c62fedb398dede31486f78c0f5977af6499376b5
[WebKit-https.git] / JSTests / ChangeLog
1 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2
3         Add Above/Below comparisons for UInt32 patterns
4         https://bugs.webkit.org/show_bug.cgi?id=177281
5
6         Reviewed by Saam Barati.
7
8         * stress/uint32-comparison-jump.js: Added.
9         (shouldBe):
10         (above):
11         (aboveOrEqual):
12         (below):
13         (belowOrEqual):
14         (notAbove):
15         (notAboveOrEqual):
16         (notBelow):
17         (notBelowOrEqual):
18         * stress/uint32-comparison.js: Added.
19         (shouldBe):
20         (above):
21         (aboveOrEqual):
22         (below):
23         (belowOrEqual):
24         (aboveTest):
25         (aboveOrEqualTest):
26         (belowTest):
27         (belowOrEqualTest):
28
29 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
30
31         [DFG] Support ArrayPush with multiple args
32         https://bugs.webkit.org/show_bug.cgi?id=175823
33
34         Reviewed by Saam Barati.
35
36         * microbenchmarks/array-push-0.js: Added.
37         (arrayPush0):
38         * microbenchmarks/array-push-1.js: Added.
39         (arrayPush1):
40         * microbenchmarks/array-push-2.js: Added.
41         (arrayPush2):
42         * microbenchmarks/array-push-3.js: Added.
43         (arrayPush3):
44         * stress/array-push-multiple-contiguous.js: Added.
45         (shouldBe):
46         (test):
47         * stress/array-push-multiple-double-nan.js: Added.
48         (shouldBe):
49         (test):
50         * stress/array-push-multiple-double.js: Added.
51         (shouldBe):
52         (test):
53         * stress/array-push-multiple-int32.js: Added.
54         (shouldBe):
55         (test):
56         * stress/array-push-multiple-many-contiguous.js: Added.
57         (shouldBe):
58         (test):
59         * stress/array-push-multiple-many-double.js: Added.
60         (shouldBe):
61         (test):
62         * stress/array-push-multiple-many-int32.js: Added.
63         (shouldBe):
64         (test):
65         * stress/array-push-multiple-many-storage.js: Added.
66         (shouldBe):
67         (test):
68         * stress/array-push-multiple-storage.js: Added.
69         (shouldBe):
70         (test):
71
72 2017-09-26  Commit Queue  <commit-queue@webkit.org>
73
74         Unreviewed, rolling out r222518.
75         https://bugs.webkit.org/show_bug.cgi?id=177507
76
77         Break the High Sierra build (Requested by yusukesuzuki on
78         #webkit).
79
80         Reverted changeset:
81
82         "Add Above/Below comparisons for UInt32 patterns"
83         https://bugs.webkit.org/show_bug.cgi?id=177281
84         http://trac.webkit.org/changeset/222518
85
86 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
87
88         Add Above/Below comparisons for UInt32 patterns
89         https://bugs.webkit.org/show_bug.cgi?id=177281
90
91         Reviewed by Saam Barati.
92
93         * stress/uint32-comparison-jump.js: Added.
94         (shouldBe):
95         (above):
96         (aboveOrEqual):
97         (below):
98         (belowOrEqual):
99         (notAbove):
100         (notAboveOrEqual):
101         (notBelow):
102         (notBelowOrEqual):
103         * stress/uint32-comparison.js: Added.
104         (shouldBe):
105         (above):
106         (aboveOrEqual):
107         (below):
108         (belowOrEqual):
109         (aboveTest):
110         (aboveOrEqualTest):
111         (belowTest):
112         (belowOrEqualTest):
113
114 2017-09-23  Keith Miller  <keith_miller@apple.com>
115
116         Fix infinite looping test262 test
117         https://bugs.webkit.org/show_bug.cgi?id=177412
118
119         Reviewed by Yusuke Suzuki.
120
121         This test was poorly designed since failing it would cause the vm
122         to inifinite loop. I've fixed it locally and will fix it on github pending
123         the results of next weeks tc39 meeting.
124
125         * test262.yaml:
126         * test262/test/language/statements/for-of/iterator-next-reference.js:
127
128 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
129
130         test262: $.agent became $262.agent in test262 update
131         https://bugs.webkit.org/show_bug.cgi?id=177407
132
133         Reviewed by Yusuke Suzuki.
134
135         * test262.yaml:
136         ~320 tests pass now that we correctly make $262 available.
137
138 2017-09-22  Keith Miller  <keith_miller@apple.com>
139
140         Speculatively change iteration protocall to use the same next function
141         https://bugs.webkit.org/show_bug.cgi?id=175653
142
143         Reviewed by Saam Barati.
144
145         Change test to match the new iteration behavior.
146
147         * stress/spread-optimized-properly.js:
148
149 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
150
151         [DFG][FTL] Profile array vector length for array allocation
152         https://bugs.webkit.org/show_bug.cgi?id=177051
153
154         Reviewed by Saam Barati.
155
156         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
157         (target):
158
159 2017-09-22  Commit Queue  <commit-queue@webkit.org>
160
161         Unreviewed, rolling out r222380.
162         https://bugs.webkit.org/show_bug.cgi?id=177352
163
164         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
165         #webkit).
166
167         Reverted changeset:
168
169         "[DFG][FTL] Profile array vector length for array allocation"
170         https://bugs.webkit.org/show_bug.cgi?id=177051
171         http://trac.webkit.org/changeset/222380
172
173 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
174
175         [DFG][FTL] Profile array vector length for array allocation
176         https://bugs.webkit.org/show_bug.cgi?id=177051
177
178         Reviewed by Saam Barati.
179
180         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
181         (target):
182
183 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
184
185         Skip new hanging test262 tests.
186         https://bugs.webkit.org/show_bug.cgi?id=177326
187
188         Unreviewed test gardening.
189
190         * test262.yaml:
191
192 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
193
194         Mark 6 test262 tests as passing.
195         https://bugs.webkit.org/show_bug.cgi?id=177307
196
197         Unreviewed test gardening.
198
199         * test262.yaml:
200
201 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
202
203         Unreviewed follow-up to r222311.
204
205         * test262/harness/sta.js:
206         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
207         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
208         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
209         * test262/test/built-ins/Array/from/elements-added-after.js:
210         * test262/test/built-ins/Array/from/elements-deleted-after.js:
211         * test262/test/built-ins/Array/from/elements-updated-after.js:
212         * test262/test/built-ins/Array/from/from-array.js:
213         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
214         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
215         * test262/test/built-ins/Array/from/source-array-boundary.js:
216         * test262/test/built-ins/Array/from/source-object-constructor.js:
217         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
218         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
219         * test262/test/built-ins/Array/from/source-object-length.js:
220         * test262/test/built-ins/Array/from/source-object-missing.js:
221         * test262/test/built-ins/Array/from/source-object-without.js:
222         * test262/test/built-ins/Array/from/this-null.js:
223         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
224         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
225         * test262/test/language/literals/numeric/7.8.3-1gs.js:
226         * test262/test/language/literals/numeric/7.8.3-2gs.js:
227         * test262/test/language/literals/numeric/7.8.3-3gs.js:
228         * test262/test/language/literals/regexp/7.8.5-1gs.js:
229         * test262/test/language/literals/string/7.8.4-1gs.js:
230         Fix some files that I failed to update when I applied my patch.
231
232 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
233
234         Update test262 tests
235         https://bugs.webkit.org/show_bug.cgi?id=177220
236
237         Reviewed by Saam Barati and Yusuke Suzuki.
238
239         * test262.yaml:
240         * test262/test262-Revision.txt:
241         New rebaselined expectations for all tests.
242
243         * test262/*:
244         Updated.
245
246 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
247
248         [DFG] Remove ToThis more aggressively
249         https://bugs.webkit.org/show_bug.cgi?id=177056
250
251         Reviewed by Saam Barati.
252
253         * stress/generator-with-this-strict.js: Added.
254         (shouldBe):
255         (generator):
256         (target):
257         * stress/generator-with-this.js: Added.
258         (shouldBe):
259         (generator):
260         (target):
261
262 2017-09-17  Michael Saboff  <msaboff@apple.com>
263
264         https://bugs.webkit.org/show_bug.cgi?id=177038
265         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
266
267         Reviewed by JF Bastien.
268
269         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
270         as it dies using too much memory.
271
272 2017-09-15  Saam Barati  <sbarati@apple.com>
273
274         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
275         https://bugs.webkit.org/show_bug.cgi?id=176981
276
277         Reviewed by Yusuke Suzuki.
278
279         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
280         (assert):
281         (verify):
282         (func):
283         (const.bar.createBuiltin):
284
285 2017-09-14  Saam Barati  <sbarati@apple.com>
286
287         It should be valid to exit before each set when doing arity fixup when inlining
288         https://bugs.webkit.org/show_bug.cgi?id=176948
289
290         Reviewed by Keith Miller.
291
292         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
293         (baz):
294         (bar):
295         (foo):
296
297 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
298
299         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
300         https://bugs.webkit.org/show_bug.cgi?id=176867
301
302         Reviewed by Sam Weinig.
303
304         * microbenchmarks/object-get-own-property-symbols.js: Added.
305         (test):
306
307 2017-09-13  Mark Lam  <mark.lam@apple.com>
308
309         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
310         https://bugs.webkit.org/show_bug.cgi?id=176888
311         <rdar://problem/34381832>
312
313         Not reviewed.
314
315         * stress/op_mod-ConstVar.js:
316         * stress/op_mod-VarConst.js:
317         * stress/op_mod-VarVar.js:
318
319 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
320
321         Skip 3 op_mod tests on Debug JSC bots.
322         https://bugs.webkit.org/show_bug.cgi?id=176630
323
324         Unreviewed test gardening.
325
326         * stress/op_mod-ConstVar.js:
327         * stress/op_mod-VarConst.js:
328         * stress/op_mod-VarVar.js:
329
330 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
331
332         [JSC] Fix Array allocation in Object.keys
333         https://bugs.webkit.org/show_bug.cgi?id=176826
334
335         Reviewed by Saam Barati.
336
337         * stress/object-own-property-keys.js: Added.
338         (shouldBe):
339
340 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
341
342         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
343         https://bugs.webkit.org/show_bug.cgi?id=176010
344
345         Reviewed by Filip Pizlo.
346
347         * microbenchmarks/weak-map-key.js: Added.
348         (assert):
349         (objectKey):
350         (let.start.Date.now):
351
352 2017-09-12  Mark Lam  <mark.lam@apple.com>
353
354         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
355         https://bugs.webkit.org/show_bug.cgi?id=176630
356
357         Reviewed by JF Bastien.
358
359         Debug builds are just slow, and these tests do a lot.  They pass when I run them
360         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
361         a speculative fix for the bots that are seeing these fail.
362
363         I also undid the skipping of the op_mod tests for debug builds.
364
365         * stress/op_div-ConstVar.js:
366         * stress/op_div-VarConst.js:
367         * stress/op_div-VarVar.js:
368         * stress/op_mod-ConstVar.js:
369         * stress/op_mod-VarConst.js:
370         * stress/op_mod-VarVar.js:
371
372 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
373
374         Skip stress/value-to-boolean.js on Debug bots.
375         https://bugs.webkit.org/show_bug.cgi?id=176787
376
377         Unreviewed test gardening.
378
379         * stress/value-to-boolean.js:
380
381 2017-09-11  Mark Lam  <mark.lam@apple.com>
382
383         Change test expectation for test262/test/language/statements/try/tco-catch.js
384         https://bugs.webkit.org/show_bug.cgi?id=176749
385
386         Rubber stamped by Keith Miller.
387
388         It's been failing since at least r221821.  I'm changing the test expectation to
389         fail to green the bots while I investigate some more.
390
391         * test262.yaml:
392
393 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
394
395         Unreviewed, rolling out r221854.
396
397         The test added with this change fails on 32-bit JSC bots.
398
399         Reverted changeset:
400
401         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
402         https://bugs.webkit.org/show_bug.cgi?id=176010
403         http://trac.webkit.org/changeset/221854
404
405 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
406
407         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
408         https://bugs.webkit.org/show_bug.cgi?id=176010
409
410         Reviewed by Filip Pizlo.
411
412         * microbenchmarks/weak-map-key.js: Added.
413         (assert):
414         (objectKey):
415         (let.start.Date.now):
416
417 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
418
419         [JSC] Optimize Object.keys by using careful array allocation
420         https://bugs.webkit.org/show_bug.cgi?id=176654
421
422         Reviewed by Darin Adler.
423
424         * microbenchmarks/object-keys.js: Added.
425         (test):
426
427 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
428
429         Error should compute .stack and friends lazily
430         https://bugs.webkit.org/show_bug.cgi?id=176645
431
432         Reviewed by Saam Barati.
433
434         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
435         * microbenchmarks/new-error.js: Added.
436         * microbenchmarks/throw.js: Added.
437
438 2017-09-09  Mark Lam  <mark.lam@apple.com>
439
440         [Re-landing] Use JIT probes for DFG OSR exit.
441         https://bugs.webkit.org/show_bug.cgi?id=175144
442         <rdar://problem/33437050>
443
444         Not reviewed.  Original patch reviewed by Saam Barati.
445
446         Disable these tests for debug builds because they run too slow with the new OSR exit.
447
448         * stress/op_mod-ConstVar.js:
449         * stress/op_mod-VarConst.js:
450         * stress/op_mod-VarVar.js:
451
452 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
453
454         [DFG] NewArrayWithSize(size)'s size does not care negative zero
455         https://bugs.webkit.org/show_bug.cgi?id=176300
456
457         Reviewed by Saam Barati.
458
459         * stress/new-array-with-size-div.js: Added.
460         (shouldBe):
461         (test):
462         (i.i):
463
464 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
465
466         [DFG] PutByVal with Array::Generic is too generic
467         https://bugs.webkit.org/show_bug.cgi?id=176345
468
469         Reviewed by Filip Pizlo.
470
471         * stress/object-assign-symbols.js: Added.
472         (shouldBe):
473         (test):
474         * stress/object-assign.js: Added.
475         (shouldBe):
476         (test):
477         (i.shouldBe.JSON.stringify.test):
478
479 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
480
481         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
482         https://bugs.webkit.org/show_bug.cgi?id=176590
483
484         Reviewed by Saam Barati.
485
486         * microbenchmarks/object-iterate-symbols.js: Added.
487         (test):
488         * microbenchmarks/object-iterate.js: Added.
489         (test):
490         * stress/object-iterate-symbols.js: Added.
491         (shouldBe):
492         (test):
493         * stress/object-iterate.js: Added.
494         (shouldBe):
495         (test):
496
497 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
498
499         [Win32] 10 JSC stress tests are failing.
500         https://bugs.webkit.org/show_bug.cgi?id=176538
501
502         Reviewed by Mark Lam.
503
504         Skip tests on Windows to make the bots green.
505
506         * ChakraCore.yaml:
507         * stress/date-relaxed.js:
508
509 2017-09-06  Mark Lam  <mark.lam@apple.com>
510
511         constructGenericTypedArrayViewWithArguments() is missing an exception check.
512         https://bugs.webkit.org/show_bug.cgi?id=176485
513         <rdar://problem/33898874>
514
515         Reviewed by Keith Miller.
516
517         * stress/regress-176485.js: Added.
518
519 2017-09-05  Saam Barati  <sbarati@apple.com>
520
521         isNotCellSpeculation is wrong with respect to SpecEmpty
522         https://bugs.webkit.org/show_bug.cgi?id=176429
523
524         Reviewed by Michael Saboff.
525
526         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
527         (Foo):
528
529 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
530
531         test262: Completion values for control flow do not match the spec
532         https://bugs.webkit.org/show_bug.cgi?id=171265
533
534         Reviewed by Saam Barati.
535
536         * stress/completion-value.js:
537         Condensed test for completion values in top level statements.
538
539         * stress/super-get-by-id.js:
540         ClassDeclaration when evaled no longer produce values. Convert
541         these to ClassExpressions so they produce the class value.
542         
543         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
544         This is a progression for currect spec behavior.
545
546         * mozilla/mozilla-tests.yaml:
547         This test is now outdated, so mark it as failing for that reason.
548
549         * test262.yaml:
550         Passing all "cptn" completion value tests.
551
552 2017-09-04  Saam Barati  <sbarati@apple.com>
553
554         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
555         https://bugs.webkit.org/show_bug.cgi?id=176317
556
557         Reviewed by Keith Miller.
558
559         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
560         (Foo):
561
562 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
563
564         [DFG][FTL] Efficiently execute number#toString()
565         https://bugs.webkit.org/show_bug.cgi?id=170007
566
567         Reviewed by Keith Miller.
568
569         * microbenchmarks/number-to-string-strength-reduction.js: Added.
570         (test):
571         * microbenchmarks/number-to-string-with-radix-10.js: Added.
572         (test):
573         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
574         (test):
575         * microbenchmarks/number-to-string-with-radix.js: Added.
576         (test):
577         * stress/number-to-string-strength-reduction.js: Added.
578         (shouldBe):
579         (test):
580         * stress/number-to-string-with-radix-10.js: Added.
581         (shouldBe):
582         (test):
583         * stress/number-to-string-with-radix-cse.js: Added.
584         (shouldBe):
585         (test):
586         * stress/number-to-string-with-radix-invalid.js: Added.
587         (shouldThrow):
588         * stress/number-to-string-with-radix-watchpoint.js: Added.
589         (shouldBe):
590         (test):
591         (i.i.1e3.Number.prototype.toString):
592         * stress/number-to-string-with-radix.js: Added.
593         (shouldBe):
594         (test):
595
596 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
597
598         [DFG] Relax arity requirement
599         https://bugs.webkit.org/show_bug.cgi?id=175523
600
601         Reviewed by Saam Barati.
602
603         * stress/arity-mismatch-arguments-length.js: Added.
604         (shouldBe):
605         (test1):
606         (test):
607         * stress/arity-mismatch-get-argument.js: Added.
608         (shouldBe):
609         (builtin.createBuiltin):
610         (test):
611         * stress/arity-mismatch-inlining-extra-slots.js: Added.
612         (shouldBe):
613         (inlineTarget):
614         (test):
615         * stress/arity-mismatch-inlining.js: Added.
616         (shouldBe):
617         (inlineTarget):
618         (test):
619         * stress/arity-mismatch-rest.js: Added.
620         (shouldBe):
621         (test2):
622         (test1):
623         (test):
624
625 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
626
627         [JSC] Fix "name" and "length" of Proxy revoke function
628         https://bugs.webkit.org/show_bug.cgi?id=176155
629
630         Reviewed by Mark Lam.
631
632         * test262.yaml:
633
634 2017-08-31  Saam Barati  <sbarati@apple.com>
635
636         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
637         https://bugs.webkit.org/show_bug.cgi?id=176206
638
639         Reviewed by Keith Miller.
640
641         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
642         (a):
643         (b):
644         (foo):
645
646 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
647
648         Skip two slow JSC tests after r221422.
649
650         Unreviewed test gardening.
651
652         * stress/regexp-prototype-match-on-too-long-rope.js:
653         * stress/regexp-prototype-test-on-too-long-rope.js:
654
655 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
656
657         Unreviewed, skipping slow tests.
658         
659         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
660         work differently now.
661
662         * stress/regexp-prototype-exec-on-too-long-rope.js:
663         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
664
665 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
666
667         [JSC] Use reifying system for "name" property of builtin JSFunction
668         https://bugs.webkit.org/show_bug.cgi?id=175260
669
670         Reviewed by Saam Barati.
671
672         * stress/accessors-get-set-prefix.js:
673         * stress/builtin-function-name.js: Added.
674         (shouldBe):
675         (shouldThrow):
676         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
677         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
678         * stress/private-name-as-anonymous-builtin.js: Added.
679         (shouldBe):
680         (NotPromise):
681
682 2017-08-30  Saam Barati  <sbarati@apple.com>
683
684         Unreviewed. Make test stop printing.
685
686         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
687
688 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
689
690         Unreviewed, rolling out r221327.
691
692         This change caused test262 failures.
693
694         Reverted changeset:
695
696         "[JSC] Use reifying system for "name" property of builtin
697         JSFunction"
698         https://bugs.webkit.org/show_bug.cgi?id=175260
699         http://trac.webkit.org/changeset/221327
700
701 2017-08-30  Saam Barati  <sbarati@apple.com>
702
703         semicolon is being interpreted as an = in the LiteralParser
704         https://bugs.webkit.org/show_bug.cgi?id=176114
705
706         Reviewed by Oliver Hunt.
707
708         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
709         * stress/resources/literal-parser-test-case.js: Added.
710
711 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
712
713         [ESNext] Async iteration - Implement async iteration statement: for-await-of
714         https://bugs.webkit.org/show_bug.cgi?id=166698
715
716         Reviewed by Yusuke Suzuki.
717
718         * stress/async-iteration-for-await-of-syntax.js: Added.
719         (assert):
720         (checkSyntax):
721         (checkSyntaxError):
722         (checkSimpleAsyncGeneratorSloppyMode):
723         (checkSimpleAsyncGeneratorStrictMode):
724         (checkNestedAsyncGenerators):
725         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
726         * stress/async-iteration-for-await-of.js: Added.
727         (assert):
728         (async.foo):
729         (async.boo):
730         (const.boo.async):
731
732 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
733
734         [JSC] Use reifying system for "name" property of builtin JSFunction
735         https://bugs.webkit.org/show_bug.cgi?id=175260
736
737         Reviewed by Saam Barati.
738
739         * stress/accessors-get-set-prefix.js:
740         * stress/builtin-function-name.js: Added.
741         (shouldBe):
742         (shouldThrow):
743         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
744         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
745
746 2017-08-25  Saam Barati  <sbarati@apple.com>
747
748         Support compiling catch in the DFG
749         https://bugs.webkit.org/show_bug.cgi?id=174590
750         <rdar://problem/34047845>
751
752         Reviewed by Filip Pizlo.
753
754         * microbenchmarks/delta-blue-try-catch.js: Added.
755         (exception):
756         (value):
757         (OrderedCollection):
758         (OrderedCollection.prototype.add):
759         (OrderedCollection.prototype.at):
760         (OrderedCollection.prototype.size):
761         (OrderedCollection.prototype.removeFirst):
762         (OrderedCollection.prototype.remove):
763         (Strength):
764         (Strength.stronger):
765         (Strength.weaker):
766         (Strength.weakestOf):
767         (Strength.strongest):
768         (Strength.prototype.nextWeaker):
769         (Constraint):
770         (Constraint.prototype.addConstraint):
771         (Constraint.prototype.satisfy):
772         (Constraint.prototype.destroyConstraint):
773         (Constraint.prototype.isInput):
774         (UnaryConstraint):
775         (UnaryConstraint.prototype.addToGraph):
776         (UnaryConstraint.prototype.chooseMethod):
777         (UnaryConstraint.prototype.isSatisfied):
778         (UnaryConstraint.prototype.markInputs):
779         (UnaryConstraint.prototype.output):
780         (UnaryConstraint.prototype.recalculate):
781         (UnaryConstraint.prototype.markUnsatisfied):
782         (UnaryConstraint.prototype.inputsKnown):
783         (UnaryConstraint.prototype.removeFromGraph):
784         (StayConstraint):
785         (StayConstraint.prototype.execute):
786         (EditConstraint.prototype.isInput):
787         (EditConstraint.prototype.execute):
788         (BinaryConstraint):
789         (BinaryConstraint.prototype.chooseMethod):
790         (BinaryConstraint.prototype.addToGraph):
791         (BinaryConstraint.prototype.isSatisfied):
792         (BinaryConstraint.prototype.markInputs):
793         (BinaryConstraint.prototype.input):
794         (BinaryConstraint.prototype.output):
795         (BinaryConstraint.prototype.recalculate):
796         (BinaryConstraint.prototype.markUnsatisfied):
797         (BinaryConstraint.prototype.inputsKnown):
798         (BinaryConstraint.prototype.removeFromGraph):
799         (ScaleConstraint):
800         (ScaleConstraint.prototype.addToGraph):
801         (ScaleConstraint.prototype.removeFromGraph):
802         (ScaleConstraint.prototype.markInputs):
803         (ScaleConstraint.prototype.execute):
804         (ScaleConstraint.prototype.recalculate):
805         (EqualityConstraint):
806         (EqualityConstraint.prototype.execute):
807         (Variable):
808         (Variable.prototype.addConstraint):
809         (Variable.prototype.removeConstraint):
810         (Planner):
811         (Planner.prototype.incrementalAdd):
812         (Planner.prototype.incrementalRemove):
813         (Planner.prototype.newMark):
814         (Planner.prototype.makePlan):
815         (Planner.prototype.extractPlanFromConstraints):
816         (Planner.prototype.addPropagate):
817         (Planner.prototype.removePropagateFrom):
818         (Planner.prototype.addConstraintsConsumingTo):
819         (Plan):
820         (Plan.prototype.addConstraint):
821         (Plan.prototype.size):
822         (Plan.prototype.constraintAt):
823         (Plan.prototype.execute):
824         (chainTest):
825         (projectionTest):
826         (change):
827         (deltaBlue):
828         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
829         (assert):
830         (Numbers):
831         (Numbers.prototype.next):
832         (return.Transpose):
833         (return.Transpose.prototype.next):
834         (transpose):
835         (verifyEven):
836         (verifyString):
837         (foo):
838         (runIterators):
839         * microbenchmarks/try-catch-word-count.js: Added.
840         (let.assert):
841         (EOF):
842         (let.texts):
843         (let.o.apply):
844         (foo):
845         (bar):
846         (f):
847         (run):
848         (test1):
849         (test2):
850         (test3):
851         (fn):
852         (A):
853         (B):
854         (A.prototype.getValue):
855         (B.prototype.getParentValue):
856         (strlen):
857         (sum.0):
858         (test):
859         (result.test.o):
860         (set add.set add):
861         (set forEach):
862         (stringHash):
863         (set if):
864         (testFunction):
865         (set delete.set has.set add):
866         * stress/catch-set-argument-speculation-failure.js: Added.
867         (o):
868         (e):
869         (e2):
870         (escape):
871         (baz):
872         (noInline.run):
873         (noInline):
874         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
875         (foo):
876         (e):
877         (baz):
878         (bar):
879
880 2017-08-24  Commit Queue  <commit-queue@webkit.org>
881
882         Unreviewed, rolling out r221119, r221124, and r221143.
883         https://bugs.webkit.org/show_bug.cgi?id=175973
884
885         "I think it regressed JSBench by 20%" (Requested by saamyjoon
886         on #webkit).
887
888         Reverted changesets:
889
890         "Support compiling catch in the DFG"
891         https://bugs.webkit.org/show_bug.cgi?id=174590
892         http://trac.webkit.org/changeset/221119
893
894         "Unreviewed, build fix in GTK port"
895         https://bugs.webkit.org/show_bug.cgi?id=174590
896         http://trac.webkit.org/changeset/221124
897
898         "DFG::JITCode::osrEntry should get sorted since we perform a
899         binary search on it"
900         https://bugs.webkit.org/show_bug.cgi?id=175893
901         http://trac.webkit.org/changeset/221143
902
903 2017-08-24  Michael Saboff  <msaboff@apple.com>
904
905         Add support for RegExp "dotAll" flag
906         https://bugs.webkit.org/show_bug.cgi?id=175924
907
908         Reviewed by Keith Miller.
909
910         Updated tests for new dotAll ('s' flag) changes.
911
912         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
913         * stress/static-getter-in-names.js:
914
915 2017-08-24  Mark Lam  <mark.lam@apple.com>
916
917         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
918         https://bugs.webkit.org/show_bug.cgi?id=175940
919         <rdar://problem/29003921>
920
921         Reviewed by Saam Barati.
922
923         * stress/regress-164081.js: Added.
924         (shouldEqual):
925         (testcase):
926
927 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
928
929         Skip flaky JSC test stress/test-finally.js.
930         https://bugs.webkit.org/show_bug.cgi?id=160283
931
932         Unreviewed test gardening.
933
934         * stress/test-finally.js:
935
936 2017-08-23  Saam Barati  <sbarati@apple.com>
937
938         Support compiling catch in the DFG
939         https://bugs.webkit.org/show_bug.cgi?id=174590
940
941         Reviewed by Filip Pizlo.
942
943         * microbenchmarks/delta-blue-try-catch.js: Added.
944         (exception):
945         (value):
946         (OrderedCollection):
947         (OrderedCollection.prototype.add):
948         (OrderedCollection.prototype.at):
949         (OrderedCollection.prototype.size):
950         (OrderedCollection.prototype.removeFirst):
951         (OrderedCollection.prototype.remove):
952         (Strength):
953         (Strength.stronger):
954         (Strength.weaker):
955         (Strength.weakestOf):
956         (Strength.strongest):
957         (Strength.prototype.nextWeaker):
958         (Constraint):
959         (Constraint.prototype.addConstraint):
960         (Constraint.prototype.satisfy):
961         (Constraint.prototype.destroyConstraint):
962         (Constraint.prototype.isInput):
963         (UnaryConstraint):
964         (UnaryConstraint.prototype.addToGraph):
965         (UnaryConstraint.prototype.chooseMethod):
966         (UnaryConstraint.prototype.isSatisfied):
967         (UnaryConstraint.prototype.markInputs):
968         (UnaryConstraint.prototype.output):
969         (UnaryConstraint.prototype.recalculate):
970         (UnaryConstraint.prototype.markUnsatisfied):
971         (UnaryConstraint.prototype.inputsKnown):
972         (UnaryConstraint.prototype.removeFromGraph):
973         (StayConstraint):
974         (StayConstraint.prototype.execute):
975         (EditConstraint.prototype.isInput):
976         (EditConstraint.prototype.execute):
977         (BinaryConstraint):
978         (BinaryConstraint.prototype.chooseMethod):
979         (BinaryConstraint.prototype.addToGraph):
980         (BinaryConstraint.prototype.isSatisfied):
981         (BinaryConstraint.prototype.markInputs):
982         (BinaryConstraint.prototype.input):
983         (BinaryConstraint.prototype.output):
984         (BinaryConstraint.prototype.recalculate):
985         (BinaryConstraint.prototype.markUnsatisfied):
986         (BinaryConstraint.prototype.inputsKnown):
987         (BinaryConstraint.prototype.removeFromGraph):
988         (ScaleConstraint):
989         (ScaleConstraint.prototype.addToGraph):
990         (ScaleConstraint.prototype.removeFromGraph):
991         (ScaleConstraint.prototype.markInputs):
992         (ScaleConstraint.prototype.execute):
993         (ScaleConstraint.prototype.recalculate):
994         (EqualityConstraint):
995         (EqualityConstraint.prototype.execute):
996         (Variable):
997         (Variable.prototype.addConstraint):
998         (Variable.prototype.removeConstraint):
999         (Planner):
1000         (Planner.prototype.incrementalAdd):
1001         (Planner.prototype.incrementalRemove):
1002         (Planner.prototype.newMark):
1003         (Planner.prototype.makePlan):
1004         (Planner.prototype.extractPlanFromConstraints):
1005         (Planner.prototype.addPropagate):
1006         (Planner.prototype.removePropagateFrom):
1007         (Planner.prototype.addConstraintsConsumingTo):
1008         (Plan):
1009         (Plan.prototype.addConstraint):
1010         (Plan.prototype.size):
1011         (Plan.prototype.constraintAt):
1012         (Plan.prototype.execute):
1013         (chainTest):
1014         (projectionTest):
1015         (change):
1016         (deltaBlue):
1017         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
1018         (assert):
1019         (Numbers):
1020         (Numbers.prototype.next):
1021         (return.Transpose):
1022         (return.Transpose.prototype.next):
1023         (transpose):
1024         (verifyEven):
1025         (verifyString):
1026         (foo):
1027         (runIterators):
1028         * microbenchmarks/try-catch-word-count.js: Added.
1029         (let.assert):
1030         (EOF):
1031         (let.texts):
1032         (let.o.apply):
1033         (foo):
1034         (bar):
1035         (f):
1036         (run):
1037         (test1):
1038         (test2):
1039         (test3):
1040         (fn):
1041         (A):
1042         (B):
1043         (A.prototype.getValue):
1044         (B.prototype.getParentValue):
1045         (strlen):
1046         (sum.0):
1047         (test):
1048         (result.test.o):
1049         (set add.set add):
1050         (set forEach):
1051         (stringHash):
1052         (set if):
1053         (testFunction):
1054         (set delete.set has.set add):
1055         * stress/catch-set-argument-speculation-failure.js: Added.
1056         (o):
1057         (e):
1058         (e2):
1059         (escape):
1060         (baz):
1061         (noInline.run):
1062         (noInline):
1063         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
1064         (foo):
1065         (e):
1066         (baz):
1067         (bar):
1068
1069 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1070
1071         [JSC] Optimize Map iteration with intrinsic
1072         https://bugs.webkit.org/show_bug.cgi?id=174355
1073
1074         Reviewed by Saam Barati.
1075
1076         * stress/map-iterator-result-should-have-expected-shape.js: Added.
1077         (shouldBe):
1078         (throw.new.Error):
1079         * stress/set-iterator-result-should-have-expected-shape.js: Added.
1080         (shouldBe):
1081         (throw.new.Error.let.iterator.set Symbol):
1082         (throw.new.Error.set add):
1083         (let.iterator.set Symbol):
1084
1085 2017-08-23  Robin Morisset  <rmorisset@apple.com>
1086
1087         Add a micro-benchmark for checking that accessing a variable within a 'with'
1088         block does not automatically prevent type prediction.
1089         https://bugs.webkit.org/show_bug.cgi?id=175738
1090
1091         Reviewed by Saam Barati.
1092
1093         * stress/with_and_arith.js: Added.
1094         (with):
1095
1096 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
1097
1098         [ESNext] Async iteration - Implement Async Generator - runtime
1099         https://bugs.webkit.org/show_bug.cgi?id=175240
1100
1101         Reviewed by Yusuke Suzuki.
1102
1103         * stress/async-iteration-async-from-sync.js: Added.
1104         (assert):
1105         (const.Logger):
1106         (this.fullfilled):
1107         (this.fullfilledDone):
1108         (this.rejected):
1109         (this.catched):
1110         (this.isFinal):
1111         (_assertLogger):
1112         (const.assertLogger):
1113         (const.getPromise.promiseHolder.return.new.Promise):
1114         (foo):
1115         (async.boo):
1116         (bar):
1117         (async.baz):
1118         (async.goo):
1119         * stress/async-iteration-basic.js: Added.
1120         (assert):
1121         (const.Logger):
1122         (this.fullfilled):
1123         (this.fullfilledDone):
1124         (this.rejected):
1125         (this.catched):
1126         (this.isFinal):
1127         (_assertLogger):
1128         (const.assertLogger):
1129         (const.getPromise.promiseHolder.return.new.Promise):
1130         (async.generator):
1131         (iterator.next.then):
1132         (async.baz):
1133         (async.boo):
1134         (async.foo):
1135         (async.goo):
1136         (A.prototype.async.foo):
1137         (A.prototype.async.boo):
1138         (A):
1139         (asyncGenExp.async):
1140         (async.joo):
1141         (j.next.then):
1142         (then):
1143         (async.koo):
1144         (async.loo):
1145         (async.moo):
1146         (async.noo):
1147         (async.ooo):
1148         (async.roo):
1149         (async.poo):
1150         (async.soo):
1151         (async.too):
1152         * stress/async-iteration-evaluation.js: Added.
1153         (assert):
1154         (async.foo):
1155         (catch):
1156         * stress/async-iteration-syntax.js:
1157         * stress/async-iteration-yield-promise.js: Added.
1158         (assert):
1159         (const.Logger):
1160         (this.fullfilled):
1161         (this.fullfilledDone):
1162         (this.rejected):
1163         (this.catched):
1164         (this.isFinal):
1165         (_assertLogger):
1166         (const.assertLogger):
1167         (const.getPromise.promiseHolder.return.new.Promise):
1168         (async.foo):
1169         (async.boo):
1170         (async.bar):
1171         * stress/async-iteration-yield-star-interface.js: Added.
1172         (assert):
1173         (const.getPromise.promiseHolder.return.new.Promise):
1174         (const.Logger):
1175         (this.fullfilled):
1176         (this.fullfilledDone):
1177         (this.rejected):
1178         (this.catched):
1179         (this.custom):
1180         (this.isFinal):
1181         (_assertLogger):
1182         (const.assertLogger):
1183         (let.asyncIter.Symbol.asyncIterator):
1184         (let.asyncIter.next):
1185         (let.asyncIter.throw):
1186         (let.asyncIter.return):
1187         (async.foo):
1188         (asyncIter.Symbol.asyncIterator):
1189         (asyncIter.next):
1190         (async.boo):
1191         (asyncIter.return):
1192         (async.bar):
1193         (async.baz):
1194         (async.foobar):
1195         * stress/async-iteration-yield-star.js: Added.
1196         (assert):
1197         (const.Logger):
1198         (this.fullfilled):
1199         (this.fullfilledDone):
1200         (this.rejected):
1201         (this.catched):
1202         (this.custom):
1203         (this.isFinal):
1204         (_assertLogger):
1205         (const.assertLogger):
1206         (const.getPromise.promiseHolder.return.new.Promise):
1207         (async.foo):
1208         (async.boo):
1209         (async.bar):
1210         (async.baz):
1211         (async.joo):
1212         (async.goo):
1213         (async.koo):
1214         (async.loo):
1215         (let.asyncIter.Symbol.asyncIterator):
1216         (let.asyncIter.next):
1217         (let.asyncIter.throw):
1218         (let.asyncIter.return):
1219         (async.moo):
1220         (async.noo):
1221         * test262.yaml:
1222
1223 2017-08-23  JF Bastien  <jfbastien@apple.com>
1224
1225         Fix printing in test
1226
1227         Unreviewed: fixing verbosity, shouldn't have been there.
1228
1229         * wasm/regress/175693.js:
1230         (else.else):
1231         (catch):
1232
1233 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
1234
1235         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
1236         https://bugs.webkit.org/show_bug.cgi?id=172543
1237
1238         Unreviewed test gardening.
1239
1240         * microbenchmarks/generator-with-several-types.js:
1241
1242 2017-08-17  JF Bastien  <jfbastien@apple.com>
1243
1244         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
1245         https://bugs.webkit.org/show_bug.cgi?id=175693
1246         <rdar://problem/33952443>
1247
1248         Reviewed by Saam Barati.
1249
1250         Add a regression directory for WebAssembly tests.
1251
1252         * wasm.yaml:
1253         * wasm/regress/175693.js: Added.
1254         (else.else):
1255         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
1256         (catch):
1257         * wasm/regress/175693.wasm: Added.
1258
1259 2017-08-15  Robin Morisset  <rmorisset@apple.com>
1260
1261         Support the 'with' keyword in FTL.
1262         https://bugs.webkit.org/show_bug.cgi?id=175585
1263
1264         Reviewed by Saam Barati.
1265
1266         Also improve the JSTest/stress/with.js file to test
1267         what happens when non-objects are passed to with.
1268
1269         * stress/with.js:
1270         (foo):
1271         (i.catch):
1272         (i.with): Deleted.
1273
1274 2017-08-14  Keith Miller  <keith_miller@apple.com>
1275
1276         Add testing tool to lie to the DFG about profiles
1277         https://bugs.webkit.org/show_bug.cgi?id=175487
1278
1279         Reviewed by Saam Barati.
1280
1281         * stress/compare-eq-incomplete-profile.js: Added.
1282         (const.test.createBuiltin):
1283
1284 2017-08-14  Robin Morisset  <rmorisset@apple.com>
1285
1286         Support the with keyword in DFG
1287         https://bugs.webkit.org/show_bug.cgi?id=175470
1288
1289         Reviewed by Saam Barati.
1290
1291         Added a new stress-test for the 'with' keyword, that caught a bug in a
1292         previous version of this code.
1293
1294         * stress/with.js: Added.
1295         (i.with):
1296
1297 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
1298
1299         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
1300         https://bugs.webkit.org/show_bug.cgi?id=175544
1301
1302         Unreviewed test gardening.
1303
1304         * ChakraCore.yaml:
1305
1306 2017-08-09  Caitlin Potter  <caitp@igalia.com>
1307
1308         Early error on ANY operator before new.target
1309         https://bugs.webkit.org/show_bug.cgi?id=157970
1310
1311         Reviewed by Saam Barati.
1312
1313         Instead of throwing if any unary operator precedes new.target, only
1314         throw if the unary operator updates the reference.
1315
1316         The following become legal in JSC:
1317
1318         ```
1319         !new.target
1320         ~new.target
1321         typeof new.target
1322         delete new.target
1323         void new.target
1324         ```
1325
1326         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
1327
1328         * stress/new-target-syntax-errors.js:
1329         * stress/new-target.js:
1330
1331 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
1332
1333         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
1334         https://bugs.webkit.org/show_bug.cgi?id=175255
1335
1336         Unreviewed test gardening.
1337
1338         * stress/regress-169783.js:
1339         * wasm/stress/oom.js:
1340
1341 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1342
1343         REGRESSION: 2 test262/test/language/statements/async-function failures
1344         https://bugs.webkit.org/show_bug.cgi?id=175334
1345
1346         Reviewed by Yusuke Suzuki.
1347
1348         Add @skip parameters to tests, and remove test for async iterator from 
1349         async await syntax test because it is already covered by async-iterator-syntax.js
1350
1351         * stress/async-await-syntax.js:
1352         * stress/async-iteration-syntax.js:
1353
1354 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1355
1356         Unreviewed, gardening test262 for Promise resolve / reject function length
1357         https://bugs.webkit.org/show_bug.cgi?id=175333
1358
1359         * test262.yaml:
1360
1361 2017-08-07  Robin Morisset  <rmorisset@apple.com>
1362
1363         GetOwnProperty of TypedArray indexed fields is wrongly configurable
1364         https://bugs.webkit.org/show_bug.cgi?id=175307
1365
1366         Reviewed by Saam Barati.
1367
1368         * stress/typedarray-getownproperty-not-configurable.js: Added.
1369         (assert):
1370         (foo):
1371
1372 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
1373
1374         Promise resolve and reject function should have length = 1
1375         https://bugs.webkit.org/show_bug.cgi?id=175242
1376
1377         Reviewed by Saam Barati.
1378
1379         * stress/builtin-function-length.js: Added.
1380         (shouldBe):
1381         (shouldThrow):
1382         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
1383         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
1384
1385 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
1386
1387         [ESNext] Async iteration - Implement Async Generator - parser
1388         https://bugs.webkit.org/show_bug.cgi?id=175210
1389
1390         Reviewed by Yusuke Suzuki.
1391
1392         * stress/async-await-syntax.js:
1393         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1394         * stress/async-iteration-syntax.js: Added.
1395         (assert):
1396         (checkSyntax):
1397         (checkSyntaxError):
1398         (checkSimpleAsyncGeneratorSloppyMode):
1399         (checkSimpleAsyncGeneratorStrictMode):
1400         (checkNestedAsyncGenerators):
1401         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
1402         * stress/generator-class-methods-syntax.js:
1403
1404 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
1405
1406         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
1407         https://bugs.webkit.org/show_bug.cgi?id=175150
1408
1409         Unreviewed test gardening.
1410
1411         * wasm/js-api/test_memory_constructor.js:
1412
1413 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
1414
1415         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
1416         https://bugs.webkit.org/show_bug.cgi?id=175100
1417
1418         Reviewed by Mark Lam.
1419
1420         The JSC test JSTests/wasm/stress/oom.js tries to use all the
1421         available memory until an out of memory exception happens.
1422
1423         The Linux kernel is more tuned for server workloads than for GUI
1424         responsiveness. When a process tries to use a lot of memory, Linux
1425         will do its best to serve the request. This usually translates to
1426         free physical RAM by writing to disk dirty pages and/or moving out
1427         less recently used pages to swap (disk storage).
1428         Meanwhile it does this, the system will become unresponsive and this
1429         leads to freezes that can last even some minutes on the worst cases.
1430
1431         Therefore, let's skip this test on Linux as it will cause more harm
1432         than good on the Linux bots or on the machines of Linux developers.
1433
1434         * wasm/stress/oom.js:
1435
1436 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
1437
1438         [JSC] Remove unnecessary print from stress\promise-finally.js test
1439         https://bugs.webkit.org/show_bug.cgi?id=175015
1440
1441         Reviewed by Yusuke Suzuki.
1442
1443         * stress/promise-finally.js:
1444         (p.finally):
1445         (then):
1446
1447 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1448
1449         Unreviewed, update test262 results for optional catch binding
1450
1451         * test262.yaml:
1452
1453 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1454
1455         [JSC] Support optional catch binding
1456         https://bugs.webkit.org/show_bug.cgi?id=174981
1457
1458         Reviewed by Saam Barati.
1459
1460         * stress/optional-catch-binding-syntax.js: Added.
1461         (testSyntax):
1462         (testSyntaxError):
1463         (catch.catch):
1464         * stress/optional-catch-binding.js: Added.
1465         (shouldBe):
1466         (throwException):
1467
1468 2017-07-28  Mark Lam  <mark.lam@apple.com>
1469
1470         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
1471         https://bugs.webkit.org/show_bug.cgi?id=174948
1472         <rdar://problem/33495680>
1473
1474         Reviewed by Filip Pizlo.
1475
1476         * stress/regress-174948.js: Added.
1477
1478 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
1479
1480         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
1481         https://bugs.webkit.org/show_bug.cgi?id=174900
1482
1483         Reviewed by Saam Barati.
1484
1485         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
1486         (sideEffect):
1487         (args):
1488         (test):
1489
1490 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1491
1492         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
1493         https://bugs.webkit.org/show_bug.cgi?id=171637
1494
1495         Reviewed by Darin Adler.
1496
1497         * stress/domjit-getter-complex-with-incorrect-object.js:
1498         (i.shouldThrow):
1499         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
1500         (shouldBe):
1501         (i.shouldThrow):
1502
1503 2017-07-26  JF Bastien  <jfbastien@apple.com>
1504
1505         WebAssembly: test throwing out of the start function
1506         https://bugs.webkit.org/show_bug.cgi?id=165714
1507         <rdar://problem/29760251>
1508
1509         Reviewed by Keith Miller.
1510
1511         * wasm/assert.js:
1512         * wasm/function-tests/trap-from-start.js: Added.
1513         (StartTraps):
1514         * wasm/function-tests/trap-from-start-async.js: Added.
1515         (async.StartTrapsAsync):
1516
1517 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1518
1519         [FTL] Arguments elimination is suppressed by unreachable blocks
1520         https://bugs.webkit.org/show_bug.cgi?id=174352
1521
1522         Reviewed by Filip Pizlo.
1523
1524         * stress/arguments-elimination-force-exit.js: Added.
1525         (shouldBe):
1526         (strict):
1527         (sloppy):
1528         * stress/arguments-elimination-throw.js: Added.
1529         (shouldBe):
1530         (shouldThrow):
1531         (sloppy):
1532         (isArguments):
1533
1534 2017-07-13  Mark Lam  <mark.lam@apple.com>
1535
1536         Add some additional test cases for bug 170896.
1537         https://bugs.webkit.org/show_bug.cgi?id=174491
1538
1539         Reviewed by Filip Pizlo.
1540
1541         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
1542         * stress/regress-170896-with-double-shape-profile.js: Added.
1543         (test):
1544         * stress/regress-170896-with-int32-shape-profile.js: Added.
1545         (test):
1546         * stress/regress-170896.js: Removed.
1547
1548 2017-07-13  Saam Barati  <sbarati@apple.com>
1549
1550         Missing exception check in JSObject::hasInstance
1551         https://bugs.webkit.org/show_bug.cgi?id=174455
1552         <rdar://problem/31384608>
1553
1554         Reviewed by Mark Lam.
1555
1556         * stress/has-instance-exception-check.js: Added.
1557         (assert):
1558         (let.getter.Object.getOwnPropertyDescriptor.get foo):
1559
1560 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
1561
1562         [ESnext] Implement Object Spread
1563         https://bugs.webkit.org/show_bug.cgi?id=167963
1564
1565         Reviewed by Saam Barati.
1566
1567         * stress/obj-rest-destructuring-order.js: Added.
1568         (assert):
1569         (o.get z):
1570         (o.get a):
1571         * stress/obj-spread-order.js: Added.
1572         (assert):
1573         (o.get z):
1574         (o.get a):
1575         * stress/object-spread.js: Added.
1576         (let.assert):
1577         (assert.sameValue):
1578         (let.o.get a):
1579         (let.obj.get c):
1580         (cthulhu.get x):
1581         (let.obj.set c):
1582         (calls.o.get z):
1583         (calls.o.get a):
1584         (try.let.obj.get foo):
1585         (get calls):
1586
1587 2017-07-12  Saam Barati  <sbarati@apple.com>
1588
1589         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
1590         https://bugs.webkit.org/show_bug.cgi?id=174411
1591         <rdar://problem/31696186>
1592
1593         Reviewed by Mark Lam.
1594
1595         * stress/generic-arguments-correct-delete-behavior.js: Added.
1596         (assert):
1597         (makeTest):
1598
1599 2017-07-07  Mark Lam  <mark.lam@apple.com>
1600
1601         \n\r is not the same as \r\n.
1602         https://bugs.webkit.org/show_bug.cgi?id=173053
1603
1604         Reviewed by Keith Miller.
1605
1606         * stress/regress-173053.js: Added.
1607         * stress/template-literal-line-terminators.js:
1608
1609 2017-07-06  Saam Barati  <sbarati@apple.com>
1610
1611         We are missing places where we invalidate the for-in context
1612         https://bugs.webkit.org/show_bug.cgi?id=174184
1613
1614         Reviewed by Geoffrey Garen.
1615
1616         * stress/for-in-invalidate-context-weird-assignments.js: Added.
1617         (assert):
1618         (test):
1619
1620 2017-07-05  Saam Barati  <sbarati@apple.com>
1621
1622         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
1623         https://bugs.webkit.org/show_bug.cgi?id=174188
1624         <rdar://problem/30581423>
1625
1626         Reviewed by Mark Lam.
1627
1628         * stress/new-array-having-a-bad-time-double.js: Added.
1629         (assert):
1630         (foo):
1631
1632 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1633
1634         WTF::StringImpl::copyChars segfaults when built with GCC 7
1635         https://bugs.webkit.org/show_bug.cgi?id=173407
1636
1637         Reviewed by Andreas Kling.
1638
1639         * stress/string-repeat-copy-chars-crash.js: Added.
1640         (shouldBe):
1641
1642 2017-07-03  Saam Barati  <sbarati@apple.com>
1643
1644         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
1645
1646         * stress/unshiftCountSlowCase-correct-postCapacity.js:
1647
1648 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1649
1650         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
1651
1652         It requires too much memory.
1653
1654         * stress/dont-reserve-huge-capacity-lexer.js:
1655
1656 2017-06-30  Michael Saboff  <msaboff@apple.com>
1657
1658         Skip a test on ARM64 platform since we run out of address space.
1659
1660         Rubber stamped by Saam Barati.
1661
1662         * stress/dont-reserve-huge-capacity-lexer.js:
1663
1664 2017-06-30  Michael Saboff  <msaboff@apple.com>
1665
1666         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
1667         https://bugs.webkit.org/show_bug.cgi?id=174044
1668
1669         Reviewed by Oliver Hunt.
1670
1671         New regression test.
1672
1673         * stress/regress-174044.js: Added.
1674         (test1):
1675         (test2):
1676
1677 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
1678
1679         RegExpCachedResult::setInput should reify left and right contexts
1680         https://bugs.webkit.org/show_bug.cgi?id=173818
1681
1682         Reviewed by Keith Miller.
1683
1684         * stress/right-left-context-invalidated-by-input.js: Added.
1685         (test.validateContexts):
1686         (test):
1687
1688 2017-06-29  Saam Barati  <sbarati@apple.com>
1689
1690         Calculating postCapacity in unshiftCountSlowCase is wrong
1691         https://bugs.webkit.org/show_bug.cgi?id=173992
1692         <rdar://problem/32283199>
1693
1694         Reviewed by Keith Miller.
1695
1696         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
1697         (temp):
1698
1699 2017-06-29  Commit Queue  <commit-queue@webkit.org>
1700
1701         Unreviewed, rolling out r218512.
1702         https://bugs.webkit.org/show_bug.cgi?id=173981
1703
1704         "It changes the behavior of the JS API's JSEvaluateScript
1705         which breaks TurboTax" (Requested by saamyjoon on #webkit).
1706
1707         Reverted changeset:
1708
1709         "test262: Completion values for control flow do not match the
1710         spec"
1711         https://bugs.webkit.org/show_bug.cgi?id=171265
1712         http://trac.webkit.org/changeset/218512
1713
1714 2017-06-27  JF Bastien  <jfbastien@apple.com>
1715
1716         WebAssembly: running out of executable memory should throw OoM
1717         https://bugs.webkit.org/show_bug.cgi?id=171537
1718         <rdar://problem/32963338>
1719
1720         Reviewed by Saam Barati.
1721
1722         * wasm.yaml:
1723         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
1724         (const.invoke):
1725         (failCount.0.catch):
1726         (failCount.0.module.undefined.catch):
1727         * wasm/lowExecutableMemory/exports-oom.js: Added.
1728         (const.type):
1729         (const.params):
1730         (const.randomProgram):
1731         (failCount.0.catch):
1732         (failCount.0.module.undefined.catch):
1733         * wasm/lowExecutableMemory/imports-oom.js: Added.
1734         (const.type):
1735         (const.params):
1736         (const.randomProgram):
1737         (f.imports.push):
1738         (failCount.0.catch):
1739         (failCount.0.module.undefined.catch):
1740
1741 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
1742
1743         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
1744         https://bugs.webkit.org/show_bug.cgi?id=167962
1745
1746         Reviewed by Saam Barati.
1747
1748         * stress/object-rest-deconstruct.js: Added.
1749         (let.assert):
1750         (let.assertPropDescriptor):
1751         (catch):
1752         (get 3):
1753         (foo):
1754         (let.src.get y):
1755         (let.src.set y):
1756         (let.gen):
1757
1758 2017-06-27  Saam Barati  <sbarati@apple.com>
1759
1760         Function constructor needs to follow the spec and validate parameters and body independently
1761         https://bugs.webkit.org/show_bug.cgi?id=173303
1762         <rdar://problem/32732526>
1763
1764         Reviewed by Keith Miller.
1765
1766         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1767         * stress/function-constructor-semantics.js: Added.
1768         (assert):
1769         (hasSyntaxError):
1770         (foo):
1771         (async.foo):
1772         (testError):
1773         (testOK.toString):
1774         (toString):
1775
1776 2017-06-26  Saam Barati  <sbarati@apple.com>
1777
1778         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
1779         https://bugs.webkit.org/show_bug.cgi?id=173740
1780
1781         Reviewed by Mark Lam.
1782
1783         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
1784         (Array.prototype.Symbol.iterator):
1785
1786 2017-06-26  Saam Barati  <sbarati@apple.com>
1787
1788         Skip a test on 32-bit platforms since we run out of address space.
1789
1790         Rubber stamped by Mark Lam.
1791
1792         * stress/dont-reserve-huge-capacity-lexer.js:
1793
1794 2017-06-26  Saam Barati  <sbarati@apple.com>
1795
1796         Crash in JSC::Lexer<unsigned char>::setCode
1797         https://bugs.webkit.org/show_bug.cgi?id=172754
1798
1799         Reviewed by Mark Lam.
1800
1801         * stress/dont-reserve-huge-capacity-lexer.js: Added.
1802         (catch):
1803
1804 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1805
1806         [JSC] Clean up Object.entries implementation
1807         https://bugs.webkit.org/show_bug.cgi?id=173759
1808
1809         Reviewed by Sam Weinig.
1810
1811         * microbenchmarks/object-entries.js: Added.
1812         (test):
1813
1814 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
1815
1816         Remove Reflect.enumerate
1817         https://bugs.webkit.org/show_bug.cgi?id=173806
1818
1819         Reviewed by Yusuke Suzuki.
1820
1821         * ChakraCore.yaml:
1822         * es6.yaml:
1823         These tests now fail because they use Reflect.enumerate.
1824
1825         * test262.yaml:
1826         This test now passes, it checked that Reflect.enumerate is undefined!
1827
1828         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
1829         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
1830
1831         * stress/reflect-enumerate.js: Removed.
1832         Remove a test solely for Reflect.enumerate.
1833
1834 2017-06-22  Saam Barati  <sbarati@apple.com>
1835
1836         ValueRep(DoubleRep(@v)) can not simply convert to @v
1837         https://bugs.webkit.org/show_bug.cgi?id=173687
1838         <rdar://problem/32855563>
1839
1840         Reviewed by Mark Lam.
1841
1842         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
1843         (i.catch):
1844
1845 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1846
1847         [JSC] Object.values should be implemented in C++
1848         https://bugs.webkit.org/show_bug.cgi?id=173703
1849
1850         Reviewed by Sam Weinig.
1851
1852         * microbenchmarks/object-keys-map-values.js: Added.
1853         (test):
1854         * microbenchmarks/object-values.js: Added.
1855         (test):
1856         * stress/object-values-changing-properties.js: Added.
1857         (shouldBe):
1858         (throw.new.Error.let.source.get x):
1859         (throw.new.Error):
1860         (shouldBe.let.handler.get order):
1861         (get let):
1862         (shouldBe.let.handler.get return):
1863         (let.handler.get order):
1864
1865 2017-06-21  Saam Barati  <sbarati@apple.com>
1866
1867         eval virtual call is incorrect in the baseline JIT
1868         https://bugs.webkit.org/show_bug.cgi?id=173587
1869         <rdar://problem/32867897>
1870
1871         Reviewed by Michael Saboff.
1872
1873         * stress/do-eval-virtual-call-correctly.js: Added.
1874         (assert):
1875         (f):
1876         (i.test):
1877         (catch):
1878
1879 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
1880
1881         Update test262 test expectations after r218581.
1882
1883         Unreviewed test gardening.
1884
1885         * test262.yaml:
1886
1887 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
1888
1889         Revert changes in bug#160417 about extending `null` not being a derived class
1890         https://bugs.webkit.org/show_bug.cgi?id=169293
1891
1892         Reviewed by Saam Barati.
1893
1894         * stress/class-derived-from-null.js:
1895         (assertThrow):
1896         (test1):
1897         (test2):
1898         (test3):
1899         (test4):
1900         (test5):
1901         (test6):
1902
1903 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1904
1905         [DFG] More ArrayIndexOf fixups for various types
1906         https://bugs.webkit.org/show_bug.cgi?id=173176
1907
1908         Reviewed by Saam Barati.
1909
1910         * stress/array-indexof-arraystorage.js: Added.
1911         (shouldBe):
1912         (indexOfInt32Other):
1913         (indexOfInt32Cell):
1914         (indexOfInt32Boolean):
1915         (indexOfDoubleOther):
1916         (indexOfDoubleCell):
1917         (indexOfDoubleBoolean):
1918         (indexOfInt32):
1919         (indexOfDouble):
1920         * stress/array-indexof-constant-folding.js: Added.
1921         (shouldBe):
1922         (indexOfInt32Other):
1923         (indexOfInt32Cell):
1924         (indexOfInt32Boolean):
1925         (indexOfDoubleOther):
1926         (indexOfDoubleCell):
1927         (indexOfDoubleBoolean):
1928         * stress/array-indexof-hole-and-other.js: Added.
1929         (shouldBe):
1930         (indexOf):
1931         * stress/array-indexof-other.js: Added.
1932         (shouldBe):
1933         (indexOfInt32):
1934         (indexOfDouble):
1935         (indexOfString):
1936         (indexOfObject):
1937         * stress/array-indexof-symbol.js: Added.
1938         (shouldBe):
1939         (indexOfInt32):
1940         (indexOfDouble):
1941         (indexOfString):
1942         (indexOfObject):
1943
1944 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
1945
1946         test262: Completion values for control flow do not match the spec
1947         https://bugs.webkit.org/show_bug.cgi?id=171265
1948
1949         Reviewed by Saam Barati.
1950
1951         * stress/completion-value.js:
1952         Condensed test for completion values in top level statements.
1953
1954         * stress/super-get-by-id.js:
1955         ClassDeclaration when evaled no longer produce values. Convert
1956         these to ClassExpressions so they produce the class value.
1957         
1958         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
1959         This is a progression for currect spec behavior.
1960
1961         * mozilla/mozilla-tests.yaml:
1962         This test is now outdated, so mark it as failing for that reason.
1963
1964         * test262.yaml:
1965         Passing all "cptn" completion value tests.
1966
1967 2017-06-17  Keith Miller  <keith_miller@apple.com>
1968
1969         ArrayBuffer constructor needs to create subclass structures before its buffer
1970         https://bugs.webkit.org/show_bug.cgi?id=173510
1971
1972         Reviewed by Yusuke Suzuki.
1973
1974         * test262.yaml:
1975
1976 2017-06-17  Keith Miller  <keith_miller@apple.com>
1977
1978         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
1979         https://bugs.webkit.org/show_bug.cgi?id=173506
1980
1981         Reviewed by Ryosuke Niwa.
1982
1983         Re-baseline tests.
1984
1985         * ChakraCore/test/Function/apply3.baseline-jsc:
1986         * test262.yaml:
1987
1988 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1989
1990         [JSC] Add fast path for Object.assign
1991         https://bugs.webkit.org/show_bug.cgi?id=173416
1992
1993         Reviewed by Mark Lam.
1994
1995         * stress/object-assign-changing-properties.js: Added.
1996         (shouldBe):
1997         (throw.new.Error.let.source.get x):
1998         (throw.new.Error):
1999         (shouldBe.let.source.get x):
2000         (shouldBe.let.target.set x):
2001         (shouldBe.let.target.get x):
2002         * stress/object-assign-proxy.js: Added.
2003         (shouldBe):
2004         (throw.new.Error.let.handler.get order):
2005
2006 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
2007
2008         [JSC] Implement Object.assign in C++
2009         https://bugs.webkit.org/show_bug.cgi?id=173414
2010
2011         Reviewed by Saam Barati.
2012
2013         * stress/object-assign-string-first.js: Added.
2014         (shouldBe):
2015         (source.get Symbol):
2016         (source.get 1):
2017         (source.get cocoa):
2018
2019 2017-06-14  JF Bastien  <jfbastien@apple.com>
2020
2021         WebAssembly: remove empty test files
2022         https://bugs.webkit.org/show_bug.cgi?id=173382
2023
2024         Reviewed by Saam Barati.
2025
2026         The following files:
2027                 JSTests/wasm/function-tests/call-indirect-params.js
2028                 JSTests/wasm/function-tests/call-indirect.js
2029                 JSTests/wasm/js-api/call-indirect-results.js
2030         Were changed to empty files in https://trac.webkit.org/changeset/209771
2031
2032         They were testing call_indirect with the wrong semantics, before
2033         we implemented tables. That change implemented tables and
2034         therefore removed the erroneous tests.
2035
2036         We have a few tests for call_indirect which already do the right thing:
2037                 JSTests/wasm/function-tests/context-switch.js
2038                 JSTests/wasm/function-tests/exceptions.js
2039                 JSTests/wasm/function-tests/grow-memory-2.js
2040                 JSTests/wasm/function-tests/stack-overflow.js
2041                 JSTests/wasm/function-tests/table-basic-2.js
2042                 JSTests/wasm/function-tests/table-basic.js
2043                 JSTests/wasm/js-api/call-indirect.js
2044                 JSTests/wasm/js-api/table.js
2045                 JSTests/wasm/js-api/unique-signature.js
2046                 JSTests/wasm/js-api/wrapper-function.js
2047
2048         I also just imported the updated spec tests which, among other
2049         things, test call_indirect:
2050                 core/br.wast
2051                 core/br_table.wast
2052                 core/call_indirect.wast
2053                 core/func.wast
2054                 core/func_ptrs.wast
2055                 core/imports.wast
2056                 core/left-to-right.wast
2057                 core/linking.wast
2058                 core/nop.wast
2059                 core/return.wast
2060                 core/typecheck.wast
2061                 core/unreachable.wast
2062
2063         So I think it's OK to just delete the tests which should just have
2064         been deleted back when tables were added.
2065
2066         * wasm/function-tests/call-indirect-params.js: Removed.
2067         * wasm/function-tests/call-indirect.js: Removed.
2068         * wasm/js-api/call-indirect-results.js: Removed.
2069
2070 2017-06-13  JF Bastien  <jfbastien@apple.com>
2071
2072         WebAssembly: import updated spec tests
2073         https://bugs.webkit.org/show_bug.cgi?id=173287
2074         <rdar://problem/32725975>
2075
2076         Reviewed by Saam Barati.
2077
2078         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
2079         with a few modifications so things work.
2080
2081         Fix a bunch of bugs found through this process, and punt a few tests (which I
2082         marked as blocked by this bug).
2083
2084         Fixes:
2085
2086         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
2087         instead of byte alignment. It was also missing memory-alignment.js despite it
2088         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
2089         pass.
2090
2091         Tables can be imported or in a section. There can be only one, but sections can
2092         be empty. An Elements section can exist if there's no Table, as long as it is
2093         also empty.
2094
2095         Memories can be imported or in a section. There can be only one, but sections
2096         can be empty. A Data section can exist if there's no Memory, as long as it is
2097         also empty.
2098
2099         Prototypes: stringify without .prototype. in the string.
2100
2101         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
2102         not a final size, and throws a RangeError on failure, not a TypeError.
2103
2104         Fix compile / instantiate so the reject the promise if given an argument of the
2105         wrong type (instead of failing instantly).
2106
2107         Fix async on neuter test.
2108
2109         Element section shouldn't affect any Table if any of the elements are out of
2110         bounds. We need to process it in two passes.
2111
2112         Segment section shouldn't affect any Data if any of the segments are out of
2113         bounds. We need to process it in two passes.
2114
2115         Empty data segments are valid, but only when there is no memory. Their index
2116         still gets validated, and has to be zero.
2117
2118         Punts:
2119
2120         Error messages with context, the test seems overly restrictive but this is
2121         minor.
2122
2123         compile/instantiate/validate property descriptors.
2124
2125         UTF-8 bugs.
2126
2127         Temporarily disable NaN tests. We need to go back and implement the following
2128         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
2129         much as getting all the other tests passing.
2130
2131         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
2132         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
2133         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
2134         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
2135         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
2136         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
2137         why they're not allowed.
2138
2139         * wasm.yaml:
2140         * wasm/function-tests/i32-load8-s.js:
2141         * wasm/function-tests/memory-access-past-4gib.js:
2142         (const.op.of.WASM.opcodes):
2143         * wasm/function-tests/memory-alignment.js: Added.
2144         (const.op.of.WASM.opcodes):
2145         * wasm/function-tests/memory-section-and-import.js:
2146         * wasm/js-api/Module-compile.js:
2147         (async.testPromiseAPI):
2148         * wasm/js-api/dont-mmap-zero-byte-memory.js:
2149         (testMems):
2150         * wasm/js-api/element.js:
2151         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
2152         * wasm/js-api/neutered-inputs.js:
2153         (const.testFunction): Deleted.
2154         (const.testConstructor): Deleted.
2155         * wasm/js-api/table.js:
2156         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
2157         (new.WebAssembly.Module):
2158         (assert.throws):
2159         (assertBadTableImport):
2160         (assert.throws.WebAssembly.Table.prototype.grow):
2161         (assertBadTableInstance): Deleted.
2162         * wasm/js-api/test_Data.js:
2163         (DataSectionWithoutMemory):
2164         * wasm/spec-harness/index.js:
2165         (module):
2166         (uniqueTest): Deleted.
2167         (assert_invalid): Deleted.
2168         (assert_soft_invalid): Deleted.
2169         (register): Deleted.
2170         (call): Deleted.
2171         (get instance): Deleted.
2172         (exports): Deleted.
2173         (run): Deleted.
2174         (assert_unlinkable): Deleted.
2175         (assert_uninstantiable): Deleted.
2176         (assert_trap): Deleted.
2177         (try.f): Deleted.
2178         (catch): Deleted.
2179         (assert_exhaustion): Deleted.
2180         (assert_return): Deleted.
2181         (assert_return_nan): Deleted.
2182         * wasm/spec-harness/testharness.css: Removed.
2183         * wasm/spec-harness/testharness.js: Removed.
2184         * wasm/spec-harness/testharnessreport.js: Removed.
2185         * wasm/spec-harness/wasm-constants.js:
2186         (assertTraps):
2187         (assertWasmThrows):
2188         * wasm/spec-harness/wasm-module-builder.js:
2189         (Binary.prototype.emit_section):
2190         (Binary):
2191         (WasmFunctionBuilder.prototype.addBody):
2192         (WasmFunctionBuilder.prototype.end):
2193         (WasmFunctionBuilder):
2194         (WasmModuleBuilder.prototype.stringToBytes):
2195         (WasmModuleBuilder.prototype.addCustomSection):
2196         (WasmModuleBuilder.prototype.addFunctionTableInit):
2197         (WasmModuleBuilder.prototype.appendToTable):
2198         (WasmModuleBuilder.prototype.toArray):
2199         (WasmModuleBuilder.prototype.toBuffer):
2200         (WasmModuleBuilder.prototype.instantiate):
2201         (WasmModuleBuilder):
2202         * wasm/spec-tests/address.wast.js:
2203         * wasm/spec-tests/align.wast.js: Added.
2204         * wasm/spec-tests/binary.wast.js:
2205         * wasm/spec-tests/block.wast.js:
2206         * wasm/spec-tests/br.wast.js:
2207         * wasm/spec-tests/br_if.wast.js:
2208         * wasm/spec-tests/br_table.wast.js:
2209         * wasm/spec-tests/call.wast.js:
2210         * wasm/spec-tests/call_indirect.wast.js:
2211         * wasm/spec-tests/comments.wast.js:
2212         * wasm/spec-tests/const.wast.js: Added.
2213         * wasm/spec-tests/conversions.wast.js: Added.
2214         * wasm/spec-tests/custom_section.wast.js:
2215         * wasm/spec-tests/exports.wast.js:
2216         * wasm/spec-tests/f32.wast.js: Added.
2217         * wasm/spec-tests/f64.wast.js: Added.
2218         * wasm/spec-tests/fac.wast.js:
2219         * wasm/spec-tests/float_exprs.wast.js: Added.
2220         * wasm/spec-tests/float_misc.wast.js: Added.
2221         * wasm/spec-tests/func.wast.js:
2222         * wasm/spec-tests/globals.wast.js:
2223         * wasm/spec-tests/if.wast.js:
2224         * wasm/spec-tests/imports.wast.js:
2225         * wasm/spec-tests/inline-module.wast.js: Added.
2226         * wasm/spec-tests/jsapi.js:
2227         (testJSAPI.test):
2228         (testJSAPI):
2229         * wasm/spec-tests/labels.wast.js:
2230         * wasm/spec-tests/loop.wast.js:
2231         * wasm/spec-tests/memory.wast.js:
2232         * wasm/spec-tests/memory_trap.wast.js: Added.
2233         * wasm/spec-tests/names.wast.js:
2234         * wasm/spec-tests/nop.wast.js:
2235         * wasm/spec-tests/return.wast.js:
2236         * wasm/spec-tests/stack.wast.js:
2237         * wasm/spec-tests/token.wast.js: Added.
2238         * wasm/spec-tests/type.wast.js: Added.
2239         * wasm/spec-tests/typecheck.wast.js:
2240         * wasm/spec-tests/unreachable.wast.js:
2241         * wasm/spec-tests/unreached-invalid.wast.js:
2242         * wasm/spec-tests/unwind.wast.js:
2243         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
2244         * wasm/spec-tests/utf8-import-field.wast.js: Added.
2245         * wasm/spec-tests/utf8-import-module.wast.js: Added.
2246
2247 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
2248
2249         Unreviewed JSC test gardening.
2250
2251         * stress/check-string-ident.js:
2252         * stress/new-largeish-contiguous-array-with-size.js:
2253
2254 2017-06-13  Michael Saboff  <msaboff@apple.com>
2255
2256         DFG doesn't properly handle a property that is change to read only in a prototype
2257         https://bugs.webkit.org/show_bug.cgi?id=173321
2258
2259         Reviewed by Filip Pizlo.
2260
2261         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
2262         * stress/regress-173321.js: Added new regression test.
2263         (shouldBe):
2264         (SimpleObject):
2265         (test):
2266
2267 2017-06-12  Saam Barati  <sbarati@apple.com>
2268
2269         Update test262 test expectation since r218082 makes new tests pass.
2270
2271         * test262.yaml:
2272
2273 2017-06-12  Saam Barati  <sbarati@apple.com>
2274
2275         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
2276         https://bugs.webkit.org/show_bug.cgi?id=172957
2277         <rdar://problem/32602704>
2278
2279         Reviewed by Filip Pizlo.
2280
2281         * stress/spec-empty-flows-through-cell-checks.js: Added.
2282         (A):
2283         (B):
2284         (i.catch):
2285
2286 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
2287
2288         We incorrectly allow escaped characters in keyword tokens
2289         https://bugs.webkit.org/show_bug.cgi?id=171310
2290
2291         Reviewed by Yusuke Suzuki.
2292
2293         * stress/destructuring-assignment-syntax.js:
2294         * stress/error-messages-for-in-operator-should-not-crash.js:
2295         (catch):
2296         * stress/reserved-word-with-escape.js:
2297         (testSyntaxError.String.raw.v):
2298         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
2299         (testSyntaxError.String.raw.a):
2300         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
2301
2302 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2303
2304         [DFG] Add ArrayIndexOf intrinsic
2305         https://bugs.webkit.org/show_bug.cgi?id=172421
2306
2307         Reviewed by Saam Barati.
2308
2309         * stress/array-indexof-array-prototype-change.js: Added.
2310         (shouldBe):
2311         (indexOfInt32):
2312         * stress/array-indexof-have-a-bad-time-getter.js: Added.
2313         (shouldBe):
2314         (indexOfInt32):
2315         * stress/array-indexof-have-a-bad-time.js: Added.
2316         (shouldBe):
2317         (indexOfInt32):
2318         * stress/array-indexof-hole-with-prototype.js: Added.
2319         (shouldBe):
2320         (indexOf):
2321         * stress/array-indexof-hole.js: Added.
2322         (shouldBe):
2323         (indexOf):
2324         * stress/array-indexof-index.js: Added.
2325         (shouldBe):
2326         (indexOfInt32):
2327         (indexOfDouble):
2328         (indexOfString):
2329         (indexOfObject):
2330         (indexOfValue):
2331         * stress/array-indexof-negative-index.js: Added.
2332         (shouldBe):
2333         (indexOfInt32):
2334         (indexOfDouble):
2335         (indexOfString):
2336         (indexOfObject):
2337         (indexOfValue):
2338         * stress/array-indexof-non-int32-start-index.js: Added.
2339         (shouldBe):
2340         (indexOf):
2341         (object.valueOf):
2342         * stress/array-indexof-object-prototype-change.js: Added.
2343         (shouldBe):
2344         (indexOfInt32):
2345         * stress/array-indexof-object.js: Added.
2346         (shouldBe):
2347         (indexOf):
2348         * stress/array-indexof-original-array.js: Added.
2349         (shouldBe):
2350         (indexOfInt32):
2351         * stress/array-indexof-string.js: Added.
2352         (shouldBe):
2353         (indexOf):
2354         * stress/array-indexof-structure-change-convert.js: Added.
2355         (shouldBe):
2356         (indexOf):
2357         * stress/array-indexof-structure-change.js: Added.
2358         (shouldBe):
2359         (indexOf):
2360         * stress/array-indexof.js: Added.
2361         (shouldBe):
2362         (indexOf):
2363
2364 2017-06-11  Keith Miller  <keith_miller@apple.com>
2365
2366         TypedArray constructor with string shouldn't throw
2367         https://bugs.webkit.org/show_bug.cgi?id=173181
2368
2369         Reviewed by JF Bastien.
2370
2371         We should be coercing primitive arguments to numbers in the various
2372         TypedArray constructors.
2373
2374         * stress/typedarray-constructor.js:
2375
2376 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
2377
2378         Unreviewed, update test results part 3
2379         https://bugs.webkit.org/show_bug.cgi?id=173227
2380
2381         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
2382
2383 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2384
2385         Unreviewed, update test results part 2
2386         https://bugs.webkit.org/show_bug.cgi?id=173227
2387
2388         * test262.yaml:
2389
2390 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2391
2392         Unreviewed, update test results
2393         https://bugs.webkit.org/show_bug.cgi?id=173227
2394
2395         * microbenchmarks/string-prototype-search-observable-side-effects.js:
2396         * test262.yaml:
2397
2398 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2399
2400         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
2401         https://bugs.webkit.org/show_bug.cgi?id=173227
2402
2403         Reviewed by Mark Lam.
2404
2405         Update the test.
2406
2407         * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
2408
2409 2017-06-08  Keith Miller  <keith_miller@apple.com>
2410
2411         WebAssembly: We should only create wrappers for functions that can be exported
2412         https://bugs.webkit.org/show_bug.cgi?id=173088
2413
2414         Reviewed by Saam Barati.
2415
2416         Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
2417         on the old testWasmModuleFunctions api, which has been removed.
2418
2419         * wasm/function-tests/copysign.js: Removed.
2420         * wasm/function-tests/ctz.js: Removed.
2421         * wasm/function-tests/drop.js: Removed.
2422         * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
2423         * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
2424         * wasm/function-tests/dumb-less-than-ite.js: Removed.
2425         * wasm/function-tests/eqz.js: Removed.
2426         * wasm/function-tests/i32-trunc-s-f32.js: Removed.
2427         * wasm/function-tests/i32-trunc-s-f64.js: Removed.
2428         * wasm/function-tests/i32-trunc-u-f32.js: Removed.
2429         * wasm/function-tests/i32-trunc-u-f64.js: Removed.
2430         * wasm/function-tests/i64-trunc-s-f32.js: Removed.
2431         * wasm/function-tests/i64-trunc-s-f64.js: Removed.
2432         * wasm/function-tests/i64-trunc-u-f32.js: Removed.
2433         * wasm/function-tests/i64-trunc-u-f64.js: Removed.
2434         * wasm/function-tests/if-then-else-fallthrough.js: Removed.
2435         * wasm/function-tests/if-then-fallthrough.js: Removed.
2436         * wasm/function-tests/int-to-floating-point.js: Removed.
2437         * wasm/function-tests/loop-mult.js:
2438         * wasm/function-tests/loop-sum.js:
2439         * wasm/function-tests/max.js: Removed.
2440         * wasm/function-tests/min.js: Removed.
2441         * wasm/function-tests/nearest.js: Removed.
2442         * wasm/function-tests/nop.js: Removed.
2443         * wasm/function-tests/popcnt.js: Removed.
2444         * wasm/function-tests/ret5.js:
2445         * wasm/function-tests/select.js: Removed.
2446         * wasm/function-tests/tee-local.js: Removed.
2447         * wasm/function-tests/trunc.js: Removed.
2448
2449 2017-06-07  JF Bastien  <jfbastien@apple.com>
2450
2451         WebAssembly: test imports and exports with 16-bit characters
2452         https://bugs.webkit.org/show_bug.cgi?id=165977
2453         <rdar://problem/29760130>
2454
2455         Reviewed by Saam Barati.
2456
2457         The output for import failure was improved, so many tests need to
2458         be updated here. Only one has new tests as noted below.
2459
2460         * wasm/function-tests/memory-import-and-grow.js:
2461         * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
2462         (idxModule):
2463         * wasm/js-api/global-error.js:
2464         (new.Number):
2465         (assert.throws):
2466         * wasm/js-api/table.js:
2467         (assert.throws):
2468         (new.WebAssembly.Table):
2469         * wasm/js-api/test_memory.js:
2470         (test):
2471         * wasm/js-api/wasm-to-wasm-bad-signature.js:
2472         (BadSignatureDropStartParams.):
2473         (BadSignatureDropStartParams):
2474         (BadSignatureDropEndParams.):
2475         (BadSignatureSwapParam.):
2476         (BadSignatureRet.):
2477         * wasm/js-api/web-assembly-instantiate.js:
2478         (assert.asyncTest.async.test):
2479         (assert.asyncTest):
2480         * wasm/js-api/wrapper-function.js:
2481         (return.new.WebAssembly.Module):
2482
2483 2017-06-07  Mark Lam  <mark.lam@apple.com>
2484
2485         Restrict the regress-173035.js test to only run on Darwin x86-64.
2486         https://bugs.webkit.org/show_bug.cgi?id=173075
2487
2488         Reviewed by Saam Barati.
2489
2490         This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
2491         this test will require to succeed.  Here's an example of this failure:
2492         https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
2493
2494         Since the issue is due to allocation of a very large amount of memory, the test
2495         will probably fail on iOS and other platforms as well.  Hence, we should just
2496         skip this test for any platforms that is not Darwin x86-64.
2497
2498         * stress/regress-173035.js:
2499
2500 2017-06-07  Mark Lam  <mark.lam@apple.com>
2501
2502         ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
2503         https://bugs.webkit.org/show_bug.cgi?id=168587
2504
2505         Not reviewed.
2506
2507         Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
2508
2509         * stress/test-finally.js:
2510
2511 2017-06-06  Mark Lam  <mark.lam@apple.com>
2512
2513         Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
2514         https://bugs.webkit.org/show_bug.cgi?id=173035
2515         <rdar://problem/32554593>
2516
2517         Reviewed by Geoffrey Garen and Filip Pizlo.
2518
2519         * stress/regress-173035.js: Added.
2520
2521 2017-06-06  Saam Barati  <sbarati@apple.com>
2522
2523         Make sure we restore SP when doing calls that could be to JS
2524         https://bugs.webkit.org/show_bug.cgi?id=172946
2525         <rdar://problem/32579026>
2526
2527         Reviewed by JF Bastien.
2528
2529         * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
2530         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
2531         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
2532         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
2533         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
2534
2535 2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
2536
2537         Unreviewed rollout r217807. Caused a test to crash.
2538
2539         * heapProfiler/class-names.js: Removed.
2540         * heapProfiler/driver/driver.js:
2541         (CheapHeapSnapshotNode):
2542         (CheapHeapSnapshot):
2543         (createCheapHeapSnapshot):
2544         (HeapSnapshot):
2545         (createHeapSnapshot):
2546         * typeProfiler/inheritance.js:
2547         (wrapper.A):
2548         (wrapper.B):
2549         (wrapper.C):
2550         (wrapper):
2551
2552 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
2553
2554         index out of bound in bytecodebasicblock
2555         https://bugs.webkit.org/show_bug.cgi?id=172963
2556
2557         Reviewed by Saam Barati and Mark Lam.
2558
2559         * stress/dfg-call-class-constructor.js: Added.
2560         (Foo):
2561         (i.catch):
2562
2563 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
2564
2565         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
2566         https://bugs.webkit.org/show_bug.cgi?id=172848
2567         <rdar://problem/25709212>
2568
2569         Reviewed by Saam Barati.
2570
2571         * typeProfiler/inheritance.js:
2572         Rewrite the test slightly for clarity. The hoisting was confusing.
2573
2574         * heapProfiler/class-names.js: Added.
2575         (MyES5Class):
2576         (MyES6Class):
2577         (MyES6Subclass):
2578         Test object types and improved class names.
2579
2580         * heapProfiler/driver/driver.js:
2581         (CheapHeapSnapshotNode):
2582         (CheapHeapSnapshot):
2583         (createCheapHeapSnapshot):
2584         (HeapSnapshot):
2585         (createHeapSnapshot):
2586         Update snapshot parsing from version 1 to version 2.
2587
2588 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2589
2590         ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
2591         https://bugs.webkit.org/show_bug.cgi?id=168844
2592
2593         Reviewed by Saam Barati.
2594
2595         * modules/async-function-export.js: Added.
2596         (f):
2597         (export.async.f):
2598
2599 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2600
2601         ES2015 modules - Export default function hoisting
2602         https://bugs.webkit.org/show_bug.cgi?id=170174
2603
2604         Reviewed by Saam Barati.
2605
2606         This issue itself is solved by fixing function declaration hoisting rules.
2607         This patch just adds the specific test to modules tests to ensure the bug
2608         is fixed.
2609
2610         * modules/export-default-function-hoisting.js: Added.
2611         * modules/export-default-function-hoisting/cappuccino.js: Added.
2612         (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
2613         * modules/export-default-function-hoisting/cocoa.js: Added.
2614         (export.default.drinkCocoa):
2615
2616 2017-06-01  Oleksandr Skachkov  <gskachkov@gmail.com>
2617
2618         Class Proxy can't be extended
2619         https://bugs.webkit.org/show_bug.cgi?id=169040
2620
2621         Reviewed by Saam Barati.
2622
2623         Adding tests that check correctness of Proxy to ES6 `class`
2624         Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
2625
2626         * stress/proxy-class.js: Added.
2627         (assert):
2628         (throw.new.Error.SuperClass):
2629         (throw.new.Error.A):
2630         (throw.new.Error):
2631
2632 2017-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2633
2634         [JSC] Implement String.prototype.concat in JS builtins
2635         https://bugs.webkit.org/show_bug.cgi?id=172798
2636
2637         Reviewed by Sam Weinig.
2638
2639         * microbenchmarks/string-concat-convert.js: Added.
2640         (test):
2641         * microbenchmarks/string-concat-long-convert.js: Added.
2642         (test):
2643         * microbenchmarks/string-concat-long.js: Added.
2644         (test):
2645         * microbenchmarks/string-concat.js: Added.
2646         (test):
2647
2648 2017-05-31  Oleksandr Skachkov  <gskachkov@gmail.com>
2649
2650         Rolling out: Prevent async methods named 'function'
2651         https://bugs.webkit.org/show_bug.cgi?id=172776
2652
2653         Reviewed by Mark Lam.
2654
2655         * stress/async-await-syntax.js:
2656         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2657         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2658         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2659         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2660         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2661
2662 2017-05-31  Ryan Haddad  <ryanhaddad@apple.com>
2663
2664         Skip flaky JSC test stress/test-finally.js
2665         https://bugs.webkit.org/show_bug.cgi?id=168587
2666
2667         Unreviewed test gardening.
2668
2669         * stress/test-finally.js:
2670
2671 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2672
2673         Prevent async methods named 'function' in Object literal
2674         https://bugs.webkit.org/show_bug.cgi?id=172660
2675
2676         Reviewed by Saam Barati.
2677
2678         * stress/async-await-syntax.js:
2679         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2680
2681 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2682
2683         ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
2684         https://bugs.webkit.org/show_bug.cgi?id=171274
2685
2686         Reviewed by Saam Barati.
2687
2688         * stress/async-arrow-functions-lexical-binding-in-class.js:
2689         (shouldBeAsync):
2690         (shouldBeAsyncAndStoreBind):
2691         (promise.new.Promise):
2692         (ChildClass4):
2693         (ChildClass4.prototype.classValue):
2694         (ChildClass4.prototype.get classProperty):
2695         * stress/async-arrow-functions-lexical-super-binding.js:
2696         (A):
2697         (const.childA1.new.prototype.var.f.async):
2698         (const.childA1.new.var):
2699         (const.childA1.new):
2700         (const.childA2.new.prototype.var.f.async):
2701         (const.childA2.new.var):
2702         (const.childA2.new):
2703         (const.childA3.new.prototype.var.f.async):
2704         (const.childA3.new.var):
2705         (const.childA3.new):
2706         (try.childA4.new.prototype.var.f.async):
2707         (try.childA4.new.var):
2708         (try.childA4.new):
2709         (catch):
2710         (const.childA5.new.prototype.var.f.async):
2711         (const.childA5.new.var):
2712         (const.childA5.new):
2713         (checkClass):
2714         (checkClass.new.prototype.var.f.async):
2715         (checkClass.new.var):
2716         (checkClass.new):
2717         (checkClass.new.prototype.method):
2718         (checkClass.new.prototype.prop):
2719
2720 2017-05-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2721
2722         [JSC] Map and Set constructors should have fast path for cloning
2723         https://bugs.webkit.org/show_bug.cgi?id=172413
2724
2725         Reviewed by Saam Barati.
2726
2727         * stress/map-clone-instance-iterator-change.js: Added.
2728         (shouldBe):
2729         (map.Symbol.iterator):
2730         * stress/map-clone-iterator-change.js: Added.
2731         (shouldBe):
2732         (Map.prototype.Symbol.iterator):
2733         * stress/map-clone-next-change.js: Added.
2734         (shouldBe):
2735         (map.Symbol.iterator.__proto__.next):
2736         * stress/map-clone.js: Added.
2737         (shouldBe):
2738         (Map.prototype):
2739         * stress/map-inherit-set.js: Added.
2740         (shouldBe):
2741         (DerivedMap):
2742         (set for):
2743         * stress/set-clone-instance-iterator-change.js: Added.
2744         (shouldBe):
2745         (set Symbol.iterator):
2746         * stress/set-clone-iterator-change.js: Added.
2747         (shouldBe):
2748         (set Set.prototype.Symbol.iterator):
2749         * stress/set-clone-next-change.js: Added.
2750         (shouldBe):
2751         (set Symbol.iterator.__proto__.next):
2752         * stress/set-clone.js: Added.
2753         (shouldBe):
2754         (set Set.prototype.add):
2755         * stress/set-inherit-add.js: Added.
2756         (shouldBe):
2757         (DerivedSet.set add):
2758
2759 2017-05-26  Ryan Haddad  <ryanhaddad@apple.com>
2760
2761         Unreviewed, rolling out r217458.
2762
2763         This change caused 55 JSC test failures.
2764
2765         Reverted changeset:
2766
2767         "Date should use historical data if it's available."
2768         https://bugs.webkit.org/show_bug.cgi?id=172592
2769         http://trac.webkit.org/changeset/217458
2770
2771 2017-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2772
2773         Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
2774         https://bugs.webkit.org/show_bug.cgi?id=167805
2775
2776         Reviewed by Saam Barati.
2777
2778         * modules/module-jit-reachability.js: Added.
2779
2780 2017-05-26  Oleksandr Skachkov  <gskachkov@gmail.com>
2781
2782         Prevent async methods named 'function'
2783         https://bugs.webkit.org/show_bug.cgi?id=172598
2784
2785         Reviewed by Mark Lam.
2786
2787         * stress/async-await-syntax.js:
2788         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2789         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2790         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2791         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2792         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2793
2794 2017-05-25  Keith Miller  <keith_miller@apple.com>
2795
2796         Date should use historical data if it's available.
2797         https://bugs.webkit.org/show_bug.cgi?id=172592
2798
2799         Reviewed by Mark Lam.
2800
2801         Remove parts of the date tests that rely on the absence of
2802         historical data in Date.
2803
2804         * mozilla/ecma/Date/15.9.5.31-1.js:
2805         (getTestCases):
2806         * mozilla/ecma/Date/15.9.5.35-1.js:
2807         (getTestCases):
2808
2809 2017-05-25  Saam Barati  <sbarati@apple.com>
2810
2811         Our for-in optimization in the bytecode generator does its static analysis incorrectly
2812         https://bugs.webkit.org/show_bug.cgi?id=172532
2813         <rdar://problem/32369452>
2814
2815         Reviewed by Mark Lam.
2816
2817         * stress/for-in-invalidation-for-any-write.js: Added.
2818         (assert):
2819         (test):
2820         (test.i):
2821
2822 2017-05-25  Mark Lam  <mark.lam@apple.com>
2823
2824         ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
2825         https://bugs.webkit.org/show_bug.cgi?id=172548
2826         <rdar://problem/31458393>
2827
2828         Reviewed by Filip Pizlo.
2829
2830         * stress/regress-172548.patch: Added.
2831
2832 2017-05-23  Saam Barati  <sbarati@apple.com>
2833
2834         We should not mmap zero bytes for a memory in Wasm
2835         https://bugs.webkit.org/show_bug.cgi?id=172528
2836         <rdar://problem/32257076>
2837
2838         Reviewed by Mark Lam.
2839
2840         * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
2841         (testMems):
2842
2843 2017-05-23  Saam Barati  <sbarati@apple.com>
2844
2845         CFGSimplificationPhase should not merge a block with itself
2846         https://bugs.webkit.org/show_bug.cgi?id=172508
2847         <rdar://problem/28424006>
2848
2849         Reviewed by Keith Miller.
2850
2851         * stress/dont-crash-in-cfg-simplification.js: Added.
2852         (bar):
2853         (baz):
2854         (foo):
2855
2856 2017-05-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2857
2858         [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
2859         https://bugs.webkit.org/show_bug.cgi?id=172216
2860
2861         Reviewed by Saam Barati.
2862
2863         * stress/array-storage-get-by-val.js: Added.
2864         (shouldBe):
2865         (testOutOfBound):
2866         (testInBound):
2867         (testSlowPutOutOfBound):
2868         (testSlowPutInBound):
2869
2870 2017-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2871
2872         Unreviewed, fix commented out tests
2873         https://bugs.webkit.org/show_bug.cgi?id=172225
2874
2875         * stress/get-by-val-string.js:
2876         (object.43):
2877         (Hello):
2878         (Hello.prototype.get 42):
2879         (Hello.prototype.43):
2880         (Derived):
2881         (shouldBe):
2882         (throw.new.Error): Deleted.
2883
2884 2017-05-21  Saam Barati  <sbarati@apple.com>
2885
2886         We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
2887         https://bugs.webkit.org/show_bug.cgi?id=171041
2888         <rdar://problem/32082516>
2889
2890         Reviewed by Yusuke Suzuki.
2891
2892         * stress/lexical-scoping-for-loop.js: Added.
2893         (assert):
2894         (test1):
2895         (test2):
2896         (test3):
2897         (test4):
2898         (test5):
2899         (test6):
2900         (let.test7):
2901         (let.test8):
2902         (let.test9):
2903         (let.test10):
2904         (let.test11):
2905         (let.test12):
2906
2907 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2908
2909         [JSC] Make get_by_val & string "499" to number 499
2910         https://bugs.webkit.org/show_bug.cgi?id=172225
2911
2912         Reviewed by Saam Barati.
2913
2914         * stress/get-by-val-string.js: Added.
2915         (shouldBe):
2916         (shouldThrow):
2917         (object.43):
2918         (Hello):
2919         (Hello.prototype.get 42):
2920         (Hello.prototype.43):
2921         (Derived):
2922
2923 2017-05-19  Mark Lam  <mark.lam@apple.com>
2924
2925         [Re-landing] DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
2926         https://bugs.webkit.org/show_bug.cgi?id=172383
2927         <rdar://problem/31418651>
2928
2929         Reviewed by Filip Pizlo.
2930
2931         * stress/regress-172383.js: Added.
2932
2933 2017-05-19  Ryan Haddad  <ryanhaddad@apple.com>
2934
2935         Unreviewed, rolling out r217156.
2936
2937         This change broke the iOS build.
2938
2939         Reverted changeset:
2940
2941         "DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring
2942         result registers."
2943         https://bugs.webkit.org/show_bug.cgi?id=172383
2944         http://trac.webkit.org/changeset/217156
2945
2946 2017-05-19  Mark Lam  <mark.lam@apple.com>
2947
2948         Add missing exception check.
2949         https://bugs.webkit.org/show_bug.cgi?id=172346
2950         <rdar://problem/32289640>
2951
2952         Reviewed by Geoffrey Garen.
2953
2954         * stress/regress-172346.js: Added.
2955
2956 2017-05-19  Mark Lam  <mark.lam@apple.com>
2957
2958         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
2959         https://bugs.webkit.org/show_bug.cgi?id=172383
2960         <rdar://problem/31418651>
2961
2962         Reviewed by Filip Pizlo.
2963
2964         * stress/regress-172383.js: Added.
2965
2966 2017-05-19  Filip Pizlo  <fpizlo@apple.com>
2967
2968         arrayProtoPrivateFuncConcatMemcpy needs to be down with firstArray being undecided
2969         https://bugs.webkit.org/show_bug.cgi?id=172369
2970
2971         Reviewed by Mark Lam.
2972
2973         * stress/undecided-concat.js: Added.
2974
2975 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2976
2977         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
2978         https://bugs.webkit.org/show_bug.cgi?id=172098
2979
2980         Reviewed by Saam Barati.
2981
2982         * stress/check-sub-class.js: Added.
2983         (shouldBe):
2984         (shouldThrow):
2985         (calling):
2986         (array.forEach):
2987         (i.array.forEach):
2988
2989 2017-05-18  JF Bastien  <jfbastien@apple.com>
2990
2991         WebAssembly: exports is a getter
2992         https://bugs.webkit.org/show_bug.cgi?id=172129
2993
2994         Reviewed by Saam Barati.
2995
2996         Update test to reflect new semantics.
2997
2998         * wasm/js-api/test_basic_api.js:
2999         (const.c.in.constructorProperties.switch):
3000
3001 2017-05-18  Saam Barati  <sbarati@apple.com>
3002
3003         Proxy's [[Get]] passes incorrect receiver
3004         https://bugs.webkit.org/show_bug.cgi?id=164849
3005         <rdar://problem/31767058>
3006
3007         Reviewed by Yusuke Suzuki.
3008
3009         * stress/proxy-get-set-correct-receiver.js: Added.
3010         (assert):
3011         (test):
3012         (test.let.target.set prop):
3013         (test.let.target.get prop):
3014         (test.get let):
3015         * stress/proxy-set.js:
3016         (let.target.get x):
3017         * stress/reflect-set-proxy-set.js:
3018         (let.target.get x):
3019         * stress/reflect-set-receiver-proxy-set.js:
3020         (let.target.get x):
3021
3022 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
3023
3024         Constructor calls set this too early
3025         https://bugs.webkit.org/show_bug.cgi?id=172302
3026
3027         Reviewed by Saam Barati.
3028         
3029         This tests all three kinds of constructs in BytecodeGenerator. All three were previously
3030         wrong.
3031
3032         * stress/construct-overwritten-variable.js: Added.
3033         (new.x.x):
3034         * stress/construct-spread-overwritten-variable-2.js: Added.
3035         (new.x.x):
3036         * stress/construct-spread-overwritten-variable.js: Added.
3037         (new.x.x):
3038
3039 2017-05-18  Saam Barati  <sbarati@apple.com>
3040
3041         WebAssembly: perform stack checks
3042         https://bugs.webkit.org/show_bug.cgi?id=165546
3043         <rdar://problem/29760307>
3044
3045         Reviewed by Filip Pizlo.
3046
3047         * wasm.yaml:
3048         * wasm/function-tests/factorial.js:
3049         * wasm/function-tests/float-sub.js:
3050         * wasm/function-tests/stack-overflow.js: Added.
3051         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
3052         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
3053         (assertOverflows.makeInstance):
3054         (assertOverflows.makeInstance2):
3055         (assertOverflows.assertThrows):
3056         (assertOverflows):
3057         (assertThrows.test.makeSignature):
3058         (assertThrows.test.makeInstance):
3059         (assertThrows.test):
3060         (assertThrows):
3061
3062 2017-05-18  Keith Miller  <keith_miller@apple.com>
3063
3064         WebAssembly API: test with neutered inputs
3065         https://bugs.webkit.org/show_bug.cgi?id=163899
3066
3067         Reviewed by JF Bastien.
3068
3069         * wasm/js-api/neutered-inputs.js: Added.
3070         (const.testFunction):
3071         (const.testConstructor):
3072         * wasm/js-api/test_basic_api.js:
3073         (const.c.in.constructorProperties.switch):
3074
3075 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
3076
3077         DFG inlining should be hardened for the no-result case
3078         https://bugs.webkit.org/show_bug.cgi?id=172290
3079
3080         Reviewed by Saam Barati.
3081
3082         * stress/array-constructor-no-result.js: Added.
3083         (foo):
3084         * stress/pow-no-result.js: Added.
3085         (foo):
3086
3087 2017-05-18  Commit Queue  <commit-queue@webkit.org>
3088
3089         Unreviewed, rolling out r217031, r217032, and r217037.
3090         https://bugs.webkit.org/show_bug.cgi?id=172293
3091
3092         cause linking errors in Windows (Requested by yusukesuzuki on
3093         #webkit).
3094
3095         Reverted changesets:
3096
3097         "[JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass"
3098         https://bugs.webkit.org/show_bug.cgi?id=172098
3099         http://trac.webkit.org/changeset/217031
3100
3101         "Unreviewed, rebaseline for newly added ClassInfo"
3102         https://bugs.webkit.org/show_bug.cgi?id=172098
3103         http://trac.webkit.org/changeset/217032
3104
3105         "Unreviewed, fix debug and non-JIT build"
3106         https://bugs.webkit.org/show_bug.cgi?id=172098
3107         http://trac.webkit.org/changeset/217037
3108
3109 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3110
3111         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
3112         https://bugs.webkit.org/show_bug.cgi?id=172098
3113
3114         Reviewed by Saam Barati.
3115
3116         * stress/check-sub-class.js: Added.
3117         (shouldBe):
3118         (shouldThrow):
3119         (calling):
3120         (array.forEach):
3121         (i.array.forEach):
3122
3123 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
3124
3125         Unreviewed, address mlam's review feedback.
3126
3127         * stress/arguments-elimination-varargs-too-many-args-arg-count.js:
3128
3129 2017-05-17  Saam Barati  <sbarati@apple.com>
3130
3131         We don't do context switches for Wasm->Wasm call indirect
3132         https://bugs.webkit.org/show_bug.cgi?id=172188
3133         <rdar://problem/32231828>
3134
3135         Reviewed by Keith Miller.
3136
3137         * wasm/function-tests/context-switch.js: Added.
3138         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
3139         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance2):
3140         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.i2.makeInstance2):
3141         (makeInstance):
3142         (makeInstance2):
3143         (assert.eq.makeInstance):
3144         (assert.eq.makeInstance2):
3145         (assert.eq):
3146
3147 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
3148
3149         JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform
3150         https://bugs.webkit.org/show_bug.cgi?id=172208
3151
3152         Reviewed by Saam Barati.
3153
3154         * stress/arguments-elimination-varargs-too-many-args-arg-count.js: Added.
3155         (foo):
3156         (bar):
3157         (baz):
3158
3159 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3160
3161         [DFG] Constant Folding Phase should convert MakeRope("", String) => Identity(String)
3162         https://bugs.webkit.org/show_bug.cgi?id=172115
3163
3164         Reviewed by Saam Barati.
3165
3166         * stress/constant-folding-should-fold-make-rope-with-empty-strings.js: Added.
3167         (shouldBe):
3168         (unknown):
3169         (readWord1):
3170         (readWord2):
3171         (readWord3):
3172         (readWord4):
3173
3174 2017-05-16  JF Bastien  <jfbastien@apple.com>
3175
3176         WebAssembly: add memory fuzzer
3177         https://bugs.webkit.org/show_bug.cgi?id=169976
3178         <rdar://problem/31965328>
3179
3180         Reviewed by Keith Miller.
3181
3182         * wasm/fuzz/memory.js: Added.
3183         (const.insert):
3184         (const.action.string_appeared_here):
3185         (const.performAction):
3186         (catch):
3187
3188 2017-05-16  JF Bastien  <jfbastien@apple.com>
3189
3190         WebAssembly: validate load / store alignment
3191         https://bugs.webkit.org/show_bug.cgi?id=168836
3192         <rdar://problem/31965349>
3193
3194         Reviewed by Keith Miller.
3195
3196         * wasm/WASM.js: fix regular expression greed
3197         * wasm/function-tests/memory-alignment.js: Added.
3198         (const.op.of.WASM.opcodes):
3199         * wasm/wasm.json: fix formatting
3200
3201 2017-05-15  Mark Lam  <mark.lam@apple.com>
3202
3203         Rolling out r214038 and r213697: Crashes when using computed properties with rest destructuring and object spread.
3204         https://bugs.webkit.org/show_bug.cgi?id=172147
3205
3206         Rubber-stamped by Saam Barati.
3207
3208         * stress/object-rest-deconstruct.js: Removed.
3209         * stress/object-spread.js: Removed.
3210
3211 2017-05-11  JF Bastien  <jfbastien@apple.com>
3212
3213         WebAssembly: stop supporting 0xD
3214         https://bugs.webkit.org/show_bug.cgi?id=168788
3215         <rdar://problem/31880922>
3216
3217         Reviewed by Saam Barati.
3218
3219         Test that only version 1 is supported.
3220
3221         * wasm/js-api/version.js: Added.
3222
3223 2017-05-10  JF Bastien  <jfbastien@apple.com>
3224
3225         WebAssemby: builder doesn't do Memory section maximum correctly
3226         https://bugs.webkit.org/show_bug.cgi?id=171931
3227
3228         Reviewed by Keith Miller.
3229
3230         * wasm/Builder.js:
3231         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
3232         * wasm/Builder_WebAssemblyBinary.js:
3233         (const.emitters.Memory):
3234         * wasm/function-tests/memory-grow-invalid.js: Added.
3235
3236 2017-05-10  JF Bastien  <jfbastien@apple.com>
3237
3238         WebAssembly: support name section
3239         https://bugs.webkit.org/show_bug.cgi?id=171263
3240
3241         Reviewed by Keith Miller.
3242
3243         * wasm/function-tests/nameSection.js: Added.
3244         (const.compile):
3245         * wasm/function-tests/nameSection.wasm: Added.
3246         * wasm/function-tests/stack-trace.js: Update format
3247
3248 2017-05-10  Filip Pizlo  <fpizlo@apple.com>
3249
3250         Null pointer dereference in WTF::RefPtr<WTF::StringImpl>::operator!() under slow_path_get_direct_pname
3251         https://bugs.webkit.org/show_bug.cgi?id=171801
3252
3253         Reviewed by Michael Saboff.
3254         
3255         These tests used to crash. The prefix and postfix tests cover different paths, except
3256         postfix-ignored goes down the same path as prefix due to an optimization.
3257
3258         * stress/for-in-postfix-ignored-index.js: Added.
3259         (foo):
3260         * stress/for-in-postfix-index.js: Added.
3261         (foo):
3262         * stress/for-in-prefix-index.js: Added.
3263         (foo):
3264
3265 2017-05-08  Mark Lam  <mark.lam@apple.com>
3266
3267         op_throw_static_error's use of its first operand should be reflected in DFG BytecodeUseDef as well.
3268         https://bugs.webkit.org/show_bug.cgi?id=171786
3269         <rdar://problem/32051023>
3270
3271         Reviewed by Saam Barati.
3272
3273         * stress/bug-171786.js: Added.
3274
3275 2017-05-06  Oleksandr Skachkov  <gskachkov@gmail.com>
3276
3277         [ES6] Arrow function. Issue in access to this after eval('super()') within constructor
3278         https://bugs.webkit.org/show_bug.cgi?id=171543
3279
3280         Reviewed by Saam Barati.
3281
3282         * stress/arrowfunction-lexical-bind-supercall-4.js:
3283         (J):
3284         (K):
3285
3286 2017-05-05  Saam Barati  <sbarati@apple.com>
3287
3288         putDirectIndex does not properly do defineOwnProperty
3289         https://bugs.webkit.org/show_bug.cgi?id=171591
3290         <rdar://problem/31735695>
3291
3292         Reviewed by Geoffrey Garen.
3293
3294         * stress/array-prototype-splice-making-typed-array.js:
3295         (test):
3296         * stress/array-species-config-array-constructor.js:
3297         (shouldThrow):
3298         (test):
3299         * stress/put-direct-index-broken-2.js: Added.
3300         (assert):
3301         (test):
3302         (makeLengthWritable):
3303         (set get restoreOldDesc):
3304         * stress/put-direct-index-broken.js: Added.
3305         (whatToTest):
3306         (tryRunning):
3307         (tryItOut):
3308         * stress/put-indexed-getter-setter.js: Added.
3309         (foo.X.prototype.set 7):
3310         (foo.X.prototype.get 7):
3311         (foo.X):
3312         (foo):
3313
3314 2017-05-04  Yusuke Suzuki  <utatane.tea@gmail.com>
3315
3316         [JSC] Math unary functions should be handled by DFG
3317         https://bugs.webkit.org/show_bug.cgi?id=171269
3318
3319         Reviewed by Saam Barati.
3320
3321         * stress/arith-acos-on-various-types.js: Added.
3322         (let.validInputTypedTestCases.validInputTestCases.map):
3323         (isIdentical):
3324         (opaqueACosNoArgument):
3325         (testNoArgument):
3326         (opaqueAllTypesACos):
3327         (testAllTypesCall):
3328         (testSingleTypeCall):
3329         (testConstant):
3330         (opaqueACosForSideEffects):
3331         (testSideEffect.let.testObject.valueOf):
3332         (testSideEffect):
3333         (opaqueACosForCSE):
3334         (testCSE.let.testObject.valueOf):
3335         (testCSE):
3336         (opaqueACosForDCE):
3337         (testDCE.let.testObject.valueOf):
3338         (testDCE):
3339         (testException.opaqueACosWithException):
3340         (testException):
3341         * stress/arith-acosh-on-various-types.js: Added.
3342         (let.validInputTypedTestCases.validInputTestCases.map):
3343         (isIdentical):
3344         (opaqueACoshNoArgument):
3345         (testNoArgument):
3346         (opaqueAllTypesACosh):
3347         (testAllTypesCall):
3348         (testSingleTypeCall):
3349         (testConstant):
3350         (opaqueACoshForSideEffects):
3351         (testSideEffect.let.testObject.valueOf):
3352         (testSideEffect):
3353         (opaqueACoshForCSE):
3354         (testCSE.let.testObject.valueOf):
3355         (testCSE):
3356         (opaqueACoshForDCE):
3357         (testDCE.let.testObject.valueOf):
3358         (testDCE):
3359         (testException.opaqueACoshWithException):
3360         (testException):
3361         * stress/arith-asin-on-various-types.js: Added.
3362         (let.validInputTypedTestCases.validInputTestCases.map):
3363         (isIdentical):
3364         (opaqueASinNoArgument):
3365         (testNoArgument):
3366         (opaqueAllTypesASin):
3367         (testAllTypesCall):
3368         (testSingleTypeCall):
3369         (testConstant):
3370         (opaqueASinForSideEffects):
3371         (testSideEffect.let.testObject.valueOf):
3372         (testSideEffect):
3373         (opaqueASinForCSE):
3374         (testCSE.let.testObject.valueOf):
3375         (testCSE):
3376         (opaqueASinForDCE):
3377         (testDCE.let.testObject.valueOf):
3378         (testDCE):
3379         (testException.opaqueASinWithException):
3380         (testException):
3381         * stress/arith-asinh-on-various-types.js: Added.
3382         (let.validInputTypedTestCases.validInputTestCases.map):
3383         (isIdentical):
3384         (opaqueASinhNoArgument):
3385         (testNoArgument):
3386         (opaqueAllTypesASinh):
3387         (testAllTypesCall):
3388         (testSingleTypeCall):
3389         (testConstant):
3390         (opaqueASinhForSideEffects):
3391         (testSideEffect.let.testObject.valueOf):
3392         (testSideEffect):
3393         (opaqueASinhForCSE):
3394         (testCSE.let.testObject.valueOf):
3395         (testCSE):
3396         (opaqueASinhForDCE):
3397         (testDCE.let.testObject.valueOf):
3398         (testDCE):
3399         (testException.opaqueASinhWithException):
3400         (testException):
3401         * stress/arith-atan-on-various-types.js: Added.
3402         (let.validInputTypedTestCases.validInputTestCases.map):
3403         (isIdentical):
3404         (opaqueATanNoArgument):
3405         (testNoArgument):
3406         (opaqueAllTypesATan):
3407         (testAllTypesCall):
3408         (testSingleTypeCall):
3409         (testConstant):
3410         (opaqueATanForSideEffects):
3411         (testSideEffect.let.testObject.valueOf):
3412         (testSideEffect):
3413         (opaqueATanForCSE):
3414         (testCSE.let.testObject.valueOf):
3415         (testCSE):
3416         (opaqueATanForDCE):
3417         (testDCE.let.testObject.valueOf):
3418         (testDCE):
3419         (testException.opaqueATanWithException):
3420         (testException):
3421         * stress/arith-atanh-on-various-types.js: Added.
3422         (let.validInputTypedTestCases.validInputTestCases.map):
3423         (isIdentical):
3424         (opaqueATanhNoArgument):
3425         (testNoArgument):
3426         (opaqueAllTypesATanh):
3427         (testAllTypesCall):
3428         (testSingleTypeCall):
3429         (testConstant):
3430         (opaqueATanhForSideEffects):
3431         (testSideEffect.let.testObject.valueOf):
3432         (testSideEffect):
3433         (opaqueATanhForCSE):
3434         (testCSE.let.testObject.valueOf):
3435         (testCSE):
3436         (opaqueATanhForDCE):
3437         (testDCE.let.testObject.valueOf):
3438         (testDCE):
3439         (testException.opaqueATanhWithException):
3440         (testException):
3441         * stress/arith-cbrt-on-various-types.js: Added.
3442         (let.validInputTypedTestCases.validInputTestCases.map):
3443         (isIdentical):
3444         (opaqueCbrtNoArgument):
3445         (testNoArgument):
3446         (opaqueAllTypesCbrt):
3447         (testAllTypesCall):
3448         (testSingleTypeCall):
3449         (testConstant):
3450         (opaqueCbrtForSideEffects):
3451         (testSideEffect.let.testObject.valueOf):
3452         (testSideEffect):
3453         (opaqueCbrtForCSE):
3454         (testCSE.let.testObject.valueOf):
3455         (testCSE):
3456         (opaqueCbrtForDCE):
3457         (testDCE.let.testObject.valueOf):
3458         (testDCE):
3459         (testException.opaqueCbrtWithException):
3460         (testException):
3461         * stress/arith-cosh-on-various-types.js: Added.
3462         (let.validInputTypedTestCases.validInputTestCases.map):
3463         (isIdentical):
3464         (opaqueCoshNoArgument):
3465         (testNoArgument):
3466         (opaqueAllTypesCosh):
3467         (testAllTypesCall):
3468         (testSingleTypeCall):
3469         (testConstant):
3470         (opaqueCoshForSideEffects):
3471         (testSideEffect.let.testObject.valueOf):
3472         (testSideEffect):
3473         (opaqueCoshForCSE):
3474         (testCSE.let.testObject.valueOf):
3475         (testCSE):
3476         (opaqueCoshForDCE):
3477         (testDCE.let.testObject.valueOf):
3478         (testDCE):
3479         (testException.opaqueCoshWithException):
3480         (testException):
3481         * stress/arith-expm1-on-various-types.js: Added.
3482         (let.validInputTypedTestCases.validInputTestCases.map):
3483         (isIdentical):
3484         (opaqueExpm1NoArgument):
3485         (testNoArgument):
3486         (opaqueAllTypesExpm1):
3487         (testAllTypesCall):
3488         (testSingleTypeCall):
3489         (testConstant):
3490         (opaqueExpm1ForSideEffects):
3491         (testSideEffect.let.testObject.valueOf):
3492         (testSideEffect):
3493         (opaqueExpm1ForCSE):
3494         (testCSE.let.testObject.valueOf):
3495         (testCSE):
3496         (opaqueExpm1ForDCE):
3497         (testDCE.let.testObject.valueOf):
3498         (testDCE):
3499         (testException.opaqueExpm1WithException):
3500         (testException):
3501         * stress/arith-log10-on-various-types.js: Added.
3502         (let.validInputTypedTestCases.validInputTestCases.map):
3503         (isIdentical):
3504         (opaqueLog10NoArgument):
3505         (testNoArgument):
3506         (opaqueAllTypesLog10):
3507         (testAllTypesCall):
3508         (testSingleTypeCall):
3509         (testConstant):
3510         (opaqueLog10ForSideEffects):
3511         (testSideEffect.let.testObject.valueOf):
3512         (testSideEffect):
3513         (opaqueLog10ForCSE):
3514         (testCSE.let.testObject.valueOf):
3515         (testCSE):
3516         (opaqueLog10ForDCE):
3517         (testDCE.let.testObject.valueOf):
3518         (testDCE):
3519         (testException.opaqueLog10WithException):
3520         (testException):
3521         * stress/arith-log2-on-various-types.js: Added.
3522         (let.validInputTypedTestCases.validInputTestCases.map):
3523         (isIdentical):
3524         (opaqueLog2NoArgument):
3525         (testNoArgument):
3526         (opaqueAllTypesLog2):
3527         (testAllTypesCall):
3528         (testSingleTypeCall):
3529         (testConstant):
3530         (opaqueLog2ForSideEffects):
3531         (testSideEffect.let.testObject.valueOf):
3532         (testSideEffect):
3533         (opaqueLog2ForCSE):
3534         (testCSE.let.testObject.valueOf):
3535         (testCSE):
3536         (opaqueLog2ForDCE):
3537         (testDCE.let.testObject.valueOf):
3538         (testDCE):
3539         (testException.opaqueLog2WithException):
3540         (testException):
3541         * stress/arith-sinh-on-various-types.js: Added.
3542         (let.validInputTypedTestCases.validInputTestCases.map):
3543         (isIdentical):
3544         (opaqueSinhNoArgument):
3545         (testNoArgument):
3546         (opaqueAllTypesSinh):
3547         (testAllTypesCall):
3548         (testSingleTypeCall):
3549         (testConstant):
3550         (opaqueSinhForSideEffects):
3551         (testSideEffect.let.testObject.valueOf):
3552         (testSideEffect):
3553         (opaqueSinhForCSE):
3554         (testCSE.let.testObject.valueOf):
3555         (testCSE):
3556         (opaqueSinhForDCE):
3557         (testDCE.let.testObject.valueOf):
3558         (testDCE):
3559         (testException.opaqueSinhWithException):
3560         (testException):
3561         * stress/arith-tan-on-various-types.js:
3562         (isIdentical):
3563         * stress/arith-tanh-on-various-types.js: Added.
3564         (let.validInputTypedTestCases.validInputTestCases.map):
3565         (isIdentical):
3566         (opaqueTanhNoArgument):
3567         (testNoArgument):
3568         (opaqueAllTypesTanh):
3569         (testAllTypesCall):
3570         (testSingleTypeCall):
3571         (testConstant):
3572         (opaqueTanhForSideEffects):
3573         (testSideEffect.let.testObject.valueOf):
3574         (testSideEffect):
3575         (opaqueTanhForCSE):
3576         (testCSE.let.testObject.valueOf):
3577         (testCSE):
3578         (opaqueTanhForDCE):
3579         (testDCE.let.testObject.valueOf):
3580         (testDCE):
3581         (testException.opaqueTanhWithException):
3582         (testException):
3583
3584 2017-05-03  Keith Miller  <keith_miller@apple.com>
3585
3586         Array.prototype.sort should also allow a null comparator
3587         https://bugs.webkit.org/show_bug.cgi?id=171621
3588
3589         Reviewed by Michael Saboff.
3590
3591         Add test to make it less likely we revert to the incompatable behavior.
3592         Also, fix now incorrect tests.
3593
3594         * ChakraCore/test/Array/array_sort.baseline-jsc:
3595         * stress/array-sort-bad-comparator.js:
3596         (test):
3597         * stress/sort-null-comparator.js: Added.
3598         (assertEq):
3599
3600 2017-05-03  Caitlin Potter  <caitp@igalia.com>
3601
3602         [JSC] remove unneeded asyncFunctionTests.yaml
3603         https://bugs.webkit.org/show_bug.cgi?id=171611
3604
3605         Reviewed by Yusuke Suzuki.
3606
3607         Async functions have shipped, and those tests are run as part of
3608         JSTests/stress and JSTests/test262.yaml. The file is no longer needed.
3609
3610         * asyncFunctionTests.yaml: Removed.
3611         * stress/async-await-long-loop.js:
3612         * stress/async-await-throw-loop.js:
3613
3614 2017-05-03  Keith Miller  <keith_miller@apple.com>
3615
3616         Different behaviour with the .sort(callback) method (unlike Firefox & Chrome)
3617         https://bugs.webkit.org/show_bug.cgi?id=47825
3618
3619         Reviewed by Saam Barati.
3620
3621         * stress/sorting-boolean-result-comparator.js: Added.
3622         (checkArray):
3623
3624 2017-05-02  David Kilzer  <ddkilzer@apple.com>
3625
3626         check-webkit-style should keep JavaScript test functions in sync
3627         <https://webkit.org/b/171424>
3628
3629         Reviewed by Joseph Pecoraro.
3630
3631         This change makes shouldBe(), shouldNotBe(), shouldNotThrow()
3632         and shouldThrow() in sync with other copies of these methods.
3633
3634         * stress/resources/standalone-pre.js:
3635         (shouldBe): Fix whitespace.  Prefix 'exception' and 'quiet'
3636         variables with underscore.
3637         (shouldThrow): Fix whitespace.
3638
3639 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3640
3641         We initialize functions too early in an eval
3642         https://bugs.webkit.org/show_bug.cgi?id=161099
3643
3644         Reviewed by Saam Barati.
3645
3646         * stress/eval-func-decl-with-let-const-class.js: Added.
3647
3648 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3649
3650         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
3651         https://bugs.webkit.org/show_bug.cgi?id=163208
3652
3653         Reviewed by Saam Barati.
3654
3655         * stress/eval-func-decl-block-scoping-reassign.js: Added.
3656         (assert):
3657         (throw.new.Error.f):
3658         (throw.new.Error):
3659         * stress/eval-func-decl-block-with-remove.js: Added.
3660         (assert):
3661         (foo.boo):
3662         (foo):
3663         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
3664         (assert):
3665         (assertThrow):
3666         (foo):
3667         (boo):
3668         (joo):
3669         (koo):
3670         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
3671         (assert):
3672         (assertThrow):
3673         (foo):
3674         (boo):
3675         (hoo):
3676         (joo):
3677         (koo):
3678         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
3679         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
3680         (assert):
3681         (assertThrow):
3682         (foo):
3683         (boo):
3684         (goo):
3685         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
3686         (assert):
3687         (assertThrow):
3688         (foo):
3689         (boo):
3690         (boo.let.val2):
3691         (boo.let.val3):
3692         * stress/eval-func-decl-in-frozen-global.js: Added.
3693         (assert):
3694         (assertThrow):
3695         (throw.new.Error):
3696         (Object.freeze):
3697         * stress/eval-func-decl-in-global-of-eval.js: Added.
3698         (assert):
3699         (assertThrow):
3700         (bar):
3701         (baz):
3702         (foobar):
3703         * stress/eval-func-decl-in-global.js: Added.
3704         (assert):
3705         (assertThrow):
3706         * stress/eval-func-decl-in-if.js: Added.
3707         (assert):
3708         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
3709         (assert):
3710         (assertThrow):
3711         (foo):
3712         (boo):
3713         (foobar):
3714         (hoo):
3715         (joo):
3716         (koo):
3717         (loo):
3718         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
3719         (assert):
3720         (assertThrow):
3721         (foo):
3722         (boo):
3723         (goo):
3724         * stress/variable-under-tdz-eval-tricky.js:
3725         (assert):
3726         * test262.yaml:
3727
3728 2017-04-27  Mark Lam  <mark.lam@apple.com>
3729
3730         Fix some RELEASE_ASSERT failures caused by OutOfMemoryErrors.
3731         https://bugs.webkit.org/show_bug.cgi?id=171404
3732         <rdar://problem/31876178>
3733
3734         Reviewed by Saam Barati.
3735
3736         * stress/js-fixed-array-out-of-memory.js: Added.
3737
3738 2017-04-27  David Kilzer  <ddkilzer@apple.com>
3739
3740         Enhance shouldBe()/shouldNotBe() to accept anonymous function arguments
3741         <https://webkit.org/b/171362>
3742         <rdar://problem/31867686>
3743
3744         Reviewed by Joseph Pecoraro.
3745
3746         * stress/resources/standalone-pre.js:
3747         (shouldBe):
3748         (shouldNotThrow):
3749         (shouldThrow):
3750         - Update shouldBe() to accept anonymous function arguments.
3751           (The shouldNotBe() function was never copied over.)
3752         - Also fix shouldThrow()/shouldNotThrow() to accept anonymous
3753           function arguments (which were missed in r202609 for Bug
3754           159232).
3755
3756 2017-04-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3757
3758         [JSC] Handle PhantomSpread in LoadVarargs as the same to the others
3759         https://bugs.webkit.org/show_bug.cgi?id=171262
3760
3761         Reviewed by Saam Barati.
3762
3763         * stress/spread-outer-create-rest.js: Added.
3764         (assert):
3765         (foo):
3766         (bar):
3767         (baz):
3768
3769 2017-04-26  Saam Barati  <sbarati@apple.com>
3770
3771         Print Wasm function index in stack trace
3772         https://bugs.webkit.org/show_bug.cgi?id=171349
3773
3774         Reviewed by JF Bastien.
3775
3776         * wasm/function-tests/stack-trace.js: Added.
3777         (import.Builder.from.string_appeared_here.assert):
3778         (let.imp):
3779         * wasm/function-tests/trap-after-cross-instance-call.js:
3780         (wasmFrameCountFromError):
3781         * wasm/function-tests/trap-load-2.js:
3782         (wasmFrameCountFromError):
3783         * wasm/function-tests/trap-load.js:
3784         (wasmFrameCountFromError):
3785
3786 2017-04-26  Saam Barati  <sbarati@apple.com>
3787
3788         ASSERTION FAILED: inIndex != notFound in JSC::invalidParameterInSourceAppender()
3789         https://bugs.webkit.org/show_bug.cgi?id=170924
3790         <rdar://problem/31721052>
3791
3792         Reviewed by Mark Lam.
3793
3794         * stress/error-message-for-function-base-not-found.js: Added.
3795         (assert):
3796         (throw.new.Error):
3797         * stress/error-messages-for-in-operator-should-not-crash.js: Added.
3798         (catch):
3799
3800 2017-04-26  Keith Miller  <keith_miller@apple.com>
3801
3802         WebAssembly: Implement tier up
3803         https://bugs.webkit.org/show_bug.cgi?id=170134
3804
3805         Reviewed by Filip Pizlo.
3806
3807         * wasm/function-tests/trap-after-cross-instance-call.js:
3808         * wasm/tier-up/js-to-wasm.js: Added.
3809         (async.test):
3810         * wasm/tier-up/wasm-to-wasm.js: Added.
3811         (async.test):
3812
3813 2017-04-26  Caitlin Potter  <caitp@igalia.com>
3814
3815         [JSC] Object.keys() must discard property names with no PropertyDescriptor
3816         https://bugs.webkit.org/show_bug.cgi?id=171291
3817
3818         Reviewed by Yusuke Suzuki.
3819
3820         * es6/Proxy_ownKeys_duplicates.js:
3821         * stress/proxy-own-keys.js:
3822         (let.handler.getOwnPropertyDescriptor):
3823         (let.handler.ownKeys):
3824
3825 2017-04-25  Commit Queue  <commit-queue@webkit.org>
3826
3827         Unreviewed, rolling out r215476.
3828         https://bugs.webkit.org/show_bug.cgi?id=171304
3829
3830         "It broke JSBench" (Requested by saamyjoon on #webkit).
3831
3832         Reverted changeset:
3833
3834         "[ES6]. Implement Annex B.3.3 function hoisting rules for
3835         eval"
3836         https://bugs.webkit.org/show_bug.cgi?id=163208
3837         http://trac.webkit.org/changeset/215476
3838
3839 2017-04-25  Saam Barati  <sbarati@apple.com>
3840
3841         JSArray::isArrayPrototypeIteratorProtocolFastAndNonObservable is wrong because it does not do the necessary checks on the base object
3842         https://bugs.webkit.org/show_bug.cgi?id=171150
3843         <rdar://problem/31771880>
3844
3845         Reviewed by Sam Weinig.
3846
3847         * stress/spread-optimized-properly.js: Added.
3848         (assert):
3849         (test):
3850         (shallowEq):
3851         (makeArrayIterator):
3852         (test.bar):
3853         (test.callback):
3854         (test.arr.__proto__.Symbol.iterator):
3855         (test.arr.Symbol.iterator):
3856         (test.get bar):
3857         (test.hackedNext):
3858         (test.test):
3859         (test.):
3860
3861 2017-04-25  Mark Lam  <mark.lam@apple.com>
3862
3863         [Follow up] Array.prototype.slice() should ensure that end >= begin.
3864         https://bugs.webkit.org/show_bug.cgi?id=170989
3865         <rdar://problem/31705652>
3866
3867         Not reviewed.
3868
3869         Follow up to rename a test file that was accidentally named wrongly.
3870
3871         * stress/regress-170989.js: Copied from JSTests/stress/regress-170989.patch.
3872         * stress/regress-170989.patch: Removed.
3873
3874 2017-04-25  Mark Lam  <mark.lam@apple.com>
3875
3876         Array.prototype.slice() should ensure that end >= begin.
3877         https://bugs.webkit.org/show_bug.cgi?id=170989
3878         <rdar://problem/31705652>
3879
3880         Reviewed by Saam Barati.
3881
3882         * stress/regress-170989.patch: Added.
3883
3884 2017-04-25  Mark Lam  <mark.lam@apple.com>
3885
3886         Local CSE wrongly CSEs array accesses with different result types.
3887         https://bugs.webkit.org/show_bug.cgi?id=170990
3888         <rdar://problem/31705945>
3889
3890         Reviewed by Saam Barati.
3891
3892         * stress/regress-170990.js: Added.
3893
3894 2017-04-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3895
3896         WebAssembly: exporting a property with a name that's a number doesn't work
3897         https://bugs.webkit.org/show_bug.cgi?id=168857
3898
3899         Reviewed by JF Bastien.
3900
3901         r213453 allows Wasm instances to expose indexed properties. We activate the tests.
3902
3903         * wasm/js-api/test_Instance.js:
3904         (ExportedNumber):
3905
3906 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3907
3908         test262: test262/test/language/expressions/object/method-definition/early-errors-object-method-duplicate-parameters.js
3909         https://bugs.webkit.org/show_bug.cgi?id=171190
3910
3911         Reviewed by Saam Barati.
3912
3913         * stress/async-await-syntax.js:
3914         * test262.yaml:
3915
3916 2017-04-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3917
3918         [JSC] Use JSFixedArray directly when using call_varargs
3919         https://bugs.webkit.org/show_bug.cgi?id=171057
3920
3921         Reviewed by Saam Barati.
3922
3923         * stress/spread-capture-rest.js: Added.
3924         (shouldBe):
3925         (capture):
3926         (a):
3927         (b):
3928         * stress/spread-multi-layers.js: Added.
3929         (shouldBe):
3930         (a):
3931         (b):
3932         (c):
3933         (d):
3934         * stress/spread-non-varargs.js: Added.
3935         (shouldBe):
3936         (a):
3937         (b):
3938
3939 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3940
3941         test262: test262/test/language/computed-property-names/class/static/getter-prototype.js
3942         https://bugs.webkit.org/show_bug.cgi?id=170897
3943
3944         Reviewed by Saam Barati.
3945
3946         * test262.yaml:
3947
3948 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3949
3950         Address some FIXMEs in JavaScript tests for bugs that have been fixed
3951         https://bugs.webkit.org/show_bug.cgi?id=171191
3952
3953         Reviewed by JF Bastien.
3954
3955         * stress/proxy-is-extensible.js:
3956
3957 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3958
3959         test262: test262/test/language/statements/for-of/dstr-array-elem-init-fn-name-arrow.js
3960         https://bugs.webkit.org/show_bug.cgi?id=171160
3961
3962         Reviewed by JF Bastien.
3963
3964         * stress/inferred-names.js:
3965         * test262.yaml:
3966
3967 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3968
3969         test262: test262/test/language/expressions/generators/yield-as-label.js
3970         https://bugs.webkit.org/show_bug.cgi?id=170979
3971
3972         Reviewed by Saam Barati.
3973
3974         * stress/async-await-module-reserved-word.js:
3975         * stress/async-await-reserved-word.js:
3976         Converge on "Cannot" instead of "Can't".
3977
3978         * catch-parameter-syntax.js:
3979         * yield-named-variable-generator.js:
3980         * yield-named-variable.js:
3981         * stress/yield-label-generator.js:
3982         * stress/yield-label.js:
3983         * stress/yield-reserved-word.js: Added.
3984         More complete list of when 'yield' is allowed.
3985
3986         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
3987         * test262.yaml:
3988
3989 2017-04-23  Commit Queue  <commit-queue@webkit.org>
3990
3991         Unreviewed, rolling out r215674.
3992         https://bugs.webkit.org/show_bug.cgi?id=171212
3993
3994         Possible unintended commit. This patch was on the wrong bug.
3995         (Requested by JoePeck on #webkit).
3996
3997         Reverted changeset:
3998
3999         "test262: test262/test/language/expressions/generators/yield-
4000         as-label.js"
4001         https://bugs.webkit.org/show_bug.cgi?id=170979
4002         http://trac.webkit.org/changeset/215674
4003
4004 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
4005
4006         test262: test262/test/built-ins/Number/prototype/toPrecision/nan.js
4007         https://bugs.webkit.org/show_bug.cgi?id=171197
4008
4009         Reviewed by Saam Barati.
4010
4011         * test262.yaml:
4012
4013 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
4014
4015         test262: test262/test/language/expressions/generators/yield-as-label.js
4016         https://bugs.webkit.org/show_bug.cgi?id=170979
4017
4018         Reviewed by Saam Barati.
4019
4020         * stress/async-await-module-reserved-word.js:
4021         * stress/async-await-reserved-word.js:
4022         Converge on "Cannot" instead of "Can't".
4023
4024         * catch-parameter-syntax.js:
4025         * yield-named-variable-generator.js:
4026         * yield-named-variable.js:
4027         * stress/yield-label-generator.js:
4028         * stress/yield-label.js:
4029         * stress/yield-reserved-word.js: Added.
4030         More complete list of when 'yield' is allowed.
4031
4032         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
4033         * test262.yaml:
4034
4035 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
4036
4037         test262: test262/test/built-ins/Number/parseFloat.js
4038         https://bugs.webkit.org/show_bug.cgi?id=171193
4039
4040         Reviewed by Yusuke Suzuki.
4041
4042         * test262.yaml:
4043
4044 2017-04-22  JF Bastien  <jfbastien@apple.com>
4045
4046         WebAssembly: Module.exports, Module.imports, Module.customSections are wrong
4047         https://bugs.webkit.org/show_bug.cgi?id=171078
4048
4049         Reviewed by Saam Barati.
4050
4051         They're static properties of Module, not instance properties of a module.
4052         https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymoduleexports
4053
4054         * wasm/js-api/Module.customSection.js:
4055         (assert.throws.WebAssembly.Module.customSections):
4056         (assert.eq):
4057         (assert.throws.WebAssembly.Module.prototype.customSections): Deleted.
4058         * wasm/js-api/Module.exports.js:
4059         (assert.throws.WebAssembly.Module.exports):
4060         (assert.truthy):
4061         (assert.throws.WebAssembly.Module.prototype.exports): Deleted.
4062         * wasm/js-api/Module.imports.js:
4063         (assert.throws.WebAssembly.Module.imports):
4064         (assert.truthy):
4065         (assert.throws.WebAssembly.Module.prototype.imports): Deleted.
4066
4067 2017-04-21  JF Bastien  <jfbastien@apple.com>
4068
4069         Silence noisy test
4070
4071         Unreviewed, Fil / Michael and I talked about it in the corridor. I
4072         just forgot to set verbose to false before commit.
4073
4074         * wasm/stress/oom.js:
4075
4076 2017-04-20  Yusuke Suzuki  <utatane.tea@gmail.com>
4077
4078         [JSC][FTL] FTL should support Arrayify
4079         https://bugs.webkit.org/show_bug.cgi?id=169596
4080
4081         Reviewed by Saam Barati.
4082
4083         * stress/arrayify.js: Added.
4084         (arrayifyInt32):
4085         (arrayifyDouble):
4086         (arrayifyContiguous):
4087
4088 2017-04-20  Mark Lam  <mark.lam@apple.com>
4089
4090         virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.
4091         https://bugs.webkit.org/show_bug.cgi?id=171079
4092         <rdar://problem/31684756>
4093
4094         Reviewed by Saam Barati.
4095
4096         * stress/regress-171079.js: Added.
4097
4098 2017-04-15  Filip Pizlo  <fpizlo@apple.com>
4099
4100         Optimize SharedArrayBuffer in the DFG+FTL
4101         https://bugs.webkit.org/show_bug.cgi?id=164108
4102
4103         Reviewed by Saam Barati.
4104         
4105         Added a fairly comprehensive test of the intrinsics. This creates a function for each possible
4106         combination of type and operation, and then first uses it nicely and then tries a bunch of
4107         erroneous conditions like OOB.
4108
4109         * stress/SharedArrayBuffer-opt.js: Added.
4110         (string_appeared_here.switch):
4111         (string_appeared_here.str):
4112         (runAtomic):
4113         (shouldFail):
4114         (Symbol):
4115         (string_appeared_here.a.of.arrays.m.of.atomics):
4116         * stress/SharedArrayBuffer.js:
4117
4118 2017-04-19  Mark Lam  <mark.lam@apple.com>
4119
4120         B3StackmapSpecial should handle when stackmap values are not recoverable from a Def'ed arg.
4121         https://bugs.webkit.org/show_bug.cgi?id=170973
4122         <rdar://problem/30318657>
4123
4124         Reviewed by Filip Pizlo.
4125
4126         * stress/regress-170973.js: Added.
4127
4128 2017-04-19  JF Bastien  <jfbastien@apple.com>
4129
4130         WebAssembly: limit slow memories
4131         https://bugs.webkit.org/show_bug.cgi?id=170825
4132
4133         Reviewed by Saam Barati.
4134
4135         * wasm.yaml:
4136         * wasm/stress/oom.js: Added.
4137         (try.true.WebAssemblyMemoryMode):
4138         (catch):
4139
4140 2017-04-19  JF Bastien  <jfbastien@apple.com>
4141
4142         WebAssembly: don't expose any WebAssembly JS object if JIT is off
4143         https://bugs.webkit.org/show_bug.cgi?id=170782
4144
4145         Reviewed by Saam Barati.
4146
4147         * wasm.yaml:
4148         * wasm/noJIT/noJIT.js: Added.
4149
4150 2017-04-18  Mark Lam  <mark.lam@apple.com>
4151
4152         r211670 broke double to int conversion.
4153         https://bugs.webkit.org/show_bug.cgi?id=170961
4154         <rdar://problem/31687696>
4155
4156         Reviewed by Yusuke Suzuki.
4157
4158         * microbenchmarks/double-to-int32.js: Added.
4159         * stress/to-int32-sensible2.js: Added.
4160
4161 2017-04-18  Oleksandr Skachkov  <gskachkov@gmail.com>
4162
4163         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
4164         https://bugs.webkit.org/show_bug.cgi?id=163208
4165
4166         Reviewed by Saam Barati.
4167
4168         * stress/eval-func-decl-block-scoping-reassign.js: Added.
4169         (assert):
4170         (throw.new.Error.f):
4171         (throw.new.Error):
4172         * stress/eval-func-decl-block-with-remove.js: Added.
4173         (assert):
4174         (foo.boo):
4175         (foo):
4176         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
4177         (assert):
4178         (assertThrow):
4179         (foo):
4180         (boo):
4181         (joo):
4182         (koo):
4183         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
4184         (assert):
4185         (assertThrow):
4186         (foo):
4187         (boo):
4188         (hoo):
4189         (joo):
4190         (koo):
4191         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
4192         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
4193         (assert):
4194         (assertThrow):
4195         (foo):
4196         (boo):
4197         (goo):
4198         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
4199         (assert):
4200         (assertThrow):
4201         (foo):
4202         (boo):
4203         (boo.let.val2):
4204         (boo.let.val3):
4205         * stress/eval-func-decl-in-frozen-global.js: Added.
4206         (assert):
4207         (assertThrow):
4208         (throw.new.Error):
4209         (Object.freeze):
4210         * stress/eval-func-decl-in-global-of-eval.js: Added.
4211         (assert):
4212         (assertThrow):
4213         (bar):
4214         (baz):
4215         (foobar):
4216         * stress/eval-func-decl-in-global.js: Added.
4217         (assert):
4218         (assertThrow):
4219         * stress/eval-func-decl-in-if.js: Added.
4220         (assert):
4221         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
4222         (assert):
4223         (assertThrow):
4224         (foo):
4225         (boo):
4226         (foobar):
4227         (hoo):
4228         (joo):
4229         (koo):
4230         (loo):
4231         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
4232         (assert):
4233         (assertThrow):
4234         (foo):
4235         (boo):
4236         (goo):
4237         * stress/variable-under-tdz-eval-tricky.js:
4238         (assert):
4239         * test262.yaml:
4240
4241 2017-04-18  Filip Pizlo  <fpizlo@apple.com>
4242
4243         wasm/function-tests/memory-multiagent times out sometimes
4244         https://bugs.webkit.org/show_bug.cgi?id=170958
4245
4246         Reviewed by Keith Miller.
4247         
4248         Add the ability to skip tests easily. Skip the test.
4249
4250         * wasm.yaml:
4251         * wasm/function-tests/memory-multiagent.js:
4252
4253 2017-04-18  Saam Barati  <sbarati@apple.com>
4254
4255         Follow up to debug build stack overflow in test after r215453
4256
4257         Rubber stamped by Mark Lam.
4258
4259         * stress/call-apply-exponential-bytecode-size.js: Decrease the call
4260         size to prevent stack overflow errors on debug builds.
4261
4262 2017-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
4263
4264         [DFG] Convert ValueAdd(Int32, String) => MakeRope(ToString(Int32), String)
4265         https://bugs.webkit.org/show_bug.cgi?id=170943
4266
4267         Reviewed by Geoffrey Garen.
4268
4269         * microbenchmarks/number-to-string-with-add-empty.js: Added.
4270         (toStringLeft):
4271         (toStringRight):
4272         * microbenchmarks/number-to-string-with-add-in-loop.js: Added.
4273         (toStringLeft):
4274         (toStringRight):
4275         * microbenchmarks/number-to-string-with-add.js: Added.
4276         (toStringLeft):
4277         (toStringRight):
4278         * stress/number-to-string-with-add.js: Added.
4279         (shouldBe):
4280         (toStringRight):
4281         (toStringLeftEmpty):
4282         (toStringRightEmpty):
4283
4284 2017-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
4285
4286         [DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object
4287         https://bugs.webkit.org/show_bug.cgi?id=170940
4288
4289         Reviewed by Filip Pizlo.
4290
4291         * microbenchmarks/for-of-array.js: Added.
4292         (fn):
4293
4294 2017-04-17  Saam Barati  <sbarati@apple.com>
4295
4296         BytecodeGenerator ".call" and ".apply" is exponential in nesting depth
4297         https://bugs.webkit.org/show_bug.cgi?id=139847
4298         <rdar://problem/19321122>
4299
4300         Reviewed by Oliver Hunt.
4301
4302         * stress/call-apply-exponential-bytecode-size.js: Added.
4303         (assert):
4304         (const.inc):
4305         (const.inc2):
4306         (bar):
4307         (randomApplyOrCall):
4308         (baz):
4309         (jaz):
4310         (haz):
4311         (foo):
4312
4313 2017-04-17  Mark Lam  <mark.lam@apple.com>
4314
4315         JSArray::appendMemcpy() needs to handle copying from Undecided indexing type too.
4316         https://bugs.webkit.org/show_bug.cgi?id=170896
4317         <rdar://problem/31651319>
4318
4319         Reviewed by JF Bastien and Keith Miller.
4320
4321         * stress/regress-170896.js: Added.
4322
4323 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
4324
4325         test262: test262/test/built-ins/Object/prototype/toLocaleString/primitive_this_value.js
4326         https://bugs.webkit.org/show_bug.cgi?id=170882
4327
4328         Reviewed by Saam Barati.
4329
4330         * test262.yaml:
4331
4332 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
4333
4334         test262: test262/test/built-ins/isNaN/toprimitive-not-callable-throws.js
4335         https://bugs.webkit.org/show_bug.cgi?id=170888
4336
4337         Reviewed by Saam Barati.
4338
4339         * stress/computed-accessor.js:
4340         * stress/eval-in-arrow-function.js:
4341         * stress/rest-elements.js:
4342         * stress/string-object-define-own-property.js:
4343         Remove unused shouldThrow.
4344
4345         * stress/symbol-toprimitive-errors.js: Added.
4346         Check for ToPrimitive TypeErrors.
4347
4348         * test262.yaml:
4349
4350 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
4351
4352         test262: test262/test/language/expressions/tagged-template/template-object.js
4353         https://bugs.webkit.org/show_bug.cgi?id=170878
4354
4355         Reviewed by Saam Barati.
4356
4357         * stress/array-length-not-writable.js: Added.
4358         (assert):
4359         * test262.yaml:
4360
4361 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
4362
4363         test262: test262/test/built-ins/Object/getOwnPropertyNames/15.2.3.4-4-44.js
4364         https://bugs.webkit.org/show_bug.cgi?id=170879
4365
4366         Reviewed by Saam Barati.
4367
4368         * ChakraCore/test/es5/enumerable.baseline-jsc:
4369         * test262.yaml:
4370
4371 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
4372
4373         test262: test262/test/built-ins/Date/prototype/Symbol.toPrimitive/name.js
4374         https://bugs.webkit.org/show_bug.cgi?id=170884
4375
4376         Reviewed by Yusuke Suzuki.
4377
4378         * test262.yaml:
4379
4380 2017-04-15  Joseph Pecoraro  <pecoraro@apple.com>
4381
4382         test262: test262/test/language/global-code/new.target-arrow.js
4383         https://bugs.webkit.org/show_bug.cgi?id=170872
4384
4385         Reviewed by Saam Barati.
4386
4387         * stress/async-arrow-functions-lexical-new.target-binding.js:
4388         (shouldThrowAsync): Deleted.
4389         (shouldThrowAsync.async): Deleted.
4390         This code should have thrown a SyntaxError. Instead it was throwing
4391         a ReferenceError for the internal @newTargetLocal variable.
4392
4393         * stress/new-target-syntax-errors.js:
4394         Cover the arrow function in global code cases.
4395
4396         * ChakraCore.yaml:
4397         * ChakraCore/test/es6/globalLambdaNewTargetSyntaxError.baseline-jsc:
4398         We now pass with an expected SyntaxError. Our error message is different.
4399
4400         * test262.yaml:
4401
4402 2017-04-14  Saam Barati  <sbarati@apple.com>
4403
4404         ParseInt intrinsic in DFG backend doesn't properly flush its operands
4405         https://bugs.webkit.org/show_bug.cgi?id=170865
4406
4407         Reviewed by Mark Lam and Geoffrey Garen.
4408
4409         * stress/parse-int-intrinsic-dfg-backend-flush.js: Added.
4410         (assert):
4411         (foo):
4412
4413 2017-04-14  Caitlin Potter  <caitp@igalia.com>
4414
4415         [JSC] use ExpressionErrorClassifier for AwaitExpression operand
4416         https://bugs.webkit.org/show_bug.cgi?id=170844
4417
4418         Reviewed by Saam Barati.
4419
4420         * stress/regress-170732.js: Added.
4421
4422 2017-04-14  Oleksandr Skachkov  <gskachkov@gmail.com>
4423
4424         Safari 10.1 JSON.parse returns incorrect object for numeric keys with decimal values
4425         https://bugs.webkit.org/show_bug.cgi?id=170442
4426
4427         Reviewed by Yusuke Suzuki.
4428
4429         * stress/object-number-properties.js:
4430
4431 2017-04-13  Yusuke Suzuki  <utatane.tea@gmail.com>
4432
4433         [JSC] Date.parse should accept wider range of representation
4434         https://bugs.webkit.org/show_bug.cgi?id=170720
4435
4436         Reviewed by Darin Adler.
4437
4438         * stress/date-relaxed.js: Added.
4439         (shouldBe):
4440         (throw.new.Error):
4441
4442 2017-04-13  Mark Lam  <mark.lam@apple.com>
4443
4444         Should use flushDirect() when flushing the scopeRegister due to needsScopeRegister().
4445         https://bugs.webkit.org/show_bug.cgi?id=170661
4446         <rdar://problem/31579046>
4447
4448         Reviewed by Filip Pizlo.
4449
4450         * stress/regress-170661.js: Added.
4451
4452 2017-04-13  JF Bastien  <jfbastien@apple.com>
4453
4454         WebAssembly: manage memory better
4455         https://bugs.webkit.org/show_bug.cgi?id=170628
4456
4457         Reviewed by Keith Miller, Michael Saboff.
4458
4459         * wasm/Builder.js: move a helper out so tests can use it
4460         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
4461         * wasm/WASM.js: add utilities to classify opcodes
4462         (export.opcodes):
4463         (export.const.memoryAccessInfo.op.const.sign):
4464         * wasm/function-tests/memory-access-past-4gib.js: Added. This test
4465         fails before this patch.
4466         (const.op.of.WASM.opcodes):
4467         * wasm/function-tests/memory-many.js: Added. This simple tests
4468         just shouldn't crash. In verbose mode it's useful at determining
4469         if the GC falls behind or not.
4470         * wasm/function-tests/memory-multiagent.js: Added. Emulate postMessage.
4471         (const.startAgents.numAgentsToStart.a.agent.receiveBroadcast):
4472         (const.startAgents.numAgentsToStart.a.write.const.idx.Math.random):
4473         (const.broadcastToAgents):
4474         * wasm/js-api/extension-MemoryMode.js: verbose logging.
4475         (testMemoryNoMax):
4476         (testMemory):
4477         (testInstanceNoMemory):
4478         (testInstanceNoMax):
4479         (testInstance):
4480         * wasm/utilities.js: move a utility here.
4481
4482 2017-04-12  Joseph Pecoraro  <pecoraro@apple.com>
4483
4484         test262: test262/test/built-ins/NativeErrors/EvalError/proto.js
4485         https://bugs.webkit.org/show_bug.cgi?id=170668
4486
4487         Reviewed by Keith Miller.
4488
4489         * ChakraCore.yaml:
4490         * ChakraCore/test/Lib/error.baseline-jsc: Added.
4491         This test does not match the spec.
4492
4493