Select service worker for documents with data/blob URLS
[WebKit-https.git] / JSTests / ChangeLog
1 2018-01-02  Saam Barati  <sbarati@apple.com>
2
3         Incorrect assertion inside AccessCase
4         https://bugs.webkit.org/show_bug.cgi?id=181200
5         <rdar://problem/35494754>
6
7         Reviewed by Yusuke Suzuki.
8
9         * stress/setter-same-base-and-rhs-invalid-assertion-inside-access-case.js: Added.
10         (ctor):
11         (theFunc):
12         (run):
13
14 2018-01-02  Caio Lima  <ticaiolima@gmail.com>
15
16         [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
17         https://bugs.webkit.org/show_bug.cgi?id=175359
18
19         Reviewed by Yusuke Suzuki.
20
21         * bigIntTests.yaml:
22         * stress/big-int-as-key.js: Added.
23         * stress/big-int-constructor-gc.js: Added.
24         * stress/big-int-constructor-oom.js: Added.
25         * stress/big-int-constructor-properties.js: Added.
26         * stress/big-int-constructor-prototype-prop-descriptor.js: Added.
27         * stress/big-int-constructor-prototype.js: Added.
28         * stress/big-int-constructor.js: Added.
29         * stress/big-int-function-apply.js:
30         * stress/big-int-length.js: Added.
31         * stress/big-int-prop-descriptor.js: Added.
32         * stress/big-int-proto-constructor.js: Added.
33         * stress/big-int-proto-name.js: Added.
34         * stress/big-int-prototype-properties.js: Added.
35         * stress/big-int-prototype-proto.js: Added.
36         * stress/big-int-prototype-value-of.js: Added.
37         * stress/big-int-prototype-symbol-to-string-tag.js: Added.
38         * stress/big-int-prototype-to-string-apply.js: Added.
39         * stress/big-int-to-object.js: Added.
40         * stress/big-int-to-string.js: Added.
41
42 2017-12-28  Saam Barati  <sbarati@apple.com>
43
44         Assertion used to determine if something is an async generator is wrong
45         https://bugs.webkit.org/show_bug.cgi?id=181168
46         <rdar://problem/35640560>
47
48         Reviewed by Yusuke Suzuki.
49
50         * stress/async-generator-assertion.js: Added.
51
52 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
53
54         Skip stress/splay-flash-access tests on memory limited platforms
55         https://bugs.webkit.org/show_bug.cgi?id=181086
56
57         Reviewed by Carlos Alberto Lopez Perez.
58
59         These tests use about 185M of memory, and occasionally get OOM-killed
60         on memory limited platforms.
61
62         * stress/splay-flash-access-1ms.js:
63         * stress/splay-flash-access.js:
64
65 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
66
67         Skip slow jsc tests on embedded platforms
68         https://bugs.webkit.org/show_bug.cgi?id=180937
69
70         Reviewed by Carlos Alberto Lopez Perez.
71
72         The tests typeProfiler/deltablue-for-of.js and
73         typeProfiler/getter-richards.js take a very long time in the
74         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
75         thus always timeout. They should be skipped on these platforms.
76
77         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
78         * typeProfiler/getter-richards.js: Skip on arm*/mips.
79
80 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
81
82         [JSC] Do not check isValid() in op_new_regexp
83         https://bugs.webkit.org/show_bug.cgi?id=180970
84
85         Reviewed by Saam Barati.
86
87         * stress/regexp-syntax-error-invalid-flags.js: Added.
88         (shouldThrow):
89
90 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
91
92         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
93         https://bugs.webkit.org/show_bug.cgi?id=180712
94
95         Reviewed by Michael Catanzaro.
96
97         stress/call-apply-exponential-bytecode-size.js crashes if the
98         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
99         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
100         should skip the test on other platforms.
101
102         * stress/call-apply-exponential-bytecode-size.js:
103
104 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
105
106         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
107         https://bugs.webkit.org/show_bug.cgi?id=179762
108
109         Reviewed by Saam Barati.
110
111         * stress/call-varargs-double-new-array-buffer.js: Added.
112         (assert):
113         (bar):
114         (foo):
115         * stress/call-varargs-spread-new-array-buffer.js: Added.
116         (assert):
117         (bar):
118         (foo):
119         * stress/call-varargs-spread-new-array-buffer2.js: Added.
120         (assert):
121         (bar):
122         (foo):
123         * stress/forward-varargs-double-new-array-buffer.js: Added.
124         (assert):
125         (test.baz):
126         (test.bar):
127         (test.foo):
128         (test):
129         * stress/new-array-buffer-sinking-osrexit.js: Added.
130         (target):
131         (test):
132         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
133         (shouldBe):
134         (test):
135         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
136         (shouldBe):
137         (target):
138         (test):
139         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
140         (assert):
141         (test1.bar):
142         (test1.foo):
143         (test1):
144         (test2.bar):
145         (test2.foo):
146         (test3.baz):
147         (test3.bar):
148         (test3.foo):
149         (test4.baz):
150         (test4.bar):
151         (test4.foo):
152         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
153         (assert):
154         (test.baz):
155         (test.bar):
156         (test.foo):
157         (test):
158         * stress/phantom-new-array-buffer-osr-exit.js: Added.
159         (assert):
160         (baz):
161         (bar):
162         (effects):
163         (foo):
164
165 2017-12-14  Saam Barati  <sbarati@apple.com>
166
167         The CleanUp after LICM is erroneously removing a Check
168         https://bugs.webkit.org/show_bug.cgi?id=180852
169         <rdar://problem/36063494>
170
171         Reviewed by Filip Pizlo.
172
173         * stress/dont-run-cleanup-after-licm.js: Added.
174
175 2017-12-14  Michael Saboff  <msaboff@apple.com>
176
177         REGRESSION (r225695): Repro crash on yahoo login page
178         https://bugs.webkit.org/show_bug.cgi?id=180761
179
180         Reviewed by JF Bastien.
181
182         New regression test.
183
184         * stress/regress-180761.js: Added.
185
186 2017-12-13  Keith Miller  <keith_miller@apple.com>
187
188         JSObjects should have a mask for loading indexed properties
189         https://bugs.webkit.org/show_bug.cgi?id=180768
190
191         Reviewed by Mark Lam.
192
193         * stress/int16-put-by-val-in-and-out-of-bounds.js:
194         (test):
195
196 2017-12-13  Saam Barati  <sbarati@apple.com>
197
198         Arrow functions need their own structure because they have different properties than sloppy functions
199         https://bugs.webkit.org/show_bug.cgi?id=180779
200         <rdar://problem/35814591>
201
202         Reviewed by Mark Lam.
203
204         * stress/arrow-function-needs-its-own-structure.js: Added.
205         (assert):
206         (readPrototype):
207         (noInline.let.f1):
208         (noInline):
209
210 2017-12-13  Saam Barati  <sbarati@apple.com>
211
212         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
213         https://bugs.webkit.org/show_bug.cgi?id=163579
214         <rdar://problem/35455798>
215
216         Reviewed by Mark Lam.
217
218         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
219         (assert):
220         (test1):
221         (i.test1):
222         (i.test1.C):
223         (i.test1.async.foo):
224         (i.test1.foo):
225         (test2):
226
227 2017-12-13  Saam Barati  <sbarati@apple.com>
228
229         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
230         https://bugs.webkit.org/show_bug.cgi?id=180734
231         <rdar://problem/35640547>
232
233         Reviewed by Yusuke Suzuki.
234
235         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
236         (__isPropertyOfType):
237         (__getProperties):
238         (__getObjects):
239         (__getRandomObject):
240         (theClass.):
241         (theClass):
242         (childClass):
243         (counter.catch):
244
245 2017-12-12  Saam Barati  <sbarati@apple.com>
246
247         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
248         https://bugs.webkit.org/show_bug.cgi?id=180725
249         <rdar://problem/35970511>
250
251         Reviewed by Michael Saboff.
252
253         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
254         (f1):
255         (f2):
256         (let.o2.valueOf):
257
258 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
259
260         [JSC] Implement optimized WeakMap and WeakSet
261         https://bugs.webkit.org/show_bug.cgi?id=179929
262
263         Reviewed by Saam Barati.
264
265         * microbenchmarks/weak-map-key.js:
266         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
267         (assert):
268         (objectKey):
269         (let.start.Date.now):
270         * stress/basic-weakmap.js: Added.
271         (shouldBe):
272         (test):
273         * stress/basic-weakset.js: Added.
274         (shouldBe):
275         (test.set new):
276         * stress/weakmap-cse-set-break.js: Added.
277         (shouldBe):
278         (test):
279         * stress/weakmap-cse.js: Added.
280         (shouldBe):
281         (test):
282         * stress/weakmap-gc.js: Added.
283         (test):
284         * stress/weakset-cse-add-break.js: Added.
285         (shouldBe):
286         (test.set new):
287         * stress/weakset-cse.js: Added.
288         (shouldBe):
289         (test.set new):
290         * stress/weakset-gc.js: Added.
291         (test.set add):
292         (test.set new):
293         (test):
294
295 2017-12-12  Saam Barati  <sbarati@apple.com>
296
297         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
298         https://bugs.webkit.org/show_bug.cgi?id=180723
299         <rdar://problem/35859726>
300
301         Reviewed by JF Bastien.
302
303         * stress/get-my-argument-by-val-constant-folding.js: Added.
304         (test):
305         (catch):
306
307 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
308
309         [ESNext][BigInt] Implement BigInt literals and JSBigInt
310         https://bugs.webkit.org/show_bug.cgi?id=179000
311
312         Reviewed by Darin Adler and Yusuke Suzuki.
313
314         * bigIntTests.yaml: Added.
315         * stress/big-int-literal-line-terminator.js: Added.
316         * stress/big-int-literals.js: Added.
317         * stress/big-int-operations-error.js: Added.
318         * stress/big-int-type-of.js: Added.
319         * stress/big-int-white-space-trailing-leading.js: Added.
320         * stress/big-int-function-apply.js: Added.
321
322 2017-12-11  Saam Barati  <sbarati@apple.com>
323
324         We need to disableCaching() in ErrorInstance when we materialize properties
325         https://bugs.webkit.org/show_bug.cgi?id=180343
326         <rdar://problem/35833002>
327
328         Reviewed by Mark Lam.
329
330         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
331         (assert):
332         (makeError):
333         (storeToStack):
334         (storeToStackAlreadyMaterialized):
335
336 2017-12-05  JF Bastien  <jfbastien@apple.com>
337
338         WebAssembly: don't eagerly checksum
339         https://bugs.webkit.org/show_bug.cgi?id=180441
340         <rdar://problem/35156628>
341
342         Reviewed by Saam Barati.
343
344         Checksum is now disabled, so tests only have <?> as the module
345         name.
346
347         * wasm/function-tests/nameSection.js:
348         * wasm/function-tests/stack-overflow.js:
349         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
350         (assertOverflows.assertThrows):
351         (assertOverflows):
352         * wasm/function-tests/stack-trace.js:
353
354 2017-12-04  JF Bastien  <jfbastien@apple.com>
355
356         Proxy all functions, except the $ objects
357         https://bugs.webkit.org/show_bug.cgi?id=180375
358
359         Reviewed by Saam Barati.
360
361         It looks like this test may have broken some executions because I
362         call some internal objects. Explicitly ignore objects whose name
363         starts with "$" because it's a bad idea anyways.
364
365         * stress/proxy-all-the-parameters.js:
366         (generateObjects):
367         (get throw):
368
369 2017-12-04  Saam Barati  <sbarati@apple.com>
370
371         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
372         https://bugs.webkit.org/show_bug.cgi?id=180366
373         <rdar://problem/35685877>
374
375         Reviewed by Michael Saboff.
376
377         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
378         (theParent):
379         (test1.base.getParentStaticValue):
380         (test1.base):
381         (test1.__v_24888.prototype.set prop):
382         (test1.__v_24888):
383         (test2.base.getParentStaticValue):
384         (test2.base):
385         (test2.__v_24888.prototype.set prop):
386         (test2.__v_24888):
387         (test2):
388
389 2017-12-01  JF Bastien  <jfbastien@apple.com>
390
391         Try proxying all function arguments
392         https://bugs.webkit.org/show_bug.cgi?id=180306
393
394         Reviewed by Saam Barati.
395
396         * stress/proxy-all-the-parameters.js: Added.
397         (isPropertyOfType):
398         (getProperties):
399         (generateObjects):
400         (getObjects):
401         (getFunctions):
402         (get throw):
403         (let.o.of.getObjects.let.f.of.getFunctions.catch):
404
405 2017-12-01  JF Bastien  <jfbastien@apple.com>
406
407         JavaScriptCore: missing exception checks in Math functions that take more than one argument
408         https://bugs.webkit.org/show_bug.cgi?id=180297
409         <rdar://problem/35745556>
410
411         Reviewed by Mark Lam.
412
413         * stress/math-exceptions.js: Added.
414         (get try):
415         (catch):
416
417 2017-12-01  JF Bastien  <jfbastien@apple.com>
418
419         JavaScriptCore: add test for weird class static getters
420         https://bugs.webkit.org/show_bug.cgi?id=180281
421         <rdar://problem/35592139>
422
423         Reviewed by Mark Lam.
424
425         I fixed a bug for it in r224927 and didn't add a test. Do so.
426
427         * stress/class-static-get-weird.js: Added.
428         (c.prototype.get name):
429         (c):
430         (c.prototype.get arguments):
431         (c.prototype.get caller):
432         (c.prototype.get length):
433
434 2017-12-01  Saam Barati  <sbarati@apple.com>
435
436         Having a bad time needs to handle ArrayClass indexing type as well
437         https://bugs.webkit.org/show_bug.cgi?id=180274
438         <rdar://problem/35667869>
439
440         Reviewed by Keith Miller and Mark Lam.
441
442         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
443         (assert):
444         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
445         (assert):
446
447 2017-12-01  JF Bastien  <jfbastien@apple.com>
448
449         WebAssembly: restore cached stack limit after out-call
450         https://bugs.webkit.org/show_bug.cgi?id=179106
451         <rdar://problem/35337525>
452
453         Reviewed by Saam Barati.
454
455         * wasm/function-tests/double-instance.js: Added.
456         (const.imp.boom):
457         (const.imp.get callAnother):
458
459 2017-11-30  JF Bastien  <jfbastien@apple.com>
460
461         WebAssembly: improve stack trace
462         https://bugs.webkit.org/show_bug.cgi?id=179343
463
464         Reviewed by Saam Barati.
465
466         Update the tests to follow the new format. Notably, SHA1 module
467         hash is now included in traces, and stubs are properly identified.
468
469         * wasm/assert.js: Add an assertion which matches regular expressions.
470         * wasm/function-tests/nameSection.js:
471         * wasm/function-tests/stack-overflow.js:
472         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
473         (assertOverflows.assertThrows.wasm.1):
474         (assertOverflows.assertThrows.wasm.0):
475         (assertOverflows.assertThrows):
476         (assertOverflows):
477         * wasm/function-tests/stack-trace.js:
478         (import.Builder.from.string_appeared_here.assert): Deleted.
479         * wasm/function-tests/trap-after-cross-instance-call.js:
480         (wasmFrameCountFromError):
481         * wasm/function-tests/trap-load-2.js:
482         (wasmFrameCountFromError):
483         * wasm/function-tests/trap-load.js:
484         (wasmFrameCountFromError):
485
486 2017-11-30  Mark Lam  <mark.lam@apple.com>
487
488         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
489         https://bugs.webkit.org/show_bug.cgi?id=180219
490         <rdar://problem/35696536>
491
492         Reviewed by Filip Pizlo.
493
494         * stress/regress-180219.js: Added.
495
496 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
497
498         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
499         https://bugs.webkit.org/show_bug.cgi?id=180190
500
501         Reviewed by Mark Lam.
502
503         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
504         (shouldBe):
505         (test1):
506         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
507         (shouldBe):
508         (test1):
509         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
510         (shouldBe):
511         (test1):
512         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
513         (shouldBe):
514         (test1):
515         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
516         (shouldBe):
517         (test1):
518         * stress/operation-in-may-have-negative-int32.js: Added.
519         (shouldBe):
520         (test2):
521         * stress/operation-in-negative-int32-cast.js: Added.
522         (shouldBe):
523         (test1):
524
525 2017-11-28  JF Bastien  <jfbastien@apple.com>
526
527         Strict and sloppy functions shouldn't share structure
528         https://bugs.webkit.org/show_bug.cgi?id=180103
529         <rdar://problem/35667847>
530
531         Reviewed by Saam Barati.
532
533         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
534         because the IC was wrong.
535         (foo):
536         (bar):
537         (baz):
538         (catch):
539         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
540         in this patch, but may as well test odd strict mode corner cases.
541         (bar):
542         (baz):
543         (catch):
544         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
545         (foo):
546         (bar):
547         (baz):
548         (catch):
549         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
550         next file, but with invalidation of the FunctionExecutable's
551         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
552         slower path.
553         (foo):
554         (bar.const.x):
555         (bar.const.y):
556         (bar):
557         (catch):
558         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
559         strict nesting works correctly.
560         (foo):
561         (bar.baz):
562         (bar):
563         * stress/strict-function-structure.js: Added. The test used to
564         assert in objectProtoFuncHasOwnProperty.
565         (foo):
566         (bar):
567         (baz):
568         * stress/strict-nested-function-structure.js: Added. Nesting.
569         (foo):
570         (bar):
571         (baz.boo):
572         (baz):
573
574 2017-11-29  Robin Morisset  <rmorisset@apple.com>
575
576         The recursive tail call optimisation is wrong on closures
577         https://bugs.webkit.org/show_bug.cgi?id=179835
578
579         Reviewed by Saam Barati.
580
581         * stress/closure-recursive-tail-call.js: Added.
582         (makeClosure):
583
584 2017-11-27  JF Bastien  <jfbastien@apple.com>
585
586         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
587         https://bugs.webkit.org/show_bug.cgi?id=180051
588         <rdar://problem/35614371>
589
590         Reviewed by Saam Barati.
591
592         * stress/rest-parameter-negative.js: Added.
593         (__f_5484):
594         (catch):
595         (__f_5485):
596         (__v_22598.catch):
597
598 2017-11-27  Saam Barati  <sbarati@apple.com>
599
600         Spread can escape when CreateRest does not
601         https://bugs.webkit.org/show_bug.cgi?id=180057
602         <rdar://problem/35676119>
603
604         Reviewed by JF Bastien.
605
606         * stress/spread-escapes-but-create-rest-does-not.js: Added.
607         (assert):
608         (getProperties):
609         (theFunc):
610         (let.obj.valueOf):
611
612 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
613
614         [DFG] Add NormalizeMapKey DFG IR
615         https://bugs.webkit.org/show_bug.cgi?id=179912
616
617         Reviewed by Saam Barati.
618
619         * stress/map-untyped-normalize-cse.js: Added.
620         (shouldBe):
621         (test):
622         * stress/map-untyped-normalize.js: Added.
623         (shouldBe):
624         (test):
625         * stress/set-untyped-normalize-cse.js: Added.
626         (shouldBe):
627         (set return.set has.set has):
628         * stress/set-untyped-normalize.js: Added.
629         (shouldBe):
630         (set return.set has):
631
632 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
633
634         [FTL] Support DeleteById and DeleteByVal
635         https://bugs.webkit.org/show_bug.cgi?id=180022
636
637         Reviewed by Saam Barati.
638
639         * stress/delete-by-id.js: Added.
640         (shouldBe):
641         (test1):
642         (test2):
643         * stress/delete-by-val-ftl.js: Added.
644         (shouldBe):
645         (test1):
646         (test2):
647
648 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
649
650         [DFG] Introduce {Set,Map,WeakMap}Fields
651         https://bugs.webkit.org/show_bug.cgi?id=179925
652
653         Reviewed by Saam Barati.
654
655         * stress/map-set-clobber-map-get.js: Added.
656         (shouldBe):
657         (test):
658         * stress/map-set-does-not-clobber-set-has.js: Added.
659         (shouldBe):
660         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
661         (shouldBe):
662         (test):
663         * stress/set-add-clobber-set-has.js: Added.
664         (shouldBe):
665         * stress/set-add-does-not-clobber-map-get.js: Added.
666         (shouldBe):
667
668 2017-11-24  Mark Lam  <mark.lam@apple.com>
669
670         Move unsafe jsc shell test functions to the $vm object.
671         https://bugs.webkit.org/show_bug.cgi?id=179980
672
673         Reviewed by Yusuke Suzuki.
674
675         * controlFlowProfiler/driver/driver.js:
676         * controlFlowProfiler/execution-count.js:
677         * controlFlowProfiler/if-statement.js:
678         * controlFlowProfiler/loop-statements.js:
679         * controlFlowProfiler/switch-statements.js:
680         * controlFlowProfiler/test-jit.js:
681         * exceptionFuzz/3d-cube.js:
682         * exceptionFuzz/date-format-xparb.js:
683         * exceptionFuzz/earley-boyer.js:
684         * heapProfiler/basic-edges.js:
685         * heapProfiler/property-edge-types.js:
686         * microbenchmarks/try-get-by-id-basic.js:
687         * microbenchmarks/try-get-by-id-polymorphic.js:
688         * modules/namespace-object-try-get.js:
689         * stress/argument-count-bytecode.js:
690         * stress/argument-intrinsic-basic.js:
691         * stress/argument-intrinsic-inlining-use-caller-arg.js:
692         * stress/argument-intrinsic-inlining-with-result-escape.js:
693         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
694         * stress/argument-intrinsic-inlining-with-vararg.js:
695         * stress/argument-intrinsic-nested-inlining.js:
696         * stress/argument-intrinsic-not-convert-to-get-argument.js:
697         * stress/argument-intrinsic-with-stack-write.js:
698         * stress/arity-mismatch-get-argument.js:
699         * stress/array-message-passing.js:
700         * stress/array-push-with-force-exit.js:
701         * stress/check-dom-with-signature.js:
702         * stress/check-sub-class.js:
703         * stress/compare-eq-incomplete-profile.js:
704         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
705         * stress/do-eval-virtual-call-correctly.js:
706         * stress/dom-jit-with-poly-proto.js:
707         * stress/domjit-exception-ic.js:
708         * stress/domjit-exception.js:
709         * stress/domjit-getter-complex-with-incorrect-object.js:
710         * stress/domjit-getter-complex.js:
711         * stress/domjit-getter-poly.js:
712         * stress/domjit-getter-proto.js:
713         * stress/domjit-getter-super-poly.js:
714         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
715         * stress/domjit-getter-type-check.js:
716         * stress/domjit-getter.js:
717         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
718         * stress/for-in-proxy-target-changed-structure.js:
719         * stress/for-in-proxy.js:
720         * stress/generational-opaque-roots.js:
721         * stress/global-const-redeclaration-setting-2.js:
722         * stress/global-const-redeclaration-setting-3.js:
723         * stress/global-const-redeclaration-setting-4.js:
724         * stress/global-const-redeclaration-setting-5.js:
725         * stress/global-const-redeclaration-setting.js:
726         * stress/import-basic.js:
727         * stress/import-from-eval.js:
728         * stress/import-reject-with-exception.js:
729         * stress/import-syntax.js:
730         * stress/impure-get-own-property-slot-inline-cache.js:
731         * stress/is-constructor.js:
732         * stress/istypedarrayview-intrinsic.js:
733         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
734         * stress/jsc-test-functions-should-be-more-robust.js:
735         * stress/object-toString-with-proxy.js:
736         * stress/poly-proto-custom-value-and-accessor.js:
737         * stress/proxy-inline-cache.js:
738         * stress/re-execute-error-module.js:
739         * stress/regress-150532.js:
740         * stress/regress-156992.js:
741         * stress/regress-179619.js:
742         * stress/resources/shadow-chicken-support.js:
743         * stress/runtime-array.js:
744         * stress/sampling-profiler-microtasks.js:
745         * stress/shadow-chicken-enabled.js:
746         * stress/spread-correct-global-object-on-exception.js:
747         * stress/super-get-by-id.js:
748         * stress/tailCallForwardArguments.js:
749         * stress/to-object-intrinsic-boolean-edge.js:
750         * stress/to-object-intrinsic-null-or-undefined-edge.js:
751         * stress/to-object-intrinsic-number-edge.js:
752         * stress/to-object-intrinsic-object-edge.js:
753         * stress/to-object-intrinsic-string-edge.js:
754         * stress/to-object-intrinsic-symbol-edge.js:
755         * stress/to-object-intrinsic.js:
756         * stress/try-catch-custom-getter-as-get-by-id.js:
757         * stress/try-get-by-id-poly-proto.js:
758         * stress/try-get-by-id-should-spill-registers-dfg.js:
759         * stress/try-get-by-id.js:
760         * typeProfiler/arrow-functions.js:
761         * typeProfiler/basic.js:
762         * typeProfiler/captured.js:
763         * typeProfiler/classes.js:
764         * typeProfiler/dfg-jit-optimizations.js:
765         * typeProfiler/dictionary-mode.js:
766         * typeProfiler/es6-block-scoping.js:
767         * typeProfiler/es6-classes.js:
768         * typeProfiler/inheritance.js:
769         * typeProfiler/int52-dfg.js:
770         * typeProfiler/loop.js:
771         * typeProfiler/optional-fields.js:
772         * typeProfiler/overflow.js:
773         * typeProfiler/return.js:
774         * typeProfiler/symbol.js:
775         * typeProfiler/weird-prototype-chain.js:
776
777 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
778
779         [DFG][FTL] Support MapSet / SetAdd intrinsics
780         https://bugs.webkit.org/show_bug.cgi?id=179858
781
782         Reviewed by Saam Barati.
783
784         * microbenchmarks/map-has-and-set.js: Added.
785         (test):
786         * stress/map-set-check-failure.js: Added.
787         (shouldBe):
788         (shouldThrow):
789         (target):
790         * stress/map-set-cse.js: Added.
791         (shouldBe):
792         (test):
793         * stress/set-add-check-failure.js: Added.
794         (shouldBe):
795         (shouldThrow):
796         (set shouldThrow):
797         * stress/set-add-cse.js: Added.
798         (shouldBe):
799
800 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
801
802         [JSC] Allow poly proto for intrinsic getters
803         https://bugs.webkit.org/show_bug.cgi?id=179550
804
805         Reviewed by Saam Barati.
806
807         This change is also tested by existing tests.
808
809             1. stress/intrinsic-getter-with-poly-proto.js
810             2. stress/poly-proto-intrinsic-getter-correctness.js
811
812         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
813         (shouldBe):
814         (makePolyProtoObject.foo.C):
815         (makePolyProtoObject.foo):
816         (makePolyProtoObject):
817         (target):
818         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
819         (shouldBe):
820         (makePolyProtoObject.foo.C):
821         (makePolyProtoObject.foo):
822         (makePolyProtoObject):
823         (target):
824
825 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
826
827         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
828         https://bugs.webkit.org/show_bug.cgi?id=179744
829
830         Reviewed by Michael Catanzaro.
831
832         This test uses too much memory for our buildbots on these platforms
833         and gets OOM-killed.
834
835         * stress/unshiftCountSlowCase-correct-postCapacity.js:
836         Skip if $memoryLimited and linux.
837
838 2017-11-17  JF Bastien  <jfbastien@apple.com>
839
840         WebAssembly JS API: throw when a promise can't be created
841         https://bugs.webkit.org/show_bug.cgi?id=179826
842         <rdar://problem/35455813>
843
844         Reviewed by Mark Lam.
845
846         Test WebAssembly.{compile,instantiate} where promise creation
847         fails because of a stack overflow.
848
849         * wasm/js-api/promise-stack-overflow.js: Added.
850         (const.runNearStackLimit.f.const.t):
851         (async.testCompile):
852         (async.testInstantiate):
853
854 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
855
856         Unreviewed, mark regress-178385.js as memory exhausting
857
858         * stress/regress-178385.js:
859
860 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
861
862         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
863
864         Unreviewed test gardening.
865
866         * test262.yaml:
867
868 2017-11-16  Robin Morisset  <rmorisset@apple.com>
869
870         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
871         https://bugs.webkit.org/show_bug.cgi?id=179763
872         <rdar://problem/35550513>
873
874         Reviewed by Keith Miller.
875
876         Just adding a slightly cleaned-up version of the original fuzzer-found test.
877
878         * stress/tdz-this-in-try-catch.js: Added.
879         (__v_6388):
880         (__v_6392):
881
882 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
883
884         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
885         https://bugs.webkit.org/show_bug.cgi?id=179594
886
887         Reviewed by Saam Barati.
888
889         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
890         (shouldBe):
891         (args):
892         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
893         (shouldBe):
894         (args):
895
896 2017-11-14  Saam Barati  <sbarati@apple.com>
897
898         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
899         https://bugs.webkit.org/show_bug.cgi?id=179639
900         <rdar://problem/35513018>
901
902         Reviewed by JF Bastien.
903
904         * wasm/function-tests/grow-memory-cause-gc.js: Added.
905         (escape):
906         (i.func):
907
908 2017-11-13  Mark Lam  <mark.lam@apple.com>
909
910         Add more overflow check book-keeping for MarkedArgumentBuffer.
911         https://bugs.webkit.org/show_bug.cgi?id=179634
912         <rdar://problem/35492517>
913
914         Reviewed by Saam Barati.
915
916         * stress/regress-179634.js: Added.
917
918 2017-11-13  Mark Lam  <mark.lam@apple.com>
919
920         Make the jsc shell loadGetterFromGetterSetter() function more robust.
921         https://bugs.webkit.org/show_bug.cgi?id=179619
922         <rdar://problem/35492518>
923
924         Reviewed by Saam Barati.
925
926         * stress/regress-179619.js: Added.
927
928 2017-11-12  Mark Lam  <mark.lam@apple.com>
929
930         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
931         https://bugs.webkit.org/show_bug.cgi?id=179562
932         <rdar://problem/35467022>
933
934         Reviewed by Saam Barati.
935
936         * regress-179562.js: Added.
937
938 2017-11-08  Saam Barati  <sbarati@apple.com>
939
940         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
941         https://bugs.webkit.org/show_bug.cgi?id=177792
942
943         Reviewed by Yusuke Suzuki.
944
945         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
946         (assert):
947         (foo.Foo.prototype.ensureX):
948         (foo.Foo):
949         (foo):
950         (access):
951
952 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
953
954         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
955         https://bugs.webkit.org/show_bug.cgi?id=178592
956
957         Unreviewed test gardening.
958
959         * test262.yaml:
960
961 2017-11-08  Robin Morisset  <rmorisset@apple.com>
962
963         Turn recursive tail calls into loops
964         https://bugs.webkit.org/show_bug.cgi?id=176601
965
966         Reviewed by Saam Barati.
967
968         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
969
970         Add some simple test that computes factorial in several ways, and other trivial computations.
971         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
972         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
973         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
974         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
975
976         * stress/inline-call-to-recursive-tail-call.js: Added.
977         (factorial.aux):
978         (factorial):
979         (factorial2.aux2):
980         (factorial2.id):
981         (factorial2):
982         (factorial3.aux3):
983         (factorial3):
984         (aux4):
985         (factorial4):
986         (foo):
987         (auxBar):
988         (bar):
989         (test):
990
991 2017-11-07  Mark Lam  <mark.lam@apple.com>
992
993         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
994         https://bugs.webkit.org/show_bug.cgi?id=179355
995         <rdar://problem/35263053>
996
997         Reviewed by Saam Barati.
998
999         * stress/regress-179355.js: Added.
1000
1001 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1002
1003         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
1004         https://bugs.webkit.org/show_bug.cgi?id=144458
1005
1006         Reviewed by Saam Barati.
1007
1008         * microbenchmarks/dfg-internal-function-call.js: Added.
1009         (target):
1010         * microbenchmarks/dfg-internal-function-construct.js: Added.
1011         (target):
1012         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
1013         (target):
1014         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
1015         (target):
1016         * stress/dfg-internal-function-call.js: Added.
1017         (shouldBe):
1018         (target):
1019         * stress/dfg-internal-function-construct.js: Added.
1020         (shouldBe):
1021         (target):
1022         * stress/internal-function-call.js: Added.
1023         (shouldBe):
1024         * stress/internal-function-construct.js: Added.
1025         (shouldBe):
1026
1027 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
1028
1029         [Win] Skip stress/regress-178385.js.
1030         https://bugs.webkit.org/show_bug.cgi?id=179298
1031
1032         Unreviewed test gardening.
1033
1034         * stress/regress-178385.js:
1035
1036 2017-11-03  Keith Miller  <keith_miller@apple.com>
1037
1038         Add test for ic with side effects
1039         https://bugs.webkit.org/show_bug.cgi?id=179268
1040
1041         Reviewed by Saam Barati.
1042
1043         * stress/put-inline-cache-side-effects.js: Added.
1044         (let.i.of.objs.keys):
1045         (f):
1046
1047 2017-11-03  Mark Lam  <mark.lam@apple.com>
1048
1049         CachedCall (and its clients) needs overflow checks.
1050         https://bugs.webkit.org/show_bug.cgi?id=179185
1051
1052         Reviewed by JF Bastien.
1053
1054         * stress/regress-179185.js: Added.
1055
1056 2017-11-02  Michael Saboff  <msaboff@apple.com>
1057
1058         DFG needs to handle code motion of code in for..in loop bodies
1059         https://bugs.webkit.org/show_bug.cgi?id=179212
1060
1061         Reviewed by Keith Miller.
1062
1063         New regression test.
1064
1065         * stress/for-in-side-effects.js: Added.
1066         (getPrototypeOf):
1067         (reset):
1068         (testWithoutFTL.f):
1069         (testWithoutFTL):
1070         (testWithFTL.f):
1071         (testWithFTL):
1072
1073 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
1074
1075         AI does not correctly model the clobber case of ArithClz32
1076         https://bugs.webkit.org/show_bug.cgi?id=179188
1077
1078         Reviewed by Michael Saboff.
1079
1080         * stress/arith-clz32-effects.js: Added.
1081         (foo):
1082         (valueOf):
1083
1084 2017-11-01  Michael Saboff  <msaboff@apple.com>
1085
1086         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
1087         https://bugs.webkit.org/show_bug.cgi?id=179140
1088
1089         Reviewed by Saam Barati.
1090
1091         New regression test.
1092
1093         * stress/regress-179140.js: Added.
1094         (testWithoutFTL):
1095         (testWithFTL):
1096
1097 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1098
1099         [JSC] Introduce @toObject
1100         https://bugs.webkit.org/show_bug.cgi?id=178726
1101
1102         Reviewed by Saam Barati.
1103
1104         * stress/array-copywithin.js:
1105         (shouldThrow):
1106         * stress/object-constructor-boolean-edge.js: Added.
1107         (shouldBe):
1108         (test):
1109         * stress/object-constructor-global.js: Added.
1110         (shouldBe):
1111         * stress/object-constructor-null-edge.js: Added.
1112         (shouldBe):
1113         (test):
1114         * stress/object-constructor-number-edge.js: Added.
1115         (shouldBe):
1116         (test):
1117         * stress/object-constructor-object-edge.js: Added.
1118         (shouldBe):
1119         (test):
1120         (i.arg):
1121         * stress/object-constructor-string-edge.js: Added.
1122         (shouldBe):
1123         (test):
1124         * stress/object-constructor-symbol-edge.js: Added.
1125         (shouldBe):
1126         (test):
1127         * stress/object-constructor-undefined-edge.js: Added.
1128         (shouldBe):
1129         (test):
1130         * stress/symbol-array-from.js: Added.
1131         (shouldBe):
1132         * stress/to-object-intrinsic-boolean-edge.js: Added.
1133         (shouldBe):
1134         (builtin.createBuiltin):
1135         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
1136         (shouldThrow):
1137         * stress/to-object-intrinsic-number-edge.js: Added.
1138         (shouldBe):
1139         (builtin.createBuiltin):
1140         * stress/to-object-intrinsic-object-edge.js: Added.
1141         (shouldBe):
1142         (builtin.createBuiltin):
1143         (i.arg):
1144         * stress/to-object-intrinsic-string-edge.js: Added.
1145         (shouldBe):
1146         (builtin.createBuiltin):
1147         * stress/to-object-intrinsic-symbol-edge.js: Added.
1148         (shouldBe):
1149         (builtin.createBuiltin):
1150         * stress/to-object-intrinsic.js: Added.
1151         (shouldBe):
1152         (shouldThrow):
1153         (builtin.createBuiltin):
1154
1155 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1156
1157         [DFG][FTL] Introduce StringSlice
1158         https://bugs.webkit.org/show_bug.cgi?id=178934
1159
1160         Reviewed by Saam Barati.
1161
1162         * microbenchmarks/string-slice-empty.js: Added.
1163         (slice):
1164         * microbenchmarks/string-slice-one-char.js: Added.
1165         (slice):
1166         * microbenchmarks/string-slice.js: Added.
1167         (slice):
1168
1169 2017-10-26  Michael Saboff  <msaboff@apple.com>
1170
1171         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
1172         https://bugs.webkit.org/show_bug.cgi?id=178890
1173
1174         Reviewed by Keith Miller.
1175
1176         New regression test.
1177
1178         * stress/regress-178890.js: Added.
1179
1180 2017-10-26  Mark Lam  <mark.lam@apple.com>
1181
1182         JSRopeString::RopeBuilder::append() should check for overflows.
1183         https://bugs.webkit.org/show_bug.cgi?id=178385
1184         <rdar://problem/35027468>
1185
1186         Reviewed by Saam Barati.
1187
1188         * stress/regress-178385.js: Added.
1189
1190 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
1191
1192         Unreviewed, rolling out r223961.
1193
1194         The change that required this has been rolled out.
1195
1196         Reverted changeset:
1197
1198         "Mark test262.yaml/test262/test/language/statements/try/tco-
1199         catch.js as passing."
1200         https://bugs.webkit.org/show_bug.cgi?id=178592
1201         https://trac.webkit.org/changeset/223961
1202
1203 2017-10-25  Commit Queue  <commit-queue@webkit.org>
1204
1205         Unreviewed, rolling out r223691 and r223729.
1206         https://bugs.webkit.org/show_bug.cgi?id=178834
1207
1208         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
1209         by rniwa on #webkit).
1210
1211         Reverted changesets:
1212
1213         "Turn recursive tail calls into loops"
1214         https://bugs.webkit.org/show_bug.cgi?id=176601
1215         https://trac.webkit.org/changeset/223691
1216
1217         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
1218         comparison is always false due to limited range of data type
1219         [-Wtype-limits]"
1220         https://bugs.webkit.org/show_bug.cgi?id=178543
1221         https://trac.webkit.org/changeset/223729
1222
1223 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
1224
1225         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1226         https://bugs.webkit.org/show_bug.cgi?id=178592
1227
1228         Unreviewed test gardening.
1229
1230         * test262.yaml:
1231
1232 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1233
1234         [FTL] Support NewStringObject
1235         https://bugs.webkit.org/show_bug.cgi?id=178737
1236
1237         Reviewed by Saam Barati.
1238
1239         * stress/new-string-object.js: Added.
1240         (shouldBe):
1241         (test):
1242
1243 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1244
1245         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
1246         https://bugs.webkit.org/show_bug.cgi?id=178308
1247
1248         Reviewed by Mark Lam.
1249
1250         * test262.yaml:
1251
1252 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1253
1254         [JSC] Use fastJoin in Array#toString
1255         https://bugs.webkit.org/show_bug.cgi?id=178062
1256
1257         Reviewed by Darin Adler.
1258
1259         * microbenchmarks/contiguous-array-to-string.js: Added.
1260         (target):
1261         * microbenchmarks/double-array-to-string.js: Added.
1262         (target):
1263         * microbenchmarks/int32-array-to-string.js: Added.
1264         (target):
1265
1266 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
1267
1268         stress/check-string-ident.js is improperly skipped
1269         https://bugs.webkit.org/show_bug.cgi?id=178642
1270
1271         Reviewed by Saam Barati.
1272
1273         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
1274         since it enforces the run-jsc-stress-tests script to still set up the
1275         test to run, despite the skip directive that's used before.
1276
1277 2017-10-20  Mark Lam  <mark.lam@apple.com>
1278
1279         Add a test case for r214334.
1280         https://bugs.webkit.org/show_bug.cgi?id=169941
1281         <rdar://problem/31221258>
1282
1283         Reviewed by JF Bastien.
1284
1285         * stress/regress-169941.js: Added.
1286
1287 2017-10-19  JF Bastien  <jfbastien@apple.com>
1288
1289         WebAssembly: no VM / JS version of everything but Instance
1290         https://bugs.webkit.org/show_bug.cgi?id=177473
1291
1292         Reviewed by Filip Pizlo, Saam Barati.
1293
1294         - Exceeding max on memory growth now returns a range error as per
1295         spec. This is a (very minor) breaking change: it used to throw OOM
1296         error. Update the corresponding test.
1297
1298         * wasm/js-api/memory-grow.js:
1299         (assertEq):
1300         * wasm/js-api/table.js:
1301         (assert.throws):
1302
1303 2017-10-19  Mark Lam  <mark.lam@apple.com>
1304
1305         Stringifier::appendStringifiedValue() is missing an exception check.
1306         https://bugs.webkit.org/show_bug.cgi?id=178386
1307         <rdar://problem/35027610>
1308
1309         Reviewed by Saam Barati.
1310
1311         * stress/regress-178386.js: Added.
1312
1313 2017-10-19  Michael Saboff  <msaboff@apple.com>
1314
1315         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1316         https://bugs.webkit.org/show_bug.cgi?id=178521
1317
1318         Reviewed by JF Bastien.
1319
1320         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1321         now passes with the current version (5.0) of the Emoji spec.
1322
1323 2017-10-19  Robin Morisset  <rmorisset@apple.com>
1324
1325         Turn recursive tail calls into loops
1326         https://bugs.webkit.org/show_bug.cgi?id=176601
1327
1328         Reviewed by Saam Barati.
1329
1330         Add some simple test that computes factorial in several ways, and other trivial computations.
1331         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1332         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1333         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1334         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1335
1336         * stress/inline-call-to-recursive-tail-call.js: Added.
1337         (factorial.aux):
1338         (factorial):
1339         (factorial2.aux):
1340         (factorial2.id):
1341         (factorial2):
1342         (factorial3.aux):
1343         (factorial3):
1344         (aux):
1345         (factorial4):
1346         (test):
1347
1348 2017-10-18  Mark Lam  <mark.lam@apple.com>
1349
1350         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1351         https://bugs.webkit.org/show_bug.cgi?id=177600
1352         <rdar://problem/34710985>
1353
1354         Reviewed by Saam Barati.
1355
1356         * stress/regress-177600.js: Added.
1357
1358 2017-10-18  Mark Lam  <mark.lam@apple.com>
1359
1360         The compiler should always register a structure when it adds its transitionWatchPointSet.
1361         https://bugs.webkit.org/show_bug.cgi?id=178420
1362         <rdar://problem/34814024>
1363
1364         Reviewed by Saam Barati and Filip Pizlo.
1365
1366         * stress/regress-178420.js: Added.
1367         (new.Array.10000.map):
1368
1369 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1370
1371         [JSC] __proto__ getter should be fast
1372         https://bugs.webkit.org/show_bug.cgi?id=178067
1373
1374         Reviewed by Saam Barati.
1375
1376         * stress/dfg-object-proto-accessor.js: Added.
1377         (shouldBe):
1378         (shouldThrow):
1379         (target):
1380         * stress/dfg-object-proto-getter.js: Added.
1381         (shouldBe):
1382         (shouldThrow):
1383         (target):
1384         * stress/dfg-object-prototype-of.js: Added.
1385         (shouldBe):
1386         (shouldThrow):
1387         (target):
1388         * stress/dfg-reflect-get-prototype-of.js: Added.
1389         (shouldBe):
1390         (shouldThrow):
1391         (target):
1392         * stress/intrinsic-getter-with-poly-proto.js: Added.
1393         (shouldBe):
1394         (makePolyProtoObject.foo.C):
1395         (makePolyProtoObject.foo):
1396         (makePolyProtoObject):
1397         (target):
1398         * stress/object-get-prototype-of-filtered.js: Added.
1399         (shouldBe):
1400         (shouldThrow):
1401         (target):
1402         (i.Cocoa):
1403         * stress/object-get-prototype-of-mono-proto.js: Added.
1404         (shouldBe):
1405         (makePolyProtoObject.foo.C):
1406         (makePolyProtoObject.foo):
1407         (makePolyProtoObject):
1408         (target):
1409         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1410         (shouldBe):
1411         (makePolyProtoObject.foo.C):
1412         (makePolyProtoObject.foo):
1413         (makePolyProtoObject):
1414         (target):
1415         * stress/object-get-prototype-of-poly-proto.js: Added.
1416         (shouldBe):
1417         (makePolyProtoObject.foo.C):
1418         (makePolyProtoObject.foo):
1419         (makePolyProtoObject):
1420         (target):
1421         * stress/object-proto-getter-filtered.js: Added.
1422         (shouldBe):
1423         (shouldThrow):
1424         (target):
1425         (i.Cocoa):
1426         * stress/object-proto-getter-poly-mono-proto.js: Added.
1427         (shouldBe):
1428         (makePolyProtoObject.foo.C):
1429         (makePolyProtoObject.foo):
1430         (makePolyProtoObject):
1431         (target):
1432         * stress/object-proto-getter-poly-proto.js: Added.
1433         (shouldBe):
1434         (makePolyProtoObject.foo.C):
1435         (makePolyProtoObject.foo):
1436         (makePolyProtoObject):
1437         (target):
1438         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1439         * stress/string-proto.js: Added.
1440         (shouldBe):
1441         (target):
1442
1443 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1444
1445         Unreviewed, rolling out r223523.
1446
1447         A test for this change is failing on debug JSC bots.
1448
1449         Reverted changeset:
1450
1451         "[JSC] __proto__ getter should be fast"
1452         https://bugs.webkit.org/show_bug.cgi?id=178067
1453         https://trac.webkit.org/changeset/223523
1454
1455 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1456
1457         [JSC] __proto__ getter should be fast
1458         https://bugs.webkit.org/show_bug.cgi?id=178067
1459
1460         Reviewed by Saam Barati.
1461
1462         * stress/dfg-object-proto-accessor.js: Added.
1463         (shouldBe):
1464         (shouldThrow):
1465         (target):
1466         * stress/dfg-object-proto-getter.js: Added.
1467         (shouldBe):
1468         (shouldThrow):
1469         (target):
1470         * stress/dfg-object-prototype-of.js: Added.
1471         (shouldBe):
1472         (shouldThrow):
1473         (target):
1474         * stress/dfg-reflect-get-prototype-of.js: Added.
1475         (shouldBe):
1476         (shouldThrow):
1477         (target):
1478         * stress/object-get-prototype-of-filtered.js: Added.
1479         (shouldBe):
1480         (shouldThrow):
1481         (target):
1482         (i.Cocoa):
1483         * stress/object-get-prototype-of-mono-proto.js: Added.
1484         (shouldBe):
1485         (makePolyProtoObject.foo.C):
1486         (makePolyProtoObject.foo):
1487         (makePolyProtoObject):
1488         (target):
1489         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1490         (shouldBe):
1491         (makePolyProtoObject.foo.C):
1492         (makePolyProtoObject.foo):
1493         (makePolyProtoObject):
1494         (target):
1495         * stress/object-get-prototype-of-poly-proto.js: Added.
1496         (shouldBe):
1497         (makePolyProtoObject.foo.C):
1498         (makePolyProtoObject.foo):
1499         (makePolyProtoObject):
1500         (target):
1501         * stress/object-proto-getter-filtered.js: Added.
1502         (shouldBe):
1503         (shouldThrow):
1504         (target):
1505         (i.Cocoa):
1506         * stress/object-proto-getter-poly-mono-proto.js: Added.
1507         (shouldBe):
1508         (makePolyProtoObject.foo.C):
1509         (makePolyProtoObject.foo):
1510         (makePolyProtoObject):
1511         (target):
1512         * stress/object-proto-getter-poly-proto.js: Added.
1513         (shouldBe):
1514         (makePolyProtoObject.foo.C):
1515         (makePolyProtoObject.foo):
1516         (makePolyProtoObject):
1517         (target):
1518         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1519         * stress/string-proto.js: Added.
1520         (shouldBe):
1521         (target):
1522
1523 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1524
1525         Reland "Add Above/Below comparisons for UInt32 patterns"
1526         https://bugs.webkit.org/show_bug.cgi?id=177281
1527
1528         Reviewed by Saam Barati.
1529
1530         * stress/uint32-comparison-jump.js: Added.
1531         (shouldBe):
1532         (above):
1533         (aboveOrEqual):
1534         (below):
1535         (belowOrEqual):
1536         (notAbove):
1537         (notAboveOrEqual):
1538         (notBelow):
1539         (notBelowOrEqual):
1540         * stress/uint32-comparison.js: Added.
1541         (shouldBe):
1542         (above):
1543         (aboveOrEqual):
1544         (below):
1545         (belowOrEqual):
1546         (aboveTest):
1547         (aboveOrEqualTest):
1548         (belowTest):
1549         (belowOrEqualTest):
1550
1551 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1552
1553         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1554         https://bugs.webkit.org/show_bug.cgi?id=178210
1555
1556         Reviewed by Saam Barati.
1557
1558         * wasm/function-tests/trap-from-start-async.js:
1559         (async.StartTrapsAsync):
1560         * wasm/function-tests/trap-from-start.js:
1561         (StartTraps):
1562         * wasm/js-api/web-assembly-function.js:
1563         (assert.eq.Object.getPrototypeOf):
1564         * wasm/js-api/wrapper-function.js:
1565         (return.new.WebAssembly.Module):
1566         (assert.throws.makeInstance): Deleted.
1567         (assert.throws.Bar): Deleted.
1568         (assert.throws): Deleted.
1569
1570 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1571
1572         Enable gigacage on iOS
1573         https://bugs.webkit.org/show_bug.cgi?id=177586
1574
1575         Reviewed by JF Bastien.
1576         
1577         Add tests for when Gigacage gets runtime disabled.
1578
1579         * stress/disable-gigacage-arrays.js: Added.
1580         (foo):
1581         * stress/disable-gigacage-strings.js: Added.
1582         (foo):
1583         * stress/disable-gigacage-typed-arrays.js: Added.
1584         (foo):
1585
1586 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1587
1588         import.meta should not be assignable
1589         https://bugs.webkit.org/show_bug.cgi?id=178202
1590
1591         Reviewed by Saam Barati.
1592
1593         * modules/import-meta-assignment.js: Added.
1594         (shouldThrow):
1595         (SyntaxError.import.meta.can.shouldThrow):
1596
1597 2017-10-11  Saam Barati  <sbarati@apple.com>
1598
1599         Unreviewed. Actually skip certain type profiler tests in debug.
1600
1601         * typeProfiler.yaml:
1602         * typeProfiler/deltablue-for-of.js:
1603         * typeProfiler/getter-richards.js:
1604
1605 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1606
1607         Unreviewed, rolling out r223113 and r223121.
1608         https://bugs.webkit.org/show_bug.cgi?id=178182
1609
1610         Reintroduced 20% regression on Kraken (Requested by rniwa on
1611         #webkit).
1612
1613         Reverted changesets:
1614
1615         "Enable gigacage on iOS"
1616         https://bugs.webkit.org/show_bug.cgi?id=177586
1617         https://trac.webkit.org/changeset/223113
1618
1619         "Use one virtual allocation for all gigacages and their
1620         runways"
1621         https://bugs.webkit.org/show_bug.cgi?id=178050
1622         https://trac.webkit.org/changeset/223121
1623
1624 2017-10-11  Michael Saboff  <msaboff@apple.com>
1625
1626         Disable test262 named capture group tests with direct unicode names and with references before definitions
1627         https://bugs.webkit.org/show_bug.cgi?id=178177
1628
1629         Reviewed by Keith Miller.
1630
1631         Bugs to track fixing these test are:
1632         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1633             "Add support in named capture group identifiers for direct surrogate pairs"
1634         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1635             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1636
1637         * test262.yaml:
1638
1639 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1640
1641         Object properties are undefined in super.call() but not in this.call()
1642         https://bugs.webkit.org/show_bug.cgi?id=177230
1643
1644         Reviewed by Saam Barati.
1645
1646         * stress/super-call-function-subclass.js: Added.
1647         (assert):
1648         (A.prototype.t):
1649         (A):
1650         * stress/super-dot-call-and-apply.js: Added.
1651         (assert):
1652         (A):
1653         (A.prototype.call):
1654         (A.prototype.apply):
1655         (B.prototype.testSuper):
1656         (B):
1657         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1658         (D.prototype.testSuper):
1659         (D):
1660
1661 2017-10-10  Saam Barati  <sbarati@apple.com>
1662
1663         The prototype cache should be aware of the Executable it generates a Structure for
1664         https://bugs.webkit.org/show_bug.cgi?id=177907
1665
1666         Reviewed by Filip Pizlo.
1667
1668         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1669         (assert):
1670         (foo.C):
1671         (foo):
1672         (bar.C):
1673         (bar):
1674         (access):
1675         (makeLongChain):
1676         (accessY):
1677
1678 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1679
1680         `async` should be able to be used as an imported binding name
1681         https://bugs.webkit.org/show_bug.cgi?id=176573
1682
1683         Reviewed by Saam Barati.
1684
1685         * modules/import-default-async.js: Added.
1686         * modules/import-named-async-as.js: Added.
1687         * modules/import-named-async.js: Added.
1688         * modules/import-named-async/target.js: Added.
1689         * modules/import-namespace-async.js: Added.
1690         * test262.yaml:
1691
1692 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1693
1694         Enable gigacage on iOS
1695         https://bugs.webkit.org/show_bug.cgi?id=177586
1696
1697         Reviewed by JF Bastien.
1698         
1699         Add tests for when Gigacage gets runtime disabled.
1700
1701         * stress/disable-gigacage-arrays.js: Added.
1702         (foo):
1703         * stress/disable-gigacage-strings.js: Added.
1704         (foo):
1705         * stress/disable-gigacage-typed-arrays.js: Added.
1706         (foo):
1707
1708 2017-10-09  Michael Saboff  <msaboff@apple.com>
1709
1710         Implement RegExp Unicode property escapes
1711         https://bugs.webkit.org/show_bug.cgi?id=172069
1712
1713         Reviewed by JF Bastien.
1714
1715         Enabled Unicode Property tests.
1716
1717         * test262.yaml:
1718
1719 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1720
1721         Unreviewed, rolling out r223015 and r223025.
1722         https://bugs.webkit.org/show_bug.cgi?id=178093
1723
1724         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1725         #webkit).
1726
1727         Reverted changesets:
1728
1729         "Enable gigacage on iOS"
1730         https://bugs.webkit.org/show_bug.cgi?id=177586
1731         http://trac.webkit.org/changeset/223015
1732
1733         "Unreviewed, disable Gigacage on ARM64 Linux"
1734         https://bugs.webkit.org/show_bug.cgi?id=177586
1735         http://trac.webkit.org/changeset/223025
1736
1737 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1738
1739         Update expectations for test262 tests that pass after r223043.
1740         https://bugs.webkit.org/show_bug.cgi?id=176685
1741
1742         Unreviewed test gardening.
1743
1744         * test262.yaml:
1745
1746 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1747
1748         Unreviewed, rolling out r223022.
1749
1750         This change introduced 18 test262 failures.
1751
1752         Reverted changeset:
1753
1754         "`async` should be able to be used as an imported binding
1755         name"
1756         https://bugs.webkit.org/show_bug.cgi?id=176573
1757         http://trac.webkit.org/changeset/223022
1758
1759 2017-10-09  Saam Barati  <sbarati@apple.com>
1760
1761         3 poly-proto JSC tests timing out on debug after r222827
1762         https://bugs.webkit.org/show_bug.cgi?id=177880
1763         <rdar://problem/34817122>
1764
1765         Unreviewed.
1766
1767         I'm skipping these type profiler tests on debug since they are long running.
1768
1769         * typeProfiler/deltablue-for-of.js:
1770         * typeProfiler/getter-richards.js:
1771
1772 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1773
1774         Safari 10 /11 problem with if (!await get(something)).
1775         https://bugs.webkit.org/show_bug.cgi?id=176685
1776
1777         Reviewed by Saam Barati.
1778
1779         * stress/async-await-basic.js:
1780         (awaitEpression.async):
1781         * stress/async-await-syntax.js:
1782         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1783         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1784
1785 2017-10-08  Saam Barati  <sbarati@apple.com>
1786
1787         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1788
1789         * typeProfiler/deltablue-for-of.js:
1790         * typeProfiler/getter-richards.js:
1791
1792 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1793
1794         `async` should be able to be used as an imported binding name
1795         https://bugs.webkit.org/show_bug.cgi?id=176573
1796
1797         Reviewed by Darin Adler.
1798
1799         * modules/import-default-async.js: Added.
1800         * modules/import-named-async-as.js: Added.
1801         * modules/import-named-async.js: Added.
1802         * modules/import-named-async/target.js: Added.
1803         * modules/import-namespace-async.js: Added.
1804
1805 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1806
1807         Enable gigacage on iOS
1808         https://bugs.webkit.org/show_bug.cgi?id=177586
1809
1810         Reviewed by JF Bastien.
1811         
1812         Add tests for when Gigacage gets runtime disabled.
1813
1814         * stress/disable-gigacage-arrays.js: Added.
1815         (foo):
1816         * stress/disable-gigacage-strings.js: Added.
1817         (foo):
1818         * stress/disable-gigacage-typed-arrays.js: Added.
1819         (foo):
1820
1821 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1822
1823         Unreviewed, rolling out r222791 and r222873.
1824         https://bugs.webkit.org/show_bug.cgi?id=178031
1825
1826         Caused crashes with workers/wasm LayoutTests (Requested by
1827         ryanhaddad on #webkit).
1828
1829         Reverted changesets:
1830
1831         "WebAssembly: no VM / JS version of everything but Instance"
1832         https://bugs.webkit.org/show_bug.cgi?id=177473
1833         http://trac.webkit.org/changeset/222791
1834
1835         "WebAssembly: address no VM / JS follow-ups"
1836         https://bugs.webkit.org/show_bug.cgi?id=177887
1837         http://trac.webkit.org/changeset/222873
1838
1839 2017-10-05  Saam Barati  <sbarati@apple.com>
1840
1841         Make sure all prototypes under poly proto get added into the VM's prototype map
1842         https://bugs.webkit.org/show_bug.cgi?id=177909
1843
1844         Reviewed by Keith Miller.
1845
1846         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1847         (assert):
1848         (foo.C):
1849         (foo):
1850         (set x):
1851
1852 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1853
1854         [JSC] Introduce import.meta
1855         https://bugs.webkit.org/show_bug.cgi?id=177703
1856
1857         Reviewed by Filip Pizlo.
1858
1859         * modules/import-meta-syntax.js: Added.
1860         (shouldThrow):
1861         (shouldNotThrow):
1862         * modules/import-meta.js: Added.
1863         * modules/import-meta/cocoa.js: Added.
1864         * modules/resources/assert.js:
1865         (export.shouldNotThrow):
1866         * stress/import-syntax.js:
1867
1868 2017-10-04  Saam Barati  <sbarati@apple.com>
1869
1870         Make pertinent AccessCases watch the poly proto watchpoint
1871         https://bugs.webkit.org/show_bug.cgi?id=177765
1872
1873         Reviewed by Keith Miller.
1874
1875         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1876         (assert):
1877         (foo.C):
1878         (foo):
1879         (validate):
1880         * stress/poly-proto-clear-stub.js: Added.
1881         (assert):
1882         (foo.C):
1883         (foo):
1884
1885 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1886
1887         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1888
1889         Unreviewed test gardening.
1890
1891         * test262.yaml:
1892
1893 2017-10-04  Saam Barati  <sbarati@apple.com>
1894
1895         3 poly-proto JSC tests timing out on debug after r222827
1896         https://bugs.webkit.org/show_bug.cgi?id=177880
1897
1898         Rubber stamped by Mark Lam.
1899
1900         * microbenchmarks/poly-proto-access.js:
1901         * typeProfiler/deltablue-for-of.js:
1902         * typeProfiler/getter-richards.js:
1903
1904 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1905
1906         Unreviewed, marking tco-catch.js as a failure after test262 update
1907         https://bugs.webkit.org/show_bug.cgi?id=177859
1908
1909         * test262.yaml:
1910
1911 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1912
1913         Unreviewed, marking one async iterator test262 test failed
1914         https://bugs.webkit.org/show_bug.cgi?id=177859
1915
1916         * test262.yaml:
1917
1918 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1919
1920         [Test262] Update Test262 to Oct 4 version
1921         https://bugs.webkit.org/show_bug.cgi?id=177859
1922
1923         Reviewed by Sam Weinig.
1924
1925         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1926         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1927
1928         * test262.yaml:
1929         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1930         (checkSequence):
1931         * test262/harness/typeCoercion.js:
1932         (testCoercibleToIndexZero):
1933         (testCoercibleToIndexOne):
1934         (testCoercibleToIndexFromIndex):
1935         (testNotCoercibleToIndex.testPrimitiveValue):
1936         (testNotCoercibleToInteger):
1937         (testCoercibleToBigIntZero.testPrimitiveValue):
1938         (testCoercibleToBigIntZero):
1939         (testCoercibleToBigIntOne.testPrimitiveValue):
1940         (testCoercibleToBigIntOne):
1941         (testPrimitiveValue):
1942         (testCoercibleToBigIntFromBigInt):
1943         (testNotCoercibleToBigInt.testPrimitiveValue):
1944         (testNotCoercibleToBigInt.testStringValue):
1945         (testNotCoercibleToBigInt):
1946         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1947         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1948         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1949         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1950         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1951         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1952         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1953         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1954         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1955         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
1956         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
1957         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
1958         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
1959         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
1960         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
1961         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
1962         (testCoercibleToBigIntZero):
1963         (testCoercibleToBigIntOne):
1964         (testNotCoercibleToBigInt):
1965         (MyError): Deleted.
1966         (valueOf): Deleted.
1967         (toString): Deleted.
1968         (Symbol.toPrimitive): Deleted.
1969         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
1970         (testCoercibleToIndexZero):
1971         (testCoercibleToIndexOne):
1972         (testNotCoercibleToIndex):
1973         (MyError): Deleted.
1974         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
1975         (assert.sameValue.BigInt.asIntN.toString): Deleted.
1976         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
1977         (BigInt.asIntN.valueOf): Deleted.
1978         (BigInt.asIntN.toString): Deleted.
1979         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
1980         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
1981         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
1982         (testCoercibleToBigIntZero):
1983         (testCoercibleToBigIntOne):
1984         (testNotCoercibleToBigInt):
1985         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
1986         (testCoercibleToIndexZero):
1987         (testCoercibleToIndexOne):
1988         (testNotCoercibleToIndex):
1989         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
1990         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
1991         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
1992         (bits.valueOf):
1993         (bigint.valueOf):
1994         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
1995         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
1996         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
1997         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
1998         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
1999         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
2000         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
2001         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
2002         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
2003         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
2004         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
2005         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
2006         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
2007         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
2008         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
2009         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
2010         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
2011         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
2012         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
2013         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
2014         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
2015         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
2016         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
2017         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
2018         (replacer):
2019         (BigInt.prototype.toJSON):
2020         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
2021         (replacer):
2022         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
2023         (BigInt.prototype.toJSON):
2024         * test262/test/built-ins/JSON/stringify/bigint.js:
2025         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
2026         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
2027         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
2028         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
2029         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
2030         * test262/test/built-ins/Object/proto-from-ctor.js:
2031         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
2032         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
2033         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
2034         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
2035         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
2036         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
2037         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
2038         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
2039         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
2040         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
2041         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
2042         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
2043         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
2044         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
2045         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
2046         * test262/test/built-ins/Proxy/get-fn-realm.js:
2047         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
2048         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
2049         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
2050         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
2051         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
2052         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
2053         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
2054         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
2055         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
2056         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
2057         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
2058         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
2059         (i6.replace):
2060         (i6b.replace):
2061         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
2062         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
2063         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
2064         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
2065         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
2066         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
2067         * test262/test/built-ins/RegExp/u180e.js: Added.
2068         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
2069         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
2070         * test262/test/built-ins/String/proto-from-ctor-realm.js:
2071         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
2072         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
2073         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
2074         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
2075         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
2076         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
2077         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
2078         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
2079         * test262/test/built-ins/String/prototype/endsWith/length.js:
2080         * test262/test/built-ins/String/prototype/endsWith/name.js:
2081         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
2082         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
2083         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
2084         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
2085         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
2086         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
2087         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
2088         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
2089         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
2090         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
2091         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
2092         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
2093         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
2094         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
2095         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
2096         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
2097         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
2098         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
2099         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
2100         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
2101         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
2102         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
2103         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
2104         * test262/test/built-ins/String/prototype/includes/includes.js:
2105         * test262/test/built-ins/String/prototype/includes/length.js:
2106         * test262/test/built-ins/String/prototype/includes/name.js:
2107         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
2108         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
2109         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
2110         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
2111         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
2112         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
2113         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
2114         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
2115         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
2116         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
2117         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
2118         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
2119         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
2120         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
2121         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
2122         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
2123         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
2124         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
2125         * test262/test/built-ins/String/prototype/trim/u180e.js:
2126         * test262/test/built-ins/Symbol/for/cross-realm.js:
2127         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
2128         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
2129         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
2130         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
2131         * test262/test/built-ins/Symbol/match/cross-realm.js:
2132         * test262/test/built-ins/Symbol/replace/cross-realm.js:
2133         * test262/test/built-ins/Symbol/search/cross-realm.js:
2134         * test262/test/built-ins/Symbol/species/cross-realm.js:
2135         * test262/test/built-ins/Symbol/split/cross-realm.js:
2136         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
2137         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
2138         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
2139         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
2140         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
2141         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
2142         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
2143         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
2144         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
2145         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
2146         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
2147         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
2148         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
2149         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
2150         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
2151         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
2152         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
2153         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
2154         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
2155         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
2156         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
2157         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
2158         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
2159         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
2160         * test262/test/language/comments/mongolian-vowel-separator-single.js:
2161         * test262/test/language/eval-code/indirect/realm.js:
2162         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
2163         (o.get z):
2164         (o.get a):
2165         * test262/test/language/expressions/call/eval-realm-indirect.js:
2166         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
2167         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
2168         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
2169         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
2170         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2171         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
2172         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
2173         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
2174         * test262/test/language/expressions/greater-than/bigint-and-number.js:
2175         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
2176         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
2177         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
2178         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2179         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
2180         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
2181         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
2182         * test262/test/language/expressions/less-than/bigint-and-number.js:
2183         * test262/test/language/expressions/new/non-ctor-err-realm.js:
2184         * test262/test/language/expressions/super/realm.js:
2185         * test262/test/language/expressions/tagged-template/cache-realm.js:
2186         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
2187         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
2188         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
2189         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
2190         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
2191         * test262/test/language/literals/string/mongolian-vowel-separator.js:
2192         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
2193         (o.get z):
2194         (o.get a):
2195         * test262/test/language/statements/for-of/iterator-next-reference.js:
2196         (next):
2197         (iterator.next): Deleted.
2198         (x.of.iterable.): Deleted.
2199         (x.of.iterable.get return): Deleted.
2200         (x.of.iterable.iterator.next): Deleted.
2201         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
2202         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
2203         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
2204         * test262/test/language/white-space/mongolian-vowel-separator.js:
2205         * test262/test262-Revision.txt:
2206
2207 2017-10-03  Saam Barati  <sbarati@apple.com>
2208
2209         Implement polymorphic prototypes
2210         https://bugs.webkit.org/show_bug.cgi?id=176391
2211
2212         Reviewed by Filip Pizlo.
2213
2214         * microbenchmarks/poly-proto-access.js: Added.
2215         (assert):
2216         (foo.C):
2217         (foo.C.prototype.get bar):
2218         (foo):
2219         (bar):
2220         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
2221         (assert):
2222         (makePolyProtoObject.foo.C):
2223         (makePolyProtoObject.foo):
2224         (makePolyProtoObject):
2225         (performSet):
2226         * microbenchmarks/poly-proto-setter-speed.js: Added.
2227         (assert):
2228         (makePolyProtoObject.foo.C):
2229         (makePolyProtoObject.foo.C.prototype.set p):
2230         (makePolyProtoObject.foo):
2231         (makePolyProtoObject):
2232         (performSet):
2233         * stress/constructor-with-return.js:
2234         (i.tests.forEach.Constructor):
2235         (i.tests.forEach):
2236         (tests.forEach.Constructor): Deleted.
2237         (tests.forEach): Deleted.
2238         * stress/dom-jit-with-poly-proto.js: Added.
2239         (assert):
2240         (makePolyProtoObject.foo.C):
2241         (makePolyProtoObject.foo):
2242         (makePolyProtoObject):
2243         (validate):
2244         * stress/poly-proto-custom-value-and-accessor.js: Added.
2245         (assert):
2246         (makePolyProtoObject.foo.C):
2247         (makePolyProtoObject.foo):
2248         (makePolyProtoObject):
2249         (items.forEach):
2250         (set get for):
2251         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
2252         (assert):
2253         (makePolyProtoObject.foo.C):
2254         (makePolyProtoObject.foo):
2255         (makePolyProtoObject):
2256         (foo):
2257         * stress/poly-proto-miss.js: Added.
2258         (makePolyProtoInstanceWithNullPrototype.foo.C):
2259         (makePolyProtoInstanceWithNullPrototype.foo):
2260         (makePolyProtoInstanceWithNullPrototype):
2261         (assert):
2262         (validate):
2263         * stress/poly-proto-op-in-caching.js: Added.
2264         (assert):
2265         (makePolyProtoObject.foo.C):
2266         (makePolyProtoObject.foo):
2267         (makePolyProtoObject):
2268         (validate):
2269         (validate2):
2270         * stress/poly-proto-put-transition.js: Added.
2271         (assert):
2272         (makePolyProtoObject.foo.C):
2273         (makePolyProtoObject.foo):
2274         (makePolyProtoObject):
2275         (performSet):
2276         (i.obj.__proto__.set p):
2277         * stress/poly-proto-set-prototype.js: Added.
2278         (assert):
2279         (let.alternateProto.get x):
2280         (let.alternateProto2.get y):
2281         (let.alternateProto2.get x):
2282         (foo.C):
2283         (foo):
2284         (validate):
2285         * stress/poly-proto-setter.js: Added.
2286         (assert):
2287         (makePolyProtoObject.foo.C):
2288         (makePolyProtoObject.foo.C.prototype.set p):
2289         (makePolyProtoObject.foo.C.prototype.get p):
2290         (makePolyProtoObject.foo):
2291         (makePolyProtoObject):
2292         (performSet):
2293         * stress/poly-proto-using-inheritance.js: Added.
2294         (assert):
2295         (foo.C):
2296         (foo.C.prototype.get baz):
2297         (foo):
2298         (bar.C):
2299         (bar):
2300         (validate):
2301         * stress/primitive-poly-proto.js: Added.
2302         (makePolyProtoInstance.foo.C):
2303         (makePolyProtoInstance.foo):
2304         (makePolyProtoInstance):
2305         (assert):
2306         (validate):
2307         * stress/prototype-is-not-js-object.js: Added.
2308         (foo.bar):
2309         (foo):
2310         (assert):
2311         (validate):
2312         * stress/try-get-by-id-poly-proto.js: Added.
2313         (assert):
2314         (makePolyProtoObject.foo.C):
2315         (makePolyProtoObject.foo):
2316         (makePolyProtoObject):
2317         (tryGetByIdText):
2318         (x.__proto__.get bar):
2319         (validate):
2320         * typeProfiler/overflow.js:
2321
2322 2017-10-03  JF Bastien  <jfbastien@apple.com>
2323
2324         WebAssembly: no VM / JS version of everything but Instance
2325         https://bugs.webkit.org/show_bug.cgi?id=177473
2326
2327         Reviewed by Filip Pizlo.
2328
2329         - Exceeding max on memory growth now returns a range error as per
2330         spec. This is a (very minor) breaking change: it used to throw OOM
2331         error. Update the corresponding test.
2332
2333         * wasm/js-api/memory-grow.js:
2334         (assertEq):
2335         * wasm/js-api/table.js:
2336         (assert.throws):
2337
2338 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
2339
2340         Skip JSC test stress/regress-159779-2.js on debug.
2341         https://bugs.webkit.org/show_bug.cgi?id=177204
2342
2343         Unreviewed test gardening.
2344
2345         * stress/regress-159779-2.js:
2346
2347 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
2348
2349         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2350         https://bugs.webkit.org/show_bug.cgi?id=175642
2351
2352         Reviewed by Darin Adler.
2353
2354         * ChakraCore/test/Function/apply3.baseline-jsc:
2355
2356 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2357
2358         Unreviewed, rolling out r222564.
2359         https://bugs.webkit.org/show_bug.cgi?id=177720
2360
2361         "It regressed JetStream by 2% on iOS caused by a 50%
2362         regression on the bigfib subtest" (Requested by saamyjoon on
2363         #webkit).
2364
2365         Reverted changeset:
2366
2367         "Add Above/Below comparisons for UInt32 patterns"
2368         https://bugs.webkit.org/show_bug.cgi?id=177281
2369         http://trac.webkit.org/changeset/222564
2370
2371 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2372
2373         [DFG] Support ArrayPush with multiple args
2374         https://bugs.webkit.org/show_bug.cgi?id=175823
2375
2376         Reviewed by Saam Barati.
2377
2378         * microbenchmarks/array-push-0.js: Added.
2379         (arrayPush0):
2380         * microbenchmarks/array-push-1.js: Added.
2381         (arrayPush1):
2382         * microbenchmarks/array-push-2.js: Added.
2383         (arrayPush2):
2384         * microbenchmarks/array-push-3.js: Added.
2385         (arrayPush3):
2386         * stress/array-push-multiple-contiguous.js: Added.
2387         (shouldBe):
2388         (test):
2389         * stress/array-push-multiple-double-nan.js: Added.
2390         (shouldBe):
2391         (test):
2392         * stress/array-push-multiple-double.js: Added.
2393         (shouldBe):
2394         (test):
2395         * stress/array-push-multiple-int32.js: Added.
2396         (shouldBe):
2397         (test):
2398         * stress/array-push-multiple-many-contiguous.js: Added.
2399         (shouldBe):
2400         (test):
2401         * stress/array-push-multiple-many-double.js: Added.
2402         (shouldBe):
2403         (test):
2404         * stress/array-push-multiple-many-int32.js: Added.
2405         (shouldBe):
2406         (test):
2407         * stress/array-push-multiple-many-storage.js: Added.
2408         (shouldBe):
2409         (test):
2410         * stress/array-push-multiple-storage.js: Added.
2411         (shouldBe):
2412         (test):
2413         * stress/array-push-with-force-exit.js: Added.
2414         (target.createBuiltin):
2415
2416 2017-09-29  Saam Barati  <sbarati@apple.com>
2417
2418         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2419         https://bugs.webkit.org/show_bug.cgi?id=177639
2420
2421         Reviewed by Geoffrey Garen.
2422
2423         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2424         (assert):
2425         (Class):
2426         (items.forEach):
2427         (set get for):
2428
2429 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2430
2431         Unreviewed, rolling out r222563, r222565, and r222581.
2432         https://bugs.webkit.org/show_bug.cgi?id=177675
2433
2434         "It causes a crash when playing youtube videos" (Requested by
2435         saamyjoon on #webkit).
2436
2437         Reverted changesets:
2438
2439         "[DFG] Support ArrayPush with multiple args"
2440         https://bugs.webkit.org/show_bug.cgi?id=175823
2441         http://trac.webkit.org/changeset/222563
2442
2443         "Unreviewed, build fix after r222563"
2444         https://bugs.webkit.org/show_bug.cgi?id=175823
2445         http://trac.webkit.org/changeset/222565
2446
2447         "Unreviewed, fix x86 breaking due to exhausted registers"
2448         https://bugs.webkit.org/show_bug.cgi?id=175823
2449         http://trac.webkit.org/changeset/222581
2450
2451 2017-09-28  Mark Lam  <mark.lam@apple.com>
2452
2453         test262: Unexpected passes after r222617 and r222618.
2454         https://bugs.webkit.org/show_bug.cgi?id=177622
2455         <rdar://problem/34725960>
2456
2457         Reviewed by Saam Barati.
2458
2459         Update test262.yaml for tests that are now passing.
2460
2461         * test262.yaml:
2462
2463 2017-09-27  Michael Saboff  <msaboff@apple.com>
2464
2465         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2466         https://bugs.webkit.org/show_bug.cgi?id=177570
2467
2468         Reviewed by Filip Pizlo.
2469
2470         New regression test.
2471
2472         * stress/regress-177570.js: Added.
2473
2474 2017-09-28  Michael Saboff  <msaboff@apple.com>
2475
2476         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2477         https://bugs.webkit.org/show_bug.cgi?id=177423
2478
2479         Reviewed by Mark Lam.
2480
2481         Updated regression test.
2482
2483         * stress/regress-177423.js:
2484         (catch):
2485
2486 2017-09-27  Mark Lam  <mark.lam@apple.com>
2487
2488         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2489         https://bugs.webkit.org/show_bug.cgi?id=177584
2490         <rdar://problem/34463903>
2491
2492         Reviewed by Saam Barati.
2493
2494         * stress/regress-177584.js: Added.
2495         (assertEqual):
2496         (Array.prototype.Symbol.species):
2497
2498 2017-09-27  Saam Barati  <sbarati@apple.com>
2499
2500         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2501         https://bugs.webkit.org/show_bug.cgi?id=177523
2502
2503         Reviewed by Mark Lam.
2504
2505         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2506         (assert):
2507         (Test):
2508         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2509         (addMethods):
2510         (i.Test.prototype.propName):
2511
2512 2017-09-27  Mark Lam  <mark.lam@apple.com>
2513
2514         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2515         https://bugs.webkit.org/show_bug.cgi?id=177423
2516         <rdar://problem/34621320>
2517
2518         Reviewed by Keith Miller.
2519
2520         * stress/regress-177423.js: Added.
2521
2522 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2523
2524         Add Above/Below comparisons for UInt32 patterns
2525         https://bugs.webkit.org/show_bug.cgi?id=177281
2526
2527         Reviewed by Saam Barati.
2528
2529         * stress/uint32-comparison-jump.js: Added.
2530         (shouldBe):
2531         (above):
2532         (aboveOrEqual):
2533         (below):
2534         (belowOrEqual):
2535         (notAbove):
2536         (notAboveOrEqual):
2537         (notBelow):
2538         (notBelowOrEqual):
2539         * stress/uint32-comparison.js: Added.
2540         (shouldBe):
2541         (above):
2542         (aboveOrEqual):
2543         (below):
2544         (belowOrEqual):
2545         (aboveTest):
2546         (aboveOrEqualTest):
2547         (belowTest):
2548         (belowOrEqualTest):
2549
2550 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2551
2552         [DFG] Support ArrayPush with multiple args
2553         https://bugs.webkit.org/show_bug.cgi?id=175823
2554
2555         Reviewed by Saam Barati.
2556
2557         * microbenchmarks/array-push-0.js: Added.
2558         (arrayPush0):
2559         * microbenchmarks/array-push-1.js: Added.
2560         (arrayPush1):
2561         * microbenchmarks/array-push-2.js: Added.
2562         (arrayPush2):
2563         * microbenchmarks/array-push-3.js: Added.
2564         (arrayPush3):
2565         * stress/array-push-multiple-contiguous.js: Added.
2566         (shouldBe):
2567         (test):
2568         * stress/array-push-multiple-double-nan.js: Added.
2569         (shouldBe):
2570         (test):
2571         * stress/array-push-multiple-double.js: Added.
2572         (shouldBe):
2573         (test):
2574         * stress/array-push-multiple-int32.js: Added.
2575         (shouldBe):
2576         (test):
2577         * stress/array-push-multiple-many-contiguous.js: Added.
2578         (shouldBe):
2579         (test):
2580         * stress/array-push-multiple-many-double.js: Added.
2581         (shouldBe):
2582         (test):
2583         * stress/array-push-multiple-many-int32.js: Added.
2584         (shouldBe):
2585         (test):
2586         * stress/array-push-multiple-many-storage.js: Added.
2587         (shouldBe):
2588         (test):
2589         * stress/array-push-multiple-storage.js: Added.
2590         (shouldBe):
2591         (test):
2592
2593 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2594
2595         Unreviewed, rolling out r222518.
2596         https://bugs.webkit.org/show_bug.cgi?id=177507
2597
2598         Break the High Sierra build (Requested by yusukesuzuki on
2599         #webkit).
2600
2601         Reverted changeset:
2602
2603         "Add Above/Below comparisons for UInt32 patterns"
2604         https://bugs.webkit.org/show_bug.cgi?id=177281
2605         http://trac.webkit.org/changeset/222518
2606
2607 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2608
2609         Add Above/Below comparisons for UInt32 patterns
2610         https://bugs.webkit.org/show_bug.cgi?id=177281
2611
2612         Reviewed by Saam Barati.
2613
2614         * stress/uint32-comparison-jump.js: Added.
2615         (shouldBe):
2616         (above):
2617         (aboveOrEqual):
2618         (below):
2619         (belowOrEqual):
2620         (notAbove):
2621         (notAboveOrEqual):
2622         (notBelow):
2623         (notBelowOrEqual):
2624         * stress/uint32-comparison.js: Added.
2625         (shouldBe):
2626         (above):
2627         (aboveOrEqual):
2628         (below):
2629         (belowOrEqual):
2630         (aboveTest):
2631         (aboveOrEqualTest):
2632         (belowTest):
2633         (belowOrEqualTest):
2634
2635 2017-09-23  Keith Miller  <keith_miller@apple.com>
2636
2637         Fix infinite looping test262 test
2638         https://bugs.webkit.org/show_bug.cgi?id=177412
2639
2640         Reviewed by Yusuke Suzuki.
2641
2642         This test was poorly designed since failing it would cause the vm
2643         to inifinite loop. I've fixed it locally and will fix it on github pending
2644         the results of next weeks tc39 meeting.
2645
2646         * test262.yaml:
2647         * test262/test/language/statements/for-of/iterator-next-reference.js:
2648
2649 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2650
2651         test262: $.agent became $262.agent in test262 update
2652         https://bugs.webkit.org/show_bug.cgi?id=177407
2653
2654         Reviewed by Yusuke Suzuki.
2655
2656         * test262.yaml:
2657         ~320 tests pass now that we correctly make $262 available.
2658
2659 2017-09-22  Keith Miller  <keith_miller@apple.com>
2660
2661         Speculatively change iteration protocall to use the same next function
2662         https://bugs.webkit.org/show_bug.cgi?id=175653
2663
2664         Reviewed by Saam Barati.
2665
2666         Change test to match the new iteration behavior.
2667
2668         * stress/spread-optimized-properly.js:
2669
2670 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2671
2672         [DFG][FTL] Profile array vector length for array allocation
2673         https://bugs.webkit.org/show_bug.cgi?id=177051
2674
2675         Reviewed by Saam Barati.
2676
2677         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2678         (target):
2679
2680 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2681
2682         Unreviewed, rolling out r222380.
2683         https://bugs.webkit.org/show_bug.cgi?id=177352
2684
2685         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2686         #webkit).
2687
2688         Reverted changeset:
2689
2690         "[DFG][FTL] Profile array vector length for array allocation"
2691         https://bugs.webkit.org/show_bug.cgi?id=177051
2692         http://trac.webkit.org/changeset/222380
2693
2694 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2695
2696         [DFG][FTL] Profile array vector length for array allocation
2697         https://bugs.webkit.org/show_bug.cgi?id=177051
2698
2699         Reviewed by Saam Barati.
2700
2701         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2702         (target):
2703
2704 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2705
2706         Skip new hanging test262 tests.
2707         https://bugs.webkit.org/show_bug.cgi?id=177326
2708
2709         Unreviewed test gardening.
2710
2711         * test262.yaml:
2712
2713 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2714
2715         Mark 6 test262 tests as passing.
2716         https://bugs.webkit.org/show_bug.cgi?id=177307
2717
2718         Unreviewed test gardening.
2719
2720         * test262.yaml:
2721
2722 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2723
2724         Unreviewed follow-up to r222311.
2725
2726         * test262/harness/sta.js:
2727         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2728         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2729         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2730         * test262/test/built-ins/Array/from/elements-added-after.js:
2731         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2732         * test262/test/built-ins/Array/from/elements-updated-after.js:
2733         * test262/test/built-ins/Array/from/from-array.js:
2734         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2735         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2736         * test262/test/built-ins/Array/from/source-array-boundary.js:
2737         * test262/test/built-ins/Array/from/source-object-constructor.js:
2738         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2739         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2740         * test262/test/built-ins/Array/from/source-object-length.js:
2741         * test262/test/built-ins/Array/from/source-object-missing.js:
2742         * test262/test/built-ins/Array/from/source-object-without.js:
2743         * test262/test/built-ins/Array/from/this-null.js:
2744         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2745         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2746         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2747         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2748         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2749         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2750         * test262/test/language/literals/string/7.8.4-1gs.js:
2751         Fix some files that I failed to update when I applied my patch.
2752
2753 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2754
2755         Update test262 tests
2756         https://bugs.webkit.org/show_bug.cgi?id=177220
2757
2758         Reviewed by Saam Barati and Yusuke Suzuki.
2759
2760         * test262.yaml:
2761         * test262/test262-Revision.txt:
2762         New rebaselined expectations for all tests.
2763
2764         * test262/*:
2765         Updated.
2766
2767 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2768
2769         [DFG] Remove ToThis more aggressively
2770         https://bugs.webkit.org/show_bug.cgi?id=177056
2771
2772         Reviewed by Saam Barati.
2773
2774         * stress/generator-with-this-strict.js: Added.
2775         (shouldBe):
2776         (generator):
2777         (target):
2778         * stress/generator-with-this.js: Added.
2779         (shouldBe):
2780         (generator):
2781         (target):
2782
2783 2017-09-17  Michael Saboff  <msaboff@apple.com>
2784
2785         https://bugs.webkit.org/show_bug.cgi?id=177038
2786         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2787
2788         Reviewed by JF Bastien.
2789
2790         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2791         as it dies using too much memory.
2792
2793 2017-09-15  Saam Barati  <sbarati@apple.com>
2794
2795         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2796         https://bugs.webkit.org/show_bug.cgi?id=176981
2797
2798         Reviewed by Yusuke Suzuki.
2799
2800         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2801         (assert):
2802         (verify):
2803         (func):
2804         (const.bar.createBuiltin):
2805
2806 2017-09-14  Saam Barati  <sbarati@apple.com>
2807
2808         It should be valid to exit before each set when doing arity fixup when inlining
2809         https://bugs.webkit.org/show_bug.cgi?id=176948
2810
2811         Reviewed by Keith Miller.
2812
2813         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2814         (baz):
2815         (bar):
2816         (foo):
2817
2818 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2819
2820         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2821         https://bugs.webkit.org/show_bug.cgi?id=176867
2822
2823         Reviewed by Sam Weinig.
2824
2825         * microbenchmarks/object-get-own-property-symbols.js: Added.
2826         (test):
2827
2828 2017-09-13  Mark Lam  <mark.lam@apple.com>
2829
2830         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2831         https://bugs.webkit.org/show_bug.cgi?id=176888
2832         <rdar://problem/34381832>
2833
2834         Not reviewed.
2835
2836         * stress/op_mod-ConstVar.js:
2837         * stress/op_mod-VarConst.js:
2838         * stress/op_mod-VarVar.js:
2839
2840 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2841
2842         Skip 3 op_mod tests on Debug JSC bots.
2843         https://bugs.webkit.org/show_bug.cgi?id=176630
2844
2845         Unreviewed test gardening.
2846
2847         * stress/op_mod-ConstVar.js:
2848         * stress/op_mod-VarConst.js:
2849         * stress/op_mod-VarVar.js:
2850
2851 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2852
2853         [JSC] Fix Array allocation in Object.keys
2854         https://bugs.webkit.org/show_bug.cgi?id=176826
2855
2856         Reviewed by Saam Barati.
2857
2858         * stress/object-own-property-keys.js: Added.
2859         (shouldBe):
2860
2861 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2862
2863         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2864         https://bugs.webkit.org/show_bug.cgi?id=176010
2865
2866         Reviewed by Filip Pizlo.
2867
2868         * microbenchmarks/weak-map-key.js: Added.
2869         (assert):
2870         (objectKey):
2871         (let.start.Date.now):
2872
2873 2017-09-12  Mark Lam  <mark.lam@apple.com>
2874
2875         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2876         https://bugs.webkit.org/show_bug.cgi?id=176630
2877
2878         Reviewed by JF Bastien.
2879
2880         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2881         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2882         a speculative fix for the bots that are seeing these fail.
2883
2884         I also undid the skipping of the op_mod tests for debug builds.
2885
2886         * stress/op_div-ConstVar.js:
2887         * stress/op_div-VarConst.js:
2888         * stress/op_div-VarVar.js:
2889         * stress/op_mod-ConstVar.js:
2890         * stress/op_mod-VarConst.js:
2891         * stress/op_mod-VarVar.js:
2892
2893 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2894
2895         Skip stress/value-to-boolean.js on Debug bots.
2896         https://bugs.webkit.org/show_bug.cgi?id=176787
2897
2898         Unreviewed test gardening.
2899
2900         * stress/value-to-boolean.js:
2901
2902 2017-09-11  Mark Lam  <mark.lam@apple.com>
2903
2904         Change test expectation for test262/test/language/statements/try/tco-catch.js
2905         https://bugs.webkit.org/show_bug.cgi?id=176749
2906
2907         Rubber stamped by Keith Miller.
2908
2909         It's been failing since at least r221821.  I'm changing the test expectation to
2910         fail to green the bots while I investigate some more.
2911
2912         * test262.yaml:
2913
2914 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2915
2916         Unreviewed, rolling out r221854.
2917
2918         The test added with this change fails on 32-bit JSC bots.
2919
2920         Reverted changeset:
2921
2922         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2923         https://bugs.webkit.org/show_bug.cgi?id=176010
2924         http://trac.webkit.org/changeset/221854
2925
2926 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2927
2928         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2929         https://bugs.webkit.org/show_bug.cgi?id=176010
2930
2931         Reviewed by Filip Pizlo.
2932
2933         * microbenchmarks/weak-map-key.js: Added.
2934         (assert):
2935         (objectKey):
2936         (let.start.Date.now):
2937
2938 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2939
2940         [JSC] Optimize Object.keys by using careful array allocation
2941         https://bugs.webkit.org/show_bug.cgi?id=176654
2942
2943         Reviewed by Darin Adler.
2944
2945         * microbenchmarks/object-keys.js: Added.
2946         (test):
2947
2948 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
2949
2950         Error should compute .stack and friends lazily
2951         https://bugs.webkit.org/show_bug.cgi?id=176645
2952
2953         Reviewed by Saam Barati.
2954
2955         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
2956         * microbenchmarks/new-error.js: Added.
2957         * microbenchmarks/throw.js: Added.
2958
2959 2017-09-09  Mark Lam  <mark.lam@apple.com>
2960
2961         [Re-landing] Use JIT probes for DFG OSR exit.
2962         https://bugs.webkit.org/show_bug.cgi?id=175144
2963         <rdar://problem/33437050>
2964
2965         Not reviewed.  Original patch reviewed by Saam Barati.
2966
2967         Disable these tests for debug builds because they run too slow with the new OSR exit.
2968
2969         * stress/op_mod-ConstVar.js:
2970         * stress/op_mod-VarConst.js:
2971         * stress/op_mod-VarVar.js:
2972
2973 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2974
2975         [DFG] NewArrayWithSize(size)'s size does not care negative zero
2976         https://bugs.webkit.org/show_bug.cgi?id=176300
2977
2978         Reviewed by Saam Barati.
2979
2980         * stress/new-array-with-size-div.js: Added.
2981         (shouldBe):
2982         (test):
2983         (i.i):
2984
2985 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2986
2987         [DFG] PutByVal with Array::Generic is too generic
2988         https://bugs.webkit.org/show_bug.cgi?id=176345
2989
2990         Reviewed by Filip Pizlo.
2991
2992         * stress/object-assign-symbols.js: Added.
2993         (shouldBe):
2994         (test):
2995         * stress/object-assign.js: Added.
2996         (shouldBe):
2997         (test):
2998         (i.shouldBe.JSON.stringify.test):
2999
3000 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3001
3002         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
3003         https://bugs.webkit.org/show_bug.cgi?id=176590
3004
3005         Reviewed by Saam Barati.
3006
3007         * microbenchmarks/object-iterate-symbols.js: Added.
3008         (test):
3009         * microbenchmarks/object-iterate.js: Added.
3010         (test):
3011         * stress/object-iterate-symbols.js: Added.
3012         (shouldBe):
3013         (test):
3014         * stress/object-iterate.js: Added.
3015         (shouldBe):
3016         (test):
3017
3018 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
3019
3020         [Win32] 10 JSC stress tests are failing.
3021         https://bugs.webkit.org/show_bug.cgi?id=176538
3022
3023         Reviewed by Mark Lam.
3024
3025         Skip tests on Windows to make the bots green.
3026
3027         * ChakraCore.yaml:
3028         * stress/date-relaxed.js:
3029
3030 2017-09-06  Mark Lam  <mark.lam@apple.com>
3031
3032         constructGenericTypedArrayViewWithArguments() is missing an exception check.
3033         https://bugs.webkit.org/show_bug.cgi?id=176485
3034         <rdar://problem/33898874>
3035
3036         Reviewed by Keith Miller.
3037
3038         * stress/regress-176485.js: Added.
3039
3040 2017-09-05  Saam Barati  <sbarati@apple.com>
3041
3042         isNotCellSpeculation is wrong with respect to SpecEmpty
3043         https://bugs.webkit.org/show_bug.cgi?id=176429
3044
3045         Reviewed by Michael Saboff.
3046
3047         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
3048         (Foo):
3049
3050 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
3051
3052         test262: Completion values for control flow do not match the spec
3053         https://bugs.webkit.org/show_bug.cgi?id=171265
3054
3055         Reviewed by Saam Barati.
3056
3057         * stress/completion-value.js:
3058         Condensed test for completion values in top level statements.
3059
3060         * stress/super-get-by-id.js:
3061         ClassDeclaration when evaled no longer produce values. Convert
3062         these to ClassExpressions so they produce the class value.
3063         
3064         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3065         This is a progression for currect spec behavior.
3066
3067         * mozilla/mozilla-tests.yaml:
3068         This test is now outdated, so mark it as failing for that reason.
3069
3070         * test262.yaml:
3071         Passing all "cptn" completion value tests.
3072
3073 2017-09-04  Saam Barati  <sbarati@apple.com>
3074
3075         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
3076         https://bugs.webkit.org/show_bug.cgi?id=176317
3077
3078         Reviewed by Keith Miller.
3079
3080         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
3081         (Foo):
3082
3083 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3084
3085         [DFG][FTL] Efficiently execute number#toString()
3086         https://bugs.webkit.org/show_bug.cgi?id=170007
3087
3088         Reviewed by Keith Miller.
3089
3090         * microbenchmarks/number-to-string-strength-reduction.js: Added.
3091         (test):
3092         * microbenchmarks/number-to-string-with-radix-10.js: Added.
3093         (test):
3094         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
3095         (test):
3096         * microbenchmarks/number-to-string-with-radix.js: Added.
3097         (test):
3098         * stress/number-to-string-strength-reduction.js: Added.
3099         (shouldBe):
3100         (test):
3101         * stress/number-to-string-with-radix-10.js: Added.
3102         (shouldBe):
3103         (test):
3104         * stress/number-to-string-with-radix-cse.js: Added.
3105         (shouldBe):
3106         (test):
3107         * stress/number-to-string-with-radix-invalid.js: Added.
3108         (shouldThrow):
3109         * stress/number-to-string-with-radix-watchpoint.js: Added.
3110         (shouldBe):
3111         (test):
3112         (i.i.1e3.Number.prototype.toString):
3113         * stress/number-to-string-with-radix.js: Added.
3114         (shouldBe):
3115         (test):
3116
3117 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3118
3119         [DFG] Relax arity requirement
3120         https://bugs.webkit.org/show_bug.cgi?id=175523
3121
3122         Reviewed by Saam Barati.
3123
3124         * stress/arity-mismatch-arguments-length.js: Added.
3125         (shouldBe):
3126         (test1):
3127         (test):
3128         * stress/arity-mismatch-get-argument.js: Added.
3129         (shouldBe):
3130         (builtin.createBuiltin):
3131         (test):
3132         * stress/arity-mismatch-inlining-extra-slots.js: Added.
3133         (shouldBe):
3134         (inlineTarget):
3135         (test):
3136         * stress/arity-mismatch-inlining.js: Added.
3137         (shouldBe):
3138         (inlineTarget):
3139         (test):
3140         * stress/arity-mismatch-rest.js: Added.
3141         (shouldBe):
3142         (test2):
3143         (test1):
3144         (test):
3145
3146 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3147
3148         [JSC] Fix "name" and "length" of Proxy revoke function
3149         https://bugs.webkit.org/show_bug.cgi?id=176155
3150
3151         Reviewed by Mark Lam.
3152
3153         * test262.yaml:
3154
3155 2017-08-31  Saam Barati  <sbarati@apple.com>
3156
3157         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
3158         https://bugs.webkit.org/show_bug.cgi?id=176206
3159
3160         Reviewed by Keith Miller.
3161
3162         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
3163         (a):
3164         (b):
3165         (foo):
3166
3167 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
3168
3169         Skip two slow JSC tests after r221422.
3170
3171         Unreviewed test gardening.
3172
3173         * stress/regexp-prototype-match-on-too-long-rope.js:
3174         * stress/regexp-prototype-test-on-too-long-rope.js:
3175
3176 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
3177
3178         Unreviewed, skipping slow tests.
3179         
3180         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
3181         work differently now.
3182
3183         * stress/regexp-prototype-exec-on-too-long-rope.js:
3184         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
3185
3186 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3187
3188         [JSC] Use reifying system for "name" property of builtin JSFunction
3189         https://bugs.webkit.org/show_bug.cgi?id=175260
3190
3191         Reviewed by Saam Barati.
3192
3193         * stress/accessors-get-set-prefix.js:
3194         * stress/builtin-function-name.js: Added.
3195         (shouldBe):
3196         (shouldThrow):
3197         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3198         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3199         * stress/private-name-as-anonymous-builtin.js: Added.
3200         (shouldBe):
3201         (NotPromise):
3202
3203 2017-08-30  Saam Barati  <sbarati@apple.com>
3204
3205         Unreviewed. Make test stop printing.
3206
3207         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
3208
3209 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
3210
3211         Unreviewed, rolling out r221327.
3212
3213         This change caused test262 failures.
3214
3215         Reverted changeset:
3216
3217         "[JSC] Use reifying system for "name" property of builtin
3218         JSFunction"
3219         https://bugs.webkit.org/show_bug.cgi?id=175260
3220         http://trac.webkit.org/changeset/221327
3221
3222 2017-08-30  Saam Barati  <sbarati@apple.com>
3223
3224         semicolon is being interpreted as an = in the LiteralParser
3225         https://bugs.webkit.org/show_bug.cgi?id=176114
3226
3227         Reviewed by Oliver Hunt.
3228
3229         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
3230         * stress/resources/literal-parser-test-case.js: Added.
3231
3232 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3233
3234         [ESNext] Async iteration - Implement async iteration statement: for-await-of
3235         https://bugs.webkit.org/show_bug.cgi?id=166698
3236
3237         Reviewed by Yusuke Suzuki.
3238
3239         * stress/async-iteration-for-await-of-syntax.js: Added.
3240         (assert):
3241         (checkSyntax):
3242         (checkSyntaxError):
3243         (checkSimpleAsyncGeneratorSloppyMode):
3244         (checkSimpleAsyncGeneratorStrictMode):
3245         (checkNestedAsyncGenerators):
3246         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3247         * stress/async-iteration-for-await-of.js: Added.
3248         (assert):
3249         (async.foo):
3250         (async.boo):
3251         (const.boo.async):
3252
3253 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
3254
3255         [JSC] Use reifying system for "name" property of builtin JSFunction
3256         https://bugs.webkit.org/show_bug.cgi?id=175260
3257
3258         Reviewed by Saam Barati.
3259
3260         * stress/accessors-get-set-prefix.js:
3261         * stress/builtin-function-name.js: Added.
3262         (shouldBe):
3263         (shouldThrow):
3264         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3265         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3266
3267 2017-08-25  Saam Barati  <sbarati@apple.com>
3268
3269         Support compiling catch in the DFG
3270         https://bugs.webkit.org/show_bug.cgi?id=174590
3271         <rdar://problem/34047845>
3272
3273         Reviewed by Filip Pizlo.
3274
3275         * microbenchmarks/delta-blue-try-catch.js: Added.
3276         (exception):
3277         (value):
3278         (OrderedCollection):
3279         (OrderedCollection.prototype.add):
3280         (OrderedCollection.prototype.at):
3281         (OrderedCollection.prototype.size):
3282         (OrderedCollection.prototype.removeFirst):
3283         (OrderedCollection.prototype.remove):
3284         (Strength):
3285         (Strength.stronger):
3286         (Strength.weaker):
3287         (Strength.weakestOf):
3288         (Strength.strongest):
3289         (Strength.prototype.nextWeaker):
3290         (Constraint):
3291         (Constraint.prototype.addConstraint):
3292         (Constraint.prototype.satisfy):
3293         (Constraint.prototype.destroyConstraint):
3294         (Constraint.prototype.isInput):
3295         (UnaryConstraint):
3296         (UnaryConstraint.prototype.addToGraph):
3297         (UnaryConstraint.prototype.chooseMethod):
3298         (UnaryConstraint.prototype.isSatisfied):
3299         (UnaryConstraint.prototype.markInputs):
3300         (UnaryConstraint.prototype.output):
3301         (UnaryConstraint.prototype.recalculate):
3302         (UnaryConstraint.prototype.markUnsatisfied):
3303         (UnaryConstraint.prototype.inputsKnown):
3304         (UnaryConstraint.prototype.removeFromGraph):
3305         (StayConstraint):
3306         (StayConstraint.prototype.execute):
3307         (EditConstraint.prototype.isInput):
3308         (EditConstraint.prototype.execute):
3309         (BinaryConstraint):
3310         (BinaryConstraint.prototype.chooseMethod):
3311         (BinaryConstraint.prototype.addToGraph):
3312         (BinaryConstraint.prototype.isSatisfied):
3313         (BinaryConstraint.prototype.markInputs):
3314         (BinaryConstraint.prototype.input):
3315         (BinaryConstraint.prototype.output):
3316         (BinaryConstraint.prototype.recalculate):
3317         (BinaryConstraint.prototype.markUnsatisfied):
3318         (BinaryConstraint.prototype.inputsKnown):
3319         (BinaryConstraint.prototype.removeFromGraph):
3320         (ScaleConstraint):
3321         (ScaleConstraint.prototype.addToGraph):
3322         (ScaleConstraint.prototype.removeFromGraph):
3323         (ScaleConstraint.prototype.markInputs):
3324         (ScaleConstraint.prototype.execute):
3325         (ScaleConstraint.prototype.recalculate):
3326         (EqualityConstraint):
3327         (EqualityConstraint.prototype.execute):
3328         (Variable):
3329         (Variable.prototype.addConstraint):
3330         (Variable.prototype.removeConstraint):
3331         (Planner):
3332         (Planner.prototype.incrementalAdd):
3333         (Planner.prototype.incrementalRemove):
3334         (Planner.prototype.newMark):
3335         (Planner.prototype.makePlan):
3336         (Planner.prototype.extractPlanFromConstraints):
3337         (Planner.prototype.addPropagate):
3338         (Planner.prototype.removePropagateFrom):
3339         (Planner.prototype.addConstraintsConsumingTo):
3340         (Plan):
3341         (Plan.prototype.addConstraint):
3342         (Plan.prototype.size):
3343         (Plan.prototype.constraintAt):
3344         (Plan.prototype.execute):
3345         (chainTest):
3346         (projectionTest):
3347         (change):
3348         (deltaBlue):
3349         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3350         (assert):
3351         (Numbers):
3352         (Numbers.prototype.next):
3353         (return.Transpose):
3354         (return.Transpose.prototype.next):
3355         (transpose):
3356         (verifyEven):
3357         (verifyString):
3358         (foo):
3359         (runIterators):
3360         * microbenchmarks/try-catch-word-count.js: Added.
3361         (let.assert):
3362         (EOF):
3363         (let.texts):
3364         (let.o.apply):
3365         (foo):
3366         (bar):
3367         (f):
3368         (run):
3369         (test1):
3370         (test2):
3371         (test3):
3372         (fn):
3373         (A):
3374         (B):
3375         (A.prototype.getValue):
3376         (B.prototype.getParentValue):
3377         (strlen):
3378         (sum.0):
3379         (test):
3380         (result.test.o):
3381         (set add.set add):
3382         (set forEach):
3383         (stringHash):
3384         (set if):
3385         (testFunction):
3386         (set delete.set has.set add):
3387         * stress/catch-set-argument-speculation-failure.js: Added.
3388         (o):
3389         (e):
3390         (e2):
3391         (escape):
3392         (baz):
3393         (noInline.run):
3394         (noInline):
3395         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3396         (foo):
3397         (e):
3398         (baz):
3399         (bar):
3400
3401 2017-08-24  Commit Queue  <commit-queue@webkit.org>
3402
3403         Unreviewed, rolling out r221119, r221124, and r221143.
3404         https://bugs.webkit.org/show_bug.cgi?id=175973
3405
3406         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3407         on #webkit).
3408
3409         Reverted changesets:
3410
3411         "Support compiling catch in the DFG"
3412         https://bugs.webkit.org/show_bug.cgi?id=174590
3413         http://trac.webkit.org/changeset/221119
3414
3415         "Unreviewed, build fix in GTK port"
3416         https://bugs.webkit.org/show_bug.cgi?id=174590
3417         http://trac.webkit.org/changeset/221124
3418
3419         "DFG::JITCode::osrEntry should get sorted since we perform a
3420         binary search on it"
3421         https://bugs.webkit.org/show_bug.cgi?id=175893
3422         http://trac.webkit.org/changeset/221143
3423
3424 2017-08-24  Michael Saboff  <msaboff@apple.com>
3425
3426         Add support for RegExp "dotAll" flag
3427         https://bugs.webkit.org/show_bug.cgi?id=175924
3428
3429         Reviewed by Keith Miller.
3430
3431         Updated tests for new dotAll ('s' flag) changes.
3432
3433         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3434         * stress/static-getter-in-names.js:
3435
3436 2017-08-24  Mark Lam  <mark.lam@apple.com>
3437
3438         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3439         https://bugs.webkit.org/show_bug.cgi?id=175940
3440         <rdar://problem/29003921>
3441
3442         Reviewed by Saam Barati.
3443
3444         * stress/regress-164081.js: Added.
3445         (shouldEqual):
3446         (testcase):
3447
3448 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3449
3450         Skip flaky JSC test stress/test-finally.js.
3451         https://bugs.webkit.org/show_bug.cgi?id=160283
3452
3453         Unreviewed test gardening.
3454
3455         * stress/test-finally.js:
3456
3457 2017-08-23  Saam Barati  <sbarati@apple.com>
3458
3459         Support compiling catch in the DFG
3460         https://bugs.webkit.org/show_bug.cgi?id=174590
3461
3462         Reviewed by Filip Pizlo.
3463
3464         * microbenchmarks/delta-blue-try-catch.js: Added.
3465         (exception):
3466         (value):
3467         (OrderedCollection):
3468         (OrderedCollection.prototype.add):
3469         (OrderedCollection.prototype.at):
3470         (OrderedCollection.prototype.size):
3471         (OrderedCollection.prototype.removeFirst):
3472         (OrderedCollection.prototype.remove):
3473         (Strength):
3474         (Strength.stronger):
3475         (Strength.weaker):
3476         (Strength.weakestOf):
3477         (Strength.strongest):
3478         (Strength.prototype.nextWeaker):
3479         (Constraint):
3480         (Constraint.prototype.addConstraint):
3481         (Constraint.prototype.satisfy):
3482         (Constraint.prototype.destroyConstraint):
3483         (Constraint.prototype.isInput):
3484         (UnaryConstraint):
3485         (UnaryConstraint.prototype.addToGraph):
3486         (UnaryConstraint.prototype.chooseMethod):
3487         (UnaryConstraint.prototype.isSatisfied):
3488         (UnaryConstraint.prototype.markInputs):
3489         (UnaryConstraint.prototype.output):
3490         (UnaryConstraint.prototype.recalculate):
3491         (UnaryConstraint.prototype.markUnsatisfied):
3492         (UnaryConstraint.prototype.inputsKnown):
3493         (UnaryConstraint.prototype.removeFromGraph):
3494         (StayConstraint):
3495         (StayConstraint.prototype.execute):
3496         (EditConstraint.prototype.isInput):
3497         (EditConstraint.prototype.execute):
3498         (BinaryConstraint):
3499         (BinaryConstraint.prototype.chooseMethod):
3500         (BinaryConstraint.prototype.addToGraph):
3501         (BinaryConstraint.prototype.isSatisfied):
3502         (BinaryConstraint.prototype.markInputs):
3503         (BinaryConstraint.prototype.input):
3504         (BinaryConstraint.prototype.output):
3505         (BinaryConstraint.prototype.recalculate):
3506         (BinaryConstraint.prototype.markUnsatisfied):
3507         (BinaryConstraint.prototype.inputsKnown):
3508         (BinaryConstraint.prototype.removeFromGraph):
3509         (ScaleConstraint):
3510         (ScaleConstraint.prototype.addToGraph):
3511         (ScaleConstraint.prototype.removeFromGraph):
3512         (ScaleConstraint.prototype.markInputs):
3513         (ScaleConstraint.prototype.execute):
3514         (ScaleConstraint.prototype.recalculate):
3515         (EqualityConstraint):
3516         (EqualityConstraint.prototype.execute):
3517         (Variable):
3518         (Variable.prototype.addConstraint):
3519         (Variable.prototype.removeConstraint):
3520         (Planner):
3521         (Planner.prototype.incrementalAdd):
3522         (Planner.prototype.incrementalRemove):
3523         (Planner.prototype.newMark):
3524         (Planner.prototype.makePlan):
3525         (Planner.prototype.extractPlanFromConstraints):
3526         (Planner.prototype.addPropagate):
3527         (Planner.prototype.removePropagateFrom):
3528         (Planner.prototype.addConstraintsConsumingTo):
3529         (Plan):
3530         (Plan.prototype.addConstraint):
3531         (Plan.prototype.size):
3532         (Plan.prototype.constraintAt):
3533         (Plan.prototype.execute):
3534         (chainTest):
3535         (projectionTest):
3536         (change):
3537         (deltaBlue):
3538         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3539         (assert):
3540         (Numbers):
3541         (Numbers.prototype.next):
3542         (return.Transpose):
3543         (return.Transpose.prototype.next):
3544         (transpose):
3545         (verifyEven):
3546         (verifyString):
3547         (foo):
3548         (runIterators):
3549         * microbenchmarks/try-catch-word-count.js: Added.
3550         (let.assert):
3551         (EOF):
3552         (let.texts):
3553         (let.o.apply):
3554         (foo):
3555         (bar):
3556         (f):
3557         (run):
3558         (test1):
3559         (test2):
3560         (test3):
3561         (fn):
3562         (A):
3563         (B):
3564         (A.prototype.getValue):
3565         (B.prototype.getParentValue):
3566         (strlen):
3567         (sum.0):
3568         (test):
3569         (result.test.o):
3570         (set add.set add):
3571         (set forEach):
3572         (stringHash):
3573         (set if):
3574         (testFunction):
3575         (set delete.set has.set add):
3576         * stress/catch-set-argument-speculation-failure.js: Added.
3577         (o):
3578         (e):
3579         (e2):
3580         (escape):
3581         (baz):
3582         (noInline.run):
3583         (noInline):
3584         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3585         (foo):
3586         (e):
3587         (baz):
3588         (bar):
3589
3590 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3591
3592         [JSC] Optimize Map iteration with intrinsic
3593         https://bugs.webkit.org/show_bug.cgi?id=174355
3594
3595         Reviewed by Saam Barati.
3596
3597         * stress/map-iterator-result-should-have-expected-shape.js: Added.
3598         (shouldBe):
3599         (throw.new.Error):
3600         * stress/set-iterator-result-should-have-expected-shape.js: Added.
3601         (shouldBe):
3602         (throw.new.Error.let.iterator.set Symbol):
3603         (throw.new.Error.set add):
3604         (let.iterator.set Symbol):
3605
3606 2017-08-23  Robin Morisset  <rmorisset@apple.com>
3607
3608         Add a micro-benchmark for checking that accessing a variable within a 'with'
3609         block does not automatically prevent type prediction.
3610         https://bugs.webkit.org/show_bug.cgi?id=175738
3611
3612         Reviewed by Saam Barati.
3613
3614         * stress/with_and_arith.js: Added.
3615         (with):
3616
3617 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
3618
3619         [ESNext] Async iteration - Implement Async Generator - runtime
3620         https://bugs.webkit.org/show_bug.cgi?id=175240
3621
3622         Reviewed by Yusuke Suzuki.
3623
3624         * stress/async-iteration-async-from-sync.js: Added.
3625         (assert):
3626         (const.Logger):
3627         (this.fullfilled):
3628         (this.fullfilledDone):
3629         (this.rejected):
3630         (this.catched):
3631         (this.isFinal):
3632         (_assertLogger):
3633         (const.assertLogger):
3634         (const.getPromise.promiseHolder.return.new.Promise):
3635         (foo):
3636         (async.boo):
3637         (bar):
3638         (async.baz):
3639         (async.goo):
3640         * stress/async-iteration-basic.js: Added.
3641         (assert):
3642         (const.Logger):
3643         (this.fullfilled):
3644         (this.fullfilledDone):
3645         (this.rejected):
3646         (this.catched):
3647         (this.isFinal):
3648         (_assertLogger):
3649         (const.assertLogger):
3650         (const.getPromise.promiseHolder.return.new.Promise):
3651         (async.generator):
3652         (iterator.next.then):
3653         (async.baz):
3654         (async.boo):
3655         (async.foo):
3656         (async.goo):
3657         (A.prototype.async.foo):
3658         (A.prototype.async.boo):
3659         (A):
3660         (asyncGenExp.async):
3661         (async.joo):
3662         (j.next.then):
3663         (then):
3664         (async.koo):
3665         (async.loo):
3666         (async.moo):
3667         (async.noo):
3668         (async.ooo):
3669         (async.roo):
3670         (async.poo):
3671         (async.soo):
3672         (async.too):
3673         * stress/async-iteration-evaluation.js: Added.
3674         (assert):
3675         (async.foo):
3676         (catch):
3677         * stress/async-iteration-syntax.js:
3678         * stress/async-iteration-yield-promise.js: Added.
3679         (assert):
3680         (const.Logger):
3681         (this.fullfilled):
3682         (this.fullfilledDone):
3683         (this.rejected):
3684         (this.catched):
3685         (this.isFinal):
3686         (_assertLogger):
3687         (const.assertLogger):
3688         (const.getPromise.promiseHolder.return.new.Promise):
3689         (async.foo):
3690         (async.boo):
3691         (async.bar):
3692         * stress/async-iteration-yield-star-interface.js: Added.
3693         (assert):
3694         (const.getPromise.promiseHolder.return.new.Promise):
3695         (const.Logger):
3696         (this.fullfilled):
3697         (this.fullfilledDone):
3698         (this.rejected):
3699         (this.catched):
3700         (this.custom):
3701         (this.isFinal):
3702         (_assertLogger):
3703         (const.assertLogger):
3704         (let.asyncIter.Symbol.asyncIterator):
3705         (let.asyncIter.next):
3706         (let.asyncIter.throw):
3707         (let.asyncIter.return):
3708         (async.foo):
3709         (asyncIter.Symbol.asyncIterator):
3710         (asyncIter.next):
3711         (async.boo):
3712         (asyncIter.return):
3713         (async.bar):
3714         (async.baz):
3715         (async.foobar):
3716         * stress/async-iteration-yield-star.js: Added.
3717         (assert):
3718         (const.Logger):
3719         (this.fullfilled):
3720         (this.fullfilledDone):
3721         (this.rejected):
3722         (this.catched):
3723         (this.custom):
3724         (this.isFinal):
3725         (_assertLogger):
3726         (const.assertLogger):