e0f65d0ed3f28fa4da1e9d7765bf0b3abf7e4310
[WebKit-https.git] / JSTests / ChangeLog
1 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
2
3         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
4         https://bugs.webkit.org/show_bug.cgi?id=178592
5
6         Unreviewed test gardening.
7
8         * test262.yaml:
9
10 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
11
12         [FTL] Support NewStringObject
13         https://bugs.webkit.org/show_bug.cgi?id=178737
14
15         Reviewed by Saam Barati.
16
17         * stress/new-string-object.js: Added.
18         (shouldBe):
19         (test):
20
21 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
22
23         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
24         https://bugs.webkit.org/show_bug.cgi?id=178308
25
26         Reviewed by Mark Lam.
27
28         * test262.yaml:
29
30 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
31
32         [JSC] Use fastJoin in Array#toString
33         https://bugs.webkit.org/show_bug.cgi?id=178062
34
35         Reviewed by Darin Adler.
36
37         * microbenchmarks/contiguous-array-to-string.js: Added.
38         (target):
39         * microbenchmarks/double-array-to-string.js: Added.
40         (target):
41         * microbenchmarks/int32-array-to-string.js: Added.
42         (target):
43
44 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
45
46         stress/check-string-ident.js is improperly skipped
47         https://bugs.webkit.org/show_bug.cgi?id=178642
48
49         Reviewed by Saam Barati.
50
51         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
52         since it enforces the run-jsc-stress-tests script to still set up the
53         test to run, despite the skip directive that's used before.
54
55 2017-10-20  Mark Lam  <mark.lam@apple.com>
56
57         Add a test case for r214334.
58         https://bugs.webkit.org/show_bug.cgi?id=169941
59         <rdar://problem/31221258>
60
61         Reviewed by JF Bastien.
62
63         * stress/regress-169941.js: Added.
64
65 2017-10-19  JF Bastien  <jfbastien@apple.com>
66
67         WebAssembly: no VM / JS version of everything but Instance
68         https://bugs.webkit.org/show_bug.cgi?id=177473
69
70         Reviewed by Filip Pizlo, Saam Barati.
71
72         - Exceeding max on memory growth now returns a range error as per
73         spec. This is a (very minor) breaking change: it used to throw OOM
74         error. Update the corresponding test.
75
76         * wasm/js-api/memory-grow.js:
77         (assertEq):
78         * wasm/js-api/table.js:
79         (assert.throws):
80
81 2017-10-19  Mark Lam  <mark.lam@apple.com>
82
83         Stringifier::appendStringifiedValue() is missing an exception check.
84         https://bugs.webkit.org/show_bug.cgi?id=178386
85         <rdar://problem/35027610>
86
87         Reviewed by Saam Barati.
88
89         * stress/regress-178386.js: Added.
90
91 2017-10-19  Michael Saboff  <msaboff@apple.com>
92
93         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
94         https://bugs.webkit.org/show_bug.cgi?id=178521
95
96         Reviewed by JF Bastien.
97
98         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
99         now passes with the current version (5.0) of the Emoji spec.
100
101 2017-10-19  Robin Morisset  <rmorisset@apple.com>
102
103         Turn recursive tail calls into loops
104         https://bugs.webkit.org/show_bug.cgi?id=176601
105
106         Reviewed by Saam Barati.
107
108         Add some simple test that computes factorial in several ways, and other trivial computations.
109         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
110         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
111         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
112         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
113
114         * stress/inline-call-to-recursive-tail-call.js: Added.
115         (factorial.aux):
116         (factorial):
117         (factorial2.aux):
118         (factorial2.id):
119         (factorial2):
120         (factorial3.aux):
121         (factorial3):
122         (aux):
123         (factorial4):
124         (test):
125
126 2017-10-18  Mark Lam  <mark.lam@apple.com>
127
128         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
129         https://bugs.webkit.org/show_bug.cgi?id=177600
130         <rdar://problem/34710985>
131
132         Reviewed by Saam Barati.
133
134         * stress/regress-177600.js: Added.
135
136 2017-10-18  Mark Lam  <mark.lam@apple.com>
137
138         The compiler should always register a structure when it adds its transitionWatchPointSet.
139         https://bugs.webkit.org/show_bug.cgi?id=178420
140         <rdar://problem/34814024>
141
142         Reviewed by Saam Barati and Filip Pizlo.
143
144         * stress/regress-178420.js: Added.
145         (new.Array.10000.map):
146
147 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
148
149         [JSC] __proto__ getter should be fast
150         https://bugs.webkit.org/show_bug.cgi?id=178067
151
152         Reviewed by Saam Barati.
153
154         * stress/dfg-object-proto-accessor.js: Added.
155         (shouldBe):
156         (shouldThrow):
157         (target):
158         * stress/dfg-object-proto-getter.js: Added.
159         (shouldBe):
160         (shouldThrow):
161         (target):
162         * stress/dfg-object-prototype-of.js: Added.
163         (shouldBe):
164         (shouldThrow):
165         (target):
166         * stress/dfg-reflect-get-prototype-of.js: Added.
167         (shouldBe):
168         (shouldThrow):
169         (target):
170         * stress/intrinsic-getter-with-poly-proto.js: Added.
171         (shouldBe):
172         (makePolyProtoObject.foo.C):
173         (makePolyProtoObject.foo):
174         (makePolyProtoObject):
175         (target):
176         * stress/object-get-prototype-of-filtered.js: Added.
177         (shouldBe):
178         (shouldThrow):
179         (target):
180         (i.Cocoa):
181         * stress/object-get-prototype-of-mono-proto.js: Added.
182         (shouldBe):
183         (makePolyProtoObject.foo.C):
184         (makePolyProtoObject.foo):
185         (makePolyProtoObject):
186         (target):
187         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
188         (shouldBe):
189         (makePolyProtoObject.foo.C):
190         (makePolyProtoObject.foo):
191         (makePolyProtoObject):
192         (target):
193         * stress/object-get-prototype-of-poly-proto.js: Added.
194         (shouldBe):
195         (makePolyProtoObject.foo.C):
196         (makePolyProtoObject.foo):
197         (makePolyProtoObject):
198         (target):
199         * stress/object-proto-getter-filtered.js: Added.
200         (shouldBe):
201         (shouldThrow):
202         (target):
203         (i.Cocoa):
204         * stress/object-proto-getter-poly-mono-proto.js: Added.
205         (shouldBe):
206         (makePolyProtoObject.foo.C):
207         (makePolyProtoObject.foo):
208         (makePolyProtoObject):
209         (target):
210         * stress/object-proto-getter-poly-proto.js: Added.
211         (shouldBe):
212         (makePolyProtoObject.foo.C):
213         (makePolyProtoObject.foo):
214         (makePolyProtoObject):
215         (target):
216         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
217         * stress/string-proto.js: Added.
218         (shouldBe):
219         (target):
220
221 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
222
223         Unreviewed, rolling out r223523.
224
225         A test for this change is failing on debug JSC bots.
226
227         Reverted changeset:
228
229         "[JSC] __proto__ getter should be fast"
230         https://bugs.webkit.org/show_bug.cgi?id=178067
231         https://trac.webkit.org/changeset/223523
232
233 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
234
235         [JSC] __proto__ getter should be fast
236         https://bugs.webkit.org/show_bug.cgi?id=178067
237
238         Reviewed by Saam Barati.
239
240         * stress/dfg-object-proto-accessor.js: Added.
241         (shouldBe):
242         (shouldThrow):
243         (target):
244         * stress/dfg-object-proto-getter.js: Added.
245         (shouldBe):
246         (shouldThrow):
247         (target):
248         * stress/dfg-object-prototype-of.js: Added.
249         (shouldBe):
250         (shouldThrow):
251         (target):
252         * stress/dfg-reflect-get-prototype-of.js: Added.
253         (shouldBe):
254         (shouldThrow):
255         (target):
256         * stress/object-get-prototype-of-filtered.js: Added.
257         (shouldBe):
258         (shouldThrow):
259         (target):
260         (i.Cocoa):
261         * stress/object-get-prototype-of-mono-proto.js: Added.
262         (shouldBe):
263         (makePolyProtoObject.foo.C):
264         (makePolyProtoObject.foo):
265         (makePolyProtoObject):
266         (target):
267         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
268         (shouldBe):
269         (makePolyProtoObject.foo.C):
270         (makePolyProtoObject.foo):
271         (makePolyProtoObject):
272         (target):
273         * stress/object-get-prototype-of-poly-proto.js: Added.
274         (shouldBe):
275         (makePolyProtoObject.foo.C):
276         (makePolyProtoObject.foo):
277         (makePolyProtoObject):
278         (target):
279         * stress/object-proto-getter-filtered.js: Added.
280         (shouldBe):
281         (shouldThrow):
282         (target):
283         (i.Cocoa):
284         * stress/object-proto-getter-poly-mono-proto.js: Added.
285         (shouldBe):
286         (makePolyProtoObject.foo.C):
287         (makePolyProtoObject.foo):
288         (makePolyProtoObject):
289         (target):
290         * stress/object-proto-getter-poly-proto.js: Added.
291         (shouldBe):
292         (makePolyProtoObject.foo.C):
293         (makePolyProtoObject.foo):
294         (makePolyProtoObject):
295         (target):
296         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
297         * stress/string-proto.js: Added.
298         (shouldBe):
299         (target):
300
301 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
302
303         Reland "Add Above/Below comparisons for UInt32 patterns"
304         https://bugs.webkit.org/show_bug.cgi?id=177281
305
306         Reviewed by Saam Barati.
307
308         * stress/uint32-comparison-jump.js: Added.
309         (shouldBe):
310         (above):
311         (aboveOrEqual):
312         (below):
313         (belowOrEqual):
314         (notAbove):
315         (notAboveOrEqual):
316         (notBelow):
317         (notBelowOrEqual):
318         * stress/uint32-comparison.js: Added.
319         (shouldBe):
320         (above):
321         (aboveOrEqual):
322         (below):
323         (belowOrEqual):
324         (aboveTest):
325         (aboveOrEqualTest):
326         (belowTest):
327         (belowOrEqualTest):
328
329 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
330
331         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
332         https://bugs.webkit.org/show_bug.cgi?id=178210
333
334         Reviewed by Saam Barati.
335
336         * wasm/function-tests/trap-from-start-async.js:
337         (async.StartTrapsAsync):
338         * wasm/function-tests/trap-from-start.js:
339         (StartTraps):
340         * wasm/js-api/web-assembly-function.js:
341         (assert.eq.Object.getPrototypeOf):
342         * wasm/js-api/wrapper-function.js:
343         (return.new.WebAssembly.Module):
344         (assert.throws.makeInstance): Deleted.
345         (assert.throws.Bar): Deleted.
346         (assert.throws): Deleted.
347
348 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
349
350         Enable gigacage on iOS
351         https://bugs.webkit.org/show_bug.cgi?id=177586
352
353         Reviewed by JF Bastien.
354         
355         Add tests for when Gigacage gets runtime disabled.
356
357         * stress/disable-gigacage-arrays.js: Added.
358         (foo):
359         * stress/disable-gigacage-strings.js: Added.
360         (foo):
361         * stress/disable-gigacage-typed-arrays.js: Added.
362         (foo):
363
364 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
365
366         import.meta should not be assignable
367         https://bugs.webkit.org/show_bug.cgi?id=178202
368
369         Reviewed by Saam Barati.
370
371         * modules/import-meta-assignment.js: Added.
372         (shouldThrow):
373         (SyntaxError.import.meta.can.shouldThrow):
374
375 2017-10-11  Saam Barati  <sbarati@apple.com>
376
377         Unreviewed. Actually skip certain type profiler tests in debug.
378
379         * typeProfiler.yaml:
380         * typeProfiler/deltablue-for-of.js:
381         * typeProfiler/getter-richards.js:
382
383 2017-10-11  Commit Queue  <commit-queue@webkit.org>
384
385         Unreviewed, rolling out r223113 and r223121.
386         https://bugs.webkit.org/show_bug.cgi?id=178182
387
388         Reintroduced 20% regression on Kraken (Requested by rniwa on
389         #webkit).
390
391         Reverted changesets:
392
393         "Enable gigacage on iOS"
394         https://bugs.webkit.org/show_bug.cgi?id=177586
395         https://trac.webkit.org/changeset/223113
396
397         "Use one virtual allocation for all gigacages and their
398         runways"
399         https://bugs.webkit.org/show_bug.cgi?id=178050
400         https://trac.webkit.org/changeset/223121
401
402 2017-10-11  Michael Saboff  <msaboff@apple.com>
403
404         Disable test262 named capture group tests with direct unicode names and with references before definitions
405         https://bugs.webkit.org/show_bug.cgi?id=178177
406
407         Reviewed by Keith Miller.
408
409         Bugs to track fixing these test are:
410         https://bugs.webkit.org/show_bug.cgi?id=178174 -
411             "Add support in named capture group identifiers for direct surrogate pairs"
412         https://bugs.webkit.org/show_bug.cgi?id=178175 -
413             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
414
415         * test262.yaml:
416
417 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
418
419         Object properties are undefined in super.call() but not in this.call()
420         https://bugs.webkit.org/show_bug.cgi?id=177230
421
422         Reviewed by Saam Barati.
423
424         * stress/super-call-function-subclass.js: Added.
425         (assert):
426         (A.prototype.t):
427         (A):
428         * stress/super-dot-call-and-apply.js: Added.
429         (assert):
430         (A):
431         (A.prototype.call):
432         (A.prototype.apply):
433         (B.prototype.testSuper):
434         (B):
435         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
436         (D.prototype.testSuper):
437         (D):
438
439 2017-10-10  Saam Barati  <sbarati@apple.com>
440
441         The prototype cache should be aware of the Executable it generates a Structure for
442         https://bugs.webkit.org/show_bug.cgi?id=177907
443
444         Reviewed by Filip Pizlo.
445
446         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
447         (assert):
448         (foo.C):
449         (foo):
450         (bar.C):
451         (bar):
452         (access):
453         (makeLongChain):
454         (accessY):
455
456 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
457
458         `async` should be able to be used as an imported binding name
459         https://bugs.webkit.org/show_bug.cgi?id=176573
460
461         Reviewed by Saam Barati.
462
463         * modules/import-default-async.js: Added.
464         * modules/import-named-async-as.js: Added.
465         * modules/import-named-async.js: Added.
466         * modules/import-named-async/target.js: Added.
467         * modules/import-namespace-async.js: Added.
468         * test262.yaml:
469
470 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
471
472         Enable gigacage on iOS
473         https://bugs.webkit.org/show_bug.cgi?id=177586
474
475         Reviewed by JF Bastien.
476         
477         Add tests for when Gigacage gets runtime disabled.
478
479         * stress/disable-gigacage-arrays.js: Added.
480         (foo):
481         * stress/disable-gigacage-strings.js: Added.
482         (foo):
483         * stress/disable-gigacage-typed-arrays.js: Added.
484         (foo):
485
486 2017-10-09  Michael Saboff  <msaboff@apple.com>
487
488         Implement RegExp Unicode property escapes
489         https://bugs.webkit.org/show_bug.cgi?id=172069
490
491         Reviewed by JF Bastien.
492
493         Enabled Unicode Property tests.
494
495         * test262.yaml:
496
497 2017-10-09  Commit Queue  <commit-queue@webkit.org>
498
499         Unreviewed, rolling out r223015 and r223025.
500         https://bugs.webkit.org/show_bug.cgi?id=178093
501
502         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
503         #webkit).
504
505         Reverted changesets:
506
507         "Enable gigacage on iOS"
508         https://bugs.webkit.org/show_bug.cgi?id=177586
509         http://trac.webkit.org/changeset/223015
510
511         "Unreviewed, disable Gigacage on ARM64 Linux"
512         https://bugs.webkit.org/show_bug.cgi?id=177586
513         http://trac.webkit.org/changeset/223025
514
515 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
516
517         Update expectations for test262 tests that pass after r223043.
518         https://bugs.webkit.org/show_bug.cgi?id=176685
519
520         Unreviewed test gardening.
521
522         * test262.yaml:
523
524 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
525
526         Unreviewed, rolling out r223022.
527
528         This change introduced 18 test262 failures.
529
530         Reverted changeset:
531
532         "`async` should be able to be used as an imported binding
533         name"
534         https://bugs.webkit.org/show_bug.cgi?id=176573
535         http://trac.webkit.org/changeset/223022
536
537 2017-10-09  Saam Barati  <sbarati@apple.com>
538
539         3 poly-proto JSC tests timing out on debug after r222827
540         https://bugs.webkit.org/show_bug.cgi?id=177880
541         <rdar://problem/34817122>
542
543         Unreviewed.
544
545         I'm skipping these type profiler tests on debug since they are long running.
546
547         * typeProfiler/deltablue-for-of.js:
548         * typeProfiler/getter-richards.js:
549
550 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
551
552         Safari 10 /11 problem with if (!await get(something)).
553         https://bugs.webkit.org/show_bug.cgi?id=176685
554
555         Reviewed by Saam Barati.
556
557         * stress/async-await-basic.js:
558         (awaitEpression.async):
559         * stress/async-await-syntax.js:
560         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
561         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
562
563 2017-10-08  Saam Barati  <sbarati@apple.com>
564
565         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
566
567         * typeProfiler/deltablue-for-of.js:
568         * typeProfiler/getter-richards.js:
569
570 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
571
572         `async` should be able to be used as an imported binding name
573         https://bugs.webkit.org/show_bug.cgi?id=176573
574
575         Reviewed by Darin Adler.
576
577         * modules/import-default-async.js: Added.
578         * modules/import-named-async-as.js: Added.
579         * modules/import-named-async.js: Added.
580         * modules/import-named-async/target.js: Added.
581         * modules/import-namespace-async.js: Added.
582
583 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
584
585         Enable gigacage on iOS
586         https://bugs.webkit.org/show_bug.cgi?id=177586
587
588         Reviewed by JF Bastien.
589         
590         Add tests for when Gigacage gets runtime disabled.
591
592         * stress/disable-gigacage-arrays.js: Added.
593         (foo):
594         * stress/disable-gigacage-strings.js: Added.
595         (foo):
596         * stress/disable-gigacage-typed-arrays.js: Added.
597         (foo):
598
599 2017-10-06  Commit Queue  <commit-queue@webkit.org>
600
601         Unreviewed, rolling out r222791 and r222873.
602         https://bugs.webkit.org/show_bug.cgi?id=178031
603
604         Caused crashes with workers/wasm LayoutTests (Requested by
605         ryanhaddad on #webkit).
606
607         Reverted changesets:
608
609         "WebAssembly: no VM / JS version of everything but Instance"
610         https://bugs.webkit.org/show_bug.cgi?id=177473
611         http://trac.webkit.org/changeset/222791
612
613         "WebAssembly: address no VM / JS follow-ups"
614         https://bugs.webkit.org/show_bug.cgi?id=177887
615         http://trac.webkit.org/changeset/222873
616
617 2017-10-05  Saam Barati  <sbarati@apple.com>
618
619         Make sure all prototypes under poly proto get added into the VM's prototype map
620         https://bugs.webkit.org/show_bug.cgi?id=177909
621
622         Reviewed by Keith Miller.
623
624         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
625         (assert):
626         (foo.C):
627         (foo):
628         (set x):
629
630 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
631
632         [JSC] Introduce import.meta
633         https://bugs.webkit.org/show_bug.cgi?id=177703
634
635         Reviewed by Filip Pizlo.
636
637         * modules/import-meta-syntax.js: Added.
638         (shouldThrow):
639         (shouldNotThrow):
640         * modules/import-meta.js: Added.
641         * modules/import-meta/cocoa.js: Added.
642         * modules/resources/assert.js:
643         (export.shouldNotThrow):
644         * stress/import-syntax.js:
645
646 2017-10-04  Saam Barati  <sbarati@apple.com>
647
648         Make pertinent AccessCases watch the poly proto watchpoint
649         https://bugs.webkit.org/show_bug.cgi?id=177765
650
651         Reviewed by Keith Miller.
652
653         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
654         (assert):
655         (foo.C):
656         (foo):
657         (validate):
658         * stress/poly-proto-clear-stub.js: Added.
659         (assert):
660         (foo.C):
661         (foo):
662
663 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
664
665         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
666
667         Unreviewed test gardening.
668
669         * test262.yaml:
670
671 2017-10-04  Saam Barati  <sbarati@apple.com>
672
673         3 poly-proto JSC tests timing out on debug after r222827
674         https://bugs.webkit.org/show_bug.cgi?id=177880
675
676         Rubber stamped by Mark Lam.
677
678         * microbenchmarks/poly-proto-access.js:
679         * typeProfiler/deltablue-for-of.js:
680         * typeProfiler/getter-richards.js:
681
682 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
683
684         Unreviewed, marking tco-catch.js as a failure after test262 update
685         https://bugs.webkit.org/show_bug.cgi?id=177859
686
687         * test262.yaml:
688
689 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
690
691         Unreviewed, marking one async iterator test262 test failed
692         https://bugs.webkit.org/show_bug.cgi?id=177859
693
694         * test262.yaml:
695
696 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
697
698         [Test262] Update Test262 to Oct 4 version
699         https://bugs.webkit.org/show_bug.cgi?id=177859
700
701         Reviewed by Sam Weinig.
702
703         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
704         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
705
706         * test262.yaml:
707         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
708         (checkSequence):
709         * test262/harness/typeCoercion.js:
710         (testCoercibleToIndexZero):
711         (testCoercibleToIndexOne):
712         (testCoercibleToIndexFromIndex):
713         (testNotCoercibleToIndex.testPrimitiveValue):
714         (testNotCoercibleToInteger):
715         (testCoercibleToBigIntZero.testPrimitiveValue):
716         (testCoercibleToBigIntZero):
717         (testCoercibleToBigIntOne.testPrimitiveValue):
718         (testCoercibleToBigIntOne):
719         (testPrimitiveValue):
720         (testCoercibleToBigIntFromBigInt):
721         (testNotCoercibleToBigInt.testPrimitiveValue):
722         (testNotCoercibleToBigInt.testStringValue):
723         (testNotCoercibleToBigInt):
724         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
725         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
726         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
727         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
728         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
729         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
730         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
731         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
732         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
733         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
734         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
735         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
736         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
737         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
738         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
739         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
740         (testCoercibleToBigIntZero):
741         (testCoercibleToBigIntOne):
742         (testNotCoercibleToBigInt):
743         (MyError): Deleted.
744         (valueOf): Deleted.
745         (toString): Deleted.
746         (Symbol.toPrimitive): Deleted.
747         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
748         (testCoercibleToIndexZero):
749         (testCoercibleToIndexOne):
750         (testNotCoercibleToIndex):
751         (MyError): Deleted.
752         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
753         (assert.sameValue.BigInt.asIntN.toString): Deleted.
754         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
755         (BigInt.asIntN.valueOf): Deleted.
756         (BigInt.asIntN.toString): Deleted.
757         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
758         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
759         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
760         (testCoercibleToBigIntZero):
761         (testCoercibleToBigIntOne):
762         (testNotCoercibleToBigInt):
763         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
764         (testCoercibleToIndexZero):
765         (testCoercibleToIndexOne):
766         (testNotCoercibleToIndex):
767         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
768         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
769         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
770         (bits.valueOf):
771         (bigint.valueOf):
772         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
773         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
774         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
775         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
776         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
777         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
778         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
779         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
780         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
781         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
782         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
783         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
784         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
785         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
786         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
787         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
788         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
789         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
790         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
791         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
792         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
793         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
794         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
795         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
796         (replacer):
797         (BigInt.prototype.toJSON):
798         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
799         (replacer):
800         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
801         (BigInt.prototype.toJSON):
802         * test262/test/built-ins/JSON/stringify/bigint.js:
803         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
804         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
805         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
806         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
807         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
808         * test262/test/built-ins/Object/proto-from-ctor.js:
809         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
810         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
811         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
812         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
813         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
814         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
815         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
816         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
817         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
818         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
819         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
820         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
821         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
822         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
823         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
824         * test262/test/built-ins/Proxy/get-fn-realm.js:
825         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
826         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
827         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
828         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
829         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
830         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
831         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
832         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
833         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
834         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
835         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
836         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
837         (i6.replace):
838         (i6b.replace):
839         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
840         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
841         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
842         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
843         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
844         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
845         * test262/test/built-ins/RegExp/u180e.js: Added.
846         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
847         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
848         * test262/test/built-ins/String/proto-from-ctor-realm.js:
849         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
850         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
851         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
852         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
853         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
854         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
855         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
856         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
857         * test262/test/built-ins/String/prototype/endsWith/length.js:
858         * test262/test/built-ins/String/prototype/endsWith/name.js:
859         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
860         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
861         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
862         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
863         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
864         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
865         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
866         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
867         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
868         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
869         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
870         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
871         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
872         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
873         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
874         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
875         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
876         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
877         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
878         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
879         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
880         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
881         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
882         * test262/test/built-ins/String/prototype/includes/includes.js:
883         * test262/test/built-ins/String/prototype/includes/length.js:
884         * test262/test/built-ins/String/prototype/includes/name.js:
885         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
886         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
887         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
888         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
889         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
890         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
891         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
892         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
893         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
894         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
895         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
896         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
897         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
898         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
899         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
900         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
901         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
902         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
903         * test262/test/built-ins/String/prototype/trim/u180e.js:
904         * test262/test/built-ins/Symbol/for/cross-realm.js:
905         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
906         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
907         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
908         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
909         * test262/test/built-ins/Symbol/match/cross-realm.js:
910         * test262/test/built-ins/Symbol/replace/cross-realm.js:
911         * test262/test/built-ins/Symbol/search/cross-realm.js:
912         * test262/test/built-ins/Symbol/species/cross-realm.js:
913         * test262/test/built-ins/Symbol/split/cross-realm.js:
914         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
915         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
916         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
917         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
918         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
919         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
920         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
921         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
922         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
923         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
924         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
925         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
926         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
927         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
928         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
929         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
930         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
931         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
932         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
933         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
934         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
935         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
936         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
937         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
938         * test262/test/language/comments/mongolian-vowel-separator-single.js:
939         * test262/test/language/eval-code/indirect/realm.js:
940         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
941         (o.get z):
942         (o.get a):
943         * test262/test/language/expressions/call/eval-realm-indirect.js:
944         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
945         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
946         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
947         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
948         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
949         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
950         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
951         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
952         * test262/test/language/expressions/greater-than/bigint-and-number.js:
953         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
954         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
955         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
956         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
957         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
958         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
959         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
960         * test262/test/language/expressions/less-than/bigint-and-number.js:
961         * test262/test/language/expressions/new/non-ctor-err-realm.js:
962         * test262/test/language/expressions/super/realm.js:
963         * test262/test/language/expressions/tagged-template/cache-realm.js:
964         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
965         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
966         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
967         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
968         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
969         * test262/test/language/literals/string/mongolian-vowel-separator.js:
970         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
971         (o.get z):
972         (o.get a):
973         * test262/test/language/statements/for-of/iterator-next-reference.js:
974         (next):
975         (iterator.next): Deleted.
976         (x.of.iterable.): Deleted.
977         (x.of.iterable.get return): Deleted.
978         (x.of.iterable.iterator.next): Deleted.
979         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
980         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
981         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
982         * test262/test/language/white-space/mongolian-vowel-separator.js:
983         * test262/test262-Revision.txt:
984
985 2017-10-03  Saam Barati  <sbarati@apple.com>
986
987         Implement polymorphic prototypes
988         https://bugs.webkit.org/show_bug.cgi?id=176391
989
990         Reviewed by Filip Pizlo.
991
992         * microbenchmarks/poly-proto-access.js: Added.
993         (assert):
994         (foo.C):
995         (foo.C.prototype.get bar):
996         (foo):
997         (bar):
998         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
999         (assert):
1000         (makePolyProtoObject.foo.C):
1001         (makePolyProtoObject.foo):
1002         (makePolyProtoObject):
1003         (performSet):
1004         * microbenchmarks/poly-proto-setter-speed.js: Added.
1005         (assert):
1006         (makePolyProtoObject.foo.C):
1007         (makePolyProtoObject.foo.C.prototype.set p):
1008         (makePolyProtoObject.foo):
1009         (makePolyProtoObject):
1010         (performSet):
1011         * stress/constructor-with-return.js:
1012         (i.tests.forEach.Constructor):
1013         (i.tests.forEach):
1014         (tests.forEach.Constructor): Deleted.
1015         (tests.forEach): Deleted.
1016         * stress/dom-jit-with-poly-proto.js: Added.
1017         (assert):
1018         (makePolyProtoObject.foo.C):
1019         (makePolyProtoObject.foo):
1020         (makePolyProtoObject):
1021         (validate):
1022         * stress/poly-proto-custom-value-and-accessor.js: Added.
1023         (assert):
1024         (makePolyProtoObject.foo.C):
1025         (makePolyProtoObject.foo):
1026         (makePolyProtoObject):
1027         (items.forEach):
1028         (set get for):
1029         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
1030         (assert):
1031         (makePolyProtoObject.foo.C):
1032         (makePolyProtoObject.foo):
1033         (makePolyProtoObject):
1034         (foo):
1035         * stress/poly-proto-miss.js: Added.
1036         (makePolyProtoInstanceWithNullPrototype.foo.C):
1037         (makePolyProtoInstanceWithNullPrototype.foo):
1038         (makePolyProtoInstanceWithNullPrototype):
1039         (assert):
1040         (validate):
1041         * stress/poly-proto-op-in-caching.js: Added.
1042         (assert):
1043         (makePolyProtoObject.foo.C):
1044         (makePolyProtoObject.foo):
1045         (makePolyProtoObject):
1046         (validate):
1047         (validate2):
1048         * stress/poly-proto-put-transition.js: Added.
1049         (assert):
1050         (makePolyProtoObject.foo.C):
1051         (makePolyProtoObject.foo):
1052         (makePolyProtoObject):
1053         (performSet):
1054         (i.obj.__proto__.set p):
1055         * stress/poly-proto-set-prototype.js: Added.
1056         (assert):
1057         (let.alternateProto.get x):
1058         (let.alternateProto2.get y):
1059         (let.alternateProto2.get x):
1060         (foo.C):
1061         (foo):
1062         (validate):
1063         * stress/poly-proto-setter.js: Added.
1064         (assert):
1065         (makePolyProtoObject.foo.C):
1066         (makePolyProtoObject.foo.C.prototype.set p):
1067         (makePolyProtoObject.foo.C.prototype.get p):
1068         (makePolyProtoObject.foo):
1069         (makePolyProtoObject):
1070         (performSet):
1071         * stress/poly-proto-using-inheritance.js: Added.
1072         (assert):
1073         (foo.C):
1074         (foo.C.prototype.get baz):
1075         (foo):
1076         (bar.C):
1077         (bar):
1078         (validate):
1079         * stress/primitive-poly-proto.js: Added.
1080         (makePolyProtoInstance.foo.C):
1081         (makePolyProtoInstance.foo):
1082         (makePolyProtoInstance):
1083         (assert):
1084         (validate):
1085         * stress/prototype-is-not-js-object.js: Added.
1086         (foo.bar):
1087         (foo):
1088         (assert):
1089         (validate):
1090         * stress/try-get-by-id-poly-proto.js: Added.
1091         (assert):
1092         (makePolyProtoObject.foo.C):
1093         (makePolyProtoObject.foo):
1094         (makePolyProtoObject):
1095         (tryGetByIdText):
1096         (x.__proto__.get bar):
1097         (validate):
1098         * typeProfiler/overflow.js:
1099
1100 2017-10-03  JF Bastien  <jfbastien@apple.com>
1101
1102         WebAssembly: no VM / JS version of everything but Instance
1103         https://bugs.webkit.org/show_bug.cgi?id=177473
1104
1105         Reviewed by Filip Pizlo.
1106
1107         - Exceeding max on memory growth now returns a range error as per
1108         spec. This is a (very minor) breaking change: it used to throw OOM
1109         error. Update the corresponding test.
1110
1111         * wasm/js-api/memory-grow.js:
1112         (assertEq):
1113         * wasm/js-api/table.js:
1114         (assert.throws):
1115
1116 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
1117
1118         Skip JSC test stress/regress-159779-2.js on debug.
1119         https://bugs.webkit.org/show_bug.cgi?id=177204
1120
1121         Unreviewed test gardening.
1122
1123         * stress/regress-159779-2.js:
1124
1125 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
1126
1127         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
1128         https://bugs.webkit.org/show_bug.cgi?id=175642
1129
1130         Reviewed by Darin Adler.
1131
1132         * ChakraCore/test/Function/apply3.baseline-jsc:
1133
1134 2017-10-01  Commit Queue  <commit-queue@webkit.org>
1135
1136         Unreviewed, rolling out r222564.
1137         https://bugs.webkit.org/show_bug.cgi?id=177720
1138
1139         "It regressed JetStream by 2% on iOS caused by a 50%
1140         regression on the bigfib subtest" (Requested by saamyjoon on
1141         #webkit).
1142
1143         Reverted changeset:
1144
1145         "Add Above/Below comparisons for UInt32 patterns"
1146         https://bugs.webkit.org/show_bug.cgi?id=177281
1147         http://trac.webkit.org/changeset/222564
1148
1149 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1150
1151         [DFG] Support ArrayPush with multiple args
1152         https://bugs.webkit.org/show_bug.cgi?id=175823
1153
1154         Reviewed by Saam Barati.
1155
1156         * microbenchmarks/array-push-0.js: Added.
1157         (arrayPush0):
1158         * microbenchmarks/array-push-1.js: Added.
1159         (arrayPush1):
1160         * microbenchmarks/array-push-2.js: Added.
1161         (arrayPush2):
1162         * microbenchmarks/array-push-3.js: Added.
1163         (arrayPush3):
1164         * stress/array-push-multiple-contiguous.js: Added.
1165         (shouldBe):
1166         (test):
1167         * stress/array-push-multiple-double-nan.js: Added.
1168         (shouldBe):
1169         (test):
1170         * stress/array-push-multiple-double.js: Added.
1171         (shouldBe):
1172         (test):
1173         * stress/array-push-multiple-int32.js: Added.
1174         (shouldBe):
1175         (test):
1176         * stress/array-push-multiple-many-contiguous.js: Added.
1177         (shouldBe):
1178         (test):
1179         * stress/array-push-multiple-many-double.js: Added.
1180         (shouldBe):
1181         (test):
1182         * stress/array-push-multiple-many-int32.js: Added.
1183         (shouldBe):
1184         (test):
1185         * stress/array-push-multiple-many-storage.js: Added.
1186         (shouldBe):
1187         (test):
1188         * stress/array-push-multiple-storage.js: Added.
1189         (shouldBe):
1190         (test):
1191         * stress/array-push-with-force-exit.js: Added.
1192         (target.createBuiltin):
1193
1194 2017-09-29  Saam Barati  <sbarati@apple.com>
1195
1196         Custom GetterSetterAccessCase does not use the correct slotBase when making call
1197         https://bugs.webkit.org/show_bug.cgi?id=177639
1198
1199         Reviewed by Geoffrey Garen.
1200
1201         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
1202         (assert):
1203         (Class):
1204         (items.forEach):
1205         (set get for):
1206
1207 2017-09-29  Commit Queue  <commit-queue@webkit.org>
1208
1209         Unreviewed, rolling out r222563, r222565, and r222581.
1210         https://bugs.webkit.org/show_bug.cgi?id=177675
1211
1212         "It causes a crash when playing youtube videos" (Requested by
1213         saamyjoon on #webkit).
1214
1215         Reverted changesets:
1216
1217         "[DFG] Support ArrayPush with multiple args"
1218         https://bugs.webkit.org/show_bug.cgi?id=175823
1219         http://trac.webkit.org/changeset/222563
1220
1221         "Unreviewed, build fix after r222563"
1222         https://bugs.webkit.org/show_bug.cgi?id=175823
1223         http://trac.webkit.org/changeset/222565
1224
1225         "Unreviewed, fix x86 breaking due to exhausted registers"
1226         https://bugs.webkit.org/show_bug.cgi?id=175823
1227         http://trac.webkit.org/changeset/222581
1228
1229 2017-09-28  Mark Lam  <mark.lam@apple.com>
1230
1231         test262: Unexpected passes after r222617 and r222618.
1232         https://bugs.webkit.org/show_bug.cgi?id=177622
1233         <rdar://problem/34725960>
1234
1235         Reviewed by Saam Barati.
1236
1237         Update test262.yaml for tests that are now passing.
1238
1239         * test262.yaml:
1240
1241 2017-09-27  Michael Saboff  <msaboff@apple.com>
1242
1243         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
1244         https://bugs.webkit.org/show_bug.cgi?id=177570
1245
1246         Reviewed by Filip Pizlo.
1247
1248         New regression test.
1249
1250         * stress/regress-177570.js: Added.
1251
1252 2017-09-28  Michael Saboff  <msaboff@apple.com>
1253
1254         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
1255         https://bugs.webkit.org/show_bug.cgi?id=177423
1256
1257         Reviewed by Mark Lam.
1258
1259         Updated regression test.
1260
1261         * stress/regress-177423.js:
1262         (catch):
1263
1264 2017-09-27  Mark Lam  <mark.lam@apple.com>
1265
1266         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
1267         https://bugs.webkit.org/show_bug.cgi?id=177584
1268         <rdar://problem/34463903>
1269
1270         Reviewed by Saam Barati.
1271
1272         * stress/regress-177584.js: Added.
1273         (assertEqual):
1274         (Array.prototype.Symbol.species):
1275
1276 2017-09-27  Saam Barati  <sbarati@apple.com>
1277
1278         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
1279         https://bugs.webkit.org/show_bug.cgi?id=177523
1280
1281         Reviewed by Mark Lam.
1282
1283         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
1284         (assert):
1285         (Test):
1286         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
1287         (addMethods):
1288         (i.Test.prototype.propName):
1289
1290 2017-09-27  Mark Lam  <mark.lam@apple.com>
1291
1292         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
1293         https://bugs.webkit.org/show_bug.cgi?id=177423
1294         <rdar://problem/34621320>
1295
1296         Reviewed by Keith Miller.
1297
1298         * stress/regress-177423.js: Added.
1299
1300 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1301
1302         Add Above/Below comparisons for UInt32 patterns
1303         https://bugs.webkit.org/show_bug.cgi?id=177281
1304
1305         Reviewed by Saam Barati.
1306
1307         * stress/uint32-comparison-jump.js: Added.
1308         (shouldBe):
1309         (above):
1310         (aboveOrEqual):
1311         (below):
1312         (belowOrEqual):
1313         (notAbove):
1314         (notAboveOrEqual):
1315         (notBelow):
1316         (notBelowOrEqual):
1317         * stress/uint32-comparison.js: Added.
1318         (shouldBe):
1319         (above):
1320         (aboveOrEqual):
1321         (below):
1322         (belowOrEqual):
1323         (aboveTest):
1324         (aboveOrEqualTest):
1325         (belowTest):
1326         (belowOrEqualTest):
1327
1328 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
1329
1330         [DFG] Support ArrayPush with multiple args
1331         https://bugs.webkit.org/show_bug.cgi?id=175823
1332
1333         Reviewed by Saam Barati.
1334
1335         * microbenchmarks/array-push-0.js: Added.
1336         (arrayPush0):
1337         * microbenchmarks/array-push-1.js: Added.
1338         (arrayPush1):
1339         * microbenchmarks/array-push-2.js: Added.
1340         (arrayPush2):
1341         * microbenchmarks/array-push-3.js: Added.
1342         (arrayPush3):
1343         * stress/array-push-multiple-contiguous.js: Added.
1344         (shouldBe):
1345         (test):
1346         * stress/array-push-multiple-double-nan.js: Added.
1347         (shouldBe):
1348         (test):
1349         * stress/array-push-multiple-double.js: Added.
1350         (shouldBe):
1351         (test):
1352         * stress/array-push-multiple-int32.js: Added.
1353         (shouldBe):
1354         (test):
1355         * stress/array-push-multiple-many-contiguous.js: Added.
1356         (shouldBe):
1357         (test):
1358         * stress/array-push-multiple-many-double.js: Added.
1359         (shouldBe):
1360         (test):
1361         * stress/array-push-multiple-many-int32.js: Added.
1362         (shouldBe):
1363         (test):
1364         * stress/array-push-multiple-many-storage.js: Added.
1365         (shouldBe):
1366         (test):
1367         * stress/array-push-multiple-storage.js: Added.
1368         (shouldBe):
1369         (test):
1370
1371 2017-09-26  Commit Queue  <commit-queue@webkit.org>
1372
1373         Unreviewed, rolling out r222518.
1374         https://bugs.webkit.org/show_bug.cgi?id=177507
1375
1376         Break the High Sierra build (Requested by yusukesuzuki on
1377         #webkit).
1378
1379         Reverted changeset:
1380
1381         "Add Above/Below comparisons for UInt32 patterns"
1382         https://bugs.webkit.org/show_bug.cgi?id=177281
1383         http://trac.webkit.org/changeset/222518
1384
1385 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1386
1387         Add Above/Below comparisons for UInt32 patterns
1388         https://bugs.webkit.org/show_bug.cgi?id=177281
1389
1390         Reviewed by Saam Barati.
1391
1392         * stress/uint32-comparison-jump.js: Added.
1393         (shouldBe):
1394         (above):
1395         (aboveOrEqual):
1396         (below):
1397         (belowOrEqual):
1398         (notAbove):
1399         (notAboveOrEqual):
1400         (notBelow):
1401         (notBelowOrEqual):
1402         * stress/uint32-comparison.js: Added.
1403         (shouldBe):
1404         (above):
1405         (aboveOrEqual):
1406         (below):
1407         (belowOrEqual):
1408         (aboveTest):
1409         (aboveOrEqualTest):
1410         (belowTest):
1411         (belowOrEqualTest):
1412
1413 2017-09-23  Keith Miller  <keith_miller@apple.com>
1414
1415         Fix infinite looping test262 test
1416         https://bugs.webkit.org/show_bug.cgi?id=177412
1417
1418         Reviewed by Yusuke Suzuki.
1419
1420         This test was poorly designed since failing it would cause the vm
1421         to inifinite loop. I've fixed it locally and will fix it on github pending
1422         the results of next weeks tc39 meeting.
1423
1424         * test262.yaml:
1425         * test262/test/language/statements/for-of/iterator-next-reference.js:
1426
1427 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
1428
1429         test262: $.agent became $262.agent in test262 update
1430         https://bugs.webkit.org/show_bug.cgi?id=177407
1431
1432         Reviewed by Yusuke Suzuki.
1433
1434         * test262.yaml:
1435         ~320 tests pass now that we correctly make $262 available.
1436
1437 2017-09-22  Keith Miller  <keith_miller@apple.com>
1438
1439         Speculatively change iteration protocall to use the same next function
1440         https://bugs.webkit.org/show_bug.cgi?id=175653
1441
1442         Reviewed by Saam Barati.
1443
1444         Change test to match the new iteration behavior.
1445
1446         * stress/spread-optimized-properly.js:
1447
1448 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1449
1450         [DFG][FTL] Profile array vector length for array allocation
1451         https://bugs.webkit.org/show_bug.cgi?id=177051
1452
1453         Reviewed by Saam Barati.
1454
1455         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1456         (target):
1457
1458 2017-09-22  Commit Queue  <commit-queue@webkit.org>
1459
1460         Unreviewed, rolling out r222380.
1461         https://bugs.webkit.org/show_bug.cgi?id=177352
1462
1463         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
1464         #webkit).
1465
1466         Reverted changeset:
1467
1468         "[DFG][FTL] Profile array vector length for array allocation"
1469         https://bugs.webkit.org/show_bug.cgi?id=177051
1470         http://trac.webkit.org/changeset/222380
1471
1472 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1473
1474         [DFG][FTL] Profile array vector length for array allocation
1475         https://bugs.webkit.org/show_bug.cgi?id=177051
1476
1477         Reviewed by Saam Barati.
1478
1479         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1480         (target):
1481
1482 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
1483
1484         Skip new hanging test262 tests.
1485         https://bugs.webkit.org/show_bug.cgi?id=177326
1486
1487         Unreviewed test gardening.
1488
1489         * test262.yaml:
1490
1491 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
1492
1493         Mark 6 test262 tests as passing.
1494         https://bugs.webkit.org/show_bug.cgi?id=177307
1495
1496         Unreviewed test gardening.
1497
1498         * test262.yaml:
1499
1500 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
1501
1502         Unreviewed follow-up to r222311.
1503
1504         * test262/harness/sta.js:
1505         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
1506         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
1507         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
1508         * test262/test/built-ins/Array/from/elements-added-after.js:
1509         * test262/test/built-ins/Array/from/elements-deleted-after.js:
1510         * test262/test/built-ins/Array/from/elements-updated-after.js:
1511         * test262/test/built-ins/Array/from/from-array.js:
1512         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
1513         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
1514         * test262/test/built-ins/Array/from/source-array-boundary.js:
1515         * test262/test/built-ins/Array/from/source-object-constructor.js:
1516         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
1517         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
1518         * test262/test/built-ins/Array/from/source-object-length.js:
1519         * test262/test/built-ins/Array/from/source-object-missing.js:
1520         * test262/test/built-ins/Array/from/source-object-without.js:
1521         * test262/test/built-ins/Array/from/this-null.js:
1522         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
1523         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
1524         * test262/test/language/literals/numeric/7.8.3-1gs.js:
1525         * test262/test/language/literals/numeric/7.8.3-2gs.js:
1526         * test262/test/language/literals/numeric/7.8.3-3gs.js:
1527         * test262/test/language/literals/regexp/7.8.5-1gs.js:
1528         * test262/test/language/literals/string/7.8.4-1gs.js:
1529         Fix some files that I failed to update when I applied my patch.
1530
1531 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
1532
1533         Update test262 tests
1534         https://bugs.webkit.org/show_bug.cgi?id=177220
1535
1536         Reviewed by Saam Barati and Yusuke Suzuki.
1537
1538         * test262.yaml:
1539         * test262/test262-Revision.txt:
1540         New rebaselined expectations for all tests.
1541
1542         * test262/*:
1543         Updated.
1544
1545 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
1546
1547         [DFG] Remove ToThis more aggressively
1548         https://bugs.webkit.org/show_bug.cgi?id=177056
1549
1550         Reviewed by Saam Barati.
1551
1552         * stress/generator-with-this-strict.js: Added.
1553         (shouldBe):
1554         (generator):
1555         (target):
1556         * stress/generator-with-this.js: Added.
1557         (shouldBe):
1558         (generator):
1559         (target):
1560
1561 2017-09-17  Michael Saboff  <msaboff@apple.com>
1562
1563         https://bugs.webkit.org/show_bug.cgi?id=177038
1564         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
1565
1566         Reviewed by JF Bastien.
1567
1568         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
1569         as it dies using too much memory.
1570
1571 2017-09-15  Saam Barati  <sbarati@apple.com>
1572
1573         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
1574         https://bugs.webkit.org/show_bug.cgi?id=176981
1575
1576         Reviewed by Yusuke Suzuki.
1577
1578         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
1579         (assert):
1580         (verify):
1581         (func):
1582         (const.bar.createBuiltin):
1583
1584 2017-09-14  Saam Barati  <sbarati@apple.com>
1585
1586         It should be valid to exit before each set when doing arity fixup when inlining
1587         https://bugs.webkit.org/show_bug.cgi?id=176948
1588
1589         Reviewed by Keith Miller.
1590
1591         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
1592         (baz):
1593         (bar):
1594         (foo):
1595
1596 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1597
1598         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
1599         https://bugs.webkit.org/show_bug.cgi?id=176867
1600
1601         Reviewed by Sam Weinig.
1602
1603         * microbenchmarks/object-get-own-property-symbols.js: Added.
1604         (test):
1605
1606 2017-09-13  Mark Lam  <mark.lam@apple.com>
1607
1608         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
1609         https://bugs.webkit.org/show_bug.cgi?id=176888
1610         <rdar://problem/34381832>
1611
1612         Not reviewed.
1613
1614         * stress/op_mod-ConstVar.js:
1615         * stress/op_mod-VarConst.js:
1616         * stress/op_mod-VarVar.js:
1617
1618 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
1619
1620         Skip 3 op_mod tests on Debug JSC bots.
1621         https://bugs.webkit.org/show_bug.cgi?id=176630
1622
1623         Unreviewed test gardening.
1624
1625         * stress/op_mod-ConstVar.js:
1626         * stress/op_mod-VarConst.js:
1627         * stress/op_mod-VarVar.js:
1628
1629 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1630
1631         [JSC] Fix Array allocation in Object.keys
1632         https://bugs.webkit.org/show_bug.cgi?id=176826
1633
1634         Reviewed by Saam Barati.
1635
1636         * stress/object-own-property-keys.js: Added.
1637         (shouldBe):
1638
1639 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1640
1641         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
1642         https://bugs.webkit.org/show_bug.cgi?id=176010
1643
1644         Reviewed by Filip Pizlo.
1645
1646         * microbenchmarks/weak-map-key.js: Added.
1647         (assert):
1648         (objectKey):
1649         (let.start.Date.now):
1650
1651 2017-09-12  Mark Lam  <mark.lam@apple.com>
1652
1653         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
1654         https://bugs.webkit.org/show_bug.cgi?id=176630
1655
1656         Reviewed by JF Bastien.
1657
1658         Debug builds are just slow, and these tests do a lot.  They pass when I run them
1659         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
1660         a speculative fix for the bots that are seeing these fail.
1661
1662         I also undid the skipping of the op_mod tests for debug builds.
1663
1664         * stress/op_div-ConstVar.js:
1665         * stress/op_div-VarConst.js:
1666         * stress/op_div-VarVar.js:
1667         * stress/op_mod-ConstVar.js:
1668         * stress/op_mod-VarConst.js:
1669         * stress/op_mod-VarVar.js:
1670
1671 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
1672
1673         Skip stress/value-to-boolean.js on Debug bots.
1674         https://bugs.webkit.org/show_bug.cgi?id=176787
1675
1676         Unreviewed test gardening.
1677
1678         * stress/value-to-boolean.js:
1679
1680 2017-09-11  Mark Lam  <mark.lam@apple.com>
1681
1682         Change test expectation for test262/test/language/statements/try/tco-catch.js
1683         https://bugs.webkit.org/show_bug.cgi?id=176749
1684
1685         Rubber stamped by Keith Miller.
1686
1687         It's been failing since at least r221821.  I'm changing the test expectation to
1688         fail to green the bots while I investigate some more.
1689
1690         * test262.yaml:
1691
1692 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
1693
1694         Unreviewed, rolling out r221854.
1695
1696         The test added with this change fails on 32-bit JSC bots.
1697
1698         Reverted changeset:
1699
1700         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
1701         https://bugs.webkit.org/show_bug.cgi?id=176010
1702         http://trac.webkit.org/changeset/221854
1703
1704 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1705
1706         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
1707         https://bugs.webkit.org/show_bug.cgi?id=176010
1708
1709         Reviewed by Filip Pizlo.
1710
1711         * microbenchmarks/weak-map-key.js: Added.
1712         (assert):
1713         (objectKey):
1714         (let.start.Date.now):
1715
1716 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1717
1718         [JSC] Optimize Object.keys by using careful array allocation
1719         https://bugs.webkit.org/show_bug.cgi?id=176654
1720
1721         Reviewed by Darin Adler.
1722
1723         * microbenchmarks/object-keys.js: Added.
1724         (test):
1725
1726 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
1727
1728         Error should compute .stack and friends lazily
1729         https://bugs.webkit.org/show_bug.cgi?id=176645
1730
1731         Reviewed by Saam Barati.
1732
1733         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
1734         * microbenchmarks/new-error.js: Added.
1735         * microbenchmarks/throw.js: Added.
1736
1737 2017-09-09  Mark Lam  <mark.lam@apple.com>
1738
1739         [Re-landing] Use JIT probes for DFG OSR exit.
1740         https://bugs.webkit.org/show_bug.cgi?id=175144
1741         <rdar://problem/33437050>
1742
1743         Not reviewed.  Original patch reviewed by Saam Barati.
1744
1745         Disable these tests for debug builds because they run too slow with the new OSR exit.
1746
1747         * stress/op_mod-ConstVar.js:
1748         * stress/op_mod-VarConst.js:
1749         * stress/op_mod-VarVar.js:
1750
1751 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1752
1753         [DFG] NewArrayWithSize(size)'s size does not care negative zero
1754         https://bugs.webkit.org/show_bug.cgi?id=176300
1755
1756         Reviewed by Saam Barati.
1757
1758         * stress/new-array-with-size-div.js: Added.
1759         (shouldBe):
1760         (test):
1761         (i.i):
1762
1763 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1764
1765         [DFG] PutByVal with Array::Generic is too generic
1766         https://bugs.webkit.org/show_bug.cgi?id=176345
1767
1768         Reviewed by Filip Pizlo.
1769
1770         * stress/object-assign-symbols.js: Added.
1771         (shouldBe):
1772         (test):
1773         * stress/object-assign.js: Added.
1774         (shouldBe):
1775         (test):
1776         (i.shouldBe.JSON.stringify.test):
1777
1778 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1779
1780         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
1781         https://bugs.webkit.org/show_bug.cgi?id=176590
1782
1783         Reviewed by Saam Barati.
1784
1785         * microbenchmarks/object-iterate-symbols.js: Added.
1786         (test):
1787         * microbenchmarks/object-iterate.js: Added.
1788         (test):
1789         * stress/object-iterate-symbols.js: Added.
1790         (shouldBe):
1791         (test):
1792         * stress/object-iterate.js: Added.
1793         (shouldBe):
1794         (test):
1795
1796 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
1797
1798         [Win32] 10 JSC stress tests are failing.
1799         https://bugs.webkit.org/show_bug.cgi?id=176538
1800
1801         Reviewed by Mark Lam.
1802
1803         Skip tests on Windows to make the bots green.
1804
1805         * ChakraCore.yaml:
1806         * stress/date-relaxed.js:
1807
1808 2017-09-06  Mark Lam  <mark.lam@apple.com>
1809
1810         constructGenericTypedArrayViewWithArguments() is missing an exception check.
1811         https://bugs.webkit.org/show_bug.cgi?id=176485
1812         <rdar://problem/33898874>
1813
1814         Reviewed by Keith Miller.
1815
1816         * stress/regress-176485.js: Added.
1817
1818 2017-09-05  Saam Barati  <sbarati@apple.com>
1819
1820         isNotCellSpeculation is wrong with respect to SpecEmpty
1821         https://bugs.webkit.org/show_bug.cgi?id=176429
1822
1823         Reviewed by Michael Saboff.
1824
1825         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
1826         (Foo):
1827
1828 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
1829
1830         test262: Completion values for control flow do not match the spec
1831         https://bugs.webkit.org/show_bug.cgi?id=171265
1832
1833         Reviewed by Saam Barati.
1834
1835         * stress/completion-value.js:
1836         Condensed test for completion values in top level statements.
1837
1838         * stress/super-get-by-id.js:
1839         ClassDeclaration when evaled no longer produce values. Convert
1840         these to ClassExpressions so they produce the class value.
1841         
1842         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
1843         This is a progression for currect spec behavior.
1844
1845         * mozilla/mozilla-tests.yaml:
1846         This test is now outdated, so mark it as failing for that reason.
1847
1848         * test262.yaml:
1849         Passing all "cptn" completion value tests.
1850
1851 2017-09-04  Saam Barati  <sbarati@apple.com>
1852
1853         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
1854         https://bugs.webkit.org/show_bug.cgi?id=176317
1855
1856         Reviewed by Keith Miller.
1857
1858         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
1859         (Foo):
1860
1861 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1862
1863         [DFG][FTL] Efficiently execute number#toString()
1864         https://bugs.webkit.org/show_bug.cgi?id=170007
1865
1866         Reviewed by Keith Miller.
1867
1868         * microbenchmarks/number-to-string-strength-reduction.js: Added.
1869         (test):
1870         * microbenchmarks/number-to-string-with-radix-10.js: Added.
1871         (test):
1872         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
1873         (test):
1874         * microbenchmarks/number-to-string-with-radix.js: Added.
1875         (test):
1876         * stress/number-to-string-strength-reduction.js: Added.
1877         (shouldBe):
1878         (test):
1879         * stress/number-to-string-with-radix-10.js: Added.
1880         (shouldBe):
1881         (test):
1882         * stress/number-to-string-with-radix-cse.js: Added.
1883         (shouldBe):
1884         (test):
1885         * stress/number-to-string-with-radix-invalid.js: Added.
1886         (shouldThrow):
1887         * stress/number-to-string-with-radix-watchpoint.js: Added.
1888         (shouldBe):
1889         (test):
1890         (i.i.1e3.Number.prototype.toString):
1891         * stress/number-to-string-with-radix.js: Added.
1892         (shouldBe):
1893         (test):
1894
1895 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
1896
1897         [DFG] Relax arity requirement
1898         https://bugs.webkit.org/show_bug.cgi?id=175523
1899
1900         Reviewed by Saam Barati.
1901
1902         * stress/arity-mismatch-arguments-length.js: Added.
1903         (shouldBe):
1904         (test1):
1905         (test):
1906         * stress/arity-mismatch-get-argument.js: Added.
1907         (shouldBe):
1908         (builtin.createBuiltin):
1909         (test):
1910         * stress/arity-mismatch-inlining-extra-slots.js: Added.
1911         (shouldBe):
1912         (inlineTarget):
1913         (test):
1914         * stress/arity-mismatch-inlining.js: Added.
1915         (shouldBe):
1916         (inlineTarget):
1917         (test):
1918         * stress/arity-mismatch-rest.js: Added.
1919         (shouldBe):
1920         (test2):
1921         (test1):
1922         (test):
1923
1924 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1925
1926         [JSC] Fix "name" and "length" of Proxy revoke function
1927         https://bugs.webkit.org/show_bug.cgi?id=176155
1928
1929         Reviewed by Mark Lam.
1930
1931         * test262.yaml:
1932
1933 2017-08-31  Saam Barati  <sbarati@apple.com>
1934
1935         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
1936         https://bugs.webkit.org/show_bug.cgi?id=176206
1937
1938         Reviewed by Keith Miller.
1939
1940         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
1941         (a):
1942         (b):
1943         (foo):
1944
1945 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
1946
1947         Skip two slow JSC tests after r221422.
1948
1949         Unreviewed test gardening.
1950
1951         * stress/regexp-prototype-match-on-too-long-rope.js:
1952         * stress/regexp-prototype-test-on-too-long-rope.js:
1953
1954 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
1955
1956         Unreviewed, skipping slow tests.
1957         
1958         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
1959         work differently now.
1960
1961         * stress/regexp-prototype-exec-on-too-long-rope.js:
1962         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
1963
1964 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1965
1966         [JSC] Use reifying system for "name" property of builtin JSFunction
1967         https://bugs.webkit.org/show_bug.cgi?id=175260
1968
1969         Reviewed by Saam Barati.
1970
1971         * stress/accessors-get-set-prefix.js:
1972         * stress/builtin-function-name.js: Added.
1973         (shouldBe):
1974         (shouldThrow):
1975         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
1976         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
1977         * stress/private-name-as-anonymous-builtin.js: Added.
1978         (shouldBe):
1979         (NotPromise):
1980
1981 2017-08-30  Saam Barati  <sbarati@apple.com>
1982
1983         Unreviewed. Make test stop printing.
1984
1985         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
1986
1987 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
1988
1989         Unreviewed, rolling out r221327.
1990
1991         This change caused test262 failures.
1992
1993         Reverted changeset:
1994
1995         "[JSC] Use reifying system for "name" property of builtin
1996         JSFunction"
1997         https://bugs.webkit.org/show_bug.cgi?id=175260
1998         http://trac.webkit.org/changeset/221327
1999
2000 2017-08-30  Saam Barati  <sbarati@apple.com>
2001
2002         semicolon is being interpreted as an = in the LiteralParser
2003         https://bugs.webkit.org/show_bug.cgi?id=176114
2004
2005         Reviewed by Oliver Hunt.
2006
2007         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
2008         * stress/resources/literal-parser-test-case.js: Added.
2009
2010 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2011
2012         [ESNext] Async iteration - Implement async iteration statement: for-await-of
2013         https://bugs.webkit.org/show_bug.cgi?id=166698
2014
2015         Reviewed by Yusuke Suzuki.
2016
2017         * stress/async-iteration-for-await-of-syntax.js: Added.
2018         (assert):
2019         (checkSyntax):
2020         (checkSyntaxError):
2021         (checkSimpleAsyncGeneratorSloppyMode):
2022         (checkSimpleAsyncGeneratorStrictMode):
2023         (checkNestedAsyncGenerators):
2024         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2025         * stress/async-iteration-for-await-of.js: Added.
2026         (assert):
2027         (async.foo):
2028         (async.boo):
2029         (const.boo.async):
2030
2031 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2032
2033         [JSC] Use reifying system for "name" property of builtin JSFunction
2034         https://bugs.webkit.org/show_bug.cgi?id=175260
2035
2036         Reviewed by Saam Barati.
2037
2038         * stress/accessors-get-set-prefix.js:
2039         * stress/builtin-function-name.js: Added.
2040         (shouldBe):
2041         (shouldThrow):
2042         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2043         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2044
2045 2017-08-25  Saam Barati  <sbarati@apple.com>
2046
2047         Support compiling catch in the DFG
2048         https://bugs.webkit.org/show_bug.cgi?id=174590
2049         <rdar://problem/34047845>
2050
2051         Reviewed by Filip Pizlo.
2052
2053         * microbenchmarks/delta-blue-try-catch.js: Added.
2054         (exception):
2055         (value):
2056         (OrderedCollection):
2057         (OrderedCollection.prototype.add):
2058         (OrderedCollection.prototype.at):
2059         (OrderedCollection.prototype.size):
2060         (OrderedCollection.prototype.removeFirst):
2061         (OrderedCollection.prototype.remove):
2062         (Strength):
2063         (Strength.stronger):
2064         (Strength.weaker):
2065         (Strength.weakestOf):
2066         (Strength.strongest):
2067         (Strength.prototype.nextWeaker):
2068         (Constraint):
2069         (Constraint.prototype.addConstraint):
2070         (Constraint.prototype.satisfy):
2071         (Constraint.prototype.destroyConstraint):
2072         (Constraint.prototype.isInput):
2073         (UnaryConstraint):
2074         (UnaryConstraint.prototype.addToGraph):
2075         (UnaryConstraint.prototype.chooseMethod):
2076         (UnaryConstraint.prototype.isSatisfied):
2077         (UnaryConstraint.prototype.markInputs):
2078         (UnaryConstraint.prototype.output):
2079         (UnaryConstraint.prototype.recalculate):
2080         (UnaryConstraint.prototype.markUnsatisfied):
2081         (UnaryConstraint.prototype.inputsKnown):
2082         (UnaryConstraint.prototype.removeFromGraph):
2083         (StayConstraint):
2084         (StayConstraint.prototype.execute):
2085         (EditConstraint.prototype.isInput):
2086         (EditConstraint.prototype.execute):
2087         (BinaryConstraint):
2088         (BinaryConstraint.prototype.chooseMethod):
2089         (BinaryConstraint.prototype.addToGraph):
2090         (BinaryConstraint.prototype.isSatisfied):
2091         (BinaryConstraint.prototype.markInputs):
2092         (BinaryConstraint.prototype.input):
2093         (BinaryConstraint.prototype.output):
2094         (BinaryConstraint.prototype.recalculate):
2095         (BinaryConstraint.prototype.markUnsatisfied):
2096         (BinaryConstraint.prototype.inputsKnown):
2097         (BinaryConstraint.prototype.removeFromGraph):
2098         (ScaleConstraint):
2099         (ScaleConstraint.prototype.addToGraph):
2100         (ScaleConstraint.prototype.removeFromGraph):
2101         (ScaleConstraint.prototype.markInputs):
2102         (ScaleConstraint.prototype.execute):
2103         (ScaleConstraint.prototype.recalculate):
2104         (EqualityConstraint):
2105         (EqualityConstraint.prototype.execute):
2106         (Variable):
2107         (Variable.prototype.addConstraint):
2108         (Variable.prototype.removeConstraint):
2109         (Planner):
2110         (Planner.prototype.incrementalAdd):
2111         (Planner.prototype.incrementalRemove):
2112         (Planner.prototype.newMark):
2113         (Planner.prototype.makePlan):
2114         (Planner.prototype.extractPlanFromConstraints):
2115         (Planner.prototype.addPropagate):
2116         (Planner.prototype.removePropagateFrom):
2117         (Planner.prototype.addConstraintsConsumingTo):
2118         (Plan):
2119         (Plan.prototype.addConstraint):
2120         (Plan.prototype.size):
2121         (Plan.prototype.constraintAt):
2122         (Plan.prototype.execute):
2123         (chainTest):
2124         (projectionTest):
2125         (change):
2126         (deltaBlue):
2127         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2128         (assert):
2129         (Numbers):
2130         (Numbers.prototype.next):
2131         (return.Transpose):
2132         (return.Transpose.prototype.next):
2133         (transpose):
2134         (verifyEven):
2135         (verifyString):
2136         (foo):
2137         (runIterators):
2138         * microbenchmarks/try-catch-word-count.js: Added.
2139         (let.assert):
2140         (EOF):
2141         (let.texts):
2142         (let.o.apply):
2143         (foo):
2144         (bar):
2145         (f):
2146         (run):
2147         (test1):
2148         (test2):
2149         (test3):
2150         (fn):
2151         (A):
2152         (B):
2153         (A.prototype.getValue):
2154         (B.prototype.getParentValue):
2155         (strlen):
2156         (sum.0):
2157         (test):
2158         (result.test.o):
2159         (set add.set add):
2160         (set forEach):
2161         (stringHash):
2162         (set if):
2163         (testFunction):
2164         (set delete.set has.set add):
2165         * stress/catch-set-argument-speculation-failure.js: Added.
2166         (o):
2167         (e):
2168         (e2):
2169         (escape):
2170         (baz):
2171         (noInline.run):
2172         (noInline):
2173         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2174         (foo):
2175         (e):
2176         (baz):
2177         (bar):
2178
2179 2017-08-24  Commit Queue  <commit-queue@webkit.org>
2180
2181         Unreviewed, rolling out r221119, r221124, and r221143.
2182         https://bugs.webkit.org/show_bug.cgi?id=175973
2183
2184         "I think it regressed JSBench by 20%" (Requested by saamyjoon
2185         on #webkit).
2186
2187         Reverted changesets:
2188
2189         "Support compiling catch in the DFG"
2190         https://bugs.webkit.org/show_bug.cgi?id=174590
2191         http://trac.webkit.org/changeset/221119
2192
2193         "Unreviewed, build fix in GTK port"
2194         https://bugs.webkit.org/show_bug.cgi?id=174590
2195         http://trac.webkit.org/changeset/221124
2196
2197         "DFG::JITCode::osrEntry should get sorted since we perform a
2198         binary search on it"
2199         https://bugs.webkit.org/show_bug.cgi?id=175893
2200         http://trac.webkit.org/changeset/221143
2201
2202 2017-08-24  Michael Saboff  <msaboff@apple.com>
2203
2204         Add support for RegExp "dotAll" flag
2205         https://bugs.webkit.org/show_bug.cgi?id=175924
2206
2207         Reviewed by Keith Miller.
2208
2209         Updated tests for new dotAll ('s' flag) changes.
2210
2211         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
2212         * stress/static-getter-in-names.js:
2213
2214 2017-08-24  Mark Lam  <mark.lam@apple.com>
2215
2216         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
2217         https://bugs.webkit.org/show_bug.cgi?id=175940
2218         <rdar://problem/29003921>
2219
2220         Reviewed by Saam Barati.
2221
2222         * stress/regress-164081.js: Added.
2223         (shouldEqual):
2224         (testcase):
2225
2226 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
2227
2228         Skip flaky JSC test stress/test-finally.js.
2229         https://bugs.webkit.org/show_bug.cgi?id=160283
2230
2231         Unreviewed test gardening.
2232
2233         * stress/test-finally.js:
2234
2235 2017-08-23  Saam Barati  <sbarati@apple.com>
2236
2237         Support compiling catch in the DFG
2238         https://bugs.webkit.org/show_bug.cgi?id=174590
2239
2240         Reviewed by Filip Pizlo.
2241
2242         * microbenchmarks/delta-blue-try-catch.js: Added.
2243         (exception):
2244         (value):
2245         (OrderedCollection):
2246         (OrderedCollection.prototype.add):
2247         (OrderedCollection.prototype.at):
2248         (OrderedCollection.prototype.size):
2249         (OrderedCollection.prototype.removeFirst):
2250         (OrderedCollection.prototype.remove):
2251         (Strength):
2252         (Strength.stronger):
2253         (Strength.weaker):
2254         (Strength.weakestOf):
2255         (Strength.strongest):
2256         (Strength.prototype.nextWeaker):
2257         (Constraint):
2258         (Constraint.prototype.addConstraint):
2259         (Constraint.prototype.satisfy):
2260         (Constraint.prototype.destroyConstraint):
2261         (Constraint.prototype.isInput):
2262         (UnaryConstraint):
2263         (UnaryConstraint.prototype.addToGraph):
2264         (UnaryConstraint.prototype.chooseMethod):
2265         (UnaryConstraint.prototype.isSatisfied):
2266         (UnaryConstraint.prototype.markInputs):
2267         (UnaryConstraint.prototype.output):
2268         (UnaryConstraint.prototype.recalculate):
2269         (UnaryConstraint.prototype.markUnsatisfied):
2270         (UnaryConstraint.prototype.inputsKnown):
2271         (UnaryConstraint.prototype.removeFromGraph):
2272         (StayConstraint):
2273         (StayConstraint.prototype.execute):
2274         (EditConstraint.prototype.isInput):
2275         (EditConstraint.prototype.execute):
2276         (BinaryConstraint):
2277         (BinaryConstraint.prototype.chooseMethod):
2278         (BinaryConstraint.prototype.addToGraph):
2279         (BinaryConstraint.prototype.isSatisfied):
2280         (BinaryConstraint.prototype.markInputs):
2281         (BinaryConstraint.prototype.input):
2282         (BinaryConstraint.prototype.output):
2283         (BinaryConstraint.prototype.recalculate):
2284         (BinaryConstraint.prototype.markUnsatisfied):
2285         (BinaryConstraint.prototype.inputsKnown):
2286         (BinaryConstraint.prototype.removeFromGraph):
2287         (ScaleConstraint):
2288         (ScaleConstraint.prototype.addToGraph):
2289         (ScaleConstraint.prototype.removeFromGraph):
2290         (ScaleConstraint.prototype.markInputs):
2291         (ScaleConstraint.prototype.execute):
2292         (ScaleConstraint.prototype.recalculate):
2293         (EqualityConstraint):
2294         (EqualityConstraint.prototype.execute):
2295         (Variable):
2296         (Variable.prototype.addConstraint):
2297         (Variable.prototype.removeConstraint):
2298         (Planner):
2299         (Planner.prototype.incrementalAdd):
2300         (Planner.prototype.incrementalRemove):
2301         (Planner.prototype.newMark):
2302         (Planner.prototype.makePlan):
2303         (Planner.prototype.extractPlanFromConstraints):
2304         (Planner.prototype.addPropagate):
2305         (Planner.prototype.removePropagateFrom):
2306         (Planner.prototype.addConstraintsConsumingTo):
2307         (Plan):
2308         (Plan.prototype.addConstraint):
2309         (Plan.prototype.size):
2310         (Plan.prototype.constraintAt):
2311         (Plan.prototype.execute):
2312         (chainTest):
2313         (projectionTest):
2314         (change):
2315         (deltaBlue):
2316         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2317         (assert):
2318         (Numbers):
2319         (Numbers.prototype.next):
2320         (return.Transpose):
2321         (return.Transpose.prototype.next):
2322         (transpose):
2323         (verifyEven):
2324         (verifyString):
2325         (foo):
2326         (runIterators):
2327         * microbenchmarks/try-catch-word-count.js: Added.
2328         (let.assert):
2329         (EOF):
2330         (let.texts):
2331         (let.o.apply):
2332         (foo):
2333         (bar):
2334         (f):
2335         (run):
2336         (test1):
2337         (test2):
2338         (test3):
2339         (fn):
2340         (A):
2341         (B):
2342         (A.prototype.getValue):
2343         (B.prototype.getParentValue):
2344         (strlen):
2345         (sum.0):
2346         (test):
2347         (result.test.o):
2348         (set add.set add):
2349         (set forEach):
2350         (stringHash):
2351         (set if):
2352         (testFunction):
2353         (set delete.set has.set add):
2354         * stress/catch-set-argument-speculation-failure.js: Added.
2355         (o):
2356         (e):
2357         (e2):
2358         (escape):
2359         (baz):
2360         (noInline.run):
2361         (noInline):
2362         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2363         (foo):
2364         (e):
2365         (baz):
2366         (bar):
2367
2368 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2369
2370         [JSC] Optimize Map iteration with intrinsic
2371         https://bugs.webkit.org/show_bug.cgi?id=174355
2372
2373         Reviewed by Saam Barati.
2374
2375         * stress/map-iterator-result-should-have-expected-shape.js: Added.
2376         (shouldBe):
2377         (throw.new.Error):
2378         * stress/set-iterator-result-should-have-expected-shape.js: Added.
2379         (shouldBe):
2380         (throw.new.Error.let.iterator.set Symbol):
2381         (throw.new.Error.set add):
2382         (let.iterator.set Symbol):
2383
2384 2017-08-23  Robin Morisset  <rmorisset@apple.com>
2385
2386         Add a micro-benchmark for checking that accessing a variable within a 'with'
2387         block does not automatically prevent type prediction.
2388         https://bugs.webkit.org/show_bug.cgi?id=175738
2389
2390         Reviewed by Saam Barati.
2391
2392         * stress/with_and_arith.js: Added.
2393         (with):
2394
2395 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
2396
2397         [ESNext] Async iteration - Implement Async Generator - runtime
2398         https://bugs.webkit.org/show_bug.cgi?id=175240
2399
2400         Reviewed by Yusuke Suzuki.
2401
2402         * stress/async-iteration-async-from-sync.js: Added.
2403         (assert):
2404         (const.Logger):
2405         (this.fullfilled):
2406         (this.fullfilledDone):
2407         (this.rejected):
2408         (this.catched):
2409         (this.isFinal):
2410         (_assertLogger):
2411         (const.assertLogger):
2412         (const.getPromise.promiseHolder.return.new.Promise):
2413         (foo):
2414         (async.boo):
2415         (bar):
2416         (async.baz):
2417         (async.goo):
2418         * stress/async-iteration-basic.js: Added.
2419         (assert):
2420         (const.Logger):
2421         (this.fullfilled):
2422         (this.fullfilledDone):
2423         (this.rejected):
2424         (this.catched):
2425         (this.isFinal):
2426         (_assertLogger):
2427         (const.assertLogger):
2428         (const.getPromise.promiseHolder.return.new.Promise):
2429         (async.generator):
2430         (iterator.next.then):
2431         (async.baz):
2432         (async.boo):
2433         (async.foo):
2434         (async.goo):
2435         (A.prototype.async.foo):
2436         (A.prototype.async.boo):
2437         (A):
2438         (asyncGenExp.async):
2439         (async.joo):
2440         (j.next.then):
2441         (then):
2442         (async.koo):
2443         (async.loo):
2444         (async.moo):
2445         (async.noo):
2446         (async.ooo):
2447         (async.roo):
2448         (async.poo):
2449         (async.soo):
2450         (async.too):
2451         * stress/async-iteration-evaluation.js: Added.
2452         (assert):
2453         (async.foo):
2454         (catch):
2455         * stress/async-iteration-syntax.js:
2456         * stress/async-iteration-yield-promise.js: Added.
2457         (assert):
2458         (const.Logger):
2459         (this.fullfilled):
2460         (this.fullfilledDone):
2461         (this.rejected):
2462         (this.catched):
2463         (this.isFinal):
2464         (_assertLogger):
2465         (const.assertLogger):
2466         (const.getPromise.promiseHolder.return.new.Promise):
2467         (async.foo):
2468         (async.boo):
2469         (async.bar):
2470         * stress/async-iteration-yield-star-interface.js: Added.
2471         (assert):
2472         (const.getPromise.promiseHolder.return.new.Promise):
2473         (const.Logger):
2474         (this.fullfilled):
2475         (this.fullfilledDone):
2476         (this.rejected):
2477         (this.catched):
2478         (this.custom):
2479         (this.isFinal):
2480         (_assertLogger):
2481         (const.assertLogger):
2482         (let.asyncIter.Symbol.asyncIterator):
2483         (let.asyncIter.next):
2484         (let.asyncIter.throw):
2485         (let.asyncIter.return):
2486         (async.foo):
2487         (asyncIter.Symbol.asyncIterator):
2488         (asyncIter.next):
2489         (async.boo):
2490         (asyncIter.return):
2491         (async.bar):
2492         (async.baz):
2493         (async.foobar):
2494         * stress/async-iteration-yield-star.js: Added.
2495         (assert):
2496         (const.Logger):
2497         (this.fullfilled):
2498         (this.fullfilledDone):
2499         (this.rejected):
2500         (this.catched):
2501         (this.custom):
2502         (this.isFinal):
2503         (_assertLogger):
2504         (const.assertLogger):
2505         (const.getPromise.promiseHolder.return.new.Promise):
2506         (async.foo):
2507         (async.boo):
2508         (async.bar):
2509         (async.baz):
2510         (async.joo):
2511         (async.goo):
2512         (async.koo):
2513         (async.loo):
2514         (let.asyncIter.Symbol.asyncIterator):
2515         (let.asyncIter.next):
2516         (let.asyncIter.throw):
2517         (let.asyncIter.return):
2518         (async.moo):
2519         (async.noo):
2520         * test262.yaml:
2521
2522 2017-08-23  JF Bastien  <jfbastien@apple.com>
2523
2524         Fix printing in test
2525
2526         Unreviewed: fixing verbosity, shouldn't have been there.
2527
2528         * wasm/regress/175693.js:
2529         (else.else):
2530         (catch):
2531
2532 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
2533
2534         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
2535         https://bugs.webkit.org/show_bug.cgi?id=172543
2536
2537         Unreviewed test gardening.
2538
2539         * microbenchmarks/generator-with-several-types.js:
2540
2541 2017-08-17  JF Bastien  <jfbastien@apple.com>
2542
2543         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
2544         https://bugs.webkit.org/show_bug.cgi?id=175693
2545         <rdar://problem/33952443>
2546
2547         Reviewed by Saam Barati.
2548
2549         Add a regression directory for WebAssembly tests.
2550
2551         * wasm.yaml:
2552         * wasm/regress/175693.js: Added.
2553         (else.else):
2554         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
2555         (catch):
2556         * wasm/regress/175693.wasm: Added.
2557
2558 2017-08-15  Robin Morisset  <rmorisset@apple.com>
2559
2560         Support the 'with' keyword in FTL.
2561         https://bugs.webkit.org/show_bug.cgi?id=175585
2562
2563         Reviewed by Saam Barati.
2564
2565         Also improve the JSTest/stress/with.js file to test
2566         what happens when non-objects are passed to with.
2567
2568         * stress/with.js:
2569         (foo):
2570         (i.catch):
2571         (i.with): Deleted.
2572
2573 2017-08-14  Keith Miller  <keith_miller@apple.com>
2574
2575         Add testing tool to lie to the DFG about profiles
2576         https://bugs.webkit.org/show_bug.cgi?id=175487
2577
2578         Reviewed by Saam Barati.
2579
2580         * stress/compare-eq-incomplete-profile.js: Added.
2581         (const.test.createBuiltin):
2582
2583 2017-08-14  Robin Morisset  <rmorisset@apple.com>
2584
2585         Support the with keyword in DFG
2586         https://bugs.webkit.org/show_bug.cgi?id=175470
2587
2588         Reviewed by Saam Barati.
2589
2590         Added a new stress-test for the 'with' keyword, that caught a bug in a
2591         previous version of this code.
2592
2593         * stress/with.js: Added.
2594         (i.with):
2595
2596 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
2597
2598         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
2599         https://bugs.webkit.org/show_bug.cgi?id=175544
2600
2601         Unreviewed test gardening.
2602
2603         * ChakraCore.yaml:
2604
2605 2017-08-09  Caitlin Potter  <caitp@igalia.com>
2606
2607         Early error on ANY operator before new.target
2608         https://bugs.webkit.org/show_bug.cgi?id=157970
2609
2610         Reviewed by Saam Barati.
2611
2612         Instead of throwing if any unary operator precedes new.target, only
2613         throw if the unary operator updates the reference.
2614
2615         The following become legal in JSC:
2616
2617         ```
2618         !new.target
2619         ~new.target
2620         typeof new.target
2621         delete new.target
2622         void new.target
2623         ```
2624
2625         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
2626
2627         * stress/new-target-syntax-errors.js:
2628         * stress/new-target.js:
2629
2630 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
2631
2632         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
2633         https://bugs.webkit.org/show_bug.cgi?id=175255
2634
2635         Unreviewed test gardening.
2636
2637         * stress/regress-169783.js:
2638         * wasm/stress/oom.js:
2639
2640 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
2641
2642         REGRESSION: 2 test262/test/language/statements/async-function failures
2643         https://bugs.webkit.org/show_bug.cgi?id=175334
2644
2645         Reviewed by Yusuke Suzuki.
2646
2647         Add @skip parameters to tests, and remove test for async iterator from 
2648         async await syntax test because it is already covered by async-iterator-syntax.js
2649
2650         * stress/async-await-syntax.js:
2651         * stress/async-iteration-syntax.js:
2652
2653 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2654
2655         Unreviewed, gardening test262 for Promise resolve / reject function length
2656         https://bugs.webkit.org/show_bug.cgi?id=175333
2657
2658         * test262.yaml:
2659
2660 2017-08-07  Robin Morisset  <rmorisset@apple.com>
2661
2662         GetOwnProperty of TypedArray indexed fields is wrongly configurable
2663         https://bugs.webkit.org/show_bug.cgi?id=175307
2664
2665         Reviewed by Saam Barati.
2666
2667         * stress/typedarray-getownproperty-not-configurable.js: Added.
2668         (assert):
2669         (foo):
2670
2671 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
2672
2673         Promise resolve and reject function should have length = 1
2674         https://bugs.webkit.org/show_bug.cgi?id=175242
2675
2676         Reviewed by Saam Barati.
2677
2678         * stress/builtin-function-length.js: Added.
2679         (shouldBe):
2680         (shouldThrow):
2681         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2682         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2683
2684 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
2685
2686         [ESNext] Async iteration - Implement Async Generator - parser
2687         https://bugs.webkit.org/show_bug.cgi?id=175210
2688
2689         Reviewed by Yusuke Suzuki.
2690
2691         * stress/async-await-syntax.js:
2692         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2693         * stress/async-iteration-syntax.js: Added.
2694         (assert):
2695         (checkSyntax):
2696         (checkSyntaxError):
2697         (checkSimpleAsyncGeneratorSloppyMode):
2698         (checkSimpleAsyncGeneratorStrictMode):
2699         (checkNestedAsyncGenerators):
2700         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2701         * stress/generator-class-methods-syntax.js:
2702
2703 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2704
2705         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
2706         https://bugs.webkit.org/show_bug.cgi?id=175150
2707
2708         Unreviewed test gardening.
2709
2710         * wasm/js-api/test_memory_constructor.js:
2711
2712 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2713
2714         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
2715         https://bugs.webkit.org/show_bug.cgi?id=175100
2716
2717         Reviewed by Mark Lam.
2718
2719         The JSC test JSTests/wasm/stress/oom.js tries to use all the
2720         available memory until an out of memory exception happens.
2721
2722         The Linux kernel is more tuned for server workloads than for GUI
2723         responsiveness. When a process tries to use a lot of memory, Linux
2724         will do its best to serve the request. This usually translates to
2725         free physical RAM by writing to disk dirty pages and/or moving out
2726         less recently used pages to swap (disk storage).
2727         Meanwhile it does this, the system will become unresponsive and this
2728         leads to freezes that can last even some minutes on the worst cases.
2729
2730         Therefore, let's skip this test on Linux as it will cause more harm
2731         than good on the Linux bots or on the machines of Linux developers.
2732
2733         * wasm/stress/oom.js:
2734
2735 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
2736
2737         [JSC] Remove unnecessary print from stress\promise-finally.js test
2738         https://bugs.webkit.org/show_bug.cgi?id=175015
2739
2740         Reviewed by Yusuke Suzuki.
2741
2742         * stress/promise-finally.js:
2743         (p.finally):
2744         (then):
2745
2746 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2747
2748         Unreviewed, update test262 results for optional catch binding
2749
2750         * test262.yaml:
2751
2752 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2753
2754         [JSC] Support optional catch binding
2755         https://bugs.webkit.org/show_bug.cgi?id=174981
2756
2757         Reviewed by Saam Barati.
2758
2759         * stress/optional-catch-binding-syntax.js: Added.
2760         (testSyntax):
2761         (testSyntaxError):
2762         (catch.catch):
2763         * stress/optional-catch-binding.js: Added.
2764         (shouldBe):
2765         (throwException):
2766
2767 2017-07-28  Mark Lam  <mark.lam@apple.com>
2768
2769         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
2770         https://bugs.webkit.org/show_bug.cgi?id=174948
2771         <rdar://problem/33495680>
2772
2773         Reviewed by Filip Pizlo.
2774
2775         * stress/regress-174948.js: Added.
2776
2777 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
2778
2779         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
2780         https://bugs.webkit.org/show_bug.cgi?id=174900
2781
2782         Reviewed by Saam Barati.
2783
2784         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
2785         (sideEffect):
2786         (args):
2787         (test):
2788
2789 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2790
2791         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
2792         https://bugs.webkit.org/show_bug.cgi?id=171637
2793
2794         Reviewed by Darin Adler.
2795
2796         * stress/domjit-getter-complex-with-incorrect-object.js:
2797         (i.shouldThrow):
2798         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
2799         (shouldBe):
2800         (i.shouldThrow):
2801
2802 2017-07-26  JF Bastien  <jfbastien@apple.com>
2803
2804         WebAssembly: test throwing out of the start function
2805         https://bugs.webkit.org/show_bug.cgi?id=165714
2806         <rdar://problem/29760251>
2807
2808         Reviewed by Keith Miller.
2809
2810         * wasm/assert.js:
2811         * wasm/function-tests/trap-from-start.js: Added.
2812         (StartTraps):
2813         * wasm/function-tests/trap-from-start-async.js: Added.
2814         (async.StartTrapsAsync):
2815
2816 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2817
2818         [FTL] Arguments elimination is suppressed by unreachable blocks
2819         https://bugs.webkit.org/show_bug.cgi?id=174352
2820
2821         Reviewed by Filip Pizlo.
2822
2823         * stress/arguments-elimination-force-exit.js: Added.
2824         (shouldBe):
2825         (strict):
2826         (sloppy):
2827         * stress/arguments-elimination-throw.js: Added.
2828         (shouldBe):
2829         (shouldThrow):
2830         (sloppy):
2831         (isArguments):
2832
2833 2017-07-13  Mark Lam  <mark.lam@apple.com>
2834
2835         Add some additional test cases for bug 170896.
2836         https://bugs.webkit.org/show_bug.cgi?id=174491
2837
2838         Reviewed by Filip Pizlo.
2839
2840         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
2841         * stress/regress-170896-with-double-shape-profile.js: Added.
2842         (test):
2843         * stress/regress-170896-with-int32-shape-profile.js: Added.
2844         (test):
2845         * stress/regress-170896.js: Removed.
2846
2847 2017-07-13  Saam Barati  <sbarati@apple.com>
2848
2849         Missing exception check in JSObject::hasInstance
2850         https://bugs.webkit.org/show_bug.cgi?id=174455
2851         <rdar://problem/31384608>
2852
2853         Reviewed by Mark Lam.
2854
2855         * stress/has-instance-exception-check.js: Added.
2856         (assert):
2857         (let.getter.Object.getOwnPropertyDescriptor.get foo):
2858
2859 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
2860
2861         [ESnext] Implement Object Spread
2862         https://bugs.webkit.org/show_bug.cgi?id=167963
2863
2864         Reviewed by Saam Barati.
2865
2866         * stress/obj-rest-destructuring-order.js: Added.
2867         (assert):
2868         (o.get z):
2869         (o.get a):
2870         * stress/obj-spread-order.js: Added.
2871         (assert):
2872         (o.get z):
2873         (o.get a):
2874         * stress/object-spread.js: Added.
2875         (let.assert):
2876         (assert.sameValue):
2877         (let.o.get a):
2878         (let.obj.get c):
2879         (cthulhu.get x):
2880         (let.obj.set c):
2881         (calls.o.get z):
2882         (calls.o.get a):
2883         (try.let.obj.get foo):
2884         (get calls):
2885
2886 2017-07-12  Saam Barati  <sbarati@apple.com>
2887
2888         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
2889         https://bugs.webkit.org/show_bug.cgi?id=174411
2890         <rdar://problem/31696186>
2891
2892         Reviewed by Mark Lam.
2893
2894         * stress/generic-arguments-correct-delete-behavior.js: Added.
2895         (assert):
2896         (makeTest):
2897
2898 2017-07-07  Mark Lam  <mark.lam@apple.com>
2899
2900         \n\r is not the same as \r\n.
2901         https://bugs.webkit.org/show_bug.cgi?id=173053
2902
2903         Reviewed by Keith Miller.
2904
2905         * stress/regress-173053.js: Added.
2906         * stress/template-literal-line-terminators.js:
2907
2908 2017-07-06  Saam Barati  <sbarati@apple.com>
2909
2910         We are missing places where we invalidate the for-in context
2911         https://bugs.webkit.org/show_bug.cgi?id=174184
2912
2913         Reviewed by Geoffrey Garen.
2914
2915         * stress/for-in-invalidate-context-weird-assignments.js: Added.
2916         (assert):
2917         (test):
2918
2919 2017-07-05  Saam Barati  <sbarati@apple.com>
2920
2921         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
2922         https://bugs.webkit.org/show_bug.cgi?id=174188
2923         <rdar://problem/30581423>
2924
2925         Reviewed by Mark Lam.
2926
2927         * stress/new-array-having-a-bad-time-double.js: Added.
2928         (assert):
2929         (foo):
2930
2931 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
2932
2933         WTF::StringImpl::copyChars segfaults when built with GCC 7
2934         https://bugs.webkit.org/show_bug.cgi?id=173407
2935
2936         Reviewed by Andreas Kling.
2937
2938         * stress/string-repeat-copy-chars-crash.js: Added.
2939         (shouldBe):
2940
2941 2017-07-03  Saam Barati  <sbarati@apple.com>
2942
2943         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
2944
2945         * stress/unshiftCountSlowCase-correct-postCapacity.js:
2946
2947 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2948
2949         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
2950
2951         It requires too much memory.
2952
2953         * stress/dont-reserve-huge-capacity-lexer.js:
2954
2955 2017-06-30  Michael Saboff  <msaboff@apple.com>
2956
2957         Skip a test on ARM64 platform since we run out of address space.
2958
2959         Rubber stamped by Saam Barati.
2960
2961         * stress/dont-reserve-huge-capacity-lexer.js:
2962
2963 2017-06-30  Michael Saboff  <msaboff@apple.com>
2964
2965         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
2966         https://bugs.webkit.org/show_bug.cgi?id=174044
2967
2968         Reviewed by Oliver Hunt.
2969
2970         New regression test.
2971
2972         * stress/regress-174044.js: Added.
2973         (test1):
2974         (test2):
2975
2976 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
2977
2978         RegExpCachedResult::setInput should reify left and right contexts
2979         https://bugs.webkit.org/show_bug.cgi?id=173818
2980
2981         Reviewed by Keith Miller.
2982
2983         * stress/right-left-context-invalidated-by-input.js: Added.
2984         (test.validateContexts):
2985         (test):
2986
2987 2017-06-29  Saam Barati  <sbarati@apple.com>
2988
2989         Calculating postCapacity in unshiftCountSlowCase is wrong
2990         https://bugs.webkit.org/show_bug.cgi?id=173992
2991         <rdar://problem/32283199>
2992
2993         Reviewed by Keith Miller.
2994
2995         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
2996         (temp):
2997
2998 2017-06-29  Commit Queue  <commit-queue@webkit.org>
2999
3000         Unreviewed, rolling out r218512.
3001         https://bugs.webkit.org/show_bug.cgi?id=173981
3002
3003         "It changes the behavior of the JS API's JSEvaluateScript
3004         which breaks TurboTax" (Requested by saamyjoon on #webkit).
3005
3006         Reverted changeset:
3007
3008         "test262: Completion values for control flow do not match the
3009         spec"
3010         https://bugs.webkit.org/show_bug.cgi?id=171265
3011         http://trac.webkit.org/changeset/218512
3012
3013 2017-06-27  JF Bastien  <jfbastien@apple.com>
3014
3015         WebAssembly: running out of executable memory should throw OoM
3016         https://bugs.webkit.org/show_bug.cgi?id=171537
3017         <rdar://problem/32963338>
3018
3019         Reviewed by Saam Barati.
3020
3021         * wasm.yaml:
3022         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
3023         (const.invoke):
3024         (failCount.0.catch):
3025         (failCount.0.module.undefined.catch):
3026         * wasm/lowExecutableMemory/exports-oom.js: Added.
3027         (const.type):
3028         (const.params):
3029         (const.randomProgram):
3030         (failCount.0.catch):
3031         (failCount.0.module.undefined.catch):
3032         * wasm/lowExecutableMemory/imports-oom.js: Added.
3033         (const.type):
3034         (const.params):
3035         (const.randomProgram):
3036         (f.imports.push):
3037         (failCount.0.catch):
3038         (failCount.0.module.undefined.catch):
3039
3040 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
3041
3042         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
3043         https://bugs.webkit.org/show_bug.cgi?id=167962
3044
3045         Reviewed by Saam Barati.
3046
3047         * stress/object-rest-deconstruct.js: Added.
3048         (let.assert):
3049         (let.assertPropDescriptor):
3050         (catch):
3051         (get 3):
3052         (foo):
3053         (let.src.get y):
3054         (let.src.set y):
3055         (let.gen):
3056
3057 2017-06-27  Saam Barati  <sbarati@apple.com>
3058
3059         Function constructor needs to follow the spec and validate parameters and body independently
3060         https://bugs.webkit.org/show_bug.cgi?id=173303
3061         <rdar://problem/32732526>
3062
3063         Reviewed by Keith Miller.
3064
3065         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
3066         * stress/function-constructor-semantics.js: Added.
3067         (assert):
3068         (hasSyntaxError):
3069         (foo):
3070         (async.foo):
3071         (testError):
3072         (testOK.toString):
3073         (toString):
3074
3075 2017-06-26  Saam Barati  <sbarati@apple.com>
3076
3077         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
3078         https://bugs.webkit.org/show_bug.cgi?id=173740
3079
3080         Reviewed by Mark Lam.
3081
3082         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
3083         (Array.prototype.Symbol.iterator):
3084
3085 2017-06-26  Saam Barati  <sbarati@apple.com>
3086
3087         Skip a test on 32-bit platforms since we run out of address space.
3088
3089         Rubber stamped by Mark Lam.
3090
3091         * stress/dont-reserve-huge-capacity-lexer.js:
3092
3093 2017-06-26  Saam Barati  <sbarati@apple.com>
3094
3095         Crash in JSC::Lexer<unsigned char>::setCode
3096         https://bugs.webkit.org/show_bug.cgi?id=172754
3097
3098         Reviewed by Mark Lam.
3099
3100         * stress/dont-reserve-huge-capacity-lexer.js: Added.
3101         (catch):
3102
3103 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3104
3105         [JSC] Clean up Object.entries implementation
3106         https://bugs.webkit.org/show_bug.cgi?id=173759
3107
3108         Reviewed by Sam Weinig.
3109
3110         * microbenchmarks/object-entries.js: Added.
3111         (test):
3112
3113 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
3114
3115         Remove Reflect.enumerate
3116         https://bugs.webkit.org/show_bug.cgi?id=173806
3117
3118         Reviewed by Yusuke Suzuki.
3119
3120         * ChakraCore.yaml:
3121         * es6.yaml:
3122         These tests now fail because they use Reflect.enumerate.
3123
3124         * test262.yaml:
3125         This test now passes, it checked that Reflect.enumerate is undefined!
3126
3127         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
3128         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
3129
3130         * stress/reflect-enumerate.js: Removed.
3131         Remove a test solely for Reflect.enumerate.
3132
3133 2017-06-22  Saam Barati  <sbarati@apple.com>
3134
3135         ValueRep(DoubleRep(@v)) can not simply convert to @v
3136         https://bugs.webkit.org/show_bug.cgi?id=173687
3137         <rdar://problem/32855563>
3138
3139         Reviewed by Mark Lam.
3140
3141         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
3142         (i.catch):
3143
3144 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
3145
3146         [JSC] Object.values should be implemented in C++
3147         https://bugs.webkit.org/show_bug.cgi?id=173703
3148
3149         Reviewed by Sam Weinig.
3150
3151         * microbenchmarks/object-keys-map-values.js: Added.
3152         (test):
3153         * microbenchmarks/object-values.js: Added.
3154         (test):
3155         * stress/object-values-changing-properties.js: Added.
3156         (shouldBe):
3157         (throw.new.Error.let.source.get x):
3158         (throw.new.Error):
3159         (shouldBe.let.handler.get order):
3160         (get let):
3161         (shouldBe.let.handler.get return):
3162         (let.handler.get order):
3163
3164 2017-06-21  Saam Barati  <sbarati@apple.com>
3165
3166         eval virtual call is incorrect in the baseline JIT
3167         https://bugs.webkit.org/show_bug.cgi?id=173587
3168         <rdar://problem/32867897>
3169
3170         Reviewed by Michael Saboff.
3171
3172         * stress/do-eval-virtual-call-correctly.js: Added.
3173         (assert):
3174         (f):
3175         (i.test):
3176         (catch):
3177
3178 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
3179
3180         Update test262 test expectations after r218581.
3181
3182         Unreviewed test gardening.
3183
3184         * test262.yaml:
3185
3186 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
3187
3188         Revert changes in bug#160417 about extending `null` not being a derived class
3189         https://bugs.webkit.org/show_bug.cgi?id=169293
3190
3191         Reviewed by Saam Barati.
3192
3193         * stress/class-derived-from-null.js:
3194         (assertThrow):
3195         (test1):
3196         (test2):
3197         (test3):
3198         (test4):
3199         (test5):
3200         (test6):
3201
3202 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3203
3204         [DFG] More ArrayIndexOf fixups for various types
3205         https://bugs.webkit.org/show_bug.cgi?id=173176
3206
3207         Reviewed by Saam Barati.
3208
3209         * stress/array-indexof-arraystorage.js: Added.
3210         (shouldBe):
3211         (indexOfInt32Other):
3212         (indexOfInt32Cell):
3213         (indexOfInt32Boolean):
3214         (indexOfDoubleOther):
3215         (indexOfDoubleCell):
3216         (indexOfDoubleBoolean):
3217         (indexOfInt32):
3218         (indexOfDouble):
3219         * stress/array-indexof-constant-folding.js: Added.
3220         (shouldBe):
3221         (indexOfInt32Other):
3222         (indexOfInt32Cell):
3223         (indexOfInt32Boolean):
3224         (indexOfDoubleOther):
3225         (indexOfDoubleCell):
3226         (indexOfDoubleBoolean):
3227         * stress/array-indexof-hole-and-other.js: Added.
3228         (shouldBe):
3229         (indexOf):
3230         * stress/array-indexof-other.js: Added.
3231         (shouldBe):
3232         (indexOfInt32):
3233         (indexOfDouble):
3234         (indexOfString):
3235         (indexOfObject):
3236         * stress/array-indexof-symbol.js: Added.
3237         (shouldBe):
3238         (indexOfInt32):
3239         (indexOfDouble):
3240         (indexOfString):
3241         (indexOfObject):
3242
3243 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
3244
3245         test262: Completion values for control flow do not match the spec
3246         https://bugs.webkit.org/show_bug.cgi?id=171265
3247
3248         Reviewed by Saam Barati.
3249
3250         * stress/completion-value.js:
3251         Condensed test for completion values in top level statements.
3252
3253         * stress/super-get-by-id.js:
3254         ClassDeclaration when evaled no longer produce values. Convert
3255         these to ClassExpressions so they produce the class value.
3256         
3257         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3258         This is a progression for currect spec behavior.
3259
3260         * mozilla/mozilla-tests.yaml:
3261         This test is now outdated, so mark it as failing for that reason.
3262
3263         * test262.yaml:
3264         Passing all "cptn" completion value tests.
3265
3266 2017-06-17  Keith Miller  <keith_miller@apple.com>
3267
3268         ArrayBuffer constructor needs to create subclass structures before its buffer
3269         https://bugs.webkit.org/show_bug.cgi?id=173510
3270
3271         Reviewed by Yusuke Suzuki.
3272
3273         * test262.yaml:
3274
3275 2017-06-17  Keith Miller  <keith_miller@apple.com>
3276
3277         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
3278         https://bugs.webkit.org/show_bug.cgi?id=173506
3279
3280         Reviewed by Ryosuke Niwa.
3281
3282         Re-baseline tests.
3283
3284         * ChakraCore/test/Function/apply3.baseline-jsc:
3285         * test262.yaml:
3286
3287 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3288
3289         [JSC] Add fast path for Object.assign
3290         https://bugs.webkit.org/show_bug.cgi?id=173416
3291
3292         Reviewed by Mark Lam.
3293
3294         * stress/object-assign-changing-properties.js: Added.
3295         (shouldBe):
3296         (throw.new.Error.let.source.get x):
3297         (throw.new.Error):
3298         (shouldBe.let.source.get x):
3299         (shouldBe.let.target.set x):
3300         (shouldBe.let.target.get x):
3301         * stress/object-assign-proxy.js: Added.
3302         (shouldBe):
3303         (throw.new.Error.let.handler.get order):
3304
3305 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
3306
3307         [JSC] Implement Object.assign in C++
3308         https://bugs.webkit.org/show_bug.cgi?id=173414
3309
3310         Reviewed by Saam Barati.
3311
3312         * stress/object-assign-string-first.js: Added.
3313         (shouldBe):
3314         (source.get Symbol):
3315         (source.get 1):
3316         (source.get cocoa):
3317
3318 2017-06-14  JF Bastien  <jfbastien@apple.com>
3319
3320         WebAssembly: remove empty test files
3321         https://bugs.webkit.org/show_bug.cgi?id=173382
3322
3323         Reviewed by Saam Barati.
3324
3325         The following files:
3326                 JSTests/wasm/function-tests/call-indirect-params.js
3327                 JSTests/wasm/function-tests/call-indirect.js
3328                 JSTests/wasm/js-api/call-indirect-results.js
3329         Were changed to empty files in https://trac.webkit.org/changeset/209771
3330
3331         They were testing call_indirect with the wrong semantics, before
3332         we implemented tables. That change implemented tables and
3333         therefore removed the erroneous tests.
3334
3335         We have a few tests for call_indirect which already do the right thing:
3336                 JSTests/wasm/function-tests/context-switch.js
3337                 JSTests/wasm/function-tests/exceptions.js
3338                 JSTests/wasm/function-tests/grow-memory-2.js
3339                 JSTests/wasm/function-tests/stack-overflow.js
3340                 JSTests/wasm/function-tests/table-basic-2.js
3341                 JSTests/wasm/function-tests/table-basic.js
3342                 JSTests/wasm/js-api/call-indirect.js
3343                 JSTests/wasm/js-api/table.js
3344                 JSTests/wasm/js-api/unique-signature.js
3345                 JSTests/wasm/js-api/wrapper-function.js
3346
3347         I also just imported the updated spec tests which, among other
3348         things, test call_indirect:
3349                 core/br.wast
3350                 core/br_table.wast
3351                 core/call_indirect.wast
3352                 core/func.wast
3353                 core/func_ptrs.wast
3354                 core/imports.wast
3355                 core/left-to-right.wast
3356                 core/linking.wast
3357                 core/nop.wast
3358                 core/return.wast
3359                 core/typecheck.wast
3360                 core/unreachable.wast
3361
3362         So I think it's OK to just delete the tests which should just have
3363         been deleted back when tables were added.
3364
3365         * wasm/function-tests/call-indirect-params.js: Removed.
3366         * wasm/function-tests/call-indirect.js: Removed.
3367         * wasm/js-api/call-indirect-results.js: Removed.
3368
3369 2017-06-13  JF Bastien  <jfbastien@apple.com>
3370
3371         WebAssembly: import updated spec tests
3372         https://bugs.webkit.org/show_bug.cgi?id=173287
3373         <rdar://problem/32725975>
3374
3375         Reviewed by Saam Barati.
3376
3377         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
3378         with a few modifications so things work.
3379
3380         Fix a bunch of bugs found through this process, and punt a few tests (which I
3381         marked as blocked by this bug).
3382
3383         Fixes:
3384
3385         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
3386         instead of byte alignment. It was also missing memory-alignment.js despite it
3387         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
3388         pass.
3389
3390         Tables can be imported or in a section. There can be only one, but sections can
3391         be empty. An Elements section can exist if there's no Table, as long as it is
3392         also empty.
3393
3394         Memories can be imported or in a section. There can be only one, but sections
3395         can be empty. A Data section can exist if there's no Memory, as long as it is
3396         also empty.
3397
3398         Prototypes: stringify without .prototype. in the string.
3399
3400         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
3401         not a final size, and throws a RangeError on failure, not a TypeError.
3402
3403         Fix compile / instantiate so the reject the promise if given an argument of the
3404         wrong type (instead of failing instantly).
3405
3406         Fix async on neuter test.
3407
3408         Element section shouldn't affect any Table if any of the elements are out of
3409         bounds. We need to process it in two passes.
3410
3411         Segment section shouldn't affect any Data if any of the segments are out of
3412         bounds. We need to process it in two passes.
3413
3414         Empty data segments are valid, but only when there is no memory. Their index
3415         still gets validated, and has to be zero.
3416
3417         Punts:
3418
3419         Error messages with context, the test seems overly restrictive but this is
3420         minor.
3421
3422         compile/instantiate/validate property descriptors.
3423
3424         UTF-8 bugs.
3425
3426         Temporarily disable NaN tests. We need to go back and implement the following
3427         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
3428         much as getting all the other tests passing.
3429
3430         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
3431         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
3432         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
3433         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
3434         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
3435         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
3436         why they're not allowed.
3437
3438         * wasm.yaml:
3439         * wasm/function-tests/i32-load8-s.js:
3440         * wasm/function-tests/memory-access-past-4gib.js:
3441         (const.op.of.WASM.opcodes):
3442         * wasm/function-tests/memory-alignment.js: Added.
3443         (const.op.of.WASM.opcodes):
3444         * wasm/function-tests/memory-section-and-import.js:
3445         * wasm/js-api/Module-compile.js:
3446         (async.testPromiseAPI):
3447         * wasm/js-api/dont-mmap-zero-byte-memory.js:
3448         (testMems):
3449         * wasm/js-api/element.js:
3450         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3451         * wasm/js-api/neutered-inputs.js:
3452         (const.testFunction): Deleted.
3453         (const.testConstructor): Deleted.
3454         * wasm/js-api/table.js:
3455         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3456         (new.WebAssembly.Module):
3457         (assert.throws):
3458         (assertBadTableImport):
3459         (assert.throws.WebAssembly.Table.prototype.grow):
3460         (assertBadTableInstance): Deleted.
3461         * wasm/js-api/test_Data.js:
3462         (DataSectionWithoutMemory):
3463         * wasm/spec-harness/index.js:
3464         (module):
3465         (uniqueTest): Deleted.
3466         (assert_invalid): Deleted.
3467         (assert_soft_invalid): Deleted.
3468         (register): Deleted.
3469         (call): Deleted.
3470         (get instance): Deleted.
3471         (exports): Deleted.
3472         (run): Deleted.
3473         (assert_unlinkable): Deleted.
3474         (assert_uninstantiable): Deleted.
3475         (assert_trap): Deleted.
3476         (try.f): Deleted.
3477         (catch): Deleted.
3478         (assert_exhaustion): Deleted.
3479         (assert_return): Deleted.
3480         (assert_return_nan): Deleted.
3481         * wasm/spec-harness/testharness.css: Removed.
3482         * wasm/spec-harness/testharness.js: Removed.
3483         * wasm/spec-harness/testharnessreport.js: Removed.
3484         * wasm/spec-harness/wasm-constants.js:
3485         (assertTraps):
3486         (assertWasmThrows):
3487         * wasm/spec-harness/wasm-module-builder.js:
3488         (Binary.prototype.emit_section):
3489         (Binary):
3490         (WasmFunctionBuilder.prototype.addBody):
3491         (WasmFunctionBuilder.prototype.end):
3492         (WasmFunctionBuilder):
3493         (WasmModuleBuilder.prototype.stringToBytes):
3494         (WasmModuleBuilder.prototype.addCustomSection):
3495         (WasmModuleBuilder.prototype.addFunctionTableInit):
3496         (WasmModuleBuilder.prototype.appendToTable):
3497         (WasmModuleBuilder.prototype.toArray):
3498         (WasmModuleBuilder.prototype.toBuffer):
3499         (WasmModuleBuilder.prototype.instantiate):
3500         (WasmModuleBuilder):
3501         * wasm/spec-tests/address.wast.js:
3502         * wasm/spec-tests/align.wast.js: Added.
3503         * wasm/spec-tests/binary.wast.js:
3504         * wasm/spec-tests/block.wast.js:
3505         * wasm/spec-tests/br.wast.js:
3506         * wasm/spec-tests/br_if.wast.js:
3507         * wasm/spec-tests/br_table.wast.js:
3508         * wasm/spec-tests/call.wast.js:
3509         * wasm/spec-tests/call_indirect.wast.js:
3510         * wasm/spec-tests/comments.wast.js:
3511         * wasm/spec-tests/const.wast.js: Added.
3512         * wasm/spec-tests/conversions.wast.js: Added.
3513         * wasm/spec-tests/custom_section.wast.js:
3514         * wasm/spec-tests/exports.wast.js:
3515         * wasm/spec-tests/f32.wast.js: Added.
3516         * wasm/spec-tests/f64.wast.js: Added.
3517         * wasm/spec-tests/fac.wast.js:
3518         * wasm/spec-tests/float_exprs.wast.js: Added.
3519         * wasm/spec-tests/float_misc.wast.js: Added.
3520         * wasm/spec-tests/func.wast.js:
3521         * wasm/spec-tests/globals.wast.js:
3522         * wasm/spec-tests/if.wast.js:
3523         * wasm/spec-tests/imports.wast.js:
3524         * wasm/spec-tests/inline-module.wast.js: Added.
3525         * wasm/spec-tests/jsapi.js:
3526         (testJSAPI.test):
3527         (testJSAPI):
3528         * wasm/spec-tests/labels.wast.js:
3529         * wasm/spec-tests/loop.wast.js:
3530         * wasm/spec-tests/memory.wast.js:
3531         * wasm/spec-tests/memory_trap.wast.js: Added.
3532         * wasm/spec-tests/names.wast.js:
3533         * wasm/spec-tests/nop.wast.js:
3534         * wasm/spec-tests/return.wast.js:
3535         * wasm/spec-tests/stack.wast.js:
3536         * wasm/spec-tests/token.wast.js: Added.
3537         * wasm/spec-tests/type.wast.js: Added.
3538         * wasm/spec-tests/typecheck.wast.js:
3539         * wasm/spec-tests/unreachable.wast.js:
3540         * wasm/spec-tests/unreached-invalid.wast.js:
3541         * wasm/spec-tests/unwind.wast.js:
3542         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
3543         * wasm/spec-tests/utf8-import-field.wast.js: Added.
3544         * wasm/spec-tests/utf8-import-module.wast.js: Added.
3545
3546 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
3547
3548         Unreviewed JSC test gardening.
3549
3550         * stress/check-string-ident.js:
3551         * stress/new-largeish-contiguous-array-with-size.js:
3552
3553 2017-06-13  Michael Saboff  <msaboff@apple.com>
3554
3555         DFG doesn't properly handle a property that is change to read only in a prototype
3556         https://bugs.webkit.org/show_bug.cgi?id=173321
3557
3558         Reviewed by Filip Pizlo.
3559
3560         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
3561         * stress/regress-173321.js: Added new regression test.
3562         (shouldBe):
3563         (SimpleObject):
3564         (test):
3565
3566 2017-06-12  Saam Barati  <sbarati@apple.com>
3567
3568         Update test262 test expectation since r218082 makes new tests pass.
3569
3570         * test262.yaml:
3571
3572 2017-06-12  Saam Barati  <sbarati@apple.com>
3573
3574         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
3575         https://bugs.webkit.org/show_bug.cgi?id=172957
3576         <rdar://problem/32602704>
3577
3578         Reviewed by Filip Pizlo.
3579
3580         * stress/spec-empty-flows-through-cell-checks.js: Added.
3581         (A):
3582         (B):
3583         (i.catch):
3584
3585 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
3586
3587         We incorrectly allow escaped characters in keyword tokens
3588         https://bugs.webkit.org/show_bug.cgi?id=171310
3589
3590         Reviewed by Yusuke Suzuki.
3591
3592         * stress/destructuring-assignment-syntax.js:
3593         * stress/error-messages-for-in-operator-should-not-crash.js:
3594         (catch):
3595         * stress/reserved-word-with-escape.js:
3596         (testSyntaxError.String.raw.v):
3597         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
3598         (testSyntaxError.String.raw.a):
3599         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
3600
3601 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
3602
3603         [DFG] Add ArrayIndexOf intrinsic
3604         https://bugs.webkit.org/show_bug.cgi?id=172421
3605
3606         Reviewed by Saam Barati.
3607
3608         * stress/array-indexof-array-prototype-change.js: Added.
3609         (shouldBe):
3610         (indexOfInt32):
3611         * stress/array-indexof-have-a-bad-time-getter.js: Added.
3612         (shouldBe):
3613         (indexOfInt32):
3614         * stress/array-indexof-have-a-bad-time.js: Added.
3615         (shouldBe):
3616         (indexOfInt32):
3617         * stress/array-indexof-hole-with-prototype.js: Added.
3618         (shouldBe):
3619         (indexOf):
3620         * stress/array-indexof-hole.js: Added.
3621         (shouldBe):
3622         (indexOf):
3623         * stress/array-indexof-index.js: Added.
3624         (shouldBe):
3625         (indexOfInt32):
3626         (indexOfDouble):
3627         (indexOfString):
3628         (indexOfObject):
3629         (indexOfValue):
3630         * stress/array-indexof-negative-index.js: Added.
3631         (shouldBe):
3632         (indexOfInt32):
3633         (indexOfDouble):
3634         (indexOfString):
3635         (indexOfObject):
3636         (indexOfValue):
3637         * stress/array-indexof-non-int32-start-index.js: Added.
3638         (shouldBe):
3639         (indexOf):
3640         (object.valueOf):
3641         * stress/array-indexof-object-prototype-change.js: Added.
3642         (shouldBe):
3643         (indexOfInt32):
3644         * stress/array-indexof-object.js: Added.
3645         (shouldBe):
3646         (indexOf):
3647         * stress/array-indexof-original-array.js: Added.
3648         (shouldBe):
3649         (indexOfInt32):
3650         * stress/array-indexof-string.js: Added.
3651         (shouldBe):
3652         (indexOf):
3653         * stress/array-indexof-structure-change-convert.js: Added.
3654         (shouldBe):
3655         (indexOf):
3656         * stress/array-indexof-structure-change.js: Added.
3657         (shouldBe):
3658         (indexOf):
3659         * stress/array-indexof.js: Added.
3660         (shouldBe):
3661         (indexOf):
3662
3663 2017-06-11  Keith Miller  <keith_miller@apple.com>
3664
3665         TypedArray constructor with string shouldn't throw
3666         https://bugs.webkit.org/show_bug.cgi?id=173181
3667
3668         Reviewed by JF Bastien.
3669
3670         We should be coercing primitive arguments to numbers in the various
3671         TypedArray constructors.
3672
3673         * stress/typedarray-constructor.js:
3674
3675 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
3676
3677         Unreviewed, update test results part 3
3678         https://bugs.webkit.org/show_bug.cgi?id=173227
3679
3680         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
3681
3682 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3683
3684         Unreviewed, update test results part 2
3685         https://bugs.webkit.org/show_bug.cgi?id=173227
3686
3687         * test262.yaml:
3688
3689 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3690
3691         Unreviewed, update test results
3692         https://bugs.webkit.org/show_bug.cgi?id=173227
3693
3694         * microbenchmarks/string-prototype-search-observable-side-effects.js:
3695         * test262.yaml:
3696
3697 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3698
3699         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
3700         https://bugs.webkit.org/show_bug.cgi?id=173227
3701
3702         Reviewed by Mark Lam.
3703
3704         Update the test.
3705
3706         * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
3707
3708 2017-06-08  Keith Miller  <keith_miller@apple.com>
3709
3710         WebAssembly: We should only create wrappers for functions that can be exported
3711         https://bugs.webkit.org/show_bug.cgi?id=173088
3712
3713         Reviewed by Saam Barati.
3714
3715         Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
3716         on the old testWasmModuleFunctions api, which has been removed.
3717
3718         * wasm/function-tests/copysign.js: Removed.
3719         * wasm/function-tests/ctz.js: Removed.
3720         * wasm/function-tests/drop.js: Removed.
3721         * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
3722         * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
3723         * wasm/function-tests/dumb-less-than-ite.js: Removed.
3724         * wasm/function-tests/eqz.js: Removed.
3725         * wasm/function-tests/i32-trunc-s-f32.js: Removed.
3726         * wasm/function-tests/i32-trunc-s-f64.js: Removed.
3727         * wasm/function-tests/i32-trunc-u-f32.js: Removed.
3728         * wasm/function-tests/i32-trunc-u-f64.js: Removed.
3729         * wasm/function-tests/i64-trunc-s-f32.js: Removed.
3730         * wasm/function-tests/i64-trunc-s-f64.js: Removed.
3731         * wasm/function-tests/i64-trunc-u-f32.js: Removed.
3732         * wasm/function-tests/i64-trunc-u-f64.js: Removed.
3733         * wasm/function-tests/if-then-else-fallthrough.js: Removed.
3734         * wasm/function-tests/if-then-fallthrough.js: Removed.
3735         * wasm/function-tests/int-to-floating-point.js: Removed.
3736         * wasm/function-tests/loop-mult.js:
3737         * wasm/function-tests/loop-sum.js:
3738         * wasm/function-tests/max.js: Removed.
3739         * wasm/function-tests/min.js: Removed.
3740         * wasm/function-tests/nearest.js: Removed.
3741         * wasm/function-tests/nop.js: Removed.
3742         * wasm/function-tests/popcnt.js: Removed.
3743         * wasm/function-tests/ret5.js:
3744         * wasm/function-tests/select.js: Removed.
3745         * wasm/function-tests/tee-local.js: Removed.
3746         * wasm/function-tests/trunc.js: Removed.
3747
3748 2017-06-07  JF Bastien  <jfbastien@apple.com>
3749
3750         WebAssembly: test imports and exports with 16-bit characters
3751         https://bugs.webkit.org/show_bug.cgi?id=165977
3752         <rdar://problem/29760130>
3753
3754         Reviewed by Saam Barati.
3755
3756         The output for import failure was improved, so many tests need to
3757         be updated here. Only one has new tests as noted below.
3758
3759         * wasm/function-tests/memory-import-and-grow.js:
3760         * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
3761         (idxModule):
3762         * wasm/js-api/global-error.js:
3763         (new.Number):
3764         (assert.throws):
3765         * wasm/js-api/table.js:
3766         (assert.throws):
3767         (new.WebAssembly.Table):
3768         * wasm/js-api/test_memory.js:
3769         (test):
3770         * wasm/js-api/wasm-to-wasm-bad-signature.js:
3771         (BadSignatureDropStartParams.):
3772         (BadSignatureDropStartParams):
3773         (BadSignatureDropEndParams.):
3774         (BadSignatureSwapParam.):
3775         (BadSignatureRet.):
3776         * wasm/js-api/web-assembly-instantiate.js:
3777         (assert.asyncTest.async.test):
3778         (assert.asyncTest):
3779         * wasm/js-api/wrapper-function.js:
3780         (return.new.WebAssembly.Module):
3781
3782 2017-06-07  Mark Lam  <mark.lam@apple.com>
3783
3784         Restrict the regress-173035.js test to only run on Darwin x86-64.
3785         https://bugs.webkit.org/show_bug.cgi?id=173075
3786
3787         Reviewed by Saam Barati.
3788
3789         This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
3790         this test will require to succeed.  Here's an example of this failure:
3791         https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
3792
3793         Since the issue is due to allocation of a very large amount of memory, the test
3794         will probably fail on iOS and other platforms as well.  Hence, we should just
3795         skip this test for any platforms that is not Darwin x86-64.
3796
3797         * stress/regress-173035.js:
3798
3799 2017-06-07  Mark Lam  <mark.lam@apple.com>
3800
3801         ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
3802         https://bugs.webkit.org/show_bug.cgi?id=168587
3803
3804         Not reviewed.
3805
3806         Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
3807
3808         * stress/test-finally.js:
3809
3810 2017-06-06  Mark Lam  <mark.lam@apple.com>
3811
3812         Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
3813         https://bugs.webkit.org/show_bug.cgi?id=173035
3814         <rdar://problem/32554593>
3815
3816         Reviewed by Geoffrey Garen and Filip Pizlo.
3817
3818         * stress/regress-173035.js: Added.
3819
3820 2017-06-06  Saam Barati  <sbarati@apple.com>
3821
3822         Make sure we restore SP when doing calls that could be to JS
3823         https://bugs.webkit.org/show_bug.cgi?id=172946
3824         <rdar://problem/32579026>
3825
3826         Reviewed by JF Bastien.
3827
3828         * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
3829         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
3830         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
3831         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
3832         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
3833
3834 2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
3835
3836         Unreviewed rollout r217807. Caused a test to crash.
3837
3838         * heapProfiler/class-names.js: Removed.
3839         * heapProfiler/driver/driver.js:
3840         (CheapHeapSnapshotNode):
3841         (CheapHeapSnapshot):
3842         (createCheapHeapSnapshot):
3843         (HeapSnapshot):
3844         (createHeapSnapshot):
3845         * typeProfiler/inheritance.js:
3846         (wrapper.A):
3847         (wrapper.B):
3848         (wrapper.C):
3849         (wrapper):
3850
3851 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
3852
3853         index out of bound in bytecodebasicblock
3854         https://bugs.webkit.org/show_bug.cgi?id=172963
3855
3856         Reviewed by Saam Barati and Mark Lam.
3857
3858         * stress/dfg-call-class-constructor.js: Added.
3859         (Foo):
3860         (i.catch):
3861
3862 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
3863
3864         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
3865         https://bugs.webkit.org/show_bug.cgi?id=172848
3866         <rdar://problem/25709212>
3867
3868         Reviewed by Saam Barati.
3869
3870         * typeProfiler/inheritance.js:
3871         Rewrite the test slightly for clarity. The hoisting was confusing.
3872
3873         * heapProfiler/class-names.js: Added.
3874         (MyES5Class):
3875         (MyES6Class):
3876         (MyES6Subclass):
3877         Test object types and improved class names.
3878
3879         * heapProfiler/driver/driver.js:
3880         (CheapHeapSnapshotNode):
3881         (CheapHeapSnapshot):
3882         (createCheapHeapSnapshot):
3883         (HeapSnapshot):
3884         (createHeapSnapshot):
3885         Update snapshot parsing from version 1 to version 2.
3886
3887 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3888
3889         ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
3890         https://bugs.webkit.org/show_bug.cgi?id=168844
3891
3892         Reviewed by Saam Barati.
3893
3894         * modules/async-function-export.js: Added.
3895         (f):
3896         (export.async.f):
3897
3898 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3899
3900         ES2015 modules - Export default function hoisting
3901         https://bugs.webkit.org/show_bug.cgi?id=170174
3902
3903         Reviewed by Saam Barati.
3904
3905         This issue itself is solved by fixing function declaration hoisting rules.
3906         This patch just adds the specific test to modules tests to ensure the bug
3907         is fixed.
3908
3909         * modules/export-default-function-hoisting.js: Added.
3910         * modules/export-default-function-hoisting/cappuccino.js: Added.
3911         (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
3912         * modules/export-default-function-hoisting/cocoa.js: Added.
3913         (export.default.drinkCocoa):
3914
3915 2017-06-01  Oleksandr Skachkov  <gskachkov@gmail.com>
3916
3917         Class Proxy can't be extended
3918         https://bugs.webkit.org/show_bug.cgi?id=169040
3919
3920         Reviewed by Saam Barati.
3921
3922         Adding tests that check correctness of Proxy to ES6 `class`
3923         Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
3924
3925         * stress/proxy-class.js: Added.
3926         (assert):
3927         (throw.new.Error.SuperClass):
3928         (throw.new.Error.A):
3929         (throw.new.Error):
3930
3931 2017-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3932
3933         [JSC] Implement String.prototype.concat in JS builtins
3934         https://bugs.webkit.org/show_bug.cgi?id=172798
3935
3936         Reviewed by Sam Weinig.
3937
3938         * microbenchmarks/string-concat-convert.js: Added.
3939         (test):
3940         * microbenchmarks/string-concat-long-convert.js: Added.
3941         (test):
3942         * microbenchmarks/string-concat-long.js: Added.
3943         (test):
3944         * microbenchmarks/string-concat.js: Added.
3945         (test):
3946
3947 2017-05-31  Oleksandr Skachkov  <gskachkov@gmail.com>
3948
3949         Rolling out: Prevent async methods named 'function'
3950         https://bugs.webkit.org/show_bug.cgi?id=172776
3951
3952         Reviewed by Mark Lam.
3953
3954         * stress/async-await-syntax.js:
3955         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
3956         (testTopLevelAsyncAwaitSyntaxSloppyMode):
3957         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
3958         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
3959         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
3960
3961 2017-05-31  Ryan Haddad  <ryanhaddad@apple.com>
3962
3963         Skip flaky JSC test stress/test-finally.js
3964         https://bugs.webkit.org/show_bug.cgi?id=168587
3965
3966         Unreviewed test gardening.
3967
3968         * stress/test-finally.js:
3969
3970 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3971
3972         Prevent async methods named 'function' in Object literal
3973         https://bugs.webkit.org/show_bug.cgi?id=172660
3974
3975         Reviewed by Saam Barati.
3976
3977         * stress/async-await-syntax.js:
3978         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
3979
3980 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3981
3982         ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
3983         https://bugs.webkit.org/show_bug.cgi?id=171274
3984
3985         Reviewed by Saam Barati.
3986
3987         * stress/async-arrow-functions-lexical-binding-in-class.js:
3988         (shouldBeAsync):
3989         (shouldBeAsyncAndStoreBind):
3990         (promise.new.Promise):
3991         (ChildClass4):
3992         (ChildClass4.prototype.classValue):
3993         (ChildClass4.prototype.get classProperty):
3994         * stress/async-arrow-functions-lexical-super-binding.js:
3995         (A):
3996         (const.childA1.new.prototype.var.f.async):
3997         (const.childA1.new.var):
3998         (const.childA1.new):
3999         (const.childA2.new.prototype.var.f.async):
4000         (const.childA2.new.var):
4001         (const.childA2.new):
4002         (const.childA3.new.prototype.var.f.async):
4003         (const.childA3.new.var):
4004         (const.childA3.new):
4005         (try.childA4.new.prototype.var.f.async):
4006         (try.childA4.new.var):
4007         (try.childA4.new):
4008         (catch):
4009         (const.childA5.new.prototype.var.f.async):
4010         (const.childA5.new.var):
4011         (const.childA5.new):
4012         (checkClass):
4013         (checkClass.new.prototype.var.f.async):
4014         (checkClass.new.var):
4015         (checkClass.new):
4016         (checkClass.new.prototype.method):
4017         (checkClass.new.prototype.prop):
4018
4019 2017-05-27  Yusuke Suzuki  <utatane.tea@gmail.com>
4020
4021         [JSC] Map and Set constructors should have fast path for cloning
4022         https://bugs.webkit.org/show_bug.cgi?id=172413
4023
4024         Reviewed by Saam Barati.
4025
4026         * stress/map-clone-instance-iterator-change.js: Added.
4027         (shouldBe):
4028         (map.Symbol.iterator):
4029         * stress/map-clone-iterator-change.js: Added.
4030         (shouldBe):
4031         (Map.prototype.Symbol.iterator):
4032         * stress/map-clone-next-change.js: Added.
4033         (shouldBe):
4034         (map.Symbol.iterator.__proto__.next):
4035         * stress/map-clone.js: Added.
4036         (shouldBe):
4037         (Map.prototype):
4038         * stress/map-inherit-set.js: Added.
4039         (shouldBe):
4040         (DerivedMap):
4041         (set for):
4042         * stress/set-clone-instance-iterator-change.js: Added.
4043         (shouldBe):
4044         (set Symbol.iterator):
4045         * stress/set-clone-iterator-change.js: Added.
4046         (shouldBe):
4047         (set Set.prototype.Symbol.iterator):
4048         * stress/set-clone-next-change.js: Added.
4049         (shouldBe):
4050         (set Symbol.iterator.__proto__.next):
4051         * stress/set-clone.js: Added.
4052         (shouldBe):
4053         (set Set.prototype.add):
4054         * stress/set-inherit-add.js: Added.
4055         (shouldBe):
4056         (DerivedSet.set add):
4057
4058 2017-05-26  Ryan Haddad  <ryanhaddad@apple.com>
4059
4060         Unreviewed, rolling out r217458.
4061
4062         This change caused 55 JSC test failures.
4063
4064         Reverted changeset:
4065
4066         "Date should use historical data if it's available."
4067         https://bugs.webkit.org/show_bug.cgi?id=172592
4068         http://trac.webkit.org/changeset/217458
4069
4070 2017-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
4071
4072         Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
4073         https://bugs.webkit.org/show_bug.cgi?id=167805
4074
4075         Reviewed by Saam Barati.
4076
4077         * modules/module-jit-reachability.js: Added.
4078
4079 2017-05-26  Oleksandr Skachkov  <gskachkov@gmail.com>
4080
4081         Prevent async methods named 'function'
4082         https://bugs.webkit.org/show_bug.cgi?id=172598
4083
4084         Reviewed by Mark Lam.
4085
4086         * stress/async-await-syntax.js:
4087         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
4088         (testTopLevelAsyncAwaitSyntaxSloppyMode):
4089         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
4090         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
4091         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
4092
4093 2017-05-25  Keith Miller  <keith_miller@apple.com>
4094
4095         Date should use historical data if it's available.
4096         https://bugs.webkit.org/show_bug.cgi?id=172592
4097
4098         Reviewed by Mark Lam.
4099
4100         Remove parts of the date tests that rely on the absence of
4101         historical data in Date.
4102
4103         * mozilla/ecma/Date/15.9.5.31-1.js:
4104         (getTestCases):
4105         * mozilla/ecma/Date/15.9.5.35-1.js:
4106         (getTestCases):
4107
4108 2017-05-25  Saam Barati  <sbarati@apple.com>
4109
4110         Our for-in optimization in the bytecode generator does its static analysis incorrectly
4111         https://bugs.webkit.org/show_bug.cgi?id=172532
4112         <rdar://problem/32369452>
4113
4114         Reviewed by Mark Lam.
4115
4116         * stress/for-in-invalidation-for-any-write.js: Added.
4117         (assert):
4118         (test):
4119         (test.i):
4120
4121 2017-05-25  Mark Lam  <mark.lam@apple.com>
4122
4123         ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
4124         https://bugs.webkit.org/show_bug.cgi?id=172548
4125         <rdar://problem/31458393>
4126
4127         Reviewed by Filip Pizlo.
4128
4129         * stress/regress-172548.patch: Added.
4130
4131 2017-05-23  Saam Barati  <sbarati@apple.com>
4132
4133         We should not mmap zero bytes for a memory in Wasm
4134         https://bugs.webkit.org/show_bug.cgi?id=172528
4135         <rdar://problem/32257076>
4136
4137         Reviewed by Mark Lam.
4138
4139         * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
4140         (testMems):
4141
4142 2017-05-23  Saam Barati  <sbarati@apple.com>
4143
4144         CFGSimplificationPhase should not merge a block with itself
4145         https://bugs.webkit.org/show_bug.cgi?id=172508
4146         <rdar://problem/28424006>
4147
4148         Reviewed by Keith Miller.
4149
4150         * stress/dont-crash-in-cfg-simplification.js: Added.
4151         (bar):
4152         (baz):
4153         (foo):
4154
4155 2017-05-20  Yusuke Suzuki  <utatane.tea@gmail.com>
4156
4157         [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
4158         https://bugs.webkit.org/show_bug.cgi?id=172216
4159
4160         Reviewed by Saam Barati.
4161
4162         * stress/array-storage-get-by-val.js: Added.
4163         (shouldBe):
4164         (testOutOfBound):
4165         (testInBound):
4166         (testSlowPutOutOfBound):
4167         (testSlowPutInBound):
4168
4169 2017-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
4170
4171         Unreviewed, fix commented out tests
4172         https://bugs.webkit.org/show_bug.cgi?id=172225
4173
4174         * stress/get-by-val-string.js:
4175         (object.43):
4176         (Hello):
4177         (Hello.prototype.get 42):
4178         (Hello.prototype.43):
4179         (Derived):
4180         (shouldBe):
4181         (throw.new.Error): Deleted.
4182
4183 2017-05-21  Saam Barati  <sbarati@apple.com>
4184
4185         We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
4186         https://bugs.webkit.org/show_bug.cgi?id=171041
4187         <rdar://problem/32082516>
4188
4189         Reviewed by Yusuke Suzuki.
4190
4191         * stress/lexical-scoping-for-loop.js: Added.
4192         (assert):
4193         (test1):
4194         (test2):
4195         (test3):
4196         (test4):
4197         (test5):
4198         (test6):
4199         (let.test7):
4200         (let.test8):
4201         (let.test9):
4202         (let.test10):
4203         (let.test11):
4204         (let.test12):
4205
4206 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
4207
4208         [JSC] Make get_by_val & string "499" to number 499
4209         https://bugs.webkit.org/show_bug.cgi?id=172225
4210
4211         Reviewed by Saam Barati.
4212
4213         * stress/get-by-val-string.js: Added.
4214         (shouldBe):
4215         (shouldThrow):
4216         (object.43):
4217         (Hello):
4218         (Hello.prototype.get 42):
4219         (Hello.prototype.43):
4220         (Derived):
4221
4222 2017-05-19  Mark Lam  <mark.lam@apple.com>
4223
4224         [Re-landing] DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
4225         https://bugs.webkit.org/show_bug.cgi?id=172383
4226         <rdar://problem/31418651>
4227
4228         Reviewed by Filip Pizlo.
4229
4230         * stress/regress-172383.js: Added.
4231
4232 2017-05-19  Ryan Haddad  <ryanhaddad@apple.com>
4233
4234         Unreviewed, rolling out r217156.
4235
4236         This change broke the iOS build.
4237
4238         Reverted changeset:
4239
4240         "DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring
4241         result registers."
4242         https://bugs.webkit.org/show_bug.cgi?id=172383
4243         http://trac.webkit.org/changeset/217156
4244
4245 2017-05-19  Mark Lam  <mark.lam@apple.com>
4246
4247         Add missing exception check.
4248         https://bugs.webkit.org/show_bug.cgi?id=172346
4249         <rdar://problem/32289640>
4250
4251         Reviewed by Geoffrey Garen.
4252
4253         * stress/regress-172346.js: Added.
4254
4255 2017-05-19  Mark Lam  <mark.lam@apple.com>
4256
4257         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
4258         https://bugs.webkit.org/show_bug.cgi?id=172383
4259         <rdar://problem/31418651>
4260
4261         Reviewed by Filip Pizlo.
4262
4263         * stress/regress-172383.js: Added.
4264
4265 2017-05-19  Filip Pizlo  <fpizlo@apple.com>
4266
4267         arrayProtoPrivateFuncConcatMemcpy needs to be down with firstArray being undecided
4268         https://bugs.webkit.org/show_bug.cgi?id=172369
4269
4270         Reviewed by Mark Lam.
4271
4272         * stress/undecided-concat.js: Added.
4273
4274 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
4275
4276         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
4277         https://bugs.webkit.org/show_bug.cgi?id=172098
4278
4279         Reviewed by Saam Barati.
4280
4281         * stress/check-sub-class.js: Added.
4282         (shouldBe):
4283         (shouldThrow):
4284         (calling):
4285         (array.forEach):
4286         (i.array.forEach):
4287
4288 2017-05-18  JF Bastien  <jfbastien@apple.com>
4289
4290         WebAssembly: exports is a getter
4291         https://bugs.webkit.org/show_bug.cgi?id=172129
4292
4293         Reviewed by Saam Barati.
4294
4295         Update test to reflect new semantics.
4296
4297         * wasm/js-api/test_basic_api.js:
4298         (const.c.in.constructorProperties.switch):
4299
4300 2017-05-18  Saam Barati  <sbarati@apple.com>
4301
4302         Proxy's [[Get]] passes incorrect receiver
4303         https://bugs.webkit.org/show_bug.cgi?id=164849
4304         <rdar://problem/31767058>
4305
4306         Reviewed by Yusuke Suzuki.
4307
4308         * stress/proxy-get-set-correct-receiver.js: Added.
4309         (assert):
4310         (test):
4311         (test.let.target.set prop):
4312         (test.let.target.get prop):
4313         (test.get let):
4314         * stress/proxy-set.js:
4315         (let.target.get x):
4316         * stress/reflect-set-proxy-set.js:
4317         (let.target.get x):
4318         * stress/reflect-set-receiver-proxy-set.js:
4319         (let.target.get x):
4320
4321 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
4322
4323         Constructor calls set this too early
4324         https://bugs.webkit.org/show_bug.cgi?id=172302
4325
4326         Reviewed by Saam Barati.
4327         
4328         This tests all three kinds of constructs in BytecodeGenerator. All three were previously
4329         wrong.
4330
4331         * stress/construct-overwritten-variable.js: Added.
4332         (new.x.x):
4333         * stress/construct-spread-overwritten-variable-2.js: Added.
4334         (new.x.x):
4335         * stress/construct-spread-overwritten-variable.js: Added.
4336         (new.x.x):
4337
4338 2017-05-18  Saam Barati  <sbarati@apple.com>
4339
4340         WebAssembly: perform stack checks
4341         https://bugs.webkit.org/show_bug.cgi?id=165546
4342         <rdar://problem/29760307>
4343
4344         Reviewed by Filip Pizlo.
4345
4346         * wasm.yaml:
4347         * wasm/function-tests/factorial.js:
4348         * wasm/function-tests/float-sub.js:
4349         * wasm/function-tests/stack-overflow.js: Added.
4350         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
4351         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
4352         (assertOverflows.makeInstance):
4353         (assertOverflows.makeInstance2):
4354         (assertOverflows.assertThrows):
4355         (assertOverflows):
4356         (assertThrows.test.makeSignature):
4357         (assertThrows.test.makeInstance):
4358         (assertThrows.test):
4359         (assertThrows):
4360
4361 2017-05-18  Keith Miller  <keith_miller@apple.com>
4362
4363         WebAssembly API: test with neutered inputs
4364         https://bugs.webkit.org/show_bug.cgi?id=163899
4365
4366         Reviewed by JF Bastien.
4367
4368         * wasm/js-api/neutered-inputs.js: Added.
4369         (const.testFunction):
4370         (const.testConstructor):
4371         * wasm/js-api/test_basic_api.js:
4372         (const.c.in.constructorProperties.switch):
4373
4374 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
4375
4376         DFG inlining should be hardened for the no-result case
4377         https://bugs.webkit.org/show_bug.cgi?id=172290
4378
4379         Reviewed by Saam Barati.
4380
4381         * stress/array-constructor-no-result.js: Added.
4382         (foo):
4383         * stress/pow-no-result.js: Added.
4384         (foo):
4385
4386 2017-05-18  Commit Queue  <commit-queue@webkit.org>
4387
4388         Unreviewed, rolling out r217031, r217032, and r217037.
4389         https://bugs.webkit.org/show_bug.cgi?id=172293
4390
4391         cause linking errors in Windows (Requested by yusukesuzuki on
4392         #webkit).
4393
4394         Reverted changesets:
4395
4396         "[JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass"
4397         https://bugs.webkit.org/show_bug.cgi?id=172098
4398         http://trac.webkit.org/changeset/217031
4399
4400         "Unreviewed, rebaseline for newly added ClassInfo"
4401         https://bugs.webkit.org/show_bug.cgi?id=172098
4402         http://trac.webkit.org/changeset/217032
4403
4404         "Unreviewed, fix debug and non-JIT build"
4405         https://bugs.webkit.org/show_bug.cgi?id=172098
4406         http://trac.webkit.org/changeset/217037
4407
4408 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
4409
4410         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
4411         https://bugs.webkit.org/show_bug.cgi?id=172098
4412
4413         Reviewed by Saam Barati.
4414
4415         * stress/check-sub-class.js: Added.
4416         (shouldBe):
4417         (shouldThrow):
4418         (calling):
4419         (array.forEach):
4420         (i.array.forEach):
4421
4422 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
4423
4424         Unreviewed, address mlam's review feedback.
4425
4426         * stress/arguments-elimination-varargs-too-many-args-arg-count.js:
4427
4428 2017-05-17  Saam Barati  <sbarati@apple.com>
4429
4430         We don't do context switches for Wasm->Wasm call indirect
4431         https://bugs.webkit.org/show_bug.cgi?id=172188