Unreviewed, reduce count of iteration to fix timing out debug JSC test
[WebKit-https.git] / JSTests / ChangeLog
1 2018-01-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2
3         Unreviewed, reduce count of iteration to fix timing out debug JSC test
4         https://bugs.webkit.org/show_bug.cgi?id=181535
5
6         * stress/inserted-recovery-with-set-last-index.js:
7
8 2018-01-17  Yusuke Suzuki  <utatane.tea@gmail.com>
9
10         [DFG][FTL] Introduce PhantomNewRegexp and RegExpExecNonGlobalOrSticky
11         https://bugs.webkit.org/show_bug.cgi?id=181535
12
13         Reviewed by Saam Barati.
14
15         * stress/inserted-recovery-with-set-last-index.js: Added.
16         (shouldBe):
17         (foo):
18         * stress/materialize-regexp-at-osr-exit.js: Added.
19         (shouldBe):
20         (test):
21         * stress/materialize-regexp-cyclic-regexp-at-osr-exit.js: Added.
22         (shouldBe):
23         (test):
24         * stress/materialize-regexp-cyclic-regexp.js: Added.
25         (shouldBe):
26         (test):
27         (i.switch):
28         * stress/materialize-regexp-cyclic.js: Added.
29         (shouldBe):
30         (test):
31         (i.switch):
32         * stress/materialize-regexp-referenced-from-phantom-regexp-cyclic.js: Added.
33         (bar):
34         (foo):
35         (test):
36         * stress/materialize-regexp-referenced-from-phantom-regexp.js: Added.
37         (bar):
38         (foo):
39         (test):
40         * stress/materialize-regexp.js: Added.
41         (shouldBe):
42         (test):
43         * stress/phantom-regexp-regexp-exec.js: Added.
44         (shouldBe):
45         (test):
46         * stress/phantom-regexp-string-match.js: Added.
47         (shouldBe):
48         (test):
49         * stress/regexp-last-index-sinking.js: Added.
50         (shouldBe):
51         (test):
52
53 2018-01-17  Saam Barati  <sbarati@apple.com>
54
55         Disable Atomics when SharedArrayBuffer isn’t enabled
56         https://bugs.webkit.org/show_bug.cgi?id=181572
57         <rdar://problem/36553206>
58
59         Reviewed by Michael Saboff.
60
61         * stress/isLockFree.js:
62
63 2018-01-17  Saam Barati  <sbarati@apple.com>
64
65         DFG::Node::convertToConstant needs to clear the varargs flags
66         https://bugs.webkit.org/show_bug.cgi?id=181697
67         <rdar://problem/36497332>
68
69         Reviewed by Yusuke Suzuki.
70
71         * stress/dfg-node-convert-to-constant-must-clear-varargs-flags.js: Added.
72         (doIndexOf):
73         (bar):
74         (i.bar):
75
76 2018-01-16  Ryan Haddad  <ryanhaddad@apple.com>
77
78         Unreviewed, rolling out r226937.
79
80         Tests added with this change are failing due to a missing
81         exception check.
82
83         Reverted changeset:
84
85         "[JSC] NumberPrototype::extractRadixFromArgs incorrectly cast
86         double to int32_t"
87         https://bugs.webkit.org/show_bug.cgi?id=181182
88         https://trac.webkit.org/changeset/226937
89
90 2018-01-13  Caio Lima  <ticaiolima@gmail.com>
91
92         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
93         https://bugs.webkit.org/show_bug.cgi?id=181182
94
95         Reviewed by Darin Adler.
96
97         * bigIntTests.yaml:
98         * stress/big-int-constructor.js:
99         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
100         (assert):
101         (assertThrowRangeError):
102         * stress/number-prototype-to-string-cast-overflow.js: Added.
103         (assert):
104         (assertThrowRangeError):
105
106 2018-01-12  Saam Barati  <sbarati@apple.com>
107
108         CheckStructure can be incorrectly subsumed by CheckStructureOrEmpty
109         https://bugs.webkit.org/show_bug.cgi?id=181177
110         <rdar://problem/36205704>
111
112         Reviewed by Yusuke Suzuki.
113
114         * stress/check-structure-ir-ensures-empty-does-not-flow-through.js: Added.
115         (runNearStackLimit.t):
116         (runNearStackLimit):
117         (test.f):
118         (test):
119
120 2018-01-12  Saam Barati  <sbarati@apple.com>
121
122         Each variant of a polymorphic inlined call should be exitOK at the top of the block
123         https://bugs.webkit.org/show_bug.cgi?id=181562
124         <rdar://problem/36445624>
125
126         Reviewed by Yusuke Suzuki.
127
128         * stress/each-block-at-top-of-polymorphic-call-inlining-should-be-exitOK.js: Added.
129         (f):
130         (foo):
131
132 2018-01-11  Saam Barati  <sbarati@apple.com>
133
134         When inserting Unreachable in byte code parser we need to flush all the right things
135         https://bugs.webkit.org/show_bug.cgi?id=181509
136         <rdar://problem/36423110>
137
138         Reviewed by Mark Lam.
139
140         * stress/proper-flushing-when-we-insert-unreachable-after-force-exit-in-bytecode-parser.js: Added.
141
142 2018-01-11  Saam Barati  <sbarati@apple.com>
143
144         JITMathIC code in the FTL is wrong when code gets duplicated
145         https://bugs.webkit.org/show_bug.cgi?id=181525
146         <rdar://problem/36351993>
147
148         Reviewed by Michael Saboff and Keith Miller.
149
150         * stress/allow-math-ic-b3-code-duplication.js: Added.
151
152 2018-01-11  Saam Barati  <sbarati@apple.com>
153
154         Our for-in caching is wrong when we add indexed properties on things in the prototype chain
155         https://bugs.webkit.org/show_bug.cgi?id=181508
156
157         Reviewed by Yusuke Suzuki.
158
159         * stress/for-in-prototype-with-indexed-properties-should-prevent-caching.js: Added.
160         (assert):
161         (test1.foo):
162         (test1):
163         (test2.foo):
164         (test2):
165
166 2018-01-09  Mark Lam  <mark.lam@apple.com>
167
168         ASSERTION FAILED: pair.second->m_type & PropertyNode::Getter
169         https://bugs.webkit.org/show_bug.cgi?id=181388
170         <rdar://problem/36349351>
171
172         Reviewed by Saam Barati.
173
174         * stress/regress-181388.js: Added.
175
176 2018-01-08  JF Bastien  <jfbastien@apple.com>
177
178         WebAssembly: mask indexed accesses to Table
179         https://bugs.webkit.org/show_bug.cgi?id=181412
180         <rdar://problem/36363236>
181
182         Reviewed by Saam Barati.
183
184         Update error messages.
185
186         * wasm/js-api/table.js:
187         (assert.throws.WebAssembly.Table.prototype.grow):
188
189 2018-01-08  Ryan Haddad  <ryanhaddad@apple.com>
190
191         Disable SharedArrayBuffer tests missed in r226386.
192         https://bugs.webkit.org/show_bug.cgi?id=181266
193
194         Unreviewed test gardening.
195
196         * test262.yaml:
197
198 2018-01-06  Yusuke Suzuki  <utatane.tea@gmail.com>
199
200         Object.getOwnPropertyNames includes "arguments" and "caller" for bound functions
201         https://bugs.webkit.org/show_bug.cgi?id=181321
202
203         Reviewed by Saam Barati.
204
205         * stress/bound-function-does-not-have-caller-and-arguments.js: Added.
206         (shouldBe):
207         (testFunction):
208         * test262.yaml:
209
210 2018-01-05  Ryan Haddad  <ryanhaddad@apple.com>
211
212         Unreviewed, attempt to fix test262 after r226386.
213
214         * test262.yaml:
215
216 2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>
217
218         [DFG] Define defs for MapSet/SetAdd to participate in CSE
219         https://bugs.webkit.org/show_bug.cgi?id=179911
220
221         Reviewed by Saam Barati.
222
223         In addition to these tests, map-set-cse.js and set-add-cse.js work.
224
225         * stress/map-set-change-get.js: Added.
226         (shouldBe):
227         (test):
228         * stress/map-set-create-bucket.js: Added.
229         (shouldBe):
230         (test):
231         * stress/set-add-create-bucket.js: Added.
232         (shouldBe):
233
234 2018-01-03  Michael Saboff  <msaboff@apple.com>
235
236         Disable SharedArrayBuffers from Web API
237         https://bugs.webkit.org/show_bug.cgi?id=181266
238
239         Reviewed by Saam Barati.
240
241         Disabled SharedArrayBuffer tests.
242
243         * stress/SharedArrayBuffer-opt.js:
244         * stress/SharedArrayBuffer.js:
245         * stress/array-buffer-byte-length.js:
246         * stress/atomics-add-uint32.js:
247         * stress/atomics-known-int-use.js:
248         * stress/atomics-neg-zero.js:
249         * stress/atomics-store-return.js:
250         * stress/lars-sab-workers.js:
251         * stress/regress-159779-1.js:
252         * stress/regress-159779-2.js:
253         * stress/regress-170473.js:
254         * test262.yaml:
255
256 2018-01-03  Caio Lima  <ticaiolima@gmail.com>
257
258         [ESNext][BigInt] Failing test stress/big-int-constructor-oom.js into MIPS
259         https://bugs.webkit.org/show_bug.cgi?id=181258
260
261         Reviewed by Antonio Gomes.
262
263         * stress/big-int-constructor-gc.js:
264         * stress/big-int-constructor-oom.js:
265
266 2018-01-03  Robin Morisset  <rmorisset@apple.com>
267
268         Inlining of a function that ends in op_unreachable crashes
269         https://bugs.webkit.org/show_bug.cgi?id=181027
270
271         Reviewed by Filip Pizlo.
272
273         * stress/inlining-unreachable.js: Added.
274         (bar):
275         (baz):
276         (i.catch):
277
278 2018-01-02  Saam Barati  <sbarati@apple.com>
279
280         Incorrect assertion inside AccessCase
281         https://bugs.webkit.org/show_bug.cgi?id=181200
282         <rdar://problem/35494754>
283
284         Reviewed by Yusuke Suzuki.
285
286         * stress/setter-same-base-and-rhs-invalid-assertion-inside-access-case.js: Added.
287         (ctor):
288         (theFunc):
289         (run):
290
291 2018-01-02  Caio Lima  <ticaiolima@gmail.com>
292
293         [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
294         https://bugs.webkit.org/show_bug.cgi?id=175359
295
296         Reviewed by Yusuke Suzuki.
297
298         * bigIntTests.yaml:
299         * stress/big-int-as-key.js: Added.
300         * stress/big-int-constructor-gc.js: Added.
301         * stress/big-int-constructor-oom.js: Added.
302         * stress/big-int-constructor-properties.js: Added.
303         * stress/big-int-constructor-prototype-prop-descriptor.js: Added.
304         * stress/big-int-constructor-prototype.js: Added.
305         * stress/big-int-constructor.js: Added.
306         * stress/big-int-function-apply.js:
307         * stress/big-int-length.js: Added.
308         * stress/big-int-prop-descriptor.js: Added.
309         * stress/big-int-proto-constructor.js: Added.
310         * stress/big-int-proto-name.js: Added.
311         * stress/big-int-prototype-properties.js: Added.
312         * stress/big-int-prototype-proto.js: Added.
313         * stress/big-int-prototype-value-of.js: Added.
314         * stress/big-int-prototype-symbol-to-string-tag.js: Added.
315         * stress/big-int-prototype-to-string-apply.js: Added.
316         * stress/big-int-to-object.js: Added.
317         * stress/big-int-to-string.js: Added.
318
319 2017-12-28  Saam Barati  <sbarati@apple.com>
320
321         Assertion used to determine if something is an async generator is wrong
322         https://bugs.webkit.org/show_bug.cgi?id=181168
323         <rdar://problem/35640560>
324
325         Reviewed by Yusuke Suzuki.
326
327         * stress/async-generator-assertion.js: Added.
328
329 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
330
331         Skip stress/splay-flash-access tests on memory limited platforms
332         https://bugs.webkit.org/show_bug.cgi?id=181086
333
334         Reviewed by Carlos Alberto Lopez Perez.
335
336         These tests use about 185M of memory, and occasionally get OOM-killed
337         on memory limited platforms.
338
339         * stress/splay-flash-access-1ms.js:
340         * stress/splay-flash-access.js:
341
342 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
343
344         Skip slow jsc tests on embedded platforms
345         https://bugs.webkit.org/show_bug.cgi?id=180937
346
347         Reviewed by Carlos Alberto Lopez Perez.
348
349         The tests typeProfiler/deltablue-for-of.js and
350         typeProfiler/getter-richards.js take a very long time in the
351         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
352         thus always timeout. They should be skipped on these platforms.
353
354         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
355         * typeProfiler/getter-richards.js: Skip on arm*/mips.
356
357 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
358
359         [JSC] Do not check isValid() in op_new_regexp
360         https://bugs.webkit.org/show_bug.cgi?id=180970
361
362         Reviewed by Saam Barati.
363
364         * stress/regexp-syntax-error-invalid-flags.js: Added.
365         (shouldThrow):
366
367 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
368
369         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
370         https://bugs.webkit.org/show_bug.cgi?id=180712
371
372         Reviewed by Michael Catanzaro.
373
374         stress/call-apply-exponential-bytecode-size.js crashes if the
375         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
376         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
377         should skip the test on other platforms.
378
379         * stress/call-apply-exponential-bytecode-size.js:
380
381 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
382
383         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
384         https://bugs.webkit.org/show_bug.cgi?id=179762
385
386         Reviewed by Saam Barati.
387
388         * stress/call-varargs-double-new-array-buffer.js: Added.
389         (assert):
390         (bar):
391         (foo):
392         * stress/call-varargs-spread-new-array-buffer.js: Added.
393         (assert):
394         (bar):
395         (foo):
396         * stress/call-varargs-spread-new-array-buffer2.js: Added.
397         (assert):
398         (bar):
399         (foo):
400         * stress/forward-varargs-double-new-array-buffer.js: Added.
401         (assert):
402         (test.baz):
403         (test.bar):
404         (test.foo):
405         (test):
406         * stress/new-array-buffer-sinking-osrexit.js: Added.
407         (target):
408         (test):
409         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
410         (shouldBe):
411         (test):
412         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
413         (shouldBe):
414         (target):
415         (test):
416         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
417         (assert):
418         (test1.bar):
419         (test1.foo):
420         (test1):
421         (test2.bar):
422         (test2.foo):
423         (test3.baz):
424         (test3.bar):
425         (test3.foo):
426         (test4.baz):
427         (test4.bar):
428         (test4.foo):
429         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
430         (assert):
431         (test.baz):
432         (test.bar):
433         (test.foo):
434         (test):
435         * stress/phantom-new-array-buffer-osr-exit.js: Added.
436         (assert):
437         (baz):
438         (bar):
439         (effects):
440         (foo):
441
442 2017-12-14  Saam Barati  <sbarati@apple.com>
443
444         The CleanUp after LICM is erroneously removing a Check
445         https://bugs.webkit.org/show_bug.cgi?id=180852
446         <rdar://problem/36063494>
447
448         Reviewed by Filip Pizlo.
449
450         * stress/dont-run-cleanup-after-licm.js: Added.
451
452 2017-12-14  Michael Saboff  <msaboff@apple.com>
453
454         REGRESSION (r225695): Repro crash on yahoo login page
455         https://bugs.webkit.org/show_bug.cgi?id=180761
456
457         Reviewed by JF Bastien.
458
459         New regression test.
460
461         * stress/regress-180761.js: Added.
462
463 2017-12-13  Keith Miller  <keith_miller@apple.com>
464
465         JSObjects should have a mask for loading indexed properties
466         https://bugs.webkit.org/show_bug.cgi?id=180768
467
468         Reviewed by Mark Lam.
469
470         * stress/int16-put-by-val-in-and-out-of-bounds.js:
471         (test):
472
473 2017-12-13  Saam Barati  <sbarati@apple.com>
474
475         Arrow functions need their own structure because they have different properties than sloppy functions
476         https://bugs.webkit.org/show_bug.cgi?id=180779
477         <rdar://problem/35814591>
478
479         Reviewed by Mark Lam.
480
481         * stress/arrow-function-needs-its-own-structure.js: Added.
482         (assert):
483         (readPrototype):
484         (noInline.let.f1):
485         (noInline):
486
487 2017-12-13  Saam Barati  <sbarati@apple.com>
488
489         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
490         https://bugs.webkit.org/show_bug.cgi?id=163579
491         <rdar://problem/35455798>
492
493         Reviewed by Mark Lam.
494
495         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
496         (assert):
497         (test1):
498         (i.test1):
499         (i.test1.C):
500         (i.test1.async.foo):
501         (i.test1.foo):
502         (test2):
503
504 2017-12-13  Saam Barati  <sbarati@apple.com>
505
506         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
507         https://bugs.webkit.org/show_bug.cgi?id=180734
508         <rdar://problem/35640547>
509
510         Reviewed by Yusuke Suzuki.
511
512         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
513         (__isPropertyOfType):
514         (__getProperties):
515         (__getObjects):
516         (__getRandomObject):
517         (theClass.):
518         (theClass):
519         (childClass):
520         (counter.catch):
521
522 2017-12-12  Saam Barati  <sbarati@apple.com>
523
524         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
525         https://bugs.webkit.org/show_bug.cgi?id=180725
526         <rdar://problem/35970511>
527
528         Reviewed by Michael Saboff.
529
530         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
531         (f1):
532         (f2):
533         (let.o2.valueOf):
534
535 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
536
537         [JSC] Implement optimized WeakMap and WeakSet
538         https://bugs.webkit.org/show_bug.cgi?id=179929
539
540         Reviewed by Saam Barati.
541
542         * microbenchmarks/weak-map-key.js:
543         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
544         (assert):
545         (objectKey):
546         (let.start.Date.now):
547         * stress/basic-weakmap.js: Added.
548         (shouldBe):
549         (test):
550         * stress/basic-weakset.js: Added.
551         (shouldBe):
552         (test.set new):
553         * stress/weakmap-cse-set-break.js: Added.
554         (shouldBe):
555         (test):
556         * stress/weakmap-cse.js: Added.
557         (shouldBe):
558         (test):
559         * stress/weakmap-gc.js: Added.
560         (test):
561         * stress/weakset-cse-add-break.js: Added.
562         (shouldBe):
563         (test.set new):
564         * stress/weakset-cse.js: Added.
565         (shouldBe):
566         (test.set new):
567         * stress/weakset-gc.js: Added.
568         (test.set add):
569         (test.set new):
570         (test):
571
572 2017-12-12  Saam Barati  <sbarati@apple.com>
573
574         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
575         https://bugs.webkit.org/show_bug.cgi?id=180723
576         <rdar://problem/35859726>
577
578         Reviewed by JF Bastien.
579
580         * stress/get-my-argument-by-val-constant-folding.js: Added.
581         (test):
582         (catch):
583
584 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
585
586         [ESNext][BigInt] Implement BigInt literals and JSBigInt
587         https://bugs.webkit.org/show_bug.cgi?id=179000
588
589         Reviewed by Darin Adler and Yusuke Suzuki.
590
591         * bigIntTests.yaml: Added.
592         * stress/big-int-literal-line-terminator.js: Added.
593         * stress/big-int-literals.js: Added.
594         * stress/big-int-operations-error.js: Added.
595         * stress/big-int-type-of.js: Added.
596         * stress/big-int-white-space-trailing-leading.js: Added.
597         * stress/big-int-function-apply.js: Added.
598
599 2017-12-11  Saam Barati  <sbarati@apple.com>
600
601         We need to disableCaching() in ErrorInstance when we materialize properties
602         https://bugs.webkit.org/show_bug.cgi?id=180343
603         <rdar://problem/35833002>
604
605         Reviewed by Mark Lam.
606
607         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
608         (assert):
609         (makeError):
610         (storeToStack):
611         (storeToStackAlreadyMaterialized):
612
613 2017-12-05  JF Bastien  <jfbastien@apple.com>
614
615         WebAssembly: don't eagerly checksum
616         https://bugs.webkit.org/show_bug.cgi?id=180441
617         <rdar://problem/35156628>
618
619         Reviewed by Saam Barati.
620
621         Checksum is now disabled, so tests only have <?> as the module
622         name.
623
624         * wasm/function-tests/nameSection.js:
625         * wasm/function-tests/stack-overflow.js:
626         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
627         (assertOverflows.assertThrows):
628         (assertOverflows):
629         * wasm/function-tests/stack-trace.js:
630
631 2017-12-04  JF Bastien  <jfbastien@apple.com>
632
633         Proxy all functions, except the $ objects
634         https://bugs.webkit.org/show_bug.cgi?id=180375
635
636         Reviewed by Saam Barati.
637
638         It looks like this test may have broken some executions because I
639         call some internal objects. Explicitly ignore objects whose name
640         starts with "$" because it's a bad idea anyways.
641
642         * stress/proxy-all-the-parameters.js:
643         (generateObjects):
644         (get throw):
645
646 2017-12-04  Saam Barati  <sbarati@apple.com>
647
648         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
649         https://bugs.webkit.org/show_bug.cgi?id=180366
650         <rdar://problem/35685877>
651
652         Reviewed by Michael Saboff.
653
654         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
655         (theParent):
656         (test1.base.getParentStaticValue):
657         (test1.base):
658         (test1.__v_24888.prototype.set prop):
659         (test1.__v_24888):
660         (test2.base.getParentStaticValue):
661         (test2.base):
662         (test2.__v_24888.prototype.set prop):
663         (test2.__v_24888):
664         (test2):
665
666 2017-12-01  JF Bastien  <jfbastien@apple.com>
667
668         Try proxying all function arguments
669         https://bugs.webkit.org/show_bug.cgi?id=180306
670
671         Reviewed by Saam Barati.
672
673         * stress/proxy-all-the-parameters.js: Added.
674         (isPropertyOfType):
675         (getProperties):
676         (generateObjects):
677         (getObjects):
678         (getFunctions):
679         (get throw):
680         (let.o.of.getObjects.let.f.of.getFunctions.catch):
681
682 2017-12-01  JF Bastien  <jfbastien@apple.com>
683
684         JavaScriptCore: missing exception checks in Math functions that take more than one argument
685         https://bugs.webkit.org/show_bug.cgi?id=180297
686         <rdar://problem/35745556>
687
688         Reviewed by Mark Lam.
689
690         * stress/math-exceptions.js: Added.
691         (get try):
692         (catch):
693
694 2017-12-01  JF Bastien  <jfbastien@apple.com>
695
696         JavaScriptCore: add test for weird class static getters
697         https://bugs.webkit.org/show_bug.cgi?id=180281
698         <rdar://problem/35592139>
699
700         Reviewed by Mark Lam.
701
702         I fixed a bug for it in r224927 and didn't add a test. Do so.
703
704         * stress/class-static-get-weird.js: Added.
705         (c.prototype.get name):
706         (c):
707         (c.prototype.get arguments):
708         (c.prototype.get caller):
709         (c.prototype.get length):
710
711 2017-12-01  Saam Barati  <sbarati@apple.com>
712
713         Having a bad time needs to handle ArrayClass indexing type as well
714         https://bugs.webkit.org/show_bug.cgi?id=180274
715         <rdar://problem/35667869>
716
717         Reviewed by Keith Miller and Mark Lam.
718
719         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
720         (assert):
721         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
722         (assert):
723
724 2017-12-01  JF Bastien  <jfbastien@apple.com>
725
726         WebAssembly: restore cached stack limit after out-call
727         https://bugs.webkit.org/show_bug.cgi?id=179106
728         <rdar://problem/35337525>
729
730         Reviewed by Saam Barati.
731
732         * wasm/function-tests/double-instance.js: Added.
733         (const.imp.boom):
734         (const.imp.get callAnother):
735
736 2017-11-30  JF Bastien  <jfbastien@apple.com>
737
738         WebAssembly: improve stack trace
739         https://bugs.webkit.org/show_bug.cgi?id=179343
740
741         Reviewed by Saam Barati.
742
743         Update the tests to follow the new format. Notably, SHA1 module
744         hash is now included in traces, and stubs are properly identified.
745
746         * wasm/assert.js: Add an assertion which matches regular expressions.
747         * wasm/function-tests/nameSection.js:
748         * wasm/function-tests/stack-overflow.js:
749         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
750         (assertOverflows.assertThrows.wasm.1):
751         (assertOverflows.assertThrows.wasm.0):
752         (assertOverflows.assertThrows):
753         (assertOverflows):
754         * wasm/function-tests/stack-trace.js:
755         (import.Builder.from.string_appeared_here.assert): Deleted.
756         * wasm/function-tests/trap-after-cross-instance-call.js:
757         (wasmFrameCountFromError):
758         * wasm/function-tests/trap-load-2.js:
759         (wasmFrameCountFromError):
760         * wasm/function-tests/trap-load.js:
761         (wasmFrameCountFromError):
762
763 2017-11-30  Mark Lam  <mark.lam@apple.com>
764
765         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
766         https://bugs.webkit.org/show_bug.cgi?id=180219
767         <rdar://problem/35696536>
768
769         Reviewed by Filip Pizlo.
770
771         * stress/regress-180219.js: Added.
772
773 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
774
775         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
776         https://bugs.webkit.org/show_bug.cgi?id=180190
777
778         Reviewed by Mark Lam.
779
780         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
781         (shouldBe):
782         (test1):
783         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
784         (shouldBe):
785         (test1):
786         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
787         (shouldBe):
788         (test1):
789         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
790         (shouldBe):
791         (test1):
792         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
793         (shouldBe):
794         (test1):
795         * stress/operation-in-may-have-negative-int32.js: Added.
796         (shouldBe):
797         (test2):
798         * stress/operation-in-negative-int32-cast.js: Added.
799         (shouldBe):
800         (test1):
801
802 2017-11-28  JF Bastien  <jfbastien@apple.com>
803
804         Strict and sloppy functions shouldn't share structure
805         https://bugs.webkit.org/show_bug.cgi?id=180103
806         <rdar://problem/35667847>
807
808         Reviewed by Saam Barati.
809
810         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
811         because the IC was wrong.
812         (foo):
813         (bar):
814         (baz):
815         (catch):
816         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
817         in this patch, but may as well test odd strict mode corner cases.
818         (bar):
819         (baz):
820         (catch):
821         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
822         (foo):
823         (bar):
824         (baz):
825         (catch):
826         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
827         next file, but with invalidation of the FunctionExecutable's
828         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
829         slower path.
830         (foo):
831         (bar.const.x):
832         (bar.const.y):
833         (bar):
834         (catch):
835         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
836         strict nesting works correctly.
837         (foo):
838         (bar.baz):
839         (bar):
840         * stress/strict-function-structure.js: Added. The test used to
841         assert in objectProtoFuncHasOwnProperty.
842         (foo):
843         (bar):
844         (baz):
845         * stress/strict-nested-function-structure.js: Added. Nesting.
846         (foo):
847         (bar):
848         (baz.boo):
849         (baz):
850
851 2017-11-29  Robin Morisset  <rmorisset@apple.com>
852
853         The recursive tail call optimisation is wrong on closures
854         https://bugs.webkit.org/show_bug.cgi?id=179835
855
856         Reviewed by Saam Barati.
857
858         * stress/closure-recursive-tail-call.js: Added.
859         (makeClosure):
860
861 2017-11-27  JF Bastien  <jfbastien@apple.com>
862
863         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
864         https://bugs.webkit.org/show_bug.cgi?id=180051
865         <rdar://problem/35614371>
866
867         Reviewed by Saam Barati.
868
869         * stress/rest-parameter-negative.js: Added.
870         (__f_5484):
871         (catch):
872         (__f_5485):
873         (__v_22598.catch):
874
875 2017-11-27  Saam Barati  <sbarati@apple.com>
876
877         Spread can escape when CreateRest does not
878         https://bugs.webkit.org/show_bug.cgi?id=180057
879         <rdar://problem/35676119>
880
881         Reviewed by JF Bastien.
882
883         * stress/spread-escapes-but-create-rest-does-not.js: Added.
884         (assert):
885         (getProperties):
886         (theFunc):
887         (let.obj.valueOf):
888
889 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
890
891         [DFG] Add NormalizeMapKey DFG IR
892         https://bugs.webkit.org/show_bug.cgi?id=179912
893
894         Reviewed by Saam Barati.
895
896         * stress/map-untyped-normalize-cse.js: Added.
897         (shouldBe):
898         (test):
899         * stress/map-untyped-normalize.js: Added.
900         (shouldBe):
901         (test):
902         * stress/set-untyped-normalize-cse.js: Added.
903         (shouldBe):
904         (set return.set has.set has):
905         * stress/set-untyped-normalize.js: Added.
906         (shouldBe):
907         (set return.set has):
908
909 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
910
911         [FTL] Support DeleteById and DeleteByVal
912         https://bugs.webkit.org/show_bug.cgi?id=180022
913
914         Reviewed by Saam Barati.
915
916         * stress/delete-by-id.js: Added.
917         (shouldBe):
918         (test1):
919         (test2):
920         * stress/delete-by-val-ftl.js: Added.
921         (shouldBe):
922         (test1):
923         (test2):
924
925 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
926
927         [DFG] Introduce {Set,Map,WeakMap}Fields
928         https://bugs.webkit.org/show_bug.cgi?id=179925
929
930         Reviewed by Saam Barati.
931
932         * stress/map-set-clobber-map-get.js: Added.
933         (shouldBe):
934         (test):
935         * stress/map-set-does-not-clobber-set-has.js: Added.
936         (shouldBe):
937         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
938         (shouldBe):
939         (test):
940         * stress/set-add-clobber-set-has.js: Added.
941         (shouldBe):
942         * stress/set-add-does-not-clobber-map-get.js: Added.
943         (shouldBe):
944
945 2017-11-24  Mark Lam  <mark.lam@apple.com>
946
947         Move unsafe jsc shell test functions to the $vm object.
948         https://bugs.webkit.org/show_bug.cgi?id=179980
949
950         Reviewed by Yusuke Suzuki.
951
952         * controlFlowProfiler/driver/driver.js:
953         * controlFlowProfiler/execution-count.js:
954         * controlFlowProfiler/if-statement.js:
955         * controlFlowProfiler/loop-statements.js:
956         * controlFlowProfiler/switch-statements.js:
957         * controlFlowProfiler/test-jit.js:
958         * exceptionFuzz/3d-cube.js:
959         * exceptionFuzz/date-format-xparb.js:
960         * exceptionFuzz/earley-boyer.js:
961         * heapProfiler/basic-edges.js:
962         * heapProfiler/property-edge-types.js:
963         * microbenchmarks/try-get-by-id-basic.js:
964         * microbenchmarks/try-get-by-id-polymorphic.js:
965         * modules/namespace-object-try-get.js:
966         * stress/argument-count-bytecode.js:
967         * stress/argument-intrinsic-basic.js:
968         * stress/argument-intrinsic-inlining-use-caller-arg.js:
969         * stress/argument-intrinsic-inlining-with-result-escape.js:
970         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
971         * stress/argument-intrinsic-inlining-with-vararg.js:
972         * stress/argument-intrinsic-nested-inlining.js:
973         * stress/argument-intrinsic-not-convert-to-get-argument.js:
974         * stress/argument-intrinsic-with-stack-write.js:
975         * stress/arity-mismatch-get-argument.js:
976         * stress/array-message-passing.js:
977         * stress/array-push-with-force-exit.js:
978         * stress/check-dom-with-signature.js:
979         * stress/check-sub-class.js:
980         * stress/compare-eq-incomplete-profile.js:
981         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
982         * stress/do-eval-virtual-call-correctly.js:
983         * stress/dom-jit-with-poly-proto.js:
984         * stress/domjit-exception-ic.js:
985         * stress/domjit-exception.js:
986         * stress/domjit-getter-complex-with-incorrect-object.js:
987         * stress/domjit-getter-complex.js:
988         * stress/domjit-getter-poly.js:
989         * stress/domjit-getter-proto.js:
990         * stress/domjit-getter-super-poly.js:
991         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
992         * stress/domjit-getter-type-check.js:
993         * stress/domjit-getter.js:
994         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
995         * stress/for-in-proxy-target-changed-structure.js:
996         * stress/for-in-proxy.js:
997         * stress/generational-opaque-roots.js:
998         * stress/global-const-redeclaration-setting-2.js:
999         * stress/global-const-redeclaration-setting-3.js:
1000         * stress/global-const-redeclaration-setting-4.js:
1001         * stress/global-const-redeclaration-setting-5.js:
1002         * stress/global-const-redeclaration-setting.js:
1003         * stress/import-basic.js:
1004         * stress/import-from-eval.js:
1005         * stress/import-reject-with-exception.js:
1006         * stress/import-syntax.js:
1007         * stress/impure-get-own-property-slot-inline-cache.js:
1008         * stress/is-constructor.js:
1009         * stress/istypedarrayview-intrinsic.js:
1010         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
1011         * stress/jsc-test-functions-should-be-more-robust.js:
1012         * stress/object-toString-with-proxy.js:
1013         * stress/poly-proto-custom-value-and-accessor.js:
1014         * stress/proxy-inline-cache.js:
1015         * stress/re-execute-error-module.js:
1016         * stress/regress-150532.js:
1017         * stress/regress-156992.js:
1018         * stress/regress-179619.js:
1019         * stress/resources/shadow-chicken-support.js:
1020         * stress/runtime-array.js:
1021         * stress/sampling-profiler-microtasks.js:
1022         * stress/shadow-chicken-enabled.js:
1023         * stress/spread-correct-global-object-on-exception.js:
1024         * stress/super-get-by-id.js:
1025         * stress/tailCallForwardArguments.js:
1026         * stress/to-object-intrinsic-boolean-edge.js:
1027         * stress/to-object-intrinsic-null-or-undefined-edge.js:
1028         * stress/to-object-intrinsic-number-edge.js:
1029         * stress/to-object-intrinsic-object-edge.js:
1030         * stress/to-object-intrinsic-string-edge.js:
1031         * stress/to-object-intrinsic-symbol-edge.js:
1032         * stress/to-object-intrinsic.js:
1033         * stress/try-catch-custom-getter-as-get-by-id.js:
1034         * stress/try-get-by-id-poly-proto.js:
1035         * stress/try-get-by-id-should-spill-registers-dfg.js:
1036         * stress/try-get-by-id.js:
1037         * typeProfiler/arrow-functions.js:
1038         * typeProfiler/basic.js:
1039         * typeProfiler/captured.js:
1040         * typeProfiler/classes.js:
1041         * typeProfiler/dfg-jit-optimizations.js:
1042         * typeProfiler/dictionary-mode.js:
1043         * typeProfiler/es6-block-scoping.js:
1044         * typeProfiler/es6-classes.js:
1045         * typeProfiler/inheritance.js:
1046         * typeProfiler/int52-dfg.js:
1047         * typeProfiler/loop.js:
1048         * typeProfiler/optional-fields.js:
1049         * typeProfiler/overflow.js:
1050         * typeProfiler/return.js:
1051         * typeProfiler/symbol.js:
1052         * typeProfiler/weird-prototype-chain.js:
1053
1054 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1055
1056         [DFG][FTL] Support MapSet / SetAdd intrinsics
1057         https://bugs.webkit.org/show_bug.cgi?id=179858
1058
1059         Reviewed by Saam Barati.
1060
1061         * microbenchmarks/map-has-and-set.js: Added.
1062         (test):
1063         * stress/map-set-check-failure.js: Added.
1064         (shouldBe):
1065         (shouldThrow):
1066         (target):
1067         * stress/map-set-cse.js: Added.
1068         (shouldBe):
1069         (test):
1070         * stress/set-add-check-failure.js: Added.
1071         (shouldBe):
1072         (shouldThrow):
1073         (set shouldThrow):
1074         * stress/set-add-cse.js: Added.
1075         (shouldBe):
1076
1077 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1078
1079         [JSC] Allow poly proto for intrinsic getters
1080         https://bugs.webkit.org/show_bug.cgi?id=179550
1081
1082         Reviewed by Saam Barati.
1083
1084         This change is also tested by existing tests.
1085
1086             1. stress/intrinsic-getter-with-poly-proto.js
1087             2. stress/poly-proto-intrinsic-getter-correctness.js
1088
1089         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
1090         (shouldBe):
1091         (makePolyProtoObject.foo.C):
1092         (makePolyProtoObject.foo):
1093         (makePolyProtoObject):
1094         (target):
1095         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
1096         (shouldBe):
1097         (makePolyProtoObject.foo.C):
1098         (makePolyProtoObject.foo):
1099         (makePolyProtoObject):
1100         (target):
1101
1102 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
1103
1104         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
1105         https://bugs.webkit.org/show_bug.cgi?id=179744
1106
1107         Reviewed by Michael Catanzaro.
1108
1109         This test uses too much memory for our buildbots on these platforms
1110         and gets OOM-killed.
1111
1112         * stress/unshiftCountSlowCase-correct-postCapacity.js:
1113         Skip if $memoryLimited and linux.
1114
1115 2017-11-17  JF Bastien  <jfbastien@apple.com>
1116
1117         WebAssembly JS API: throw when a promise can't be created
1118         https://bugs.webkit.org/show_bug.cgi?id=179826
1119         <rdar://problem/35455813>
1120
1121         Reviewed by Mark Lam.
1122
1123         Test WebAssembly.{compile,instantiate} where promise creation
1124         fails because of a stack overflow.
1125
1126         * wasm/js-api/promise-stack-overflow.js: Added.
1127         (const.runNearStackLimit.f.const.t):
1128         (async.testCompile):
1129         (async.testInstantiate):
1130
1131 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1132
1133         Unreviewed, mark regress-178385.js as memory exhausting
1134
1135         * stress/regress-178385.js:
1136
1137 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
1138
1139         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
1140
1141         Unreviewed test gardening.
1142
1143         * test262.yaml:
1144
1145 2017-11-16  Robin Morisset  <rmorisset@apple.com>
1146
1147         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
1148         https://bugs.webkit.org/show_bug.cgi?id=179763
1149         <rdar://problem/35550513>
1150
1151         Reviewed by Keith Miller.
1152
1153         Just adding a slightly cleaned-up version of the original fuzzer-found test.
1154
1155         * stress/tdz-this-in-try-catch.js: Added.
1156         (__v_6388):
1157         (__v_6392):
1158
1159 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1160
1161         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
1162         https://bugs.webkit.org/show_bug.cgi?id=179594
1163
1164         Reviewed by Saam Barati.
1165
1166         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
1167         (shouldBe):
1168         (args):
1169         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
1170         (shouldBe):
1171         (args):
1172
1173 2017-11-14  Saam Barati  <sbarati@apple.com>
1174
1175         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
1176         https://bugs.webkit.org/show_bug.cgi?id=179639
1177         <rdar://problem/35513018>
1178
1179         Reviewed by JF Bastien.
1180
1181         * wasm/function-tests/grow-memory-cause-gc.js: Added.
1182         (escape):
1183         (i.func):
1184
1185 2017-11-13  Mark Lam  <mark.lam@apple.com>
1186
1187         Add more overflow check book-keeping for MarkedArgumentBuffer.
1188         https://bugs.webkit.org/show_bug.cgi?id=179634
1189         <rdar://problem/35492517>
1190
1191         Reviewed by Saam Barati.
1192
1193         * stress/regress-179634.js: Added.
1194
1195 2017-11-13  Mark Lam  <mark.lam@apple.com>
1196
1197         Make the jsc shell loadGetterFromGetterSetter() function more robust.
1198         https://bugs.webkit.org/show_bug.cgi?id=179619
1199         <rdar://problem/35492518>
1200
1201         Reviewed by Saam Barati.
1202
1203         * stress/regress-179619.js: Added.
1204
1205 2017-11-12  Mark Lam  <mark.lam@apple.com>
1206
1207         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
1208         https://bugs.webkit.org/show_bug.cgi?id=179562
1209         <rdar://problem/35467022>
1210
1211         Reviewed by Saam Barati.
1212
1213         * regress-179562.js: Added.
1214
1215 2017-11-08  Saam Barati  <sbarati@apple.com>
1216
1217         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
1218         https://bugs.webkit.org/show_bug.cgi?id=177792
1219
1220         Reviewed by Yusuke Suzuki.
1221
1222         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
1223         (assert):
1224         (foo.Foo.prototype.ensureX):
1225         (foo.Foo):
1226         (foo):
1227         (access):
1228
1229 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
1230
1231         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1232         https://bugs.webkit.org/show_bug.cgi?id=178592
1233
1234         Unreviewed test gardening.
1235
1236         * test262.yaml:
1237
1238 2017-11-08  Robin Morisset  <rmorisset@apple.com>
1239
1240         Turn recursive tail calls into loops
1241         https://bugs.webkit.org/show_bug.cgi?id=176601
1242
1243         Reviewed by Saam Barati.
1244
1245         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
1246
1247         Add some simple test that computes factorial in several ways, and other trivial computations.
1248         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1249         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1250         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1251         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1252
1253         * stress/inline-call-to-recursive-tail-call.js: Added.
1254         (factorial.aux):
1255         (factorial):
1256         (factorial2.aux2):
1257         (factorial2.id):
1258         (factorial2):
1259         (factorial3.aux3):
1260         (factorial3):
1261         (aux4):
1262         (factorial4):
1263         (foo):
1264         (auxBar):
1265         (bar):
1266         (test):
1267
1268 2017-11-07  Mark Lam  <mark.lam@apple.com>
1269
1270         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
1271         https://bugs.webkit.org/show_bug.cgi?id=179355
1272         <rdar://problem/35263053>
1273
1274         Reviewed by Saam Barati.
1275
1276         * stress/regress-179355.js: Added.
1277
1278 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1279
1280         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
1281         https://bugs.webkit.org/show_bug.cgi?id=144458
1282
1283         Reviewed by Saam Barati.
1284
1285         * microbenchmarks/dfg-internal-function-call.js: Added.
1286         (target):
1287         * microbenchmarks/dfg-internal-function-construct.js: Added.
1288         (target):
1289         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
1290         (target):
1291         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
1292         (target):
1293         * stress/dfg-internal-function-call.js: Added.
1294         (shouldBe):
1295         (target):
1296         * stress/dfg-internal-function-construct.js: Added.
1297         (shouldBe):
1298         (target):
1299         * stress/internal-function-call.js: Added.
1300         (shouldBe):
1301         * stress/internal-function-construct.js: Added.
1302         (shouldBe):
1303
1304 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
1305
1306         [Win] Skip stress/regress-178385.js.
1307         https://bugs.webkit.org/show_bug.cgi?id=179298
1308
1309         Unreviewed test gardening.
1310
1311         * stress/regress-178385.js:
1312
1313 2017-11-03  Keith Miller  <keith_miller@apple.com>
1314
1315         Add test for ic with side effects
1316         https://bugs.webkit.org/show_bug.cgi?id=179268
1317
1318         Reviewed by Saam Barati.
1319
1320         * stress/put-inline-cache-side-effects.js: Added.
1321         (let.i.of.objs.keys):
1322         (f):
1323
1324 2017-11-03  Mark Lam  <mark.lam@apple.com>
1325
1326         CachedCall (and its clients) needs overflow checks.
1327         https://bugs.webkit.org/show_bug.cgi?id=179185
1328
1329         Reviewed by JF Bastien.
1330
1331         * stress/regress-179185.js: Added.
1332
1333 2017-11-02  Michael Saboff  <msaboff@apple.com>
1334
1335         DFG needs to handle code motion of code in for..in loop bodies
1336         https://bugs.webkit.org/show_bug.cgi?id=179212
1337
1338         Reviewed by Keith Miller.
1339
1340         New regression test.
1341
1342         * stress/for-in-side-effects.js: Added.
1343         (getPrototypeOf):
1344         (reset):
1345         (testWithoutFTL.f):
1346         (testWithoutFTL):
1347         (testWithFTL.f):
1348         (testWithFTL):
1349
1350 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
1351
1352         AI does not correctly model the clobber case of ArithClz32
1353         https://bugs.webkit.org/show_bug.cgi?id=179188
1354
1355         Reviewed by Michael Saboff.
1356
1357         * stress/arith-clz32-effects.js: Added.
1358         (foo):
1359         (valueOf):
1360
1361 2017-11-01  Michael Saboff  <msaboff@apple.com>
1362
1363         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
1364         https://bugs.webkit.org/show_bug.cgi?id=179140
1365
1366         Reviewed by Saam Barati.
1367
1368         New regression test.
1369
1370         * stress/regress-179140.js: Added.
1371         (testWithoutFTL):
1372         (testWithFTL):
1373
1374 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1375
1376         [JSC] Introduce @toObject
1377         https://bugs.webkit.org/show_bug.cgi?id=178726
1378
1379         Reviewed by Saam Barati.
1380
1381         * stress/array-copywithin.js:
1382         (shouldThrow):
1383         * stress/object-constructor-boolean-edge.js: Added.
1384         (shouldBe):
1385         (test):
1386         * stress/object-constructor-global.js: Added.
1387         (shouldBe):
1388         * stress/object-constructor-null-edge.js: Added.
1389         (shouldBe):
1390         (test):
1391         * stress/object-constructor-number-edge.js: Added.
1392         (shouldBe):
1393         (test):
1394         * stress/object-constructor-object-edge.js: Added.
1395         (shouldBe):
1396         (test):
1397         (i.arg):
1398         * stress/object-constructor-string-edge.js: Added.
1399         (shouldBe):
1400         (test):
1401         * stress/object-constructor-symbol-edge.js: Added.
1402         (shouldBe):
1403         (test):
1404         * stress/object-constructor-undefined-edge.js: Added.
1405         (shouldBe):
1406         (test):
1407         * stress/symbol-array-from.js: Added.
1408         (shouldBe):
1409         * stress/to-object-intrinsic-boolean-edge.js: Added.
1410         (shouldBe):
1411         (builtin.createBuiltin):
1412         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
1413         (shouldThrow):
1414         * stress/to-object-intrinsic-number-edge.js: Added.
1415         (shouldBe):
1416         (builtin.createBuiltin):
1417         * stress/to-object-intrinsic-object-edge.js: Added.
1418         (shouldBe):
1419         (builtin.createBuiltin):
1420         (i.arg):
1421         * stress/to-object-intrinsic-string-edge.js: Added.
1422         (shouldBe):
1423         (builtin.createBuiltin):
1424         * stress/to-object-intrinsic-symbol-edge.js: Added.
1425         (shouldBe):
1426         (builtin.createBuiltin):
1427         * stress/to-object-intrinsic.js: Added.
1428         (shouldBe):
1429         (shouldThrow):
1430         (builtin.createBuiltin):
1431
1432 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1433
1434         [DFG][FTL] Introduce StringSlice
1435         https://bugs.webkit.org/show_bug.cgi?id=178934
1436
1437         Reviewed by Saam Barati.
1438
1439         * microbenchmarks/string-slice-empty.js: Added.
1440         (slice):
1441         * microbenchmarks/string-slice-one-char.js: Added.
1442         (slice):
1443         * microbenchmarks/string-slice.js: Added.
1444         (slice):
1445
1446 2017-10-26  Michael Saboff  <msaboff@apple.com>
1447
1448         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
1449         https://bugs.webkit.org/show_bug.cgi?id=178890
1450
1451         Reviewed by Keith Miller.
1452
1453         New regression test.
1454
1455         * stress/regress-178890.js: Added.
1456
1457 2017-10-26  Mark Lam  <mark.lam@apple.com>
1458
1459         JSRopeString::RopeBuilder::append() should check for overflows.
1460         https://bugs.webkit.org/show_bug.cgi?id=178385
1461         <rdar://problem/35027468>
1462
1463         Reviewed by Saam Barati.
1464
1465         * stress/regress-178385.js: Added.
1466
1467 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
1468
1469         Unreviewed, rolling out r223961.
1470
1471         The change that required this has been rolled out.
1472
1473         Reverted changeset:
1474
1475         "Mark test262.yaml/test262/test/language/statements/try/tco-
1476         catch.js as passing."
1477         https://bugs.webkit.org/show_bug.cgi?id=178592
1478         https://trac.webkit.org/changeset/223961
1479
1480 2017-10-25  Commit Queue  <commit-queue@webkit.org>
1481
1482         Unreviewed, rolling out r223691 and r223729.
1483         https://bugs.webkit.org/show_bug.cgi?id=178834
1484
1485         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
1486         by rniwa on #webkit).
1487
1488         Reverted changesets:
1489
1490         "Turn recursive tail calls into loops"
1491         https://bugs.webkit.org/show_bug.cgi?id=176601
1492         https://trac.webkit.org/changeset/223691
1493
1494         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
1495         comparison is always false due to limited range of data type
1496         [-Wtype-limits]"
1497         https://bugs.webkit.org/show_bug.cgi?id=178543
1498         https://trac.webkit.org/changeset/223729
1499
1500 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
1501
1502         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1503         https://bugs.webkit.org/show_bug.cgi?id=178592
1504
1505         Unreviewed test gardening.
1506
1507         * test262.yaml:
1508
1509 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1510
1511         [FTL] Support NewStringObject
1512         https://bugs.webkit.org/show_bug.cgi?id=178737
1513
1514         Reviewed by Saam Barati.
1515
1516         * stress/new-string-object.js: Added.
1517         (shouldBe):
1518         (test):
1519
1520 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1521
1522         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
1523         https://bugs.webkit.org/show_bug.cgi?id=178308
1524
1525         Reviewed by Mark Lam.
1526
1527         * test262.yaml:
1528
1529 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1530
1531         [JSC] Use fastJoin in Array#toString
1532         https://bugs.webkit.org/show_bug.cgi?id=178062
1533
1534         Reviewed by Darin Adler.
1535
1536         * microbenchmarks/contiguous-array-to-string.js: Added.
1537         (target):
1538         * microbenchmarks/double-array-to-string.js: Added.
1539         (target):
1540         * microbenchmarks/int32-array-to-string.js: Added.
1541         (target):
1542
1543 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
1544
1545         stress/check-string-ident.js is improperly skipped
1546         https://bugs.webkit.org/show_bug.cgi?id=178642
1547
1548         Reviewed by Saam Barati.
1549
1550         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
1551         since it enforces the run-jsc-stress-tests script to still set up the
1552         test to run, despite the skip directive that's used before.
1553
1554 2017-10-20  Mark Lam  <mark.lam@apple.com>
1555
1556         Add a test case for r214334.
1557         https://bugs.webkit.org/show_bug.cgi?id=169941
1558         <rdar://problem/31221258>
1559
1560         Reviewed by JF Bastien.
1561
1562         * stress/regress-169941.js: Added.
1563
1564 2017-10-19  JF Bastien  <jfbastien@apple.com>
1565
1566         WebAssembly: no VM / JS version of everything but Instance
1567         https://bugs.webkit.org/show_bug.cgi?id=177473
1568
1569         Reviewed by Filip Pizlo, Saam Barati.
1570
1571         - Exceeding max on memory growth now returns a range error as per
1572         spec. This is a (very minor) breaking change: it used to throw OOM
1573         error. Update the corresponding test.
1574
1575         * wasm/js-api/memory-grow.js:
1576         (assertEq):
1577         * wasm/js-api/table.js:
1578         (assert.throws):
1579
1580 2017-10-19  Mark Lam  <mark.lam@apple.com>
1581
1582         Stringifier::appendStringifiedValue() is missing an exception check.
1583         https://bugs.webkit.org/show_bug.cgi?id=178386
1584         <rdar://problem/35027610>
1585
1586         Reviewed by Saam Barati.
1587
1588         * stress/regress-178386.js: Added.
1589
1590 2017-10-19  Michael Saboff  <msaboff@apple.com>
1591
1592         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1593         https://bugs.webkit.org/show_bug.cgi?id=178521
1594
1595         Reviewed by JF Bastien.
1596
1597         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1598         now passes with the current version (5.0) of the Emoji spec.
1599
1600 2017-10-19  Robin Morisset  <rmorisset@apple.com>
1601
1602         Turn recursive tail calls into loops
1603         https://bugs.webkit.org/show_bug.cgi?id=176601
1604
1605         Reviewed by Saam Barati.
1606
1607         Add some simple test that computes factorial in several ways, and other trivial computations.
1608         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1609         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1610         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1611         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1612
1613         * stress/inline-call-to-recursive-tail-call.js: Added.
1614         (factorial.aux):
1615         (factorial):
1616         (factorial2.aux):
1617         (factorial2.id):
1618         (factorial2):
1619         (factorial3.aux):
1620         (factorial3):
1621         (aux):
1622         (factorial4):
1623         (test):
1624
1625 2017-10-18  Mark Lam  <mark.lam@apple.com>
1626
1627         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1628         https://bugs.webkit.org/show_bug.cgi?id=177600
1629         <rdar://problem/34710985>
1630
1631         Reviewed by Saam Barati.
1632
1633         * stress/regress-177600.js: Added.
1634
1635 2017-10-18  Mark Lam  <mark.lam@apple.com>
1636
1637         The compiler should always register a structure when it adds its transitionWatchPointSet.
1638         https://bugs.webkit.org/show_bug.cgi?id=178420
1639         <rdar://problem/34814024>
1640
1641         Reviewed by Saam Barati and Filip Pizlo.
1642
1643         * stress/regress-178420.js: Added.
1644         (new.Array.10000.map):
1645
1646 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1647
1648         [JSC] __proto__ getter should be fast
1649         https://bugs.webkit.org/show_bug.cgi?id=178067
1650
1651         Reviewed by Saam Barati.
1652
1653         * stress/dfg-object-proto-accessor.js: Added.
1654         (shouldBe):
1655         (shouldThrow):
1656         (target):
1657         * stress/dfg-object-proto-getter.js: Added.
1658         (shouldBe):
1659         (shouldThrow):
1660         (target):
1661         * stress/dfg-object-prototype-of.js: Added.
1662         (shouldBe):
1663         (shouldThrow):
1664         (target):
1665         * stress/dfg-reflect-get-prototype-of.js: Added.
1666         (shouldBe):
1667         (shouldThrow):
1668         (target):
1669         * stress/intrinsic-getter-with-poly-proto.js: Added.
1670         (shouldBe):
1671         (makePolyProtoObject.foo.C):
1672         (makePolyProtoObject.foo):
1673         (makePolyProtoObject):
1674         (target):
1675         * stress/object-get-prototype-of-filtered.js: Added.
1676         (shouldBe):
1677         (shouldThrow):
1678         (target):
1679         (i.Cocoa):
1680         * stress/object-get-prototype-of-mono-proto.js: Added.
1681         (shouldBe):
1682         (makePolyProtoObject.foo.C):
1683         (makePolyProtoObject.foo):
1684         (makePolyProtoObject):
1685         (target):
1686         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1687         (shouldBe):
1688         (makePolyProtoObject.foo.C):
1689         (makePolyProtoObject.foo):
1690         (makePolyProtoObject):
1691         (target):
1692         * stress/object-get-prototype-of-poly-proto.js: Added.
1693         (shouldBe):
1694         (makePolyProtoObject.foo.C):
1695         (makePolyProtoObject.foo):
1696         (makePolyProtoObject):
1697         (target):
1698         * stress/object-proto-getter-filtered.js: Added.
1699         (shouldBe):
1700         (shouldThrow):
1701         (target):
1702         (i.Cocoa):
1703         * stress/object-proto-getter-poly-mono-proto.js: Added.
1704         (shouldBe):
1705         (makePolyProtoObject.foo.C):
1706         (makePolyProtoObject.foo):
1707         (makePolyProtoObject):
1708         (target):
1709         * stress/object-proto-getter-poly-proto.js: Added.
1710         (shouldBe):
1711         (makePolyProtoObject.foo.C):
1712         (makePolyProtoObject.foo):
1713         (makePolyProtoObject):
1714         (target):
1715         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1716         * stress/string-proto.js: Added.
1717         (shouldBe):
1718         (target):
1719
1720 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1721
1722         Unreviewed, rolling out r223523.
1723
1724         A test for this change is failing on debug JSC bots.
1725
1726         Reverted changeset:
1727
1728         "[JSC] __proto__ getter should be fast"
1729         https://bugs.webkit.org/show_bug.cgi?id=178067
1730         https://trac.webkit.org/changeset/223523
1731
1732 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1733
1734         [JSC] __proto__ getter should be fast
1735         https://bugs.webkit.org/show_bug.cgi?id=178067
1736
1737         Reviewed by Saam Barati.
1738
1739         * stress/dfg-object-proto-accessor.js: Added.
1740         (shouldBe):
1741         (shouldThrow):
1742         (target):
1743         * stress/dfg-object-proto-getter.js: Added.
1744         (shouldBe):
1745         (shouldThrow):
1746         (target):
1747         * stress/dfg-object-prototype-of.js: Added.
1748         (shouldBe):
1749         (shouldThrow):
1750         (target):
1751         * stress/dfg-reflect-get-prototype-of.js: Added.
1752         (shouldBe):
1753         (shouldThrow):
1754         (target):
1755         * stress/object-get-prototype-of-filtered.js: Added.
1756         (shouldBe):
1757         (shouldThrow):
1758         (target):
1759         (i.Cocoa):
1760         * stress/object-get-prototype-of-mono-proto.js: Added.
1761         (shouldBe):
1762         (makePolyProtoObject.foo.C):
1763         (makePolyProtoObject.foo):
1764         (makePolyProtoObject):
1765         (target):
1766         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1767         (shouldBe):
1768         (makePolyProtoObject.foo.C):
1769         (makePolyProtoObject.foo):
1770         (makePolyProtoObject):
1771         (target):
1772         * stress/object-get-prototype-of-poly-proto.js: Added.
1773         (shouldBe):
1774         (makePolyProtoObject.foo.C):
1775         (makePolyProtoObject.foo):
1776         (makePolyProtoObject):
1777         (target):
1778         * stress/object-proto-getter-filtered.js: Added.
1779         (shouldBe):
1780         (shouldThrow):
1781         (target):
1782         (i.Cocoa):
1783         * stress/object-proto-getter-poly-mono-proto.js: Added.
1784         (shouldBe):
1785         (makePolyProtoObject.foo.C):
1786         (makePolyProtoObject.foo):
1787         (makePolyProtoObject):
1788         (target):
1789         * stress/object-proto-getter-poly-proto.js: Added.
1790         (shouldBe):
1791         (makePolyProtoObject.foo.C):
1792         (makePolyProtoObject.foo):
1793         (makePolyProtoObject):
1794         (target):
1795         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1796         * stress/string-proto.js: Added.
1797         (shouldBe):
1798         (target):
1799
1800 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1801
1802         Reland "Add Above/Below comparisons for UInt32 patterns"
1803         https://bugs.webkit.org/show_bug.cgi?id=177281
1804
1805         Reviewed by Saam Barati.
1806
1807         * stress/uint32-comparison-jump.js: Added.
1808         (shouldBe):
1809         (above):
1810         (aboveOrEqual):
1811         (below):
1812         (belowOrEqual):
1813         (notAbove):
1814         (notAboveOrEqual):
1815         (notBelow):
1816         (notBelowOrEqual):
1817         * stress/uint32-comparison.js: Added.
1818         (shouldBe):
1819         (above):
1820         (aboveOrEqual):
1821         (below):
1822         (belowOrEqual):
1823         (aboveTest):
1824         (aboveOrEqualTest):
1825         (belowTest):
1826         (belowOrEqualTest):
1827
1828 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1829
1830         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1831         https://bugs.webkit.org/show_bug.cgi?id=178210
1832
1833         Reviewed by Saam Barati.
1834
1835         * wasm/function-tests/trap-from-start-async.js:
1836         (async.StartTrapsAsync):
1837         * wasm/function-tests/trap-from-start.js:
1838         (StartTraps):
1839         * wasm/js-api/web-assembly-function.js:
1840         (assert.eq.Object.getPrototypeOf):
1841         * wasm/js-api/wrapper-function.js:
1842         (return.new.WebAssembly.Module):
1843         (assert.throws.makeInstance): Deleted.
1844         (assert.throws.Bar): Deleted.
1845         (assert.throws): Deleted.
1846
1847 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1848
1849         Enable gigacage on iOS
1850         https://bugs.webkit.org/show_bug.cgi?id=177586
1851
1852         Reviewed by JF Bastien.
1853         
1854         Add tests for when Gigacage gets runtime disabled.
1855
1856         * stress/disable-gigacage-arrays.js: Added.
1857         (foo):
1858         * stress/disable-gigacage-strings.js: Added.
1859         (foo):
1860         * stress/disable-gigacage-typed-arrays.js: Added.
1861         (foo):
1862
1863 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1864
1865         import.meta should not be assignable
1866         https://bugs.webkit.org/show_bug.cgi?id=178202
1867
1868         Reviewed by Saam Barati.
1869
1870         * modules/import-meta-assignment.js: Added.
1871         (shouldThrow):
1872         (SyntaxError.import.meta.can.shouldThrow):
1873
1874 2017-10-11  Saam Barati  <sbarati@apple.com>
1875
1876         Unreviewed. Actually skip certain type profiler tests in debug.
1877
1878         * typeProfiler.yaml:
1879         * typeProfiler/deltablue-for-of.js:
1880         * typeProfiler/getter-richards.js:
1881
1882 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1883
1884         Unreviewed, rolling out r223113 and r223121.
1885         https://bugs.webkit.org/show_bug.cgi?id=178182
1886
1887         Reintroduced 20% regression on Kraken (Requested by rniwa on
1888         #webkit).
1889
1890         Reverted changesets:
1891
1892         "Enable gigacage on iOS"
1893         https://bugs.webkit.org/show_bug.cgi?id=177586
1894         https://trac.webkit.org/changeset/223113
1895
1896         "Use one virtual allocation for all gigacages and their
1897         runways"
1898         https://bugs.webkit.org/show_bug.cgi?id=178050
1899         https://trac.webkit.org/changeset/223121
1900
1901 2017-10-11  Michael Saboff  <msaboff@apple.com>
1902
1903         Disable test262 named capture group tests with direct unicode names and with references before definitions
1904         https://bugs.webkit.org/show_bug.cgi?id=178177
1905
1906         Reviewed by Keith Miller.
1907
1908         Bugs to track fixing these test are:
1909         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1910             "Add support in named capture group identifiers for direct surrogate pairs"
1911         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1912             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1913
1914         * test262.yaml:
1915
1916 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1917
1918         Object properties are undefined in super.call() but not in this.call()
1919         https://bugs.webkit.org/show_bug.cgi?id=177230
1920
1921         Reviewed by Saam Barati.
1922
1923         * stress/super-call-function-subclass.js: Added.
1924         (assert):
1925         (A.prototype.t):
1926         (A):
1927         * stress/super-dot-call-and-apply.js: Added.
1928         (assert):
1929         (A):
1930         (A.prototype.call):
1931         (A.prototype.apply):
1932         (B.prototype.testSuper):
1933         (B):
1934         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1935         (D.prototype.testSuper):
1936         (D):
1937
1938 2017-10-10  Saam Barati  <sbarati@apple.com>
1939
1940         The prototype cache should be aware of the Executable it generates a Structure for
1941         https://bugs.webkit.org/show_bug.cgi?id=177907
1942
1943         Reviewed by Filip Pizlo.
1944
1945         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1946         (assert):
1947         (foo.C):
1948         (foo):
1949         (bar.C):
1950         (bar):
1951         (access):
1952         (makeLongChain):
1953         (accessY):
1954
1955 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1956
1957         `async` should be able to be used as an imported binding name
1958         https://bugs.webkit.org/show_bug.cgi?id=176573
1959
1960         Reviewed by Saam Barati.
1961
1962         * modules/import-default-async.js: Added.
1963         * modules/import-named-async-as.js: Added.
1964         * modules/import-named-async.js: Added.
1965         * modules/import-named-async/target.js: Added.
1966         * modules/import-namespace-async.js: Added.
1967         * test262.yaml:
1968
1969 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1970
1971         Enable gigacage on iOS
1972         https://bugs.webkit.org/show_bug.cgi?id=177586
1973
1974         Reviewed by JF Bastien.
1975         
1976         Add tests for when Gigacage gets runtime disabled.
1977
1978         * stress/disable-gigacage-arrays.js: Added.
1979         (foo):
1980         * stress/disable-gigacage-strings.js: Added.
1981         (foo):
1982         * stress/disable-gigacage-typed-arrays.js: Added.
1983         (foo):
1984
1985 2017-10-09  Michael Saboff  <msaboff@apple.com>
1986
1987         Implement RegExp Unicode property escapes
1988         https://bugs.webkit.org/show_bug.cgi?id=172069
1989
1990         Reviewed by JF Bastien.
1991
1992         Enabled Unicode Property tests.
1993
1994         * test262.yaml:
1995
1996 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1997
1998         Unreviewed, rolling out r223015 and r223025.
1999         https://bugs.webkit.org/show_bug.cgi?id=178093
2000
2001         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
2002         #webkit).
2003
2004         Reverted changesets:
2005
2006         "Enable gigacage on iOS"
2007         https://bugs.webkit.org/show_bug.cgi?id=177586
2008         http://trac.webkit.org/changeset/223015
2009
2010         "Unreviewed, disable Gigacage on ARM64 Linux"
2011         https://bugs.webkit.org/show_bug.cgi?id=177586
2012         http://trac.webkit.org/changeset/223025
2013
2014 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
2015
2016         Update expectations for test262 tests that pass after r223043.
2017         https://bugs.webkit.org/show_bug.cgi?id=176685
2018
2019         Unreviewed test gardening.
2020
2021         * test262.yaml:
2022
2023 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
2024
2025         Unreviewed, rolling out r223022.
2026
2027         This change introduced 18 test262 failures.
2028
2029         Reverted changeset:
2030
2031         "`async` should be able to be used as an imported binding
2032         name"
2033         https://bugs.webkit.org/show_bug.cgi?id=176573
2034         http://trac.webkit.org/changeset/223022
2035
2036 2017-10-09  Saam Barati  <sbarati@apple.com>
2037
2038         3 poly-proto JSC tests timing out on debug after r222827
2039         https://bugs.webkit.org/show_bug.cgi?id=177880
2040         <rdar://problem/34817122>
2041
2042         Unreviewed.
2043
2044         I'm skipping these type profiler tests on debug since they are long running.
2045
2046         * typeProfiler/deltablue-for-of.js:
2047         * typeProfiler/getter-richards.js:
2048
2049 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
2050
2051         Safari 10 /11 problem with if (!await get(something)).
2052         https://bugs.webkit.org/show_bug.cgi?id=176685
2053
2054         Reviewed by Saam Barati.
2055
2056         * stress/async-await-basic.js:
2057         (awaitEpression.async):
2058         * stress/async-await-syntax.js:
2059         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2060         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2061
2062 2017-10-08  Saam Barati  <sbarati@apple.com>
2063
2064         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
2065
2066         * typeProfiler/deltablue-for-of.js:
2067         * typeProfiler/getter-richards.js:
2068
2069 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
2070
2071         `async` should be able to be used as an imported binding name
2072         https://bugs.webkit.org/show_bug.cgi?id=176573
2073
2074         Reviewed by Darin Adler.
2075
2076         * modules/import-default-async.js: Added.
2077         * modules/import-named-async-as.js: Added.
2078         * modules/import-named-async.js: Added.
2079         * modules/import-named-async/target.js: Added.
2080         * modules/import-namespace-async.js: Added.
2081
2082 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
2083
2084         Enable gigacage on iOS
2085         https://bugs.webkit.org/show_bug.cgi?id=177586
2086
2087         Reviewed by JF Bastien.
2088         
2089         Add tests for when Gigacage gets runtime disabled.
2090
2091         * stress/disable-gigacage-arrays.js: Added.
2092         (foo):
2093         * stress/disable-gigacage-strings.js: Added.
2094         (foo):
2095         * stress/disable-gigacage-typed-arrays.js: Added.
2096         (foo):
2097
2098 2017-10-06  Commit Queue  <commit-queue@webkit.org>
2099
2100         Unreviewed, rolling out r222791 and r222873.
2101         https://bugs.webkit.org/show_bug.cgi?id=178031
2102
2103         Caused crashes with workers/wasm LayoutTests (Requested by
2104         ryanhaddad on #webkit).
2105
2106         Reverted changesets:
2107
2108         "WebAssembly: no VM / JS version of everything but Instance"
2109         https://bugs.webkit.org/show_bug.cgi?id=177473
2110         http://trac.webkit.org/changeset/222791
2111
2112         "WebAssembly: address no VM / JS follow-ups"
2113         https://bugs.webkit.org/show_bug.cgi?id=177887
2114         http://trac.webkit.org/changeset/222873
2115
2116 2017-10-05  Saam Barati  <sbarati@apple.com>
2117
2118         Make sure all prototypes under poly proto get added into the VM's prototype map
2119         https://bugs.webkit.org/show_bug.cgi?id=177909
2120
2121         Reviewed by Keith Miller.
2122
2123         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
2124         (assert):
2125         (foo.C):
2126         (foo):
2127         (set x):
2128
2129 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
2130
2131         [JSC] Introduce import.meta
2132         https://bugs.webkit.org/show_bug.cgi?id=177703
2133
2134         Reviewed by Filip Pizlo.
2135
2136         * modules/import-meta-syntax.js: Added.
2137         (shouldThrow):
2138         (shouldNotThrow):
2139         * modules/import-meta.js: Added.
2140         * modules/import-meta/cocoa.js: Added.
2141         * modules/resources/assert.js:
2142         (export.shouldNotThrow):
2143         * stress/import-syntax.js:
2144
2145 2017-10-04  Saam Barati  <sbarati@apple.com>
2146
2147         Make pertinent AccessCases watch the poly proto watchpoint
2148         https://bugs.webkit.org/show_bug.cgi?id=177765
2149
2150         Reviewed by Keith Miller.
2151
2152         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
2153         (assert):
2154         (foo.C):
2155         (foo):
2156         (validate):
2157         * stress/poly-proto-clear-stub.js: Added.
2158         (assert):
2159         (foo.C):
2160         (foo):
2161
2162 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
2163
2164         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
2165
2166         Unreviewed test gardening.
2167
2168         * test262.yaml:
2169
2170 2017-10-04  Saam Barati  <sbarati@apple.com>
2171
2172         3 poly-proto JSC tests timing out on debug after r222827
2173         https://bugs.webkit.org/show_bug.cgi?id=177880
2174
2175         Rubber stamped by Mark Lam.
2176
2177         * microbenchmarks/poly-proto-access.js:
2178         * typeProfiler/deltablue-for-of.js:
2179         * typeProfiler/getter-richards.js:
2180
2181 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
2182
2183         Unreviewed, marking tco-catch.js as a failure after test262 update
2184         https://bugs.webkit.org/show_bug.cgi?id=177859
2185
2186         * test262.yaml:
2187
2188 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2189
2190         Unreviewed, marking one async iterator test262 test failed
2191         https://bugs.webkit.org/show_bug.cgi?id=177859
2192
2193         * test262.yaml:
2194
2195 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2196
2197         [Test262] Update Test262 to Oct 4 version
2198         https://bugs.webkit.org/show_bug.cgi?id=177859
2199
2200         Reviewed by Sam Weinig.
2201
2202         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
2203         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
2204
2205         * test262.yaml:
2206         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
2207         (checkSequence):
2208         * test262/harness/typeCoercion.js:
2209         (testCoercibleToIndexZero):
2210         (testCoercibleToIndexOne):
2211         (testCoercibleToIndexFromIndex):
2212         (testNotCoercibleToIndex.testPrimitiveValue):
2213         (testNotCoercibleToInteger):
2214         (testCoercibleToBigIntZero.testPrimitiveValue):
2215         (testCoercibleToBigIntZero):
2216         (testCoercibleToBigIntOne.testPrimitiveValue):
2217         (testCoercibleToBigIntOne):
2218         (testPrimitiveValue):
2219         (testCoercibleToBigIntFromBigInt):
2220         (testNotCoercibleToBigInt.testPrimitiveValue):
2221         (testNotCoercibleToBigInt.testStringValue):
2222         (testNotCoercibleToBigInt):
2223         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
2224         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
2225         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
2226         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
2227         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
2228         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
2229         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
2230         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
2231         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
2232         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
2233         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
2234         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
2235         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
2236         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
2237         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
2238         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
2239         (testCoercibleToBigIntZero):
2240         (testCoercibleToBigIntOne):
2241         (testNotCoercibleToBigInt):
2242         (MyError): Deleted.
2243         (valueOf): Deleted.
2244         (toString): Deleted.
2245         (Symbol.toPrimitive): Deleted.
2246         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
2247         (testCoercibleToIndexZero):
2248         (testCoercibleToIndexOne):
2249         (testNotCoercibleToIndex):
2250         (MyError): Deleted.
2251         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
2252         (assert.sameValue.BigInt.asIntN.toString): Deleted.
2253         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
2254         (BigInt.asIntN.valueOf): Deleted.
2255         (BigInt.asIntN.toString): Deleted.
2256         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
2257         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
2258         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
2259         (testCoercibleToBigIntZero):
2260         (testCoercibleToBigIntOne):
2261         (testNotCoercibleToBigInt):
2262         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
2263         (testCoercibleToIndexZero):
2264         (testCoercibleToIndexOne):
2265         (testNotCoercibleToIndex):
2266         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
2267         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
2268         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
2269         (bits.valueOf):
2270         (bigint.valueOf):
2271         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
2272         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
2273         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
2274         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
2275         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
2276         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
2277         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
2278         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
2279         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
2280         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
2281         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
2282         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
2283         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
2284         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
2285         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
2286         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
2287         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
2288         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
2289         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
2290         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
2291         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
2292         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
2293         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
2294         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
2295         (replacer):
2296         (BigInt.prototype.toJSON):
2297         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
2298         (replacer):
2299         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
2300         (BigInt.prototype.toJSON):
2301         * test262/test/built-ins/JSON/stringify/bigint.js:
2302         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
2303         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
2304         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
2305         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
2306         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
2307         * test262/test/built-ins/Object/proto-from-ctor.js:
2308         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
2309         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
2310         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
2311         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
2312         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
2313         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
2314         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
2315         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
2316         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
2317         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
2318         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
2319         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
2320         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
2321         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
2322         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
2323         * test262/test/built-ins/Proxy/get-fn-realm.js:
2324         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
2325         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
2326         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
2327         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
2328         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
2329         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
2330         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
2331         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
2332         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
2333         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
2334         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
2335         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
2336         (i6.replace):
2337         (i6b.replace):
2338         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
2339         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
2340         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
2341         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
2342         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
2343         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
2344         * test262/test/built-ins/RegExp/u180e.js: Added.
2345         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
2346         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
2347         * test262/test/built-ins/String/proto-from-ctor-realm.js:
2348         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
2349         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
2350         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
2351         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
2352         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
2353         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
2354         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
2355         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
2356         * test262/test/built-ins/String/prototype/endsWith/length.js:
2357         * test262/test/built-ins/String/prototype/endsWith/name.js:
2358         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
2359         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
2360         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
2361         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
2362         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
2363         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
2364         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
2365         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
2366         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
2367         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
2368         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
2369         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
2370         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
2371         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
2372         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
2373         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
2374         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
2375         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
2376         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
2377         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
2378         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
2379         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
2380         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
2381         * test262/test/built-ins/String/prototype/includes/includes.js:
2382         * test262/test/built-ins/String/prototype/includes/length.js:
2383         * test262/test/built-ins/String/prototype/includes/name.js:
2384         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
2385         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
2386         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
2387         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
2388         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
2389         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
2390         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
2391         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
2392         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
2393         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
2394         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
2395         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
2396         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
2397         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
2398         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
2399         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
2400         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
2401         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
2402         * test262/test/built-ins/String/prototype/trim/u180e.js:
2403         * test262/test/built-ins/Symbol/for/cross-realm.js:
2404         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
2405         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
2406         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
2407         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
2408         * test262/test/built-ins/Symbol/match/cross-realm.js:
2409         * test262/test/built-ins/Symbol/replace/cross-realm.js:
2410         * test262/test/built-ins/Symbol/search/cross-realm.js:
2411         * test262/test/built-ins/Symbol/species/cross-realm.js:
2412         * test262/test/built-ins/Symbol/split/cross-realm.js:
2413         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
2414         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
2415         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
2416         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
2417         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
2418         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
2419         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
2420         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
2421         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
2422         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
2423         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
2424         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
2425         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
2426         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
2427         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
2428         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
2429         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
2430         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
2431         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
2432         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
2433         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
2434         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
2435         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
2436         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
2437         * test262/test/language/comments/mongolian-vowel-separator-single.js:
2438         * test262/test/language/eval-code/indirect/realm.js:
2439         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
2440         (o.get z):
2441         (o.get a):
2442         * test262/test/language/expressions/call/eval-realm-indirect.js:
2443         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
2444         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
2445         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
2446         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
2447         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2448         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
2449         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
2450         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
2451         * test262/test/language/expressions/greater-than/bigint-and-number.js:
2452         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
2453         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
2454         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
2455         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2456         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
2457         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
2458         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
2459         * test262/test/language/expressions/less-than/bigint-and-number.js:
2460         * test262/test/language/expressions/new/non-ctor-err-realm.js:
2461         * test262/test/language/expressions/super/realm.js:
2462         * test262/test/language/expressions/tagged-template/cache-realm.js:
2463         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
2464         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
2465         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
2466         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
2467         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
2468         * test262/test/language/literals/string/mongolian-vowel-separator.js:
2469         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
2470         (o.get z):
2471         (o.get a):
2472         * test262/test/language/statements/for-of/iterator-next-reference.js:
2473         (next):
2474         (iterator.next): Deleted.
2475         (x.of.iterable.): Deleted.
2476         (x.of.iterable.get return): Deleted.
2477         (x.of.iterable.iterator.next): Deleted.
2478         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
2479         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
2480         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
2481         * test262/test/language/white-space/mongolian-vowel-separator.js:
2482         * test262/test262-Revision.txt:
2483
2484 2017-10-03  Saam Barati  <sbarati@apple.com>
2485
2486         Implement polymorphic prototypes
2487         https://bugs.webkit.org/show_bug.cgi?id=176391
2488
2489         Reviewed by Filip Pizlo.
2490
2491         * microbenchmarks/poly-proto-access.js: Added.
2492         (assert):
2493         (foo.C):
2494         (foo.C.prototype.get bar):
2495         (foo):
2496         (bar):
2497         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
2498         (assert):
2499         (makePolyProtoObject.foo.C):
2500         (makePolyProtoObject.foo):
2501         (makePolyProtoObject):
2502         (performSet):
2503         * microbenchmarks/poly-proto-setter-speed.js: Added.
2504         (assert):
2505         (makePolyProtoObject.foo.C):
2506         (makePolyProtoObject.foo.C.prototype.set p):
2507         (makePolyProtoObject.foo):
2508         (makePolyProtoObject):
2509         (performSet):
2510         * stress/constructor-with-return.js:
2511         (i.tests.forEach.Constructor):
2512         (i.tests.forEach):
2513         (tests.forEach.Constructor): Deleted.
2514         (tests.forEach): Deleted.
2515         * stress/dom-jit-with-poly-proto.js: Added.
2516         (assert):
2517         (makePolyProtoObject.foo.C):
2518         (makePolyProtoObject.foo):
2519         (makePolyProtoObject):
2520         (validate):
2521         * stress/poly-proto-custom-value-and-accessor.js: Added.
2522         (assert):
2523         (makePolyProtoObject.foo.C):
2524         (makePolyProtoObject.foo):
2525         (makePolyProtoObject):
2526         (items.forEach):
2527         (set get for):
2528         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
2529         (assert):
2530         (makePolyProtoObject.foo.C):
2531         (makePolyProtoObject.foo):
2532         (makePolyProtoObject):
2533         (foo):
2534         * stress/poly-proto-miss.js: Added.
2535         (makePolyProtoInstanceWithNullPrototype.foo.C):
2536         (makePolyProtoInstanceWithNullPrototype.foo):
2537         (makePolyProtoInstanceWithNullPrototype):
2538         (assert):
2539         (validate):
2540         * stress/poly-proto-op-in-caching.js: Added.
2541         (assert):
2542         (makePolyProtoObject.foo.C):
2543         (makePolyProtoObject.foo):
2544         (makePolyProtoObject):
2545         (validate):
2546         (validate2):
2547         * stress/poly-proto-put-transition.js: Added.
2548         (assert):
2549         (makePolyProtoObject.foo.C):
2550         (makePolyProtoObject.foo):
2551         (makePolyProtoObject):
2552         (performSet):
2553         (i.obj.__proto__.set p):
2554         * stress/poly-proto-set-prototype.js: Added.
2555         (assert):
2556         (let.alternateProto.get x):
2557         (let.alternateProto2.get y):
2558         (let.alternateProto2.get x):
2559         (foo.C):
2560         (foo):
2561         (validate):
2562         * stress/poly-proto-setter.js: Added.
2563         (assert):
2564         (makePolyProtoObject.foo.C):
2565         (makePolyProtoObject.foo.C.prototype.set p):
2566         (makePolyProtoObject.foo.C.prototype.get p):
2567         (makePolyProtoObject.foo):
2568         (makePolyProtoObject):
2569         (performSet):
2570         * stress/poly-proto-using-inheritance.js: Added.
2571         (assert):
2572         (foo.C):
2573         (foo.C.prototype.get baz):
2574         (foo):
2575         (bar.C):
2576         (bar):
2577         (validate):
2578         * stress/primitive-poly-proto.js: Added.
2579         (makePolyProtoInstance.foo.C):
2580         (makePolyProtoInstance.foo):
2581         (makePolyProtoInstance):
2582         (assert):
2583         (validate):
2584         * stress/prototype-is-not-js-object.js: Added.
2585         (foo.bar):
2586         (foo):
2587         (assert):
2588         (validate):
2589         * stress/try-get-by-id-poly-proto.js: Added.
2590         (assert):
2591         (makePolyProtoObject.foo.C):
2592         (makePolyProtoObject.foo):
2593         (makePolyProtoObject):
2594         (tryGetByIdText):
2595         (x.__proto__.get bar):
2596         (validate):
2597         * typeProfiler/overflow.js:
2598
2599 2017-10-03  JF Bastien  <jfbastien@apple.com>
2600
2601         WebAssembly: no VM / JS version of everything but Instance
2602         https://bugs.webkit.org/show_bug.cgi?id=177473
2603
2604         Reviewed by Filip Pizlo.
2605
2606         - Exceeding max on memory growth now returns a range error as per
2607         spec. This is a (very minor) breaking change: it used to throw OOM
2608         error. Update the corresponding test.
2609
2610         * wasm/js-api/memory-grow.js:
2611         (assertEq):
2612         * wasm/js-api/table.js:
2613         (assert.throws):
2614
2615 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
2616
2617         Skip JSC test stress/regress-159779-2.js on debug.
2618         https://bugs.webkit.org/show_bug.cgi?id=177204
2619
2620         Unreviewed test gardening.
2621
2622         * stress/regress-159779-2.js:
2623
2624 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
2625
2626         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2627         https://bugs.webkit.org/show_bug.cgi?id=175642
2628
2629         Reviewed by Darin Adler.
2630
2631         * ChakraCore/test/Function/apply3.baseline-jsc:
2632
2633 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2634
2635         Unreviewed, rolling out r222564.
2636         https://bugs.webkit.org/show_bug.cgi?id=177720
2637
2638         "It regressed JetStream by 2% on iOS caused by a 50%
2639         regression on the bigfib subtest" (Requested by saamyjoon on
2640         #webkit).
2641
2642         Reverted changeset:
2643
2644         "Add Above/Below comparisons for UInt32 patterns"
2645         https://bugs.webkit.org/show_bug.cgi?id=177281
2646         http://trac.webkit.org/changeset/222564
2647
2648 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2649
2650         [DFG] Support ArrayPush with multiple args
2651         https://bugs.webkit.org/show_bug.cgi?id=175823
2652
2653         Reviewed by Saam Barati.
2654
2655         * microbenchmarks/array-push-0.js: Added.
2656         (arrayPush0):
2657         * microbenchmarks/array-push-1.js: Added.
2658         (arrayPush1):
2659         * microbenchmarks/array-push-2.js: Added.
2660         (arrayPush2):
2661         * microbenchmarks/array-push-3.js: Added.
2662         (arrayPush3):
2663         * stress/array-push-multiple-contiguous.js: Added.
2664         (shouldBe):
2665         (test):
2666         * stress/array-push-multiple-double-nan.js: Added.
2667         (shouldBe):
2668         (test):
2669         * stress/array-push-multiple-double.js: Added.
2670         (shouldBe):
2671         (test):
2672         * stress/array-push-multiple-int32.js: Added.
2673         (shouldBe):
2674         (test):
2675         * stress/array-push-multiple-many-contiguous.js: Added.
2676         (shouldBe):
2677         (test):
2678         * stress/array-push-multiple-many-double.js: Added.
2679         (shouldBe):
2680         (test):
2681         * stress/array-push-multiple-many-int32.js: Added.
2682         (shouldBe):
2683         (test):
2684         * stress/array-push-multiple-many-storage.js: Added.
2685         (shouldBe):
2686         (test):
2687         * stress/array-push-multiple-storage.js: Added.
2688         (shouldBe):
2689         (test):
2690         * stress/array-push-with-force-exit.js: Added.
2691         (target.createBuiltin):
2692
2693 2017-09-29  Saam Barati  <sbarati@apple.com>
2694
2695         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2696         https://bugs.webkit.org/show_bug.cgi?id=177639
2697
2698         Reviewed by Geoffrey Garen.
2699
2700         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2701         (assert):
2702         (Class):
2703         (items.forEach):
2704         (set get for):
2705
2706 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2707
2708         Unreviewed, rolling out r222563, r222565, and r222581.
2709         https://bugs.webkit.org/show_bug.cgi?id=177675
2710
2711         "It causes a crash when playing youtube videos" (Requested by
2712         saamyjoon on #webkit).
2713
2714         Reverted changesets:
2715
2716         "[DFG] Support ArrayPush with multiple args"
2717         https://bugs.webkit.org/show_bug.cgi?id=175823
2718         http://trac.webkit.org/changeset/222563
2719
2720         "Unreviewed, build fix after r222563"
2721         https://bugs.webkit.org/show_bug.cgi?id=175823
2722         http://trac.webkit.org/changeset/222565
2723
2724         "Unreviewed, fix x86 breaking due to exhausted registers"
2725         https://bugs.webkit.org/show_bug.cgi?id=175823
2726         http://trac.webkit.org/changeset/222581
2727
2728 2017-09-28  Mark Lam  <mark.lam@apple.com>
2729
2730         test262: Unexpected passes after r222617 and r222618.
2731         https://bugs.webkit.org/show_bug.cgi?id=177622
2732         <rdar://problem/34725960>
2733
2734         Reviewed by Saam Barati.
2735
2736         Update test262.yaml for tests that are now passing.
2737
2738         * test262.yaml:
2739
2740 2017-09-27  Michael Saboff  <msaboff@apple.com>
2741
2742         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2743         https://bugs.webkit.org/show_bug.cgi?id=177570
2744
2745         Reviewed by Filip Pizlo.
2746
2747         New regression test.
2748
2749         * stress/regress-177570.js: Added.
2750
2751 2017-09-28  Michael Saboff  <msaboff@apple.com>
2752
2753         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2754         https://bugs.webkit.org/show_bug.cgi?id=177423
2755
2756         Reviewed by Mark Lam.
2757
2758         Updated regression test.
2759
2760         * stress/regress-177423.js:
2761         (catch):
2762
2763 2017-09-27  Mark Lam  <mark.lam@apple.com>
2764
2765         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2766         https://bugs.webkit.org/show_bug.cgi?id=177584
2767         <rdar://problem/34463903>
2768
2769         Reviewed by Saam Barati.
2770
2771         * stress/regress-177584.js: Added.
2772         (assertEqual):
2773         (Array.prototype.Symbol.species):
2774
2775 2017-09-27  Saam Barati  <sbarati@apple.com>
2776
2777         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2778         https://bugs.webkit.org/show_bug.cgi?id=177523
2779
2780         Reviewed by Mark Lam.
2781
2782         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2783         (assert):
2784         (Test):
2785         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2786         (addMethods):
2787         (i.Test.prototype.propName):
2788
2789 2017-09-27  Mark Lam  <mark.lam@apple.com>
2790
2791         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2792         https://bugs.webkit.org/show_bug.cgi?id=177423
2793         <rdar://problem/34621320>
2794
2795         Reviewed by Keith Miller.
2796
2797         * stress/regress-177423.js: Added.
2798
2799 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2800
2801         Add Above/Below comparisons for UInt32 patterns
2802         https://bugs.webkit.org/show_bug.cgi?id=177281
2803
2804         Reviewed by Saam Barati.
2805
2806         * stress/uint32-comparison-jump.js: Added.
2807         (shouldBe):
2808         (above):
2809         (aboveOrEqual):
2810         (below):
2811         (belowOrEqual):
2812         (notAbove):
2813         (notAboveOrEqual):
2814         (notBelow):
2815         (notBelowOrEqual):
2816         * stress/uint32-comparison.js: Added.
2817         (shouldBe):
2818         (above):
2819         (aboveOrEqual):
2820         (below):
2821         (belowOrEqual):
2822         (aboveTest):
2823         (aboveOrEqualTest):
2824         (belowTest):
2825         (belowOrEqualTest):
2826
2827 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2828
2829         [DFG] Support ArrayPush with multiple args
2830         https://bugs.webkit.org/show_bug.cgi?id=175823
2831
2832         Reviewed by Saam Barati.
2833
2834         * microbenchmarks/array-push-0.js: Added.
2835         (arrayPush0):
2836         * microbenchmarks/array-push-1.js: Added.
2837         (arrayPush1):
2838         * microbenchmarks/array-push-2.js: Added.
2839         (arrayPush2):
2840         * microbenchmarks/array-push-3.js: Added.
2841         (arrayPush3):
2842         * stress/array-push-multiple-contiguous.js: Added.
2843         (shouldBe):
2844         (test):
2845         * stress/array-push-multiple-double-nan.js: Added.
2846         (shouldBe):
2847         (test):
2848         * stress/array-push-multiple-double.js: Added.
2849         (shouldBe):
2850         (test):
2851         * stress/array-push-multiple-int32.js: Added.
2852         (shouldBe):
2853         (test):
2854         * stress/array-push-multiple-many-contiguous.js: Added.
2855         (shouldBe):
2856         (test):
2857         * stress/array-push-multiple-many-double.js: Added.
2858         (shouldBe):
2859         (test):
2860         * stress/array-push-multiple-many-int32.js: Added.
2861         (shouldBe):
2862         (test):
2863         * stress/array-push-multiple-many-storage.js: Added.
2864         (shouldBe):
2865         (test):
2866         * stress/array-push-multiple-storage.js: Added.
2867         (shouldBe):
2868         (test):
2869
2870 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2871
2872         Unreviewed, rolling out r222518.
2873         https://bugs.webkit.org/show_bug.cgi?id=177507
2874
2875         Break the High Sierra build (Requested by yusukesuzuki on
2876         #webkit).
2877
2878         Reverted changeset:
2879
2880         "Add Above/Below comparisons for UInt32 patterns"
2881         https://bugs.webkit.org/show_bug.cgi?id=177281
2882         http://trac.webkit.org/changeset/222518
2883
2884 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2885
2886         Add Above/Below comparisons for UInt32 patterns
2887         https://bugs.webkit.org/show_bug.cgi?id=177281
2888
2889         Reviewed by Saam Barati.
2890
2891         * stress/uint32-comparison-jump.js: Added.
2892         (shouldBe):
2893         (above):
2894         (aboveOrEqual):
2895         (below):
2896         (belowOrEqual):
2897         (notAbove):
2898         (notAboveOrEqual):
2899         (notBelow):
2900         (notBelowOrEqual):
2901         * stress/uint32-comparison.js: Added.
2902         (shouldBe):
2903         (above):
2904         (aboveOrEqual):
2905         (below):
2906         (belowOrEqual):
2907         (aboveTest):
2908         (aboveOrEqualTest):
2909         (belowTest):
2910         (belowOrEqualTest):
2911
2912 2017-09-23  Keith Miller  <keith_miller@apple.com>
2913
2914         Fix infinite looping test262 test
2915         https://bugs.webkit.org/show_bug.cgi?id=177412
2916
2917         Reviewed by Yusuke Suzuki.
2918
2919         This test was poorly designed since failing it would cause the vm
2920         to inifinite loop. I've fixed it locally and will fix it on github pending
2921         the results of next weeks tc39 meeting.
2922
2923         * test262.yaml:
2924         * test262/test/language/statements/for-of/iterator-next-reference.js:
2925
2926 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2927
2928         test262: $.agent became $262.agent in test262 update
2929         https://bugs.webkit.org/show_bug.cgi?id=177407
2930
2931         Reviewed by Yusuke Suzuki.
2932
2933         * test262.yaml:
2934         ~320 tests pass now that we correctly make $262 available.
2935
2936 2017-09-22  Keith Miller  <keith_miller@apple.com>
2937
2938         Speculatively change iteration protocall to use the same next function
2939         https://bugs.webkit.org/show_bug.cgi?id=175653
2940
2941         Reviewed by Saam Barati.
2942
2943         Change test to match the new iteration behavior.
2944
2945         * stress/spread-optimized-properly.js:
2946
2947 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2948
2949         [DFG][FTL] Profile array vector length for array allocation
2950         https://bugs.webkit.org/show_bug.cgi?id=177051
2951
2952         Reviewed by Saam Barati.
2953
2954         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2955         (target):
2956
2957 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2958
2959         Unreviewed, rolling out r222380.
2960         https://bugs.webkit.org/show_bug.cgi?id=177352
2961
2962         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2963         #webkit).
2964
2965         Reverted changeset:
2966
2967         "[DFG][FTL] Profile array vector length for array allocation"
2968         https://bugs.webkit.org/show_bug.cgi?id=177051
2969         http://trac.webkit.org/changeset/222380
2970
2971 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2972
2973         [DFG][FTL] Profile array vector length for array allocation
2974         https://bugs.webkit.org/show_bug.cgi?id=177051
2975
2976         Reviewed by Saam Barati.
2977
2978         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2979         (target):
2980
2981 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2982
2983         Skip new hanging test262 tests.
2984         https://bugs.webkit.org/show_bug.cgi?id=177326
2985
2986         Unreviewed test gardening.
2987
2988         * test262.yaml:
2989
2990 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2991
2992         Mark 6 test262 tests as passing.
2993         https://bugs.webkit.org/show_bug.cgi?id=177307
2994
2995         Unreviewed test gardening.
2996
2997         * test262.yaml:
2998
2999 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
3000
3001         Unreviewed follow-up to r222311.
3002
3003         * test262/harness/sta.js:
3004         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
3005         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
3006         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
3007         * test262/test/built-ins/Array/from/elements-added-after.js:
3008         * test262/test/built-ins/Array/from/elements-deleted-after.js:
3009         * test262/test/built-ins/Array/from/elements-updated-after.js:
3010         * test262/test/built-ins/Array/from/from-array.js:
3011         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
3012         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
3013         * test262/test/built-ins/Array/from/source-array-boundary.js:
3014         * test262/test/built-ins/Array/from/source-object-constructor.js:
3015         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
3016         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
3017         * test262/test/built-ins/Array/from/source-object-length.js:
3018         * test262/test/built-ins/Array/from/source-object-missing.js:
3019         * test262/test/built-ins/Array/from/source-object-without.js:
3020         * test262/test/built-ins/Array/from/this-null.js:
3021         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
3022         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
3023         * test262/test/language/literals/numeric/7.8.3-1gs.js:
3024         * test262/test/language/literals/numeric/7.8.3-2gs.js:
3025         * test262/test/language/literals/numeric/7.8.3-3gs.js:
3026         * test262/test/language/literals/regexp/7.8.5-1gs.js:
3027         * test262/test/language/literals/string/7.8.4-1gs.js:
3028         Fix some files that I failed to update when I applied my patch.
3029
3030 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
3031
3032         Update test262 tests
3033         https://bugs.webkit.org/show_bug.cgi?id=177220
3034
3035         Reviewed by Saam Barati and Yusuke Suzuki.
3036
3037         * test262.yaml:
3038         * test262/test262-Revision.txt:
3039         New rebaselined expectations for all tests.
3040
3041         * test262/*:
3042         Updated.
3043
3044 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
3045
3046         [DFG] Remove ToThis more aggressively
3047         https://bugs.webkit.org/show_bug.cgi?id=177056
3048
3049         Reviewed by Saam Barati.
3050
3051         * stress/generator-with-this-strict.js: Added.
3052         (shouldBe):
3053         (generator):
3054         (target):
3055         * stress/generator-with-this.js: Added.
3056         (shouldBe):
3057         (generator):
3058         (target):
3059
3060 2017-09-17  Michael Saboff  <msaboff@apple.com>
3061
3062         https://bugs.webkit.org/show_bug.cgi?id=177038
3063         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
3064
3065         Reviewed by JF Bastien.
3066
3067         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
3068         as it dies using too much memory.
3069
3070 2017-09-15  Saam Barati  <sbarati@apple.com>
3071
3072         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
3073         https://bugs.webkit.org/show_bug.cgi?id=176981
3074
3075         Reviewed by Yusuke Suzuki.
3076
3077         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
3078         (assert):
3079         (verify):
3080         (func):
3081         (const.bar.createBuiltin):
3082
3083 2017-09-14  Saam Barati  <sbarati@apple.com>
3084
3085         It should be valid to exit before each set when doing arity fixup when inlining
3086         https://bugs.webkit.org/show_bug.cgi?id=176948
3087
3088         Reviewed by Keith Miller.
3089
3090         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
3091         (baz):
3092         (bar):
3093         (foo):
3094
3095 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
3096
3097         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
3098         https://bugs.webkit.org/show_bug.cgi?id=176867
3099
3100         Reviewed by Sam Weinig.
3101
3102         * microbenchmarks/object-get-own-property-symbols.js: Added.
3103         (test):
3104
3105 2017-09-13  Mark Lam  <mark.lam@apple.com>
3106
3107         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
3108         https://bugs.webkit.org/show_bug.cgi?id=176888
3109         <rdar://problem/34381832>
3110
3111         Not reviewed.
3112
3113         * stress/op_mod-ConstVar.js:
3114         * stress/op_mod-VarConst.js:
3115         * stress/op_mod-VarVar.js:
3116
3117 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
3118
3119         Skip 3 op_mod tests on Debug JSC bots.
3120         https://bugs.webkit.org/show_bug.cgi?id=176630
3121
3122         Unreviewed test gardening.
3123
3124         * stress/op_mod-ConstVar.js:
3125         * stress/op_mod-VarConst.js:
3126         * stress/op_mod-VarVar.js:
3127
3128 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3129
3130         [JSC] Fix Array allocation in Object.keys
3131         https://bugs.webkit.org/show_bug.cgi?id=176826
3132
3133         Reviewed by Saam Barati.
3134
3135         * stress/object-own-property-keys.js: Added.
3136         (shouldBe):
3137
3138 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3139
3140         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
3141         https://bugs.webkit.org/show_bug.cgi?id=176010
3142
3143         Reviewed by Filip Pizlo.
3144
3145         * microbenchmarks/weak-map-key.js: Added.
3146         (assert):
3147         (objectKey):
3148         (let.start.Date.now):
3149
3150 2017-09-12  Mark Lam  <mark.lam@apple.com>
3151
3152         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
3153         https://bugs.webkit.org/show_bug.cgi?id=176630
3154
3155         Reviewed by JF Bastien.
3156
3157         Debug builds are just slow, and these tests do a lot.  They pass when I run them
3158         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
3159         a speculative fix for the bots that are seeing these fail.
3160
3161         I also undid the skipping of the op_mod tests for debug builds.
3162
3163         * stress/op_div-ConstVar.js:
3164         * stress/op_div-VarConst.js:
3165         * stress/op_div-VarVar.js:
3166         * stress/op_mod-ConstVar.js:
3167         * stress/op_mod-VarConst.js:
3168         * stress/op_mod-VarVar.js:
3169
3170 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
3171
3172         Skip stress/value-to-boolean.js on Debug bots.
3173         https://bugs.webkit.org/show_bug.cgi?id=176787
3174
3175         Unreviewed test gardening.
3176
3177         * stress/value-to-boolean.js:
3178
3179 2017-09-11  Mark Lam  <mark.lam@apple.com>
3180
3181         Change test expectation for test262/test/language/statements/try/tco-catch.js
3182         https://bugs.webkit.org/show_bug.cgi?id=176749
3183
3184         Rubber stamped by Keith Miller.
3185
3186         It's been failing since at least r221821.  I'm changing the test expectation to
3187         fail to green the bots while I investigate some more.
3188
3189         * test262.yaml:
3190
3191 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
3192
3193         Unreviewed, rolling out r221854.
3194
3195         The test added with this change fails on 32-bit JSC bots.
3196
3197         Reverted changeset:
3198
3199         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
3200         https://bugs.webkit.org/show_bug.cgi?id=176010
3201         http://trac.webkit.org/changeset/221854
3202
3203 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3204
3205         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
3206         https://bugs.webkit.org/show_bug.cgi?id=176010
3207
3208         Reviewed by Filip Pizlo.
3209
3210         * microbenchmarks/weak-map-key.js: Added.
3211         (assert):
3212         (objectKey):
3213         (let.start.Date.now):
3214
3215 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
3216
3217         [JSC] Optimize Object.keys by using careful array allocation
3218         https://bugs.webkit.org/show_bug.cgi?id=176654
3219
3220         Reviewed by Darin Adler.
3221
3222         * microbenchmarks/object-keys.js: Added.
3223         (test):
3224
3225 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
3226
3227         Error should compute .stack and friends lazily
3228         https://bugs.webkit.org/show_bug.cgi?id=176645
3229
3230         Reviewed by Saam Barati.
3231
3232         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
3233         * microbenchmarks/new-error.js: Added.
3234         * microbenchmarks/throw.js: Added.
3235
3236 2017-09-09  Mark Lam  <mark.lam@apple.com>
3237
3238         [Re-landing] Use JIT probes for DFG OSR exit.
3239         https://bugs.webkit.org/show_bug.cgi?id=175144
3240         <rdar://problem/33437050>
3241
3242         Not reviewed.  Original patch reviewed by Saam Barati.
3243
3244         Disable these tests for debug builds because they run too slow with the new OSR exit.
3245
3246         * stress/op_mod-ConstVar.js:
3247         * stress/op_mod-VarConst.js:
3248         * stress/op_mod-VarVar.js:
3249
3250 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3251
3252         [DFG] NewArrayWithSize(size)'s size does not care negative zero
3253         https://bugs.webkit.org/show_bug.cgi?id=176300
3254
3255         Reviewed by Saam Barati.
3256
3257         * stress/new-array-with-size-div.js: Added.
3258         (shouldBe):
3259         (test):
3260         (i.i):
3261
3262 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3263
3264         [DFG] PutByVal with Array::Generic is too generic
3265         https://bugs.webkit.org/show_bug.cgi?id=176345
3266
3267         Reviewed by Filip Pizlo.
3268
3269         * stress/object-assign-symbols.js: Added.
3270         (shouldBe):
3271         (test):
3272         * stress/object-assign.js: Added.
3273         (shouldBe):
3274         (test):
3275         (i.shouldBe.JSON.stringify.test):
3276
3277 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3278
3279         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
3280         https://bugs.webkit.org/show_bug.cgi?id=176590
3281
3282         Reviewed by Saam Barati.
3283
3284         * microbenchmarks/object-iterate-symbols.js: Added.
3285         (test):
3286         * microbenchmarks/object-iterate.js: Added.
3287         (test):
3288         * stress/object-iterate-symbols.js: Added.
3289         (shouldBe):
3290         (test):
3291         * stress/object-iterate.js: Added.
3292         (shouldBe):
3293         (test):
3294
3295 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
3296
3297         [Win32] 10 JSC stress tests are failing.
3298         https://bugs.webkit.org/show_bug.cgi?id=176538
3299
3300         Reviewed by Mark Lam.
3301
3302         Skip tests on Windows to make the bots green.
3303
3304         * ChakraCore.yaml:
3305         * stress/date-relaxed.js:
3306
3307 2017-09-06  Mark Lam  <mark.lam@apple.com>
3308
3309         constructGenericTypedArrayViewWithArguments() is missing an exception check.
3310         https://bugs.webkit.org/show_bug.cgi?id=176485
3311         <rdar://problem/33898874>
3312
3313         Reviewed by Keith Miller.
3314
3315         * stress/regress-176485.js: Added.
3316
3317 2017-09-05  Saam Barati  <sbarati@apple.com>
3318
3319         isNotCellSpeculation is wrong with respect to SpecEmpty
3320         https://bugs.webkit.org/show_bug.cgi?id=176429
3321
3322         Reviewed by Michael Saboff.
3323
3324         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
3325         (Foo):
3326
3327 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
3328
3329         test262: Completion values for control flow do not match the spec
3330         https://bugs.webkit.org/show_bug.cgi?id=171265
3331
3332         Reviewed by Saam Barati.
3333
3334         * stress/completion-value.js:
3335         Condensed test for completion values in top level statements.
3336
3337         * stress/super-get-by-id.js:
3338         ClassDeclaration when evaled no longer produce values. Convert
3339         these to ClassExpressions so they produce the class value.
3340         
3341         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3342         This is a progression for currect spec behavior.
3343
3344         * mozilla/mozilla-tests.yaml:
3345         This test is now outdated, so mark it as failing for that reason.
3346
3347         * test262.yaml:
3348         Passing all "cptn" completion value tests.
3349
3350 2017-09-04  Saam Barati  <sbarati@apple.com>
3351
3352         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
3353         https://bugs.webkit.org/show_bug.cgi?id=176317
3354
3355         Reviewed by Keith Miller.
3356
3357         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
3358         (Foo):
3359
3360 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3361
3362         [DFG][FTL] Efficiently execute number#toString()
3363         https://bugs.webkit.org/show_bug.cgi?id=170007
3364
3365         Reviewed by Keith Miller.
3366
3367         * microbenchmarks/number-to-string-strength-reduction.js: Added.
3368         (test):
3369         * microbenchmarks/number-to-string-with-radix-10.js: Added.
3370         (test):
3371         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
3372         (test):
3373         * microbenchmarks/number-to-string-with-radix.js: Added.
3374         (test):
3375         * stress/number-to-string-strength-reduction.js: Added.
3376         (shouldBe):
3377         (test):
3378         * stress/number-to-string-with-radix-10.js: Added.
3379         (shouldBe):
3380         (test):
3381         * stress/number-to-string-with-radix-cse.js: Added.
3382         (shouldBe):
3383         (test):
3384         * stress/number-to-string-with-radix-invalid.js: Added.
3385         (shouldThrow):
3386         * stress/number-to-string-with-radix-watchpoint.js: Added.
3387         (shouldBe):
3388         (test):
3389         (i.i.1e3.Number.prototype.toString):
3390         * stress/number-to-string-with-radix.js: Added.
3391         (shouldBe):
3392         (test):
3393
3394 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3395
3396         [DFG] Relax arity requirement
3397         https://bugs.webkit.org/show_bug.cgi?id=175523
3398
3399         Reviewed by Saam Barati.
3400
3401         * stress/arity-mismatch-arguments-length.js: Added.
3402         (shouldBe):
3403         (test1):
3404         (test):
3405         * stress/arity-mismatch-get-argument.js: Added.
3406         (shouldBe):
3407         (builtin.createBuiltin):
3408         (test):
3409         * stress/arity-mismatch-inlining-extra-slots.js: Added.
3410         (shouldBe):
3411         (inlineTarget):
3412         (test):
3413         * stress/arity-mismatch-inlining.js: Added.
3414         (shouldBe):
3415         (inlineTarget):
3416         (test):
3417         * stress/arity-mismatch-rest.js: Added.
3418         (shouldBe):
3419         (test2):
3420         (test1):
3421         (test):
3422
3423 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3424
3425         [JSC] Fix "name" and "length" of Proxy revoke function
3426         https://bugs.webkit.org/show_bug.cgi?id=176155
3427
3428         Reviewed by Mark Lam.
3429
3430         * test262.yaml:
3431
3432 2017-08-31  Saam Barati  <sbarati@apple.com>
3433
3434         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
3435         https://bugs.webkit.org/show_bug.cgi?id=176206
3436
3437         Reviewed by Keith Miller.
3438
3439         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
3440         (a):
3441         (b):
3442         (foo):
3443
3444 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
3445
3446         Skip two slow JSC tests after r221422.
3447
3448         Unreviewed test gardening.
3449
3450         * stress/regexp-prototype-match-on-too-long-rope.js:
3451         * stress/regexp-prototype-test-on-too-long-rope.js:
3452
3453 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
3454
3455         Unreviewed, skipping slow tests.
3456         
3457         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
3458         work differently now.
3459
3460         * stress/regexp-prototype-exec-on-too-long-rope.js:
3461         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
3462
3463 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3464
3465         [JSC] Use reifying system for "name" property of builtin JSFunction
3466         https://bugs.webkit.org/show_bug.cgi?id=175260
3467
3468         Reviewed by Saam Barati.
3469
3470         * stress/accessors-get-set-prefix.js:
3471         * stress/builtin-function-name.js: Added.
3472         (shouldBe):
3473         (shouldThrow):
3474         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3475         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3476         * stress/private-name-as-anonymous-builtin.js: Added.
3477         (shouldBe):
3478         (NotPromise):
3479
3480 2017-08-30  Saam Barati  <sbarati@apple.com>
3481
3482         Unreviewed. Make test stop printing.
3483
3484         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
3485
3486 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
3487
3488         Unreviewed, rolling out r221327.
3489
3490         This change caused test262 failures.
3491
3492         Reverted changeset:
3493
3494         "[JSC] Use reifying system for "name" property of builtin
3495         JSFunction"
3496         https://bugs.webkit.org/show_bug.cgi?id=175260
3497         http://trac.webkit.org/changeset/221327
3498
3499 2017-08-30  Saam Barati  <sbarati@apple.com>
3500
3501         semicolon is being interpreted as an = in the LiteralParser
3502         https://bugs.webkit.org/show_bug.cgi?id=176114
3503
3504         Reviewed by Oliver Hunt.
3505
3506         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
3507         * stress/resources/literal-parser-test-case.js: Added.
3508
3509 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3510
3511         [ESNext] Async iteration - Implement async iteration statement: for-await-of
3512         https://bugs.webkit.org/show_bug.cgi?id=166698
3513
3514         Reviewed by Yusuke Suzuki.
3515
3516         * stress/async-iteration-for-await-of-syntax.js: Added.
3517         (assert):
3518         (checkSyntax):
3519         (checkSyntaxError):
3520         (checkSimpleAsyncGeneratorSloppyMode):
3521         (checkSimpleAsyncGeneratorStrictMode):
3522         (checkNestedAsyncGenerators):
3523         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3524         * stress/async-iteration-for-await-of.js: Added.
3525         (assert):
3526         (async.foo):
3527         (async.boo):
3528         (const.boo.async):
3529
3530 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
3531
3532         [JSC] Use reifying system for "name" property of builtin JSFunction
3533         https://bugs.webkit.org/show_bug.cgi?id=175260
3534
3535         Reviewed by Saam Barati.
3536
3537         * stress/accessors-get-set-prefix.js:
3538         * stress/builtin-function-name.js: Added.
3539         (shouldBe):
3540         (shouldThrow):
3541         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3542         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3543
3544 2017-08-25  Saam Barati  <sbarati@apple.com>
3545
3546         Support compiling catch in the DFG
3547         https://bugs.webkit.org/show_bug.cgi?id=174590
3548         <rdar://problem/34047845>
3549
3550         Reviewed by Filip Pizlo.
3551
3552         * microbenchmarks/delta-blue-try-catch.js: Added.
3553         (exception):
3554         (value):
3555         (OrderedCollection):
3556         (OrderedCollection.prototype.add):
3557         (OrderedCollection.prototype.at):
3558         (OrderedCollection.prototype.size):
3559         (OrderedCollection.prototype.removeFirst):
3560         (OrderedCollection.prototype.remove):
3561         (Strength):
3562         (Strength.stronger):
3563         (Strength.weaker):
3564         (Strength.weakestOf):
3565         (Strength.strongest):
3566         (Strength.prototype.nextWeaker):
3567         (Constraint):
3568         (Constraint.prototype.addConstraint):
3569         (Constraint.prototype.satisfy):
3570         (Constraint.prototype.destroyConstraint):
3571         (Constraint.prototype.isInput):
3572         (UnaryConstraint):
3573         (UnaryConstraint.prototype.addToGraph):
3574         (UnaryConstraint.prototype.chooseMethod):
3575         (UnaryConstraint.prototype.isSatisfied):
3576         (UnaryConstraint.prototype.markInputs):
3577         (UnaryConstraint.prototype.output):
3578         (UnaryConstraint.prototype.recalculate):
3579         (UnaryConstraint.prototype.markUnsatisfied):
3580         (UnaryConstraint.prototype.inputsKnown):
3581         (UnaryConstraint.prototype.removeFromGraph):
3582         (StayConstraint):
3583         (StayConstraint.prototype.execute):
3584         (EditConstraint.prototype.isInput):
3585         (EditConstraint.prototype.execute):
3586         (BinaryConstraint):
3587         (BinaryConstraint.prototype.chooseMethod):
3588         (BinaryConstraint.prototype.addToGraph):
3589         (BinaryConstraint.prototype.isSatisfied):
3590         (BinaryConstraint.prototype.markInputs):
3591         (BinaryConstraint.prototype.input):
3592         (BinaryConstraint.prototype.output):
3593         (BinaryConstraint.prototype.recalculate):
3594         (BinaryConstraint.prototype.markUnsatisfied):
3595         (BinaryConstraint.prototype.inputsKnown):
3596         (BinaryConstraint.prototype.removeFromGraph):
3597         (ScaleConstraint):
3598         (ScaleConstraint.prototype.addToGraph):
3599         (ScaleConstraint.prototype.removeFromGraph):
3600         (ScaleConstraint.prototype.markInputs):
3601         (ScaleConstraint.prototype.execute):
3602         (ScaleConstraint.prototype.recalculate):
3603         (EqualityConstraint):
3604         (EqualityConstraint.prototype.execute):
3605         (Variable):
3606         (Variable.prototype.addConstraint):
3607         (Variable.prototype.removeConstraint):
3608         (Planner):
3609         (Planner.prototype.incrementalAdd):
3610         (Planner.prototype.incrementalRemove):
3611         (Planner.prototype.newMark):
3612         (Planner.prototype.makePlan):
3613         (Planner.prototype.extractPlanFromConstraints):
3614         (Planner.prototype.addPropagate):
3615         (Planner.prototype.removePropagateFrom):
3616         (Planner.prototype.addConstraintsConsumingTo):
3617         (Plan):
3618         (Plan.prototype.addConstraint):
3619         (Plan.prototype.size):
3620         (Plan.prototype.constraintAt):
3621         (Plan.prototype.execute):
3622         (chainTest):
3623         (projectionTest):
3624         (change):
3625         (deltaBlue):
3626         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3627         (assert):
3628         (Numbers):
3629         (Numbers.prototype.next):
3630         (return.Transpose):
3631         (return.Transpose.prototype.next):
3632         (transpose):
3633         (verifyEven):
3634         (verifyString):
3635         (foo):
3636         (runIterators):
3637         * microbenchmarks/try-catch-word-count.js: Added.
3638         (let.assert):
3639         (EOF):
3640         (let.texts):
3641         (let.o.apply):
3642         (foo):
3643         (bar):
3644         (f):
3645         (run):
3646         (test1):
3647         (test2):
3648         (test3):
3649         (fn):
3650         (A):
3651         (B):
3652         (A.prototype.getValue):
3653         (B.prototype.getParentValue):
3654         (strlen):
3655         (sum.0):
3656         (test):
3657         (result.test.o):
3658         (set add.set add):
3659         (set forEach):
3660         (stringHash):
3661         (set if):
3662         (testFunction):
3663         (set delete.set has.set add):
3664         * stress/catch-set-argument-speculation-failure.js: Added.
3665         (o):
3666         (e):
3667         (e2):
3668         (escape):
3669         (baz):
3670         (noInline.run):
3671         (noInline):
3672         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3673         (foo):
3674         (e):
3675         (baz):
3676         (bar):
3677
3678 2017-08-24  Commit Queue  <commit-queue@webkit.org>
3679
3680         Unreviewed, rolling out r221119, r221124, and r221143.
3681         https://bugs.webkit.org/show_bug.cgi?id=175973
3682
3683         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3684         on #webkit).
3685
3686         Reverted changesets:
3687
3688         "Support compiling catch in the DFG"
3689         https://bugs.webkit.org/show_bug.cgi?id=174590
3690         http://trac.webkit.org/changeset/221119
3691
3692         "Unreviewed, build fix in GTK port"
3693         https://bugs.webkit.org/show_bug.cgi?id=174590
3694         http://trac.webkit.org/changeset/221124
3695
3696         "DFG::JITCode::osrEntry should get sorted since we perform a
3697         binary search on it"
3698         https://bugs.webkit.org/show_bug.cgi?id=175893
3699         http://trac.webkit.org/changeset/221143
3700
3701 2017-08-24  Michael Saboff  <msaboff@apple.com>
3702
3703         Add support for RegExp "dotAll" flag
3704         https://bugs.webkit.org/show_bug.cgi?id=175924
3705
3706         Reviewed by Keith Miller.
3707
3708         Updated tests for new dotAll ('s' flag) changes.
3709
3710         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3711         * stress/static-getter-in-names.js:
3712
3713 2017-08-24  Mark Lam  <mark.lam@apple.com>
3714
3715         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3716         https://bugs.webkit.org/show_bug.cgi?id=175940
3717         <rdar://problem/29003921>
3718
3719         Reviewed by Saam Barati.
3720
3721         * stress/regress-164081.js: Added.
3722         (shouldEqual):
3723         (testcase):
3724
3725 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3726
3727         Skip flaky JSC test stress/test-finally.js.
3728         https://bugs.webkit.org/show_bug.cgi?id=160283
3729
3730         Unreviewed test gardening.
3731
3732         * stress/test-finally.js: