.webkit.org/show_bug.cgi?id=170990
2656         <rdar://problem/31705945>
2657
2658         Reviewed by Saam Barati.
2659
2660         * stress/regress-170990.js: Added.
2661
2662 2017-04-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2663
2664         WebAssembly: exporting a property with a name that's a number doesn't work
2665         https://bugs.webkit.org/show_bug.cgi?id=168857
2666
2667         Reviewed by JF Bastien.
2668
2669         r213453 allows Wasm instances to expose indexed properties. We activate the tests.
2670
2671         * wasm/js-api/test_Instance.js:
2672         (ExportedNumber):
2673
2674 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
2675
2676         test262: test262/test/language/expressions/object/method-definition/early-errors-object-method-duplicate-parameters.js
2677         https://bugs.webkit.org/show_bug.cgi?id=171190
2678
2679         Reviewed by Saam Barati.
2680
2681         * stress/async-await-syntax.js:
2682         * test262.yaml:
2683
2684 2017-04-24  Yusuke Suzuki  <utatane.tea@gmail.com>
2685
2686         [JSC] Use JSFixedArray directly when using call_varargs
2687         https://bugs.webkit.org/show_bug.cgi?id=171057
2688
2689         Reviewed by Saam Barati.
2690
2691         * stress/spread-capture-rest.js: Added.
2692         (shouldBe):
2693         (capture):
2694         (a):
2695         (b):
2696         * stress/spread-multi-layers.js: Added.
2697         (shouldBe):
2698         (a):
2699         (b):
2700         (c):
2701         (d):
2702         * stress/spread-non-varargs.js: Added.
2703         (shouldBe):
2704         (a):
2705         (b):
2706
2707 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
2708
2709         test262: test262/test/language/computed-property-names/class/static/getter-prototype.js
2710         https://bugs.webkit.org/show_bug.cgi?id=170897
2711
2712         Reviewed by Saam Barati.
2713
2714         * test262.yaml:
2715
2716 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
2717
2718         Address some FIXMEs in JavaScript tests for bugs that have been fixed
2719         https://bugs.webkit.org/show_bug.cgi?id=171191
2720
2721         Reviewed by JF Bastien.
2722
2723         * stress/proxy-is-extensible.js:
2724
2725 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
2726
2727         test262: test262/test/language/statements/for-of/dstr-array-elem-init-fn-name-arrow.js
2728         https://bugs.webkit.org/show_bug.cgi?id=171160
2729
2730         Reviewed by JF Bastien.
2731
2732         * stress/inferred-names.js:
2733         * test262.yaml:
2734
2735 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
2736
2737         test262: test262/test/language/expressions/generators/yield-as-label.js
2738         https://bugs.webkit.org/show_bug.cgi?id=170979
2739
2740         Reviewed by Saam Barati.
2741
2742         * stress/async-await-module-reserved-word.js:
2743         * stress/async-await-reserved-word.js:
2744         Converge on "Cannot" instead of "Can't".
2745
2746         * catch-parameter-syntax.js:
2747         * yield-named-variable-generator.js:
2748         * yield-named-variable.js:
2749         * stress/yield-label-generator.js:
2750         * stress/yield-label.js:
2751         * stress/yield-reserved-word.js: Added.
2752         More complete list of when 'yield' is allowed.
2753
2754         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
2755         * test262.yaml:
2756
2757 2017-04-23  Commit Queue  <commit-queue@webkit.org>
2758
2759         Unreviewed, rolling out r215674.
2760         https://bugs.webkit.org/show_bug.cgi?id=171212
2761
2762         Possible unintended commit. This patch was on the wrong bug.
2763         (Requested by JoePeck on #webkit).
2764
2765         Reverted changeset:
2766
2767         "test262: test262/test/language/expressions/generators/yield-
2768         as-label.js"
2769         https://bugs.webkit.org/show_bug.cgi?id=170979
2770         http://trac.webkit.org/changeset/215674
2771
2772 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
2773
2774         test262: test262/test/built-ins/Number/prototype/toPrecision/nan.js
2775         https://bugs.webkit.org/show_bug.cgi?id=171197
2776
2777         Reviewed by Saam Barati.
2778
2779         * test262.yaml:
2780
2781 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
2782
2783         test262: test262/test/language/expressions/generators/yield-as-label.js
2784         https://bugs.webkit.org/show_bug.cgi?id=170979
2785
2786         Reviewed by Saam Barati.
2787
2788         * stress/async-await-module-reserved-word.js:
2789         * stress/async-await-reserved-word.js:
2790         Converge on "Cannot" instead of "Can't".
2791
2792         * catch-parameter-syntax.js:
2793         * yield-named-variable-generator.js:
2794         * yield-named-variable.js:
2795         * stress/yield-label-generator.js:
2796         * stress/yield-label.js:
2797         * stress/yield-reserved-word.js: Added.
2798         More complete list of when 'yield' is allowed.
2799
2800         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
2801         * test262.yaml:
2802
2803 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
2804
2805         test262: test262/test/built-ins/Number/parseFloat.js
2806         https://bugs.webkit.org/show_bug.cgi?id=171193
2807
2808         Reviewed by Yusuke Suzuki.
2809
2810         * test262.yaml:
2811
2812 2017-04-22  JF Bastien  <jfbastien@apple.com>
2813
2814         WebAssembly: Module.exports, Module.imports, Module.customSections are wrong
2815         https://bugs.webkit.org/show_bug.cgi?id=171078
2816
2817         Reviewed by Saam Barati.
2818
2819         They're static properties of Module, not instance properties of a module.
2820         https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymoduleexports
2821
2822         * wasm/js-api/Module.customSection.js:
2823         (assert.throws.WebAssembly.Module.customSections):
2824         (assert.eq):
2825         (assert.throws.WebAssembly.Module.prototype.customSections): Deleted.
2826         * wasm/js-api/Module.exports.js:
2827         (assert.throws.WebAssembly.Module.exports):
2828         (assert.truthy):
2829         (assert.throws.WebAssembly.Module.prototype.exports): Deleted.
2830         * wasm/js-api/Module.imports.js:
2831         (assert.throws.WebAssembly.Module.imports):
2832         (assert.truthy):
2833         (assert.throws.WebAssembly.Module.prototype.imports): Deleted.
2834
2835 2017-04-21  JF Bastien  <jfbastien@apple.com>
2836
2837         Silence noisy test
2838
2839         Unreviewed, Fil / Michael and I talked about it in the corridor. I
2840         just forgot to set verbose to false before commit.
2841
2842         * wasm/stress/oom.js:
2843
2844 2017-04-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2845
2846         [JSC][FTL] FTL should support Arrayify
2847         https://bugs.webkit.org/show_bug.cgi?id=169596
2848
2849         Reviewed by Saam Barati.
2850
2851         * stress/arrayify.js: Added.
2852         (arrayifyInt32):
2853         (arrayifyDouble):
2854         (arrayifyContiguous):
2855
2856 2017-04-20  Mark Lam  <mark.lam@apple.com>
2857
2858         virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.
2859         https://bugs.webkit.org/show_bug.cgi?id=171079
2860         <rdar://problem/31684756>
2861
2862         Reviewed by Saam Barati.
2863
2864         * stress/regress-171079.js: Added.
2865
2866 2017-04-15  Filip Pizlo  <fpizlo@apple.com>
2867
2868         Optimize SharedArrayBuffer in the DFG+FTL
2869         https://bugs.webkit.org/show_bug.cgi?id=164108
2870
2871         Reviewed by Saam Barati.
2872         
2873         Added a fairly comprehensive test of the intrinsics. This creates a function for each possible
2874         combination of type and operation, and then first uses it nicely and then tries a bunch of
2875         erroneous conditions like OOB.
2876
2877         * stress/SharedArrayBuffer-opt.js: Added.
2878         (string_appeared_here.switch):
2879         (string_appeared_here.str):
2880         (runAtomic):
2881         (shouldFail):
2882         (Symbol):
2883         (string_appeared_here.a.of.arrays.m.of.atomics):
2884         * stress/SharedArrayBuffer.js:
2885
2886 2017-04-19  Mark Lam  <mark.lam@apple.com>
2887
2888         B3StackmapSpecial should handle when stackmap values are not recoverable from a Def'ed arg.
2889         https://bugs.webkit.org/show_bug.cgi?id=170973
2890         <rdar://problem/30318657>
2891
2892         Reviewed by Filip Pizlo.
2893
2894         * stress/regress-170973.js: Added.
2895
2896 2017-04-19  JF Bastien  <jfbastien@apple.com>
2897
2898         WebAssembly: limit slow memories
2899         https://bugs.webkit.org/show_bug.cgi?id=170825
2900
2901         Reviewed by Saam Barati.
2902
2903         * wasm.yaml:
2904         * wasm/stress/oom.js: Added.
2905         (try.true.WebAssemblyMemoryMode):
2906         (catch):
2907
2908 2017-04-19  JF Bastien  <jfbastien@apple.com>
2909
2910         WebAssembly: don't expose any WebAssembly JS object if JIT is off
2911         https://bugs.webkit.org/show_bug.cgi?id=170782
2912
2913         Reviewed by Saam Barati.
2914
2915         * wasm.yaml:
2916         * wasm/noJIT/noJIT.js: Added.
2917
2918 2017-04-18  Mark Lam  <mark.lam@apple.com>
2919
2920         r211670 broke double to int conversion.
2921         https://bugs.webkit.org/show_bug.cgi?id=170961
2922         <rdar://problem/31687696>
2923
2924         Reviewed by Yusuke Suzuki.
2925
2926         * microbenchmarks/double-to-int32.js: Added.
2927         * stress/to-int32-sensible2.js: Added.
2928
2929 2017-04-18  Oleksandr Skachkov  <gskachkov@gmail.com>
2930
2931         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
2932         https://bugs.webkit.org/show_bug.cgi?id=163208
2933
2934         Reviewed by Saam Barati.
2935
2936         * stress/eval-func-decl-block-scoping-reassign.js: Added.
2937         (assert):
2938         (throw.new.Error.f):
2939         (throw.new.Error):
2940         * stress/eval-func-decl-block-with-remove.js: Added.
2941         (assert):
2942         (foo.boo):
2943         (foo):
2944         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
2945         (assert):
2946         (assertThrow):
2947         (foo):
2948         (boo):
2949         (joo):
2950         (koo):
2951         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
2952         (assert):
2953         (assertThrow):
2954         (foo):
2955         (boo):
2956         (hoo):
2957         (joo):
2958         (koo):
2959         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
2960         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
2961         (assert):
2962         (assertThrow):
2963         (foo):
2964         (boo):
2965         (goo):
2966         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
2967         (assert):
2968         (assertThrow):
2969         (foo):
2970         (boo):
2971         (boo.let.val2):
2972         (boo.let.val3):
2973         * stress/eval-func-decl-in-frozen-global.js: Added.
2974         (assert):
2975         (assertThrow):
2976         (throw.new.Error):
2977         (Object.freeze):
2978         * stress/eval-func-decl-in-global-of-eval.js: Added.
2979         (assert):
2980         (assertThrow):
2981         (bar):
2982         (baz):
2983         (foobar):
2984         * stress/eval-func-decl-in-global.js: Added.
2985         (assert):
2986         (assertThrow):
2987         * stress/eval-func-decl-in-if.js: Added.
2988         (assert):
2989         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
2990         (assert):
2991         (assertThrow):
2992         (foo):
2993         (boo):
2994         (foobar):
2995         (hoo):
2996         (joo):
2997         (koo):
2998         (loo):
2999         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
3000         (assert):
3001         (assertThrow):
3002         (foo):
3003         (boo):
3004         (goo):
3005         * stress/variable-under-tdz-eval-tricky.js:
3006         (assert):
3007         * test262.yaml:
3008
3009 2017-04-18  Filip Pizlo  <fpizlo@apple.com>
3010
3011         wasm/function-tests/memory-multiagent times out sometimes
3012         https://bugs.webkit.org/show_bug.cgi?id=170958
3013
3014         Reviewed by Keith Miller.
3015         
3016         Add the ability to skip tests easily. Skip the test.
3017
3018         * wasm.yaml:
3019         * wasm/function-tests/memory-multiagent.js:
3020
3021 2017-04-18  Saam Barati  <sbarati@apple.com>
3022
3023         Follow up to debug build stack overflow in test after r215453
3024
3025         Rubber stamped by Mark Lam.
3026
3027         * stress/call-apply-exponential-bytecode-size.js: Decrease the call
3028         size to prevent stack overflow errors on debug builds.
3029
3030 2017-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
3031
3032         [DFG] Convert ValueAdd(Int32, String) => MakeRope(ToString(Int32), String)
3033         https://bugs.webkit.org/show_bug.cgi?id=170943
3034
3035         Reviewed by Geoffrey Garen.
3036
3037         * microbenchmarks/number-to-string-with-add-empty.js: Added.
3038         (toStringLeft):
3039         (toStringRight):
3040         * microbenchmarks/number-to-string-with-add-in-loop.js: Added.
3041         (toStringLeft):
3042         (toStringRight):
3043         * microbenchmarks/number-to-string-with-add.js: Added.
3044         (toStringLeft):
3045         (toStringRight):
3046         * stress/number-to-string-with-add.js: Added.
3047         (shouldBe):
3048         (toStringRight):
3049         (toStringLeftEmpty):
3050         (toStringRightEmpty):
3051
3052 2017-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
3053
3054         [DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object
3055         https://bugs.webkit.org/show_bug.cgi?id=170940
3056
3057         Reviewed by Filip Pizlo.
3058
3059         * microbenchmarks/for-of-array.js: Added.
3060         (fn):
3061
3062 2017-04-17  Saam Barati  <sbarati@apple.com>
3063
3064         BytecodeGenerator ".call" and ".apply" is exponential in nesting depth
3065         https://bugs.webkit.org/show_bug.cgi?id=139847
3066         <rdar://problem/19321122>
3067
3068         Reviewed by Oliver Hunt.
3069
3070         * stress/call-apply-exponential-bytecode-size.js: Added.
3071         (assert):
3072         (const.inc):
3073         (const.inc2):
3074         (bar):
3075         (randomApplyOrCall):
3076         (baz):
3077         (jaz):
3078         (haz):
3079         (foo):
3080
3081 2017-04-17  Mark Lam  <mark.lam@apple.com>
3082
3083         JSArray::appendMemcpy() needs to handle copying from Undecided indexing type too.
3084         https://bugs.webkit.org/show_bug.cgi?id=170896
3085         <rdar://problem/31651319>
3086
3087         Reviewed by JF Bastien and Keith Miller.
3088
3089         * stress/regress-170896.js: Added.
3090
3091 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3092
3093         test262: test262/test/built-ins/Object/prototype/toLocaleString/primitive_this_value.js
3094         https://bugs.webkit.org/show_bug.cgi?id=170882
3095
3096         Reviewed by Saam Barati.
3097
3098         * test262.yaml:
3099
3100 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3101
3102         test262: test262/test/built-ins/isNaN/toprimitive-not-callable-throws.js
3103         https://bugs.webkit.org/show_bug.cgi?id=170888
3104
3105         Reviewed by Saam Barati.
3106
3107         * stress/computed-accessor.js:
3108         * stress/eval-in-arrow-function.js:
3109         * stress/rest-elements.js:
3110         * stress/string-object-define-own-property.js:
3111         Remove unused shouldThrow.
3112
3113         * stress/symbol-toprimitive-errors.js: Added.
3114         Check for ToPrimitive TypeErrors.
3115
3116         * test262.yaml:
3117
3118 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3119
3120         test262: test262/test/language/expressions/tagged-template/template-object.js
3121         https://bugs.webkit.org/show_bug.cgi?id=170878
3122
3123         Reviewed by Saam Barati.
3124
3125         * stress/array-length-not-writable.js: Added.
3126         (assert):
3127         * test262.yaml:
3128
3129 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3130
3131         test262: test262/test/built-ins/Object/getOwnPropertyNames/15.2.3.4-4-44.js
3132         https://bugs.webkit.org/show_bug.cgi?id=170879
3133
3134         Reviewed by Saam Barati.
3135
3136         * ChakraCore/test/es5/enumerable.baseline-jsc:
3137         * test262.yaml:
3138
3139 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3140
3141         test262: test262/test/built-ins/Date/prototype/Symbol.toPrimitive/name.js
3142         https://bugs.webkit.org/show_bug.cgi?id=170884
3143
3144         Reviewed by Yusuke Suzuki.
3145
3146         * test262.yaml:
3147
3148 2017-04-15  Joseph Pecoraro  <pecoraro@apple.com>
3149
3150         test262: test262/test/language/global-code/new.target-arrow.js
3151         https://bugs.webkit.org/show_bug.cgi?id=170872
3152
3153         Reviewed by Saam Barati.
3154
3155         * stress/async-arrow-functions-lexical-new.target-binding.js:
3156         (shouldThrowAsync): Deleted.
3157         (shouldThrowAsync.async): Deleted.
3158         This code should have thrown a SyntaxError. Instead it was throwing
3159         a ReferenceError for the internal @newTargetLocal variable.
3160
3161         * stress/new-target-syntax-errors.js:
3162         Cover the arrow function in global code cases.
3163
3164         * ChakraCore.yaml:
3165         * ChakraCore/test/es6/globalLambdaNewTargetSyntaxError.baseline-jsc:
3166         We now pass with an expected SyntaxError. Our error message is different.
3167
3168         * test262.yaml:
3169
3170 2017-04-14  Saam Barati  <sbarati@apple.com>
3171
3172         ParseInt intrinsic in DFG backend doesn't properly flush its operands
3173         https://bugs.webkit.org/show_bug.cgi?id=170865
3174
3175         Reviewed by Mark Lam and Geoffrey Garen.
3176
3177         * stress/parse-int-intrinsic-dfg-backend-flush.js: Added.
3178         (assert):
3179         (foo):
3180
3181 2017-04-14  Caitlin Potter  <caitp@igalia.com>
3182
3183         [JSC] use ExpressionErrorClassifier for AwaitExpression operand
3184         https://bugs.webkit.org/show_bug.cgi?id=170844
3185
3186         Reviewed by Saam Barati.
3187
3188         * stress/regress-170732.js: Added.
3189
3190 2017-04-14  Oleksandr Skachkov  <gskachkov@gmail.com>
3191
3192         Safari 10.1 JSON.parse returns incorrect object for numeric keys with decimal values
3193         https://bugs.webkit.org/show_bug.cgi?id=170442
3194
3195         Reviewed by Yusuke Suzuki.
3196
3197         * stress/object-number-properties.js:
3198
3199 2017-04-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3200
3201         [JSC] Date.parse should accept wider range of representation
3202         https://bugs.webkit.org/show_bug.cgi?id=170720
3203
3204         Reviewed by Darin Adler.
3205
3206         * stress/date-relaxed.js: Added.
3207         (shouldBe):
3208         (throw.new.Error):
3209
3210 2017-04-13  Mark Lam  <mark.lam@apple.com>
3211
3212         Should use flushDirect() when flushing the scopeRegister due to needsScopeRegister().
3213         https://bugs.webkit.org/show_bug.cgi?id=170661
3214         <rdar://problem/31579046>
3215
3216         Reviewed by Filip Pizlo.
3217
3218         * stress/regress-170661.js: Added.
3219
3220 2017-04-13  JF Bastien  <jfbastien@apple.com>
3221
3222         WebAssembly: manage memory better
3223         https://bugs.webkit.org/show_bug.cgi?id=170628
3224
3225         Reviewed by Keith Miller, Michael Saboff.
3226
3227         * wasm/Builder.js: move a helper out so tests can use it
3228         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
3229         * wasm/WASM.js: add utilities to classify opcodes
3230         (export.opcodes):
3231         (export.const.memoryAccessInfo.op.const.sign):
3232         * wasm/function-tests/memory-access-past-4gib.js: Added. This test
3233         fails before this patch.
3234         (const.op.of.WASM.opcodes):
3235         * wasm/function-tests/memory-many.js: Added. This simple tests
3236         just shouldn't crash. In verbose mode it's useful at determining
3237         if the GC falls behind or not.
3238         * wasm/function-tests/memory-multiagent.js: Added. Emulate postMessage.
3239         (const.startAgents.numAgentsToStart.a.agent.receiveBroadcast):
3240         (const.startAgents.numAgentsToStart.a.write.const.idx.Math.random):
3241         (const.broadcastToAgents):
3242         * wasm/js-api/extension-MemoryMode.js: verbose logging.
3243         (testMemoryNoMax):
3244         (testMemory):
3245         (testInstanceNoMemory):
3246         (testInstanceNoMax):
3247         (testInstance):
3248         * wasm/utilities.js: move a utility here.
3249
3250 2017-04-12  Joseph Pecoraro  <pecoraro@apple.com>
3251
3252         test262: test262/test/built-ins/NativeErrors/EvalError/proto.js
3253         https://bugs.webkit.org/show_bug.cgi?id=170668
3254
3255         Reviewed by Keith Miller.
3256
3257         * ChakraCore.yaml:
3258         * ChakraCore/test/Lib/error.baseline-jsc: Added.
3259         This test does not match the spec.
3260
3261         * test262.yaml:
3262
3263 2017-04-12  Joseph Pecoraro  <pecoraro@apple.com>
3264
3265         test262: test262/test/language/literals/regexp/u-dec-esc.js
3266         https://bugs.webkit.org/show_bug.cgi?id=170687
3267
3268         Reviewed by Michael Saboff.
3269
3270         * test262.yaml:
3271
3272 2017-04-11  Michael Saboff  <msaboff@apple.com>
3273
3274         Implement Object.isFrozen() and Object.isSealed() per ECMA spec
3275         https://bugs.webkit.org/show_bug.cgi?id=170753
3276
3277         Reviewed by Mark Lam.
3278
3279         Added JSC baseline and enabled defineIndexProperty test.
3280
3281         Note that JSC differs from Chakra in that a JSC doesn't use indexed
3282         properties placed on the Array prototype when sorting the indexed 
3283         properties of an Object.  This is behavior is considered undefined
3284         in the standard.
3285
3286         * ChakraCore.yaml:
3287         * ChakraCore/test/es5/defineIndexProperty.baseline-jsc: Added.
3288
3289 2017-04-11  Joseph Pecoraro  <pecoraro@apple.com>
3290
3291         test262: test262/test/annexB/language/comments/multi-line-html-close.js
3292         https://bugs.webkit.org/show_bug.cgi?id=170648
3293
3294         Reviewed by Keith Miller.
3295
3296         * test262.yaml:
3297
3298 2017-04-11  Joseph Pecoraro  <pecoraro@apple.com>
3299
3300         test262: test262/test/built-ins/Array/S15.4.3_A2.2.js
3301         https://bugs.webkit.org/show_bug.cgi?id=170652
3302
3303         Reviewed by Michael Saboff.
3304
3305         * stress/native-constructors-length.js: Added.
3306         (assertLengthDescriptorAttributes):
3307         Add a quick test for the length properties of all native constructors.
3308
3309         * ChakraCore/test/es5/enumerable.baseline-jsc:
3310         Rebaseline expectations for this test.
3311
3312         * test262.yaml:
3313
3314 2017-04-10  Keith Miller  <keith_miller@apple.com>
3315
3316         WebAssembly: Update spec tests
3317         https://bugs.webkit.org/show_bug.cgi?id=170683
3318
3319         Rubber-stamped by JF Bastien.
3320
3321         * wasm.yaml:
3322         * wasm/spec-tests/br_table.wast.js:
3323         * wasm/spec-tests/conversions.wast.js: Removed.
3324         * wasm/spec-tests/f32_bitwise.wast.js: Added.
3325         * wasm/spec-tests/f32_cmp.wast.js:
3326         * wasm/spec-tests/f64_bitwise.wast.js: Added.
3327         * wasm/spec-tests/f64_cmp.wast.js:
3328         * wasm/spec-tests/i32.wast.js:
3329         * wasm/spec-tests/i64.wast.js:
3330         * wasm/spec-tests/int_exprs.wast.js:
3331         * wasm/spec-tests/memory.wast.js:
3332
3333 2017-04-09  Joseph Pecoraro  <pecoraro@apple.com>
3334
3335         test262: test262/test/annexB/language/expressions/object/__proto__-fn-name.js
3336         https://bugs.webkit.org/show_bug.cgi?id=170650
3337
3338         Reviewed by Saam Barati.
3339
3340         * stress/inferred-names.js:
3341         * test262.yaml:
3342
3343 2017-04-09  Joseph Pecoraro  <pecoraro@apple.com>
3344
3345         test262: test262/test/annexB/language/literals/regexp/identity-escape.js
3346         https://bugs.webkit.org/show_bug.cgi?id=170651
3347
3348         Reviewed by Saam Barati.
3349
3350         * test262.yaml:
3351
3352 2017-04-07  Michael Saboff  <msaboff@apple.com>
3353
3354         Fix and enable ChakraCore/test/es6/ES6Function_bugs.js after r215072
3355         https://bugs.webkit.org/show_bug.cgi?id=170580
3356
3357         Reviewed by JF Bastien.
3358
3359         Commented out subtest that expects defineProperty("length") to a getter on a
3360         sealed function shouldn't throw.
3361
3362         * ChakraCore.yaml:
3363         * ChakraCore/test/es6/ES6Function_bugs.js:
3364
3365 2017-04-06  Michael Saboff  <msaboff@apple.com>
3366
3367         Cannot Object.seal() or Object.freeze() global "this"
3368         https://bugs.webkit.org/show_bug.cgi?id=170549
3369
3370         Reviewed by Mark Lam.
3371
3372         Enabled failing tests fixed by the corresponding code change:
3373             ChakraCore/test/LetConst/delete.js
3374             ChakraCore/test/LetConst/dop.js
3375             ChakraCore/test/LetConst/dop1.js
3376
3377         * ChakraCore.yaml:
3378         * ChakraCore/test/LetConst/dop.baseline-jsc: Added JSC specific expected output.
3379         * ChakraCore/test/LetConst/dop1.baseline-jsc: Added JSC specific expected output.
3380
3381 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
3382
3383         test262: ES2017 test progressions need updated expectations (arguments.caller removed)
3384         https://bugs.webkit.org/show_bug.cgi?id=170536
3385
3386         Reviewed by Mark Lam.
3387
3388         * test262.yaml:
3389         After r208867 the tests are out of date and are now expected to fail.
3390
3391 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
3392
3393         test262: Final rebaseline of existing tests, a few tests have started failing
3394         https://bugs.webkit.org/show_bug.cgi?id=170538
3395
3396         Reviewed by Mark Lam.
3397
3398         * test262.yaml:
3399         These tests started failing a while ago. Mark them as legitmate failures.
3400
3401 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
3402
3403         test262: Rebaseline expectations for now passing tests
3404         https://bugs.webkit.org/show_bug.cgi?id=170532
3405
3406         Reviewed by Ryosuke Niwa.
3407
3408         * test262.yaml:
3409         Update expectations for tests we are now passing.
3410
3411 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
3412
3413         test262: module test progressions need updated expectations (@@iterator changes)
3414         https://bugs.webkit.org/show_bug.cgi?id=170535
3415
3416         Reviewed by Saam Barati.
3417
3418         * test262.yaml:
3419         After r212430 the tests are out of date and are now expected to fail.
3420
3421 2017-04-05  Michael Saboff  <msaboff@apple.com>
3422
3423         Unreviewed rollout of r214642 as the test still intermittently fails.
3424
3425         Disabled ChakraCore/test/fieldopts/objtypespec-newobj-invalidation.1.js.
3426
3427         * ChakraCore.yaml:
3428
3429 2017-04-05  Michael Saboff  <msaboff@apple.com>
3430
3431         REGRESSION (Safari 10.1): Inserting elements into arrays fails when array contains very large numbers
3432         https://bugs.webkit.org/show_bug.cgi?id=170264
3433         <rdar://problem/31375593>
3434
3435         Rubber-stamped by Saam Barati.
3436
3437         The original bug was fixed in: https://trac.webkit.org/changeset/214714
3438         I'm just adding another test for good measure.
3439
3440         * stress/double-array-to-array-storage.js: Added.
3441         (assert):
3442
3443 2017-04-05  Keith Miller  <keith_miller@apple.com>
3444
3445         WebAssembly: We shouldn't need to pin size registers if we have a fast memory.
3446         https://bugs.webkit.org/show_bug.cgi?id=170504
3447
3448         Reviewed by Mark Lam.
3449
3450         * wasm/function-tests/trap-after-cross-instance-call.js: Added.
3451         (b.new.WebAssembly.Memory):
3452         (importObject.foo.bar):
3453         (wasmFrameCountFromError):
3454
3455 2017-03-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3456
3457         [JSC] Generate TemplateObjects at linking time
3458         https://bugs.webkit.org/show_bug.cgi?id=169743
3459
3460         Reviewed by Keith Miller.
3461
3462         * stress/template-string-tags-eval.js: Added.
3463         (shouldBe):
3464         (tag):
3465
3466 2017-04-04  Mark Lam  <mark.lam@apple.com>
3467
3468         On ARM64, DFG::SpeculativeJIT::compileArithMod() failed to ensure result is of DataFormatInt32.
3469         https://bugs.webkit.org/show_bug.cgi?id=170473
3470         <rdar://problem/29912391>
3471
3472         Reviewed by Saam Barati.
3473
3474         * stress/regress-170473.js: Added.
3475
3476 2017-04-03  Mark Lam  <mark.lam@apple.com>
3477
3478         Fix incorrect capacity delta calculation reported in SparseArrayValueMap::add().
3479         https://bugs.webkit.org/show_bug.cgi?id=170412
3480         <rdar://problem/29697336>
3481
3482         Reviewed by Filip Pizlo.
3483
3484         * stress/regress-170412.js: Added.
3485
3486 2017-04-03  Keith Miller  <keith_miller@apple.com>
3487
3488         WebAssembly: Update spec tests
3489         https://bugs.webkit.org/show_bug.cgi?id=170361
3490
3491         Rubber-stamped by Saam Barati.
3492
3493         Update the spec tests to run tests generated by the newer spec
3494         test builder wasm-spec/test/builder.py. This patch also adds the
3495         necessary harness code in spec-harness.js so we can run the tests.
3496
3497         * wasm.yaml:
3498         * wasm/import-spec-tests.rb:
3499         * wasm/spec-harness.js: Added.
3500         (import.string_appeared_here.then):
3501         (test):
3502         (promise_test):
3503         (let.assert_unreached):
3504         * wasm/spec-harness/index.js: Added.
3505         (let.testNum):
3506         (assertThrows):
3507         (_assert):
3508         (ValueResult):
3509         (ErrorResult):
3510         (Result.prototype.isError):
3511         (binary):
3512         (module):
3513         (uniqueTest):
3514         (assert_invalid):
3515         (assert_soft_invalid):
3516         (register):
3517         (call):
3518         (get instance):
3519         (exports):
3520         (run):
3521         (assert_unlinkable):
3522         (assert_uninstantiable):
3523         (assert_trap):
3524         (try.f):
3525         (catch):
3526         (assert_exhaustion):
3527         (assert_return):
3528         (assert_return_nan):
3529         * wasm/spec-harness/testharness.css: Added.
3530         (html):
3531         (#log .warning,):
3532         (#log .error,):
3533         (section#summary):
3534         (table#results):
3535         (table#results th:first-child,):
3536         (table#results th:last-child,):
3537         (table#results.assertions th:last-child,):
3538         (table#results th):
3539         (table#results td):
3540         (tr.pass > td:first-child):
3541         (tr.fail > td:first-child):
3542         (tr.timeout > td:first-child):
3543         (tr.notrun > td:first-child):
3544         (.pass > td:first-child, .fail > td:first-child, .timeout > td:first-child, .notrun > td:first-child):
3545         (table#results span):
3546         (table#results span.expected):
3547         (table#results span.actual):
3548         (span.ok):
3549         (tr.error):
3550         (span.timeout):
3551         (span.ok, span.timeout, span.error):
3552         * wasm/spec-harness/testharness.js: Added.
3553         (WindowTestEnvironment):
3554         (WindowTestEnvironment.prototype._dispatch):
3555         (WindowTestEnvironment.prototype._forEach_windows):
3556         (WindowTestEnvironment.prototype.on_tests_ready):
3557         (WindowTestEnvironment.prototype.setup_messages):
3558         (WindowTestEnvironment.prototype.next_default_test_name):
3559         (WindowTestEnvironment.prototype.on_new_harness_properties):
3560         (WindowTestEnvironment.prototype.add_on_loaded_callback):
3561         (WindowTestEnvironment.prototype.test_timeout):
3562         (WindowTestEnvironment.prototype.global_scope):
3563         (WorkerTestEnvironment):
3564         (WorkerTestEnvironment.prototype._dispatch):
3565         (WorkerTestEnvironment.prototype._add_message_port):
3566         (WorkerTestEnvironment.prototype.next_default_test_name):
3567         (WorkerTestEnvironment.prototype.on_new_harness_properties):
3568         (WorkerTestEnvironment.prototype.on_tests_ready):
3569         (WorkerTestEnvironment.prototype.add_on_loaded_callback):
3570         (WorkerTestEnvironment.prototype.test_timeout):
3571         (WorkerTestEnvironment.prototype.global_scope):
3572         (DedicatedWorkerTestEnvironment):
3573         (DedicatedWorkerTestEnvironment.prototype.on_tests_ready):
3574         (SharedWorkerTestEnvironment):
3575         (SharedWorkerTestEnvironment.prototype.on_tests_ready):
3576         (ServiceWorkerTestEnvironment):
3577         (ServiceWorkerTestEnvironment.prototype.add_on_loaded_callback):
3578         (create_test_environment):
3579         (is_shared_worker):
3580         (is_service_worker):
3581         (test):
3582         (async_test):
3583         (promise_test):
3584         (this.wait_for):
3585         (EventWatcher):
3586         (setup):
3587         (done):
3588         (generate_tests):
3589         (step_timeout):
3590         (truncate):
3591         (is_node):
3592         (format_value):
3593         * wasm/spec-harness/testharnessreport.js: Added.
3594         * wasm/spec-harness/wasm-constants.js: Added.
3595         (bytes):
3596         (bytesWithHeader):
3597         (makeSig):
3598         (makeSig_v_x):
3599         (makeSig_v_xx):
3600         (makeSig_r_v):
3601         (makeSig_r_x):
3602         (makeSig_r_xx):
3603         (assertTraps):
3604         (assertWasmThrows):
3605         * wasm/spec-harness/wasm-module-builder.js: Added.
3606         (Binary.prototype.emit_u8):
3607         (Binary.prototype.emit_u16):
3608         (Binary.prototype.emit_u32):
3609         (Binary.prototype.emit_u32v):
3610         (Binary.prototype.emit_bytes):
3611         (Binary.prototype.emit_string):
3612         (Binary.prototype.emit_header):
3613         (Binary.prototype.emit_section):
3614         (Binary):
3615         (WasmFunctionBuilder):
3616         (WasmFunctionBuilder.prototype.exportAs):
3617         (WasmFunctionBuilder.prototype.exportFunc):
3618         (WasmFunctionBuilder.prototype.addBody):
3619         (WasmFunctionBuilder.prototype.addLocals):
3620         (WasmFunctionBuilder.prototype.end):
3621         (WasmGlobalBuilder):
3622         (WasmGlobalBuilder.prototype.exportAs):
3623         (WasmModuleBuilder):
3624         (WasmModuleBuilder.prototype.addStart):
3625         (WasmModuleBuilder.prototype.addMemory):
3626         (WasmModuleBuilder.prototype.addExplicitSection):
3627         (WasmModuleBuilder.prototype.addType):
3628         (WasmModuleBuilder.prototype.addGlobal):
3629         (WasmModuleBuilder.prototype.addFunction):
3630         (WasmModuleBuilder.prototype.addImport):
3631         (WasmModuleBuilder.prototype.addImportedGlobal):
3632         (WasmModuleBuilder.prototype.addImportedMemory):
3633         (WasmModuleBuilder.prototype.addImportedTable):
3634         (WasmModuleBuilder.prototype.addExport):
3635         (WasmModuleBuilder.prototype.addExportOfKind):
3636         (WasmModuleBuilder.prototype.addDataSegment):
3637         (WasmModuleBuilder.prototype.exportMemoryAs):
3638         (WasmModuleBuilder.prototype.addFunctionTableInit):
3639         (WasmModuleBuilder.prototype.appendToTable):
3640         (WasmModuleBuilder.prototype.setFunctionTableLength):
3641         (WasmModuleBuilder.prototype.toArray):
3642         (WasmModuleBuilder.prototype.toBuffer):
3643         (WasmModuleBuilder.prototype.instantiate):
3644         * wasm/spec-harness/wast.js: Added.
3645         (normalize):
3646         (require.else._registry.name):
3647         (require):
3648         (add_hex_char):
3649         (add_char):
3650         (string_with):
3651         (list_of_opt):
3652         (break_bytes.f):
3653         (break_bytes):
3654         (f):
3655         (decls):
3656         (func_type):
3657         (limits):
3658         (global_type):
3659         (testop):
3660         (relop):
3661         (unop):
3662         (binop):
3663         (cvtop):
3664         (oper):
3665         (mem_size):
3666         (extension):
3667         (memop):
3668         (storeop):
3669         (var):
3670         (constop):
3671         (instr.else.switch.case.0.f):
3672         (instr.else.switch.case.1.f.1):
3673         (instr.else.switch.case.2.f.2):
3674         (instr):
3675         (func_with_name):
3676         (func):
3677         (start):
3678         (table):
3679         (memory):
3680         (segment):
3681         (elems):
3682         (data):
3683         (typedef):
3684         (import_kind):
3685         (import):
3686         (export_kind):
3687         (export):
3688         (var_opt):
3689         (is_func_import):
3690         (is_table_import):
3691         (is_memory_import):
3692         (is_global_import):
3693         (f.1):
3694         (f.2):
3695         (f.3):
3696         (module_with_var_opt):
3697         (module_):
3698         (literal):
3699         (definition):
3700         (access):
3701         (action):
3702         (script):
3703         (_registry.string_appeared_here):
3704         (init):
3705         (make_matrix):
3706         (copy):
3707         (append):
3708         (sub):
3709         (fill):
3710         (blit):
3711         (iter):
3712         (map):
3713         (iteri):
3714         (mapi):
3715         (to_list):
3716         (list_length):
3717         (of_list):
3718         (fold_left):
3719         (fold_right):
3720         (maxson):
3721         (trickle):
3722         (bubble):
3723         (trickleup):
3724         (sort):
3725         (merge):
3726         (isortto):
3727         (sortto):
3728         (stable_sort):
3729         (import_type):
3730         (export_type):
3731         (dims.n):
3732         (dims.d.i):
3733         (dims):
3734         (map_file):
3735         (create):
3736         (of_array):
3737         (slice_left):
3738         (slice_right):
3739         (slice_left_1):
3740         (slice_right_1):
3741         (slice_left_2):
3742         (slice_right_2):
3743         (array1_of_genarray):
3744         (array2_of_genarray):
3745         (array3_of_genarray):
3746         (reshape_1):
3747         (reshape_2):
3748         (reshape_3):
3749         (reshape):
3750         (__):
3751         (contents):
3752         (to_bytes):
3753         (nth):
3754         (length):
3755         (clear):
3756         (reset):
3757         (resize):
3758         (add_substring):
3759         (add_subbytes):
3760         (add_string):
3761         (add_bytes):
3762         (add_buffer):
3763         (add_channel):
3764         (output_buffer):
3765         (closing):
3766         (advance_to_closing):
3767         (advance_to_non_alpha):
3768         (find_ident):
3769         (add_substitute):
3770         (make):
3771    &