cf603ef9b171b4d2c7498c1b79088224e9aaefa1
[WebKit-https.git] / JSTests / ChangeLog
1 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
2
3         Green the cloop bot by raising this threshold.
4
5         * mozilla/js1_5/Array/regress-101964.js:
6
7 2016-12-08  JF Bastien  <jfbastien@apple.com>
8
9         WebAssembly JS API: wire up Instance imports
10         https://bugs.webkit.org/show_bug.cgi?id=165118
11
12         Reviewed by Saam Barati.
13
14         * wasm/js-api/test_Instance.js: add the test, disabled for now
15
16 2016-12-07  Keith Miller  <keith_miller@apple.com>
17
18         Add more missing trivial wasm ops.
19         https://bugs.webkit.org/show_bug.cgi?id=165564
20
21         Add tests for drop and tee_local.
22
23         Reviewed by Geoffrey Garen.
24
25         * wasm/function-tests/drop.js: Added.
26         * wasm/function-tests/nop.js: Added.
27         * wasm/function-tests/tee-local.js: Added.
28
29 2016-12-06  Keith Miller  <keith_miller@apple.com>
30
31         Add support for truncation operators
32         https://bugs.webkit.org/show_bug.cgi?id=165519
33
34         Reviewed by Geoffrey Garen.
35
36         * wasm/function-tests/i32-trunc-s-f32.js: Added.
37         * wasm/function-tests/i32-trunc-s-f64.js: Added.
38         * wasm/function-tests/i32-trunc-u-f32.js: Added.
39         * wasm/function-tests/i32-trunc-u-f64.js: Added.
40         * wasm/function-tests/i64-trunc-s-f32.js: Added.
41         * wasm/function-tests/i64-trunc-s-f64.js: Added.
42         * wasm/function-tests/i64-trunc-u-f32.js: Added.
43         * wasm/function-tests/i64-trunc-u-f64.js: Added.
44
45 2016-12-06  Mark Lam  <mark.lam@apple.com>
46
47         Introduce the concept of Immutable Prototype Exotic Objects to comply with the spec.
48         https://bugs.webkit.org/show_bug.cgi?id=165227
49         <rdar://problem/29442665>
50
51         Reviewed by Saam Barati.
52
53         * stress/get-from-scope-dynamic-onto-proxy.js:
54         - Updated error message.
55
56         * stress/proxy-dont-infinite-loop.js: Removed.
57         * stress/proxy-json-path.js: Removed.
58         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Removed.
59         - Removed these tests because the issue they are testing relies on being able to
60           set Object.prototype.__proto__ to something else (which is now not possible).
61
62 2016-12-05  Caitlin Potter  <caitp@igalia.com>
63
64         [JSC] report unexpected token when "async" is followed by identifier 
65         https://bugs.webkit.org/show_bug.cgi?id=165091
66
67         Reviewed by Mark Lam.
68
69         * stress/bug-165091.js:
70
71 2016-12-05  Keith Miller  <keith_miller@apple.com>
72
73         Add Wasm i64 to i32 conversion.
74         https://bugs.webkit.org/show_bug.cgi?id=165378
75
76         Reviewed by Filip Pizlo.
77
78         It turns out the wrap operation is just B3's Trunc.
79
80         * wasm/wasm.json:
81
82 2016-12-04  Keith Miller  <keith_miller@apple.com>
83
84         Add support for Wasm ctz and popcnt
85         https://bugs.webkit.org/show_bug.cgi?id=165369
86
87         Reviewed by Saam Barati.
88
89         * wasm/function-tests/ctz.js: Added.
90         * wasm/function-tests/popcnt.js: Added.
91
92 2016-12-03  JF Bastien  <jfbastien@apple.com>
93
94         WebAssembly: update binary format to 0xD version
95         https://bugs.webkit.org/show_bug.cgi?id=165345
96
97         Reviewed by Keith Miller.
98
99         As described in the following PR: https://github.com/WebAssembly/design/pull/836
100         Originally committed in r209175, reverted in r209242, and fixed in r209284.
101
102         * wasm/Builder.js:
103         (const._normalizeFunctionSignature):
104         * wasm/Builder_WebAssemblyBinary.js:
105         (const.emitters.Type):
106         (const.emitters.Code):
107         * wasm/LowLevelBinary.js:
108         (export.default.LowLevelBinary.prototype.block_type):
109         (export.default.LowLevelBinary.prototype.inline_signature_type): Deleted.
110         * wasm/WASM.js:
111         * wasm/js-api/test_basic_api.js:
112         * wasm/self-test/test_BuilderWebAssembly.js:
113         (EmptyModule):
114         (CustomSection):
115         * wasm/self-test/test_WASM.js:
116         * wasm/wasm.json:
117
118 2016-12-02  Keith Miller  <keith_miller@apple.com>
119
120         Add Wasm copysign
121         https://bugs.webkit.org/show_bug.cgi?id=165355
122
123         Reviewed by Filip Pizlo.
124
125         * wasm/function-tests/copysign.js: Added.
126
127 2016-12-03  Commit Queue  <commit-queue@webkit.org>
128
129         Unreviewed, rolling out r209298.
130         https://bugs.webkit.org/show_bug.cgi?id=165359
131
132         broke the build (Requested by smfr on #webkit).
133
134         Reverted changeset:
135
136         "Add Wasm copysign"
137         https://bugs.webkit.org/show_bug.cgi?id=165355
138         http://trac.webkit.org/changeset/209298
139
140 2016-12-02  Keith Miller  <keith_miller@apple.com>
141
142         Add Wasm copysign
143         https://bugs.webkit.org/show_bug.cgi?id=165355
144
145         Reviewed by Filip Pizlo.
146
147         * wasm/function-tests/copysign.js: Added.
148
149 2016-12-02  Keith Miller  <keith_miller@apple.com>
150
151         Unreviewed, fix git having a breakdown over trying to reland a rollout.
152
153 2016-12-02  Keith Miller  <keith_miller@apple.com>
154
155         Add Wasm floating point nearest and trunc
156         https://bugs.webkit.org/show_bug.cgi?id=165339
157
158         Reviewed by Saam Barati.
159
160         * wasm/function-tests/nearest.js: Added.
161         * wasm/function-tests/trunc.js: Added.
162
163 2016-12-02  Caitlin Potter  <caitp@igalia.com>
164
165 [JSC] add additional bit to JSTokenType bitfield
166         https://bugs.webkit.org/show_bug.cgi?id=165091
167
168         Reviewed by Geoffrey Garen.
169
170         * stress/bug-165091.js: Added.
171         (shouldThrowSyntaxError):
172
173 2016-12-02  Commit Queue  <commit-queue@webkit.org>
174
175         Unreviewed, rolling out r209275 and r209276.
176         https://bugs.webkit.org/show_bug.cgi?id=165348
177
178         "broke the arm build" (Requested by keith_miller on #webkit).
179
180         Reverted changesets:
181
182         "Add Wasm floating point nearest and trunc"
183         https://bugs.webkit.org/show_bug.cgi?id=165339
184         http://trac.webkit.org/changeset/209275
185
186         "Unreviewed, forgot to change instruction after renaming."
187         http://trac.webkit.org/changeset/209276
188
189 2016-12-02  Keith Miller  <keith_miller@apple.com>
190
191         Add Wasm floating point nearest and trunc
192         https://bugs.webkit.org/show_bug.cgi?id=165339
193
194         Reviewed by Filip Pizlo.
195
196         * wasm/function-tests/nearest.js: Added.
197         * wasm/function-tests/trunc.js: Added.
198
199 2016-12-02  JF Bastien  <jfbastien@apple.com>
200
201         WebAssembly: revert patch causing odd breakage
202         https://bugs.webkit.org/show_bug.cgi?id=165308
203
204         Unreviewed.
205
206         Bug #164724 seems to cause build issues which I haven't tracked down yet. WasmOps.h can't be found:
207         ./Source/JavaScriptCore/wasm/WasmFormat.h:34:10: fatal error: 'WasmOps.h' file not found
208
209         It's weird since the file is auto-generated and has been for a while. #164724 merely includes it in WasmFormat.h.
210
211         * wasm/Builder.js:
212         (const._normalizeFunctionSignature):
213         * wasm/Builder_WebAssemblyBinary.js:
214         (const.emitters.Type):
215         (const.emitters.Code):
216         * wasm/LowLevelBinary.js:
217         (export.default.LowLevelBinary.prototype.inline_signature_type):
218         (export.default.LowLevelBinary.prototype.block_type): Deleted.
219         * wasm/WASM.js:
220         * wasm/js-api/test_basic_api.js:
221         * wasm/self-test/test_BuilderWebAssembly.js:
222         (EmptyModule):
223         (CustomSection):
224         * wasm/self-test/test_WASM.js:
225         * wasm/wasm.json:
226
227 2016-12-01  Ryan Haddad  <ryanhaddad@apple.com>
228
229         Skip flaky test ChakraCore/test/fieldopts/objtypespec-newobj-invalidation.1.js
230         https://bugs.webkit.org/show_bug.cgi?id=162567
231
232         Reviewed by Saam Barati.
233
234         * ChakraCore.yaml:
235
236 2016-12-01  Keith Miller  <keith_miller@apple.com>
237
238         Add wasm int to floating point opcodes
239         https://bugs.webkit.org/show_bug.cgi?id=165252
240
241         Reviewed by Geoffrey Garen.
242
243         Add tests for Wasm integral to floating point conversion opcodes.
244
245         * wasm/function-tests/int-to-floating-point.js: Added.
246         * wasm/wasm.json:
247
248 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
249
250         Land a test case for <rdar://problem/27889416>
251         https://bugs.webkit.org/show_bug.cgi?id=165272
252
253         Reviewed by Saam Barati.
254
255         * stress/marked-argument-buffer.js: Added.
256         (allocate):
257         (test.o.toString):
258         (test):
259
260 2016-11-29  Per Arne Vollan  <pvollan@apple.com>
261
262         [Win] Skip failing JSC tests.
263         https://bugs.webkit.org/show_bug.cgi?id=165140
264
265         Reviewed by Mark Lam.
266
267         * ChakraCore.yaml:
268         * microbenchmarks/tan.js:
269
270 2016-11-30  JF Bastien  <jfbastien@apple.com>
271
272         WebAssembly builder: don't throw when checker not implemented
273         https://bugs.webkit.org/show_bug.cgi?id=165219
274
275         Reviewed by Mark Lam.
276
277         We should perform whichever checks we've implemented, and assume the rest are OK until bug #163421 is fixed.
278
279         * wasm/Builder.js:
280         * wasm/README.md:
281         * wasm/function-tests/add-12.js:
282         * wasm/function-tests/br-if-loop-less-than.js:
283         * wasm/function-tests/brTableAsIf.js:
284         * wasm/function-tests/brTableManyValues.js:
285         * wasm/function-tests/brTableWithLoop.js:
286         * wasm/function-tests/dumb-eq-if-then-else.js:
287         * wasm/function-tests/dumb-less-than-fallthrough.js:
288         * wasm/function-tests/dumb-less-than-ite.js:
289         * wasm/function-tests/eqz.js:
290         * wasm/function-tests/factorial.js:
291         * wasm/function-tests/float-sub.js:
292         * wasm/function-tests/i32-load.js:
293         * wasm/function-tests/i32-load8-s.js:
294         * wasm/function-tests/if-then-else-fallthrough.js:
295         * wasm/function-tests/if-then-fallthrough.js:
296         * wasm/function-tests/loop-mult.js:
297         * wasm/function-tests/loop-sum.js:
298         * wasm/function-tests/max.js:
299         * wasm/function-tests/min.js:
300         * wasm/function-tests/ret5.js:
301         * wasm/function-tests/select.js:
302         * wasm/self-test/test_BuilderJSON.js:
303
304 2016-11-29  JF Bastien  <jfbastien@apple.com>
305
306         WebAssembly JS API: improve Instance
307         https://bugs.webkit.org/show_bug.cgi?id=164757
308
309         Reviewed by Keith Miller.
310
311         An Instance's `exports` property wasn't populated with exports.
312
313         A follow-up patch will do imports.
314
315         A few things of note:
316
317          - LowLevelBinary: support 3-byte integers.
318          - LowLevelBinary: support proper UTF-8 2003 code points (instead of UTF-16).
319
320         * wasm/Builder.js:
321         * wasm/Builder_WebAssemblyBinary.js: wire up exports, stub other things out some more
322         (const.emitters.Export):
323         * wasm/LowLevelBinary.js:
324         (export.default.LowLevelBinary.prototype.uint24): add, used for UTF-8
325         (export.default.LowLevelBinary.prototype.string): support UTF-8
326         (export.default.LowLevelBinary.prototype.getUint24): add, used for UTF-8
327         (export.default.LowLevelBinary.prototype.getVaruint1): was missing
328         (export.default.LowLevelBinary.prototype.getString): support UTF-8
329         (export.default.LowLevelBinary):
330         * wasm/js-api/test_Instance.js: instance.exports.answer() // <-- this is where the magic of this entire patch is
331         (ExportedAnswerI32):
332         * wasm/js-api/test_basic_api.js: punt test to later
333         (const.c.in.constructorProperties.switch):
334         * wasm/self-test/test_BuilderWebAssembly.js: UTF-8
335         (CustomSection):
336         * wasm/self-test/test_LowLevelBinary_string.js: UTF-8 now works
337         * wasm/self-test/test_LowLevelBinary_uint16.js: was missing one value
338         * wasm/self-test/test_LowLevelBinary_uint24.js: Copied from JSTests/wasm/self-test/test_LowLevelBinary_uint8.js.
339         * wasm/self-test/test_LowLevelBinary_uint8.js: was missing one value
340         * wasm/self-test/test_LowLevelBinary_varuint1.js: Added.
341         * wasm/utilities.js: this `dump` thing was useful
342         (const._dump):
343
344 2016-11-29  Saam Barati  <sbarati@apple.com>
345
346         We should be able optimize the pattern where we spread a function's rest parameter to another call
347         https://bugs.webkit.org/show_bug.cgi?id=163865
348
349         Reviewed by Filip Pizlo.
350
351         * microbenchmarks/default-derived-constructor.js: Added.
352         (createClassHierarchy.let.currentClass):
353         (createClassHierarchy):
354         * stress/call-varargs-spread.js: Added.
355         (assert):
356         (bar):
357         (foo):
358         * stress/load-varargs-on-new-array-with-spread-convert-to-static-loads.js: Added.
359         (assert):
360         (baz):
361         (bar):
362         (foo):
363         * stress/new-array-with-spread-with-normal-spread-and-phantom-spread.js: Added.
364         (assert):
365         (foo):
366         (escape):
367         (bar):
368         * stress/phantom-new-array-with-spread-osr-exit.js: Added.
369         (assert):
370         (baz):
371         (bar):
372         (effects):
373         (foo):
374         * stress/phantom-spread-forward-varargs.js: Added.
375         (assert):
376         (test1.bar):
377         (test1.foo):
378         (test1):
379         (test2.bar):
380         (test2.foo):
381         (test3.baz):
382         (test3.bar):
383         (test3.foo):
384         (test4.baz):
385         (test4.bar):
386         (test4.foo):
387         (test5.baz):
388         (test5.bar):
389         (test5.foo):
390         * stress/phantom-spread-osr-exit.js: Added.
391         (assert):
392         (baz):
393         (bar):
394         (effects):
395         (foo):
396         * stress/spread-call-convert-to-static-call.js: Added.
397         (assert):
398         (baz):
399         (bar):
400         (foo):
401         * stress/spread-forward-call-varargs-stack-overflow.js: Added.
402         (assert):
403         (identity):
404         (bar):
405         (foo):
406         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol-2.js: Added.
407         (assert):
408         (baz.Array.prototype.Symbol.iterator):
409         (baz):
410         (bar):
411         (foo):
412         (test):
413         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol.js: Added.
414         (assert):
415         (baz.Array.prototype.Symbol.iterator):
416         (baz):
417         (bar):
418         (foo):
419         * stress/spread-forward-varargs-stack-overflow.js: Added.
420         (assert):
421         (bar):
422         (foo):
423
424 2016-11-29  Caitlin Potter  <caitp@igalia.com>
425
426         [JSC] always wrap AwaitExpression operand in a new Promise
427         https://bugs.webkit.org/show_bug.cgi?id=165181
428
429         Reviewed by Yusuke Suzuki.
430
431         * stress/async-await-basic.js:
432         (async.awaitedPromisesAreWrapped):
433
434 2016-11-29  Keith Miller  <keith_miller@apple.com>
435
436         Add simple way to implement Wasm ops that require more than one B3 opcode
437         https://bugs.webkit.org/show_bug.cgi?id=165129
438
439         Reviewed by Geoffrey Garen.
440
441         * wasm/function-tests/eqz.js: Added.
442         * wasm/function-tests/max.js: Added.
443         * wasm/function-tests/min.js: Added.
444         * wasm/wasm.json:
445
446 2016-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
447
448         Crash in com.apple.JavaScriptCore: WTF::ThreadSpecific<WTF::WTFThreadData, + 142
449         https://bugs.webkit.org/show_bug.cgi?id=164898
450
451         Reviewed by Darin Adler.
452
453         * stress/tagged-template-registry-key-collect.js: Added.
454         (shouldBe):
455         (tag):
456         (i.eval):
457         * stress/tagged-template-registry-key.js: Added.
458         (shouldBe):
459         (tag):
460         (a):
461         (b):
462
463 2016-11-20  Caitlin Potter  <caitp@igalia.com>
464
465         [JSC] speed up parsing of async functions
466         https://bugs.webkit.org/show_bug.cgi?id=164808
467
468         Reviewed by Yusuke Suzuki.
469
470         Add tests for line terminator following "async" keyword in async
471         function syntax.
472
473         * stress/async-await-syntax.js:
474         (shouldBe):
475
476 2016-11-19  Mark Lam  <mark.lam@apple.com>
477
478         op_mod-* JSC tests needs a longer timeout too.
479         https://bugs.webkit.org/show_bug.cgi?id=164994
480
481         Reviewed by Yusuke Suzuki.
482
483         * stress/op_mod-ConstVar.js:
484         * stress/op_mod-VarConst.js:
485         * stress/op_mod-VarVar.js:
486
487 2016-11-19  Mark Lam  <mark.lam@apple.com>
488
489         Add --timeoutMultiplier option to allow some tests more time to run.
490         https://bugs.webkit.org/show_bug.cgi?id=164951
491
492         Reviewed by Yusuke Suzuki.
493
494         Extended the timeout for these tests by 50% more because they run quite slow on
495         low-end machines.
496
497         * stress/op_div-ConstVar.js:
498         * stress/op_div-VarConst.js:
499         * stress/op_div-VarVar.js:
500
501 2016-11-18  Yusuke Suzuki  <utatane.tea@gmail.com>
502
503         REGRESSION(r208867): JSC test failure: ChakraCore.yaml/ChakraCore/test/strict/05.arguments_sm.js.default
504         https://bugs.webkit.org/show_bug.cgi?id=164929
505
506         Reviewed by Mark Lam.
507
508         ES2017 drops arguments.caller and JavaScriptCore is updated to meet the spec.
509         This patch rebaselines the result of ChakraCore test for JSC.
510
511         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
512
513 2016-11-18  Joseph Pecoraro  <pecoraro@apple.com>
514
515         Web Inspector: Generator functions should have a displayable name when shown in stack traces
516         https://bugs.webkit.org/show_bug.cgi?id=164844
517         <rdar://problem/29300697>
518
519         Reviewed by Yusuke Suzuki.
520
521         * stress/generator-function-name.js:
522         Add another test now that we name the inner generator function
523         that we do not break the lexical resolution of names.
524
525 2016-11-17  Yusuke Suzuki  <utatane.tea@gmail.com>
526
527         [JSC] Drop arguments.caller
528         https://bugs.webkit.org/show_bug.cgi?id=164859
529
530         Reviewed by Saam Barati.
531
532         * stress/strict-mode-arguments-caller.js: Added.
533         (strictArguments):
534         (shouldBe):
535
536 2016-11-17  Keith Miller  <keith_miller@apple.com>
537
538         Add rotate to Wasm
539         https://bugs.webkit.org/show_bug.cgi?id=164871
540
541         Reviewed by Filip Pizlo.
542
543         * wasm/wasm.json:
544
545 2016-11-17  Keith Miller  <keith_miller@apple.com>
546
547         Add sqrt to Wasm
548         https://bugs.webkit.org/show_bug.cgi?id=164877
549
550         Reviewed by Mark Lam.
551
552         B3 already has a Sqrt opcode we just need to map Wasm to it.
553
554         * wasm/wasm.json:
555
556 2016-11-17  Saam Barati  <sbarati@apple.com>
557
558         Remove async/await compile time flag and enable tests
559         https://bugs.webkit.org/show_bug.cgi?id=164828
560         <rdar://problem/28639334>
561
562         Reviewed by Yusuke Suzuki.
563
564         * stress/async-arrow-functions-lexical-arguments-binding.js:
565         * stress/async-arrow-functions-lexical-new.target-binding.js:
566         * stress/async-arrow-functions-lexical-super-binding.js:
567         * stress/async-arrow-functions-lexical-this-binding.js:
568         * stress/async-await-basic.js:
569         * stress/async-await-long-loop.js:
570         * stress/async-await-module-reserved-word.js:
571         * stress/async-await-mozilla.js:
572         (mozSyntaxErrors):
573         * stress/async-await-reserved-word.js:
574         * stress/async-await-syntax.js:
575         * stress/async-await-throw-loop.js:
576         * stress/async-function-create-nobaseline.js:
577         * stress/async-function-create-optimized.js:
578         * stress/async-function-declaration-sinking-no-double-allocate.js:
579         * stress/async-function-declaration-sinking-osrexit.js:
580         * stress/async-function-declaration-sinking-put.js:
581         * stress/async-function-expression-sinking-no-double-allocate.js:
582         * stress/async-function-expression-sinking-osrexit.js:
583         * stress/async-function-expression-sinking-put.js:
584         * test262.yaml:
585
586 2016-11-15  Mark Lam  <mark.lam@apple.com>
587
588         Make JSC test functions more robust.
589         https://bugs.webkit.org/show_bug.cgi?id=164807
590
591         Reviewed by Keith Miller.
592
593         * stress/jsc-test-functions-should-be-more-robust.js: Added.
594
595 2016-11-15  Keith Miller  <keith_miller@apple.com>
596
597         B3 should support UDiv/UMod
598         https://bugs.webkit.org/show_bug.cgi?id=164811
599
600         Reviewed by Filip Pizlo.
601
602         Link new instructions to wasm.
603
604         * wasm/wasm.json:
605
606 2016-11-15  Saam Barati  <sbarati@apple.com>
607
608         Debug JSC test timeout: stress/has-own-property-name-cache-symbols-and-strings.js.ftl-no-cjit-small-pool
609         https://bugs.webkit.org/show_bug.cgi?id=163012
610
611         Unreviewed. This patch makes a test run for less time because it's timing out on the bots.
612
613         * stress/has-own-property-name-cache-symbols-and-strings.js:
614
615 2016-11-15  Mark Lam  <mark.lam@apple.com>
616
617         The jsc shell's setImpureGetterDelegate() should ensure that the set value is an ImpureGetter.
618         https://bugs.webkit.org/show_bug.cgi?id=164781
619         <rdar://problem/28418590>
620
621         Reviewed by Geoffrey Garen and Michael Saboff.
622
623         * stress/jsc-setImpureGetterDelegate-on-bad-type.js: Added.
624
625 2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
626
627         [DOMJIT] Allow using macro assembler scratches in FTL CheckDOM
628         https://bugs.webkit.org/show_bug.cgi?id=164727
629
630         Reviewed by Filip Pizlo.
631
632         * stress/check-dom-with-signature.js: Added.
633         (shouldBe):
634         (calling):
635         (i.array.forEach):
636
637 2016-11-14  Caitlin Potter  <caitp@igalia.com>
638
639         [JSC] do not reference AwaitExpression Promises in async function Promise chain
640         https://bugs.webkit.org/show_bug.cgi?id=164753
641
642         Reviewed by Yusuke Suzuki.
643
644         * asyncFunctionTests.yaml:
645         * stress/async-await-long-loop.js: Added.
646         (shouldBe):
647         (async.longLoop):
648         * stress/async-await-throw-loop.js: Added.
649         (shouldBe):
650         (async.thrower):
651         (async.throwLoop):
652
653 2016-11-14  Keith Miller  <keith_miller@apple.com>
654
655         Add Wasm select
656         https://bugs.webkit.org/show_bug.cgi?id=164743
657
658         Reviewed by Saam Barati.
659
660         * wasm/function-tests/select.js: Added.
661
662 2016-11-14  Caitlin Potter  <caitp@igalia.com>
663
664         [JSC] Handle new_async_func / new_async_func_exp in DFG / FTL
665         https://bugs.webkit.org/show_bug.cgi?id=164037
666
667         Reviewed by Yusuke Suzuki.
668
669         Add tests based on tests from https://trac.webkit.org/changeset/194216.
670
671         * asyncFunctionTests.yaml:
672         * stress/async-function-create-nobaseline.js: Added.
673         * stress/async-function-create-optimized.js: Added.
674         * stress/async-function-declaration-sinking-no-double-allocate.js: Added.
675         * stress/async-function-declaration-sinking-osrexit.js: Added.
676         * stress/async-function-declaration-sinking-put.js: Added.
677         * stress/async-function-expression-sinking-no-double-allocate.js: Added.
678         * stress/async-function-expression-sinking-osrexit.js: Added.
679         * stress/async-function-expression-sinking-put.js: Added.
680
681 2016-11-14  Mark Lam  <mark.lam@apple.com>
682
683         Some of JSStringView::SafeView methods are not idiomatically safe for JSString to StringView conversions.
684         https://bugs.webkit.org/show_bug.cgi?id=164701
685         <rdar://problem/27462104>
686
687         Reviewed by Darin Adler.
688
689         * stress/string-prototype-charCodeAt-on-too-long-rope.js: Added.
690
691 2016-11-14  Mark Lam  <mark.lam@apple.com>
692
693         RegExpObject::exec/match should handle errors gracefully.
694         https://bugs.webkit.org/show_bug.cgi?id=155145
695         <rdar://problem/27435934>
696
697         Reviewed by Keith Miller.
698
699         * stress/regexp-prototype-exec-on-too-long-rope.js: Added.
700         * stress/regexp-prototype-match-on-too-long-rope.js: Added.
701         * stress/regexp-prototype-test-on-too-long-rope.js: Added.
702
703 2016-11-14  Mark Lam  <mark.lam@apple.com>
704
705         Enhance run-jsc-stress-test script to allow optional test specific options to be added for all test run configurations.
706         https://bugs.webkit.org/show_bug.cgi?id=164695
707
708         Reviewed by Keith Miller.
709
710         Replace use of runMisc* test run configurations with equivalents.
711
712         * stress/licm-no-pre-header-nested.js:
713         * stress/licm-no-pre-header.js:
714         * stress/licm-pre-header-cannot-exit-nested.js:
715         * stress/licm-pre-header-cannot-exit.js:
716         * stress/make-dictionary-repatch.js:
717         * stress/retry-cache-later.js:
718         * stress/shadow-chicken-reading-from-scope-after-ftl-osr-exit-bytecode-liveness.js:
719         * stress/slow-path-generator-updating-current-node-dfg.js:
720         * stress/unshift-array-storage.js:
721
722 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
723
724         test262: DataView with explicit undefined byteLength should be the same as it not being present
725         https://bugs.webkit.org/show_bug.cgi?id=164453
726
727         Reviewed by Darin Adler.
728
729         * stress/dataview-construct.js: Added.
730         (assert):
731         (shouldThrow):
732         * test262.yaml:
733
734 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
735
736         test262: DataView get methods should allow for missing offset, set methods should allow for missing value
737         https://bugs.webkit.org/show_bug.cgi?id=164451
738
739         Reviewed by Darin Adler.
740
741         * test262.yaml:
742
743 2016-11-11  Saam Barati  <sbarati@apple.com>
744
745         We should have a more concise way of determining when we're varargs calling a function using rest parameters
746         https://bugs.webkit.org/show_bug.cgi?id=164258
747
748         Reviewed by Yusuke Suzuki.
749
750         * microbenchmarks/call-using-spread.js: Added.
751         (bar):
752         (foo):
753         * microbenchmarks/spread-large-array.js: Added.
754         (foo):
755         (arrays.push):
756         * microbenchmarks/spread-small-array.js: Added.
757         (foo):
758         * stress/spread-array-iterator-watchpoint-2.js: Added.
759         (foo):
760         (arrayIterator.next):
761         * stress/spread-array-iterator-watchpoint.js: Added.
762         (foo):
763         (Array.prototype.Symbol.iterator):
764         * stress/spread-non-array.js: Added.
765         (assert):
766         (foo):
767         (let.customIterator.Symbol.iterator):
768         (bar):
769
770 2016-11-11  Keith Miller  <keith_miller@apple.com>
771
772         Relocate wasm tests and actually add them to the test runner
773         https://bugs.webkit.org/show_bug.cgi?id=164668
774
775         Reviewed by Yusuke Suzuki.
776
777         This moves the Wasm tests from their current location down a level.
778         Without relocating, the tests cannot properly be run by the wasm test runner.
779
780         * wasm.yaml:
781         * wasm/Builder.js: Fix typos, yay lazy synatx checking!
782         * wasm/LowLevelBinary.js: Fix typos, yay lazy synatx checking!
783         (export.default.LowLevelBinary.prototype.get return):
784         * wasm/function-tests/add-12.js: Renamed from JSTests/wasm/js-api/function-tests/add-12.js.
785         * wasm/function-tests/br-if-loop-less-than.js: Renamed from JSTests/wasm/js-api/function-tests/br-if-loop-less-than.js.
786         * wasm/function-tests/brTableAsIf.js: Renamed from JSTests/wasm/js-api/function-tests/brTableAsIf.js.
787         * wasm/function-tests/brTableManyValues.js: Renamed from JSTests/wasm/js-api/function-tests/brTableManyValues.js.
788         * wasm/function-tests/brTableWithLoop.js: Renamed from JSTests/wasm/js-api/function-tests/brTableWithLoop.js.
789         * wasm/function-tests/dumb-eq-if-then-else.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-eq-if-then-else.js.
790         * wasm/function-tests/dumb-less-than-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-fallthrough.js.
791         * wasm/function-tests/dumb-less-than-ite.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-ite.js.
792         * wasm/function-tests/factorial.js: Renamed from JSTests/wasm/js-api/function-tests/factorial.js.
793         * wasm/function-tests/float-sub.js: Renamed from JSTests/wasm/js-api/function-tests/float-sub.js.
794         * wasm/function-tests/i32-load.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load.js.
795         * wasm/function-tests/i32-load8-s.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load8-s.js.
796         * wasm/function-tests/if-then-else-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-else-fallthrough.js.
797         * wasm/function-tests/if-then-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-fallthrough.js.
798         * wasm/function-tests/loop-mult.js: Renamed from JSTests/wasm/js-api/function-tests/loop-mult.js.
799         * wasm/function-tests/loop-sum.js: Renamed from JSTests/wasm/js-api/function-tests/loop-sum.js.
800         * wasm/function-tests/ret5.js: Renamed from JSTests/wasm/js-api/function-tests/ret5.js.
801         * wasm/self-test/test_BuilderJSON.js: Rebasline
802
803 2016-11-11  Keith Miller  <keith_miller@apple.com>
804
805         Move Wasm tests to JS
806         https://bugs.webkit.org/show_bug.cgi?id=164611
807
808         Reviewed by Geoffrey Garen.
809
810         This patch translates most of the tests from testWasm.cpp to the JS testing api. Most of the
811         ommited tests were earliest tests, which tested trivial things, like adding two
812         constants. Some tests are ommited for other reasons, however. These are:
813
814         1) Tests using I64 since the testing api does not yet know how to handle 64-bit numbers.  2)
815         Tests that would validate the memory of the module once wasm was done with it since that's
816         not really possible in JS.
817
818         In order to make such a translation easier this patch also adds some features to the JS
819         testing api:
820
821         1) Blocks can now be done lexically by adding a lambda as the last argument of the block
822         opcode. For example one can do:
823             ...
824             .Block("i32", b => b.I32Const(1) )
825
826         and the nested lambda will automatically have an end attached.
827
828         2) The JS testing api can now handle inline signature types.
829
830         3) Relocate some code to make it easier to follow and prevent 44 space indentation.
831
832         4) Rename varuint/varint to varuint32/varint32, this lets them be directly called from the
833         wasm.json without being remapped.
834
835         5) Add support for Memory and Function sections to the Builder.
836
837         6) Add support for local variables.
838
839         On the JSC side, we needed to expose a new function to validate the compiled wasm code
840         behaves the way we expect. At least until the JS Wasm API is finished. The new validation
841         function, testWasmModuleFunctions, takes an array buffer containing the wasm binary, the
842         number of functions in the blob and tests for each of those functions.
843
844         * wasm/Builder.js:
845         (const._maybeRegisterType):
846         (const): Deleted.
847         (switch.typeof): Deleted.
848         * wasm/Builder_WebAssemblyBinary.js:
849         (const.emitters.Type):
850         (const.emitters.Import):
851         (const.emitters.Function):
852         (const.emitters.Memory):
853         (const.emitters.Code):
854         (export.const.Binary):
855         * wasm/LowLevelBinary.js:
856         (export.default.LowLevelBinary.prototype.get return):
857         (export.default.LowLevelBinary.prototype.varuint32):
858         (export.default.LowLevelBinary.prototype.varint32):
859         (export.default.LowLevelBinary.prototype.varuint1):
860         (export.default.LowLevelBinary.prototype.varint7):
861         (export.default.LowLevelBinary.prototype.varuint7):
862         (export.default.LowLevelBinary.prototype.inline_signature_type):
863         (export.default.LowLevelBinary.prototype.string):
864         (export.default.LowLevelBinary.prototype.getVaruint32):
865         (export.default.LowLevelBinary.prototype.getVarint32):
866         (export.default.LowLevelBinary.prototype.getVaruint7):
867         (export.default.LowLevelBinary.prototype.getString):
868         (export.default.LowLevelBinary):
869         (export.default.LowLevelBinary.prototype.varuint): Deleted.
870         (export.default.LowLevelBinary.prototype.varint): Deleted.
871         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
872         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
873         * wasm/js-api/test_old_tests.js: Added.
874         (ret5):
875         (brTableWithLoop):
876         (brTableManyValues):
877         (run.brTableManyValues.brTableAsIf):
878         (ifThenFallthrough):
879         (ifThenElseFallthrough):
880         (dumbLessThanFallthrough):
881         (run.dumbLessThanFallthrough.floatSub):
882         (run.floatSub.add12):
883         (run.add12.factorial):
884         (i32load):
885         (run.i32load.i32load8s):
886         (run.i32load8s.dumbEqIfThenElse):
887         (run.dumbEqIfThenElse.dumbEqIfThenElse):
888         (run.dumbEqIfThenElse.dumbLessThanIfThenElse):
889         (run.dumbLessThanIfThenElse.loopSum):
890         (run.loopSum.loopMult):
891         (brIfLoopLessThan):
892         (run.brIfLoopLessThan.run):
893         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
894         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
895
896         * wasm/Builder.js:
897         (const._maybeRegisterType):
898         (const): Deleted.
899         (switch.typeof): Deleted.
900         * wasm/Builder_WebAssemblyBinary.js:
901         (const.emitters.Type):
902         (const.emitters.Import):
903         (const.emitters.Function):
904         (const.emitters.Memory):
905         (const.emitters.Code):
906         (export.const.Binary):
907         * wasm/LowLevelBinary.js:
908         (export.default.LowLevelBinary.prototype.get return):
909         (export.default.LowLevelBinary.prototype.varuint32):
910         (export.default.LowLevelBinary.prototype.varint32):
911         (export.default.LowLevelBinary.prototype.varuint1):
912         (export.default.LowLevelBinary.prototype.varint7):
913         (export.default.LowLevelBinary.prototype.varuint7):
914         (export.default.LowLevelBinary.prototype.inline_signature_type):
915         (export.default.LowLevelBinary.prototype.string):
916         (export.default.LowLevelBinary.prototype.getVaruint32):
917         (export.default.LowLevelBinary.prototype.getVarint32):
918         (export.default.LowLevelBinary.prototype.getVaruint7):
919         (export.default.LowLevelBinary.prototype.getString):
920         (export.default.LowLevelBinary):
921         (export.default.LowLevelBinary.prototype.varuint): Deleted.
922         (export.default.LowLevelBinary.prototype.varint): Deleted.
923         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
924         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
925         * wasm/js-api/function-tests/add-12.js: Added.
926         * wasm/js-api/function-tests/br-if-loop-less-than.js: Added.
927         * wasm/js-api/function-tests/brTableAsIf.js: Added.
928         * wasm/js-api/function-tests/brTableManyValues.js: Added.
929         * wasm/js-api/function-tests/brTableWithLoop.js: Added.
930         * wasm/js-api/function-tests/dumb-eq-if-then-else.js: Added.
931         * wasm/js-api/function-tests/dumb-less-than-fallthrough.js: Added.
932         * wasm/js-api/function-tests/dumb-less-than-ite.js: Added.
933         * wasm/js-api/function-tests/factorial.js: Added.
934         * wasm/js-api/function-tests/float-sub.js: Added.
935         * wasm/js-api/function-tests/i32-load.js: Added.
936         * wasm/js-api/function-tests/i32-load8-s.js: Added.
937         * wasm/js-api/function-tests/if-then-else-fallthrough.js: Added.
938         * wasm/js-api/function-tests/if-then-fallthrough.js: Added.
939         * wasm/js-api/function-tests/loop-mult.js: Added.
940         * wasm/js-api/function-tests/loop-sum.js: Added.
941         * wasm/js-api/function-tests/ret5.js: Added.
942         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
943         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
944
945 2016-11-11  Saam Barati  <sbarati@apple.com>
946
947         We recursively grab a lock in the DFGBytecodeParser causing us to deadlock
948         https://bugs.webkit.org/show_bug.cgi?id=164650
949
950         Reviewed by Geoffrey Garen.
951
952         * stress/dont-dead-lock-put-by-val-as-put-by-id.js: Added.
953         (ident):
954         (let.o.set foo):
955         (foo):
956
957 2016-11-11  Chris Dumez  <cdumez@apple.com>
958
959         Unreviewed, rolling out r208584.
960
961         Seems to have regressed Speedometer by 1% on Mac
962
963         Reverted changeset:
964
965         "We should have a more concise way of determining when we're
966         varargs calling a function using rest parameters"
967         https://bugs.webkit.org/show_bug.cgi?id=164258
968         http://trac.webkit.org/changeset/208584
969
970 2016-11-11  Chris Dumez  <cdumez@apple.com>
971
972         Unreviewed, rolling out r208117 and r208160.
973
974         Regressed Speedometer by >1.5%
975
976         Reverted changesets:
977
978         "We should have a way of profiling when a get_by_id is pure
979         and to emit a PureGetById in the DFG/FTL"
980         https://bugs.webkit.org/show_bug.cgi?id=163305
981         http://trac.webkit.org/changeset/208117
982
983         "Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing
984         out"
985         https://bugs.webkit.org/show_bug.cgi?id=164227
986         http://trac.webkit.org/changeset/208160
987
988 2016-11-11  Saam Barati  <sbarati@apple.com>
989
990         We should have a more concise way of determining when we're varargs calling a function using rest parameters
991         https://bugs.webkit.org/show_bug.cgi?id=164258
992
993         Reviewed by Yusuke Suzuki.
994
995         * microbenchmarks/call-using-spread.js: Added.
996         (bar):
997         (foo):
998         * microbenchmarks/spread-large-array.js: Added.
999         (foo):
1000         (arrays.push):
1001         * microbenchmarks/spread-small-array.js: Added.
1002         (foo):
1003         * stress/spread-array-iterator-watchpoint-2.js: Added.
1004         (foo):
1005         (arrayIterator.next):
1006         * stress/spread-array-iterator-watchpoint.js: Added.
1007         (foo):
1008         (Array.prototype.Symbol.iterator):
1009         * stress/spread-non-array.js: Added.
1010         (assert):
1011         (foo):
1012         (let.customIterator.Symbol.iterator):
1013         (bar):
1014
1015 2016-11-10  Mark Lam  <mark.lam@apple.com>
1016
1017         Fix broken have-a-bad-time-with-arguments.js test.
1018         https://bugs.webkit.org/show_bug.cgi?id=164626
1019
1020         Reviewed by Filip Pizlo.
1021
1022         But also saved a copy of the broken one as broken-have-a-bad-time-with-arguments-for-gc-testing.js
1023         because coincidentally, it stresses the GC in ways that help reveal bugs.
1024
1025         * stress/broken-have-a-bad-time-with-arguments-for-gc-testing.js: Added.
1026         (testFunction):
1027         (warmupFunction):
1028         (let.argsDeclIndex.in.argumentsDecls.let.indexToReturnIndex.in.indicesToReturn.let.insertElementActionIndex.in.insertElementActions.let.tierWarmupCountIndex.in.tierWarmupCounts.let.testArgsIndex.in.testArgsList.catch):
1029         * stress/have-a-bad-time-with-arguments.js:
1030
1031 2016-11-10  JF Bastien  <jfbastien@apple.com>
1032
1033         ASSERTION FAILED: length > offset encountered with wasm.yaml/wasm/js-api/test_Module.js.default-wasm
1034         https://bugs.webkit.org/show_bug.cgi?id=164597
1035
1036         Reviewed by Keith Miller.
1037
1038         Trim the array buffer before returning it: it's optimistically
1039         over-allocated to avoid growing all the time, but when parsed it
1040         can't have extra content.
1041
1042         * wasm/Builder_WebAssemblyBinary.js:
1043         (export.const.Binary):
1044         * wasm/LowLevelBinary.js:
1045         (export.default.LowLevelBinary.prototype.get return):
1046
1047 2016-11-10  Joseph Pecoraro  <pecoraro@apple.com>
1048
1049         test262: DataView / TypedArray methods should throw RangeErrors for negative numbers (ToIndex)
1050         https://bugs.webkit.org/show_bug.cgi?id=164450
1051
1052         Reviewed by Darin Adler.
1053
1054         * stress/dataview-typedarray-toindex.js: Added.
1055         Tests for all cases where ToIndex should be used.
1056
1057         * test262.yaml:
1058         New passing tests.
1059
1060 2016-11-10  Mark Lam  <mark.lam@apple.com>
1061
1062         Graph::methodOfGettingAValueProfileFor() should be returning the profile for the operand node.
1063         https://bugs.webkit.org/show_bug.cgi?id=164600
1064         <rdar://problem/28828676>
1065
1066         Reviewed by Filip Pizlo.
1067
1068         * stress/osr-exit-on-op-negate-should-no-fail-assertions.js: Added.
1069
1070 2016-11-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1071
1072         [JSC] Avoid cloned arguments allocation in ArrayPrototype methods
1073         https://bugs.webkit.org/show_bug.cgi?id=164502
1074
1075         Reviewed by Saam Barati.
1076
1077         * stress/argument-intrinsic-basic.js: Added.
1078         (shouldBe):
1079         (builtin.createBuiltin):
1080         * stress/argument-intrinsic-inlining-with-result-escape.js: Added.
1081         (shouldBe):
1082         (builtin.createBuiltin):
1083         (escape):
1084         * stress/argument-intrinsic-nested-inlining.js: Added.
1085         (shouldBe):
1086         (builtin.createBuiltin):
1087         (builtinCaller1):
1088         (builtinCaller2):
1089         (escape):
1090         * stress/argument-intrinsic-not-convert-to-get-argument.js: Added.
1091         (shouldBe):
1092         (builtin.createBuiltin):
1093         * stress/argument-intrinsic-with-stack-write.js: Added.
1094         (shouldBe):
1095         (builtin.createBuiltin):
1096
1097 2016-11-09  Saam Barati  <sbarati@apple.com>
1098
1099         Math.min()/Math.max() with no arguments is lowered incorrectly in the BytecodeParser
1100         https://bugs.webkit.org/show_bug.cgi?id=164464
1101         <rdar://problem/29131452>
1102
1103         Reviewed by Darin Adler.
1104
1105         * stress/math-max-min-no-arguments.js: Added.
1106         (assert):
1107         (min):
1108         (max):
1109         (test):
1110
1111 2016-11-09  Saam Barati  <sbarati@apple.com>
1112
1113         TypeProfiler and running GC collection on another thread don't play nicely with each other
1114         https://bugs.webkit.org/show_bug.cgi?id=164441
1115         <rdar://problem/29132174>
1116
1117         Reviewed by Geoffrey Garen.
1118
1119         * typeProfiler/type-profiler-gc.js: Added.
1120         (bar):
1121         (foo):
1122
1123 2016-11-04  Mark Lam  <mark.lam@apple.com>
1124
1125         Error description code should be able to handle Symbol values.
1126         https://bugs.webkit.org/show_bug.cgi?id=164436
1127         <rdar://problem/29115583>
1128
1129         Reviewed by Filip Pizlo and Saam Barati.
1130
1131         * stress/error-description-on-symbols-should-not-crash.js: Added.
1132
1133 2016-11-03  Geoffrey Garen  <ggaren@apple.com>
1134
1135         EvalCodeCache should not give up in strict mode and other cases
1136         https://bugs.webkit.org/show_bug.cgi?id=164357
1137
1138         Reviewed by Michael Saboff.
1139
1140         * microbenchmarks/eval-cached.js: Added. 45x faster now.
1141         * stress/eval-cached.js: Added. Try running the same eval text in a bunch
1142         of different scopes and verify that we access the right scope.
1143
1144 2016-11-04  JF Bastien  <jfbastien@apple.com>
1145
1146         WebAssembly JS API: implement more sections
1147         https://bugs.webkit.org/show_bug.cgi?id=164023
1148
1149         Reviewed by Keith Miller.
1150
1151         On the JSC side:
1152
1153          - Put in parser stubs for all WebAssembly sections.
1154          - Parse Import, Export sections.
1155          - Use tryReserveCapacity instead of reserve, and bail out of the parser if it fails. This prevents the parser from bringing everything down when faced with a malicious input.
1156          - Encapsulate all parsed module information into its own structure, making it easier to pass around (from parser to Plan to Module to Instance).
1157          - Create WasmFormat.cpp to hold parsed module information's dtor to avoid including WasmMemory.h needlessly.
1158          - parseCode: avoid overflow through function size.
1159          - Remove all remainders of polyfill-prototype-1, and update license.
1160          - Add missing WasmOps.h and WasmValidateInlines.h auto-generation for cmake build.
1161
1162         On the Builder.js testing side:
1163
1164          - Implement Type, Import (function only), Export (function only) sections.
1165          - Check section order and uniqueness.
1166          - Optionally auto-generate the Type section from subsequent Export / Import / Code entries.
1167          - Allow re-exporting an import.
1168
1169         * wasm/Builder.js: build type, import, and export sections
1170         (const._normalizeFunctionSignature):
1171         * wasm/Builder_WebAssemblyBinary.js: Added. Forked from Builder.js
1172         (const.emitters.Type):
1173         (const.emitters.Import):
1174         (const.emitters.Function):
1175         (const.emitters.Table):
1176         (const.emitters.Memory):
1177         (const.emitters.Global):
1178         (const.emitters.Export):
1179         (const.emitters.Start):
1180         (const.emitters.Element):
1181         (const.emitters.Code):
1182         (const.emitters.Data):
1183         (export.const.Binary):
1184         * wasm/LowLevelBinary.js: Add a few useful outputs
1185         (export.default.LowLevelBinary.prototype.varuint1):
1186         (export.default.LowLevelBinary.prototype.varint7):
1187         * wasm/WASM.js: value type and external kind helpers
1188         * wasm/assert.js: array element-wise equality comparison
1189         (const._eq):
1190         * wasm/js-api/test_Module.js:
1191         (ModuleWithImports):
1192         * wasm/self-test/test_BuilderJSON.js: many more tests for all the new Builder APIs, and update to some older tests which now require a Type section or rejiggered Function signature
1193         (const.assertOpThrows):
1194         (SectionsWithSameCustomName):
1195         (TwoTypeSections):
1196         (EmptyImportSection):
1197         (ImportBeforeTypeSections):
1198         * wasm/self-test/test_BuilderWebAssembly.js: remove a test which wasn't helpful and is now obsolete
1199         (CustomSection):
1200
1201 2016-11-03  Mark Lam  <mark.lam@apple.com>
1202
1203         ClonedArguments need to also support haveABadTime mode.
1204         https://bugs.webkit.org/show_bug.cgi?id=164200
1205         <rdar://problem/27211336>
1206
1207         Reviewed by Geoffrey Garen.
1208
1209         * stress/have-a-bad-time-with-arguments.js: Added.
1210
1211 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
1212
1213         DFG plays fast and loose with the shadow values of a Phi
1214         https://bugs.webkit.org/show_bug.cgi?id=164309
1215
1216         Reviewed by Saam Barati.
1217         
1218         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
1219
1220         * stress/dfg-ssa-swap.js: Added.
1221         (foo):
1222
1223 2016-11-03  Commit Queue  <commit-queue@webkit.org>
1224
1225         Unreviewed, rolling out r208364.
1226         https://bugs.webkit.org/show_bug.cgi?id=164402
1227
1228         broke the build (Requested by smfr on #webkit).
1229
1230         Reverted changeset:
1231
1232         "DFG plays fast and loose with the shadow values of a Phi"
1233         https://bugs.webkit.org/show_bug.cgi?id=164309
1234         http://trac.webkit.org/changeset/208364
1235
1236 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
1237
1238         DFG plays fast and loose with the shadow values of a Phi
1239         https://bugs.webkit.org/show_bug.cgi?id=164309
1240
1241         Reviewed by Saam Barati.
1242         
1243         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
1244
1245         * stress/dfg-ssa-swap.js: Added.
1246         (foo):
1247
1248 2016-11-03  Saam Barati  <sbarati@apple.com>
1249
1250         Asking for a value profile prediction should be defensive against not finding a value profile
1251         https://bugs.webkit.org/show_bug.cgi?id=164306
1252
1253         Reviewed by Mark Lam.
1254
1255         * stress/inlined-tail-call-in-inlined-setter-should-not-crash-when-getting-value-profile.js: Added.
1256         (let.o.set foo):
1257         (bar):
1258
1259 2016-11-02  Saam Barati  <sbarati@apple.com>
1260
1261         Allocation elimination of rest parameter doesn't take into account indexed properties on Array.prototype/Object.prototype
1262         https://bugs.webkit.org/show_bug.cgi?id=164301
1263
1264         Reviewed by Geoffrey Garen.
1265
1266         * stress/rest-parameter-allocation-elimination-watchpoints-2.js: Added.
1267         (assert):
1268         (foo):
1269         * stress/rest-parameter-allocation-elimination-watchpoints-3.js: Added.
1270         (assert):
1271         (foo):
1272         * stress/rest-parameter-allocation-elimination-watchpoints-4.js: Added.
1273         (assert):
1274         (foo):
1275         * stress/rest-parameter-allocation-elimination-watchpoints-5.js: Added.
1276         (assert):
1277         (foo):
1278         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Added.
1279         (assert):
1280         (foo):
1281         * stress/rest-parameter-allocation-elimination-watchpoints.js: Added.
1282         (assert):
1283         (foo):
1284
1285 2016-11-01  Saam Barati  <sbarati@apple.com>
1286
1287         We should be able to eliminate rest parameter allocations
1288         https://bugs.webkit.org/show_bug.cgi?id=163925
1289
1290         Reviewed by Filip Pizlo.
1291
1292         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
1293         (assert):
1294         (test1.bar):
1295         (test1):
1296         (test2.jaz):
1297         (test2.jaz2.kaz):
1298         (test2.jaz2):
1299         (test2):
1300         (test3.foo):
1301         (test3.baz):
1302         (test3.jaz):
1303         (test3):
1304         (test4.baz):
1305         (test4.jaz):
1306         (test4):
1307         (test5.baz):
1308         (test5.jaz):
1309         (test5):
1310         (test6.baz):
1311         (test6.jaz):
1312         (test6):
1313         (test7.baz):
1314         (test7.jaz):
1315         (test7.check):
1316         (test7):
1317         (test8.baz):
1318         (test8.jaz):
1319         (test8.check):
1320         (test8):
1321         (test9.baz):
1322         (test9.jaz):
1323         (test9.check):
1324         (test9):
1325         (test10.baz):
1326         (test10.jaz):
1327         (test10):
1328         (test11.bar):
1329         (test11.foo):
1330         (test11.makeArguments):
1331         (test11.):
1332         (test12):
1333         (test12.bar):
1334         (test12.foo):
1335         (test12.makeArguments):
1336         (test12.):
1337         (test13.bar):
1338         (test13.top):
1339         (test13.foo):
1340         (test13.makeArguments):
1341         (test13.):
1342         (test13):
1343         (test14.bar):
1344         (test14.top):
1345         (test14.foo):
1346         (test14.makeArguments):
1347         (test14.):
1348         (test14):
1349         (test15.bar):
1350         (test15.top):
1351         (test15.foo):
1352         (test15.makeArguments):
1353         (test15.):
1354         (test15):
1355
1356 2016-11-01  Commit Queue  <commit-queue@webkit.org>
1357
1358         Unreviewed, rolling out r208208 and r208210.
1359         https://bugs.webkit.org/show_bug.cgi?id=164276
1360
1361         This change caused 28 JSC test failures. (Requested by
1362         ryanhaddad on #webkit).
1363
1364         Reverted changesets:
1365
1366         "We should be able to eliminate rest parameter allocations"
1367         https://bugs.webkit.org/show_bug.cgi?id=163925
1368         http://trac.webkit.org/changeset/208208
1369
1370         "Fix the EFL build."
1371         http://trac.webkit.org/changeset/208210
1372
1373 2016-10-31  Filip Pizlo  <fpizlo@apple.com>
1374
1375         JSC should support SharedArrayBuffer
1376         https://bugs.webkit.org/show_bug.cgi?id=163986
1377
1378         Reviewed by Keith Miller.
1379         
1380         This adds our own test for the various corner cases of SharedArrayBuffer. This test is meant to
1381         check all of the things that don't require concurrency.
1382
1383         * stress/SharedArrayBuffer.js: Added.
1384         (checkAtomics):
1385         (shouldFail):
1386         (Symbol):
1387         (runAtomic):
1388
1389 2016-10-31  Saam Barati  <sbarati@apple.com>
1390
1391         We should be able to eliminate rest parameter allocations
1392         https://bugs.webkit.org/show_bug.cgi?id=163925
1393
1394         Reviewed by Filip Pizlo.
1395
1396         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
1397         (assert):
1398         (test1.bar):
1399         (test1):
1400         (test2.jaz):
1401         (test2.jaz2.kaz):
1402         (test2.jaz2):
1403         (test2):
1404         (test3.foo):
1405         (test3.baz):
1406         (test3.jaz):
1407         (test3):
1408         (test4.baz):
1409         (test4.jaz):
1410         (test4):
1411         (test5.baz):
1412         (test5.jaz):
1413         (test5):
1414         (test6.baz):
1415         (test6.jaz):
1416         (test6):
1417         (test7.baz):
1418         (test7.jaz):
1419         (test7.check):
1420         (test7):
1421         (test8.baz):
1422         (test8.jaz):
1423         (test8.check):
1424         (test8):
1425         (test9.baz):
1426         (test9.jaz):
1427         (test9.check):
1428         (test9):
1429         (test10.baz):
1430         (test10.jaz):
1431         (test10):
1432         (test11.bar):
1433         (test11.foo):
1434         (test11.makeArguments):
1435         (test11.):
1436         (test12):
1437         (test12.bar):
1438         (test12.foo):
1439         (test12.makeArguments):
1440         (test12.):
1441         (test13.bar):
1442         (test13.top):
1443         (test13.foo):
1444         (test13.makeArguments):
1445         (test13.):
1446         (test13):
1447         (test14.bar):
1448         (test14.top):
1449         (test14.foo):
1450         (test14.makeArguments):
1451         (test14.):
1452         (test14):
1453         (test15.bar):
1454         (test15.top):
1455         (test15.foo):
1456         (test15.makeArguments):
1457         (test15.):
1458         (test15):
1459
1460 2016-10-31  Saam Barati  <sbarati@apple.com>
1461
1462         Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing out
1463         https://bugs.webkit.org/show_bug.cgi?id=164227
1464
1465         Unreviewed timeout fix.
1466
1467         * microbenchmarks/pure-get-by-id-cse-2.js:
1468
1469 2016-10-31  Keith Miller  <keith_miller@apple.com>
1470
1471         autogenerated files from wasm.json should be in derived sources.
1472         https://bugs.webkit.org/show_bug.cgi?id=164152
1473
1474         Reviewed by Filip Pizlo.
1475
1476         Delete generation script since it is no longer used.
1477
1478         * wasm/generate-wasmops-header.js: Removed.
1479
1480 2016-10-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1481
1482         [JSC] JSON.stringify should handle Proxy which is non JSArray but isArray is true
1483         https://bugs.webkit.org/show_bug.cgi?id=164123
1484
1485         Reviewed by Mark Lam.
1486
1487         * stress/json-stringify-with-non-jsarray-array.js: Added.
1488         (shouldBe):
1489         (shouldBe.JSON.stringify.new.Proxy):
1490
1491 2016-10-29  Saam Barati  <sbarati@apple.com>
1492
1493         We should have a way of profiling when a get_by_id is pure and to emit a PureGetById in the DFG/FTL
1494         https://bugs.webkit.org/show_bug.cgi?id=163305
1495
1496         Reviewed by Keith Miller.
1497
1498         * microbenchmarks/pure-get-by-id-cse-2.js: Added.
1499         (foo):
1500         * microbenchmarks/pure-get-by-id-cse.js: Added.
1501         (foo):
1502         * stress/pure-get-by-id-cse-correctness.js: Added.
1503         (assert):
1504         (foo):
1505         * stress/pure-get-by-id-on-non-object.js: Added.
1506         (assert):
1507         (foo):
1508
1509 2016-10-28  Csaba Osztrogonác  <ossy@webkit.org>
1510
1511         Skip JSTests/microbenchmarks/dense-set.js on memory limited devices
1512         https://bugs.webkit.org/show_bug.cgi?id=164128
1513
1514         Reviewed by Mark Lam.
1515
1516         * microbenchmarks/dense-set.js:
1517
1518 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1519
1520         [JSC] implement runtime for async functions
1521         https://bugs.webkit.org/show_bug.cgi?id=163760
1522
1523         Reviewed by Yusuke Suzuki.
1524
1525         * stress/async-await-basic.js: Added.
1526         (shouldBe):
1527         (shouldBeAsync):
1528         (shouldThrow):
1529         (shouldThrowAsync):
1530         (shouldThrowSyntaxError):
1531         (let.AsyncFunction.async):
1532         (async.asyncFunctionForProto):
1533         (Object.getPrototypeOf.async):
1534         (Object.getPrototypeOf.async.method):
1535         (async):
1536         (async.method):
1537         (async.asyncNonConstructorDecl):
1538         (shouldThrow.new.async):
1539         (shouldThrow.new.async.nonConstructor):
1540         (async.asyncDecl):
1541         (async.f):
1542         (MyError):
1543         (async.asyncDeclThrower):
1544         (shouldThrowAsync.async):
1545         (resolveLater):
1546         (rejectLater):
1547         (async.resumeAfterNormal):
1548         (O.async.resumeAfterNormal):
1549         (resumeAfterNormalArrow.async):
1550         (async.resumeAfterThrow):
1551         (O.async.resumeAfterThrow):
1552         (resumeAfterThrowArrow.async):
1553         (catch):
1554         * stress/async-await-module-reserved-word.js: Added.
1555         (shouldThrow):
1556         (SyntaxError.Canstring_appeared_hereawait.checkModuleSyntaxError.String.raw.await):
1557         (checkModuleSyntaxError.String.raw.await):
1558         (checkModuleSyntaxError.String.raw.async.await):
1559         (SyntaxError.Cannot.declare.named):
1560         * stress/async-await-mozilla.js: Added.
1561         (shouldBe):
1562         (shouldBeAsync):
1563         (shouldThrow):
1564         (shouldThrowAsync):
1565         (assert):
1566         (shouldThrowSyntaxError):
1567         (mozSemantics.async.empty):
1568         (mozSemantics.async.simpleReturn):
1569         (mozSemantics.async.simpleAwait):
1570         (mozSemantics.async.simpleAwaitAsync):
1571         (mozSemantics.async.returnOtherAsync):
1572         (mozSemantics.async.simpleThrower):
1573         (mozSemantics.async.delegatedThrower):
1574         (mozSemantics.async.tryCatch):
1575         (mozSemantics.async.tryCatchThrow):
1576         (mozSemantics.async.wellFinally):
1577         (mozSemantics.async.finallyMayFail):
1578         (mozSemantics.async.embedded.async.inner):
1579         (mozSemantics.async.embedded):
1580         (mozSemantics.async.fib):
1581         (mozSemantics.async.isOdd.async.isEven):
1582         (mozSemantics.async.isOdd):
1583         (mozSemantics.hardcoreFib.async.fib2):
1584         (mozSemantics.namedAsyncExpr.async.simple):
1585         (mozSemantics.async.executionOrder.async.first):
1586         (mozSemantics.async.executionOrder.async.second):
1587         (mozSemantics.async.executionOrder.async.third):
1588         (mozSemantics.async.executionOrder):
1589         (mozSemantics.async.miscellaneous):
1590         (mozSemantics.thrower):
1591         (mozSemantics.async.defaultArgs):
1592         (mozSemantics.shouldThrow):
1593         (mozSemantics):
1594         (mozMethods.X):
1595         (mozMethods.X.prototype.async.getValue):
1596         (mozMethods.X.prototype.setValue):
1597         (mozMethods.X.prototype.async.increment):
1598         (mozMethods.X.prototype.async.getBaseClassName):
1599         (mozMethods.X.async.getStaticValue):
1600         (mozMethods.Y.prototype.async.getBaseClassName):
1601         (mozMethods.Y):
1602         (mozFunctionNameInferrence.async.test):
1603         (mozSyntaxErrors):
1604         * stress/async-await-reserved-word.js: Added.
1605         (assert):
1606         (shouldThrowSyntaxError):
1607         (AsyncFunction.async):
1608         * stress/async_arrow_functions_lexical_arguments_binding.js: Added.
1609         (shouldBe):
1610         (shouldBeAsync):
1611         (shouldThrowAsync):
1612         (noArgumentsArrow2.async):
1613         * stress/async_arrow_functions_lexical_new.target_binding.js: Added.
1614         (shouldBe):
1615         (shouldBeAsync):
1616         (shouldThrowAsync):
1617         (C1):
1618         (C2):
1619         (shouldThrowAsync.async):
1620         * stress/async_arrow_functions_lexical_super_binding.js: Added.
1621         (shouldBe):
1622         (shouldBeAsync):
1623         (BaseClass.prototype.baseClassValue):
1624         (BaseClass.prototype.get property):
1625         (BaseClass):
1626         (ChildClass.prototype.asyncSuperProp):
1627         (ChildClass.prototype.asyncSuperProp2):
1628         (ChildClass):
1629         (ChildClass2):
1630         * stress/async_arrow_functions_lexical_this_binding.js: Added.
1631         (shouldBe):
1632         (shouldBeAsync):
1633         (d.y):
1634
1635 2016-10-28  Csaba Osztrogonác  <ossy@webkit.org>
1636
1637         Skip 2 JS stress tests on memory limited devices
1638         https://bugs.webkit.org/show_bug.cgi?id=164125
1639
1640         Unreviewed quick fix to unbreak JSCOnly ARM bots as soon as possible.
1641
1642         * stress/joined-strings-should-not-exceed-max-string-length.js:
1643         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js:
1644
1645 2016-10-27  Caitlin Potter  <caitp@igalia.com>
1646
1647         [JSC] forbid lexical redeclaration of generator formal parameters
1648         https://bugs.webkit.org/show_bug.cgi?id=163930
1649
1650         Reviewed by Yusuke Suzuki.
1651
1652         * stress/async-await-syntax.js:
1653         * stress/generator-syntax.js:
1654         (testSyntaxError.gen):
1655         (testSyntaxError.arguments):
1656         (testSyntaxError.eval):
1657         * test262.yaml:
1658
1659 2016-10-26  JF Bastien  <jfbastien@apple.com>
1660
1661         WebAssembly API: implement Instance
1662
1663         As described in: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblyinstance-objects
1664
1665          - Take ownership of Wasm::Plan's compilation result when successfully creating a JSWebAssemblyModule object.
1666          - Construct a basic Instance with a Module.
1667          - Handle second argument (importObject) of WebAssembly.Instance.
1668          - Add reference text from the spec to WebAssembly.Module's code.
1669          - Expose and test an empty 'exports' ModuleNamespaceObject on WebAssembly.Instance.
1670
1671         The implementation isn't complete yet: it relies on further work for which I've filed bugs.
1672
1673         WebAssembly API: implement Instance
1674         https://bugs.webkit.org/show_bug.cgi?id=163998
1675
1676         Reviewed by Keith Miller.
1677
1678         * wasm/js-api/test_Instance.js: Added.
1679         (EmptyModule): use the Builder, create the simplest Module possible, and create an Instance from it
1680         * wasm/js-api/test_basic_api.js:
1681         (const.c.in.constructorProperties.switch): basic tests of the API
1682
1683 2016-10-26  Mark Lam  <mark.lam@apple.com>
1684
1685         JSGenericTypedArrayView::set() should check for exceptions.
1686         https://bugs.webkit.org/show_bug.cgi?id=164007
1687         <rdar://problem/28853775>
1688
1689         Reviewed by Filip Pizlo.
1690
1691         * stress/typed-array-view-set-should-not-crash-on-exception.js: Added.
1692
1693 2016-10-25  Mark Lam  <mark.lam@apple.com>
1694
1695         String.prototype.replace() should throw an OutOfMemoryError when using too much memory.
1696         https://bugs.webkit.org/show_bug.cgi?id=163996
1697         <rdar://problem/28263117>
1698
1699         Reviewed by Geoffrey Garen.
1700
1701         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: Added.
1702
1703 2016-10-25  Mark Lam  <mark.lam@apple.com>
1704
1705         JSStringJoiner::joinedLength() should limit joined string lengths to INT_MAX.
1706         https://bugs.webkit.org/show_bug.cgi?id=163937
1707         <rdar://problem/28642990>
1708
1709         Reviewed by Geoffrey Garen.
1710
1711         * stress/joined-strings-should-not-exceed-max-string-length.js: Added.
1712
1713 2016-10-25  JF Bastien  <jfbastien@apple.com>
1714
1715         WebAssembly JS API: simple Module test
1716         https://bugs.webkit.org/show_bug.cgi?id=163963
1717
1718         Reviewed by Filip Pizlo.
1719
1720         * wasm/LowLevelBinary.js:
1721         (export.default.LowLevelBinary.prototype.get return): get the ArrayBuffer
1722         (export.default.LowLevelBinary.prototype.hexdump): Deleted.
1723         (export.default.LowLevelBinary.prototype._maybeGrow): Deleted.
1724         * wasm/js-api/test_Module.js: Added.
1725         (EmptyModule): The most basic module possible
1726
1727 2016-10-25  JF Bastien  <jfbastien@apple.com>
1728
1729         WebAssembly JS API: implement Module
1730
1731         This implementation allows us to:
1732          - Syncrhonously create a WebAssembly.Module with a typed array.
1733          - Creates a compilation plan.
1734          - Parse the Module and creates corresponding code.
1735          - Throw WebAssembly.CompileError with mildly helpful [*] error messages on
1736            failure.
1737
1738         Consult the API documentation for expected behavior: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymodule-constructor
1739
1740         For now the implementation discards the generated code.
1741
1742         The next steps will be:
1743          - Expose a Module's exports.
1744          - Implement WebAssembly.Instance, which allows instantiating and running a
1745            compiled Module.
1746          - Beef up the testing infrastructure under JSTests/wasm so that more complex
1747            modules can be created and tested (instead of writing the bits by hand).
1748
1749         This patch also:
1750          - Adds assert.instanceof in assert.js.
1751          - Refactors Wasm::Parser and friends to accept const uint8_t* as well as a
1752            Vector, to avoid copying when invoked synchronously.
1753          - Remove useless Structure from some of the wasm constructors: they're already
1754            on the JSGlobalObject, visited properly and all.
1755          - Fix off-by-one error in parsing: Parser::parseUInt32 failed if the integer
1756            was exactly at end of file.
1757
1758          [*] On error messages while parsing: I filed https://bugs.webkit.org/show_bug.cgi?id=163919
1759
1760         WebAssembly JS API: implement Module
1761         https://bugs.webkit.org/show_bug.cgi?id=163903
1762
1763         Reviewed by Keith Miller.
1764
1765         * wasm/assert.js: use underscore in name, and remove when exporting to avoid clasing with builtin names
1766         (const._notUndef):
1767         (const._isUndef):
1768         (const._eq):
1769         (const._ge):
1770         (const._throws):
1771         * wasm/js-api/test_basic_api.js: test the WebAssembly.Module API
1772         (const.c.in.constructorProperties.switch):
1773
1774 2016-10-25  Keith Miller  <keith_miller@apple.com>
1775
1776         Add trivial Wasm conversion opcodes
1777         https://bugs.webkit.org/show_bug.cgi?id=163950
1778
1779         Reviewed by Filip Pizlo.
1780
1781         This patch differentiates between Wasm opcodes that are trivially mapped to a B3 opcode and
1782         those that are not.  Some of the Wasm opcodes that are currently a non-simple opcode will
1783         become simple as we add B3 opcodes for Wasm operations.  The remaining opcodes will need to
1784         be added via patchpoints in a later patch.
1785
1786         * wasm/generate-wasmops-header.js:
1787         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.Wasm.inline.bool.isSimple):
1788         * wasm/wasm.json:
1789
1790 2016-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1791
1792         Arrow functions with concise bodies cannot return regular expressions
1793         https://bugs.webkit.org/show_bug.cgi?id=163162
1794
1795         Reviewed by Filip Pizlo.
1796
1797         * ChakraCore/test/Operators/instanceof.baseline-jsc:
1798         * ChakraCore/test/Regex/nul_character.baseline-jsc:
1799         * ChakraCore/test/es5/Lex_u3.baseline-jsc:
1800         * stress/parse-regexp-as-token.js: Added.
1801         (shouldBe):
1802
1803 2016-10-24  Keith Miller  <keith_miller@apple.com>
1804
1805         Wasm should support floating point operations.
1806         https://bugs.webkit.org/show_bug.cgi?id=163770
1807
1808         Reviewed by Michael Saboff.
1809
1810         Add appropriate b3op names for floating point wasm bytecodes, where they exist.
1811         Also, fix some WASM => Wasm in WasmOps.h generator script that I missed
1812         the first time I made the change.
1813
1814         * wasm/generate-wasmops-header.js:
1815         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.template.typename.Int.inline.bool.isValidOpType): Deleted.
1816         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.BinaryOpType): Deleted.
1817         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.UnaryOpType): Deleted.
1818         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.LoadOpType): Deleted.
1819         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.StoreOpType): Deleted.
1820         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.undef.CREATE_ENUM_VALUE.inline.bool.isControlOp): Deleted.
1821         * wasm/wasm.json:
1822
1823 2016-10-21  Saam Barati  <sbarati@apple.com>
1824
1825         SpeculativeJIT::compileTryGetById needs to pass in NeedsToSpill along both the cell speculation and untyped speculation path
1826         https://bugs.webkit.org/show_bug.cgi?id=163622
1827
1828         Reviewed by Yusuke Suzuki.
1829
1830         * stress/try-get-by-id-should-spill-registers-dfg.js: Added.
1831         (let.f.createBuiltin):
1832
1833 2016-10-21  Caitlin Potter  <caitp@igalia.com>
1834
1835         [JSC] don't crash when arguments to `new Function()` produce unexpected AST
1836         https://bugs.webkit.org/show_bug.cgi?id=163748
1837
1838         Reviewed by Mark Lam.
1839
1840         * stress/regress-163748.js: Added.
1841         (assert):
1842         (shouldThrowSyntaxError):
1843         (GeneratorFunction):
1844
1845 2016-10-20  Keith Miller  <keith_miller@apple.com>
1846
1847         Add support for WASM calls
1848         https://bugs.webkit.org/show_bug.cgi?id=161727
1849
1850         Reviewed by Filip Pizlo and Michael Saboff.
1851
1852         Add members of the Call category to the WASMOps special group.
1853
1854         * wasm/generate-wasmops-header.js:
1855
1856 2016-10-20  Yusuke Suzuki  <utatane.tea@gmail.com>
1857
1858         [JSC] Drop isEnvironmentRecord type info flag and use JSType information instead
1859         https://bugs.webkit.org/show_bug.cgi?id=163761
1860
1861         Reviewed by Keith Miller.
1862
1863         * modules/string-prototype-module-scope.js: Added.
1864         (shouldBe):
1865         (catch):
1866         (refer):
1867         * stress/string-prototype-scopes-global-lexical-environment-strict.js: Added.
1868         (shouldBe):
1869         (catch):
1870         * stress/string-prototype-scopes-global-lexical-environment.js: Added.
1871         (shouldBe):
1872         (catch):
1873         * stress/string-prototype-scopes-strict.js: Added.
1874         (shouldBe):
1875         (catch):
1876         (try.refer):
1877         (refer):
1878         * stress/string-prototype-scopes.js: Added.
1879         (shouldBe):
1880         (catch):
1881         (try.refer):
1882         (refer):
1883         (object.toString):
1884         (with):
1885
1886 2016-10-20  JF Bastien  <jfbastien@apple.com>
1887
1888         WebAssembly API: implement exception constructors properly
1889
1890          - Rename WebAssemblyObject to JSWebAssembly for consistency.
1891          - WebAssembly object now has its own prototype: add WebAssemblyPrototype, and
1892            use it to register JSWebAssembly's function properties through auto-generated
1893            .lut.h, instead of manually.
1894          - The error constructors used to throw (e.g. `new WebAssembly.CompileError()`).
1895          - Register WebAssembly's constructors from the global object, and hold a
1896            reference to their structure and prototype so that invoking the constructor
1897            can use the structure directly from the global object.
1898          - Add a prototype base field to global object creation. Previous ones all had
1899            Object's prototype as their base, but WebAssembly's error constructors have
1900            Error as their base.
1901          - Test for the error object's correctness.
1902          - Add missing #if ENABLE(WEBASSEMBLY)
1903
1904         WebAssembly API: implement exception constructors properly
1905         https://bugs.webkit.org/show_bug.cgi?id=163699
1906
1907         Reviewed by Keith Miller.
1908
1909         * wasm/js-api/test_basic_api.js:
1910         (const.c.in.constructorProperties): more tests
1911
1912 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1913
1914         [JSC] disallow references to `await` in AsyncFunction formal parameters
1915         https://bugs.webkit.org/show_bug.cgi?id=163694
1916
1917         Reviewed by Saam Barati.
1918
1919         * stress/async-await-syntax.js:
1920
1921 2016-10-20  Keith Miller  <keith_miller@apple.com>
1922
1923         Invalid assertion in arguments elimination
1924         https://bugs.webkit.org/show_bug.cgi?id=163740
1925         <rdar://problem/27911462>
1926
1927         Reviewed by Michael Saboff.
1928
1929         * stress/direct-arguments-osr-entry.js: Added.
1930         (foo.):
1931         (foo):
1932
1933 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1934
1935         [JSC] throw TypeError when constructing dynamically created JSGeneratorFunction
1936         https://bugs.webkit.org/show_bug.cgi?id=163714
1937
1938         Reviewed by Mark Lam.
1939
1940         Add missing test coverage that dynamically created
1941         JSGeneratorFunctions can not be constructed.
1942
1943         * stress/generator-function-constructor.js:
1944         (shouldThrow):
1945
1946 2016-10-19  JF Bastien  <jfbastien@apple.com>
1947
1948         JavaScript WebAssembly API: baby steps
1949
1950          - Expand WebAssembly constructors into their own files. This requires a lot of
1951            boilerplate, as well as adding the .lut.h files. All of the
1952            JSWebAssembly*.{h,cpp}, as well as Constructor and Prototype files, are
1953            currently the same between the 4 specified WebAssembly constructors. It'll be
1954            easy to implement individual functions on constructed objects as per the
1955            spec, and have each of these files diverge. The error constructors are also
1956            similar, except that their instance derives from ErrorInstance.
1957          - Use constructor macro when initializing the global object.
1958          - Dramatically improve testing of the WebAssembly API by checking for
1959            properties specified in the spec [*].
1960          - Clean up assert.js' exception testing.
1961          - Fix a copy-paste bug in wasm.json: floating-point const return values were
1962            swapped.
1963
1964         [*] https://github.com/WebAssembly/design/blob/master/JS.md
1965
1966         Implement more of the JavaScript WebAssembly API
1967         https://bugs.webkit.org/show_bug.cgi?id=163571
1968
1969         Reviewed by Keith Miller.
1970
1971         * wasm/assert.js:
1972         (export.const.isUndef): add this useful helper
1973         (export.const.throws): fold other throw checks into this one, and check message as well
1974         * wasm/js-api/test_basic_api.js:
1975         (const.checkOwnPropertyDescriptor): check own property descriptor follows the spec
1976         * wasm/self-test/test_BuilderJSON.js:
1977         (const.assertOpThrows): use new assert API
1978         (CheckedOpcodeArgumentsTooMany): ditto
1979         (CheckedOpcodeArgumentsNotEnough): ditto
1980         (CallInvalid): ditto
1981         (I32ConstInvalid): ditto
1982         (F32ConstInvalid): ditto (and this caugth the JSON copy-paste bug)
1983         (F64ConstInvalid): ditto
1984         * wasm/self-test/test_LowLevelBinary_varint.js: use new assert API
1985         * wasm/self-test/test_LowLevelBinary_varuint.js: use new assert API
1986         * wasm/utilities.js: add "global" object, used in basic API test (to access global.WebAssembly).
1987         * wasm/wasm.json: fix copy-paste
1988
1989 2016-10-19  Caitlin Potter  <caitp@igalia.com>
1990
1991         [JSC] forbid "use strict" directive in generator functions with non-simple parameters
1992         https://bugs.webkit.org/show_bug.cgi?id=163683
1993
1994         Reviewed by Geoffrey Garen.
1995
1996         Update various generator*-non-simple-param.js tests to be passing.
1997
1998         * test262.yaml:
1999
2000 2016-10-18  Mark Lam  <mark.lam@apple.com>
2001
2002         Invoking Object.prototype.__proto__ accessors directly should throw a TypeError.
2003         https://bugs.webkit.org/show_bug.cgi?id=154377
2004         <rdar://problem/27330808>
2005
2006         Reviewed by Filip Pizlo and Saam Barati.
2007
2008         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js: Added.
2009
2010 2016-10-18  Keith Miller  <keith_miller@apple.com>
2011
2012         GetByVal to GetById conversion in the DFG is incorrect for getters with control flow
2013         https://bugs.webkit.org/show_bug.cgi?id=163629
2014
2015         Reviewed by Yusuke Suzuki.
2016
2017         * stress/get-by-val-to-id-with-getter.js: Added.
2018         (foo):
2019         (o.get hello):
2020
2021 2016-10-15  Filip Pizlo  <fpizlo@apple.com>
2022
2023         DFG and FTL should be able to use DirectCall ICs when they proved the callee or its executable
2024         https://bugs.webkit.org/show_bug.cgi?id=163371
2025
2026         Reviewed by Geoffrey Garen and Saam Barati.
2027         
2028         Add microbenchmarks for all of the cases that this patch optimizes.
2029
2030         * microbenchmarks/direct-call-arity-mismatch.js: Added.
2031         (foo):
2032         (bar):
2033         * microbenchmarks/direct-call.js: Added.
2034         (foo):
2035         (bar):
2036         * microbenchmarks/direct-construct-arity-mismatch.js: Added.
2037         (Foo):
2038         (bar):
2039         * microbenchmarks/direct-construct.js: Added.
2040         (Foo):
2041         (bar):
2042         * microbenchmarks/direct-tail-call-arity-mismatch.js: Added.
2043         (foo):
2044         (bar):
2045         * microbenchmarks/direct-tail-call-inlined-caller-arity-mismatch.js: Added.
2046         (foo):
2047         (bar):
2048         (baz):
2049         * microbenchmarks/direct-tail-call-inlined-caller.js: Added.
2050         (foo):
2051         (bar):
2052         (baz):
2053         * microbenchmarks/direct-tail-call.js: Added.
2054         (foo):
2055         (bar):
2056
2057 2016-10-18  Caitlin Potter  <caitp@igalia.com>
2058
2059         [JSC] ES6 Method functions should not have prototype
2060         https://bugs.webkit.org/show_bug.cgi?id=162530
2061
2062         Reviewed by Saam Barati.
2063
2064         Fix test262 expectations about MethodDefinitions
2065
2066         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
2067         * stress/reflect-set.js:
2068         * test262.yaml:
2069
2070 2016-10-17  Keith Miller  <keith_miller@apple.com>
2071
2072         Add support for WASM Memory.
2073         https://bugs.webkit.org/show_bug.cgi?id=161710
2074
2075         Reviewed by Geoffrey Garen.
2076
2077         Add store and load opcodes to wasm.json. Additionally, add new
2078         enums for those opcodes in the generator.
2079
2080         * stress/wasm/generate-wasmops-header.js:
2081         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.LoadOpType):
2082         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.StoreOpType):
2083
2084 2016-10-17  Saam Barati  <sbarati@apple.com>
2085
2086         Add more tests for the double->String conversion in ValueAdd constant folding
2087         https://bugs.webkit.org/show_bug.cgi?id=163517
2088
2089         Reviewed by Yusuke Suzuki.
2090
2091         * microbenchmarks/string-add-constant-folding.js:
2092         (test):
2093
2094 2016-10-17  JF Bastien  <jfbastien@apple.com>
2095
2096         WebAssembly JS API: implement basic stub
2097
2098         Implement the global WebAssembly JavaScript object, and its constructor +
2099         function properties as described in:
2100           https://github.com/WebAssembly/design/blob/master/JS.md
2101
2102         These don't do anything at the moment, the parent bug will take care of adding
2103         more functionality and associated tests.
2104
2105         WebAssembly JS API: implement basic stub
2106         https://bugs.webkit.org/show_bug.cgi?id=163404
2107
2108         Reviewed by Keith Miller.
2109
2110         * wasm.yaml:
2111         * wasm/js-api/test_basic_api.js: Added.
2112         (const.f.of.functionProperties.WebAssembly.f.undefined.throw.new.Error.Couldn.const.c.of.constructorProperties.WebAssembly.c.undefined.throw.new.Error.Couldn):
2113         (const.c.of.constructorProperties.catch):
2114
2115 2016-10-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2116
2117         [DOMJIT] Use DOMJIT::Patchpoint in IC
2118         https://bugs.webkit.org/show_bug.cgi?id=163223
2119
2120         Reviewed by Saam Barati.
2121
2122         * stress/domjit-exception-ic.js: Added.
2123         (shouldBe):
2124         (access):
2125         * stress/domjit-exception.js: Added.
2126         (shouldBe):
2127         (access):
2128         * stress/domjit-getter-complex-with-incorrect-object.js: Added.
2129         (shouldThrow):
2130         (access):
2131         (i.shouldThrow):
2132         * stress/domjit-getter-complex.js: Added.
2133         (shouldBe):
2134         (access):
2135         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js: Added.
2136         (assert):
2137         (bar):
2138         (foo):
2139
2140 2016-10-15  Saam Barati  <sbarati@apple.com>
2141
2142         Assertion failed under operationToLowerCase with a rope with zero length
2143         https://bugs.webkit.org/show_bug.cgi?id=163314
2144
2145         Reviewed by Mark Lam.
2146
2147         * stress/to-lower-case-intrinsic-on-empty-rope.js: Added.
2148         (assert):
2149         (returnRope.helper):
2150         (returnRope):
2151         (lower):
2152
2153 2016-10-14  Benjamin Poulain  <bpoulain@apple.com>
2154
2155         [JSC] op_negate should with any type
2156         https://bugs.webkit.org/show_bug.cgi?id=162587
2157
2158         Reviewed by Saam Barati.
2159
2160         * stress/arith-abs-to-arith-negate-range-optimizaton.js: Added.
2161         Cover OSR Exits when converting Math.abs() into ArithNegate.
2162
2163         * stress/arith-negate-on-various-types.js: Added.
2164         Cover ArithNegate with all types.
2165
2166 2016-10-14  JF Bastien  <jfbastien@apple.com>
2167
2168         Basic WebAssembly testing
2169
2170         Create a small DSL in JavaScript which can build WebAssembly binary modules based on the JSON description of the format as described in:
2171         https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md
2172
2173         This DSL can then be used to write small text description of valid and invalid WebAssembly binaries, making testing the JSC implementation much easier.
2174
2175         Details and example in README.md.
2176
2177         Basic WebAssembly testing
2178         https://bugs.webkit.org/show_bug.cgi?id=163267
2179
2180         Reviewed by Keith Miller.
2181
2182         * stress/wasm/wasm.json: Removed.
2183         * wasm.yaml: Added.
2184         * wasm/Builder.js: Added.
2185         (const._isValidValue):
2186         (const._BuildWebAssemblyBinary):
2187         (export.default.Builder):
2188         (export.default.Builder.prototype.setChecked):
2189         (export.default.Builder.prototype.setPreamble):
2190         (export.default.Builder.prototype._registerSectionBuilders.switch.case.string_appeared_here.this.section):
2191         (export.default.Builder.prototype._registerSectionBuilders.this.Unknown):
2192         (export.default.Builder.prototype._registerSectionBuilders):
2193         (export.default.Builder.prototype._addSection):
2194         (export.default.Builder.prototype.optimize):
2195         (export.default.Builder.prototype.json):
2196         (export.default.Builder.prototype.AsmJS):
2197         (export.default.Builder.prototype.WebAssembly):
2198         * wasm/LowLevelBinary.js: Added.
2199         (const._getterRangeCheck):
2200         (const._hexdump):
2201         (export.default.LowLevelBinary):
2202         (export.default.LowLevelBinary.prototype.newPatchable):
2203         (export.default.LowLevelBinary.prototype.hexdump):
2204         (export.default.LowLevelBinary.prototype._maybeGrow):
2205         (export.default.LowLevelBinary.prototype._push8):
2206         (export.default.LowLevelBinary.prototype.uint8):
2207         (export.default.LowLevelBinary.prototype.uint16):
2208         (export.default.LowLevelBinary.prototype.uint32):
2209         (export.default.LowLevelBinary.prototype.varuint):
2210         (export.default.LowLevelBinary.prototype.varint):
2211         (export.default.LowLevelBinary.prototype.varuint7):
2212         (export.default.LowLevelBinary.prototype.string):
2213         (export.default.LowLevelBinary.prototype.getSize):
2214         (export.default.LowLevelBinary.prototype.getUint8):
2215         (export.default.LowLevelBinary.prototype.getUint16):
2216         (export.default.LowLevelBinary.prototype.getUint32):
2217         (export.default.LowLevelBinary.prototype.getVaruint):
2218         (export.default.LowLevelBinary.prototype.getVarint):
2219         (export.default.LowLevelBinary.prototype.getVaruint7):
2220         (export.default.LowLevelBinary.prototype.getString):
2221         (PatchableLowLevelBinary):
2222         (PatchableLowLevelBinary.prototype._push8):
2223         (PatchableLowLevelBinary.prototype.apply):
2224         * wasm/README.md: Added.
2225         * wasm/WASM.js: Added.
2226         * wasm/assert.js: Added.
2227         (export.const.notUndef):
2228         (export.const.eq):
2229         (export.const.ge):
2230         (export.const.throwsError):
2231         (export.const.throwsRangeError):
2232         * wasm/generate-wasmops-header.js: Renamed from JSTests/stress/wasm/generate-wasmops-header.js.
2233         * wasm/self-test/test_BuilderJSON.js: Added.
2234         (const.assertOpThrows):
2235         (EmptyModule):
2236         (CustomMagicNumber):
2237         (CustomVersion):
2238         (CustomSection):
2239         (CustomSectionAllBytes):
2240         (CustomSectionInvalidByte):
2241         (TwoCustomSections):
2242         (EmptyCodeSection):
2243         (CodeSectionWithEmptyFunction):
2244         (CodeSectionWithEmptyFunctionWithParameters):
2245         (InvalidFunctionParameters):
2246         (SimpleFunction):
2247         (TwoSimpleFunctions):
2248         (TwoBuildersAtTheSameTime):
2249         (CheckedOpcodeArgumentsTooMany):
2250         (CheckedOpcodeArgumentsNotEnough):
2251         (CallNoArguments):
2252         (CallInvalid):
2253         (I32ConstInvalid):
2254         (F32ConstInvalid):
2255         (F64ConstInvalid):
2256         (CallManyFromStack):
2257         (OpcodeAdd):
2258         (OpcodeUnreachable):
2259         (OpcodeUnreachableCombinations):
2260         (OpcodeSelect):
2261         * wasm/self-test/test_BuilderWebAssembly.js: Added.
2262         (EmptyModule):
2263         (CustomSection):
2264         (Basic):
2265         * wasm/self-test/test_LowLevelBinary_encode.js: Added.
2266         * wasm/self-test/test_LowLevelBinary_string.js: Added.
2267         * wasm/self-test/test_LowLevelBinary_uint16.js: Added.
2268         * wasm/self-test/test_LowLevelBinary_uint32.js: Added.
2269         * wasm/self-test/test_LowLevelBinary_uint8.js: Added.
2270         * wasm/self-test/test_LowLevelBinary_varint.js: Added.
2271         * wasm/self-test/test_LowLevelBinary_varuint.js: Added.
2272         * wasm/self-test/test_LowLevelBinary_varuint7.js: Added.
2273         * wasm/self-test/test_WASM.js: Added.
2274         * wasm/test.sh: Added.
2275         * wasm/utilities.js: Added.
2276         (const._read.filename.switch):
2277         (const._load.filename.switch):
2278         (const._json.filename.switch):
2279         * wasm/wasm.json: Added.
2280
2281 2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
2282
2283         test262: @isConstructor incorrectly thinks Math.cos is a constructor
2284         https://bugs.webkit.org/show_bug.cgi?id=163437
2285
2286         Reviewed by Saam Barati.
2287
2288         * stress/is-constructor.js: Added.
2289         (assert):
2290         (prototype.assert):
2291         New test to cover the @isConstructor builtin.
2292
2293         * test262.yaml:
2294         Test now passes.
2295
2296 2016-10-14  Ryan Haddad  <ryanhaddad@apple.com>
2297
2298         Unreviewed, rolling out r207322.
2299
2300         This change caused JSC test failures
2301
2302         Reverted changeset:
2303
2304         "Fix Array.prototype.splice ES6 compliance."
2305         https://bugs.webkit.org/show_bug.cgi?id=163372
2306         http://trac.webkit.org/changeset/207322
2307
2308 2016-10-14  Mark Lam  <mark.lam@apple.com>
2309
2310         JSON.parse should not modify frozen objects.
2311         https://bugs.webkit.org/show_bug.cgi?id=163430
2312
2313         Reviewed by Saam Barati.
2314
2315         * stress/json-parse-on-frozen-object.js: Added.
2316
2317 2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
2318
2319         test262: Failure with RegExp.prototype.compile when pattern is undefined
2320         https://bugs.webkit.org/show_bug.cgi?id=163431
2321
2322         Reviewed by Yusuke Suzuki.
2323
2324         * test262.yaml:
2325
2326 2016-10-13  Joseph Pecoraro  <pecoraro@apple.com>
2327
2328         Exception message for expressions with multiple bracket accesses is inconsistent / incorrect
2329         https://bugs.webkit.org/show_bug.cgi?id=163426
2330
2331         Reviewed by Geoffrey Garen.
2332
2333         * ChakraCore/test/Error/CallNonFunction_3.baseline-jsc:
2334         * ChakraCore/test/Object/null.baseline-jsc:
2335         * stress/exception-in-to-property-key-should-be-handled-early.js:
2336         Better exception messages.
2337
2338 2016-10-13  Mark Lam  <mark.lam@apple.com>
2339
2340         Fix Array.prototype.splice ES6 compliance.
2341         https://bugs.webkit.org/show_bug.cgi?id=163372
2342
2343         Reviewed by Geoffrey Garen and Yusuke Suzuki.
2344
2345         * stress/array-splice-on-frozen-object.js: Added.
2346
2347 2016-10-12  Keith Miller  <keith_miller@apple.com>
2348
2349         Handle non-function, non-undefined comparator in Array.prototype.sort
2350         https://bugs.webkit.org/show_bug.cgi?id=163085
2351
2352         Reviewed by Yusuke Suzuki.
2353
2354         * ChakraCore/test/Array/array_sort.baseline-jsc:
2355         * stress/array-sort-bad-comparator.js: Added.
2356         (test):
2357
2358 2016-10-12  Mark Lam  <mark.lam@apple.com>
2359
2360         Array.prototype.slice should not modify frozen objects.
2361         https://bugs.webkit.org/show_bug.cgi?id=163338
2362
2363         Reviewed by Filip Pizlo.
2364
2365         * stress/array-slice-on-frozen-object.js: Added.
2366
2367 2016-10-11  Mark Lam  <mark.lam@apple.com>
2368
2369         Array.prototype.concat should not modify frozen objects.
2370         https://bugs.webkit.org/show_bug.cgi?id=163302
2371
2372         Reviewed by Filip Pizlo.
2373
2374         * stress/array-concat-on-frozen-object.js: Added.
2375
2376 2016-10-11  Saam Barati  <sbarati@apple.com>
2377
2378         ValueAdd should be constant folded if the operands are constant String,Primitive or Primitive,String
2379         https://bugs.webkit.org/show_bug.cgi?id=163182
2380
2381         Reviewed by Filip Pizlo.
2382
2383         * microbenchmarks/string-add-constant-folding.js: Added.
2384         (assert):
2385         (runTests):
2386         (add):
2387         (test):
2388
2389 2016-10-07  Mark Lam  <mark.lam@apple.com>
2390
2391         Object.freeze() and seal() should throw if [[PreventExtensions]]() fails.
2392         https://bugs.webkit.org/show_bug.cgi?id=163160
2393
2394         Reviewed by Saam Barati.
2395
2396         * stress/object-freeze-with-proxy-preventExtensions.js: Added.
2397         * stress/object-seal-with-proxy-preventExtensions.js: Added.
2398
2399 2016-10-05  Yusuke Suzuki  <utatane.tea@gmail.com>
2400
2401         [DOMJIT] Add initial CheckDOM and CallDOM implementations
2402         https://bugs.webkit.org/show_bug.cgi?id=162941
2403
2404         Reviewed by Filip Pizlo.
2405
2406         * stress/domjit-getter-poly.js: Added.
2407         (shouldBe):
2408         (access):
2409         * stress/domjit-getter-proto.js: Added.
2410         (shouldBe):
2411         (access):
2412         * stress/domjit-getter-super-poly.js: Added.
2413         (shouldBe):
2414         (access):
2415         * stress/domjit-getter.js: Added.
2416         (shouldBe):
2417         (access):
2418
2419 2016-10-04  Saam Barati  <sbarati@apple.com>
2420
2421         String.prototype.toLowerCase should be a DFG/FTL intrinsic
2422         https://bugs.webkit.org/show_bug.cgi?id=162887
2423
2424         Reviewed by Filip Pizlo and Yusuke Suzuki.
2425
2426         * microbenchmarks/to-lower-case.js: Added.
2427         (assert):
2428         (foo):
2429         (bar):
2430         * stress/to-lower-case.js: Added.
2431         (assert):
2432         (foo):
2433
2434 2016-10-04  JF Bastien  <jfbastien@apple.com>
2435
2436         WebAssembly: handle a few corner cases
2437         https://bugs.webkit.org/show_bug.cgi?id=162884
2438
2439         Reviewed by Keith Miller.
2440
2441         * stress/wasm/generate-wasmops-header.js:
2442         (const.opcodeIterator): max opcode value
2443
2444 2016-10-03  JF Bastien  <jfbastien@apple.com>
2445
2446         Auto-generate WASMOps.h, share with testing JSON file
2447         https://bugs.webkit.org/show_bug.cgi?id=162870
2448
2449         Reviewed by Keith Miller.
2450
2451         * stress/wasm/to-c++.js: Added. Generates WASMOps.h, siilar to the current one but with more data.
2452         (const.opcode_iterator):
2453         (opcode_macroizer):
2454         * stress/wasm/wasm.json: Added. Data from 0xC binary format version.
2455
2456 2016-10-03  Saam Barati  <sbarati@apple.com>
2457
2458         MapHash should speculate on the type of its child node
2459         https://bugs.webkit.org/show_bug.cgi?id=161922
2460
2461         Reviewed by Filip Pizlo.
2462
2463         * microbenchmarks/map-key-well-typed.js: Added.
2464         (assert):
2465         (intKey):
2466         (doubleKey):
2467         (objectKey):
2468         (stringKey):
2469         (booleanKey):
2470         (symbolKey):
2471         (cellKey):
2472         (assert.doubleKey):
2473         (assert.booleanKey):
2474
2475 2016-10-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2476
2477         [ES6] GeneratorFunction (a.k.a. GeneratorWrapperFunction)'s prototype object does not have constructor property
2478         https://bugs.webkit.org/show_bug.cgi?id=162849
2479
2480         Reviewed by Geoffrey Garen.
2481
2482         * test262.yaml:
2483
2484 2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
2485
2486         [ES6] Align attributes of Generator related properties to spec
2487         https://bugs.webkit.org/show_bug.cgi?id=162839
2488
2489         Reviewed by Saam Barati.
2490
2491         * test262.yaml:
2492
2493 2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
2494
2495         [ES6] GeneratorFunction constructor should instantiate generator function
2496         https://bugs.webkit.org/show_bug.cgi?id=162838
2497
2498         Reviewed by Saam Barati.
2499
2500         * stress/generator-function-constructor-is-subclassible.js: Added.
2501         (shouldBe):
2502         (GeneratorFunction):
2503         (prototype.hello):
2504         * stress/generator-function-constructor.js:
2505         * test262.yaml:
2506
2507 2016-09-30  Saam Barati  <sbarati@apple.com>
2508
2509         Arrow functions should not allow duplicate parameter names
2510         https://bugs.webkit.org/show_bug.cgi?id=162741
2511
2512         Reviewed by Filip Pizlo.
2513
2514         * test262.yaml:
2515
2516 2016-09-30  Saam Barati  <sbarati@apple.com>
2517
2518         Make some microbenchmarks run for less time.
2519
2520         Rubber stamped by Filip Pizlo.
2521
2522         * microbenchmarks/bound-function-construction-performance.js:
2523         (foo):
2524         * microbenchmarks/getter-richards-try-catch.js:
2525
2526 2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
2527
2528         Arrow functions do not infer name from computed property but normal functions do
2529         https://bugs.webkit.org/show_bug.cgi?id=162720
2530
2531         Reviewed by Saam Barati.
2532
2533         * stress/inferred-names.js:
2534
2535 2016-09-29  Mark Lam  <mark.lam@apple.com>
2536
2537         Break some slow running tests into smaller bits so they don't time out.
2538         https://bugs.webkit.org/show_bug.cgi?id=162743
2539
2540         Reviewed by Keith Miller.
2541
2542         The following tests have shown to be slow running:
2543             op_div.js
2544             op_lshift.js
2545             op_mod.js
2546             op_mul.js
2547             op_rshift.js
2548             op_sub.js
2549             op_urshift
2550
2551         These tests auto-generate permutations of values to apply to binary operations.
2552         They also test the operations with 3 permutations of value types:
2553             1. VarVar - both operands variables
2554             2. VarConst - variable operand 1, constant / literal operand 2
2555             3. ConstVar - constant / literal operand 1, variable operand 2
2556
2557         We can prevent these tests from timing out by breaking each up to only run 1 of
2558         the 3 permutations of value types.
2559
2560         * stress/op_div-ConstVar.js: Added.
2561         * stress/op_div-VarConst.js: Added.
2562         * stress/op_div-VarVar.js: Copied from JSTests/stress/op_div.js.
2563         (o1.valueOf): Deleted.
2564         * stress/op_div.js: Removed.
2565         * stress/op_lshift-ConstVar.js: Added.
2566         * stress/op_lshift-VarConst.js: Added.
2567         * stress/op_lshift-VarVar.js: Copied from JSTests/stress/op_lshift.js.
2568         (o1.valueOf): Deleted.
2569         * stress/op_lshift.js: Removed.
2570         * stress/op_mod-ConstVar.js: Added.
2571         * stress/op_mod-VarConst.js: Added.
2572         * stress/op_mod-VarVar.js: Copied from JSTests/stress/op_mod.js.
2573         (o1.valueOf): Deleted.
2574         * stress/op_mod.js: Removed.
2575         * stress/op_mul-ConstVar.js: Added.
2576         * stress/op_mul-VarConst.js: Added.
2577         * stress/op_mul-VarVar.js: Copied from JSTests/stress/op_mul.js.
2578         (o1.valueOf): Deleted.
2579         * stress/op_mul.js: Removed.
2580         * stress/op_rshift-ConstVar.js: Added.
2581         * stress/op_rshift-VarConst.js: Added.
2582         * stress/op_rshift-VarVar.js: Copied from JSTests/stress/op_rshift.js.
2583         (o1.valueOf): Deleted.
2584         * stress/op_rshift.js: Removed.
2585         * stress/op_sub-ConstVar.js: Added.
2586         * stress/op_sub-VarConst.js: Added.
2587         * stress/op_sub-VarVar.js: Copied from JSTests/stress/op_sub.js.
2588         (o1.valueOf): Deleted.
2589         * stress/op_sub.js: Removed.
2590         * stress/op_urshift-ConstVar.js: Added.
2591         * stress/op_urshift-VarConst.js: Added.
2592         * stress/op_urshift-VarVar.js: Copied from JSTests/stress/op_urshift.js.
2593         (o1.valueOf): Deleted.
2594         * stress/op_urshift.js: Removed.
2595         * stress/resources/binary-op-values.js: Added.
2596         (o1.valueOf):
2597
2598 2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
2599
2600         test262: class and function names should be inferred in assignment
2601         https://bugs.webkit.org/show_bug.cgi?id=146262
2602
2603         Reviewed by Saam Barati.
2604
2605         * stress/arrowfunction-name.js: Added.
2606         Quick tests for arrow function names.
2607
2608         * stress/inferred-names.js: Added.
2609         General test for inferred function names.
2610
2611         * test262.yaml:
2612         Pass many tests checking inferred function names.
2613
2614 2016-09-29  Saam Barati  <sbarati@apple.com>
2615
2616         We don't properly propagate non-simple-parameter-list when parsing a setter
2617         https://bugs.webkit.org/show_bug.cgi?id=160483
2618
2619         Reviewed by Joseph Pecoraro.
2620
2621         * test262.yaml:
2622
2623 2016-09-28  Saam Barati  <sbarati@apple.com>
2624
2625         stringProtoFuncRepeatCharacter will return `null` when it should not
2626         https://bugs.webkit.org/show_bug.cgi?id=161944
2627
2628         Reviewed by Yusuke Suzuki.
2629
2630         * stress/pad-start-calls-repeat-character-with-double.js: Added.
2631         (logLinesWithContext):
2632
2633 2016-09-27  Filip Pizlo  <fpizlo@apple.com>
2634
2635         B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64
2636         https://bugs.webkit.org/show_bug.cgi?id=162644
2637
2638         Reviewed by Keith Miller.
2639
2640         * stress/chill-mod-chill-mod.js: Added.
2641         (foo):
2642
2643 2016-09-26  Csaba Osztrogonác  <oszi@inf.u-szeged.hu>
2644
2645         Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
2646         https://bugs.webkit.org/show_bug.cgi?id=162386
2647
2648         Unreviewed, relanding r206317 after typo fix.
2649
2650         * stress/string-joining-long-strings-should-not-crash.js:
2651
2652 2016-09-24  Caitlin Potter  <caitp@igalia.com>
2653
2654         [JSTests] fix test262 expectations following r206333
2655         https://bugs.webkit.org/show_bug.cgi?id=162533
2656
2657         Reviewed by Yusuke Suzuki.
2658
2659         * test262.yaml:
2660
2661 2016-09-23  Caitlin Potter  <caitp@igalia.com>
2662
2663         [JSC] Implement parsing of Async Functions
2664         https://bugs.webkit.org/show_bug.cgi?id=161409
2665
2666         Reviewed by Yusuke Suzuki.
2667
2668         * stress/async-await-syntax.js: Added.
2669         (testSyntax):
2670         (testSyntaxError):
2671         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2672         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2673         (testTopLevelAsyncAwaitSyntaxStrictMode):
2674         (testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2675         (testNestedAsyncAwaitSyntax.async):
2676         (testNestedAsyncAwaitSyntax.foo):
2677         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2678
2679 2016-09-23  Ryan Haddad  <ryanhaddad@apple.com>
2680
2681         Unreviewed, rolling out r206317.
2682
2683         This change caused timeouts on El Capitan Release JSC tests
2684
2685         Reverted changeset:
2686
2687         "Skip stress/string-joining-long-strings-should-not-crash.js
2688         on memory limited devices"
2689         https://bugs.webkit.org/show_bug.cgi?id=162386
2690         http://trac.webkit.org/changeset/206317
2691
2692 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
2693
2694         Skip mozilla-tests.yaml/js1_5/Array/regress-157652 on memory limited devices
2695         https://bugs.webkit.org/show_bug.cgi?id=162381
2696
2697         Reviewed by Mark Lam.
2698
2699         * mozilla/mozilla-tests.yaml:
2700
2701 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
2702
2703         Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
2704         https://bugs.webkit.org/show_bug.cgi?id=162386
2705
2706         Reviewed by Mark Lam.
2707
2708         * stress/string-joining-long-strings-should-not-crash.js:
2709
2710 2016-09-22  Benjamin Poulain  <bpoulain@apple.com>
2711
2712         [JSC] Use an inline cache to generate op_negate
2713         https://bugs.webkit.org/show_bug.cgi?id=162371
2714
2715         Reviewed by Saam Barati.
2716
2717         * stress/op-negate-inline-cache.js: Added.
2718
2719 2016-09-22  Mark Lam  <mark.lam@apple.com>
2720
2721         Array.prototype.join should do overflow checks on string joins.
2722         https://bugs.webkit.org/show_bug.cgi?id=162459
2723
2724         Reviewed by Saam Barati.
2725
2726         * stress/array-join-on-strings-need-overflow-checks.js: Added.
2727         (assert):
2728         (catch):
2729
2730 2016-09-22  Joseph Pecoraro  <pecoraro@apple.com>
2731
2732         test262: Function length should be number of parameters before parameters with default values
2733         https://bugs.webkit.org/show_bug.cgi?id=162377
2734
2735         Reviewed by Saam Barati.
2736
2737         * stress/es6-default-parameters.js:
2738         Add our own tests for function lengths with default parameters.
2739
2740         * test262.yaml:
2741         We now pass all dflt-length tests.
2742
2743 2016-09-20  Benjamin Poulain  <bpoulain@apple.com>
2744
2745         [JSC] Do not use EagerRun on tests counting recompilation
2746         https://bugs.webkit.org/show_bug.cgi?id=162248
2747
2748         Reviewed by Geoffrey Garen.
2749
2750         This patch adds defaultNoEagerRun to all the tests
2751         for which recompilation is the symptom of a bug.
2752         The reason is that an OSR Exit can be unrelated to the tested
2753         nodes when we are running in Eager mode.
2754
2755         * stress/arith-abs-on-various-types.js:
2756         * stress/arith-ceil-on-various-types.js:
2757         * stress/arith-clz32-on-various-types.js:
2758         * stress/arith-cos-on-various-types.js:
2759         * stress/arith-floor-on-various-types.js:
2760         * stress/arith-fround-on-various-types.js:
2761         * stress/arith-log-on-various-types.js:
2762         * stress/arith-round-on-various-types.js:
2763         * stress/arith-sin-on-various-types.js:
2764         * stress/arith-sqrt-on-various-types.js:
2765         * stress/arith-tan-on-various-types.js:
2766         * stress/arith-trunc-on-various-types.js:
2767
2768         * stress/compare-strict-eq-on-various-types.js:
2769         (testAllTypesCall):
2770         The value 2 came from the other tests.
2771         CompareStrictEq supports many more cases, the worst case
2772         is bool->int->int52->number->polymorphic.
2773
2774 2016-09-20  Filip Pizlo  <fpizlo@apple.com>
2775
2776         Make MarkedBlock state tracking support overlapped allocation and marking state
2777         https://bugs.webkit.org/show_bug.cgi?id=161581
2778
2779         Reviewed by Geoffrey Garen.
2780         
2781         Add a microbenchmark for why we want to reclaim empty blocks from other allocators.
2782
2783         * microbenchmarks/switching-size-classes.js: Added.
2784
2785 2016-09-20  Saam Barati  <sbarati@apple.com>
2786
2787         Unreviewed, added test for x86 32-bit failure for HasOwnProperty node in DFG.
2788
2789         * stress/has-own-property-called-on-non-object.js: Added.
2790         (let.objs):
2791         (new.String):
2792         (foo):
2793
2794 2016-09-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2795
2796         [JSC] Add `typeof value === "symbol"` handling to bytecode compiler
2797         https://bugs.webkit.org/show_bug.cgi?id=162253
2798
2799         Reviewed by Sam Weinig.
2800
2801         * microbenchmarks/is-symbol-mixed.js: Added.
2802         (isSymbol):
2803         (i.let.pair.of.list.String):
2804         * microbenchmarks/is-symbol.js: Added.
2805         (isSymbol):
2806
2807 2016-09-19  Saam Barati  <sbarati@apple.com>
2808
2809         Make HasOwnProperty faster
2810         https://bugs.webkit.org/show_bug.cgi?id=161708
2811
2812         Reviewed by Geoffrey Garen.
2813
2814         * microbenchmarks/has-own-property-name-cache.js: Added.
2815         (foo):
2816         * stress/has-own-property-cache-basics.js: Added.
2817         (assert):
2818         (foo):
2819         * stress/has-own-property-name-cache-string-keys.js: Added.
2820         (assert):
2821         (foo):
2822         * stress/has-own-property-name-cache-symbol-keys.js: Added.
2823         (assert):
2824         (foo):
2825         * stress/has-own-property-name-cache-symbols-and-strings.js: Added.
2826         (assert):
2827         (foo):
2828
2829 2016-09-19  Benjamin Poulain  <bpoulain@apple.com>
2830
2831         [JSC] Make the rounding-related nodes support any type
2832         https://bugs.webkit.org/show_bug.cgi?id=161895
2833
2834         Reviewed by Geoffrey Garen.
2835
2836         * stress/arith-ceil-on-various-types.js: Added.
2837         * stress/arith-floor-on-various-types.js: Added.
2838         * stress/arith-round-on-various-types.js: Added.
2839         * stress/arith-trunc-on-various-types.js: Added.
2840
2841 2016-09-18  Yusuke Suzuki  <utatane.tea@gmail.com>
2842
2843         [JSC] Do not need to use defineProperty to define methods for object literals
2844         https://bugs.webkit.org/show_bug.cgi?id=162111
2845
2846         Reviewed by Saam Barati.
2847
2848         * stress/object-literal-methods.js: Added.
2849         (shouldBe):
2850         (throw.new.Error.let.object.get name):
2851         (throw.new.Error):
2852         (shouldBe.let.object.get name):
2853         (shouldBe.let.object.get prototype):
2854         (shouldBe.let.object.get 42):
2855
2856 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2857
2858         [DFG] Introduce IsCellWithType node and unify IsJSArray, IsRegExpObject and newly added IsProxyObject
2859         https://bugs.webkit.org/show_bug.cgi?id=162000
2860
2861         Reviewed by Filip Pizlo.
2862
2863         * microbenchmarks/is-array-for-array.js: Added.
2864         (isArray):
2865         * microbenchmarks/is-array-for-mixed-case.js: Added.
2866         (isArray):
2867         * microbenchmarks/is-array-for-non-array-object.js: Added.
2868         (isArray):
2869         * microbenchmarks/is-array-for-proxy.js: Added.
2870         (isArray):
2871         (isArray.proxy.throw.new.Error.isArray):
2872         (isArray.proxy.throw.new.Error):
2873
2874 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2875
2876         Unreviewed, gardening test262 results
2877
2878         Some tests are now passed with JSC, but marked as failed.
2879
2880         * test262.yaml:
2881
2882 2016-09-16  Joseph Pecoraro  <pecoraro@apple.com>
2883
2884         test262: Various Constructors length properties should be configurable
2885         https://bugs.webkit.org/show_bug.cgi?id=161998
2886
2887         Reviewed by Saam Barati.
2888
2889         * test262.yaml:
2890
2891 2016-09-15  Commit Queue  <commit-queue@webkit.org>
2892
2893         Unreviewed, rolling out r205931.
2894         https://bugs.webkit.org/show_bug.cgi?id=162021
2895
2896         Tests for this change fail on 32-bit JSC bots (Requested by
2897         ryanhaddad on #webkit).
2898
2899         Reverted changeset:
2900
2901         "[JSC] Make the rounding-related nodes support any type"
2902         https://bugs.webkit.org/show_bug.cgi?id=161895
2903         http://trac.webkit.org/changeset/205931
2904
2905 2016-09-15  Joseph Pecoraro  <pecoraro@apple.com>
2906
2907         test262: Should be a SyntaxError for duplicate parameter names in function with default parameters
2908         https://bugs.webkit.org/show_bug.cgi?id=162013
2909
2910         Reviewed by Saam Barati.
2911
2912         * stress/es6-default-parameters.js:
2913         * test262.yaml:
2914
2915 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2916
2917         ASSERT_NOT_REACHED when using spread inside an array literal with Function.prototype.apply
2918         https://bugs.webkit.org/show_bug.cgi?id=162003
2919
2920         Reviewed by Saam Barati.
2921
2922         * stress/spread-calling.js:
2923         * test262.yaml:
2924
2925 2016-09-14  Michael Saboff  <msaboff@apple.com>
2926
2927         YARR doesn't check for invalid flags for literal regular expressions
2928         https://bugs.webkit.org/show_bug.cgi?id=161995
2929
2930         Reviewed by Mark Lam.
2931
2932         New test.
2933
2934         * stress/regress-161995.js: Added.
2935         (testStatic):
2936         (catch):
2937
2938 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2939
2940         test262: TypedArray constructors length should be 3 and configurable
2941         https://bugs.webkit.org/show_bug.cgi?id=161955
2942
2943         Reviewed by Mark Lam.
2944
2945         * test262.yaml:
2946
2947 2016-09-14  Benjamin Poulain  <bpoulain@apple.com>
2948
2949         [JSC] Make the rounding-related nodes support any type
2950         https://bugs.webkit.org/show_bug.cgi?id=161895
2951
2952         Reviewed by Geoffrey Garen.
2953
2954         * stress/arith-ceil-on-various-types.js: Added.
2955         * stress/arith-floor-on-various-types.js: Added.
2956         * stress/arith-round-on-various-types.js: Added.
2957         * stress/arith-trunc-on-various-types.js: Added.
2958
2959 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2960
2961         TaggedTemplateString function calls should emit tail position calls
2962         https://bugs.webkit.org/show_bug.cgi?id=161948
2963
2964         Reviewed by Yusuke Suzuki.
2965
2966         * stress/tail-call-recognize.js:
2967         (runTests):
2968         Ensure a tagged template string function call is tail call.
2969
2970         * test262.yaml:
2971         These now pass.
2972
2973 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2974
2975         test262: Array.prototype.slice should always set length
2976         https://bugs.webkit.org/show_bug.cgi?id=161953
2977
2978         Reviewed by Mark Lam.
2979
2980         * test262.yaml:
2981
2982 2016-09-13  JF Bastien  <jfbastien@apple.com>
2983
2984         Support jsc shell builtin `read`
2985         https://bugs.webkit.org/show_bug.cgi?id=161662
2986
2987         Reviewed by Keith Miller.
2988
2989         * stress/jsc-read.js: Added.
2990         (test): test `read` and `readFile` shell builtins, in string and binary mode.
2991
2992 2016-09-12  Skachkov Oleksandr  <gskachkov@gmail.com>
2993
2994         ES6: Classes: Should be allowed to create a static method with name "arguments"
2995         https://bugs.webkit.org/show_bug.cgi?id=152985
2996
2997         Reviewed by Keith Miller.
2998
2999         * test262.yaml:
3000
3001 2016-09-12  Saam Barati  <sbarati@apple.com>
3002
3003         Speed up Function.prototype.bind a bit by making it a builtin
3004         https://bugs.webkit.org/show_bug.cgi?id=161879
3005
3006         Reviewed by Filip Pizlo.
3007
3008         * microbenchmarks/function-bind-inlining.js: Added.
3009         (assert):
3010         (test):
3011         (test2):
3012         (foo):
3013         * microbenchmarks/function-bind-no-inlining.js: Added.
3014         (assert):
3015         (test):
3016         (test2):
3017         (foo):
3018
3019 2016-09-12  Saam Barati  <sbarati@apple.com>
3020
3021         HashMapImpl should take into account m_deleteCount in its load factor and it should be able to rehash the table to be smaller
3022         https://bugs.webkit.org/show_bug.cgi?id=161640
3023
3024         Reviewed by Geoffrey Garen.
3025
3026         * microbenchmarks/map-rehash.js: Added.
3027         * stress/map-delete.js: Added.
3028         (assert):
3029         * stress/map-rehash-2.js: Added.
3030         (assert):
3031         * stress/map-rehash.js: Added.
3032         (assert):
3033
3034 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3035
3036         Unreviewed, fix tests for different libm environments
3037         https://bugs.webkit.org/show_bug.cgi?id=161857
3038
3039         * stress/ftl-arithtan.js:
3040
3041 2016-09-12  Benjamin Poulain  <bpoulain@apple.com>
3042
3043         [JSC] Use GetArrayLength for JSArray.length even when the array type is undecided
3044         https://bugs.webkit.org/show_bug.cgi?id=161671
3045
3046         Reviewed by Geoffrey Garen.
3047
3048         * stress/get-array-length-on-undecided.js: Added.
3049
3050 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3051
3052         [DFG][FTL] Add ArithTan
3053         https://bugs.webkit.org/show_bug.cgi?id=161857
3054
3055         Reviewed by Filip Pizlo.
3056
3057         * microbenchmarks/tan.js: Added.
3058         * stress/arith-tan-on-various-types.js: Added.
3059         (let.validInputTypedTestCases.validInputTestCases.map):
3060         (isIdentical):
3061         (opaqueTanNoArgument):
3062         (testNoArgument):
3063         (opaqueAllTypesTan):
3064         (testAllTypesCall):
3065         (testTangleTypeCall):
3066         (testConstant):
3067         (opaqueTanForSideEffects):
3068         (testSideEffect.let.testObject.valueOf):
3069         (testSideEffect):
3070         (opaqueTanForCSE):
3071         (testCSE.let.testObject.valueOf):
3072         (testCSE):
3073         (opaqueTanForDCE):
3074         (testDCE.let.testObject.valueOf):
3075         (testDCE):
3076         (testException.opaqueTanWithException):
3077         (testException):
3078         * stress/ftl-arithtan.js: Added.
3079         (foo):
3080
3081 2016-09-12  Saam Barati  <sbarati@apple.com>
3082
3083         MapHash should do constant folding when it has a constant argument and its legal to hash that value
3084         https://bugs.webkit.org/show_bug.cgi?id=161639
3085
3086         Reviewed by Filip Pizlo.
3087
3088         * microbenchmarks/map-constant-key.js: Added.
3089         (assert):
3090         (test):
3091         (foo):
3092
3093 2016-09-12  Michael Saboff  <msaboff@apple.com>
3094
3095         JSC test timeout: ChakraCore.yaml/ChakraCore/test/Bugs/bug56026_trycatch.js.default
3096         https://bugs.webkit.org/show_bug.cgi?id=161863
3097
3098         Reviewed by Saam Barati.
3099
3100         * ChakraCore.yaml:
3101         Disabled Bugs/bug56026_trycatch.js.
3102
3103 2016-09-09  Michael Saboff  <msaboff@apple.com>
3104
3105         Unreviewed, rolling r205759 back in with a fix.
3106
3107         The expectation file, JSTests/ChakraCore/test/Lib/tostring.baseline-jsc,
3108         should be named "toString.baseline-jsc".
3109
3110         * ChakraCore/test/Lib/toString.baseline-jsc: Copied from JSTests/ChakraCore/test/Lib/tostring.baseline-jsc.
3111         * ChakraCore/test/Lib/tostring.baseline-jsc: Removed.
3112
3113 2016-09-09  Michael Saboff  <msaboff@apple.com>
3114
3115         Disable three flakey Chakra Tests
3116         https://bugs.webkit.org/show_bug.cgi?id=161807
3117
3118         Reviewed by Saam Barati.
3119
3120         * ChakraCore.yaml: Disabled the flakey tests
3121         ChakraCore/test/Array/protoLookup_native.js
3122         ChakraCore/test/LetConst/delete.js
3123         ChakraCore/test/fieldopts/fieldhoist_sideeffect.js
3124
3125 2016-09-08  Saam Barati  <sbarati@apple.com>
3126
3127         We should inline operationConvertJSValueToBoolean into JIT code
3128         https://bugs.webkit.org/show_bug.cgi?id=161729
3129
3130         Reviewed by Filip Pizlo.
3131
3132         * stress/value-to-boolean.js: Added.
3133         (assert):
3134         (test1):
3135         (test2):
3136         (test3):
3137
3138 2016-09-08  Mark Lam  <mark.lam@apple.com>
3139
3140         REGRESSION (r205569?): 32-bit JSC test timeout: stress/rest-parameter-many-arguments.js.dfg-maximal-flush-validate-no-cjit
3141         https://bugs.webkit.org/show_bug.cgi?id=161756
3142
3143         Reviewed by Saam Barati.
3144
3145         It looks like the 32-bit JSC bot is just too slow at running this test with the
3146         dfg-maximal-flush-validate-no-cjit configuration.  We'll try excluding that
3147         configuration.
3148
3149         * stress/rest-parameter-many-arguments.js:
3150
3151 2016-09-08  JF Bastien  <jfbastien@apple.com>
3152
3153         Delete older WebAssembly tests
3154         https://bugs.webkit.org/show_bug.cgi?id=161758
3155
3156         Reviewed by Filip Pizlo.
3157
3158         They're not running, rely on the older polyfill prototype, and the older code was deleted in: https://trac.webkit.org/changeset/204180
3159
3160         * stress/wasm-arithmetic-float32.js: Removed.
3161         * stress/wasm-arithmetic-float64.js: Removed.
3162         * stress/wasm-arithmetic-int32.js: Removed.
3163         * stress/wasm-calls.js: Removed.
3164         * stress/wasm-comma.js: Removed.
3165         * stress/wasm-control-flow.js: Removed.
3166         * stress/wasm-globals.js: Removed.
3167         * stress/wasm-linear-memory.js: Removed.
3168         * stress/wasm-locals.js: Removed.
3169         * stress/wasm-relational.js: Removed.
3170         * stress/wasm-type-conversion.js: Removed.
3171         * stress/wasm/arithmetic-float32.wasm: Removed.
3172         * stress/wasm/arithmetic-float64.wasm: Removed.
3173         * stress/wasm/arithmetic-int32.wasm: Removed.
3174         * stress/wasm/calls.wasm: Removed.
3175         * stress/wasm/comma.wasm: Removed.
3176         * stress/wasm/control-flow.wasm: Removed.
3177         * stress/wasm/globals.wasm: Removed.
3178         * stress/wasm/linear-memory.wasm: Removed.
3179         * stress/wasm/locals.wasm: Removed.
3180         * stress/wasm/relational.wasm: Removed.
3181         * stress/wasm/type-conversion.wasm: Removed.
3182
3183 2016-09-08  Per Arne Vollan  <pvollan@apple.com>
3184
3185         [Win] Exception fuzz tests fail
3186         https://bugs.webkit.org/show_bug.cgi?id=140928
3187
3188         Reviewed by Mark Lam.
3189
3190         Unskip tests.
3191
3192         * exceptionFuzz.yaml:
3193
3194 2016-09-06  Saam Barati  <sbarati@apple.com>
3195
3196         ProxyObject's structure should not have ObjectPrototype as its prototype and it should not have special behavior for intercepting "__proto__"
3197         https://bugs.webkit.org/show_bug.cgi?id=161558
3198
3199         Reviewed by Benjamin Poulain.
3200
3201         * stress/proxy-get-prototype-of.js:
3202         * stress/proxy-set-prototype-of.js:
3203         (let.handler.setPrototypeOf): Deleted.
3204         * stress/proxy-underscore-proto.js: Added.
3205         (assert):
3206
3207 2016-09-06  Saam Barati  <sbarati@apple.com>
3208
3209         Make JSMap and JSSet faster
3210         https://bugs.webkit.org/show_bug.cgi?id=160989
3211
3212         Reviewed by Filip Pizlo.
3213
3214         * microbenchmarks/dense-set.js: Added.
3215         (bench):
3216         * microbenchmarks/large-map-iteration-with-additions.js: Added.
3217         (bar):
3218         (foo):
3219         * microbenchmarks/large-map-iteration-with-mutation.js: Added.
3220         (bar):
3221         (foo):
3222         * microbenchmarks/large-map-iteration.js: Added.
3223         (bar):
3224         (foo):
3225         * microbenchmarks/map-get-get-cse.js: Added.
3226         (bar):
3227         (foo):
3228         * microbenchmarks/map-has-get-cse-opportunity.js: Added.
3229         (bar):
3230         (foo):
3231         * microbenchmarks/sparse-set.js: Added.
3232         (bench):
3233         * stress/map-cse-correctness.js: Added.
3234         (assert):
3235         (testHas):
3236         (testGet):
3237         (foo):
3238         * stress/map-iteration.js: Added.
3239         (assert):
3240         (test1):
3241         (test2):
3242         (test3):
3243         (test4):
3244         (test5):
3245         (test6):
3246         (test7):
3247         (test8):
3248         (test9):
3249         (test10):
3250         (test11):
3251         (test12):
3252         (test13):
3253         (test14):
3254         (test15):
3255         (test16):
3256         (test17):
3257         (test18):
3258
3259 2016-09-06  Benjamin Poulain  <bpoulain@apple.com>
3260
3261         [JSC] Make ArithClz32 work with Cell arguments
3262         https://bugs.webkit.org/show_bug.cgi?id=161369
3263
3264         Reviewed by Geoffrey Garen.
3265
3266         * stress/arith-clz32-on-various-types.js: Added.
3267
3268 2016-09-06  Commit Queue  <commit-queue@webkit.org>
3269
3270         Unreviewed, rolling out r205504.
3271         https://bugs.webkit.org/show_bug.cgi?id=161645
3272
3273         Broke the iOS device build (Requested by ryanhaddad on
3274         #webkit).
3275
3276         Reverted changeset:
3277
3278         "Make JSMap and JSSet faster"
3279         https://bugs.webkit.org/show_bug.cgi?id=160989
3280         http://trac.webkit.org/changeset/205504
3281
3282 2016-09-06  Saam Barati  <sbarati@apple.com>
3283
3284         Make JSMap and JSSet faster
3285         https://bugs.webkit.org/show_bug.cgi?id=160989
3286
3287         Reviewed by Filip Pizlo.
3288
3289         * microbenchmarks/dense-set.js: Added.
3290         (bench):
3291         * microbenchmarks/large-map-iteration-with-additions.js: Added.
3292         (bar):
3293         (foo):
3294         * microbenchmarks/large-map-iteration-with-mutation.js: Added.
3295         (bar):
3296         (foo):
3297         * microbenchmarks/large-map-iteration.js: Added.
3298         (bar):
3299         (foo):
3300         * microbenchmarks/map-get-get-cse.js: Added.
3301         (bar):
3302         (foo):
3303         * microbenchmarks/map-has-get-cse-opportunity.js: Added.
3304         (bar):
3305         (foo):
3306         * microbenchmarks/sparse-set.js: Added.
3307         (bench):
3308         * stress/map-cse-correctness.js: Added.
3309         (assert):
3310         (testHas):
3311         (testGet):
3312         (foo):
3313         * stress/map-iteration.js: Added.
3314         (assert):
3315         (test1):
3316         (test2):
3317         (test3):
3318         (test4):
3319         (test5):
3320         (test6):
3321         (test7):
3322         (test8):
3323         (test9):
3324         (test10):
3325         (test11):
3326         (test12):
3327         (test13):
3328         (test14):
3329         (test15):
3330         (test16):
3331         (test17):
3332         (test18):
3333
3334 2016-08-31  Filip Pizlo  <fpizlo@apple.com>
3335
3336         Butterflies should be allocated in Auxiliary MarkedSpace instead of CopiedSpace and we should rewrite as much of the GC as needed to make this not a regression
3337         https://bugs.webkit.org/show_bug.cgi?id=160125
3338
3339         Reviewed by Geoffrey Garen and Keith Miller.
3340         
3341         Most of the things I did properly covered by existing tests, but I found some simple cases of
3342         unshifting that had sketchy coverage.
3343
3344         * stress/array-storage-array-unshift.js: Added.
3345         * stress/contiguous-array-unshift.js: Added.
3346         * stress/double-array-unshift.js: Added.
3347         * stress/int32-array-unshift.js: Added.
3348
3349 2016-09-02  Michael Saboff  <msaboff@apple.com>
3350
3351         Unreviewed fix after importing Chakra test
3352
3353         * ChakraCore.yaml: Skipped ChakraCore/test/UnifiedRegex/crazy.js because the original
3354         test contained tab characters.  I removed the tabs before landing.  This test depended
3355         on the tab characters and now fails after they were removed.
3356         test.
3357
3358 2016-09-01  Michael Saboff  <msaboff@apple.com>
3359
3360         Import Chakra tests to JSC
3361         https://bugs.webkit.org/show_bug.cgi?id=154697
3362
3363         Reviewed by Saam Barati.
3364
3365         Added Chakra tests.  All these tests are under Chakra/test.  This is the same layout
3366         for tests in the Chakra tree.
3367
3368         Created a ChakraCore.yaml file to be used with run-jsc-stress-tests.  This file contains
3369         the tests that are run when the original Chakra runtests.py script is run.  That script
3370         is the test driver for *nix platforms and does not attempt to run all tests or all
3371         variations of tests.  The runtest.py driver consults rlexe.xml files in each test
3372         subdirectory to determine the test to run, the options to pass to the test and how to
3373         determine pass/fail of the test.  With runtests.py as the start, tests that didn't
3374         pass directly where either skipped, with a message describing why or through 
3375         adjustments to the test infrastructure, as described below, where made to pass.
3376         
3377         The only modification to the test infrastrucutre are:
3378
3379          1) Added simple mapping of Chakra expected exception text to JSC expected text in
3380             test/UnitTestFramework/UnitTestFramework.js.  It would make sense to also
3381             map some JSC specific exception text to more generic text for the cases where
3382             that text contains indetifier names or other source specific strings and the
3383             Chakra equivolent exception texts are generic.  
3384  
3385          2) Created JSC specific expected text files where it is clear that the text work
3386             as expected on JSC but the test output is different.  Typically the differences
3387             fall into three categories, different exception output, different output from
3388             toString() of a function, slight numeric differences, and test that rely on
3389             iteration order.
3390
3391          3) Stripped the CR's from the CR-LF line terminations of the files.  
3392
3393         No actual test .js files were modified.
3394
3395         * ChakraCore: Added.
3396         * ChakraCore.yaml: Added.
3397         * ChakraCore/CONTRIBUTING.md: Added.
3398         * ChakraCore/LICENSE.txt: Added.
3399         * ChakraCore/README.md: Added.
3400         * ChakraCore/THIRD-PARTY-NOTICES.txt: Added.
3401         * ChakraCore/test: Added this directory and the tests included therein.
3402
3403 2016-09-01  JF Bastien  <jfbastien@apple.com>
3404
3405         GetByIdWithThis/GetByValWithThis should have ValueProfiles so that they can predict their result types
3406         https://bugs.webkit.org/show_bug.cgi?id=160922
3407
3408         Reviewed by Keith Miller.
3409
3410         Benchmark GetBy{Id,Val}WithThis in monomorphic and polymorphic uses.
3411         The value profile is used by the calc functions, which do some mild math with the result.
3412         These benchmarks get ~4% faster with value profiling.
3413
3414         * microbenchmarks/super-get-by-id-with-this-monomorphic.js: Added.
3415         (A):
3416         (A.prototype.set value):
3417         (A.prototype.get value):
3418         (B.prototype.set value):
3419         (B.prototype.get value):
3420         (B):
3421         (const.bench):
3422         * microbenchmarks/super-get-by-id-with-this-polymorphic.js: Added.
3423         (A):
3424         (A.prototype.set value):
3425         (A.prototype.get value):
3426         (B.prototype.set value):
3427         (B.prototype.get value):
3428         (B):
3429         (const.bench):
3430         * microbenchmarks/super-get-by-val-with-this-monomorphic.js: Added.
3431         (value):
3432         (A):
3433         (A.prototype.set v):
3434         (A.prototype.get v):
3435         (B.prototype.set v):
3436         (B.prototype.get v):
3437         (B):
3438         (const.bench):
3439         * microbenchmarks/super-get-by-val-with-this-polymorphic.js: Added.
3440         (value):
3441         (A):
3442         (A.prototype.set v):
3443         (A.prototype.get v):
3444         (B.prototype.set v):
3445         (B.prototype.get v):
3446         (B):
3447         (const.bench):
3448
3449 2016-09-01  Benjamin Poulain  <bpoulain@apple.com>
3450
3451         arith-abs-on-various-types.js is flaky
3452
3453         Unreviewed.
3454
3455         * stress/arith-abs-on-various-types.js:
3456         Two compilation is too small for the worst case.
3457         Math.abs() can be typed integer->number->untyped if we are very unlucky.
3458
3459 2016-09-01  Filip Pizlo  <fpizlo@apple.com>
3460
3461         ObjectAllocationSinkingPhase::insertOSRHintsForUpdate() fails to emit updated hints in some cases
3462         https://bugs.webkit.org/show_bug.cgi?id=161492
3463
3464         Reviewed by Mark Lam.
3465         
3466         This bug affected function->activation references but not object->object field references,
3467         because object->object field references are !neededForMaterialization(). So, the object
3468         test always passed but the activation/function test used to always fail. It passes now.
3469
3470         * stress/materialize-activation-referenced-from-phantom-function.js: Added.
3471         (bar):
3472         (inc):
3473         (dec):
3474         (foo):
3475         (test):
3476         * stress/materialize-object-referenced-from-phantom-object.js: Added.
3477         (bar):
3478         (foo):
3479         (test):
3480
3481 2016-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3482
3483         stress/random-53bit.js.ftl-no-cjit-no-inline-validate sometimes fails
3484         https://bugs.webkit.org/show_bug.cgi?id=161436
3485
3486         Reviewed by Filip Pizlo.
3487
3488         The test checks Math.random() correctly produces 53bit random values.
3489         The test can fail by design, but this should be fairly rare.
3490
3491         However, when introducing, we wrap the `test()` with 1e4 to ensure the FTL compilation, and this
3492         increases the failure rate. By increasing the MAX in the test, we make the failures much more rare case.
3493
3494         And we also add getRandomSeed() and setRandomSeed(seed) JSC shell helpers to dump more useful information
3495         and reproduce the situation easily.
3496
3497         * stress/random-53bit.js:
3498         (test):
3499
3500 2016-08-29  Benjamin Poulain  <bpoulain@apple.com>
3501
3502         [JSC] Improve ArithAbs with polymorphic input
3503         https://bugs.webkit.org/show_bug.cgi?id=161286
3504
3505         Reviewed by Saam Barati.
3506
3507         * stress/arith-abs-on-various-types.js: Added.
3508         New tests.
3509
3510         * stress/arith-cos-on-various-types.js:
3511         * stress/arith-fround-on-various-types.js:
3512         * stress/arith-log-on-various-types.js:
3513         * stress/arith-sin-on-various-types.js:
3514         * stress/arith-sqrt-on-various-types.js:
3515         Extend the existing tests to cover the DCE case.
3516
3517 2016-08-26  Benjamin Poulain  <benjamin@webkit.org>
3518
3519         [JSC] Implement CompareStrictEq(String, Untyped) in FTL
3520         https://bugs.webkit.org/show_bug.cgi?id=161229
3521
3522         Reviewed by Geoffrey Garen.
3523
3524         * stress/compare-strict-eq-on-various-types.js: Added.
3525
3526 2016-08-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3527
3528         [ES6] newPromiseCapabilities should check the given argument is constructor
3529         https://bugs.webkit.org/show_bug.cgi?id=161226
3530
3531         Reviewed by Mark Lam.
3532
3533         The arrow function should not be a constructor. So the error should be raised.
3534
3535         * stress/new-promise-capabilities-requires-constructor.js: Added.
3536         (shouldThrow):
3537
3538 2016-08-25  Benjamin Poulain  <bpoulain@apple.com>
3539
3540         [JSC] Clean up the abstract interpreter for cos/sin/sqrt/fround/log
3541         https://bugs.webkit.org/show_bug.cgi?id=161181
3542
3543         Reviewed by Geoffrey Garen.
3544
3545         Extend the tests to constants.
3546         Add no-argument cases where needed.
3547
3548         * stress/arith-cos-on-various-types.js:
3549         * stress/arith-fround-on-various-types.js:
3550         * stress/arith-log-on-various-types.js:
3551         * stress/arith-sin-on-various-types.js:
3552         * stress/arith-sqrt-on-various-types.js:
3553
3554 2016-08-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3555
3556         [DFG][FTL] Implement ES6 Generators in DFG / FTL
3557         https://bugs.webkit.org/show_bug.cgi?id=152723
3558
3559         Reviewed by Filip Pizlo.
3560
3561         * stress/generator-fib-ftl-and-array.js: Added.
3562         (fib):
3563         * stress/generator-fib-ftl-and-object.js: Added.
3564         (fib):
3565         * stress/generator-fib-ftl-and-string.js: Added.
3566         (fib):
3567         * stress/generator-fib-ftl.js: Added.
3568         (fib):
3569         * stress/generator-frame-empty.js: Added.
3570         (shouldThrow):
3571         (shouldThrow.fib):
3572         * stress/generator-reduced-save-point-put-to-scope.js: Added.
3573         (shouldBe):
3574         (gen):
3575         * stress/generator-transfer-register-beyond-mutiple-yields.js: Added.
3576         (shouldBe):
3577         (gen):
3578
3579 2016-08-25  JF Bastien  <jfbastien@apple.com>
3580
3581         TryGetById should have a ValueProfile so that it can predict its output type
3582         https://bugs.webkit.org/show_bug.cgi?id=160921
3583
3584         Reviewed by Saam Barati.
3585
3586         * microbenchmarks/try-get-by-id-basic.js: Added.
3587         (const.check):
3588         (const.bench.f.const.fooPlusBar.createBuiltin):
3589         * microbenchmarks/try-get-by-id-polymorphic.js: Added.
3590         (const.check):
3591         (fooPlusBar.createBuiltin):
3592         (bench):
3593
3594 2016-08-25  Caio Lima  <ticaiolima@gmail.com>
3595
3596         NewRegexp should not prevent inlining
3597         https://bugs.webkit.org/show_bug.cgi?id=154808
3598
3599         Reviewed by Geoffrey Garen.
3600
3601         Added test where functions with NewRegExp can be inlined right now.
3602
3603         * stress/new-regex-inline.js: Added.
3604         (assert):
3605         (testRegexpInline):
3606         (toInlineGlobal):
3607         (withRegexp):
3608         (inlineRegexpNotGlobal):
3609         (toInlineRecursive):
3610         (regexpContainsRecursive):
3611
3612 2016-08-24  Benjamin Poulain  <benjamin@webkit.org>
3613
3614         [JSC] Make FRound work with any type
3615         https://bugs.webkit.org/show_bug.cgi?id=161129
3616
3617         Reviewed by Geoffrey Garen.
3618
3619         * stress/arith-fround-on-various-types.js: Added.
3620
3621 2016-08-24  Filip Pizlo  <fpizlo@apple.com>
3622
3623         Unreviewed, roll out r204901, r204897, r204866, r204856, r204854.
3624
3625         * stress/array-storage-array-unshift.js: Removed.
3626         * stress/contiguous-array-unshift.js: Removed.
3627         * stress/double-array-unshift.js: Removed.
3628         * stress/int32-array-unshift.js: Removed.
3629
3630 2016-08-24  Skachkov Oleksandr  <gskachkov@gmail.com>
3631
3632         [ES2016] Allow assignment in for-in head in not-strict mode
3633         https://bugs.webkit.org/show_bug.cgi?id=160955
3634
3635         Reviewed by Saam Barati.
3636
3637         * stress/for-in-tests.js:
3638         (foo):
3639         (boo):
3640         (catch):
3641
3642 2016-08-23  Benjamin Poulain  <benjamin@webkit.org>
3643
3644         [JSC] Make ArithLog works with any type
3645         https://bugs.webkit.org/show_bug.cgi?id=161110
3646
3647         Reviewed by Geoffrey Garen.
3648
3649         * stress/arith-log-on-various-types.js: Added.
3650
3651 2016-08-23  Saam Barati  <sbarati@apple.com>
3652
3653         JSC should have a "microbenchmarks" directory instead of "regress" directory
3654         https://bugs.webkit.org/show_bug.cgi?id=161096
3655
3656         Rubber stamped by Mark Lam.
3657
3658         * microbenchmarks: Copied from LayoutTests/js/regress/script-tests.
3659
3660 2016-08-23  Keith Miller  <keith_miller@apple.com>
3661
3662         %TypedArray%.prototype.slice needs to check that the source and destination have not been detached.
3663         https://bugs.webkit.org/show_bug.cgi?id=161031
3664         <rdar://problem/27937019>
3665
3666         Reviewed by Geoffrey Garen.
3667
3668         * stress/typedarray-slice.js:
3669         (get let):
3670         (get try):
3671         (testSpeciesWithTransferring):
3672
3673 2016-08-22  Filip Pizlo  <fpizlo@apple.com>
3674
3675         Butterflies should be allocated in Auxiliary MarkedSpace instead of CopiedSpace and we should rewrite as much of the GC as needed to make this not a regression
3676         https://bugs.webkit.org/show_bug.cgi?id=160125
3677
3678         Reviewed by Geoffrey Garen.
3679         
3680         Most of the things I did properly covered by existing tests, but I found some simple cases of
3681         unshifting that had sketchy coverage.
3682
3683         * stress/array-storage-array-unshift.js: Added.
3684         * stress/contiguous-array-unshift.js: Added.
3685         * stress/double-array-unshift.js: Added.
3686         * stress/int32-array-unshift.js: Added.
3687
3688 2016-08-23  Keith Miller  <keith_miller@apple.com>
3689
3690         Update/add new test262 tests
3691         https://bugs.webkit.org/show_bug.cgi?id=161098
3692
3693         Reviewed by Saam Barati.
3694
3695         * test262.yaml:
3696         * test262/test/annexB/language/statements/for-in/bare-initializer.js: Added.
3697         * test262/test/annexB/language/statements/for-in/const-initializer.js: Added.
3698         * test262/test/annexB/language/statements/for-in/let-initializer.js: Added.
3699         * test262/test/annexB/language/statements/for-in/nonstrict-initializer.js: Added.
3700         (a):
3701         * test262/test/annenxB/language/statements/for-in/strict-initializer.js: Added.
3702         * test262/test/annexB/language/statements/for-in/var-arraybindingpattern-initializer.js: Added.
3703         * test262/test/annexB/language/statements/for-in/var-objectbindingpattern-initializer.js: Added.
3704         * test262/test/built-ins/AsyncFunction/AsyncFunction-construct.js: Added.
3705         (AsyncFunction.async.foo):
3706         * test262/test/built-ins/AsyncFunction/AsyncFunction-is-extensible.js: Added.
3707         (AsyncFunction.async):
3708         * test262/test/built-ins/AsyncFunction/AsyncFunction-is-subclass.js: Added.
3709         (async.foo):
3710         * test262/test/built-ins/AsyncFunction/AsyncFunction-length.js: Added.
3711         (AsyncFunction.async.foo):
3712         * test262/test/built-ins/AsyncFunction/AsyncFunction-name.js: Added.
3713         (AsyncFunction.async.foo):
3714         * test262/test/built-ins/AsyncFunction/AsyncFunction-prototype.js: Added.
3715         (AsyncFunction.async.foo):
3716         * test262/test/built-ins/AsyncFunction/AsyncFunction.js: Added.
3717         (AsyncFunction.async.foo):
3718         * test262/test/built-ins/AsyncFunction/AsyncFunctionPrototype-is-extensible.js: Added.
3719         (AsyncFunction.async.foo):
3720         * test262/test/built-ins/AsyncFunction/AsyncFunctionPrototype-prototype.js: Added.
3721         (AsyncFunction.async.foo):
3722         * test262/test/built-ins/AsyncFunction/AsyncFunctionPrototype-to-string.js: Added.
3723         (AsyncFunction.async.foo):
3724         * test262/test/built-ins/AsyncFunction/instance-construct.js: Added.
3725         (async.foo):
3726         * test262/test/built-ins/AsyncFunction/instance-has-name.js: Added.
3727         (async.foo):
3728         * test262/test/built-ins/AsyncFunction/instance-length.js: Added.
3729         (async.l0):
3730         (async.l1):
3731         (async.l2):
3732         * test262/test/built-ins/AsyncFunction/instance-prototype-property.js: Added.
3733         (async.foo):
3734         * test262/test/built-ins/AsyncFunction/is-not-a-global.js: Added.
3735         * test262/test/built-ins/DataView/prototype/getFloat32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getFloat32/detached-buffer-after-integer-byteoffset.js.
3736         * test262/test/built-ins/DataView/prototype/getFloat32/detached-buffer-before-outofrange-byteoffset.js:
3737         * test262/test/built-ins/DataView/prototype/getFloat64/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getFloat64/detached-buffer-after-integer-byteoffset.js.
3738         * test262/test/built-ins/DataView/prototype/getFloat64/detached-buffer-before-outofrange-byteoffset.js:
3739         * test262/test/built-ins/DataView/prototype/getInt16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getInt16/detached-buffer-after-integer-byteoffset.js.
3740         * test262/test/built-ins/DataView/prototype/getInt16/detached-buffer-before-outofrange-byteoffset.js:
3741         * test262/test/built-ins/DataView/prototype/getInt32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getInt32/detached-buffer-after-integer-byteoffset.js.
3742         * test262/test/built-ins/DataView/prototype/getInt32/detached-buffer-before-outofrange-byteoffset.js:
3743         * test262/test/built-ins/DataView/prototype/getInt8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getInt8/detached-buffer-after-integer-byteoffset.js.
3744         * test262/test/built-ins/DataView/prototype/getInt8/detached-buffer-before-outofrange-byteoffset.js:
3745         * test262/test/built-ins/DataView/prototype/getUint16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getUint16/detached-buffer-after-integer-byteoffset.js.
3746         * test262/test/built-ins/DataView/prototype/getUint16/detached-buffer-before-outofrange-byteoffset.js:
3747         * test262/test/built-ins/DataView/prototype/getUint32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getUint32/detached-buffer-after-integer-byteoffset.js.
3748         * test262/test/built-ins/DataView/prototype/getUint32/detached-buffer-before-outofrange-byteoffset.js:
3749         * test262/test/built-ins/DataView/prototype/getUint8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getUint8/detached-buffer-after-integer-byteoffset.js.
3750         * test262/test/built-ins/DataView/prototype/getUint8/detached-buffer-before-outofrange-byteoffset.js:
3751         * test262/test/built-ins/DataView/prototype/setFloat32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setFloat32/detached-buffer-after-integer-byteoffset.js.
3752         * test262/test/built-ins/DataView/prototype/setFloat32/detached-buffer-before-outofrange-byteoffset.js:
3753         * test262/test/built-ins/DataView/prototype/setFloat32/index-check-before-value-conversion.js:
3754         * test262/test/built-ins/DataView/prototype/setFloat32/range-check-after-value-conversion.js:
3755         * test262/test/built-ins/DataView/prototype/setFloat64/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setFloat64/detached-buffer-after-integer-byteoffset.js.
3756         * test262/test/built-ins/DataView/prototype/setFloat64/detached-buffer-before-outofrange-byteoffset.js:
3757         * test262/test/built-ins/DataView/prototype/setFloat64/index-check-before-value-conversion.js:
3758         * test262/test/built-ins/DataView/prototype/setFloat64/range-check-after-value-conversion.js:
3759         * test262/test/built-ins/DataView/prototype/setInt16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setInt16/detached-buffer-after-integer-byteoffset.js.
3760         * test262/test/built-ins/DataView/prototype/setInt16/detached-buffer-before-outofrange-byteoffset.js:
3761         * test262/test/built-ins/DataView/prototype/setInt16/index-check-before-value-conversion.js:
3762         * test262/test/built-ins/DataView/prototype/setInt16/range-check-after-value-conversion.js:
3763         * test262/test/built-ins/DataView/prototype/setInt32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setInt32/detached-buffer-after-integer-byteoffset.js.
3764         * test262/test/built-ins/DataView/prototype/setInt32/detached-buffer-before-outofrange-byteoffset.js:
3765         * test262/test/built-ins/DataView/prototype/setInt32/index-check-before-value-conversion.js:
3766         * test262/test/built-ins/DataView/prototype/setInt32/range-check-after-value-conversion.js:
3767         * test262/test/built-ins/DataView/prototype/setInt8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setInt8/detached-buffer-after-integer-byteoffset.js.
3768         * test262/test/built-ins/DataView/prototype/setInt8/detached-buffer-before-outofrange-byteoffset.js:
3769         * test262/test/built-ins/DataView/prototype/setInt8/index-check-before-value-conversion.js:
3770         * test262/test/built-ins/DataView/prototype/setInt8/range-check-after-value-conversion.js:
3771         * test262/test/built-ins/DataView/prototype/setUint16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setUint16/detached-buffer-after-integer-byteoffset.js.
3772         * test262/test/built-ins/DataView/prototype/setUint16/detached-buffer-before-outofrange-byteoffset.js:
3773         * test262/test/built-ins/DataView/prototype/setUint16/index-check-before-value-conversion.js:
3774         * test262/test/built-ins/DataView/prototype/setUint16/range-check-after-value-conversion.js:
3775         * test262/test/built-ins/DataView/prototype/setUint32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setUint32/detached-buffer-after-integer-byteoffset.js.
3776         * test262/test/built-ins/DataView/prototype/setUint32/detached-buffer-before-outofrange-byteoffset.js:
3777         * test262/test/built-ins/DataView/prototype/setUint32/index-check-before-value-conversion.js:
3778         * test262/test/built-ins/DataView/prototype/setUint32/range-check-after-value-conversion.js:
3779         * test262/test/built-ins/DataView/prototype/setUint8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setUint8/detached-buffer-after-integer-byteoffset.js.
3780         * test262/test/built-ins/DataView/prototype/setUint8/detached-buffer-before-outofrange-byteoffset.js:
3781         * test262/test/built-ins/DataView/prototype/setUint8/index-check-before-value-conversion.js:
3782         * test262/test/built-ins/DataView/prototype/setUint8/range-check-after-value-conversion.js:
3783         * test262/test/built-ins/Function/prototype/bind/instance-construct-newtarget-boundtarget-bound.js: Added.
3784         (A):
3785         * test262/test/built-ins/Function/prototype/bind/instance-construct-newtarget-boundtarget.js: Added.
3786         (A):
3787         * test262/test/built-ins/Function/prototype/bind/instance-construct-newtarget-self-new.js: Added.
3788         (A):
3789         * test262/test/built-ins/Function/prototype/bind/instance-construct-newtarget-self-reflect.js: Added.
3790         (A):
3791         * test262/test/built-ins/Function/prototype/toString/AsyncFunction.js: Added.
3792         (async.f):
3793         * test262/test/built-ins/Function/prototype/toString/async-function-declaration.js: Added.
3794         (async.f):
3795         * test262/test/built-ins/Function/prototype/toString/async-function-expression.js: Added.
3796         (let.f.async.f):
3797         * test262/test/built-ins/Function/prototype/toString/async-method.js: Added.
3798         (let.f.async.f):
3799         (let.g.async.string_appeared_here):
3800         * test262/test/built-ins/JSON/parse/reviver-array-define-prop-err.js: Added.
3801         (defineProperty):
3802         * test262/test/built-ins/JSON/parse/reviver-array-delete-err.js: Added.
3803         (deleteProperty):
3804         * test262/test/built-ins/JSON/parse/reviver-array-length-coerce-err.js: Added.
3805         (uncoercible.valueOf):
3806         (get if):
3807         * test262/test/built-ins/JSON/parse/reviver-array-length-get-err.js: Added.
3808         (get if):
3809         * test262/test/built-ins/JSON/parse/reviver-call-err.js: Added.
3810         * test262/test/built-ins/JSON/parse/reviver-get-name-err.js: Added.
3811         (thrower):
3812         * test262/test/built-ins/JSON/parse/reviver-object-define-prop-err.js: Added.
3813         (defineProperty):
3814         * test262/test/built-ins/JSON/parse/reviver-object-delete-err.js: Added.
3815         (deleteProperty):
3816         * test262/test/built-ins/JSON/parse/reviver-object-own-keys-err.js: Added.
3817         (ownKeys):
3818         * test262/test/built-ins/Number/prototype/toExponential/infinity.js: Added.
3819         * test262/test/built-ins/Number/prototype/toExponential/nan.js: Added.
3820         * test262/test/built-ins/Number/prototype/toExponential/prop-desc.js: Added.
3821         * test262/test/built-ins/Number/prototype/toExponential/return-abrupt-tointeger-fractiondigits-symbol.js: Added.
3822         * test262/test/built-ins/Number/prototype/toExponential/return-abrupt-tointeger-fractiondigits.js: Added.
3823         (fd1.valueOf):
3824         (fd2.toString):
3825         * test262/test/built-ins/Number/prototype/toExponential/return-values.js: Added.
3826         * test262/test/built-ins/Number/prototype/toExponential/this-is-0-fractiondigits-is-0.js: Added.
3827         * test262/test/built-ins/Number/prototype/toExponential/this-is-0-fractiondigits-is-not-0.js: Added.
3828         * test262/test/built-ins/Number/prototype/toExponential/this-type-not-number-or-number-object.js: Added.
3829         * test262/test/built-ins/Number/prototype/toExponential/tointeger-fractiondigits.js: Added.
3830         * test262/test/built-ins/Number/prototype/toExponential/undefined-fractiondigits.js: Added.
3831         * test262/test/built-ins/Object/getOwnPropertyDescriptors/duplicate-keys.js:
3832         * test262/test/built-ins/Object/getOwnPropertyDescriptors/proxy-undefined-descriptor.js: Added.
3833         (badProxyHandlers.allowProxyTraps.getOwnPropertyDescriptor):
3834         (badProxyHandlers.allowProxyTraps.ownKeys):
3835         * test262/test/built-ins/Proxy/setPrototypeOf/boolean-trap-result-extensible-target.js: Removed.
3836         (setPrototypeOf): Deleted.
3837         * test262/test/built-ins/Proxy/setPrototypeOf/internals-call-order.js: Added.
3838         (target.new.Proxy.Object.create.isExtensible):
3839         (target.new.Proxy.Object.create.getPrototypeOf):
3840         (target.new.Proxy.Object.create):
3841         (setPrototypeOf):
3842         * test262/test/built-ins/Proxy/setPrototypeOf/not-extensible-target-not-same-target-prototype.js:
3843         (setPrototypeOf):
3844         * test262/test/built-ins/Proxy/setPrototypeOf/not-extensible-target-same-target-prototype.js:
3845         (setPrototypeOf):
3846         * test262/test/built-ins/Proxy/setPrototypeOf/not-extensible-trap-is-false-return-false.js: Removed.
3847         (setPrototypeOf): Deleted.
3848         * test262/test/built-ins/Proxy/setPrototypeOf/return-abrupt-from-get-trap.js: Added.
3849         * test262/test/built-ins/Proxy/setPrototypeOf/return-abrupt-from-isextensible-target.js: Added.
3850         (isExtensible):
3851         (setPrototypeOf):
3852         * test262/test/built-ins/Proxy/setPrototypeOf/return-abrupt-from-target-getprototypeof.js: Added.
3853         (getPrototypeOf):
3854         (setPrototypeOf):
3855         * test262/test/built-ins/Proxy/setPrototypeOf/return-abrupt-from-trap.js: Renamed from JSTests/test262/test/built-ins/Proxy/setPrototypeOf/return-is-abrupt.js.
3856         (setPrototypeOf):
3857         * test262/test/built-ins/Proxy/setPrototypeOf/return-is-abrupt.js:
3858         (setPrototypeOf): Deleted.
3859         * test262/test/built-ins/Proxy/setPrototypeOf/toboolean-trap-result-false.js: Added.
3860         (isExtensible):
3861         (setPrototypeOf):
3862         * test262/test/built-ins/Proxy/setPrototypeOf/toboolean-trap-result-true-target-is-extensible.js: Added.
3863         (isExtensible):
3864         (getPrototypeOf):
3865         (setPrototypeOf):
3866         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable.js:
3867         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-undefined-or-null.js: Added.
3868         (setPrototypeOf):
3869         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-undefined.js: Removed.
3870         * test262/test/built-ins/RegExp/lastIndex.js: Added.
3871         * test262/test/built-ins/RegExp/prototype/global/15.10.7.2-1.js: Removed.
3872         * test262/test/built-ins/RegExp/prototype/global/this-val-invalid-obj.js: Added.
3873         (get Object):
3874         * test262/test/built-ins/RegExp/prototype/global/this-val-non-obj.js: Added.
3875         (get Object):
3876         * test262/test/built-ins/RegExp/prototype/global/this-val-regexp-prototype.js: Added.
3877         * test262/test/built-ins/RegExp/prototype/ignoreCase/15.10.7.3-1.js: Removed.
3878         * test262/test/built-ins/RegExp/prototype/ignoreCase/this-val-invalid-obj.js: Added.
3879         (get Object):
3880         * test262/test/built-ins/RegExp/prototype/ignoreCase/this-val-non-obj.js: Added.
3881         (get Object):
3882         * test262/test/built-ins/RegExp/prototype/ignoreCase/this-val-regexp-prototype.js: Added.
3883         * test262/test/built-ins/RegExp/prototype/lastIndex/15.10.7.5-1.js: Removed.
3884         * test262/test/built-ins/RegExp/prototype/lastIndex/15.10.7.5-2.js: Removed.
3885         * test262/test/built-ins/RegExp/prototype/lastIndex/S15.10.7.5_A8.js: Removed.
3886         (__re.hasOwnProperty): Deleted.
3887         (__re.propertyIsEnumerable): Deleted.
3888         (count.0): Deleted.
3889         * test262/test/built-ins/RegExp/prototype/lastIndex/S15.10.7.5_A9.js: Removed.
3890         (__re.hasOwnProperty): Deleted.
3891         (catch): Deleted.
3892         * test262/test/built-ins/RegExp/prototype/multiline/15.10.7.4-1.js: Removed.
3893         * test262/test/built-ins/RegExp/prototype/multiline/this-val-invalid-obj.js: Added.
3894         (get Object):
3895         * test262/test/built-ins/RegExp/prototype/multiline/this-val-non-obj.js: Added.
3896         (get Object):
3897         * test262/test/built-ins/RegExp/prototype/multiline/this-val-regexp-prototype.js: Added.
3898         * test262/test/built-ins/RegExp/prototype/no-regexp-matcher.js: Added.
3899         * test262/test/built-ins/RegExp/prototype/source/15.10.7.1-1.js: Removed.
3900         * test262/test/built-ins/RegExp/prototype/source/this-val-invalid-obj.js: Added.
3901         (get Object):
3902         * test262/test/built-ins/RegExp/prototype/source/this-val-non-obj.js: Added.
3903         (get Object):
3904         * test262/test/built-ins/RegExp/prototype/source/this-val-regexp-prototype.js: Added.
3905         * test262/test/built-ins/RegExp/prototype/source/value-empty.js: Added.
3906         * test262/test/built-ins/RegExp/prototype/source/value-line-terminator.js: Added.
3907         * test262/test/built-ins/RegExp/prototype/source/value-u.js: Added.
3908         * test262/test/built-ins/RegExp/prototype/source/value.js: Added.
3909         * test262/test/built-ins/RegExp/prototype/sticky/this-val-invalid-obj.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/sticky/this-invalid-obj.js.
3910         * test262/test/built-ins/RegExp/prototype/sticky/this-val-non-obj.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/sticky/this-non-obj.js.
3911         * test262/test/built-ins/RegExp/prototype/sticky/this-val-regexp-prototype.js: Added.
3912         * test262/test/built-ins/RegExp/prototype/sticky/this-val-regexp.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/sticky/this-regexp.js.
3913         * test262/test/built-ins/RegExp/prototype/unicode/this-val-invalid-obj.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/unicode/this-invald-obj.js.
3914         * test262/test/built-ins/RegExp/prototype/unicode/this-val-non-obj.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/unicode/this-non-obj.js.
3915         * test262/test/built-ins/RegExp/prototype/unicode/this-val-regexp-prototype.js: Added.
3916         * test262/test/built-ins/RegExp/prototype/unicode/this-val-regexp.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/unicode/this-regexp.js.
3917         * test262/test/built-ins/String/numeric-properties.js: Added.
3918         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/date-is-infinity-throws.js: Added.
3919         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/date-is-nan-throws.js: Added.
3920         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/formatToParts.js: Added.
3921         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/length.js: Added.
3922         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/main.js: Added.
3923         (reduce):
3924         (compareFTPtoFormat):
3925         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/name.js: Added.
3926         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/return-abrupt-tonumber-date.js: Added.
3927         (obj1.valueOf):
3928         (obj2.toString):
3929         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/this-has-not-internal-throws.js: Added.
3930         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/this-is-not-object-throws.js: Added.
3931         * test262/test/intl402/NumberFormat/prototype/formatToParts/formatToParts.js: Added.
3932         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js: Added.
3933         * test262/test/intl402/NumberFormat/prototype/formatToParts/main.js: Added.
3934         (reduce):
3935         (compareFTPtoFormat):
3936         * test262/test/intl402/NumberFormat/prototype/formatToParts/name.js: Added.
3937         * test262/test/intl402/NumberFormat/prototype/formatToParts/return-abrupt-tonumber.js: Added.
3938         (obj1.valueOf):
3939         (obj2.toString):
3940         * test262/test/intl402/NumberFormat/prototype/formatToParts/this-has-not-internal-throws.js: Added.
3941         * test262/test/intl402/NumberFormat/prototype/formatToParts/this-is-not-object-throws.js: Added.
3942         * test262/test/language/arguments-object/10.6-10-c-ii-2-s.js:
3943         (foo): Deleted.
3944         * test262/test/language/arguments-object/unmapped/via-params-dflt.js: Added.
3945         (dflt):
3946         * test262/test/language/arguments-object/unmapped/via-params-dstr.js: Added.
3947         (dstr):
3948         * test262/test/language/arguments-object/unmapped/via-params-rest.js: Added.
3949         (rest):
3950         * test262/test/language/arguments-object/unmapped/via-strict.js: Renamed from JSTests/test262/test/language/arguments-object/10.6-10-c-ii-2-s.js.
3951         (foo):
3952         * test262/test/language/block-scope/syntax/redeclaration-global/allowed-to-redeclare-function-declaration-with-function-declaration.js:
3953         (f): Deleted.
3954         * test262/test/language/eval-code/direct/super-call-arrow.js: Added.
3955         (catch):
3956         * test262/test/language/eval-code/direct/super-call-fn.js: Added.
3957         (f):
3958         * test262/test/language/eval-code/direct/super-call.js: Added.
3959         (catch):
3960         * test262/test/language/eval-code/direct/super-prop-arrow.js: Added.
3961         (catch):
3962         * test262/test/language/eval-code/direct/super-prop-method.js: Added.
3963         (o.method):
3964         * test262/test/language/eval-code/direct/super-prop.js: Added.
3965         (catch):
3966         * test262/test/language/eval-code/indirect/super-call.js: Added.
3967         (catch):
3968         (try.m):
3969         * test262/test/language/eval-code/indirect/super-prop.js: Added.
3970         (catch):
3971         (try.m):
3972         * test262/test/language/expressions/arrow-function/params-trailing-comma-length.js: Added.
3973         (assert.sameValue):
3974         * test262/test/language/expressions/arrow-function/params-trailing-comma.js: Added.
3975         * test262/test/language/expressions/async-arrow-function/arrow-returns-promise.js: Added.
3976         (p.then):
3977         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-NSPL-with-USD.js: Added.
3978         (async):
3979         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-arguments-in-formal-parameters.js: Added.
3980         (async):
3981         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-await-in-formals-default.js: Added.
3982         (async):
3983         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-await-in-formals.js: Added.
3984         (async):
3985         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-body-contains-super-call.js: Added.
3986         (async):
3987         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-body-contains-super-property.js: Added.
3988         (async):
3989         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-duplicate-parameters.js: Added.
3990         (async):
3991         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-eval-in-formal-parameters.js: Added.
3992         (async):
3993         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-formals-body-duplicate.js: Added.
3994         (async):
3995         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-formals-contains-super-call.js: Added.
3996         (async.foo.super):
3997         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-formals-contains-super-property.js: Added.
3998         (async):
3999         * test262/test/language/expressions/async-function/early-errors-expression-NSPL-with-USD.js: Added.
4000         (async):
4001         * test262/test/language/expressions/async-function/early-errors-expression-binding-identifier-arguments.js: Added.
4002         (async.arguments):
4003         * test262/test/language/expressions/async-function/early-errors-expression-binding-identifier-eval.js: Added.
4004         (async.eval):
4005         * test262/test/language/expressions/async-function/early-errors-expression-body-contains-super-call.js: Added.
4006         (async.foo):
4007         * test262/test/language/expressions/async-function/early-errors-expression-body-contains-super-property.js: Added.
4008         (async.foo):
4009         * test262/test/language/expressions/async-function/early-errors-expression-eval-in-formal-parameters.js: Added.
4010         (async.foo):
4011         * test262/test/language/expressions/async-function/early-errors-expression-formals-body-duplicate.js: Added.
4012         (async.foo):
4013         * test262/test/language/expressions/async-function/early-errors-expression-formals-contains-super-call.js: Added.
4014         (async.foo):
4015         * test262/test/language/expressions/async-function/early-errors-expression-formals-contains-super-property.js: Added.
4016         (async.foo):
4017         * test262/test/language/expressions/async-function/early-errors-expression-not-simple-assignment-target.js: Added.
4018         (async.foo):
4019         * test262/test/language/expressions/async-function/expression-returns-promise.js: Added.
4020         (p.async):
4021         * test262/test/language/expressions/async-function/syntax-expression-is-PrimaryExpression.js: Added.
4022         (async.foo):
4023         * test262/test/language/expressions/await/await-BindingIdentifier-in-global.js: Added.
4024         (async.await):
4025         * test262/test/language/expressions/await/await-BindingIdentifier-nested.js: Added.
4026         (async.foo.await):
4027         (async.foo):
4028         * test262/test/language/expressions/await/await-awaits-thenable-not-callable.js: Added.
4029         (async.foo):
4030         * test262/test/language/expressions/await/await-awaits-thenables-that-throw.js: Added.
4031         (thenable.then):
4032         (async.foo):
4033         * test262/test/language/expressions/await/await-awaits-thenables.js: Added.
4034         (thenable.then):
4035         (async.foo):
4036         * test262/test/language/expressions/await/await-in-function.js: Added.
4037         (foo):
4038         * test262/test/language/expressions/await/await-in-generator.js: Added.
4039         (foo):
4040         * test262/test/language/expressions/await/await-in-global.js: Added.
4041         * test262/test/language/expressions/await/await-in-nested-function.js: Added.
4042         (async.foo.bar):
4043         (async.foo):
4044         * test262/test/language/expressions/await/await-in-nested-generator.js: Added.
4045         (async.foo.bar):
4046         (async.foo):
4047         * test262/test/language/expressions/await/await-throws-rejections.js: Added.
4048         (async.foo):
4049         * test262/test/language/expressions/await/early-errors-await-not-simple-assignment-target.js: Added.
4050         (async.foo):
4051         * test262/test/language/expressions/await/no-operand.js: Added.
4052         (async.foo):
4053         * test262/test/language/expressions/await/syntax-await-has-UnaryExpression-with-MultiplicativeExpression.js: Added.
4054         (async.foo):
4055         * test262/test/language/expressions/await/syntax-await-has-UnaryExpression.js: Added.
4056         (async.foo):
4057         * test262/test/language/expressions/call/trailing-comma.js: Added.
4058         (foo):
4059         * test262/test/language/expressions/function/arguments-with-arguments-fn.js: Added.
4060         (f):
4061         * test262/test/language/expressions/function/arguments-with-arguments-lex.js: Added.
4062         (f):
4063         * test262/test/language/expressions/function/params-trailing-comma-arguments.js: Added.
4064         (f1):
4065         (f2):
4066         * test262/test/language/expressions/function/params-trailing-comma-length.js: Added.
4067         (assert.sameValue):
4068         * test262/test/language/expressions/function/params-trailing-comma.js: Added.
4069         * test262/test/language/expressions/generators/arguments-with-arguments-fn.js: Added.
4070         (g):
4071         * test262/test/language/expressions/generators/arguments-with-arguments-lex.js: Added.
4072         (g):
4073         * test262/test/language/expressions/generators/params-trailing-comma-arguments.js: Added.
4074         (f1):
4075         (f2):
4076         * test262/test/language/expressions/generators/params-trailing-comma-length.js: Added.
4077         (assert.sameValue):
4078         * test262/test/language/expressions/generators/params-trailing-comma.js: Added.
4079         * test262/test/language/expressions/object/computed-property-evaluation-order.js: Added.
4080         * test262/test/language/expressions/object/method-definition/async-super-call-body.js: Added.
4081         (sup.method):
4082         (child.async.method):
4083         * test262/test/language/expressions/object/method-definition/async-super-call-param.js: Added.
4084         (sup.method):
4085         (child.async.method.x.super.method):
4086         * test262/test/language/expressions/object/method-definition/early-errors-object-method-NSPL-with-USD.js: Added.
4087         (foo):
4088         * test262/test/language/expressions/object/method-definition/early-errors-object-method-arguments-in-formal-parameters.js: Added.
4089         (async.foo):
4090         * test262/test/language/expressions/object/method-definition/early-errors-object-method-await-in-formals-default.js: Added.
4091         (async.foo):
4092         * test262/test/language/expressions/object/method-definition/early-errors-object-method-await-in-formals.js: Added.
4093         (async.foo):
4094         * test262/test/language/expressions/object/method-definition/early-errors-object-method-body-contains-super-call.js: Added.
4095         (async.foo):
4096         * test262/test/language/expressions/object/method-definition/early-errors-object-method-duplicate-parameters.js: Added.
4097         (async.foo):
4098         * test262/test/language/expressions/object/method-definition/early-errors-object-method-eval-in-formal-parameters.js: Added.
4099         (async.foo):
4100         * test262/test/language/expressions/object/method-definition/early-errors-object-method-formals-body-duplicate.js: Added.
4101         (async.foo):
4102         * test262/test/language/expressions/object/method-definition/early-errors-object-method-formals-contains-super-call.js: Added.
4103         (async.foo.foo.super):
4104         * test262/test/language/expressions/object/method-definition/object-method-returns-promise.js: Added.
4105         (obj.async.method):
4106         * test262/test/language/expressions/object/method-definition/params-trailing-comma-arguments.js: Added.
4107         (obj.f1):
4108         (obj.f2):
4109         * test262/test/language/expressions/object/method-definition/params-trailing-comma-length.js: Added.
4110         (obj.one):
4111         (obj.two):
4112         * test262/test/language/expressions/object/method-definition/params-trailing-comma-rest.js: Added.
4113         (m):
4114         * test262/test/language/expressions/object/method-definition/params-trailing-comma.js: Added.
4115         (one):
4116         (two):
4117         * test262/test/language/global-code/decl-func-dup.js: Renamed from JSTests/test262/test/language/block-scope/syntax/redeclaration-global/allowed-to-redeclare-function-declaration-with-function-declaration.js.
4118         (f):
4119         * test262/test/language/global-code/decl-func.js: Added.
4120         (brandNew):
4121         * test262/test/language/global-code/decl-lex-configurable-global.js: Added.
4122         * test262/test/language/global-code/decl-lex-deletion.js: Added.
4123         (test262class):
4124         * test262/test/language/global-code/decl-lex-restricted-global.js: Added.
4125         * test262/test/language/global-code/decl-lex.js: Added.
4126         (test262class):
4127         * test262/test/language/global-code/decl-var.js: Added.
4128         * test262/test/language/global-code/return.js: Added.
4129         * test262/test/language/global-code/script-decl-func-dups.js: Added.
4130         * test262/test/language/global-code/script-decl-func-err-non-configurable.js: Added.
4131         * test262/test/language/global-code/script-decl-func-err-non-extensible.js: Added.
4132         * test262/test/language/global-code/script-decl-func.js: Added.
4133         * test262/test/language/global-code/script-decl-lex-deletion.js: Added.
4134         * test262/test/language/global-code/script-decl-lex-lex.js: Added.
4135         (test262Class):
4136         * test262/test/language/global-code/script-decl-lex-restricted-global.js: Added.
4137         * test262/test/language/global-code/script-decl-lex-var.js: Added.
4138         (test262Fn):
4139         * test262/test/language/global-code/script-decl-lex.js: Added.
4140         * test262/test/language/global-code/script-decl-var-collision.js: Added.
4141         (test262Class):
4142         * test262/test/language/global-code/script-decl-var-err.js: Added.
4143         * test262/test/language/global-code/script-decl-var.js: Added.
4144         * test262/test/language/global-code/super-call-arrow.js: Added.
4145         * test262/test/language/global-code/super-call.js: Added.
4146         * test262/test/language/global-code/super-prop-arrow.js: Added.
4147         * test262/test/language/global-code/super-prop.js: Added.
4148         * test262/test/language/global-code/yield-non-strict.js: Added.
4149         (catch):
4150         * test262/test/language/global-code/yield-strict.js: Added.
4151         * test262/test/language/literals/regexp/lastIndex.js: Added.
4152         * test262/test/language/literals/regexp/u-unicode-esc-bounds.js:
4153         * test262/test/language/literals/regexp/y-assertion-start.js: Added.
4154         * test262/test/language/module-code/instn-star-err-not-found-faulty_FIXTURE.js:
4155         * test262/test/language/module-code/instn-star-err-not-found.js:
4156         * test262/test/language/module-code/namespace/internals/get-own-property-str-found-init.js:
4157         * test262/test/language/module-code/parse-err-return.js: Added.
4158         * test262/test/language/module-code/parse-err-yield.js: Added.
4159         * test262/test/language/rest-parameters/params-trailing-comma-rest.js: Added.
4160         * test262/test/language/statements/async-function/declaration-returns-promise.js: Added.
4161         (async.foo):
4162         * test262/test/language/statements/async-function/early-errors-declaration-NSPL-with-USD.js: Added.
4163         (async.foo):
4164         * test262/test/language/statements/async-function/early-errors-declaration-arguments-in-formal-parameters.js: Added.
4165         (async.foo):
4166         * test262/test/language/statements/async-function/early-errors-declaration-await-in-formals-default.js: Added.
4167         (async.foo):
4168         * test262/test/language/statements/async-function/early-errors-declaration-await-in-formals.js: Added.
4169         (async.foo):
4170         * test262/test/language/statements/async-function/early-errors-declaration-binding-identifier-arguments.js: Added.
4171         (async.arguments):
4172         * test262/test/language/statements/async-function/early-errors-declaration-binding-identifier-eval.js: Added.
4173         (async.eval):
4174         * test262/test/language/statements/async-function/early-errors-declaration-body-contains-super-call.js: Added.
4175         (async.foo):
4176         * test262/test/language/statements/async-function/early-errors-declaration-body-contains-super-property.js: Added.
4177         (async.foo):
4178         * test262/test/language/statements/async-function/early-errors-declaration-duplicate-parameters.js: Added.
4179         (async.foo):
4180         * test262/test/language/statements/async-function/early-errors-declaration-eval-in-formal-parameters.js: Added.
4181         (async.foo):
4182         * test262/test/language/statements/async-function/early-errors-declaration-formals-body-duplicate.js: Added.
4183         (async.foo):
4184         * test262/test/language/statements/async-function/early-errors-declaration-formals-contains-super-call.js: Added.
4185         (async.foo):
4186         * test262/test/language/statements/async-function/early-errors-declaration-formals-contains-super-property.js: Added.
4187         (async.foo):
4188         * test262/test/language/statements/async-function/early-errors-no-async-generator.js: Added.
4189         (async.foo):
4190         * test262/test/language/statements/async-function/evaluation-body-that-returns-after-await.js: Added.
4191         (async.foo):
4192         (foo.then):
4193         * test262/test/language/statements/async-function/evaluation-body-that-returns.js: Added.
4194         (async.foo):
4195         (foo.then):
4196         * test262/test/language/statements/async-function/evaluation-body-that-throws-after-await.js: Added.
4197         (async.foo):
4198         (foo.then):
4199         * test262/test/language/statements/async-function/evaluation-body-that-throws.js: Added.
4200         (async.foo):
4201         (foo.then):
4202         * test262/test/language/statements/async-function/evaluation-body.js: Added.
4203         (async.foo):
4204         * test262/test/language/statements/async-function/evaluation-default-that-throws.js: Added.
4205         (async.foo):
4206         (foo.then):
4207         * test262/test/language/statements/async-function/evaluation-mapped-arguments.js: Added.
4208         (async.foo):
4209         * test262/test/language/statements/async-function/evaluation-this-value-global.js: Added.
4210         (async.foo):
4211         * test262/test/language/statements/async-function/evaluation-this-value-passed.js: Added.
4212         (async.foo):
4213         * test262/test/language/statements/async-function/evaluation-unmapped-arguments.js: Added.
4214         (async.foo):
4215         * test262/test/language/statements/async-function/syntax-declaration-line-terminators-allowed.js: Added.
4216         (async.foo):
4217         * test262/test/language/statements/async-function/syntax-declaration-no-line-terminator.js: Added.
4218         (async.foo):
4219         * test262/test/language/statements/async-function/syntax-declaration.js: Added.
4220         (async.foo):
4221         (foo.then):
4222         * test262/test/language/statements/class/definition/class-method-returns-promise.js: Added.
4223         (Foo.prototype.async.method):
4224         (Foo):
4225         * test262/test/language/statements/class/definition/early-errors-class-method-NSPL-with-USD.js: Added.
4226         (Foo.prototype.async.bar):
4227         (Foo):
4228         * test262/test/language/statements/class/definition/early-errors-class-method-arguments-in-formal-parameters.js: Added.
4229         (Foo.prototype.async.foo):
4230         (Foo):
4231         * test262/test/language/statements/class/definition/early-errors-class-method-await-in-formals-default.js: Added.
4232         (Foo.prototype.async.foo):
4233         (Foo):
4234         * test262/test/language/statements/class/definition/early-errors-class-method-await-in-formals.js: Added.
4235         (Foo.prototype.async.foo):
4236         (Foo):
4237         * test262/test/language/statements/class/definition/early-errors-class-method-body-contains-super-call.js: Added.
4238         (Foo.prototype.async.foo):
4239         (Foo):
4240         * test262/test/language/statements/class/definition/early-errors-class-method-duplicate-parameters.js: Added.
4241         (Foo.prototype.async.foo):
4242         (Foo):
4243         * test262/test/language/statements/class/definition/early-errors-class-method-eval-in-formal-parameters.js: Added.
4244         (Foo.prototype.async.foo):
4245         (Foo):
4246         * test262/test/language/statements/class/definition/early-errors-class-method-formals-body-duplicate.js: Added.
4247         (Foo.async.foo):
4248         (Foo):
4249         * test262/test/language/statements/class/definition/early-errors-class-method-formals-contains-super-call.js: Added.
4250         (Foo.prototype.async.foo):
4251         (Foo):
4252         * test262/test/language/statements/class/definition/methods-async-super-call-body.js: Added.
4253         (A.prototype.async.method):
4254         (A):
4255         (B.prototype.async.method):
4256         (B):
4257         * test262/test/language/statements/class/definition/methods-async-super-call-param.js: Added.
4258         (A.prototype.async.method):
4259         (A):
4260         (B.prototype.async.method):
4261         (B):
4262         * test262/test/language/statements/class/definition/params-trailing-comma-arguments.js: Added.
4263         (C.prototype.f1):
4264         (C.prototype.f2):
4265         (C):
4266         * test262/test/language/statements/class/definition/params-trailing-comma-length.js: Added.
4267         (C.prototype.one):
4268         (C.prototype.two):
4269         (C):
4270         * test262/test/language/statements/class/definition/params-trailing-comma-rest.js: Added.
4271         (C.prototype.m):
4272         (C):
4273         * test262/test/language/statements/class/definition/params-trailing-comma.js: Added.
4274         (C.prototype.one):
4275         (C.prototype.two):
4276         (C):
4277         * test262/test/language/statements/function/arguments-with-arguments-fn.js: Added.
4278         (f):
4279         * test262/test/language/statements/function/arguments-with-arguments-lex.js: Added.
4280         (f):
4281         * test262/test/language/statements/function/params-trailing-comma-arguments.js: Added.
4282         (f1):
4283         (f2):
4284         * test262/test/language/statements/function/params-trailing-comma-length.js: Added.
4285         (one):
4286         (two):
4287         * test262/test/language/statements/function/params-trailing-comma.js: Added.
4288         (one):
4289         (two):
4290         * test262/test/language/statements/generators/arguments-with-arguments-fn.js: Added.
4291         (g):
4292         * test262/test/language/statements/generators/arguments-with-arguments-lex.js: Added.
4293         (g):
4294         * test262/test/language/statements/generators/params-trailing-comma-length.js: Added.
4295         (one):
4296         (two):
4297         * test262/test/language/statements/generators/params-trailing-comma.js: Added.
4298         (one):
4299         (two):
4300         * test262/test262-Revision.txt:
4301
4302 2016-08-23  Benjamin Poulain  <bpoulain@apple.com>
4303