Web Inspector: add RemoteObject.fetchProperties and some basic tests for RemoteObject API
[WebKit-https.git] / JSTests / ChangeLog
1 2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2
3         [DFG] Define defs for MapSet/SetAdd to participate in CSE
4         https://bugs.webkit.org/show_bug.cgi?id=179911
5
6         Reviewed by Saam Barati.
7
8         In addition to these tests, map-set-cse.js and set-add-cse.js work.
9
10         * stress/map-set-change-get.js: Added.
11         (shouldBe):
12         (test):
13         * stress/map-set-create-bucket.js: Added.
14         (shouldBe):
15         (test):
16         * stress/set-add-create-bucket.js: Added.
17         (shouldBe):
18
19 2018-01-03  Michael Saboff  <msaboff@apple.com>
20
21         Disable SharedArrayBuffers from Web API
22         https://bugs.webkit.org/show_bug.cgi?id=181266
23
24         Reviewed by Saam Barati.
25
26         Disabled SharedArrayBuffer tests.
27
28         * stress/SharedArrayBuffer-opt.js:
29         * stress/SharedArrayBuffer.js:
30         * stress/array-buffer-byte-length.js:
31         * stress/atomics-add-uint32.js:
32         * stress/atomics-known-int-use.js:
33         * stress/atomics-neg-zero.js:
34         * stress/atomics-store-return.js:
35         * stress/lars-sab-workers.js:
36         * stress/regress-159779-1.js:
37         * stress/regress-159779-2.js:
38         * stress/regress-170473.js:
39         * test262.yaml:
40
41 2018-01-03  Caio Lima  <ticaiolima@gmail.com>
42
43         [ESNext][BigInt] Failing test stress/big-int-constructor-oom.js into MIPS
44         https://bugs.webkit.org/show_bug.cgi?id=181258
45
46         Reviewed by Antonio Gomes.
47
48         * stress/big-int-constructor-gc.js:
49         * stress/big-int-constructor-oom.js:
50
51 2018-01-03  Robin Morisset  <rmorisset@apple.com>
52
53         Inlining of a function that ends in op_unreachable crashes
54         https://bugs.webkit.org/show_bug.cgi?id=181027
55
56         Reviewed by Filip Pizlo.
57
58         * stress/inlining-unreachable.js: Added.
59         (bar):
60         (baz):
61         (i.catch):
62
63 2018-01-02  Saam Barati  <sbarati@apple.com>
64
65         Incorrect assertion inside AccessCase
66         https://bugs.webkit.org/show_bug.cgi?id=181200
67         <rdar://problem/35494754>
68
69         Reviewed by Yusuke Suzuki.
70
71         * stress/setter-same-base-and-rhs-invalid-assertion-inside-access-case.js: Added.
72         (ctor):
73         (theFunc):
74         (run):
75
76 2018-01-02  Caio Lima  <ticaiolima@gmail.com>
77
78         [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
79         https://bugs.webkit.org/show_bug.cgi?id=175359
80
81         Reviewed by Yusuke Suzuki.
82
83         * bigIntTests.yaml:
84         * stress/big-int-as-key.js: Added.
85         * stress/big-int-constructor-gc.js: Added.
86         * stress/big-int-constructor-oom.js: Added.
87         * stress/big-int-constructor-properties.js: Added.
88         * stress/big-int-constructor-prototype-prop-descriptor.js: Added.
89         * stress/big-int-constructor-prototype.js: Added.
90         * stress/big-int-constructor.js: Added.
91         * stress/big-int-function-apply.js:
92         * stress/big-int-length.js: Added.
93         * stress/big-int-prop-descriptor.js: Added.
94         * stress/big-int-proto-constructor.js: Added.
95         * stress/big-int-proto-name.js: Added.
96         * stress/big-int-prototype-properties.js: Added.
97         * stress/big-int-prototype-proto.js: Added.
98         * stress/big-int-prototype-value-of.js: Added.
99         * stress/big-int-prototype-symbol-to-string-tag.js: Added.
100         * stress/big-int-prototype-to-string-apply.js: Added.
101         * stress/big-int-to-object.js: Added.
102         * stress/big-int-to-string.js: Added.
103
104 2017-12-28  Saam Barati  <sbarati@apple.com>
105
106         Assertion used to determine if something is an async generator is wrong
107         https://bugs.webkit.org/show_bug.cgi?id=181168
108         <rdar://problem/35640560>
109
110         Reviewed by Yusuke Suzuki.
111
112         * stress/async-generator-assertion.js: Added.
113
114 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
115
116         Skip stress/splay-flash-access tests on memory limited platforms
117         https://bugs.webkit.org/show_bug.cgi?id=181086
118
119         Reviewed by Carlos Alberto Lopez Perez.
120
121         These tests use about 185M of memory, and occasionally get OOM-killed
122         on memory limited platforms.
123
124         * stress/splay-flash-access-1ms.js:
125         * stress/splay-flash-access.js:
126
127 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
128
129         Skip slow jsc tests on embedded platforms
130         https://bugs.webkit.org/show_bug.cgi?id=180937
131
132         Reviewed by Carlos Alberto Lopez Perez.
133
134         The tests typeProfiler/deltablue-for-of.js and
135         typeProfiler/getter-richards.js take a very long time in the
136         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
137         thus always timeout. They should be skipped on these platforms.
138
139         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
140         * typeProfiler/getter-richards.js: Skip on arm*/mips.
141
142 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
143
144         [JSC] Do not check isValid() in op_new_regexp
145         https://bugs.webkit.org/show_bug.cgi?id=180970
146
147         Reviewed by Saam Barati.
148
149         * stress/regexp-syntax-error-invalid-flags.js: Added.
150         (shouldThrow):
151
152 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
153
154         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
155         https://bugs.webkit.org/show_bug.cgi?id=180712
156
157         Reviewed by Michael Catanzaro.
158
159         stress/call-apply-exponential-bytecode-size.js crashes if the
160         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
161         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
162         should skip the test on other platforms.
163
164         * stress/call-apply-exponential-bytecode-size.js:
165
166 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
167
168         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
169         https://bugs.webkit.org/show_bug.cgi?id=179762
170
171         Reviewed by Saam Barati.
172
173         * stress/call-varargs-double-new-array-buffer.js: Added.
174         (assert):
175         (bar):
176         (foo):
177         * stress/call-varargs-spread-new-array-buffer.js: Added.
178         (assert):
179         (bar):
180         (foo):
181         * stress/call-varargs-spread-new-array-buffer2.js: Added.
182         (assert):
183         (bar):
184         (foo):
185         * stress/forward-varargs-double-new-array-buffer.js: Added.
186         (assert):
187         (test.baz):
188         (test.bar):
189         (test.foo):
190         (test):
191         * stress/new-array-buffer-sinking-osrexit.js: Added.
192         (target):
193         (test):
194         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
195         (shouldBe):
196         (test):
197         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
198         (shouldBe):
199         (target):
200         (test):
201         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
202         (assert):
203         (test1.bar):
204         (test1.foo):
205         (test1):
206         (test2.bar):
207         (test2.foo):
208         (test3.baz):
209         (test3.bar):
210         (test3.foo):
211         (test4.baz):
212         (test4.bar):
213         (test4.foo):
214         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
215         (assert):
216         (test.baz):
217         (test.bar):
218         (test.foo):
219         (test):
220         * stress/phantom-new-array-buffer-osr-exit.js: Added.
221         (assert):
222         (baz):
223         (bar):
224         (effects):
225         (foo):
226
227 2017-12-14  Saam Barati  <sbarati@apple.com>
228
229         The CleanUp after LICM is erroneously removing a Check
230         https://bugs.webkit.org/show_bug.cgi?id=180852
231         <rdar://problem/36063494>
232
233         Reviewed by Filip Pizlo.
234
235         * stress/dont-run-cleanup-after-licm.js: Added.
236
237 2017-12-14  Michael Saboff  <msaboff@apple.com>
238
239         REGRESSION (r225695): Repro crash on yahoo login page
240         https://bugs.webkit.org/show_bug.cgi?id=180761
241
242         Reviewed by JF Bastien.
243
244         New regression test.
245
246         * stress/regress-180761.js: Added.
247
248 2017-12-13  Keith Miller  <keith_miller@apple.com>
249
250         JSObjects should have a mask for loading indexed properties
251         https://bugs.webkit.org/show_bug.cgi?id=180768
252
253         Reviewed by Mark Lam.
254
255         * stress/int16-put-by-val-in-and-out-of-bounds.js:
256         (test):
257
258 2017-12-13  Saam Barati  <sbarati@apple.com>
259
260         Arrow functions need their own structure because they have different properties than sloppy functions
261         https://bugs.webkit.org/show_bug.cgi?id=180779
262         <rdar://problem/35814591>
263
264         Reviewed by Mark Lam.
265
266         * stress/arrow-function-needs-its-own-structure.js: Added.
267         (assert):
268         (readPrototype):
269         (noInline.let.f1):
270         (noInline):
271
272 2017-12-13  Saam Barati  <sbarati@apple.com>
273
274         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
275         https://bugs.webkit.org/show_bug.cgi?id=163579
276         <rdar://problem/35455798>
277
278         Reviewed by Mark Lam.
279
280         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
281         (assert):
282         (test1):
283         (i.test1):
284         (i.test1.C):
285         (i.test1.async.foo):
286         (i.test1.foo):
287         (test2):
288
289 2017-12-13  Saam Barati  <sbarati@apple.com>
290
291         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
292         https://bugs.webkit.org/show_bug.cgi?id=180734
293         <rdar://problem/35640547>
294
295         Reviewed by Yusuke Suzuki.
296
297         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
298         (__isPropertyOfType):
299         (__getProperties):
300         (__getObjects):
301         (__getRandomObject):
302         (theClass.):
303         (theClass):
304         (childClass):
305         (counter.catch):
306
307 2017-12-12  Saam Barati  <sbarati@apple.com>
308
309         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
310         https://bugs.webkit.org/show_bug.cgi?id=180725
311         <rdar://problem/35970511>
312
313         Reviewed by Michael Saboff.
314
315         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
316         (f1):
317         (f2):
318         (let.o2.valueOf):
319
320 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
321
322         [JSC] Implement optimized WeakMap and WeakSet
323         https://bugs.webkit.org/show_bug.cgi?id=179929
324
325         Reviewed by Saam Barati.
326
327         * microbenchmarks/weak-map-key.js:
328         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
329         (assert):
330         (objectKey):
331         (let.start.Date.now):
332         * stress/basic-weakmap.js: Added.
333         (shouldBe):
334         (test):
335         * stress/basic-weakset.js: Added.
336         (shouldBe):
337         (test.set new):
338         * stress/weakmap-cse-set-break.js: Added.
339         (shouldBe):
340         (test):
341         * stress/weakmap-cse.js: Added.
342         (shouldBe):
343         (test):
344         * stress/weakmap-gc.js: Added.
345         (test):
346         * stress/weakset-cse-add-break.js: Added.
347         (shouldBe):
348         (test.set new):
349         * stress/weakset-cse.js: Added.
350         (shouldBe):
351         (test.set new):
352         * stress/weakset-gc.js: Added.
353         (test.set add):
354         (test.set new):
355         (test):
356
357 2017-12-12  Saam Barati  <sbarati@apple.com>
358
359         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
360         https://bugs.webkit.org/show_bug.cgi?id=180723
361         <rdar://problem/35859726>
362
363         Reviewed by JF Bastien.
364
365         * stress/get-my-argument-by-val-constant-folding.js: Added.
366         (test):
367         (catch):
368
369 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
370
371         [ESNext][BigInt] Implement BigInt literals and JSBigInt
372         https://bugs.webkit.org/show_bug.cgi?id=179000
373
374         Reviewed by Darin Adler and Yusuke Suzuki.
375
376         * bigIntTests.yaml: Added.
377         * stress/big-int-literal-line-terminator.js: Added.
378         * stress/big-int-literals.js: Added.
379         * stress/big-int-operations-error.js: Added.
380         * stress/big-int-type-of.js: Added.
381         * stress/big-int-white-space-trailing-leading.js: Added.
382         * stress/big-int-function-apply.js: Added.
383
384 2017-12-11  Saam Barati  <sbarati@apple.com>
385
386         We need to disableCaching() in ErrorInstance when we materialize properties
387         https://bugs.webkit.org/show_bug.cgi?id=180343
388         <rdar://problem/35833002>
389
390         Reviewed by Mark Lam.
391
392         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
393         (assert):
394         (makeError):
395         (storeToStack):
396         (storeToStackAlreadyMaterialized):
397
398 2017-12-05  JF Bastien  <jfbastien@apple.com>
399
400         WebAssembly: don't eagerly checksum
401         https://bugs.webkit.org/show_bug.cgi?id=180441
402         <rdar://problem/35156628>
403
404         Reviewed by Saam Barati.
405
406         Checksum is now disabled, so tests only have <?> as the module
407         name.
408
409         * wasm/function-tests/nameSection.js:
410         * wasm/function-tests/stack-overflow.js:
411         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
412         (assertOverflows.assertThrows):
413         (assertOverflows):
414         * wasm/function-tests/stack-trace.js:
415
416 2017-12-04  JF Bastien  <jfbastien@apple.com>
417
418         Proxy all functions, except the $ objects
419         https://bugs.webkit.org/show_bug.cgi?id=180375
420
421         Reviewed by Saam Barati.
422
423         It looks like this test may have broken some executions because I
424         call some internal objects. Explicitly ignore objects whose name
425         starts with "$" because it's a bad idea anyways.
426
427         * stress/proxy-all-the-parameters.js:
428         (generateObjects):
429         (get throw):
430
431 2017-12-04  Saam Barati  <sbarati@apple.com>
432
433         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
434         https://bugs.webkit.org/show_bug.cgi?id=180366
435         <rdar://problem/35685877>
436
437         Reviewed by Michael Saboff.
438
439         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
440         (theParent):
441         (test1.base.getParentStaticValue):
442         (test1.base):
443         (test1.__v_24888.prototype.set prop):
444         (test1.__v_24888):
445         (test2.base.getParentStaticValue):
446         (test2.base):
447         (test2.__v_24888.prototype.set prop):
448         (test2.__v_24888):
449         (test2):
450
451 2017-12-01  JF Bastien  <jfbastien@apple.com>
452
453         Try proxying all function arguments
454         https://bugs.webkit.org/show_bug.cgi?id=180306
455
456         Reviewed by Saam Barati.
457
458         * stress/proxy-all-the-parameters.js: Added.
459         (isPropertyOfType):
460         (getProperties):
461         (generateObjects):
462         (getObjects):
463         (getFunctions):
464         (get throw):
465         (let.o.of.getObjects.let.f.of.getFunctions.catch):
466
467 2017-12-01  JF Bastien  <jfbastien@apple.com>
468
469         JavaScriptCore: missing exception checks in Math functions that take more than one argument
470         https://bugs.webkit.org/show_bug.cgi?id=180297
471         <rdar://problem/35745556>
472
473         Reviewed by Mark Lam.
474
475         * stress/math-exceptions.js: Added.
476         (get try):
477         (catch):
478
479 2017-12-01  JF Bastien  <jfbastien@apple.com>
480
481         JavaScriptCore: add test for weird class static getters
482         https://bugs.webkit.org/show_bug.cgi?id=180281
483         <rdar://problem/35592139>
484
485         Reviewed by Mark Lam.
486
487         I fixed a bug for it in r224927 and didn't add a test. Do so.
488
489         * stress/class-static-get-weird.js: Added.
490         (c.prototype.get name):
491         (c):
492         (c.prototype.get arguments):
493         (c.prototype.get caller):
494         (c.prototype.get length):
495
496 2017-12-01  Saam Barati  <sbarati@apple.com>
497
498         Having a bad time needs to handle ArrayClass indexing type as well
499         https://bugs.webkit.org/show_bug.cgi?id=180274
500         <rdar://problem/35667869>
501
502         Reviewed by Keith Miller and Mark Lam.
503
504         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
505         (assert):
506         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
507         (assert):
508
509 2017-12-01  JF Bastien  <jfbastien@apple.com>
510
511         WebAssembly: restore cached stack limit after out-call
512         https://bugs.webkit.org/show_bug.cgi?id=179106
513         <rdar://problem/35337525>
514
515         Reviewed by Saam Barati.
516
517         * wasm/function-tests/double-instance.js: Added.
518         (const.imp.boom):
519         (const.imp.get callAnother):
520
521 2017-11-30  JF Bastien  <jfbastien@apple.com>
522
523         WebAssembly: improve stack trace
524         https://bugs.webkit.org/show_bug.cgi?id=179343
525
526         Reviewed by Saam Barati.
527
528         Update the tests to follow the new format. Notably, SHA1 module
529         hash is now included in traces, and stubs are properly identified.
530
531         * wasm/assert.js: Add an assertion which matches regular expressions.
532         * wasm/function-tests/nameSection.js:
533         * wasm/function-tests/stack-overflow.js:
534         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
535         (assertOverflows.assertThrows.wasm.1):
536         (assertOverflows.assertThrows.wasm.0):
537         (assertOverflows.assertThrows):
538         (assertOverflows):
539         * wasm/function-tests/stack-trace.js:
540         (import.Builder.from.string_appeared_here.assert): Deleted.
541         * wasm/function-tests/trap-after-cross-instance-call.js:
542         (wasmFrameCountFromError):
543         * wasm/function-tests/trap-load-2.js:
544         (wasmFrameCountFromError):
545         * wasm/function-tests/trap-load.js:
546         (wasmFrameCountFromError):
547
548 2017-11-30  Mark Lam  <mark.lam@apple.com>
549
550         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
551         https://bugs.webkit.org/show_bug.cgi?id=180219
552         <rdar://problem/35696536>
553
554         Reviewed by Filip Pizlo.
555
556         * stress/regress-180219.js: Added.
557
558 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
559
560         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
561         https://bugs.webkit.org/show_bug.cgi?id=180190
562
563         Reviewed by Mark Lam.
564
565         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
566         (shouldBe):
567         (test1):
568         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
569         (shouldBe):
570         (test1):
571         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
572         (shouldBe):
573         (test1):
574         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
575         (shouldBe):
576         (test1):
577         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
578         (shouldBe):
579         (test1):
580         * stress/operation-in-may-have-negative-int32.js: Added.
581         (shouldBe):
582         (test2):
583         * stress/operation-in-negative-int32-cast.js: Added.
584         (shouldBe):
585         (test1):
586
587 2017-11-28  JF Bastien  <jfbastien@apple.com>
588
589         Strict and sloppy functions shouldn't share structure
590         https://bugs.webkit.org/show_bug.cgi?id=180103
591         <rdar://problem/35667847>
592
593         Reviewed by Saam Barati.
594
595         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
596         because the IC was wrong.
597         (foo):
598         (bar):
599         (baz):
600         (catch):
601         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
602         in this patch, but may as well test odd strict mode corner cases.
603         (bar):
604         (baz):
605         (catch):
606         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
607         (foo):
608         (bar):
609         (baz):
610         (catch):
611         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
612         next file, but with invalidation of the FunctionExecutable's
613         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
614         slower path.
615         (foo):
616         (bar.const.x):
617         (bar.const.y):
618         (bar):
619         (catch):
620         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
621         strict nesting works correctly.
622         (foo):
623         (bar.baz):
624         (bar):
625         * stress/strict-function-structure.js: Added. The test used to
626         assert in objectProtoFuncHasOwnProperty.
627         (foo):
628         (bar):
629         (baz):
630         * stress/strict-nested-function-structure.js: Added. Nesting.
631         (foo):
632         (bar):
633         (baz.boo):
634         (baz):
635
636 2017-11-29  Robin Morisset  <rmorisset@apple.com>
637
638         The recursive tail call optimisation is wrong on closures
639         https://bugs.webkit.org/show_bug.cgi?id=179835
640
641         Reviewed by Saam Barati.
642
643         * stress/closure-recursive-tail-call.js: Added.
644         (makeClosure):
645
646 2017-11-27  JF Bastien  <jfbastien@apple.com>
647
648         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
649         https://bugs.webkit.org/show_bug.cgi?id=180051
650         <rdar://problem/35614371>
651
652         Reviewed by Saam Barati.
653
654         * stress/rest-parameter-negative.js: Added.
655         (__f_5484):
656         (catch):
657         (__f_5485):
658         (__v_22598.catch):
659
660 2017-11-27  Saam Barati  <sbarati@apple.com>
661
662         Spread can escape when CreateRest does not
663         https://bugs.webkit.org/show_bug.cgi?id=180057
664         <rdar://problem/35676119>
665
666         Reviewed by JF Bastien.
667
668         * stress/spread-escapes-but-create-rest-does-not.js: Added.
669         (assert):
670         (getProperties):
671         (theFunc):
672         (let.obj.valueOf):
673
674 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
675
676         [DFG] Add NormalizeMapKey DFG IR
677         https://bugs.webkit.org/show_bug.cgi?id=179912
678
679         Reviewed by Saam Barati.
680
681         * stress/map-untyped-normalize-cse.js: Added.
682         (shouldBe):
683         (test):
684         * stress/map-untyped-normalize.js: Added.
685         (shouldBe):
686         (test):
687         * stress/set-untyped-normalize-cse.js: Added.
688         (shouldBe):
689         (set return.set has.set has):
690         * stress/set-untyped-normalize.js: Added.
691         (shouldBe):
692         (set return.set has):
693
694 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
695
696         [FTL] Support DeleteById and DeleteByVal
697         https://bugs.webkit.org/show_bug.cgi?id=180022
698
699         Reviewed by Saam Barati.
700
701         * stress/delete-by-id.js: Added.
702         (shouldBe):
703         (test1):
704         (test2):
705         * stress/delete-by-val-ftl.js: Added.
706         (shouldBe):
707         (test1):
708         (test2):
709
710 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
711
712         [DFG] Introduce {Set,Map,WeakMap}Fields
713         https://bugs.webkit.org/show_bug.cgi?id=179925
714
715         Reviewed by Saam Barati.
716
717         * stress/map-set-clobber-map-get.js: Added.
718         (shouldBe):
719         (test):
720         * stress/map-set-does-not-clobber-set-has.js: Added.
721         (shouldBe):
722         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
723         (shouldBe):
724         (test):
725         * stress/set-add-clobber-set-has.js: Added.
726         (shouldBe):
727         * stress/set-add-does-not-clobber-map-get.js: Added.
728         (shouldBe):
729
730 2017-11-24  Mark Lam  <mark.lam@apple.com>
731
732         Move unsafe jsc shell test functions to the $vm object.
733         https://bugs.webkit.org/show_bug.cgi?id=179980
734
735         Reviewed by Yusuke Suzuki.
736
737         * controlFlowProfiler/driver/driver.js:
738         * controlFlowProfiler/execution-count.js:
739         * controlFlowProfiler/if-statement.js:
740         * controlFlowProfiler/loop-statements.js:
741         * controlFlowProfiler/switch-statements.js:
742         * controlFlowProfiler/test-jit.js:
743         * exceptionFuzz/3d-cube.js:
744         * exceptionFuzz/date-format-xparb.js:
745         * exceptionFuzz/earley-boyer.js:
746         * heapProfiler/basic-edges.js:
747         * heapProfiler/property-edge-types.js:
748         * microbenchmarks/try-get-by-id-basic.js:
749         * microbenchmarks/try-get-by-id-polymorphic.js:
750         * modules/namespace-object-try-get.js:
751         * stress/argument-count-bytecode.js:
752         * stress/argument-intrinsic-basic.js:
753         * stress/argument-intrinsic-inlining-use-caller-arg.js:
754         * stress/argument-intrinsic-inlining-with-result-escape.js:
755         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
756         * stress/argument-intrinsic-inlining-with-vararg.js:
757         * stress/argument-intrinsic-nested-inlining.js:
758         * stress/argument-intrinsic-not-convert-to-get-argument.js:
759         * stress/argument-intrinsic-with-stack-write.js:
760         * stress/arity-mismatch-get-argument.js:
761         * stress/array-message-passing.js:
762         * stress/array-push-with-force-exit.js:
763         * stress/check-dom-with-signature.js:
764         * stress/check-sub-class.js:
765         * stress/compare-eq-incomplete-profile.js:
766         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
767         * stress/do-eval-virtual-call-correctly.js:
768         * stress/dom-jit-with-poly-proto.js:
769         * stress/domjit-exception-ic.js:
770         * stress/domjit-exception.js:
771         * stress/domjit-getter-complex-with-incorrect-object.js:
772         * stress/domjit-getter-complex.js:
773         * stress/domjit-getter-poly.js:
774         * stress/domjit-getter-proto.js:
775         * stress/domjit-getter-super-poly.js:
776         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
777         * stress/domjit-getter-type-check.js:
778         * stress/domjit-getter.js:
779         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
780         * stress/for-in-proxy-target-changed-structure.js:
781         * stress/for-in-proxy.js:
782         * stress/generational-opaque-roots.js:
783         * stress/global-const-redeclaration-setting-2.js:
784         * stress/global-const-redeclaration-setting-3.js:
785         * stress/global-const-redeclaration-setting-4.js:
786         * stress/global-const-redeclaration-setting-5.js:
787         * stress/global-const-redeclaration-setting.js:
788         * stress/import-basic.js:
789         * stress/import-from-eval.js:
790         * stress/import-reject-with-exception.js:
791         * stress/import-syntax.js:
792         * stress/impure-get-own-property-slot-inline-cache.js:
793         * stress/is-constructor.js:
794         * stress/istypedarrayview-intrinsic.js:
795         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
796         * stress/jsc-test-functions-should-be-more-robust.js:
797         * stress/object-toString-with-proxy.js:
798         * stress/poly-proto-custom-value-and-accessor.js:
799         * stress/proxy-inline-cache.js:
800         * stress/re-execute-error-module.js:
801         * stress/regress-150532.js:
802         * stress/regress-156992.js:
803         * stress/regress-179619.js:
804         * stress/resources/shadow-chicken-support.js:
805         * stress/runtime-array.js:
806         * stress/sampling-profiler-microtasks.js:
807         * stress/shadow-chicken-enabled.js:
808         * stress/spread-correct-global-object-on-exception.js:
809         * stress/super-get-by-id.js:
810         * stress/tailCallForwardArguments.js:
811         * stress/to-object-intrinsic-boolean-edge.js:
812         * stress/to-object-intrinsic-null-or-undefined-edge.js:
813         * stress/to-object-intrinsic-number-edge.js:
814         * stress/to-object-intrinsic-object-edge.js:
815         * stress/to-object-intrinsic-string-edge.js:
816         * stress/to-object-intrinsic-symbol-edge.js:
817         * stress/to-object-intrinsic.js:
818         * stress/try-catch-custom-getter-as-get-by-id.js:
819         * stress/try-get-by-id-poly-proto.js:
820         * stress/try-get-by-id-should-spill-registers-dfg.js:
821         * stress/try-get-by-id.js:
822         * typeProfiler/arrow-functions.js:
823         * typeProfiler/basic.js:
824         * typeProfiler/captured.js:
825         * typeProfiler/classes.js:
826         * typeProfiler/dfg-jit-optimizations.js:
827         * typeProfiler/dictionary-mode.js:
828         * typeProfiler/es6-block-scoping.js:
829         * typeProfiler/es6-classes.js:
830         * typeProfiler/inheritance.js:
831         * typeProfiler/int52-dfg.js:
832         * typeProfiler/loop.js:
833         * typeProfiler/optional-fields.js:
834         * typeProfiler/overflow.js:
835         * typeProfiler/return.js:
836         * typeProfiler/symbol.js:
837         * typeProfiler/weird-prototype-chain.js:
838
839 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
840
841         [DFG][FTL] Support MapSet / SetAdd intrinsics
842         https://bugs.webkit.org/show_bug.cgi?id=179858
843
844         Reviewed by Saam Barati.
845
846         * microbenchmarks/map-has-and-set.js: Added.
847         (test):
848         * stress/map-set-check-failure.js: Added.
849         (shouldBe):
850         (shouldThrow):
851         (target):
852         * stress/map-set-cse.js: Added.
853         (shouldBe):
854         (test):
855         * stress/set-add-check-failure.js: Added.
856         (shouldBe):
857         (shouldThrow):
858         (set shouldThrow):
859         * stress/set-add-cse.js: Added.
860         (shouldBe):
861
862 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
863
864         [JSC] Allow poly proto for intrinsic getters
865         https://bugs.webkit.org/show_bug.cgi?id=179550
866
867         Reviewed by Saam Barati.
868
869         This change is also tested by existing tests.
870
871             1. stress/intrinsic-getter-with-poly-proto.js
872             2. stress/poly-proto-intrinsic-getter-correctness.js
873
874         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
875         (shouldBe):
876         (makePolyProtoObject.foo.C):
877         (makePolyProtoObject.foo):
878         (makePolyProtoObject):
879         (target):
880         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
881         (shouldBe):
882         (makePolyProtoObject.foo.C):
883         (makePolyProtoObject.foo):
884         (makePolyProtoObject):
885         (target):
886
887 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
888
889         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
890         https://bugs.webkit.org/show_bug.cgi?id=179744
891
892         Reviewed by Michael Catanzaro.
893
894         This test uses too much memory for our buildbots on these platforms
895         and gets OOM-killed.
896
897         * stress/unshiftCountSlowCase-correct-postCapacity.js:
898         Skip if $memoryLimited and linux.
899
900 2017-11-17  JF Bastien  <jfbastien@apple.com>
901
902         WebAssembly JS API: throw when a promise can't be created
903         https://bugs.webkit.org/show_bug.cgi?id=179826
904         <rdar://problem/35455813>
905
906         Reviewed by Mark Lam.
907
908         Test WebAssembly.{compile,instantiate} where promise creation
909         fails because of a stack overflow.
910
911         * wasm/js-api/promise-stack-overflow.js: Added.
912         (const.runNearStackLimit.f.const.t):
913         (async.testCompile):
914         (async.testInstantiate):
915
916 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
917
918         Unreviewed, mark regress-178385.js as memory exhausting
919
920         * stress/regress-178385.js:
921
922 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
923
924         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
925
926         Unreviewed test gardening.
927
928         * test262.yaml:
929
930 2017-11-16  Robin Morisset  <rmorisset@apple.com>
931
932         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
933         https://bugs.webkit.org/show_bug.cgi?id=179763
934         <rdar://problem/35550513>
935
936         Reviewed by Keith Miller.
937
938         Just adding a slightly cleaned-up version of the original fuzzer-found test.
939
940         * stress/tdz-this-in-try-catch.js: Added.
941         (__v_6388):
942         (__v_6392):
943
944 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
945
946         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
947         https://bugs.webkit.org/show_bug.cgi?id=179594
948
949         Reviewed by Saam Barati.
950
951         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
952         (shouldBe):
953         (args):
954         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
955         (shouldBe):
956         (args):
957
958 2017-11-14  Saam Barati  <sbarati@apple.com>
959
960         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
961         https://bugs.webkit.org/show_bug.cgi?id=179639
962         <rdar://problem/35513018>
963
964         Reviewed by JF Bastien.
965
966         * wasm/function-tests/grow-memory-cause-gc.js: Added.
967         (escape):
968         (i.func):
969
970 2017-11-13  Mark Lam  <mark.lam@apple.com>
971
972         Add more overflow check book-keeping for MarkedArgumentBuffer.
973         https://bugs.webkit.org/show_bug.cgi?id=179634
974         <rdar://problem/35492517>
975
976         Reviewed by Saam Barati.
977
978         * stress/regress-179634.js: Added.
979
980 2017-11-13  Mark Lam  <mark.lam@apple.com>
981
982         Make the jsc shell loadGetterFromGetterSetter() function more robust.
983         https://bugs.webkit.org/show_bug.cgi?id=179619
984         <rdar://problem/35492518>
985
986         Reviewed by Saam Barati.
987
988         * stress/regress-179619.js: Added.
989
990 2017-11-12  Mark Lam  <mark.lam@apple.com>
991
992         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
993         https://bugs.webkit.org/show_bug.cgi?id=179562
994         <rdar://problem/35467022>
995
996         Reviewed by Saam Barati.
997
998         * regress-179562.js: Added.
999
1000 2017-11-08  Saam Barati  <sbarati@apple.com>
1001
1002         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
1003         https://bugs.webkit.org/show_bug.cgi?id=177792
1004
1005         Reviewed by Yusuke Suzuki.
1006
1007         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
1008         (assert):
1009         (foo.Foo.prototype.ensureX):
1010         (foo.Foo):
1011         (foo):
1012         (access):
1013
1014 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
1015
1016         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1017         https://bugs.webkit.org/show_bug.cgi?id=178592
1018
1019         Unreviewed test gardening.
1020
1021         * test262.yaml:
1022
1023 2017-11-08  Robin Morisset  <rmorisset@apple.com>
1024
1025         Turn recursive tail calls into loops
1026         https://bugs.webkit.org/show_bug.cgi?id=176601
1027
1028         Reviewed by Saam Barati.
1029
1030         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
1031
1032         Add some simple test that computes factorial in several ways, and other trivial computations.
1033         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1034         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1035         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1036         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1037
1038         * stress/inline-call-to-recursive-tail-call.js: Added.
1039         (factorial.aux):
1040         (factorial):
1041         (factorial2.aux2):
1042         (factorial2.id):
1043         (factorial2):
1044         (factorial3.aux3):
1045         (factorial3):
1046         (aux4):
1047         (factorial4):
1048         (foo):
1049         (auxBar):
1050         (bar):
1051         (test):
1052
1053 2017-11-07  Mark Lam  <mark.lam@apple.com>
1054
1055         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
1056         https://bugs.webkit.org/show_bug.cgi?id=179355
1057         <rdar://problem/35263053>
1058
1059         Reviewed by Saam Barati.
1060
1061         * stress/regress-179355.js: Added.
1062
1063 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1064
1065         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
1066         https://bugs.webkit.org/show_bug.cgi?id=144458
1067
1068         Reviewed by Saam Barati.
1069
1070         * microbenchmarks/dfg-internal-function-call.js: Added.
1071         (target):
1072         * microbenchmarks/dfg-internal-function-construct.js: Added.
1073         (target):
1074         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
1075         (target):
1076         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
1077         (target):
1078         * stress/dfg-internal-function-call.js: Added.
1079         (shouldBe):
1080         (target):
1081         * stress/dfg-internal-function-construct.js: Added.
1082         (shouldBe):
1083         (target):
1084         * stress/internal-function-call.js: Added.
1085         (shouldBe):
1086         * stress/internal-function-construct.js: Added.
1087         (shouldBe):
1088
1089 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
1090
1091         [Win] Skip stress/regress-178385.js.
1092         https://bugs.webkit.org/show_bug.cgi?id=179298
1093
1094         Unreviewed test gardening.
1095
1096         * stress/regress-178385.js:
1097
1098 2017-11-03  Keith Miller  <keith_miller@apple.com>
1099
1100         Add test for ic with side effects
1101         https://bugs.webkit.org/show_bug.cgi?id=179268
1102
1103         Reviewed by Saam Barati.
1104
1105         * stress/put-inline-cache-side-effects.js: Added.
1106         (let.i.of.objs.keys):
1107         (f):
1108
1109 2017-11-03  Mark Lam  <mark.lam@apple.com>
1110
1111         CachedCall (and its clients) needs overflow checks.
1112         https://bugs.webkit.org/show_bug.cgi?id=179185
1113
1114         Reviewed by JF Bastien.
1115
1116         * stress/regress-179185.js: Added.
1117
1118 2017-11-02  Michael Saboff  <msaboff@apple.com>
1119
1120         DFG needs to handle code motion of code in for..in loop bodies
1121         https://bugs.webkit.org/show_bug.cgi?id=179212
1122
1123         Reviewed by Keith Miller.
1124
1125         New regression test.
1126
1127         * stress/for-in-side-effects.js: Added.
1128         (getPrototypeOf):
1129         (reset):
1130         (testWithoutFTL.f):
1131         (testWithoutFTL):
1132         (testWithFTL.f):
1133         (testWithFTL):
1134
1135 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
1136
1137         AI does not correctly model the clobber case of ArithClz32
1138         https://bugs.webkit.org/show_bug.cgi?id=179188
1139
1140         Reviewed by Michael Saboff.
1141
1142         * stress/arith-clz32-effects.js: Added.
1143         (foo):
1144         (valueOf):
1145
1146 2017-11-01  Michael Saboff  <msaboff@apple.com>
1147
1148         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
1149         https://bugs.webkit.org/show_bug.cgi?id=179140
1150
1151         Reviewed by Saam Barati.
1152
1153         New regression test.
1154
1155         * stress/regress-179140.js: Added.
1156         (testWithoutFTL):
1157         (testWithFTL):
1158
1159 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1160
1161         [JSC] Introduce @toObject
1162         https://bugs.webkit.org/show_bug.cgi?id=178726
1163
1164         Reviewed by Saam Barati.
1165
1166         * stress/array-copywithin.js:
1167         (shouldThrow):
1168         * stress/object-constructor-boolean-edge.js: Added.
1169         (shouldBe):
1170         (test):
1171         * stress/object-constructor-global.js: Added.
1172         (shouldBe):
1173         * stress/object-constructor-null-edge.js: Added.
1174         (shouldBe):
1175         (test):
1176         * stress/object-constructor-number-edge.js: Added.
1177         (shouldBe):
1178         (test):
1179         * stress/object-constructor-object-edge.js: Added.
1180         (shouldBe):
1181         (test):
1182         (i.arg):
1183         * stress/object-constructor-string-edge.js: Added.
1184         (shouldBe):
1185         (test):
1186         * stress/object-constructor-symbol-edge.js: Added.
1187         (shouldBe):
1188         (test):
1189         * stress/object-constructor-undefined-edge.js: Added.
1190         (shouldBe):
1191         (test):
1192         * stress/symbol-array-from.js: Added.
1193         (shouldBe):
1194         * stress/to-object-intrinsic-boolean-edge.js: Added.
1195         (shouldBe):
1196         (builtin.createBuiltin):
1197         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
1198         (shouldThrow):
1199         * stress/to-object-intrinsic-number-edge.js: Added.
1200         (shouldBe):
1201         (builtin.createBuiltin):
1202         * stress/to-object-intrinsic-object-edge.js: Added.
1203         (shouldBe):
1204         (builtin.createBuiltin):
1205         (i.arg):
1206         * stress/to-object-intrinsic-string-edge.js: Added.
1207         (shouldBe):
1208         (builtin.createBuiltin):
1209         * stress/to-object-intrinsic-symbol-edge.js: Added.
1210         (shouldBe):
1211         (builtin.createBuiltin):
1212         * stress/to-object-intrinsic.js: Added.
1213         (shouldBe):
1214         (shouldThrow):
1215         (builtin.createBuiltin):
1216
1217 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1218
1219         [DFG][FTL] Introduce StringSlice
1220         https://bugs.webkit.org/show_bug.cgi?id=178934
1221
1222         Reviewed by Saam Barati.
1223
1224         * microbenchmarks/string-slice-empty.js: Added.
1225         (slice):
1226         * microbenchmarks/string-slice-one-char.js: Added.
1227         (slice):
1228         * microbenchmarks/string-slice.js: Added.
1229         (slice):
1230
1231 2017-10-26  Michael Saboff  <msaboff@apple.com>
1232
1233         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
1234         https://bugs.webkit.org/show_bug.cgi?id=178890
1235
1236         Reviewed by Keith Miller.
1237
1238         New regression test.
1239
1240         * stress/regress-178890.js: Added.
1241
1242 2017-10-26  Mark Lam  <mark.lam@apple.com>
1243
1244         JSRopeString::RopeBuilder::append() should check for overflows.
1245         https://bugs.webkit.org/show_bug.cgi?id=178385
1246         <rdar://problem/35027468>
1247
1248         Reviewed by Saam Barati.
1249
1250         * stress/regress-178385.js: Added.
1251
1252 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
1253
1254         Unreviewed, rolling out r223961.
1255
1256         The change that required this has been rolled out.
1257
1258         Reverted changeset:
1259
1260         "Mark test262.yaml/test262/test/language/statements/try/tco-
1261         catch.js as passing."
1262         https://bugs.webkit.org/show_bug.cgi?id=178592
1263         https://trac.webkit.org/changeset/223961
1264
1265 2017-10-25  Commit Queue  <commit-queue@webkit.org>
1266
1267         Unreviewed, rolling out r223691 and r223729.
1268         https://bugs.webkit.org/show_bug.cgi?id=178834
1269
1270         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
1271         by rniwa on #webkit).
1272
1273         Reverted changesets:
1274
1275         "Turn recursive tail calls into loops"
1276         https://bugs.webkit.org/show_bug.cgi?id=176601
1277         https://trac.webkit.org/changeset/223691
1278
1279         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
1280         comparison is always false due to limited range of data type
1281         [-Wtype-limits]"
1282         https://bugs.webkit.org/show_bug.cgi?id=178543
1283         https://trac.webkit.org/changeset/223729
1284
1285 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
1286
1287         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1288         https://bugs.webkit.org/show_bug.cgi?id=178592
1289
1290         Unreviewed test gardening.
1291
1292         * test262.yaml:
1293
1294 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1295
1296         [FTL] Support NewStringObject
1297         https://bugs.webkit.org/show_bug.cgi?id=178737
1298
1299         Reviewed by Saam Barati.
1300
1301         * stress/new-string-object.js: Added.
1302         (shouldBe):
1303         (test):
1304
1305 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1306
1307         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
1308         https://bugs.webkit.org/show_bug.cgi?id=178308
1309
1310         Reviewed by Mark Lam.
1311
1312         * test262.yaml:
1313
1314 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1315
1316         [JSC] Use fastJoin in Array#toString
1317         https://bugs.webkit.org/show_bug.cgi?id=178062
1318
1319         Reviewed by Darin Adler.
1320
1321         * microbenchmarks/contiguous-array-to-string.js: Added.
1322         (target):
1323         * microbenchmarks/double-array-to-string.js: Added.
1324         (target):
1325         * microbenchmarks/int32-array-to-string.js: Added.
1326         (target):
1327
1328 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
1329
1330         stress/check-string-ident.js is improperly skipped
1331         https://bugs.webkit.org/show_bug.cgi?id=178642
1332
1333         Reviewed by Saam Barati.
1334
1335         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
1336         since it enforces the run-jsc-stress-tests script to still set up the
1337         test to run, despite the skip directive that's used before.
1338
1339 2017-10-20  Mark Lam  <mark.lam@apple.com>
1340
1341         Add a test case for r214334.
1342         https://bugs.webkit.org/show_bug.cgi?id=169941
1343         <rdar://problem/31221258>
1344
1345         Reviewed by JF Bastien.
1346
1347         * stress/regress-169941.js: Added.
1348
1349 2017-10-19  JF Bastien  <jfbastien@apple.com>
1350
1351         WebAssembly: no VM / JS version of everything but Instance
1352         https://bugs.webkit.org/show_bug.cgi?id=177473
1353
1354         Reviewed by Filip Pizlo, Saam Barati.
1355
1356         - Exceeding max on memory growth now returns a range error as per
1357         spec. This is a (very minor) breaking change: it used to throw OOM
1358         error. Update the corresponding test.
1359
1360         * wasm/js-api/memory-grow.js:
1361         (assertEq):
1362         * wasm/js-api/table.js:
1363         (assert.throws):
1364
1365 2017-10-19  Mark Lam  <mark.lam@apple.com>
1366
1367         Stringifier::appendStringifiedValue() is missing an exception check.
1368         https://bugs.webkit.org/show_bug.cgi?id=178386
1369         <rdar://problem/35027610>
1370
1371         Reviewed by Saam Barati.
1372
1373         * stress/regress-178386.js: Added.
1374
1375 2017-10-19  Michael Saboff  <msaboff@apple.com>
1376
1377         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1378         https://bugs.webkit.org/show_bug.cgi?id=178521
1379
1380         Reviewed by JF Bastien.
1381
1382         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1383         now passes with the current version (5.0) of the Emoji spec.
1384
1385 2017-10-19  Robin Morisset  <rmorisset@apple.com>
1386
1387         Turn recursive tail calls into loops
1388         https://bugs.webkit.org/show_bug.cgi?id=176601
1389
1390         Reviewed by Saam Barati.
1391
1392         Add some simple test that computes factorial in several ways, and other trivial computations.
1393         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1394         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1395         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1396         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1397
1398         * stress/inline-call-to-recursive-tail-call.js: Added.
1399         (factorial.aux):
1400         (factorial):
1401         (factorial2.aux):
1402         (factorial2.id):
1403         (factorial2):
1404         (factorial3.aux):
1405         (factorial3):
1406         (aux):
1407         (factorial4):
1408         (test):
1409
1410 2017-10-18  Mark Lam  <mark.lam@apple.com>
1411
1412         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1413         https://bugs.webkit.org/show_bug.cgi?id=177600
1414         <rdar://problem/34710985>
1415
1416         Reviewed by Saam Barati.
1417
1418         * stress/regress-177600.js: Added.
1419
1420 2017-10-18  Mark Lam  <mark.lam@apple.com>
1421
1422         The compiler should always register a structure when it adds its transitionWatchPointSet.
1423         https://bugs.webkit.org/show_bug.cgi?id=178420
1424         <rdar://problem/34814024>
1425
1426         Reviewed by Saam Barati and Filip Pizlo.
1427
1428         * stress/regress-178420.js: Added.
1429         (new.Array.10000.map):
1430
1431 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1432
1433         [JSC] __proto__ getter should be fast
1434         https://bugs.webkit.org/show_bug.cgi?id=178067
1435
1436         Reviewed by Saam Barati.
1437
1438         * stress/dfg-object-proto-accessor.js: Added.
1439         (shouldBe):
1440         (shouldThrow):
1441         (target):
1442         * stress/dfg-object-proto-getter.js: Added.
1443         (shouldBe):
1444         (shouldThrow):
1445         (target):
1446         * stress/dfg-object-prototype-of.js: Added.
1447         (shouldBe):
1448         (shouldThrow):
1449         (target):
1450         * stress/dfg-reflect-get-prototype-of.js: Added.
1451         (shouldBe):
1452         (shouldThrow):
1453         (target):
1454         * stress/intrinsic-getter-with-poly-proto.js: Added.
1455         (shouldBe):
1456         (makePolyProtoObject.foo.C):
1457         (makePolyProtoObject.foo):
1458         (makePolyProtoObject):
1459         (target):
1460         * stress/object-get-prototype-of-filtered.js: Added.
1461         (shouldBe):
1462         (shouldThrow):
1463         (target):
1464         (i.Cocoa):
1465         * stress/object-get-prototype-of-mono-proto.js: Added.
1466         (shouldBe):
1467         (makePolyProtoObject.foo.C):
1468         (makePolyProtoObject.foo):
1469         (makePolyProtoObject):
1470         (target):
1471         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1472         (shouldBe):
1473         (makePolyProtoObject.foo.C):
1474         (makePolyProtoObject.foo):
1475         (makePolyProtoObject):
1476         (target):
1477         * stress/object-get-prototype-of-poly-proto.js: Added.
1478         (shouldBe):
1479         (makePolyProtoObject.foo.C):
1480         (makePolyProtoObject.foo):
1481         (makePolyProtoObject):
1482         (target):
1483         * stress/object-proto-getter-filtered.js: Added.
1484         (shouldBe):
1485         (shouldThrow):
1486         (target):
1487         (i.Cocoa):
1488         * stress/object-proto-getter-poly-mono-proto.js: Added.
1489         (shouldBe):
1490         (makePolyProtoObject.foo.C):
1491         (makePolyProtoObject.foo):
1492         (makePolyProtoObject):
1493         (target):
1494         * stress/object-proto-getter-poly-proto.js: Added.
1495         (shouldBe):
1496         (makePolyProtoObject.foo.C):
1497         (makePolyProtoObject.foo):
1498         (makePolyProtoObject):
1499         (target):
1500         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1501         * stress/string-proto.js: Added.
1502         (shouldBe):
1503         (target):
1504
1505 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1506
1507         Unreviewed, rolling out r223523.
1508
1509         A test for this change is failing on debug JSC bots.
1510
1511         Reverted changeset:
1512
1513         "[JSC] __proto__ getter should be fast"
1514         https://bugs.webkit.org/show_bug.cgi?id=178067
1515         https://trac.webkit.org/changeset/223523
1516
1517 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1518
1519         [JSC] __proto__ getter should be fast
1520         https://bugs.webkit.org/show_bug.cgi?id=178067
1521
1522         Reviewed by Saam Barati.
1523
1524         * stress/dfg-object-proto-accessor.js: Added.
1525         (shouldBe):
1526         (shouldThrow):
1527         (target):
1528         * stress/dfg-object-proto-getter.js: Added.
1529         (shouldBe):
1530         (shouldThrow):
1531         (target):
1532         * stress/dfg-object-prototype-of.js: Added.
1533         (shouldBe):
1534         (shouldThrow):
1535         (target):
1536         * stress/dfg-reflect-get-prototype-of.js: Added.
1537         (shouldBe):
1538         (shouldThrow):
1539         (target):
1540         * stress/object-get-prototype-of-filtered.js: Added.
1541         (shouldBe):
1542         (shouldThrow):
1543         (target):
1544         (i.Cocoa):
1545         * stress/object-get-prototype-of-mono-proto.js: Added.
1546         (shouldBe):
1547         (makePolyProtoObject.foo.C):
1548         (makePolyProtoObject.foo):
1549         (makePolyProtoObject):
1550         (target):
1551         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1552         (shouldBe):
1553         (makePolyProtoObject.foo.C):
1554         (makePolyProtoObject.foo):
1555         (makePolyProtoObject):
1556         (target):
1557         * stress/object-get-prototype-of-poly-proto.js: Added.
1558         (shouldBe):
1559         (makePolyProtoObject.foo.C):
1560         (makePolyProtoObject.foo):
1561         (makePolyProtoObject):
1562         (target):
1563         * stress/object-proto-getter-filtered.js: Added.
1564         (shouldBe):
1565         (shouldThrow):
1566         (target):
1567         (i.Cocoa):
1568         * stress/object-proto-getter-poly-mono-proto.js: Added.
1569         (shouldBe):
1570         (makePolyProtoObject.foo.C):
1571         (makePolyProtoObject.foo):
1572         (makePolyProtoObject):
1573         (target):
1574         * stress/object-proto-getter-poly-proto.js: Added.
1575         (shouldBe):
1576         (makePolyProtoObject.foo.C):
1577         (makePolyProtoObject.foo):
1578         (makePolyProtoObject):
1579         (target):
1580         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1581         * stress/string-proto.js: Added.
1582         (shouldBe):
1583         (target):
1584
1585 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1586
1587         Reland "Add Above/Below comparisons for UInt32 patterns"
1588         https://bugs.webkit.org/show_bug.cgi?id=177281
1589
1590         Reviewed by Saam Barati.
1591
1592         * stress/uint32-comparison-jump.js: Added.
1593         (shouldBe):
1594         (above):
1595         (aboveOrEqual):
1596         (below):
1597         (belowOrEqual):
1598         (notAbove):
1599         (notAboveOrEqual):
1600         (notBelow):
1601         (notBelowOrEqual):
1602         * stress/uint32-comparison.js: Added.
1603         (shouldBe):
1604         (above):
1605         (aboveOrEqual):
1606         (below):
1607         (belowOrEqual):
1608         (aboveTest):
1609         (aboveOrEqualTest):
1610         (belowTest):
1611         (belowOrEqualTest):
1612
1613 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1614
1615         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1616         https://bugs.webkit.org/show_bug.cgi?id=178210
1617
1618         Reviewed by Saam Barati.
1619
1620         * wasm/function-tests/trap-from-start-async.js:
1621         (async.StartTrapsAsync):
1622         * wasm/function-tests/trap-from-start.js:
1623         (StartTraps):
1624         * wasm/js-api/web-assembly-function.js:
1625         (assert.eq.Object.getPrototypeOf):
1626         * wasm/js-api/wrapper-function.js:
1627         (return.new.WebAssembly.Module):
1628         (assert.throws.makeInstance): Deleted.
1629         (assert.throws.Bar): Deleted.
1630         (assert.throws): Deleted.
1631
1632 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1633
1634         Enable gigacage on iOS
1635         https://bugs.webkit.org/show_bug.cgi?id=177586
1636
1637         Reviewed by JF Bastien.
1638         
1639         Add tests for when Gigacage gets runtime disabled.
1640
1641         * stress/disable-gigacage-arrays.js: Added.
1642         (foo):
1643         * stress/disable-gigacage-strings.js: Added.
1644         (foo):
1645         * stress/disable-gigacage-typed-arrays.js: Added.
1646         (foo):
1647
1648 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1649
1650         import.meta should not be assignable
1651         https://bugs.webkit.org/show_bug.cgi?id=178202
1652
1653         Reviewed by Saam Barati.
1654
1655         * modules/import-meta-assignment.js: Added.
1656         (shouldThrow):
1657         (SyntaxError.import.meta.can.shouldThrow):
1658
1659 2017-10-11  Saam Barati  <sbarati@apple.com>
1660
1661         Unreviewed. Actually skip certain type profiler tests in debug.
1662
1663         * typeProfiler.yaml:
1664         * typeProfiler/deltablue-for-of.js:
1665         * typeProfiler/getter-richards.js:
1666
1667 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1668
1669         Unreviewed, rolling out r223113 and r223121.
1670         https://bugs.webkit.org/show_bug.cgi?id=178182
1671
1672         Reintroduced 20% regression on Kraken (Requested by rniwa on
1673         #webkit).
1674
1675         Reverted changesets:
1676
1677         "Enable gigacage on iOS"
1678         https://bugs.webkit.org/show_bug.cgi?id=177586
1679         https://trac.webkit.org/changeset/223113
1680
1681         "Use one virtual allocation for all gigacages and their
1682         runways"
1683         https://bugs.webkit.org/show_bug.cgi?id=178050
1684         https://trac.webkit.org/changeset/223121
1685
1686 2017-10-11  Michael Saboff  <msaboff@apple.com>
1687
1688         Disable test262 named capture group tests with direct unicode names and with references before definitions
1689         https://bugs.webkit.org/show_bug.cgi?id=178177
1690
1691         Reviewed by Keith Miller.
1692
1693         Bugs to track fixing these test are:
1694         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1695             "Add support in named capture group identifiers for direct surrogate pairs"
1696         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1697             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1698
1699         * test262.yaml:
1700
1701 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1702
1703         Object properties are undefined in super.call() but not in this.call()
1704         https://bugs.webkit.org/show_bug.cgi?id=177230
1705
1706         Reviewed by Saam Barati.
1707
1708         * stress/super-call-function-subclass.js: Added.
1709         (assert):
1710         (A.prototype.t):
1711         (A):
1712         * stress/super-dot-call-and-apply.js: Added.
1713         (assert):
1714         (A):
1715         (A.prototype.call):
1716         (A.prototype.apply):
1717         (B.prototype.testSuper):
1718         (B):
1719         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1720         (D.prototype.testSuper):
1721         (D):
1722
1723 2017-10-10  Saam Barati  <sbarati@apple.com>
1724
1725         The prototype cache should be aware of the Executable it generates a Structure for
1726         https://bugs.webkit.org/show_bug.cgi?id=177907
1727
1728         Reviewed by Filip Pizlo.
1729
1730         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1731         (assert):
1732         (foo.C):
1733         (foo):
1734         (bar.C):
1735         (bar):
1736         (access):
1737         (makeLongChain):
1738         (accessY):
1739
1740 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1741
1742         `async` should be able to be used as an imported binding name
1743         https://bugs.webkit.org/show_bug.cgi?id=176573
1744
1745         Reviewed by Saam Barati.
1746
1747         * modules/import-default-async.js: Added.
1748         * modules/import-named-async-as.js: Added.
1749         * modules/import-named-async.js: Added.
1750         * modules/import-named-async/target.js: Added.
1751         * modules/import-namespace-async.js: Added.
1752         * test262.yaml:
1753
1754 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1755
1756         Enable gigacage on iOS
1757         https://bugs.webkit.org/show_bug.cgi?id=177586
1758
1759         Reviewed by JF Bastien.
1760         
1761         Add tests for when Gigacage gets runtime disabled.
1762
1763         * stress/disable-gigacage-arrays.js: Added.
1764         (foo):
1765         * stress/disable-gigacage-strings.js: Added.
1766         (foo):
1767         * stress/disable-gigacage-typed-arrays.js: Added.
1768         (foo):
1769
1770 2017-10-09  Michael Saboff  <msaboff@apple.com>
1771
1772         Implement RegExp Unicode property escapes
1773         https://bugs.webkit.org/show_bug.cgi?id=172069
1774
1775         Reviewed by JF Bastien.
1776
1777         Enabled Unicode Property tests.
1778
1779         * test262.yaml:
1780
1781 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1782
1783         Unreviewed, rolling out r223015 and r223025.
1784         https://bugs.webkit.org/show_bug.cgi?id=178093
1785
1786         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1787         #webkit).
1788
1789         Reverted changesets:
1790
1791         "Enable gigacage on iOS"
1792         https://bugs.webkit.org/show_bug.cgi?id=177586
1793         http://trac.webkit.org/changeset/223015
1794
1795         "Unreviewed, disable Gigacage on ARM64 Linux"
1796         https://bugs.webkit.org/show_bug.cgi?id=177586
1797         http://trac.webkit.org/changeset/223025
1798
1799 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1800
1801         Update expectations for test262 tests that pass after r223043.
1802         https://bugs.webkit.org/show_bug.cgi?id=176685
1803
1804         Unreviewed test gardening.
1805
1806         * test262.yaml:
1807
1808 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1809
1810         Unreviewed, rolling out r223022.
1811
1812         This change introduced 18 test262 failures.
1813
1814         Reverted changeset:
1815
1816         "`async` should be able to be used as an imported binding
1817         name"
1818         https://bugs.webkit.org/show_bug.cgi?id=176573
1819         http://trac.webkit.org/changeset/223022
1820
1821 2017-10-09  Saam Barati  <sbarati@apple.com>
1822
1823         3 poly-proto JSC tests timing out on debug after r222827
1824         https://bugs.webkit.org/show_bug.cgi?id=177880
1825         <rdar://problem/34817122>
1826
1827         Unreviewed.
1828
1829         I'm skipping these type profiler tests on debug since they are long running.
1830
1831         * typeProfiler/deltablue-for-of.js:
1832         * typeProfiler/getter-richards.js:
1833
1834 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1835
1836         Safari 10 /11 problem with if (!await get(something)).
1837         https://bugs.webkit.org/show_bug.cgi?id=176685
1838
1839         Reviewed by Saam Barati.
1840
1841         * stress/async-await-basic.js:
1842         (awaitEpression.async):
1843         * stress/async-await-syntax.js:
1844         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1845         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1846
1847 2017-10-08  Saam Barati  <sbarati@apple.com>
1848
1849         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1850
1851         * typeProfiler/deltablue-for-of.js:
1852         * typeProfiler/getter-richards.js:
1853
1854 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1855
1856         `async` should be able to be used as an imported binding name
1857         https://bugs.webkit.org/show_bug.cgi?id=176573
1858
1859         Reviewed by Darin Adler.
1860
1861         * modules/import-default-async.js: Added.
1862         * modules/import-named-async-as.js: Added.
1863         * modules/import-named-async.js: Added.
1864         * modules/import-named-async/target.js: Added.
1865         * modules/import-namespace-async.js: Added.
1866
1867 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1868
1869         Enable gigacage on iOS
1870         https://bugs.webkit.org/show_bug.cgi?id=177586
1871
1872         Reviewed by JF Bastien.
1873         
1874         Add tests for when Gigacage gets runtime disabled.
1875
1876         * stress/disable-gigacage-arrays.js: Added.
1877         (foo):
1878         * stress/disable-gigacage-strings.js: Added.
1879         (foo):
1880         * stress/disable-gigacage-typed-arrays.js: Added.
1881         (foo):
1882
1883 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1884
1885         Unreviewed, rolling out r222791 and r222873.
1886         https://bugs.webkit.org/show_bug.cgi?id=178031
1887
1888         Caused crashes with workers/wasm LayoutTests (Requested by
1889         ryanhaddad on #webkit).
1890
1891         Reverted changesets:
1892
1893         "WebAssembly: no VM / JS version of everything but Instance"
1894         https://bugs.webkit.org/show_bug.cgi?id=177473
1895         http://trac.webkit.org/changeset/222791
1896
1897         "WebAssembly: address no VM / JS follow-ups"
1898         https://bugs.webkit.org/show_bug.cgi?id=177887
1899         http://trac.webkit.org/changeset/222873
1900
1901 2017-10-05  Saam Barati  <sbarati@apple.com>
1902
1903         Make sure all prototypes under poly proto get added into the VM's prototype map
1904         https://bugs.webkit.org/show_bug.cgi?id=177909
1905
1906         Reviewed by Keith Miller.
1907
1908         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1909         (assert):
1910         (foo.C):
1911         (foo):
1912         (set x):
1913
1914 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1915
1916         [JSC] Introduce import.meta
1917         https://bugs.webkit.org/show_bug.cgi?id=177703
1918
1919         Reviewed by Filip Pizlo.
1920
1921         * modules/import-meta-syntax.js: Added.
1922         (shouldThrow):
1923         (shouldNotThrow):
1924         * modules/import-meta.js: Added.
1925         * modules/import-meta/cocoa.js: Added.
1926         * modules/resources/assert.js:
1927         (export.shouldNotThrow):
1928         * stress/import-syntax.js:
1929
1930 2017-10-04  Saam Barati  <sbarati@apple.com>
1931
1932         Make pertinent AccessCases watch the poly proto watchpoint
1933         https://bugs.webkit.org/show_bug.cgi?id=177765
1934
1935         Reviewed by Keith Miller.
1936
1937         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1938         (assert):
1939         (foo.C):
1940         (foo):
1941         (validate):
1942         * stress/poly-proto-clear-stub.js: Added.
1943         (assert):
1944         (foo.C):
1945         (foo):
1946
1947 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1948
1949         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1950
1951         Unreviewed test gardening.
1952
1953         * test262.yaml:
1954
1955 2017-10-04  Saam Barati  <sbarati@apple.com>
1956
1957         3 poly-proto JSC tests timing out on debug after r222827
1958         https://bugs.webkit.org/show_bug.cgi?id=177880
1959
1960         Rubber stamped by Mark Lam.
1961
1962         * microbenchmarks/poly-proto-access.js:
1963         * typeProfiler/deltablue-for-of.js:
1964         * typeProfiler/getter-richards.js:
1965
1966 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1967
1968         Unreviewed, marking tco-catch.js as a failure after test262 update
1969         https://bugs.webkit.org/show_bug.cgi?id=177859
1970
1971         * test262.yaml:
1972
1973 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1974
1975         Unreviewed, marking one async iterator test262 test failed
1976         https://bugs.webkit.org/show_bug.cgi?id=177859
1977
1978         * test262.yaml:
1979
1980 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1981
1982         [Test262] Update Test262 to Oct 4 version
1983         https://bugs.webkit.org/show_bug.cgi?id=177859
1984
1985         Reviewed by Sam Weinig.
1986
1987         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1988         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1989
1990         * test262.yaml:
1991         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1992         (checkSequence):
1993         * test262/harness/typeCoercion.js:
1994         (testCoercibleToIndexZero):
1995         (testCoercibleToIndexOne):
1996         (testCoercibleToIndexFromIndex):
1997         (testNotCoercibleToIndex.testPrimitiveValue):
1998         (testNotCoercibleToInteger):
1999         (testCoercibleToBigIntZero.testPrimitiveValue):
2000         (testCoercibleToBigIntZero):
2001         (testCoercibleToBigIntOne.testPrimitiveValue):
2002         (testCoercibleToBigIntOne):
2003         (testPrimitiveValue):
2004         (testCoercibleToBigIntFromBigInt):
2005         (testNotCoercibleToBigInt.testPrimitiveValue):
2006         (testNotCoercibleToBigInt.testStringValue):
2007         (testNotCoercibleToBigInt):
2008         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
2009         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
2010         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
2011         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
2012         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
2013         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
2014         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
2015         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
2016         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
2017         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
2018         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
2019         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
2020         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
2021         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
2022         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
2023         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
2024         (testCoercibleToBigIntZero):
2025         (testCoercibleToBigIntOne):
2026         (testNotCoercibleToBigInt):
2027         (MyError): Deleted.
2028         (valueOf): Deleted.
2029         (toString): Deleted.
2030         (Symbol.toPrimitive): Deleted.
2031         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
2032         (testCoercibleToIndexZero):
2033         (testCoercibleToIndexOne):
2034         (testNotCoercibleToIndex):
2035         (MyError): Deleted.
2036         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
2037         (assert.sameValue.BigInt.asIntN.toString): Deleted.
2038         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
2039         (BigInt.asIntN.valueOf): Deleted.
2040         (BigInt.asIntN.toString): Deleted.
2041         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
2042         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
2043         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
2044         (testCoercibleToBigIntZero):
2045         (testCoercibleToBigIntOne):
2046         (testNotCoercibleToBigInt):
2047         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
2048         (testCoercibleToIndexZero):
2049         (testCoercibleToIndexOne):
2050         (testNotCoercibleToIndex):
2051         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
2052         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
2053         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
2054         (bits.valueOf):
2055         (bigint.valueOf):
2056         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
2057         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
2058         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
2059         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
2060         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
2061         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
2062         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
2063         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
2064         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
2065         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
2066         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
2067         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
2068         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
2069         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
2070         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
2071         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
2072         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
2073         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
2074         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
2075         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
2076         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
2077         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
2078         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
2079         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
2080         (replacer):
2081         (BigInt.prototype.toJSON):
2082         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
2083         (replacer):
2084         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
2085         (BigInt.prototype.toJSON):
2086         * test262/test/built-ins/JSON/stringify/bigint.js:
2087         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
2088         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
2089         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
2090         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
2091         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
2092         * test262/test/built-ins/Object/proto-from-ctor.js:
2093         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
2094         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
2095         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
2096         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
2097         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
2098         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
2099         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
2100         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
2101         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
2102         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
2103         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
2104         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
2105         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
2106         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
2107         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
2108         * test262/test/built-ins/Proxy/get-fn-realm.js:
2109         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
2110         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
2111         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
2112         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
2113         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
2114         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
2115         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
2116         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
2117         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
2118         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
2119         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
2120         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
2121         (i6.replace):
2122         (i6b.replace):
2123         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
2124         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
2125         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
2126         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
2127         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
2128         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
2129         * test262/test/built-ins/RegExp/u180e.js: Added.
2130         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
2131         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
2132         * test262/test/built-ins/String/proto-from-ctor-realm.js:
2133         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
2134         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
2135         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
2136         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
2137         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
2138         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
2139         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
2140         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
2141         * test262/test/built-ins/String/prototype/endsWith/length.js:
2142         * test262/test/built-ins/String/prototype/endsWith/name.js:
2143         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
2144         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
2145         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
2146         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
2147         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
2148         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
2149         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
2150         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
2151         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
2152         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
2153         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
2154         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
2155         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
2156         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
2157         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
2158         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
2159         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
2160         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
2161         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
2162         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
2163         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
2164         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
2165         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
2166         * test262/test/built-ins/String/prototype/includes/includes.js:
2167         * test262/test/built-ins/String/prototype/includes/length.js:
2168         * test262/test/built-ins/String/prototype/includes/name.js:
2169         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
2170         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
2171         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
2172         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
2173         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
2174         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
2175         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
2176         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
2177         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
2178         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
2179         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
2180         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
2181         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
2182         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
2183         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
2184         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
2185         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
2186         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
2187         * test262/test/built-ins/String/prototype/trim/u180e.js:
2188         * test262/test/built-ins/Symbol/for/cross-realm.js:
2189         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
2190         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
2191         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
2192         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
2193         * test262/test/built-ins/Symbol/match/cross-realm.js:
2194         * test262/test/built-ins/Symbol/replace/cross-realm.js:
2195         * test262/test/built-ins/Symbol/search/cross-realm.js:
2196         * test262/test/built-ins/Symbol/species/cross-realm.js:
2197         * test262/test/built-ins/Symbol/split/cross-realm.js:
2198         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
2199         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
2200         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
2201         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
2202         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
2203         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
2204         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
2205         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
2206         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
2207         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
2208         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
2209         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
2210         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
2211         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
2212         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
2213         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
2214         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
2215         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
2216         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
2217         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
2218         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
2219         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
2220         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
2221         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
2222         * test262/test/language/comments/mongolian-vowel-separator-single.js:
2223         * test262/test/language/eval-code/indirect/realm.js:
2224         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
2225         (o.get z):
2226         (o.get a):
2227         * test262/test/language/expressions/call/eval-realm-indirect.js:
2228         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
2229         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
2230         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
2231         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
2232         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2233         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
2234         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
2235         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
2236         * test262/test/language/expressions/greater-than/bigint-and-number.js:
2237         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
2238         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
2239         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
2240         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2241         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
2242         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
2243         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
2244         * test262/test/language/expressions/less-than/bigint-and-number.js:
2245         * test262/test/language/expressions/new/non-ctor-err-realm.js:
2246         * test262/test/language/expressions/super/realm.js:
2247         * test262/test/language/expressions/tagged-template/cache-realm.js:
2248         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
2249         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
2250         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
2251         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
2252         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
2253         * test262/test/language/literals/string/mongolian-vowel-separator.js:
2254         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
2255         (o.get z):
2256         (o.get a):
2257         * test262/test/language/statements/for-of/iterator-next-reference.js:
2258         (next):
2259         (iterator.next): Deleted.
2260         (x.of.iterable.): Deleted.
2261         (x.of.iterable.get return): Deleted.
2262         (x.of.iterable.iterator.next): Deleted.
2263         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
2264         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
2265         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
2266         * test262/test/language/white-space/mongolian-vowel-separator.js:
2267         * test262/test262-Revision.txt:
2268
2269 2017-10-03  Saam Barati  <sbarati@apple.com>
2270
2271         Implement polymorphic prototypes
2272         https://bugs.webkit.org/show_bug.cgi?id=176391
2273
2274         Reviewed by Filip Pizlo.
2275
2276         * microbenchmarks/poly-proto-access.js: Added.
2277         (assert):
2278         (foo.C):
2279         (foo.C.prototype.get bar):
2280         (foo):
2281         (bar):
2282         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
2283         (assert):
2284         (makePolyProtoObject.foo.C):
2285         (makePolyProtoObject.foo):
2286         (makePolyProtoObject):
2287         (performSet):
2288         * microbenchmarks/poly-proto-setter-speed.js: Added.
2289         (assert):
2290         (makePolyProtoObject.foo.C):
2291         (makePolyProtoObject.foo.C.prototype.set p):
2292         (makePolyProtoObject.foo):
2293         (makePolyProtoObject):
2294         (performSet):
2295         * stress/constructor-with-return.js:
2296         (i.tests.forEach.Constructor):
2297         (i.tests.forEach):
2298         (tests.forEach.Constructor): Deleted.
2299         (tests.forEach): Deleted.
2300         * stress/dom-jit-with-poly-proto.js: Added.
2301         (assert):
2302         (makePolyProtoObject.foo.C):
2303         (makePolyProtoObject.foo):
2304         (makePolyProtoObject):
2305         (validate):
2306         * stress/poly-proto-custom-value-and-accessor.js: Added.
2307         (assert):
2308         (makePolyProtoObject.foo.C):
2309         (makePolyProtoObject.foo):
2310         (makePolyProtoObject):
2311         (items.forEach):
2312         (set get for):
2313         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
2314         (assert):
2315         (makePolyProtoObject.foo.C):
2316         (makePolyProtoObject.foo):
2317         (makePolyProtoObject):
2318         (foo):
2319         * stress/poly-proto-miss.js: Added.
2320         (makePolyProtoInstanceWithNullPrototype.foo.C):
2321         (makePolyProtoInstanceWithNullPrototype.foo):
2322         (makePolyProtoInstanceWithNullPrototype):
2323         (assert):
2324         (validate):
2325         * stress/poly-proto-op-in-caching.js: Added.
2326         (assert):
2327         (makePolyProtoObject.foo.C):
2328         (makePolyProtoObject.foo):
2329         (makePolyProtoObject):
2330         (validate):
2331         (validate2):
2332         * stress/poly-proto-put-transition.js: Added.
2333         (assert):
2334         (makePolyProtoObject.foo.C):
2335         (makePolyProtoObject.foo):
2336         (makePolyProtoObject):
2337         (performSet):
2338         (i.obj.__proto__.set p):
2339         * stress/poly-proto-set-prototype.js: Added.
2340         (assert):
2341         (let.alternateProto.get x):
2342         (let.alternateProto2.get y):
2343         (let.alternateProto2.get x):
2344         (foo.C):
2345         (foo):
2346         (validate):
2347         * stress/poly-proto-setter.js: Added.
2348         (assert):
2349         (makePolyProtoObject.foo.C):
2350         (makePolyProtoObject.foo.C.prototype.set p):
2351         (makePolyProtoObject.foo.C.prototype.get p):
2352         (makePolyProtoObject.foo):
2353         (makePolyProtoObject):
2354         (performSet):
2355         * stress/poly-proto-using-inheritance.js: Added.
2356         (assert):
2357         (foo.C):
2358         (foo.C.prototype.get baz):
2359         (foo):
2360         (bar.C):
2361         (bar):
2362         (validate):
2363         * stress/primitive-poly-proto.js: Added.
2364         (makePolyProtoInstance.foo.C):
2365         (makePolyProtoInstance.foo):
2366         (makePolyProtoInstance):
2367         (assert):
2368         (validate):
2369         * stress/prototype-is-not-js-object.js: Added.
2370         (foo.bar):
2371         (foo):
2372         (assert):
2373         (validate):
2374         * stress/try-get-by-id-poly-proto.js: Added.
2375         (assert):
2376         (makePolyProtoObject.foo.C):
2377         (makePolyProtoObject.foo):
2378         (makePolyProtoObject):
2379         (tryGetByIdText):
2380         (x.__proto__.get bar):
2381         (validate):
2382         * typeProfiler/overflow.js:
2383
2384 2017-10-03  JF Bastien  <jfbastien@apple.com>
2385
2386         WebAssembly: no VM / JS version of everything but Instance
2387         https://bugs.webkit.org/show_bug.cgi?id=177473
2388
2389         Reviewed by Filip Pizlo.
2390
2391         - Exceeding max on memory growth now returns a range error as per
2392         spec. This is a (very minor) breaking change: it used to throw OOM
2393         error. Update the corresponding test.
2394
2395         * wasm/js-api/memory-grow.js:
2396         (assertEq):
2397         * wasm/js-api/table.js:
2398         (assert.throws):
2399
2400 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
2401
2402         Skip JSC test stress/regress-159779-2.js on debug.
2403         https://bugs.webkit.org/show_bug.cgi?id=177204
2404
2405         Unreviewed test gardening.
2406
2407         * stress/regress-159779-2.js:
2408
2409 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
2410
2411         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2412         https://bugs.webkit.org/show_bug.cgi?id=175642
2413
2414         Reviewed by Darin Adler.
2415
2416         * ChakraCore/test/Function/apply3.baseline-jsc:
2417
2418 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2419
2420         Unreviewed, rolling out r222564.
2421         https://bugs.webkit.org/show_bug.cgi?id=177720
2422
2423         "It regressed JetStream by 2% on iOS caused by a 50%
2424         regression on the bigfib subtest" (Requested by saamyjoon on
2425         #webkit).
2426
2427         Reverted changeset:
2428
2429         "Add Above/Below comparisons for UInt32 patterns"
2430         https://bugs.webkit.org/show_bug.cgi?id=177281
2431         http://trac.webkit.org/changeset/222564
2432
2433 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2434
2435         [DFG] Support ArrayPush with multiple args
2436         https://bugs.webkit.org/show_bug.cgi?id=175823
2437
2438         Reviewed by Saam Barati.
2439
2440         * microbenchmarks/array-push-0.js: Added.
2441         (arrayPush0):
2442         * microbenchmarks/array-push-1.js: Added.
2443         (arrayPush1):
2444         * microbenchmarks/array-push-2.js: Added.
2445         (arrayPush2):
2446         * microbenchmarks/array-push-3.js: Added.
2447         (arrayPush3):
2448         * stress/array-push-multiple-contiguous.js: Added.
2449         (shouldBe):
2450         (test):
2451         * stress/array-push-multiple-double-nan.js: Added.
2452         (shouldBe):
2453         (test):
2454         * stress/array-push-multiple-double.js: Added.
2455         (shouldBe):
2456         (test):
2457         * stress/array-push-multiple-int32.js: Added.
2458         (shouldBe):
2459         (test):
2460         * stress/array-push-multiple-many-contiguous.js: Added.
2461         (shouldBe):
2462         (test):
2463         * stress/array-push-multiple-many-double.js: Added.
2464         (shouldBe):
2465         (test):
2466         * stress/array-push-multiple-many-int32.js: Added.
2467         (shouldBe):
2468         (test):
2469         * stress/array-push-multiple-many-storage.js: Added.
2470         (shouldBe):
2471         (test):
2472         * stress/array-push-multiple-storage.js: Added.
2473         (shouldBe):
2474         (test):
2475         * stress/array-push-with-force-exit.js: Added.
2476         (target.createBuiltin):
2477
2478 2017-09-29  Saam Barati  <sbarati@apple.com>
2479
2480         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2481         https://bugs.webkit.org/show_bug.cgi?id=177639
2482
2483         Reviewed by Geoffrey Garen.
2484
2485         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2486         (assert):
2487         (Class):
2488         (items.forEach):
2489         (set get for):
2490
2491 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2492
2493         Unreviewed, rolling out r222563, r222565, and r222581.
2494         https://bugs.webkit.org/show_bug.cgi?id=177675
2495
2496         "It causes a crash when playing youtube videos" (Requested by
2497         saamyjoon on #webkit).
2498
2499         Reverted changesets:
2500
2501         "[DFG] Support ArrayPush with multiple args"
2502         https://bugs.webkit.org/show_bug.cgi?id=175823
2503         http://trac.webkit.org/changeset/222563
2504
2505         "Unreviewed, build fix after r222563"
2506         https://bugs.webkit.org/show_bug.cgi?id=175823
2507         http://trac.webkit.org/changeset/222565
2508
2509         "Unreviewed, fix x86 breaking due to exhausted registers"
2510         https://bugs.webkit.org/show_bug.cgi?id=175823
2511         http://trac.webkit.org/changeset/222581
2512
2513 2017-09-28  Mark Lam  <mark.lam@apple.com>
2514
2515         test262: Unexpected passes after r222617 and r222618.
2516         https://bugs.webkit.org/show_bug.cgi?id=177622
2517         <rdar://problem/34725960>
2518
2519         Reviewed by Saam Barati.
2520
2521         Update test262.yaml for tests that are now passing.
2522
2523         * test262.yaml:
2524
2525 2017-09-27  Michael Saboff  <msaboff@apple.com>
2526
2527         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2528         https://bugs.webkit.org/show_bug.cgi?id=177570
2529
2530         Reviewed by Filip Pizlo.
2531
2532         New regression test.
2533
2534         * stress/regress-177570.js: Added.
2535
2536 2017-09-28  Michael Saboff  <msaboff@apple.com>
2537
2538         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2539         https://bugs.webkit.org/show_bug.cgi?id=177423
2540
2541         Reviewed by Mark Lam.
2542
2543         Updated regression test.
2544
2545         * stress/regress-177423.js:
2546         (catch):
2547
2548 2017-09-27  Mark Lam  <mark.lam@apple.com>
2549
2550         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2551         https://bugs.webkit.org/show_bug.cgi?id=177584
2552         <rdar://problem/34463903>
2553
2554         Reviewed by Saam Barati.
2555
2556         * stress/regress-177584.js: Added.
2557         (assertEqual):
2558         (Array.prototype.Symbol.species):
2559
2560 2017-09-27  Saam Barati  <sbarati@apple.com>
2561
2562         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2563         https://bugs.webkit.org/show_bug.cgi?id=177523
2564
2565         Reviewed by Mark Lam.
2566
2567         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2568         (assert):
2569         (Test):
2570         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2571         (addMethods):
2572         (i.Test.prototype.propName):
2573
2574 2017-09-27  Mark Lam  <mark.lam@apple.com>
2575
2576         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2577         https://bugs.webkit.org/show_bug.cgi?id=177423
2578         <rdar://problem/34621320>
2579
2580         Reviewed by Keith Miller.
2581
2582         * stress/regress-177423.js: Added.
2583
2584 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2585
2586         Add Above/Below comparisons for UInt32 patterns
2587         https://bugs.webkit.org/show_bug.cgi?id=177281
2588
2589         Reviewed by Saam Barati.
2590
2591         * stress/uint32-comparison-jump.js: Added.
2592         (shouldBe):
2593         (above):
2594         (aboveOrEqual):
2595         (below):
2596         (belowOrEqual):
2597         (notAbove):
2598         (notAboveOrEqual):
2599         (notBelow):
2600         (notBelowOrEqual):
2601         * stress/uint32-comparison.js: Added.
2602         (shouldBe):
2603         (above):
2604         (aboveOrEqual):
2605         (below):
2606         (belowOrEqual):
2607         (aboveTest):
2608         (aboveOrEqualTest):
2609         (belowTest):
2610         (belowOrEqualTest):
2611
2612 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2613
2614         [DFG] Support ArrayPush with multiple args
2615         https://bugs.webkit.org/show_bug.cgi?id=175823
2616
2617         Reviewed by Saam Barati.
2618
2619         * microbenchmarks/array-push-0.js: Added.
2620         (arrayPush0):
2621         * microbenchmarks/array-push-1.js: Added.
2622         (arrayPush1):
2623         * microbenchmarks/array-push-2.js: Added.
2624         (arrayPush2):
2625         * microbenchmarks/array-push-3.js: Added.
2626         (arrayPush3):
2627         * stress/array-push-multiple-contiguous.js: Added.
2628         (shouldBe):
2629         (test):
2630         * stress/array-push-multiple-double-nan.js: Added.
2631         (shouldBe):
2632         (test):
2633         * stress/array-push-multiple-double.js: Added.
2634         (shouldBe):
2635         (test):
2636         * stress/array-push-multiple-int32.js: Added.
2637         (shouldBe):
2638         (test):
2639         * stress/array-push-multiple-many-contiguous.js: Added.
2640         (shouldBe):
2641         (test):
2642         * stress/array-push-multiple-many-double.js: Added.
2643         (shouldBe):
2644         (test):
2645         * stress/array-push-multiple-many-int32.js: Added.
2646         (shouldBe):
2647         (test):
2648         * stress/array-push-multiple-many-storage.js: Added.
2649         (shouldBe):
2650         (test):
2651         * stress/array-push-multiple-storage.js: Added.
2652         (shouldBe):
2653         (test):
2654
2655 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2656
2657         Unreviewed, rolling out r222518.
2658         https://bugs.webkit.org/show_bug.cgi?id=177507
2659
2660         Break the High Sierra build (Requested by yusukesuzuki on
2661         #webkit).
2662
2663         Reverted changeset:
2664
2665         "Add Above/Below comparisons for UInt32 patterns"
2666         https://bugs.webkit.org/show_bug.cgi?id=177281
2667         http://trac.webkit.org/changeset/222518
2668
2669 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2670
2671         Add Above/Below comparisons for UInt32 patterns
2672         https://bugs.webkit.org/show_bug.cgi?id=177281
2673
2674         Reviewed by Saam Barati.
2675
2676         * stress/uint32-comparison-jump.js: Added.
2677         (shouldBe):
2678         (above):
2679         (aboveOrEqual):
2680         (below):
2681         (belowOrEqual):
2682         (notAbove):
2683         (notAboveOrEqual):
2684         (notBelow):
2685         (notBelowOrEqual):
2686         * stress/uint32-comparison.js: Added.
2687         (shouldBe):
2688         (above):
2689         (aboveOrEqual):
2690         (below):
2691         (belowOrEqual):
2692         (aboveTest):
2693         (aboveOrEqualTest):
2694         (belowTest):
2695         (belowOrEqualTest):
2696
2697 2017-09-23  Keith Miller  <keith_miller@apple.com>
2698
2699         Fix infinite looping test262 test
2700         https://bugs.webkit.org/show_bug.cgi?id=177412
2701
2702         Reviewed by Yusuke Suzuki.
2703
2704         This test was poorly designed since failing it would cause the vm
2705         to inifinite loop. I've fixed it locally and will fix it on github pending
2706         the results of next weeks tc39 meeting.
2707
2708         * test262.yaml:
2709         * test262/test/language/statements/for-of/iterator-next-reference.js:
2710
2711 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2712
2713         test262: $.agent became $262.agent in test262 update
2714         https://bugs.webkit.org/show_bug.cgi?id=177407
2715
2716         Reviewed by Yusuke Suzuki.
2717
2718         * test262.yaml:
2719         ~320 tests pass now that we correctly make $262 available.
2720
2721 2017-09-22  Keith Miller  <keith_miller@apple.com>
2722
2723         Speculatively change iteration protocall to use the same next function
2724         https://bugs.webkit.org/show_bug.cgi?id=175653
2725
2726         Reviewed by Saam Barati.
2727
2728         Change test to match the new iteration behavior.
2729
2730         * stress/spread-optimized-properly.js:
2731
2732 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2733
2734         [DFG][FTL] Profile array vector length for array allocation
2735         https://bugs.webkit.org/show_bug.cgi?id=177051
2736
2737         Reviewed by Saam Barati.
2738
2739         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2740         (target):
2741
2742 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2743
2744         Unreviewed, rolling out r222380.
2745         https://bugs.webkit.org/show_bug.cgi?id=177352
2746
2747         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2748         #webkit).
2749
2750         Reverted changeset:
2751
2752         "[DFG][FTL] Profile array vector length for array allocation"
2753         https://bugs.webkit.org/show_bug.cgi?id=177051
2754         http://trac.webkit.org/changeset/222380
2755
2756 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2757
2758         [DFG][FTL] Profile array vector length for array allocation
2759         https://bugs.webkit.org/show_bug.cgi?id=177051
2760
2761         Reviewed by Saam Barati.
2762
2763         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2764         (target):
2765
2766 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2767
2768         Skip new hanging test262 tests.
2769         https://bugs.webkit.org/show_bug.cgi?id=177326
2770
2771         Unreviewed test gardening.
2772
2773         * test262.yaml:
2774
2775 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2776
2777         Mark 6 test262 tests as passing.
2778         https://bugs.webkit.org/show_bug.cgi?id=177307
2779
2780         Unreviewed test gardening.
2781
2782         * test262.yaml:
2783
2784 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2785
2786         Unreviewed follow-up to r222311.
2787
2788         * test262/harness/sta.js:
2789         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2790         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2791         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2792         * test262/test/built-ins/Array/from/elements-added-after.js:
2793         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2794         * test262/test/built-ins/Array/from/elements-updated-after.js:
2795         * test262/test/built-ins/Array/from/from-array.js:
2796         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2797         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2798         * test262/test/built-ins/Array/from/source-array-boundary.js:
2799         * test262/test/built-ins/Array/from/source-object-constructor.js:
2800         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2801         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2802         * test262/test/built-ins/Array/from/source-object-length.js:
2803         * test262/test/built-ins/Array/from/source-object-missing.js:
2804         * test262/test/built-ins/Array/from/source-object-without.js:
2805         * test262/test/built-ins/Array/from/this-null.js:
2806         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2807         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2808         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2809         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2810         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2811         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2812         * test262/test/language/literals/string/7.8.4-1gs.js:
2813         Fix some files that I failed to update when I applied my patch.
2814
2815 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2816
2817         Update test262 tests
2818         https://bugs.webkit.org/show_bug.cgi?id=177220
2819
2820         Reviewed by Saam Barati and Yusuke Suzuki.
2821
2822         * test262.yaml:
2823         * test262/test262-Revision.txt:
2824         New rebaselined expectations for all tests.
2825
2826         * test262/*:
2827         Updated.
2828
2829 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2830
2831         [DFG] Remove ToThis more aggressively
2832         https://bugs.webkit.org/show_bug.cgi?id=177056
2833
2834         Reviewed by Saam Barati.
2835
2836         * stress/generator-with-this-strict.js: Added.
2837         (shouldBe):
2838         (generator):
2839         (target):
2840         * stress/generator-with-this.js: Added.
2841         (shouldBe):
2842         (generator):
2843         (target):
2844
2845 2017-09-17  Michael Saboff  <msaboff@apple.com>
2846
2847         https://bugs.webkit.org/show_bug.cgi?id=177038
2848         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2849
2850         Reviewed by JF Bastien.
2851
2852         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2853         as it dies using too much memory.
2854
2855 2017-09-15  Saam Barati  <sbarati@apple.com>
2856
2857         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2858         https://bugs.webkit.org/show_bug.cgi?id=176981
2859
2860         Reviewed by Yusuke Suzuki.
2861
2862         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2863         (assert):
2864         (verify):
2865         (func):
2866         (const.bar.createBuiltin):
2867
2868 2017-09-14  Saam Barati  <sbarati@apple.com>
2869
2870         It should be valid to exit before each set when doing arity fixup when inlining
2871         https://bugs.webkit.org/show_bug.cgi?id=176948
2872
2873         Reviewed by Keith Miller.
2874
2875         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2876         (baz):
2877         (bar):
2878         (foo):
2879
2880 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2881
2882         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2883         https://bugs.webkit.org/show_bug.cgi?id=176867
2884
2885         Reviewed by Sam Weinig.
2886
2887         * microbenchmarks/object-get-own-property-symbols.js: Added.
2888         (test):
2889
2890 2017-09-13  Mark Lam  <mark.lam@apple.com>
2891
2892         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2893         https://bugs.webkit.org/show_bug.cgi?id=176888
2894         <rdar://problem/34381832>
2895
2896         Not reviewed.
2897
2898         * stress/op_mod-ConstVar.js:
2899         * stress/op_mod-VarConst.js:
2900         * stress/op_mod-VarVar.js:
2901
2902 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2903
2904         Skip 3 op_mod tests on Debug JSC bots.
2905         https://bugs.webkit.org/show_bug.cgi?id=176630
2906
2907         Unreviewed test gardening.
2908
2909         * stress/op_mod-ConstVar.js:
2910         * stress/op_mod-VarConst.js:
2911         * stress/op_mod-VarVar.js:
2912
2913 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2914
2915         [JSC] Fix Array allocation in Object.keys
2916         https://bugs.webkit.org/show_bug.cgi?id=176826
2917
2918         Reviewed by Saam Barati.
2919
2920         * stress/object-own-property-keys.js: Added.
2921         (shouldBe):
2922
2923 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2924
2925         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2926         https://bugs.webkit.org/show_bug.cgi?id=176010
2927
2928         Reviewed by Filip Pizlo.
2929
2930         * microbenchmarks/weak-map-key.js: Added.
2931         (assert):
2932         (objectKey):
2933         (let.start.Date.now):
2934
2935 2017-09-12  Mark Lam  <mark.lam@apple.com>
2936
2937         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2938         https://bugs.webkit.org/show_bug.cgi?id=176630
2939
2940         Reviewed by JF Bastien.
2941
2942         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2943         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2944         a speculative fix for the bots that are seeing these fail.
2945
2946         I also undid the skipping of the op_mod tests for debug builds.
2947
2948         * stress/op_div-ConstVar.js:
2949         * stress/op_div-VarConst.js:
2950         * stress/op_div-VarVar.js:
2951         * stress/op_mod-ConstVar.js:
2952         * stress/op_mod-VarConst.js:
2953         * stress/op_mod-VarVar.js:
2954
2955 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2956
2957         Skip stress/value-to-boolean.js on Debug bots.
2958         https://bugs.webkit.org/show_bug.cgi?id=176787
2959
2960         Unreviewed test gardening.
2961
2962         * stress/value-to-boolean.js:
2963
2964 2017-09-11  Mark Lam  <mark.lam@apple.com>
2965
2966         Change test expectation for test262/test/language/statements/try/tco-catch.js
2967         https://bugs.webkit.org/show_bug.cgi?id=176749
2968
2969         Rubber stamped by Keith Miller.
2970
2971         It's been failing since at least r221821.  I'm changing the test expectation to
2972         fail to green the bots while I investigate some more.
2973
2974         * test262.yaml:
2975
2976 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2977
2978         Unreviewed, rolling out r221854.
2979
2980         The test added with this change fails on 32-bit JSC bots.
2981
2982         Reverted changeset:
2983
2984         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2985         https://bugs.webkit.org/show_bug.cgi?id=176010
2986         http://trac.webkit.org/changeset/221854
2987
2988 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2989
2990         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2991         https://bugs.webkit.org/show_bug.cgi?id=176010
2992
2993         Reviewed by Filip Pizlo.
2994
2995         * microbenchmarks/weak-map-key.js: Added.
2996         (assert):
2997         (objectKey):
2998         (let.start.Date.now):
2999
3000 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
3001
3002         [JSC] Optimize Object.keys by using careful array allocation
3003         https://bugs.webkit.org/show_bug.cgi?id=176654
3004
3005         Reviewed by Darin Adler.
3006
3007         * microbenchmarks/object-keys.js: Added.
3008         (test):
3009
3010 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
3011
3012         Error should compute .stack and friends lazily
3013         https://bugs.webkit.org/show_bug.cgi?id=176645
3014
3015         Reviewed by Saam Barati.
3016
3017         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
3018         * microbenchmarks/new-error.js: Added.
3019         * microbenchmarks/throw.js: Added.
3020
3021 2017-09-09  Mark Lam  <mark.lam@apple.com>
3022
3023         [Re-landing] Use JIT probes for DFG OSR exit.
3024         https://bugs.webkit.org/show_bug.cgi?id=175144
3025         <rdar://problem/33437050>
3026
3027         Not reviewed.  Original patch reviewed by Saam Barati.
3028
3029         Disable these tests for debug builds because they run too slow with the new OSR exit.
3030
3031         * stress/op_mod-ConstVar.js:
3032         * stress/op_mod-VarConst.js:
3033         * stress/op_mod-VarVar.js:
3034
3035 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3036
3037         [DFG] NewArrayWithSize(size)'s size does not care negative zero
3038         https://bugs.webkit.org/show_bug.cgi?id=176300
3039
3040         Reviewed by Saam Barati.
3041
3042         * stress/new-array-with-size-div.js: Added.
3043         (shouldBe):
3044         (test):
3045         (i.i):
3046
3047 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3048
3049         [DFG] PutByVal with Array::Generic is too generic
3050         https://bugs.webkit.org/show_bug.cgi?id=176345
3051
3052         Reviewed by Filip Pizlo.
3053
3054         * stress/object-assign-symbols.js: Added.
3055         (shouldBe):
3056         (test):
3057         * stress/object-assign.js: Added.
3058         (shouldBe):
3059         (test):
3060         (i.shouldBe.JSON.stringify.test):
3061
3062 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3063
3064         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
3065         https://bugs.webkit.org/show_bug.cgi?id=176590
3066
3067         Reviewed by Saam Barati.
3068
3069         * microbenchmarks/object-iterate-symbols.js: Added.
3070         (test):
3071         * microbenchmarks/object-iterate.js: Added.
3072         (test):
3073         * stress/object-iterate-symbols.js: Added.
3074         (shouldBe):
3075         (test):
3076         * stress/object-iterate.js: Added.
3077         (shouldBe):
3078         (test):
3079
3080 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
3081
3082         [Win32] 10 JSC stress tests are failing.
3083         https://bugs.webkit.org/show_bug.cgi?id=176538
3084
3085         Reviewed by Mark Lam.
3086
3087         Skip tests on Windows to make the bots green.
3088
3089         * ChakraCore.yaml:
3090         * stress/date-relaxed.js:
3091
3092 2017-09-06  Mark Lam  <mark.lam@apple.com>
3093
3094         constructGenericTypedArrayViewWithArguments() is missing an exception check.
3095         https://bugs.webkit.org/show_bug.cgi?id=176485
3096         <rdar://problem/33898874>
3097
3098         Reviewed by Keith Miller.
3099
3100         * stress/regress-176485.js: Added.
3101
3102 2017-09-05  Saam Barati  <sbarati@apple.com>
3103
3104         isNotCellSpeculation is wrong with respect to SpecEmpty
3105         https://bugs.webkit.org/show_bug.cgi?id=176429
3106
3107         Reviewed by Michael Saboff.
3108
3109         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
3110         (Foo):
3111
3112 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
3113
3114         test262: Completion values for control flow do not match the spec
3115         https://bugs.webkit.org/show_bug.cgi?id=171265
3116
3117         Reviewed by Saam Barati.
3118
3119         * stress/completion-value.js:
3120         Condensed test for completion values in top level statements.
3121
3122         * stress/super-get-by-id.js:
3123         ClassDeclaration when evaled no longer produce values. Convert
3124         these to ClassExpressions so they produce the class value.
3125         
3126         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3127         This is a progression for currect spec behavior.
3128
3129         * mozilla/mozilla-tests.yaml:
3130         This test is now outdated, so mark it as failing for that reason.
3131
3132         * test262.yaml:
3133         Passing all "cptn" completion value tests.
3134
3135 2017-09-04  Saam Barati  <sbarati@apple.com>
3136
3137         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
3138         https://bugs.webkit.org/show_bug.cgi?id=176317
3139
3140         Reviewed by Keith Miller.
3141
3142         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
3143         (Foo):
3144
3145 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3146
3147         [DFG][FTL] Efficiently execute number#toString()
3148         https://bugs.webkit.org/show_bug.cgi?id=170007
3149
3150         Reviewed by Keith Miller.
3151
3152         * microbenchmarks/number-to-string-strength-reduction.js: Added.
3153         (test):
3154         * microbenchmarks/number-to-string-with-radix-10.js: Added.
3155         (test):
3156         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
3157         (test):
3158         * microbenchmarks/number-to-string-with-radix.js: Added.
3159         (test):
3160         * stress/number-to-string-strength-reduction.js: Added.
3161         (shouldBe):
3162         (test):
3163         * stress/number-to-string-with-radix-10.js: Added.
3164         (shouldBe):
3165         (test):
3166         * stress/number-to-string-with-radix-cse.js: Added.
3167         (shouldBe):
3168         (test):
3169         * stress/number-to-string-with-radix-invalid.js: Added.
3170         (shouldThrow):
3171         * stress/number-to-string-with-radix-watchpoint.js: Added.
3172         (shouldBe):
3173         (test):
3174         (i.i.1e3.Number.prototype.toString):
3175         * stress/number-to-string-with-radix.js: Added.
3176         (shouldBe):
3177         (test):
3178
3179 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3180
3181         [DFG] Relax arity requirement
3182         https://bugs.webkit.org/show_bug.cgi?id=175523
3183
3184         Reviewed by Saam Barati.
3185
3186         * stress/arity-mismatch-arguments-length.js: Added.
3187         (shouldBe):
3188         (test1):
3189         (test):
3190         * stress/arity-mismatch-get-argument.js: Added.
3191         (shouldBe):
3192         (builtin.createBuiltin):
3193         (test):
3194         * stress/arity-mismatch-inlining-extra-slots.js: Added.
3195         (shouldBe):
3196         (inlineTarget):
3197         (test):
3198         * stress/arity-mismatch-inlining.js: Added.
3199         (shouldBe):
3200         (inlineTarget):
3201         (test):
3202         * stress/arity-mismatch-rest.js: Added.
3203         (shouldBe):
3204         (test2):
3205         (test1):
3206         (test):
3207
3208 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3209
3210         [JSC] Fix "name" and "length" of Proxy revoke function
3211         https://bugs.webkit.org/show_bug.cgi?id=176155
3212
3213         Reviewed by Mark Lam.
3214
3215         * test262.yaml:
3216
3217 2017-08-31  Saam Barati  <sbarati@apple.com>
3218
3219         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
3220         https://bugs.webkit.org/show_bug.cgi?id=176206
3221
3222         Reviewed by Keith Miller.
3223
3224         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
3225         (a):
3226         (b):
3227         (foo):
3228
3229 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
3230
3231         Skip two slow JSC tests after r221422.
3232
3233         Unreviewed test gardening.
3234
3235         * stress/regexp-prototype-match-on-too-long-rope.js:
3236         * stress/regexp-prototype-test-on-too-long-rope.js:
3237
3238 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
3239
3240         Unreviewed, skipping slow tests.
3241         
3242         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
3243         work differently now.
3244
3245         * stress/regexp-prototype-exec-on-too-long-rope.js:
3246         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
3247
3248 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3249
3250         [JSC] Use reifying system for "name" property of builtin JSFunction
3251         https://bugs.webkit.org/show_bug.cgi?id=175260
3252
3253         Reviewed by Saam Barati.
3254
3255         * stress/accessors-get-set-prefix.js:
3256         * stress/builtin-function-name.js: Added.
3257         (shouldBe):
3258         (shouldThrow):
3259         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3260         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3261         * stress/private-name-as-anonymous-builtin.js: Added.
3262         (shouldBe):
3263         (NotPromise):
3264
3265 2017-08-30  Saam Barati  <sbarati@apple.com>
3266
3267         Unreviewed. Make test stop printing.
3268
3269         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
3270
3271 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
3272
3273         Unreviewed, rolling out r221327.
3274
3275         This change caused test262 failures.
3276
3277         Reverted changeset:
3278
3279         "[JSC] Use reifying system for "name" property of builtin
3280         JSFunction"
3281         https://bugs.webkit.org/show_bug.cgi?id=175260
3282         http://trac.webkit.org/changeset/221327
3283
3284 2017-08-30  Saam Barati  <sbarati@apple.com>
3285
3286         semicolon is being interpreted as an = in the LiteralParser
3287         https://bugs.webkit.org/show_bug.cgi?id=176114
3288
3289         Reviewed by Oliver Hunt.
3290
3291         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
3292         * stress/resources/literal-parser-test-case.js: Added.
3293
3294 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3295
3296         [ESNext] Async iteration - Implement async iteration statement: for-await-of
3297         https://bugs.webkit.org/show_bug.cgi?id=166698
3298
3299         Reviewed by Yusuke Suzuki.
3300
3301         * stress/async-iteration-for-await-of-syntax.js: Added.
3302         (assert):
3303         (checkSyntax):
3304         (checkSyntaxError):
3305         (checkSimpleAsyncGeneratorSloppyMode):
3306         (checkSimpleAsyncGeneratorStrictMode):
3307         (checkNestedAsyncGenerators):
3308         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3309         * stress/async-iteration-for-await-of.js: Added.
3310         (assert):
3311         (async.foo):
3312         (async.boo):
3313         (const.boo.async):
3314
3315 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
3316
3317         [JSC] Use reifying system for "name" property of builtin JSFunction
3318         https://bugs.webkit.org/show_bug.cgi?id=175260
3319
3320         Reviewed by Saam Barati.
3321
3322         * stress/accessors-get-set-prefix.js:
3323         * stress/builtin-function-name.js: Added.
3324         (shouldBe):
3325         (shouldThrow):
3326         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3327         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3328
3329 2017-08-25  Saam Barati  <sbarati@apple.com>
3330
3331         Support compiling catch in the DFG
3332         https://bugs.webkit.org/show_bug.cgi?id=174590
3333         <rdar://problem/34047845>
3334
3335         Reviewed by Filip Pizlo.
3336
3337         * microbenchmarks/delta-blue-try-catch.js: Added.
3338         (exception):
3339         (value):
3340         (OrderedCollection):
3341         (OrderedCollection.prototype.add):
3342         (OrderedCollection.prototype.at):
3343         (OrderedCollection.prototype.size):
3344         (OrderedCollection.prototype.removeFirst):
3345         (OrderedCollection.prototype.remove):
3346         (Strength):
3347         (Strength.stronger):
3348         (Strength.weaker):
3349         (Strength.weakestOf):
3350         (Strength.strongest):
3351         (Strength.prototype.nextWeaker):
3352         (Constraint):
3353         (Constraint.prototype.addConstraint):
3354         (Constraint.prototype.satisfy):
3355         (Constraint.prototype.destroyConstraint):
3356         (Constraint.prototype.isInput):
3357         (UnaryConstraint):
3358         (UnaryConstraint.prototype.addToGraph):
3359         (UnaryConstraint.prototype.chooseMethod):
3360         (UnaryConstraint.prototype.isSatisfied):
3361         (UnaryConstraint.prototype.markInputs):
3362         (UnaryConstraint.prototype.output):
3363         (UnaryConstraint.prototype.recalculate):
3364         (UnaryConstraint.prototype.markUnsatisfied):
3365         (UnaryConstraint.prototype.inputsKnown):
3366         (UnaryConstraint.prototype.removeFromGraph):
3367         (StayConstraint):
3368         (StayConstraint.prototype.execute):
3369         (EditConstraint.prototype.isInput):
3370         (EditConstraint.prototype.execute):
3371         (BinaryConstraint):
3372         (BinaryConstraint.prototype.chooseMethod):
3373         (BinaryConstraint.prototype.addToGraph):
3374         (BinaryConstraint.prototype.isSatisfied):
3375         (BinaryConstraint.prototype.markInputs):
3376         (BinaryConstraint.prototype.input):
3377         (BinaryConstraint.prototype.output):
3378         (BinaryConstraint.prototype.recalculate):
3379         (BinaryConstraint.prototype.markUnsatisfied):
3380         (BinaryConstraint.prototype.inputsKnown):
3381         (BinaryConstraint.prototype.removeFromGraph):
3382         (ScaleConstraint):
3383         (ScaleConstraint.prototype.addToGraph):
3384         (ScaleConstraint.prototype.removeFromGraph):
3385         (ScaleConstraint.prototype.markInputs):
3386         (ScaleConstraint.prototype.execute):
3387         (ScaleConstraint.prototype.recalculate):
3388         (EqualityConstraint):
3389         (EqualityConstraint.prototype.execute):
3390         (Variable):
3391         (Variable.prototype.addConstraint):
3392         (Variable.prototype.removeConstraint):
3393         (Planner):
3394         (Planner.prototype.incrementalAdd):
3395         (Planner.prototype.incrementalRemove):
3396         (Planner.prototype.newMark):
3397         (Planner.prototype.makePlan):
3398         (Planner.prototype.extractPlanFromConstraints):
3399         (Planner.prototype.addPropagate):
3400         (Planner.prototype.removePropagateFrom):
3401         (Planner.prototype.addConstraintsConsumingTo):
3402         (Plan):
3403         (Plan.prototype.addConstraint):
3404         (Plan.prototype.size):
3405         (Plan.prototype.constraintAt):
3406         (Plan.prototype.execute):
3407         (chainTest):
3408         (projectionTest):
3409         (change):
3410         (deltaBlue):
3411         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3412         (assert):
3413         (Numbers):
3414         (Numbers.prototype.next):
3415         (return.Transpose):
3416         (return.Transpose.prototype.next):
3417         (transpose):
3418         (verifyEven):
3419         (verifyString):
3420         (foo):
3421         (runIterators):
3422         * microbenchmarks/try-catch-word-count.js: Added.
3423         (let.assert):
3424         (EOF):
3425         (let.texts):
3426         (let.o.apply):
3427         (foo):
3428         (bar):
3429         (f):
3430         (run):
3431         (test1):
3432         (test2):
3433         (test3):
3434         (fn):
3435         (A):
3436         (B):
3437         (A.prototype.getValue):
3438         (B.prototype.getParentValue):
3439         (strlen):
3440         (sum.0):
3441         (test):
3442         (result.test.o):
3443         (set add.set add):
3444         (set forEach):
3445         (stringHash):
3446         (set if):
3447         (testFunction):
3448         (set delete.set has.set add):
3449         * stress/catch-set-argument-speculation-failure.js: Added.
3450         (o):
3451         (e):
3452         (e2):
3453         (escape):
3454         (baz):
3455         (noInline.run):
3456         (noInline):
3457         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3458         (foo):
3459         (e):
3460         (baz):
3461         (bar):
3462
3463 2017-08-24  Commit Queue  <commit-queue@webkit.org>
3464
3465         Unreviewed, rolling out r221119, r221124, and r221143.
3466         https://bugs.webkit.org/show_bug.cgi?id=175973
3467
3468         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3469         on #webkit).
3470
3471         Reverted changesets:
3472
3473         "Support compiling catch in the DFG"
3474         https://bugs.webkit.org/show_bug.cgi?id=174590
3475         http://trac.webkit.org/changeset/221119
3476
3477         "Unreviewed, build fix in GTK port"
3478         https://bugs.webkit.org/show_bug.cgi?id=174590
3479         http://trac.webkit.org/changeset/221124
3480
3481         "DFG::JITCode::osrEntry should get sorted since we perform a
3482         binary search on it"
3483         https://bugs.webkit.org/show_bug.cgi?id=175893
3484         http://trac.webkit.org/changeset/221143
3485
3486 2017-08-24  Michael Saboff  <msaboff@apple.com>
3487
3488         Add support for RegExp "dotAll" flag
3489         https://bugs.webkit.org/show_bug.cgi?id=175924
3490
3491         Reviewed by Keith Miller.
3492
3493         Updated tests for new dotAll ('s' flag) changes.
3494
3495         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3496         * stress/static-getter-in-names.js:
3497
3498 2017-08-24  Mark Lam  <mark.lam@apple.com>
3499
3500         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3501         https://bugs.webkit.org/show_bug.cgi?id=175940
3502         <rdar://problem/29003921>
3503
3504         Reviewed by Saam Barati.
3505
3506         * stress/regress-164081.js: Added.
3507         (shouldEqual):
3508         (testcase):
3509
3510 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3511
3512         Skip flaky JSC test stress/test-finally.js.
3513         https://bugs.webkit.org/show_bug.cgi?id=160283
3514
3515         Unreviewed test gardening.
3516
3517         * stress/test-finally.js:
3518
3519 2017-08-23  Saam Barati  <sbarati@apple.com>
3520
3521         Support compiling catch in the DFG
3522         https://bugs.webkit.org/show_bug.cgi?id=174590
3523
3524         Reviewed by Filip Pizlo.
3525
3526         * microbenchmarks/delta-blue-try-catch.js: Added.
3527         (exception):
3528         (value):
3529         (OrderedCollection):
3530         (OrderedCollection.prototype.add):
3531         (OrderedCollection.prototype.at):
3532         (OrderedCollection.prototype.size):
3533         (OrderedCollection.prototype.removeFirst):
3534         (OrderedCollection.prototype.remove):
3535         (Strength):
3536         (Strength.stronger):
3537         (Strength.weaker):
3538         (Strength.weakestOf):
3539         (Strength.strongest):
3540         (Strength.prototype.nextWeaker):
3541         (Constraint):
3542         (Constraint.prototype.addConstraint):
3543         (Constraint.prototype.satisfy):
3544         (Constraint.prototype.destroyConstraint):
3545         (Constraint.prototype.isInput):
3546         (UnaryConstraint):
3547         (UnaryConstraint.prototype.addToGraph):
3548         (UnaryConstraint.prototype.chooseMethod):
3549         (UnaryConstraint.prototype.isSatisfied):
3550         (UnaryConstraint.prototype.markInputs):
3551         (UnaryConstraint.prototype.output):
3552         (UnaryConstraint.prototype.recalculate):
3553         (UnaryConstraint.prototype.markUnsatisfied):
3554         (UnaryConstraint.prototype.inputsKnown):
3555         (UnaryConstraint.prototype.removeFromGraph):
3556         (StayConstraint):
3557         (StayConstraint.prototype.execute):
3558         (EditConstraint.prototype.isInput):
3559         (EditConstraint.prototype.execute):
3560         (BinaryConstraint):
3561         (BinaryConstraint.prototype.chooseMethod):
3562         (BinaryConstraint.prototype.addToGraph):
3563         (BinaryConstraint.prototype.isSatisfied):
3564         (BinaryConstraint.prototype.markInputs):
3565         (BinaryConstraint.prototype.input):
3566         (BinaryConstraint.prototype.output):
3567         (BinaryConstraint.prototype.recalculate):
3568         (BinaryConstraint.prototype.markUnsatisfied):
3569         (BinaryConstraint.prototype.inputsKnown):
3570         (BinaryConstraint.prototype.removeFromGraph):
3571         (ScaleConstraint):
3572         (ScaleConstraint.prototype.addToGraph):
3573         (ScaleConstraint.prototype.removeFromGraph):
3574         (ScaleConstraint.prototype.markInputs):
3575         (ScaleConstraint.prototype.execute):
3576         (ScaleConstraint.prototype.recalculate):
3577         (EqualityConstraint):
3578         (EqualityConstraint.prototype.execute):
3579         (Variable):
3580         (Variable.prototype.addConstraint):
3581         (Variable.prototype.removeConstraint):
3582         (Planner):
3583         (Planner.prototype.incrementalAdd):
3584         (Planner.prototype.incrementalRemove):
3585         (Planner.prototype.newMark):
3586         (Planner.prototype.makePlan):
3587         (Planner.prototype.extractPlanFromConstraints):
3588         (Planner.prototype.addPropagate):
3589         (Planner.prototype.removePropagateFrom):
3590         (Planner.prototype.addConstraintsConsumingTo):
3591         (Plan):
3592         (Plan.prototype.addConstraint):
3593         (Plan.prototype.size):
3594         (Plan.prototype.constraintAt):
3595         (Plan.prototype.execute):
3596         (chainTest):
3597         (projectionTest):
3598         (change):
3599         (deltaBlue):
3600         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3601         (assert):
3602         (Numbers):
3603         (Numbers.prototype.next):
3604         (return.Transpose):
3605         (return.Transpose.prototype.next):
3606         (transpose):
3607         (verifyEven):
3608         (verifyString):
3609         (foo):
3610         (runIterators):
3611         * microbenchmarks/try-catch-word-count.js: Added.
3612         (let.assert):
3613         (EOF):
3614         (let.texts):
3615         (let.o.apply):
3616         (foo):
3617         (bar):
3618         (f):
3619         (run):
3620         (test1):
3621         (test2):
3622         (test3):
3623         (fn):
3624         (A):
3625         (B):
3626         (A.prototype.getValue):
3627         (B.prototype.getParentValue):
3628         (strlen):
3629         (sum.0):
3630         (test):
3631         (result.test.o):
3632         (set add.set add):
3633         (set forEach):
3634         (stringHash):
3635         (set if):
3636         (testFunction):
3637         (set delete.set has.set add):
3638         * stress/catch-set-argument-speculation-failure.js: Added.
3639         (o):
3640         (e):
3641         (e2):
3642         (escape):
3643         (baz):
3644         (noInline.run):
3645         (noInline):
3646         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3647         (foo):
3648         (e):
3649         (baz):
3650         (bar):
3651
3652 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3653
3654         [JSC] Optimize Map iteration with intrinsic
3655         https://bugs.webkit.org/show_bug.cgi?id=174355
3656
3657         Reviewed by Saam Barati.
3658
3659         * stress/map-iterator-result-should-have-expected-shape.js: Added.
3660         (shouldBe):
3661         (throw.new.Error):
3662         * stress/set-iterator-result-should-have-expected-shape.js: Added.
3663         (shouldBe):
3664         (throw.new.Error.let.iterator.set Symbol):
3665         (throw.new.Error.set add):
3666         (let.iterator.set Symbol):
3667
3668 2017-08-23  Robin Morisset  <rmorisset@apple.com>
3669
3670         Add a micro-benchmark for checking that accessing a variable within a 'with'
3671         block does not automatically prevent type prediction.
3672         https://bugs.webkit.org/show_bug.cgi?id=175738
3673
3674         Reviewed by Saam Barati.
3675
3676         * stress/with_and_arith.js: Added.
3677         (with):
3678
3679 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
3680
3681         [ESNext] Async iteration - Implement Async Generator - runtime
3682         https://bugs.webkit.org/show_bug.cgi?id=175240
3683
3684         Reviewed by Yusuke Suzuki.
3685
3686         * stress/async-iteration-async-from-sync.js: Added.
3687         (assert):
3688         (const.Logger):
3689         (this.fullfilled):
3690         (this.fullfilledDone):
3691         (this.rejected):
3692         (this.catched):
3693         (this.isFinal):
3694         (_assertLogger):
3695         (const.assertLogger):
3696         (const.getPromise.promiseHolder.return.new.Promise):
3697         (foo):
3698         (async.boo):
3699         (bar):
3700         (async.baz):
3701         (async.goo):
3702         * stress/async-iteration-basic.js: Added.
3703         (assert):
3704         (const.Logger):
3705         (this.fullfilled):
3706         (this.fullfilledDone):
3707         (this.rejected):
3708         (this.catched):
3709         (this.isFinal):
3710         (_assertLogger):
3711         (const.assertLogger):
3712         (const.getPromise.promiseHolder.return.new.Promise):
3713         (async.generator):
3714         (iterator.next.then):
3715         (async.baz):
3716         (async.boo):
3717         (async.foo):
3718         (async.goo):
3719         (A.prototype.async.foo):
3720         (A.prototype.async.boo):
3721         (A):
3722         (asyncGenExp.async):
3723         (async.joo):
3724         (j.next.then):
3725         (then):
3726         (async.koo):
3727         (async.loo):