e5586241d6206f5d09a8bc181d8e3a6d4741c97b
[WebKit-https.git] / JSTests / ChangeLog
1 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
2
3         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
4         https://bugs.webkit.org/show_bug.cgi?id=180190
5
6         Reviewed by Mark Lam.
7
8         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
9         (shouldBe):
10         (test1):
11         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
12         (shouldBe):
13         (test1):
14         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
15         (shouldBe):
16         (test1):
17         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
18         (shouldBe):
19         (test1):
20         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
21         (shouldBe):
22         (test1):
23         * stress/operation-in-may-have-negative-int32.js: Added.
24         (shouldBe):
25         (test2):
26         * stress/operation-in-negative-int32-cast.js: Added.
27         (shouldBe):
28         (test1):
29
30 2017-11-28  JF Bastien  <jfbastien@apple.com>
31
32         Strict and sloppy functions shouldn't share structure
33         https://bugs.webkit.org/show_bug.cgi?id=180103
34         <rdar://problem/35667847>
35
36         Reviewed by Saam Barati.
37
38         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
39         because the IC was wrong.
40         (foo):
41         (bar):
42         (baz):
43         (catch):
44         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
45         in this patch, but may as well test odd strict mode corner cases.
46         (bar):
47         (baz):
48         (catch):
49         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
50         (foo):
51         (bar):
52         (baz):
53         (catch):
54         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
55         next file, but with invalidation of the FunctionExecutable's
56         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
57         slower path.
58         (foo):
59         (bar.const.x):
60         (bar.const.y):
61         (bar):
62         (catch):
63         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
64         strict nesting works correctly.
65         (foo):
66         (bar.baz):
67         (bar):
68         * stress/strict-function-structure.js: Added. The test used to
69         assert in objectProtoFuncHasOwnProperty.
70         (foo):
71         (bar):
72         (baz):
73         * stress/strict-nested-function-structure.js: Added. Nesting.
74         (foo):
75         (bar):
76         (baz.boo):
77         (baz):
78
79 2017-11-29  Robin Morisset  <rmorisset@apple.com>
80
81         The recursive tail call optimisation is wrong on closures
82         https://bugs.webkit.org/show_bug.cgi?id=179835
83
84         Reviewed by Saam Barati.
85
86         * stress/closure-recursive-tail-call.js: Added.
87         (makeClosure):
88
89 2017-11-27  JF Bastien  <jfbastien@apple.com>
90
91         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
92         https://bugs.webkit.org/show_bug.cgi?id=180051
93         <rdar://problem/35614371>
94
95         Reviewed by Saam Barati.
96
97         * stress/rest-parameter-negative.js: Added.
98         (__f_5484):
99         (catch):
100         (__f_5485):
101         (__v_22598.catch):
102
103 2017-11-27  Saam Barati  <sbarati@apple.com>
104
105         Spread can escape when CreateRest does not
106         https://bugs.webkit.org/show_bug.cgi?id=180057
107         <rdar://problem/35676119>
108
109         Reviewed by JF Bastien.
110
111         * stress/spread-escapes-but-create-rest-does-not.js: Added.
112         (assert):
113         (getProperties):
114         (theFunc):
115         (let.obj.valueOf):
116
117 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
118
119         [DFG] Add NormalizeMapKey DFG IR
120         https://bugs.webkit.org/show_bug.cgi?id=179912
121
122         Reviewed by Saam Barati.
123
124         * stress/map-untyped-normalize-cse.js: Added.
125         (shouldBe):
126         (test):
127         * stress/map-untyped-normalize.js: Added.
128         (shouldBe):
129         (test):
130         * stress/set-untyped-normalize-cse.js: Added.
131         (shouldBe):
132         (set return.set has.set has):
133         * stress/set-untyped-normalize.js: Added.
134         (shouldBe):
135         (set return.set has):
136
137 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
138
139         [FTL] Support DeleteById and DeleteByVal
140         https://bugs.webkit.org/show_bug.cgi?id=180022
141
142         Reviewed by Saam Barati.
143
144         * stress/delete-by-id.js: Added.
145         (shouldBe):
146         (test1):
147         (test2):
148         * stress/delete-by-val-ftl.js: Added.
149         (shouldBe):
150         (test1):
151         (test2):
152
153 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
154
155         [DFG] Introduce {Set,Map,WeakMap}Fields
156         https://bugs.webkit.org/show_bug.cgi?id=179925
157
158         Reviewed by Saam Barati.
159
160         * stress/map-set-clobber-map-get.js: Added.
161         (shouldBe):
162         (test):
163         * stress/map-set-does-not-clobber-set-has.js: Added.
164         (shouldBe):
165         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
166         (shouldBe):
167         (test):
168         * stress/set-add-clobber-set-has.js: Added.
169         (shouldBe):
170         * stress/set-add-does-not-clobber-map-get.js: Added.
171         (shouldBe):
172
173 2017-11-24  Mark Lam  <mark.lam@apple.com>
174
175         Move unsafe jsc shell test functions to the $vm object.
176         https://bugs.webkit.org/show_bug.cgi?id=179980
177
178         Reviewed by Yusuke Suzuki.
179
180         * controlFlowProfiler/driver/driver.js:
181         * controlFlowProfiler/execution-count.js:
182         * controlFlowProfiler/if-statement.js:
183         * controlFlowProfiler/loop-statements.js:
184         * controlFlowProfiler/switch-statements.js:
185         * controlFlowProfiler/test-jit.js:
186         * exceptionFuzz/3d-cube.js:
187         * exceptionFuzz/date-format-xparb.js:
188         * exceptionFuzz/earley-boyer.js:
189         * heapProfiler/basic-edges.js:
190         * heapProfiler/property-edge-types.js:
191         * microbenchmarks/try-get-by-id-basic.js:
192         * microbenchmarks/try-get-by-id-polymorphic.js:
193         * modules/namespace-object-try-get.js:
194         * stress/argument-count-bytecode.js:
195         * stress/argument-intrinsic-basic.js:
196         * stress/argument-intrinsic-inlining-use-caller-arg.js:
197         * stress/argument-intrinsic-inlining-with-result-escape.js:
198         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
199         * stress/argument-intrinsic-inlining-with-vararg.js:
200         * stress/argument-intrinsic-nested-inlining.js:
201         * stress/argument-intrinsic-not-convert-to-get-argument.js:
202         * stress/argument-intrinsic-with-stack-write.js:
203         * stress/arity-mismatch-get-argument.js:
204         * stress/array-message-passing.js:
205         * stress/array-push-with-force-exit.js:
206         * stress/check-dom-with-signature.js:
207         * stress/check-sub-class.js:
208         * stress/compare-eq-incomplete-profile.js:
209         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
210         * stress/do-eval-virtual-call-correctly.js:
211         * stress/dom-jit-with-poly-proto.js:
212         * stress/domjit-exception-ic.js:
213         * stress/domjit-exception.js:
214         * stress/domjit-getter-complex-with-incorrect-object.js:
215         * stress/domjit-getter-complex.js:
216         * stress/domjit-getter-poly.js:
217         * stress/domjit-getter-proto.js:
218         * stress/domjit-getter-super-poly.js:
219         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
220         * stress/domjit-getter-type-check.js:
221         * stress/domjit-getter.js:
222         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
223         * stress/for-in-proxy-target-changed-structure.js:
224         * stress/for-in-proxy.js:
225         * stress/generational-opaque-roots.js:
226         * stress/global-const-redeclaration-setting-2.js:
227         * stress/global-const-redeclaration-setting-3.js:
228         * stress/global-const-redeclaration-setting-4.js:
229         * stress/global-const-redeclaration-setting-5.js:
230         * stress/global-const-redeclaration-setting.js:
231         * stress/import-basic.js:
232         * stress/import-from-eval.js:
233         * stress/import-reject-with-exception.js:
234         * stress/import-syntax.js:
235         * stress/impure-get-own-property-slot-inline-cache.js:
236         * stress/is-constructor.js:
237         * stress/istypedarrayview-intrinsic.js:
238         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
239         * stress/jsc-test-functions-should-be-more-robust.js:
240         * stress/object-toString-with-proxy.js:
241         * stress/poly-proto-custom-value-and-accessor.js:
242         * stress/proxy-inline-cache.js:
243         * stress/re-execute-error-module.js:
244         * stress/regress-150532.js:
245         * stress/regress-156992.js:
246         * stress/regress-179619.js:
247         * stress/resources/shadow-chicken-support.js:
248         * stress/runtime-array.js:
249         * stress/sampling-profiler-microtasks.js:
250         * stress/shadow-chicken-enabled.js:
251         * stress/spread-correct-global-object-on-exception.js:
252         * stress/super-get-by-id.js:
253         * stress/tailCallForwardArguments.js:
254         * stress/to-object-intrinsic-boolean-edge.js:
255         * stress/to-object-intrinsic-null-or-undefined-edge.js:
256         * stress/to-object-intrinsic-number-edge.js:
257         * stress/to-object-intrinsic-object-edge.js:
258         * stress/to-object-intrinsic-string-edge.js:
259         * stress/to-object-intrinsic-symbol-edge.js:
260         * stress/to-object-intrinsic.js:
261         * stress/try-catch-custom-getter-as-get-by-id.js:
262         * stress/try-get-by-id-poly-proto.js:
263         * stress/try-get-by-id-should-spill-registers-dfg.js:
264         * stress/try-get-by-id.js:
265         * typeProfiler/arrow-functions.js:
266         * typeProfiler/basic.js:
267         * typeProfiler/captured.js:
268         * typeProfiler/classes.js:
269         * typeProfiler/dfg-jit-optimizations.js:
270         * typeProfiler/dictionary-mode.js:
271         * typeProfiler/es6-block-scoping.js:
272         * typeProfiler/es6-classes.js:
273         * typeProfiler/inheritance.js:
274         * typeProfiler/int52-dfg.js:
275         * typeProfiler/loop.js:
276         * typeProfiler/optional-fields.js:
277         * typeProfiler/overflow.js:
278         * typeProfiler/return.js:
279         * typeProfiler/symbol.js:
280         * typeProfiler/weird-prototype-chain.js:
281
282 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
283
284         [DFG][FTL] Support MapSet / SetAdd intrinsics
285         https://bugs.webkit.org/show_bug.cgi?id=179858
286
287         Reviewed by Saam Barati.
288
289         * microbenchmarks/map-has-and-set.js: Added.
290         (test):
291         * stress/map-set-check-failure.js: Added.
292         (shouldBe):
293         (shouldThrow):
294         (target):
295         * stress/map-set-cse.js: Added.
296         (shouldBe):
297         (test):
298         * stress/set-add-check-failure.js: Added.
299         (shouldBe):
300         (shouldThrow):
301         (set shouldThrow):
302         * stress/set-add-cse.js: Added.
303         (shouldBe):
304
305 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
306
307         [JSC] Allow poly proto for intrinsic getters
308         https://bugs.webkit.org/show_bug.cgi?id=179550
309
310         Reviewed by Saam Barati.
311
312         This change is also tested by existing tests.
313
314             1. stress/intrinsic-getter-with-poly-proto.js
315             2. stress/poly-proto-intrinsic-getter-correctness.js
316
317         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
318         (shouldBe):
319         (makePolyProtoObject.foo.C):
320         (makePolyProtoObject.foo):
321         (makePolyProtoObject):
322         (target):
323         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
324         (shouldBe):
325         (makePolyProtoObject.foo.C):
326         (makePolyProtoObject.foo):
327         (makePolyProtoObject):
328         (target):
329
330 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
331
332         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
333         https://bugs.webkit.org/show_bug.cgi?id=179744
334
335         Reviewed by Michael Catanzaro.
336
337         This test uses too much memory for our buildbots on these platforms
338         and gets OOM-killed.
339
340         * stress/unshiftCountSlowCase-correct-postCapacity.js:
341         Skip if $memoryLimited and linux.
342
343 2017-11-17  JF Bastien  <jfbastien@apple.com>
344
345         WebAssembly JS API: throw when a promise can't be created
346         https://bugs.webkit.org/show_bug.cgi?id=179826
347         <rdar://problem/35455813>
348
349         Reviewed by Mark Lam.
350
351         Test WebAssembly.{compile,instantiate} where promise creation
352         fails because of a stack overflow.
353
354         * wasm/js-api/promise-stack-overflow.js: Added.
355         (const.runNearStackLimit.f.const.t):
356         (async.testCompile):
357         (async.testInstantiate):
358
359 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
360
361         Unreviewed, mark regress-178385.js as memory exhausting
362
363         * stress/regress-178385.js:
364
365 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
366
367         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
368
369         Unreviewed test gardening.
370
371         * test262.yaml:
372
373 2017-11-16  Robin Morisset  <rmorisset@apple.com>
374
375         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
376         https://bugs.webkit.org/show_bug.cgi?id=179763
377         <rdar://problem/35550513>
378
379         Reviewed by Keith Miller.
380
381         Just adding a slightly cleaned-up version of the original fuzzer-found test.
382
383         * stress/tdz-this-in-try-catch.js: Added.
384         (__v_6388):
385         (__v_6392):
386
387 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
388
389         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
390         https://bugs.webkit.org/show_bug.cgi?id=179594
391
392         Reviewed by Saam Barati.
393
394         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
395         (shouldBe):
396         (args):
397         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
398         (shouldBe):
399         (args):
400
401 2017-11-14  Saam Barati  <sbarati@apple.com>
402
403         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
404         https://bugs.webkit.org/show_bug.cgi?id=179639
405         <rdar://problem/35513018>
406
407         Reviewed by JF Bastien.
408
409         * wasm/function-tests/grow-memory-cause-gc.js: Added.
410         (escape):
411         (i.func):
412
413 2017-11-13  Mark Lam  <mark.lam@apple.com>
414
415         Add more overflow check book-keeping for MarkedArgumentBuffer.
416         https://bugs.webkit.org/show_bug.cgi?id=179634
417         <rdar://problem/35492517>
418
419         Reviewed by Saam Barati.
420
421         * stress/regress-179634.js: Added.
422
423 2017-11-13  Mark Lam  <mark.lam@apple.com>
424
425         Make the jsc shell loadGetterFromGetterSetter() function more robust.
426         https://bugs.webkit.org/show_bug.cgi?id=179619
427         <rdar://problem/35492518>
428
429         Reviewed by Saam Barati.
430
431         * stress/regress-179619.js: Added.
432
433 2017-11-12  Mark Lam  <mark.lam@apple.com>
434
435         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
436         https://bugs.webkit.org/show_bug.cgi?id=179562
437         <rdar://problem/35467022>
438
439         Reviewed by Saam Barati.
440
441         * regress-179562.js: Added.
442
443 2017-11-08  Saam Barati  <sbarati@apple.com>
444
445         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
446         https://bugs.webkit.org/show_bug.cgi?id=177792
447
448         Reviewed by Yusuke Suzuki.
449
450         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
451         (assert):
452         (foo.Foo.prototype.ensureX):
453         (foo.Foo):
454         (foo):
455         (access):
456
457 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
458
459         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
460         https://bugs.webkit.org/show_bug.cgi?id=178592
461
462         Unreviewed test gardening.
463
464         * test262.yaml:
465
466 2017-11-08  Robin Morisset  <rmorisset@apple.com>
467
468         Turn recursive tail calls into loops
469         https://bugs.webkit.org/show_bug.cgi?id=176601
470
471         Reviewed by Saam Barati.
472
473         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
474
475         Add some simple test that computes factorial in several ways, and other trivial computations.
476         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
477         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
478         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
479         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
480
481         * stress/inline-call-to-recursive-tail-call.js: Added.
482         (factorial.aux):
483         (factorial):
484         (factorial2.aux2):
485         (factorial2.id):
486         (factorial2):
487         (factorial3.aux3):
488         (factorial3):
489         (aux4):
490         (factorial4):
491         (foo):
492         (auxBar):
493         (bar):
494         (test):
495
496 2017-11-07  Mark Lam  <mark.lam@apple.com>
497
498         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
499         https://bugs.webkit.org/show_bug.cgi?id=179355
500         <rdar://problem/35263053>
501
502         Reviewed by Saam Barati.
503
504         * stress/regress-179355.js: Added.
505
506 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
507
508         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
509         https://bugs.webkit.org/show_bug.cgi?id=144458
510
511         Reviewed by Saam Barati.
512
513         * microbenchmarks/dfg-internal-function-call.js: Added.
514         (target):
515         * microbenchmarks/dfg-internal-function-construct.js: Added.
516         (target):
517         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
518         (target):
519         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
520         (target):
521         * stress/dfg-internal-function-call.js: Added.
522         (shouldBe):
523         (target):
524         * stress/dfg-internal-function-construct.js: Added.
525         (shouldBe):
526         (target):
527         * stress/internal-function-call.js: Added.
528         (shouldBe):
529         * stress/internal-function-construct.js: Added.
530         (shouldBe):
531
532 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
533
534         [Win] Skip stress/regress-178385.js.
535         https://bugs.webkit.org/show_bug.cgi?id=179298
536
537         Unreviewed test gardening.
538
539         * stress/regress-178385.js:
540
541 2017-11-03  Keith Miller  <keith_miller@apple.com>
542
543         Add test for ic with side effects
544         https://bugs.webkit.org/show_bug.cgi?id=179268
545
546         Reviewed by Saam Barati.
547
548         * stress/put-inline-cache-side-effects.js: Added.
549         (let.i.of.objs.keys):
550         (f):
551
552 2017-11-03  Mark Lam  <mark.lam@apple.com>
553
554         CachedCall (and its clients) needs overflow checks.
555         https://bugs.webkit.org/show_bug.cgi?id=179185
556
557         Reviewed by JF Bastien.
558
559         * stress/regress-179185.js: Added.
560
561 2017-11-02  Michael Saboff  <msaboff@apple.com>
562
563         DFG needs to handle code motion of code in for..in loop bodies
564         https://bugs.webkit.org/show_bug.cgi?id=179212
565
566         Reviewed by Keith Miller.
567
568         New regression test.
569
570         * stress/for-in-side-effects.js: Added.
571         (getPrototypeOf):
572         (reset):
573         (testWithoutFTL.f):
574         (testWithoutFTL):
575         (testWithFTL.f):
576         (testWithFTL):
577
578 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
579
580         AI does not correctly model the clobber case of ArithClz32
581         https://bugs.webkit.org/show_bug.cgi?id=179188
582
583         Reviewed by Michael Saboff.
584
585         * stress/arith-clz32-effects.js: Added.
586         (foo):
587         (valueOf):
588
589 2017-11-01  Michael Saboff  <msaboff@apple.com>
590
591         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
592         https://bugs.webkit.org/show_bug.cgi?id=179140
593
594         Reviewed by Saam Barati.
595
596         New regression test.
597
598         * stress/regress-179140.js: Added.
599         (testWithoutFTL):
600         (testWithFTL):
601
602 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
603
604         [JSC] Introduce @toObject
605         https://bugs.webkit.org/show_bug.cgi?id=178726
606
607         Reviewed by Saam Barati.
608
609         * stress/array-copywithin.js:
610         (shouldThrow):
611         * stress/object-constructor-boolean-edge.js: Added.
612         (shouldBe):
613         (test):
614         * stress/object-constructor-global.js: Added.
615         (shouldBe):
616         * stress/object-constructor-null-edge.js: Added.
617         (shouldBe):
618         (test):
619         * stress/object-constructor-number-edge.js: Added.
620         (shouldBe):
621         (test):
622         * stress/object-constructor-object-edge.js: Added.
623         (shouldBe):
624         (test):
625         (i.arg):
626         * stress/object-constructor-string-edge.js: Added.
627         (shouldBe):
628         (test):
629         * stress/object-constructor-symbol-edge.js: Added.
630         (shouldBe):
631         (test):
632         * stress/object-constructor-undefined-edge.js: Added.
633         (shouldBe):
634         (test):
635         * stress/symbol-array-from.js: Added.
636         (shouldBe):
637         * stress/to-object-intrinsic-boolean-edge.js: Added.
638         (shouldBe):
639         (builtin.createBuiltin):
640         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
641         (shouldThrow):
642         * stress/to-object-intrinsic-number-edge.js: Added.
643         (shouldBe):
644         (builtin.createBuiltin):
645         * stress/to-object-intrinsic-object-edge.js: Added.
646         (shouldBe):
647         (builtin.createBuiltin):
648         (i.arg):
649         * stress/to-object-intrinsic-string-edge.js: Added.
650         (shouldBe):
651         (builtin.createBuiltin):
652         * stress/to-object-intrinsic-symbol-edge.js: Added.
653         (shouldBe):
654         (builtin.createBuiltin):
655         * stress/to-object-intrinsic.js: Added.
656         (shouldBe):
657         (shouldThrow):
658         (builtin.createBuiltin):
659
660 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
661
662         [DFG][FTL] Introduce StringSlice
663         https://bugs.webkit.org/show_bug.cgi?id=178934
664
665         Reviewed by Saam Barati.
666
667         * microbenchmarks/string-slice-empty.js: Added.
668         (slice):
669         * microbenchmarks/string-slice-one-char.js: Added.
670         (slice):
671         * microbenchmarks/string-slice.js: Added.
672         (slice):
673
674 2017-10-26  Michael Saboff  <msaboff@apple.com>
675
676         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
677         https://bugs.webkit.org/show_bug.cgi?id=178890
678
679         Reviewed by Keith Miller.
680
681         New regression test.
682
683         * stress/regress-178890.js: Added.
684
685 2017-10-26  Mark Lam  <mark.lam@apple.com>
686
687         JSRopeString::RopeBuilder::append() should check for overflows.
688         https://bugs.webkit.org/show_bug.cgi?id=178385
689         <rdar://problem/35027468>
690
691         Reviewed by Saam Barati.
692
693         * stress/regress-178385.js: Added.
694
695 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
696
697         Unreviewed, rolling out r223961.
698
699         The change that required this has been rolled out.
700
701         Reverted changeset:
702
703         "Mark test262.yaml/test262/test/language/statements/try/tco-
704         catch.js as passing."
705         https://bugs.webkit.org/show_bug.cgi?id=178592
706         https://trac.webkit.org/changeset/223961
707
708 2017-10-25  Commit Queue  <commit-queue@webkit.org>
709
710         Unreviewed, rolling out r223691 and r223729.
711         https://bugs.webkit.org/show_bug.cgi?id=178834
712
713         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
714         by rniwa on #webkit).
715
716         Reverted changesets:
717
718         "Turn recursive tail calls into loops"
719         https://bugs.webkit.org/show_bug.cgi?id=176601
720         https://trac.webkit.org/changeset/223691
721
722         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
723         comparison is always false due to limited range of data type
724         [-Wtype-limits]"
725         https://bugs.webkit.org/show_bug.cgi?id=178543
726         https://trac.webkit.org/changeset/223729
727
728 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
729
730         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
731         https://bugs.webkit.org/show_bug.cgi?id=178592
732
733         Unreviewed test gardening.
734
735         * test262.yaml:
736
737 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
738
739         [FTL] Support NewStringObject
740         https://bugs.webkit.org/show_bug.cgi?id=178737
741
742         Reviewed by Saam Barati.
743
744         * stress/new-string-object.js: Added.
745         (shouldBe):
746         (test):
747
748 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
749
750         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
751         https://bugs.webkit.org/show_bug.cgi?id=178308
752
753         Reviewed by Mark Lam.
754
755         * test262.yaml:
756
757 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
758
759         [JSC] Use fastJoin in Array#toString
760         https://bugs.webkit.org/show_bug.cgi?id=178062
761
762         Reviewed by Darin Adler.
763
764         * microbenchmarks/contiguous-array-to-string.js: Added.
765         (target):
766         * microbenchmarks/double-array-to-string.js: Added.
767         (target):
768         * microbenchmarks/int32-array-to-string.js: Added.
769         (target):
770
771 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
772
773         stress/check-string-ident.js is improperly skipped
774         https://bugs.webkit.org/show_bug.cgi?id=178642
775
776         Reviewed by Saam Barati.
777
778         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
779         since it enforces the run-jsc-stress-tests script to still set up the
780         test to run, despite the skip directive that's used before.
781
782 2017-10-20  Mark Lam  <mark.lam@apple.com>
783
784         Add a test case for r214334.
785         https://bugs.webkit.org/show_bug.cgi?id=169941
786         <rdar://problem/31221258>
787
788         Reviewed by JF Bastien.
789
790         * stress/regress-169941.js: Added.
791
792 2017-10-19  JF Bastien  <jfbastien@apple.com>
793
794         WebAssembly: no VM / JS version of everything but Instance
795         https://bugs.webkit.org/show_bug.cgi?id=177473
796
797         Reviewed by Filip Pizlo, Saam Barati.
798
799         - Exceeding max on memory growth now returns a range error as per
800         spec. This is a (very minor) breaking change: it used to throw OOM
801         error. Update the corresponding test.
802
803         * wasm/js-api/memory-grow.js:
804         (assertEq):
805         * wasm/js-api/table.js:
806         (assert.throws):
807
808 2017-10-19  Mark Lam  <mark.lam@apple.com>
809
810         Stringifier::appendStringifiedValue() is missing an exception check.
811         https://bugs.webkit.org/show_bug.cgi?id=178386
812         <rdar://problem/35027610>
813
814         Reviewed by Saam Barati.
815
816         * stress/regress-178386.js: Added.
817
818 2017-10-19  Michael Saboff  <msaboff@apple.com>
819
820         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
821         https://bugs.webkit.org/show_bug.cgi?id=178521
822
823         Reviewed by JF Bastien.
824
825         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
826         now passes with the current version (5.0) of the Emoji spec.
827
828 2017-10-19  Robin Morisset  <rmorisset@apple.com>
829
830         Turn recursive tail calls into loops
831         https://bugs.webkit.org/show_bug.cgi?id=176601
832
833         Reviewed by Saam Barati.
834
835         Add some simple test that computes factorial in several ways, and other trivial computations.
836         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
837         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
838         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
839         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
840
841         * stress/inline-call-to-recursive-tail-call.js: Added.
842         (factorial.aux):
843         (factorial):
844         (factorial2.aux):
845         (factorial2.id):
846         (factorial2):
847         (factorial3.aux):
848         (factorial3):
849         (aux):
850         (factorial4):
851         (test):
852
853 2017-10-18  Mark Lam  <mark.lam@apple.com>
854
855         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
856         https://bugs.webkit.org/show_bug.cgi?id=177600
857         <rdar://problem/34710985>
858
859         Reviewed by Saam Barati.
860
861         * stress/regress-177600.js: Added.
862
863 2017-10-18  Mark Lam  <mark.lam@apple.com>
864
865         The compiler should always register a structure when it adds its transitionWatchPointSet.
866         https://bugs.webkit.org/show_bug.cgi?id=178420
867         <rdar://problem/34814024>
868
869         Reviewed by Saam Barati and Filip Pizlo.
870
871         * stress/regress-178420.js: Added.
872         (new.Array.10000.map):
873
874 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
875
876         [JSC] __proto__ getter should be fast
877         https://bugs.webkit.org/show_bug.cgi?id=178067
878
879         Reviewed by Saam Barati.
880
881         * stress/dfg-object-proto-accessor.js: Added.
882         (shouldBe):
883         (shouldThrow):
884         (target):
885         * stress/dfg-object-proto-getter.js: Added.
886         (shouldBe):
887         (shouldThrow):
888         (target):
889         * stress/dfg-object-prototype-of.js: Added.
890         (shouldBe):
891         (shouldThrow):
892         (target):
893         * stress/dfg-reflect-get-prototype-of.js: Added.
894         (shouldBe):
895         (shouldThrow):
896         (target):
897         * stress/intrinsic-getter-with-poly-proto.js: Added.
898         (shouldBe):
899         (makePolyProtoObject.foo.C):
900         (makePolyProtoObject.foo):
901         (makePolyProtoObject):
902         (target):
903         * stress/object-get-prototype-of-filtered.js: Added.
904         (shouldBe):
905         (shouldThrow):
906         (target):
907         (i.Cocoa):
908         * stress/object-get-prototype-of-mono-proto.js: Added.
909         (shouldBe):
910         (makePolyProtoObject.foo.C):
911         (makePolyProtoObject.foo):
912         (makePolyProtoObject):
913         (target):
914         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
915         (shouldBe):
916         (makePolyProtoObject.foo.C):
917         (makePolyProtoObject.foo):
918         (makePolyProtoObject):
919         (target):
920         * stress/object-get-prototype-of-poly-proto.js: Added.
921         (shouldBe):
922         (makePolyProtoObject.foo.C):
923         (makePolyProtoObject.foo):
924         (makePolyProtoObject):
925         (target):
926         * stress/object-proto-getter-filtered.js: Added.
927         (shouldBe):
928         (shouldThrow):
929         (target):
930         (i.Cocoa):
931         * stress/object-proto-getter-poly-mono-proto.js: Added.
932         (shouldBe):
933         (makePolyProtoObject.foo.C):
934         (makePolyProtoObject.foo):
935         (makePolyProtoObject):
936         (target):
937         * stress/object-proto-getter-poly-proto.js: Added.
938         (shouldBe):
939         (makePolyProtoObject.foo.C):
940         (makePolyProtoObject.foo):
941         (makePolyProtoObject):
942         (target):
943         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
944         * stress/string-proto.js: Added.
945         (shouldBe):
946         (target):
947
948 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
949
950         Unreviewed, rolling out r223523.
951
952         A test for this change is failing on debug JSC bots.
953
954         Reverted changeset:
955
956         "[JSC] __proto__ getter should be fast"
957         https://bugs.webkit.org/show_bug.cgi?id=178067
958         https://trac.webkit.org/changeset/223523
959
960 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
961
962         [JSC] __proto__ getter should be fast
963         https://bugs.webkit.org/show_bug.cgi?id=178067
964
965         Reviewed by Saam Barati.
966
967         * stress/dfg-object-proto-accessor.js: Added.
968         (shouldBe):
969         (shouldThrow):
970         (target):
971         * stress/dfg-object-proto-getter.js: Added.
972         (shouldBe):
973         (shouldThrow):
974         (target):
975         * stress/dfg-object-prototype-of.js: Added.
976         (shouldBe):
977         (shouldThrow):
978         (target):
979         * stress/dfg-reflect-get-prototype-of.js: Added.
980         (shouldBe):
981         (shouldThrow):
982         (target):
983         * stress/object-get-prototype-of-filtered.js: Added.
984         (shouldBe):
985         (shouldThrow):
986         (target):
987         (i.Cocoa):
988         * stress/object-get-prototype-of-mono-proto.js: Added.
989         (shouldBe):
990         (makePolyProtoObject.foo.C):
991         (makePolyProtoObject.foo):
992         (makePolyProtoObject):
993         (target):
994         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
995         (shouldBe):
996         (makePolyProtoObject.foo.C):
997         (makePolyProtoObject.foo):
998         (makePolyProtoObject):
999         (target):
1000         * stress/object-get-prototype-of-poly-proto.js: Added.
1001         (shouldBe):
1002         (makePolyProtoObject.foo.C):
1003         (makePolyProtoObject.foo):
1004         (makePolyProtoObject):
1005         (target):
1006         * stress/object-proto-getter-filtered.js: Added.
1007         (shouldBe):
1008         (shouldThrow):
1009         (target):
1010         (i.Cocoa):
1011         * stress/object-proto-getter-poly-mono-proto.js: Added.
1012         (shouldBe):
1013         (makePolyProtoObject.foo.C):
1014         (makePolyProtoObject.foo):
1015         (makePolyProtoObject):
1016         (target):
1017         * stress/object-proto-getter-poly-proto.js: Added.
1018         (shouldBe):
1019         (makePolyProtoObject.foo.C):
1020         (makePolyProtoObject.foo):
1021         (makePolyProtoObject):
1022         (target):
1023         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1024         * stress/string-proto.js: Added.
1025         (shouldBe):
1026         (target):
1027
1028 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1029
1030         Reland "Add Above/Below comparisons for UInt32 patterns"
1031         https://bugs.webkit.org/show_bug.cgi?id=177281
1032
1033         Reviewed by Saam Barati.
1034
1035         * stress/uint32-comparison-jump.js: Added.
1036         (shouldBe):
1037         (above):
1038         (aboveOrEqual):
1039         (below):
1040         (belowOrEqual):
1041         (notAbove):
1042         (notAboveOrEqual):
1043         (notBelow):
1044         (notBelowOrEqual):
1045         * stress/uint32-comparison.js: Added.
1046         (shouldBe):
1047         (above):
1048         (aboveOrEqual):
1049         (below):
1050         (belowOrEqual):
1051         (aboveTest):
1052         (aboveOrEqualTest):
1053         (belowTest):
1054         (belowOrEqualTest):
1055
1056 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1057
1058         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1059         https://bugs.webkit.org/show_bug.cgi?id=178210
1060
1061         Reviewed by Saam Barati.
1062
1063         * wasm/function-tests/trap-from-start-async.js:
1064         (async.StartTrapsAsync):
1065         * wasm/function-tests/trap-from-start.js:
1066         (StartTraps):
1067         * wasm/js-api/web-assembly-function.js:
1068         (assert.eq.Object.getPrototypeOf):
1069         * wasm/js-api/wrapper-function.js:
1070         (return.new.WebAssembly.Module):
1071         (assert.throws.makeInstance): Deleted.
1072         (assert.throws.Bar): Deleted.
1073         (assert.throws): Deleted.
1074
1075 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1076
1077         Enable gigacage on iOS
1078         https://bugs.webkit.org/show_bug.cgi?id=177586
1079
1080         Reviewed by JF Bastien.
1081         
1082         Add tests for when Gigacage gets runtime disabled.
1083
1084         * stress/disable-gigacage-arrays.js: Added.
1085         (foo):
1086         * stress/disable-gigacage-strings.js: Added.
1087         (foo):
1088         * stress/disable-gigacage-typed-arrays.js: Added.
1089         (foo):
1090
1091 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1092
1093         import.meta should not be assignable
1094         https://bugs.webkit.org/show_bug.cgi?id=178202
1095
1096         Reviewed by Saam Barati.
1097
1098         * modules/import-meta-assignment.js: Added.
1099         (shouldThrow):
1100         (SyntaxError.import.meta.can.shouldThrow):
1101
1102 2017-10-11  Saam Barati  <sbarati@apple.com>
1103
1104         Unreviewed. Actually skip certain type profiler tests in debug.
1105
1106         * typeProfiler.yaml:
1107         * typeProfiler/deltablue-for-of.js:
1108         * typeProfiler/getter-richards.js:
1109
1110 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1111
1112         Unreviewed, rolling out r223113 and r223121.
1113         https://bugs.webkit.org/show_bug.cgi?id=178182
1114
1115         Reintroduced 20% regression on Kraken (Requested by rniwa on
1116         #webkit).
1117
1118         Reverted changesets:
1119
1120         "Enable gigacage on iOS"
1121         https://bugs.webkit.org/show_bug.cgi?id=177586
1122         https://trac.webkit.org/changeset/223113
1123
1124         "Use one virtual allocation for all gigacages and their
1125         runways"
1126         https://bugs.webkit.org/show_bug.cgi?id=178050
1127         https://trac.webkit.org/changeset/223121
1128
1129 2017-10-11  Michael Saboff  <msaboff@apple.com>
1130
1131         Disable test262 named capture group tests with direct unicode names and with references before definitions
1132         https://bugs.webkit.org/show_bug.cgi?id=178177
1133
1134         Reviewed by Keith Miller.
1135
1136         Bugs to track fixing these test are:
1137         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1138             "Add support in named capture group identifiers for direct surrogate pairs"
1139         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1140             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1141
1142         * test262.yaml:
1143
1144 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1145
1146         Object properties are undefined in super.call() but not in this.call()
1147         https://bugs.webkit.org/show_bug.cgi?id=177230
1148
1149         Reviewed by Saam Barati.
1150
1151         * stress/super-call-function-subclass.js: Added.
1152         (assert):
1153         (A.prototype.t):
1154         (A):
1155         * stress/super-dot-call-and-apply.js: Added.
1156         (assert):
1157         (A):
1158         (A.prototype.call):
1159         (A.prototype.apply):
1160         (B.prototype.testSuper):
1161         (B):
1162         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1163         (D.prototype.testSuper):
1164         (D):
1165
1166 2017-10-10  Saam Barati  <sbarati@apple.com>
1167
1168         The prototype cache should be aware of the Executable it generates a Structure for
1169         https://bugs.webkit.org/show_bug.cgi?id=177907
1170
1171         Reviewed by Filip Pizlo.
1172
1173         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1174         (assert):
1175         (foo.C):
1176         (foo):
1177         (bar.C):
1178         (bar):
1179         (access):
1180         (makeLongChain):
1181         (accessY):
1182
1183 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1184
1185         `async` should be able to be used as an imported binding name
1186         https://bugs.webkit.org/show_bug.cgi?id=176573
1187
1188         Reviewed by Saam Barati.
1189
1190         * modules/import-default-async.js: Added.
1191         * modules/import-named-async-as.js: Added.
1192         * modules/import-named-async.js: Added.
1193         * modules/import-named-async/target.js: Added.
1194         * modules/import-namespace-async.js: Added.
1195         * test262.yaml:
1196
1197 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1198
1199         Enable gigacage on iOS
1200         https://bugs.webkit.org/show_bug.cgi?id=177586
1201
1202         Reviewed by JF Bastien.
1203         
1204         Add tests for when Gigacage gets runtime disabled.
1205
1206         * stress/disable-gigacage-arrays.js: Added.
1207         (foo):
1208         * stress/disable-gigacage-strings.js: Added.
1209         (foo):
1210         * stress/disable-gigacage-typed-arrays.js: Added.
1211         (foo):
1212
1213 2017-10-09  Michael Saboff  <msaboff@apple.com>
1214
1215         Implement RegExp Unicode property escapes
1216         https://bugs.webkit.org/show_bug.cgi?id=172069
1217
1218         Reviewed by JF Bastien.
1219
1220         Enabled Unicode Property tests.
1221
1222         * test262.yaml:
1223
1224 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1225
1226         Unreviewed, rolling out r223015 and r223025.
1227         https://bugs.webkit.org/show_bug.cgi?id=178093
1228
1229         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1230         #webkit).
1231
1232         Reverted changesets:
1233
1234         "Enable gigacage on iOS"
1235         https://bugs.webkit.org/show_bug.cgi?id=177586
1236         http://trac.webkit.org/changeset/223015
1237
1238         "Unreviewed, disable Gigacage on ARM64 Linux"
1239         https://bugs.webkit.org/show_bug.cgi?id=177586
1240         http://trac.webkit.org/changeset/223025
1241
1242 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1243
1244         Update expectations for test262 tests that pass after r223043.
1245         https://bugs.webkit.org/show_bug.cgi?id=176685
1246
1247         Unreviewed test gardening.
1248
1249         * test262.yaml:
1250
1251 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1252
1253         Unreviewed, rolling out r223022.
1254
1255         This change introduced 18 test262 failures.
1256
1257         Reverted changeset:
1258
1259         "`async` should be able to be used as an imported binding
1260         name"
1261         https://bugs.webkit.org/show_bug.cgi?id=176573
1262         http://trac.webkit.org/changeset/223022
1263
1264 2017-10-09  Saam Barati  <sbarati@apple.com>
1265
1266         3 poly-proto JSC tests timing out on debug after r222827
1267         https://bugs.webkit.org/show_bug.cgi?id=177880
1268         <rdar://problem/34817122>
1269
1270         Unreviewed.
1271
1272         I'm skipping these type profiler tests on debug since they are long running.
1273
1274         * typeProfiler/deltablue-for-of.js:
1275         * typeProfiler/getter-richards.js:
1276
1277 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1278
1279         Safari 10 /11 problem with if (!await get(something)).
1280         https://bugs.webkit.org/show_bug.cgi?id=176685
1281
1282         Reviewed by Saam Barati.
1283
1284         * stress/async-await-basic.js:
1285         (awaitEpression.async):
1286         * stress/async-await-syntax.js:
1287         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1288         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1289
1290 2017-10-08  Saam Barati  <sbarati@apple.com>
1291
1292         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1293
1294         * typeProfiler/deltablue-for-of.js:
1295         * typeProfiler/getter-richards.js:
1296
1297 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1298
1299         `async` should be able to be used as an imported binding name
1300         https://bugs.webkit.org/show_bug.cgi?id=176573
1301
1302         Reviewed by Darin Adler.
1303
1304         * modules/import-default-async.js: Added.
1305         * modules/import-named-async-as.js: Added.
1306         * modules/import-named-async.js: Added.
1307         * modules/import-named-async/target.js: Added.
1308         * modules/import-namespace-async.js: Added.
1309
1310 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1311
1312         Enable gigacage on iOS
1313         https://bugs.webkit.org/show_bug.cgi?id=177586
1314
1315         Reviewed by JF Bastien.
1316         
1317         Add tests for when Gigacage gets runtime disabled.
1318
1319         * stress/disable-gigacage-arrays.js: Added.
1320         (foo):
1321         * stress/disable-gigacage-strings.js: Added.
1322         (foo):
1323         * stress/disable-gigacage-typed-arrays.js: Added.
1324         (foo):
1325
1326 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1327
1328         Unreviewed, rolling out r222791 and r222873.
1329         https://bugs.webkit.org/show_bug.cgi?id=178031
1330
1331         Caused crashes with workers/wasm LayoutTests (Requested by
1332         ryanhaddad on #webkit).
1333
1334         Reverted changesets:
1335
1336         "WebAssembly: no VM / JS version of everything but Instance"
1337         https://bugs.webkit.org/show_bug.cgi?id=177473
1338         http://trac.webkit.org/changeset/222791
1339
1340         "WebAssembly: address no VM / JS follow-ups"
1341         https://bugs.webkit.org/show_bug.cgi?id=177887
1342         http://trac.webkit.org/changeset/222873
1343
1344 2017-10-05  Saam Barati  <sbarati@apple.com>
1345
1346         Make sure all prototypes under poly proto get added into the VM's prototype map
1347         https://bugs.webkit.org/show_bug.cgi?id=177909
1348
1349         Reviewed by Keith Miller.
1350
1351         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1352         (assert):
1353         (foo.C):
1354         (foo):
1355         (set x):
1356
1357 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1358
1359         [JSC] Introduce import.meta
1360         https://bugs.webkit.org/show_bug.cgi?id=177703
1361
1362         Reviewed by Filip Pizlo.
1363
1364         * modules/import-meta-syntax.js: Added.
1365         (shouldThrow):
1366         (shouldNotThrow):
1367         * modules/import-meta.js: Added.
1368         * modules/import-meta/cocoa.js: Added.
1369         * modules/resources/assert.js:
1370         (export.shouldNotThrow):
1371         * stress/import-syntax.js:
1372
1373 2017-10-04  Saam Barati  <sbarati@apple.com>
1374
1375         Make pertinent AccessCases watch the poly proto watchpoint
1376         https://bugs.webkit.org/show_bug.cgi?id=177765
1377
1378         Reviewed by Keith Miller.
1379
1380         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1381         (assert):
1382         (foo.C):
1383         (foo):
1384         (validate):
1385         * stress/poly-proto-clear-stub.js: Added.
1386         (assert):
1387         (foo.C):
1388         (foo):
1389
1390 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1391
1392         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1393
1394         Unreviewed test gardening.
1395
1396         * test262.yaml:
1397
1398 2017-10-04  Saam Barati  <sbarati@apple.com>
1399
1400         3 poly-proto JSC tests timing out on debug after r222827
1401         https://bugs.webkit.org/show_bug.cgi?id=177880
1402
1403         Rubber stamped by Mark Lam.
1404
1405         * microbenchmarks/poly-proto-access.js:
1406         * typeProfiler/deltablue-for-of.js:
1407         * typeProfiler/getter-richards.js:
1408
1409 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1410
1411         Unreviewed, marking tco-catch.js as a failure after test262 update
1412         https://bugs.webkit.org/show_bug.cgi?id=177859
1413
1414         * test262.yaml:
1415
1416 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1417
1418         Unreviewed, marking one async iterator test262 test failed
1419         https://bugs.webkit.org/show_bug.cgi?id=177859
1420
1421         * test262.yaml:
1422
1423 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1424
1425         [Test262] Update Test262 to Oct 4 version
1426         https://bugs.webkit.org/show_bug.cgi?id=177859
1427
1428         Reviewed by Sam Weinig.
1429
1430         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1431         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1432
1433         * test262.yaml:
1434         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1435         (checkSequence):
1436         * test262/harness/typeCoercion.js:
1437         (testCoercibleToIndexZero):
1438         (testCoercibleToIndexOne):
1439         (testCoercibleToIndexFromIndex):
1440         (testNotCoercibleToIndex.testPrimitiveValue):
1441         (testNotCoercibleToInteger):
1442         (testCoercibleToBigIntZero.testPrimitiveValue):
1443         (testCoercibleToBigIntZero):
1444         (testCoercibleToBigIntOne.testPrimitiveValue):
1445         (testCoercibleToBigIntOne):
1446         (testPrimitiveValue):
1447         (testCoercibleToBigIntFromBigInt):
1448         (testNotCoercibleToBigInt.testPrimitiveValue):
1449         (testNotCoercibleToBigInt.testStringValue):
1450         (testNotCoercibleToBigInt):
1451         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1452         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1453         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1454         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1455         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1456         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1457         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1458         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1459         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1460         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
1461         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
1462         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
1463         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
1464         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
1465         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
1466         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
1467         (testCoercibleToBigIntZero):
1468         (testCoercibleToBigIntOne):
1469         (testNotCoercibleToBigInt):
1470         (MyError): Deleted.
1471         (valueOf): Deleted.
1472         (toString): Deleted.
1473         (Symbol.toPrimitive): Deleted.
1474         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
1475         (testCoercibleToIndexZero):
1476         (testCoercibleToIndexOne):
1477         (testNotCoercibleToIndex):
1478         (MyError): Deleted.
1479         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
1480         (assert.sameValue.BigInt.asIntN.toString): Deleted.
1481         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
1482         (BigInt.asIntN.valueOf): Deleted.
1483         (BigInt.asIntN.toString): Deleted.
1484         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
1485         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
1486         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
1487         (testCoercibleToBigIntZero):
1488         (testCoercibleToBigIntOne):
1489         (testNotCoercibleToBigInt):
1490         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
1491         (testCoercibleToIndexZero):
1492         (testCoercibleToIndexOne):
1493         (testNotCoercibleToIndex):
1494         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
1495         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
1496         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
1497         (bits.valueOf):
1498         (bigint.valueOf):
1499         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
1500         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
1501         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
1502         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
1503         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
1504         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
1505         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
1506         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
1507         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
1508         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
1509         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
1510         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
1511         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
1512         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
1513         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
1514         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
1515         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
1516         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
1517         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
1518         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
1519         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
1520         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
1521         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
1522         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
1523         (replacer):
1524         (BigInt.prototype.toJSON):
1525         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
1526         (replacer):
1527         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
1528         (BigInt.prototype.toJSON):
1529         * test262/test/built-ins/JSON/stringify/bigint.js:
1530         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
1531         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
1532         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
1533         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
1534         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
1535         * test262/test/built-ins/Object/proto-from-ctor.js:
1536         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
1537         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
1538         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
1539         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
1540         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
1541         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
1542         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
1543         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
1544         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
1545         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
1546         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
1547         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
1548         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
1549         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
1550         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
1551         * test262/test/built-ins/Proxy/get-fn-realm.js:
1552         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
1553         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
1554         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
1555         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
1556         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
1557         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
1558         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
1559         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
1560         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
1561         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
1562         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
1563         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
1564         (i6.replace):
1565         (i6b.replace):
1566         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
1567         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
1568         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
1569         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
1570         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
1571         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
1572         * test262/test/built-ins/RegExp/u180e.js: Added.
1573         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
1574         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
1575         * test262/test/built-ins/String/proto-from-ctor-realm.js:
1576         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
1577         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
1578         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
1579         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
1580         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
1581         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
1582         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
1583         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
1584         * test262/test/built-ins/String/prototype/endsWith/length.js:
1585         * test262/test/built-ins/String/prototype/endsWith/name.js:
1586         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
1587         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
1588         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
1589         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
1590         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
1591         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
1592         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
1593         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
1594         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
1595         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
1596         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
1597         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
1598         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
1599         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
1600         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
1601         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
1602         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
1603         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
1604         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
1605         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
1606         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
1607         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
1608         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
1609         * test262/test/built-ins/String/prototype/includes/includes.js:
1610         * test262/test/built-ins/String/prototype/includes/length.js:
1611         * test262/test/built-ins/String/prototype/includes/name.js:
1612         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
1613         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
1614         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
1615         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
1616         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
1617         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
1618         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
1619         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
1620         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
1621         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
1622         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
1623         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
1624         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
1625         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
1626         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
1627         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
1628         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
1629         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
1630         * test262/test/built-ins/String/prototype/trim/u180e.js:
1631         * test262/test/built-ins/Symbol/for/cross-realm.js:
1632         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
1633         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
1634         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
1635         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
1636         * test262/test/built-ins/Symbol/match/cross-realm.js:
1637         * test262/test/built-ins/Symbol/replace/cross-realm.js:
1638         * test262/test/built-ins/Symbol/search/cross-realm.js:
1639         * test262/test/built-ins/Symbol/species/cross-realm.js:
1640         * test262/test/built-ins/Symbol/split/cross-realm.js:
1641         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
1642         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
1643         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
1644         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
1645         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
1646         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
1647         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
1648         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
1649         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
1650         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
1651         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
1652         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
1653         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
1654         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
1655         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
1656         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
1657         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
1658         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
1659         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
1660         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
1661         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
1662         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
1663         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
1664         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
1665         * test262/test/language/comments/mongolian-vowel-separator-single.js:
1666         * test262/test/language/eval-code/indirect/realm.js:
1667         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
1668         (o.get z):
1669         (o.get a):
1670         * test262/test/language/expressions/call/eval-realm-indirect.js:
1671         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
1672         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
1673         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
1674         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
1675         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
1676         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
1677         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
1678         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
1679         * test262/test/language/expressions/greater-than/bigint-and-number.js:
1680         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
1681         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
1682         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
1683         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
1684         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
1685         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
1686         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
1687         * test262/test/language/expressions/less-than/bigint-and-number.js:
1688         * test262/test/language/expressions/new/non-ctor-err-realm.js:
1689         * test262/test/language/expressions/super/realm.js:
1690         * test262/test/language/expressions/tagged-template/cache-realm.js:
1691         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
1692         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
1693         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
1694         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
1695         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
1696         * test262/test/language/literals/string/mongolian-vowel-separator.js:
1697         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
1698         (o.get z):
1699         (o.get a):
1700         * test262/test/language/statements/for-of/iterator-next-reference.js:
1701         (next):
1702         (iterator.next): Deleted.
1703         (x.of.iterable.): Deleted.
1704         (x.of.iterable.get return): Deleted.
1705         (x.of.iterable.iterator.next): Deleted.
1706         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
1707         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
1708         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
1709         * test262/test/language/white-space/mongolian-vowel-separator.js:
1710         * test262/test262-Revision.txt:
1711
1712 2017-10-03  Saam Barati  <sbarati@apple.com>
1713
1714         Implement polymorphic prototypes
1715         https://bugs.webkit.org/show_bug.cgi?id=176391
1716
1717         Reviewed by Filip Pizlo.
1718
1719         * microbenchmarks/poly-proto-access.js: Added.
1720         (assert):
1721         (foo.C):
1722         (foo.C.prototype.get bar):
1723         (foo):
1724         (bar):
1725         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
1726         (assert):
1727         (makePolyProtoObject.foo.C):
1728         (makePolyProtoObject.foo):
1729         (makePolyProtoObject):
1730         (performSet):
1731         * microbenchmarks/poly-proto-setter-speed.js: Added.
1732         (assert):
1733         (makePolyProtoObject.foo.C):
1734         (makePolyProtoObject.foo.C.prototype.set p):
1735         (makePolyProtoObject.foo):
1736         (makePolyProtoObject):
1737         (performSet):
1738         * stress/constructor-with-return.js:
1739         (i.tests.forEach.Constructor):
1740         (i.tests.forEach):
1741         (tests.forEach.Constructor): Deleted.
1742         (tests.forEach): Deleted.
1743         * stress/dom-jit-with-poly-proto.js: Added.
1744         (assert):
1745         (makePolyProtoObject.foo.C):
1746         (makePolyProtoObject.foo):
1747         (makePolyProtoObject):
1748         (validate):
1749         * stress/poly-proto-custom-value-and-accessor.js: Added.
1750         (assert):
1751         (makePolyProtoObject.foo.C):
1752         (makePolyProtoObject.foo):
1753         (makePolyProtoObject):
1754         (items.forEach):
1755         (set get for):
1756         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
1757         (assert):
1758         (makePolyProtoObject.foo.C):
1759         (makePolyProtoObject.foo):
1760         (makePolyProtoObject):
1761         (foo):
1762         * stress/poly-proto-miss.js: Added.
1763         (makePolyProtoInstanceWithNullPrototype.foo.C):
1764         (makePolyProtoInstanceWithNullPrototype.foo):
1765         (makePolyProtoInstanceWithNullPrototype):
1766         (assert):
1767         (validate):
1768         * stress/poly-proto-op-in-caching.js: Added.
1769         (assert):
1770         (makePolyProtoObject.foo.C):
1771         (makePolyProtoObject.foo):
1772         (makePolyProtoObject):
1773         (validate):
1774         (validate2):
1775         * stress/poly-proto-put-transition.js: Added.
1776         (assert):
1777         (makePolyProtoObject.foo.C):
1778         (makePolyProtoObject.foo):
1779         (makePolyProtoObject):
1780         (performSet):
1781         (i.obj.__proto__.set p):
1782         * stress/poly-proto-set-prototype.js: Added.
1783         (assert):
1784         (let.alternateProto.get x):
1785         (let.alternateProto2.get y):
1786         (let.alternateProto2.get x):
1787         (foo.C):
1788         (foo):
1789         (validate):
1790         * stress/poly-proto-setter.js: Added.
1791         (assert):
1792         (makePolyProtoObject.foo.C):
1793         (makePolyProtoObject.foo.C.prototype.set p):
1794         (makePolyProtoObject.foo.C.prototype.get p):
1795         (makePolyProtoObject.foo):
1796         (makePolyProtoObject):
1797         (performSet):
1798         * stress/poly-proto-using-inheritance.js: Added.
1799         (assert):
1800         (foo.C):
1801         (foo.C.prototype.get baz):
1802         (foo):
1803         (bar.C):
1804         (bar):
1805         (validate):
1806         * stress/primitive-poly-proto.js: Added.
1807         (makePolyProtoInstance.foo.C):
1808         (makePolyProtoInstance.foo):
1809         (makePolyProtoInstance):
1810         (assert):
1811         (validate):
1812         * stress/prototype-is-not-js-object.js: Added.
1813         (foo.bar):
1814         (foo):
1815         (assert):
1816         (validate):
1817         * stress/try-get-by-id-poly-proto.js: Added.
1818         (assert):
1819         (makePolyProtoObject.foo.C):
1820         (makePolyProtoObject.foo):
1821         (makePolyProtoObject):
1822         (tryGetByIdText):
1823         (x.__proto__.get bar):
1824         (validate):
1825         * typeProfiler/overflow.js:
1826
1827 2017-10-03  JF Bastien  <jfbastien@apple.com>
1828
1829         WebAssembly: no VM / JS version of everything but Instance
1830         https://bugs.webkit.org/show_bug.cgi?id=177473
1831
1832         Reviewed by Filip Pizlo.
1833
1834         - Exceeding max on memory growth now returns a range error as per
1835         spec. This is a (very minor) breaking change: it used to throw OOM
1836         error. Update the corresponding test.
1837
1838         * wasm/js-api/memory-grow.js:
1839         (assertEq):
1840         * wasm/js-api/table.js:
1841         (assert.throws):
1842
1843 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
1844
1845         Skip JSC test stress/regress-159779-2.js on debug.
1846         https://bugs.webkit.org/show_bug.cgi?id=177204
1847
1848         Unreviewed test gardening.
1849
1850         * stress/regress-159779-2.js:
1851
1852 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
1853
1854         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
1855         https://bugs.webkit.org/show_bug.cgi?id=175642
1856
1857         Reviewed by Darin Adler.
1858
1859         * ChakraCore/test/Function/apply3.baseline-jsc:
1860
1861 2017-10-01  Commit Queue  <commit-queue@webkit.org>
1862
1863         Unreviewed, rolling out r222564.
1864         https://bugs.webkit.org/show_bug.cgi?id=177720
1865
1866         "It regressed JetStream by 2% on iOS caused by a 50%
1867         regression on the bigfib subtest" (Requested by saamyjoon on
1868         #webkit).
1869
1870         Reverted changeset:
1871
1872         "Add Above/Below comparisons for UInt32 patterns"
1873         https://bugs.webkit.org/show_bug.cgi?id=177281
1874         http://trac.webkit.org/changeset/222564
1875
1876 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1877
1878         [DFG] Support ArrayPush with multiple args
1879         https://bugs.webkit.org/show_bug.cgi?id=175823
1880
1881         Reviewed by Saam Barati.
1882
1883         * microbenchmarks/array-push-0.js: Added.
1884         (arrayPush0):
1885         * microbenchmarks/array-push-1.js: Added.
1886         (arrayPush1):
1887         * microbenchmarks/array-push-2.js: Added.
1888         (arrayPush2):
1889         * microbenchmarks/array-push-3.js: Added.
1890         (arrayPush3):
1891         * stress/array-push-multiple-contiguous.js: Added.
1892         (shouldBe):
1893         (test):
1894         * stress/array-push-multiple-double-nan.js: Added.
1895         (shouldBe):
1896         (test):
1897         * stress/array-push-multiple-double.js: Added.
1898         (shouldBe):
1899         (test):
1900         * stress/array-push-multiple-int32.js: Added.
1901         (shouldBe):
1902         (test):
1903         * stress/array-push-multiple-many-contiguous.js: Added.
1904         (shouldBe):
1905         (test):
1906         * stress/array-push-multiple-many-double.js: Added.
1907         (shouldBe):
1908         (test):
1909         * stress/array-push-multiple-many-int32.js: Added.
1910         (shouldBe):
1911         (test):
1912         * stress/array-push-multiple-many-storage.js: Added.
1913         (shouldBe):
1914         (test):
1915         * stress/array-push-multiple-storage.js: Added.
1916         (shouldBe):
1917         (test):
1918         * stress/array-push-with-force-exit.js: Added.
1919         (target.createBuiltin):
1920
1921 2017-09-29  Saam Barati  <sbarati@apple.com>
1922
1923         Custom GetterSetterAccessCase does not use the correct slotBase when making call
1924         https://bugs.webkit.org/show_bug.cgi?id=177639
1925
1926         Reviewed by Geoffrey Garen.
1927
1928         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
1929         (assert):
1930         (Class):
1931         (items.forEach):
1932         (set get for):
1933
1934 2017-09-29  Commit Queue  <commit-queue@webkit.org>
1935
1936         Unreviewed, rolling out r222563, r222565, and r222581.
1937         https://bugs.webkit.org/show_bug.cgi?id=177675
1938
1939         "It causes a crash when playing youtube videos" (Requested by
1940         saamyjoon on #webkit).
1941
1942         Reverted changesets:
1943
1944         "[DFG] Support ArrayPush with multiple args"
1945         https://bugs.webkit.org/show_bug.cgi?id=175823
1946         http://trac.webkit.org/changeset/222563
1947
1948         "Unreviewed, build fix after r222563"
1949         https://bugs.webkit.org/show_bug.cgi?id=175823
1950         http://trac.webkit.org/changeset/222565
1951
1952         "Unreviewed, fix x86 breaking due to exhausted registers"
1953         https://bugs.webkit.org/show_bug.cgi?id=175823
1954         http://trac.webkit.org/changeset/222581
1955
1956 2017-09-28  Mark Lam  <mark.lam@apple.com>
1957
1958         test262: Unexpected passes after r222617 and r222618.
1959         https://bugs.webkit.org/show_bug.cgi?id=177622
1960         <rdar://problem/34725960>
1961
1962         Reviewed by Saam Barati.
1963
1964         Update test262.yaml for tests that are now passing.
1965
1966         * test262.yaml:
1967
1968 2017-09-27  Michael Saboff  <msaboff@apple.com>
1969
1970         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
1971         https://bugs.webkit.org/show_bug.cgi?id=177570
1972
1973         Reviewed by Filip Pizlo.
1974
1975         New regression test.
1976
1977         * stress/regress-177570.js: Added.
1978
1979 2017-09-28  Michael Saboff  <msaboff@apple.com>
1980
1981         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
1982         https://bugs.webkit.org/show_bug.cgi?id=177423
1983
1984         Reviewed by Mark Lam.
1985
1986         Updated regression test.
1987
1988         * stress/regress-177423.js:
1989         (catch):
1990
1991 2017-09-27  Mark Lam  <mark.lam@apple.com>
1992
1993         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
1994         https://bugs.webkit.org/show_bug.cgi?id=177584
1995         <rdar://problem/34463903>
1996
1997         Reviewed by Saam Barati.
1998
1999         * stress/regress-177584.js: Added.
2000         (assertEqual):
2001         (Array.prototype.Symbol.species):
2002
2003 2017-09-27  Saam Barati  <sbarati@apple.com>
2004
2005         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2006         https://bugs.webkit.org/show_bug.cgi?id=177523
2007
2008         Reviewed by Mark Lam.
2009
2010         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2011         (assert):
2012         (Test):
2013         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2014         (addMethods):
2015         (i.Test.prototype.propName):
2016
2017 2017-09-27  Mark Lam  <mark.lam@apple.com>
2018
2019         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2020         https://bugs.webkit.org/show_bug.cgi?id=177423
2021         <rdar://problem/34621320>
2022
2023         Reviewed by Keith Miller.
2024
2025         * stress/regress-177423.js: Added.
2026
2027 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2028
2029         Add Above/Below comparisons for UInt32 patterns
2030         https://bugs.webkit.org/show_bug.cgi?id=177281
2031
2032         Reviewed by Saam Barati.
2033
2034         * stress/uint32-comparison-jump.js: Added.
2035         (shouldBe):
2036         (above):
2037         (aboveOrEqual):
2038         (below):
2039         (belowOrEqual):
2040         (notAbove):
2041         (notAboveOrEqual):
2042         (notBelow):
2043         (notBelowOrEqual):
2044         * stress/uint32-comparison.js: Added.
2045         (shouldBe):
2046         (above):
2047         (aboveOrEqual):
2048         (below):
2049         (belowOrEqual):
2050         (aboveTest):
2051         (aboveOrEqualTest):
2052         (belowTest):
2053         (belowOrEqualTest):
2054
2055 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2056
2057         [DFG] Support ArrayPush with multiple args
2058         https://bugs.webkit.org/show_bug.cgi?id=175823
2059
2060         Reviewed by Saam Barati.
2061
2062         * microbenchmarks/array-push-0.js: Added.
2063         (arrayPush0):
2064         * microbenchmarks/array-push-1.js: Added.
2065         (arrayPush1):
2066         * microbenchmarks/array-push-2.js: Added.
2067         (arrayPush2):
2068         * microbenchmarks/array-push-3.js: Added.
2069         (arrayPush3):
2070         * stress/array-push-multiple-contiguous.js: Added.
2071         (shouldBe):
2072         (test):
2073         * stress/array-push-multiple-double-nan.js: Added.
2074         (shouldBe):
2075         (test):
2076         * stress/array-push-multiple-double.js: Added.
2077         (shouldBe):
2078         (test):
2079         * stress/array-push-multiple-int32.js: Added.
2080         (shouldBe):
2081         (test):
2082         * stress/array-push-multiple-many-contiguous.js: Added.
2083         (shouldBe):
2084         (test):
2085         * stress/array-push-multiple-many-double.js: Added.
2086         (shouldBe):
2087         (test):
2088         * stress/array-push-multiple-many-int32.js: Added.
2089         (shouldBe):
2090         (test):
2091         * stress/array-push-multiple-many-storage.js: Added.
2092         (shouldBe):
2093         (test):
2094         * stress/array-push-multiple-storage.js: Added.
2095         (shouldBe):
2096         (test):
2097
2098 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2099
2100         Unreviewed, rolling out r222518.
2101         https://bugs.webkit.org/show_bug.cgi?id=177507
2102
2103         Break the High Sierra build (Requested by yusukesuzuki on
2104         #webkit).
2105
2106         Reverted changeset:
2107
2108         "Add Above/Below comparisons for UInt32 patterns"
2109         https://bugs.webkit.org/show_bug.cgi?id=177281
2110         http://trac.webkit.org/changeset/222518
2111
2112 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2113
2114         Add Above/Below comparisons for UInt32 patterns
2115         https://bugs.webkit.org/show_bug.cgi?id=177281
2116
2117         Reviewed by Saam Barati.
2118
2119         * stress/uint32-comparison-jump.js: Added.
2120         (shouldBe):
2121         (above):
2122         (aboveOrEqual):
2123         (below):
2124         (belowOrEqual):
2125         (notAbove):
2126         (notAboveOrEqual):
2127         (notBelow):
2128         (notBelowOrEqual):
2129         * stress/uint32-comparison.js: Added.
2130         (shouldBe):
2131         (above):
2132         (aboveOrEqual):
2133         (below):
2134         (belowOrEqual):
2135         (aboveTest):
2136         (aboveOrEqualTest):
2137         (belowTest):
2138         (belowOrEqualTest):
2139
2140 2017-09-23  Keith Miller  <keith_miller@apple.com>
2141
2142         Fix infinite looping test262 test
2143         https://bugs.webkit.org/show_bug.cgi?id=177412
2144
2145         Reviewed by Yusuke Suzuki.
2146
2147         This test was poorly designed since failing it would cause the vm
2148         to inifinite loop. I've fixed it locally and will fix it on github pending
2149         the results of next weeks tc39 meeting.
2150
2151         * test262.yaml:
2152         * test262/test/language/statements/for-of/iterator-next-reference.js:
2153
2154 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2155
2156         test262: $.agent became $262.agent in test262 update
2157         https://bugs.webkit.org/show_bug.cgi?id=177407
2158
2159         Reviewed by Yusuke Suzuki.
2160
2161         * test262.yaml:
2162         ~320 tests pass now that we correctly make $262 available.
2163
2164 2017-09-22  Keith Miller  <keith_miller@apple.com>
2165
2166         Speculatively change iteration protocall to use the same next function
2167         https://bugs.webkit.org/show_bug.cgi?id=175653
2168
2169         Reviewed by Saam Barati.
2170
2171         Change test to match the new iteration behavior.
2172
2173         * stress/spread-optimized-properly.js:
2174
2175 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2176
2177         [DFG][FTL] Profile array vector length for array allocation
2178         https://bugs.webkit.org/show_bug.cgi?id=177051
2179
2180         Reviewed by Saam Barati.
2181
2182         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2183         (target):
2184
2185 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2186
2187         Unreviewed, rolling out r222380.
2188         https://bugs.webkit.org/show_bug.cgi?id=177352
2189
2190         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2191         #webkit).
2192
2193         Reverted changeset:
2194
2195         "[DFG][FTL] Profile array vector length for array allocation"
2196         https://bugs.webkit.org/show_bug.cgi?id=177051
2197         http://trac.webkit.org/changeset/222380
2198
2199 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2200
2201         [DFG][FTL] Profile array vector length for array allocation
2202         https://bugs.webkit.org/show_bug.cgi?id=177051
2203
2204         Reviewed by Saam Barati.
2205
2206         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2207         (target):
2208
2209 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2210
2211         Skip new hanging test262 tests.
2212         https://bugs.webkit.org/show_bug.cgi?id=177326
2213
2214         Unreviewed test gardening.
2215
2216         * test262.yaml:
2217
2218 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2219
2220         Mark 6 test262 tests as passing.
2221         https://bugs.webkit.org/show_bug.cgi?id=177307
2222
2223         Unreviewed test gardening.
2224
2225         * test262.yaml:
2226
2227 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2228
2229         Unreviewed follow-up to r222311.
2230
2231         * test262/harness/sta.js:
2232         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2233         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2234         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2235         * test262/test/built-ins/Array/from/elements-added-after.js:
2236         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2237         * test262/test/built-ins/Array/from/elements-updated-after.js:
2238         * test262/test/built-ins/Array/from/from-array.js:
2239         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2240         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2241         * test262/test/built-ins/Array/from/source-array-boundary.js:
2242         * test262/test/built-ins/Array/from/source-object-constructor.js:
2243         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2244         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2245         * test262/test/built-ins/Array/from/source-object-length.js:
2246         * test262/test/built-ins/Array/from/source-object-missing.js:
2247         * test262/test/built-ins/Array/from/source-object-without.js:
2248         * test262/test/built-ins/Array/from/this-null.js:
2249         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2250         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2251         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2252         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2253         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2254         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2255         * test262/test/language/literals/string/7.8.4-1gs.js:
2256         Fix some files that I failed to update when I applied my patch.
2257
2258 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2259
2260         Update test262 tests
2261         https://bugs.webkit.org/show_bug.cgi?id=177220
2262
2263         Reviewed by Saam Barati and Yusuke Suzuki.
2264
2265         * test262.yaml:
2266         * test262/test262-Revision.txt:
2267         New rebaselined expectations for all tests.
2268
2269         * test262/*:
2270         Updated.
2271
2272 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2273
2274         [DFG] Remove ToThis more aggressively
2275         https://bugs.webkit.org/show_bug.cgi?id=177056
2276
2277         Reviewed by Saam Barati.
2278
2279         * stress/generator-with-this-strict.js: Added.
2280         (shouldBe):
2281         (generator):
2282         (target):
2283         * stress/generator-with-this.js: Added.
2284         (shouldBe):
2285         (generator):
2286         (target):
2287
2288 2017-09-17  Michael Saboff  <msaboff@apple.com>
2289
2290         https://bugs.webkit.org/show_bug.cgi?id=177038
2291         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2292
2293         Reviewed by JF Bastien.
2294
2295         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2296         as it dies using too much memory.
2297
2298 2017-09-15  Saam Barati  <sbarati@apple.com>
2299
2300         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2301         https://bugs.webkit.org/show_bug.cgi?id=176981
2302
2303         Reviewed by Yusuke Suzuki.
2304
2305         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2306         (assert):
2307         (verify):
2308         (func):
2309         (const.bar.createBuiltin):
2310
2311 2017-09-14  Saam Barati  <sbarati@apple.com>
2312
2313         It should be valid to exit before each set when doing arity fixup when inlining
2314         https://bugs.webkit.org/show_bug.cgi?id=176948
2315
2316         Reviewed by Keith Miller.
2317
2318         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2319         (baz):
2320         (bar):
2321         (foo):
2322
2323 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2324
2325         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2326         https://bugs.webkit.org/show_bug.cgi?id=176867
2327
2328         Reviewed by Sam Weinig.
2329
2330         * microbenchmarks/object-get-own-property-symbols.js: Added.
2331         (test):
2332
2333 2017-09-13  Mark Lam  <mark.lam@apple.com>
2334
2335         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2336         https://bugs.webkit.org/show_bug.cgi?id=176888
2337         <rdar://problem/34381832>
2338
2339         Not reviewed.
2340
2341         * stress/op_mod-ConstVar.js:
2342         * stress/op_mod-VarConst.js:
2343         * stress/op_mod-VarVar.js:
2344
2345 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2346
2347         Skip 3 op_mod tests on Debug JSC bots.
2348         https://bugs.webkit.org/show_bug.cgi?id=176630
2349
2350         Unreviewed test gardening.
2351
2352         * stress/op_mod-ConstVar.js:
2353         * stress/op_mod-VarConst.js:
2354         * stress/op_mod-VarVar.js:
2355
2356 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2357
2358         [JSC] Fix Array allocation in Object.keys
2359         https://bugs.webkit.org/show_bug.cgi?id=176826
2360
2361         Reviewed by Saam Barati.
2362
2363         * stress/object-own-property-keys.js: Added.
2364         (shouldBe):
2365
2366 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2367
2368         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2369         https://bugs.webkit.org/show_bug.cgi?id=176010
2370
2371         Reviewed by Filip Pizlo.
2372
2373         * microbenchmarks/weak-map-key.js: Added.
2374         (assert):
2375         (objectKey):
2376         (let.start.Date.now):
2377
2378 2017-09-12  Mark Lam  <mark.lam@apple.com>
2379
2380         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2381         https://bugs.webkit.org/show_bug.cgi?id=176630
2382
2383         Reviewed by JF Bastien.
2384
2385         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2386         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2387         a speculative fix for the bots that are seeing these fail.
2388
2389         I also undid the skipping of the op_mod tests for debug builds.
2390
2391         * stress/op_div-ConstVar.js:
2392         * stress/op_div-VarConst.js:
2393         * stress/op_div-VarVar.js:
2394         * stress/op_mod-ConstVar.js:
2395         * stress/op_mod-VarConst.js:
2396         * stress/op_mod-VarVar.js:
2397
2398 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2399
2400         Skip stress/value-to-boolean.js on Debug bots.
2401         https://bugs.webkit.org/show_bug.cgi?id=176787
2402
2403         Unreviewed test gardening.
2404
2405         * stress/value-to-boolean.js:
2406
2407 2017-09-11  Mark Lam  <mark.lam@apple.com>
2408
2409         Change test expectation for test262/test/language/statements/try/tco-catch.js
2410         https://bugs.webkit.org/show_bug.cgi?id=176749
2411
2412         Rubber stamped by Keith Miller.
2413
2414         It's been failing since at least r221821.  I'm changing the test expectation to
2415         fail to green the bots while I investigate some more.
2416
2417         * test262.yaml:
2418
2419 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2420
2421         Unreviewed, rolling out r221854.
2422
2423         The test added with this change fails on 32-bit JSC bots.
2424
2425         Reverted changeset:
2426
2427         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2428         https://bugs.webkit.org/show_bug.cgi?id=176010
2429         http://trac.webkit.org/changeset/221854
2430
2431 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2432
2433         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2434         https://bugs.webkit.org/show_bug.cgi?id=176010
2435
2436         Reviewed by Filip Pizlo.
2437
2438         * microbenchmarks/weak-map-key.js: Added.
2439         (assert):
2440         (objectKey):
2441         (let.start.Date.now):
2442
2443 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2444
2445         [JSC] Optimize Object.keys by using careful array allocation
2446         https://bugs.webkit.org/show_bug.cgi?id=176654
2447
2448         Reviewed by Darin Adler.
2449
2450         * microbenchmarks/object-keys.js: Added.
2451         (test):
2452
2453 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
2454
2455         Error should compute .stack and friends lazily
2456         https://bugs.webkit.org/show_bug.cgi?id=176645
2457
2458         Reviewed by Saam Barati.
2459
2460         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
2461         * microbenchmarks/new-error.js: Added.
2462         * microbenchmarks/throw.js: Added.
2463
2464 2017-09-09  Mark Lam  <mark.lam@apple.com>
2465
2466         [Re-landing] Use JIT probes for DFG OSR exit.
2467         https://bugs.webkit.org/show_bug.cgi?id=175144
2468         <rdar://problem/33437050>
2469
2470         Not reviewed.  Original patch reviewed by Saam Barati.
2471
2472         Disable these tests for debug builds because they run too slow with the new OSR exit.
2473
2474         * stress/op_mod-ConstVar.js:
2475         * stress/op_mod-VarConst.js:
2476         * stress/op_mod-VarVar.js:
2477
2478 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2479
2480         [DFG] NewArrayWithSize(size)'s size does not care negative zero
2481         https://bugs.webkit.org/show_bug.cgi?id=176300
2482
2483         Reviewed by Saam Barati.
2484
2485         * stress/new-array-with-size-div.js: Added.
2486         (shouldBe):
2487         (test):
2488         (i.i):
2489
2490 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2491
2492         [DFG] PutByVal with Array::Generic is too generic
2493         https://bugs.webkit.org/show_bug.cgi?id=176345
2494
2495         Reviewed by Filip Pizlo.
2496
2497         * stress/object-assign-symbols.js: Added.
2498         (shouldBe):
2499         (test):
2500         * stress/object-assign.js: Added.
2501         (shouldBe):
2502         (test):
2503         (i.shouldBe.JSON.stringify.test):
2504
2505 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2506
2507         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
2508         https://bugs.webkit.org/show_bug.cgi?id=176590
2509
2510         Reviewed by Saam Barati.
2511
2512         * microbenchmarks/object-iterate-symbols.js: Added.
2513         (test):
2514         * microbenchmarks/object-iterate.js: Added.
2515         (test):
2516         * stress/object-iterate-symbols.js: Added.
2517         (shouldBe):
2518         (test):
2519         * stress/object-iterate.js: Added.
2520         (shouldBe):
2521         (test):
2522
2523 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
2524
2525         [Win32] 10 JSC stress tests are failing.
2526         https://bugs.webkit.org/show_bug.cgi?id=176538
2527
2528         Reviewed by Mark Lam.
2529
2530         Skip tests on Windows to make the bots green.
2531
2532         * ChakraCore.yaml:
2533         * stress/date-relaxed.js:
2534
2535 2017-09-06  Mark Lam  <mark.lam@apple.com>
2536
2537         constructGenericTypedArrayViewWithArguments() is missing an exception check.
2538         https://bugs.webkit.org/show_bug.cgi?id=176485
2539         <rdar://problem/33898874>
2540
2541         Reviewed by Keith Miller.
2542
2543         * stress/regress-176485.js: Added.
2544
2545 2017-09-05  Saam Barati  <sbarati@apple.com>
2546
2547         isNotCellSpeculation is wrong with respect to SpecEmpty
2548         https://bugs.webkit.org/show_bug.cgi?id=176429
2549
2550         Reviewed by Michael Saboff.
2551
2552         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
2553         (Foo):
2554
2555 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
2556
2557         test262: Completion values for control flow do not match the spec
2558         https://bugs.webkit.org/show_bug.cgi?id=171265
2559
2560         Reviewed by Saam Barati.
2561
2562         * stress/completion-value.js:
2563         Condensed test for completion values in top level statements.
2564
2565         * stress/super-get-by-id.js:
2566         ClassDeclaration when evaled no longer produce values. Convert
2567         these to ClassExpressions so they produce the class value.
2568         
2569         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
2570         This is a progression for currect spec behavior.
2571
2572         * mozilla/mozilla-tests.yaml:
2573         This test is now outdated, so mark it as failing for that reason.
2574
2575         * test262.yaml:
2576         Passing all "cptn" completion value tests.
2577
2578 2017-09-04  Saam Barati  <sbarati@apple.com>
2579
2580         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
2581         https://bugs.webkit.org/show_bug.cgi?id=176317
2582
2583         Reviewed by Keith Miller.
2584
2585         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
2586         (Foo):
2587
2588 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2589
2590         [DFG][FTL] Efficiently execute number#toString()
2591         https://bugs.webkit.org/show_bug.cgi?id=170007
2592
2593         Reviewed by Keith Miller.
2594
2595         * microbenchmarks/number-to-string-strength-reduction.js: Added.
2596         (test):
2597         * microbenchmarks/number-to-string-with-radix-10.js: Added.
2598         (test):
2599         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
2600         (test):
2601         * microbenchmarks/number-to-string-with-radix.js: Added.
2602         (test):
2603         * stress/number-to-string-strength-reduction.js: Added.
2604         (shouldBe):
2605         (test):
2606         * stress/number-to-string-with-radix-10.js: Added.
2607         (shouldBe):
2608         (test):
2609         * stress/number-to-string-with-radix-cse.js: Added.
2610         (shouldBe):
2611         (test):
2612         * stress/number-to-string-with-radix-invalid.js: Added.
2613         (shouldThrow):
2614         * stress/number-to-string-with-radix-watchpoint.js: Added.
2615         (shouldBe):
2616         (test):
2617         (i.i.1e3.Number.prototype.toString):
2618         * stress/number-to-string-with-radix.js: Added.
2619         (shouldBe):
2620         (test):
2621
2622 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2623
2624         [DFG] Relax arity requirement
2625         https://bugs.webkit.org/show_bug.cgi?id=175523
2626
2627         Reviewed by Saam Barati.
2628
2629         * stress/arity-mismatch-arguments-length.js: Added.
2630         (shouldBe):
2631         (test1):
2632         (test):
2633         * stress/arity-mismatch-get-argument.js: Added.
2634         (shouldBe):
2635         (builtin.createBuiltin):
2636         (test):
2637         * stress/arity-mismatch-inlining-extra-slots.js: Added.
2638         (shouldBe):
2639         (inlineTarget):
2640         (test):
2641         * stress/arity-mismatch-inlining.js: Added.
2642         (shouldBe):
2643         (inlineTarget):
2644         (test):
2645         * stress/arity-mismatch-rest.js: Added.
2646         (shouldBe):
2647         (test2):
2648         (test1):
2649         (test):
2650
2651 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2652
2653         [JSC] Fix "name" and "length" of Proxy revoke function
2654         https://bugs.webkit.org/show_bug.cgi?id=176155
2655
2656         Reviewed by Mark Lam.
2657
2658         * test262.yaml:
2659
2660 2017-08-31  Saam Barati  <sbarati@apple.com>
2661
2662         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
2663         https://bugs.webkit.org/show_bug.cgi?id=176206
2664
2665         Reviewed by Keith Miller.
2666
2667         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
2668         (a):
2669         (b):
2670         (foo):
2671
2672 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
2673
2674         Skip two slow JSC tests after r221422.
2675
2676         Unreviewed test gardening.
2677
2678         * stress/regexp-prototype-match-on-too-long-rope.js:
2679         * stress/regexp-prototype-test-on-too-long-rope.js:
2680
2681 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
2682
2683         Unreviewed, skipping slow tests.
2684         
2685         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
2686         work differently now.
2687
2688         * stress/regexp-prototype-exec-on-too-long-rope.js:
2689         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
2690
2691 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2692
2693         [JSC] Use reifying system for "name" property of builtin JSFunction
2694         https://bugs.webkit.org/show_bug.cgi?id=175260
2695
2696         Reviewed by Saam Barati.
2697
2698         * stress/accessors-get-set-prefix.js:
2699         * stress/builtin-function-name.js: Added.
2700         (shouldBe):
2701         (shouldThrow):
2702         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2703         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2704         * stress/private-name-as-anonymous-builtin.js: Added.
2705         (shouldBe):
2706         (NotPromise):
2707
2708 2017-08-30  Saam Barati  <sbarati@apple.com>
2709
2710         Unreviewed. Make test stop printing.
2711
2712         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
2713
2714 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
2715
2716         Unreviewed, rolling out r221327.
2717
2718         This change caused test262 failures.
2719
2720         Reverted changeset:
2721
2722         "[JSC] Use reifying system for "name" property of builtin
2723         JSFunction"
2724         https://bugs.webkit.org/show_bug.cgi?id=175260
2725         http://trac.webkit.org/changeset/221327
2726
2727 2017-08-30  Saam Barati  <sbarati@apple.com>
2728
2729         semicolon is being interpreted as an = in the LiteralParser
2730         https://bugs.webkit.org/show_bug.cgi?id=176114
2731
2732         Reviewed by Oliver Hunt.
2733
2734         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
2735         * stress/resources/literal-parser-test-case.js: Added.
2736
2737 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2738
2739         [ESNext] Async iteration - Implement async iteration statement: for-await-of
2740         https://bugs.webkit.org/show_bug.cgi?id=166698
2741
2742         Reviewed by Yusuke Suzuki.
2743
2744         * stress/async-iteration-for-await-of-syntax.js: Added.
2745         (assert):
2746         (checkSyntax):
2747         (checkSyntaxError):
2748         (checkSimpleAsyncGeneratorSloppyMode):
2749         (checkSimpleAsyncGeneratorStrictMode):
2750         (checkNestedAsyncGenerators):
2751         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2752         * stress/async-iteration-for-await-of.js: Added.
2753         (assert):
2754         (async.foo):
2755         (async.boo):
2756         (const.boo.async):
2757
2758 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2759
2760         [JSC] Use reifying system for "name" property of builtin JSFunction
2761         https://bugs.webkit.org/show_bug.cgi?id=175260
2762
2763         Reviewed by Saam Barati.
2764
2765         * stress/accessors-get-set-prefix.js:
2766         * stress/builtin-function-name.js: Added.
2767         (shouldBe):
2768         (shouldThrow):
2769         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2770         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2771
2772 2017-08-25  Saam Barati  <sbarati@apple.com>
2773
2774         Support compiling catch in the DFG
2775         https://bugs.webkit.org/show_bug.cgi?id=174590
2776         <rdar://problem/34047845>
2777
2778         Reviewed by Filip Pizlo.
2779
2780         * microbenchmarks/delta-blue-try-catch.js: Added.
2781         (exception):
2782         (value):
2783         (OrderedCollection):
2784         (OrderedCollection.prototype.add):
2785         (OrderedCollection.prototype.at):
2786         (OrderedCollection.prototype.size):
2787         (OrderedCollection.prototype.removeFirst):
2788         (OrderedCollection.prototype.remove):
2789         (Strength):
2790         (Strength.stronger):
2791         (Strength.weaker):
2792         (Strength.weakestOf):
2793         (Strength.strongest):
2794         (Strength.prototype.nextWeaker):
2795         (Constraint):
2796         (Constraint.prototype.addConstraint):
2797         (Constraint.prototype.satisfy):
2798         (Constraint.prototype.destroyConstraint):
2799         (Constraint.prototype.isInput):
2800         (UnaryConstraint):
2801         (UnaryConstraint.prototype.addToGraph):
2802         (UnaryConstraint.prototype.chooseMethod):
2803         (UnaryConstraint.prototype.isSatisfied):
2804         (UnaryConstraint.prototype.markInputs):
2805         (UnaryConstraint.prototype.output):
2806         (UnaryConstraint.prototype.recalculate):
2807         (UnaryConstraint.prototype.markUnsatisfied):
2808         (UnaryConstraint.prototype.inputsKnown):
2809         (UnaryConstraint.prototype.removeFromGraph):
2810         (StayConstraint):
2811         (StayConstraint.prototype.execute):
2812         (EditConstraint.prototype.isInput):
2813         (EditConstraint.prototype.execute):
2814         (BinaryConstraint):
2815         (BinaryConstraint.prototype.chooseMethod):
2816         (BinaryConstraint.prototype.addToGraph):
2817         (BinaryConstraint.prototype.isSatisfied):
2818         (BinaryConstraint.prototype.markInputs):
2819         (BinaryConstraint.prototype.input):
2820         (BinaryConstraint.prototype.output):
2821         (BinaryConstraint.prototype.recalculate):
2822         (BinaryConstraint.prototype.markUnsatisfied):
2823         (BinaryConstraint.prototype.inputsKnown):
2824         (BinaryConstraint.prototype.removeFromGraph):
2825         (ScaleConstraint):
2826         (ScaleConstraint.prototype.addToGraph):
2827         (ScaleConstraint.prototype.removeFromGraph):
2828         (ScaleConstraint.prototype.markInputs):
2829         (ScaleConstraint.prototype.execute):
2830         (ScaleConstraint.prototype.recalculate):
2831         (EqualityConstraint):
2832         (EqualityConstraint.prototype.execute):
2833         (Variable):
2834         (Variable.prototype.addConstraint):
2835         (Variable.prototype.removeConstraint):
2836         (Planner):
2837         (Planner.prototype.incrementalAdd):
2838         (Planner.prototype.incrementalRemove):
2839         (Planner.prototype.newMark):
2840         (Planner.prototype.makePlan):
2841         (Planner.prototype.extractPlanFromConstraints):
2842         (Planner.prototype.addPropagate):
2843         (Planner.prototype.removePropagateFrom):
2844         (Planner.prototype.addConstraintsConsumingTo):
2845         (Plan):
2846         (Plan.prototype.addConstraint):
2847         (Plan.prototype.size):
2848         (Plan.prototype.constraintAt):
2849         (Plan.prototype.execute):
2850         (chainTest):
2851         (projectionTest):
2852         (change):
2853         (deltaBlue):
2854         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2855         (assert):
2856         (Numbers):
2857         (Numbers.prototype.next):
2858         (return.Transpose):
2859         (return.Transpose.prototype.next):
2860         (transpose):
2861         (verifyEven):
2862         (verifyString):
2863         (foo):
2864         (runIterators):
2865         * microbenchmarks/try-catch-word-count.js: Added.
2866         (let.assert):
2867         (EOF):
2868         (let.texts):
2869         (let.o.apply):
2870         (foo):
2871         (bar):
2872         (f):
2873         (run):
2874         (test1):
2875         (test2):
2876         (test3):
2877         (fn):
2878         (A):
2879         (B):
2880         (A.prototype.getValue):
2881         (B.prototype.getParentValue):
2882         (strlen):
2883         (sum.0):
2884         (test):
2885         (result.test.o):
2886         (set add.set add):
2887         (set forEach):
2888         (stringHash):
2889         (set if):
2890         (testFunction):
2891         (set delete.set has.set add):
2892         * stress/catch-set-argument-speculation-failure.js: Added.
2893         (o):
2894         (e):
2895         (e2):
2896         (escape):
2897         (baz):
2898         (noInline.run):
2899         (noInline):
2900         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2901         (foo):
2902         (e):
2903         (baz):
2904         (bar):
2905
2906 2017-08-24  Commit Queue  <commit-queue@webkit.org>
2907
2908         Unreviewed, rolling out r221119, r221124, and r221143.
2909         https://bugs.webkit.org/show_bug.cgi?id=175973
2910
2911         "I think it regressed JSBench by 20%" (Requested by saamyjoon
2912         on #webkit).
2913
2914         Reverted changesets:
2915
2916         "Support compiling catch in the DFG"
2917         https://bugs.webkit.org/show_bug.cgi?id=174590
2918         http://trac.webkit.org/changeset/221119
2919
2920         "Unreviewed, build fix in GTK port"
2921         https://bugs.webkit.org/show_bug.cgi?id=174590
2922         http://trac.webkit.org/changeset/221124
2923
2924         "DFG::JITCode::osrEntry should get sorted since we perform a
2925         binary search on it"
2926         https://bugs.webkit.org/show_bug.cgi?id=175893
2927         http://trac.webkit.org/changeset/221143
2928
2929 2017-08-24  Michael Saboff  <msaboff@apple.com>
2930
2931         Add support for RegExp "dotAll" flag
2932         https://bugs.webkit.org/show_bug.cgi?id=175924
2933
2934         Reviewed by Keith Miller.
2935
2936         Updated tests for new dotAll ('s' flag) changes.
2937
2938         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
2939         * stress/static-getter-in-names.js:
2940
2941 2017-08-24  Mark Lam  <mark.lam@apple.com>
2942
2943         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
2944         https://bugs.webkit.org/show_bug.cgi?id=175940
2945         <rdar://problem/29003921>
2946
2947         Reviewed by Saam Barati.
2948
2949         * stress/regress-164081.js: Added.
2950         (shouldEqual):
2951         (testcase):
2952
2953 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
2954
2955         Skip flaky JSC test stress/test-finally.js.
2956         https://bugs.webkit.org/show_bug.cgi?id=160283
2957
2958         Unreviewed test gardening.
2959
2960         * stress/test-finally.js:
2961
2962 2017-08-23  Saam Barati  <sbarati@apple.com>
2963
2964         Support compiling catch in the DFG
2965         https://bugs.webkit.org/show_bug.cgi?id=174590
2966
2967         Reviewed by Filip Pizlo.
2968
2969         * microbenchmarks/delta-blue-try-catch.js: Added.
2970         (exception):
2971         (value):
2972         (OrderedCollection):
2973         (OrderedCollection.prototype.add):
2974         (OrderedCollection.prototype.at):
2975         (OrderedCollection.prototype.size):
2976         (OrderedCollection.prototype.removeFirst):
2977         (OrderedCollection.prototype.remove):
2978         (Strength):
2979         (Strength.stronger):
2980         (Strength.weaker):
2981         (Strength.weakestOf):
2982         (Strength.strongest):
2983         (Strength.prototype.nextWeaker):
2984         (Constraint):
2985         (Constraint.prototype.addConstraint):
2986         (Constraint.prototype.satisfy):
2987         (Constraint.prototype.destroyConstraint):
2988         (Constraint.prototype.isInput):
2989         (UnaryConstraint):
2990         (UnaryConstraint.prototype.addToGraph):
2991         (UnaryConstraint.prototype.chooseMethod):
2992         (UnaryConstraint.prototype.isSatisfied):
2993         (UnaryConstraint.prototype.markInputs):
2994         (UnaryConstraint.prototype.output):
2995         (UnaryConstraint.prototype.recalculate):
2996         (UnaryConstraint.prototype.markUnsatisfied):
2997         (UnaryConstraint.prototype.inputsKnown):
2998         (UnaryConstraint.prototype.removeFromGraph):
2999         (StayConstraint):
3000         (StayConstraint.prototype.execute):
3001         (EditConstraint.prototype.isInput):
3002         (EditConstraint.prototype.execute):
3003         (BinaryConstraint):
3004         (BinaryConstraint.prototype.chooseMethod):
3005         (BinaryConstraint.prototype.addToGraph):
3006         (BinaryConstraint.prototype.isSatisfied):
3007         (BinaryConstraint.prototype.markInputs):
3008         (BinaryConstraint.prototype.input):
3009         (BinaryConstraint.prototype.output):
3010         (BinaryConstraint.prototype.recalculate):
3011         (BinaryConstraint.prototype.markUnsatisfied):
3012         (BinaryConstraint.prototype.inputsKnown):
3013         (BinaryConstraint.prototype.removeFromGraph):
3014         (ScaleConstraint):
3015         (ScaleConstraint.prototype.addToGraph):
3016         (ScaleConstraint.prototype.removeFromGraph):
3017         (ScaleConstraint.prototype.markInputs):
3018         (ScaleConstraint.prototype.execute):
3019         (ScaleConstraint.prototype.recalculate):
3020         (EqualityConstraint):
3021         (EqualityConstraint.prototype.execute):
3022         (Variable):
3023         (Variable.prototype.addConstraint):
3024         (Variable.prototype.removeConstraint):
3025         (Planner):
3026         (Planner.prototype.incrementalAdd):
3027         (Planner.prototype.incrementalRemove):
3028         (Planner.prototype.newMark):
3029         (Planner.prototype.makePlan):
3030         (Planner.prototype.extractPlanFromConstraints):
3031         (Planner.prototype.addPropagate):
3032         (Planner.prototype.removePropagateFrom):
3033         (Planner.prototype.addConstraintsConsumingTo):
3034         (Plan):
3035         (Plan.prototype.addConstraint):
3036         (Plan.prototype.size):
3037         (Plan.prototype.constraintAt):
3038         (Plan.prototype.execute):
3039         (chainTest):
3040         (projectionTest):
3041         (change):
3042         (deltaBlue):
3043         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3044         (assert):
3045         (Numbers):
3046         (Numbers.prototype.next):
3047         (return.Transpose):
3048         (return.Transpose.prototype.next):
3049         (transpose):
3050         (verifyEven):
3051         (verifyString):
3052         (foo):
3053         (runIterators):
3054         * microbenchmarks/try-catch-word-count.js: Added.
3055         (let.assert):
3056         (EOF):
3057         (let.texts):
3058         (let.o.apply):
3059         (foo):
3060         (bar):
3061         (f):
3062         (run):
3063         (test1):
3064         (test2):
3065         (test3):
3066         (fn):
3067         (A):
3068         (B):
3069         (A.prototype.getValue):
3070         (B.prototype.getParentValue):
3071         (strlen):
3072         (sum.0):
3073         (test):
3074         (result.test.o):
3075         (set add.set add):
3076         (set forEach):
3077         (stringHash):
3078         (set if):
3079         (testFunction):
3080         (set delete.set has.set add):
3081         * stress/catch-set-argument-speculation-failure.js: Added.
3082         (o):
3083         (e):
3084         (e2):
3085         (escape):
3086         (baz):
3087         (noInline.run):
3088         (noInline):
3089         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3090         (foo):
3091         (e):
3092         (baz):
3093         (bar):
3094
3095 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3096
3097         [JSC] Optimize Map iteration with intrinsic
3098         https://bugs.webkit.org/show_bug.cgi?id=174355
3099
3100         Reviewed by Saam Barati.
3101
3102         * stress/map-iterator-result-should-have-expected-shape.js: Added.
3103         (shouldBe):
3104         (throw.new.Error):
3105         * stress/set-iterator-result-should-have-expected-shape.js: Added.
3106         (shouldBe):
3107         (throw.new.Error.let.iterator.set Symbol):
3108         (throw.new.Error.set add):
3109         (let.iterator.set Symbol):
3110
3111 2017-08-23  Robin Morisset  <rmorisset@apple.com>
3112
3113         Add a micro-benchmark for checking that accessing a variable within a 'with'
3114         block does not automatically prevent type prediction.
3115         https://bugs.webkit.org/show_bug.cgi?id=175738
3116
3117         Reviewed by Saam Barati.
3118
3119         * stress/with_and_arith.js: Added.
3120         (with):
3121
3122 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
3123
3124         [ESNext] Async iteration - Implement Async Generator - runtime
3125         https://bugs.webkit.org/show_bug.cgi?id=175240
3126
3127         Reviewed by Yusuke Suzuki.
3128
3129         * stress/async-iteration-async-from-sync.js: Added.
3130         (assert):
3131         (const.Logger):
3132         (this.fullfilled):
3133         (this.fullfilledDone):
3134         (this.rejected):
3135         (this.catched):
3136         (this.isFinal):
3137         (_assertLogger):
3138         (const.assertLogger):
3139         (const.getPromise.promiseHolder.return.new.Promise):
3140         (foo):
3141         (async.boo):
3142         (bar):
3143         (async.baz):
3144         (async.goo):
3145         * stress/async-iteration-basic.js: Added.
3146         (assert):
3147         (const.Logger):
3148         (this.fullfilled):
3149         (this.fullfilledDone):
3150         (this.rejected):
3151         (this.catched):
3152         (this.isFinal):
3153         (_assertLogger):
3154         (const.assertLogger):
3155         (const.getPromise.promiseHolder.return.new.Promise):
3156         (async.generator):
3157         (iterator.next.then):
3158         (async.baz):
3159         (async.boo):
3160         (async.foo):
3161         (async.goo):
3162         (A.prototype.async.foo):
3163         (A.prototype.async.boo):
3164         (A):
3165         (asyncGenExp.async):
3166         (async.joo):
3167         (j.next.then):
3168         (then):
3169         (async.koo):
3170         (async.loo):
3171         (async.moo):
3172         (async.noo):
3173         (async.ooo):
3174         (async.roo):
3175         (async.poo):
3176         (async.soo):
3177         (async.too):
3178         * stress/async-iteration-evaluation.js: Added.
3179         (assert):
3180         (async.foo):
3181         (catch):
3182         * stress/async-iteration-syntax.js:
3183         * stress/async-iteration-yield-promise.js: Added.
3184         (assert):
3185         (const.Logger):
3186         (this.fullfilled):
3187         (this.fullfilledDone):
3188         (this.rejected):
3189         (this.catched):
3190         (this.isFinal):
3191         (_assertLogger):
3192         (const.assertLogger):
3193         (const.getPromise.promiseHolder.return.new.Promise):
3194         (async.foo):
3195         (async.boo):
3196         (async.bar):
3197         * stress/async-iteration-yield-star-interface.js: Added.
3198         (assert):
3199         (const.getPromise.promiseHolder.return.new.Promise):
3200         (const.Logger):
3201         (this.fullfilled):
3202         (this.fullfilledDone):
3203         (this.rejected):
3204         (this.catched):
3205         (this.custom):
3206         (this.isFinal):
3207         (_assertLogger):
3208         (const.assertLogger):
3209         (let.asyncIter.Symbol.asyncIterator):
3210         (let.asyncIter.next):
3211         (let.asyncIter.throw):
3212         (let.asyncIter.return):
3213         (async.foo):
3214         (asyncIter.Symbol.asyncIterator):
3215         (asyncIter.next):
3216         (async.boo):
3217         (asyncIter.return):
3218         (async.bar):
3219         (async.baz):
3220         (async.foobar):
3221         * stress/async-iteration-yield-star.js: Added.
3222         (assert):
3223         (const.Logger):
3224         (this.fullfilled):
3225         (this.fullfilledDone):
3226         (this.rejected):
3227         (this.catched):
3228         (this.custom):
3229         (this.isFinal):
3230         (_assertLogger):
3231         (const.assertLogger):
3232         (const.getPromise.promiseHolder.return.new.Promise):
3233         (async.foo):
3234         (async.boo):
3235         (async.bar):
3236         (async.baz):
3237         (async.joo):
3238         (async.goo):
3239         (async.koo):
3240         (async.loo):
3241         (let.asyncIter.Symbol.asyncIterator):
3242         (let.asyncIter.next):
3243         (let.asyncIter.throw):
3244         (let.asyncIter.return):
3245         (async.moo):
3246         (async.noo):
3247         * test262.yaml:
3248
3249 2017-08-23  JF Bastien  <jfbastien@apple.com>
3250
3251         Fix printing in test
3252
3253         Unreviewed: fixing verbosity, shouldn't have been there.
3254
3255         * wasm/regress/175693.js:
3256         (else.else):
3257         (catch):
3258
3259 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
3260
3261         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
3262         https://bugs.webkit.org/show_bug.cgi?id=172543
3263
3264         Unreviewed test gardening.
3265
3266         * microbenchmarks/generator-with-several-types.js:
3267
3268 2017-08-17  JF Bastien  <jfbastien@apple.com>
3269
3270         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
3271         https://bugs.webkit.org/show_bug.cgi?id=175693
3272         <rdar://problem/33952443>
3273
3274         Reviewed by Saam Barati.
3275
3276         Add a regression directory for WebAssembly tests.
3277
3278         * wasm.yaml:
3279         * wasm/regress/175693.js: Added.
3280         (else.else):
3281         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
3282         (catch):
3283         * wasm/regress/175693.wasm: Added.
3284
3285 2017-08-15  Robin Morisset  <rmorisset@apple.com>
3286
3287         Support the 'with' keyword in FTL.
3288         https://bugs.webkit.org/show_bug.cgi?id=175585
3289
3290         Reviewed by Saam Barati.
3291
3292         Also improve the JSTest/stress/with.js file to test
3293         what happens when non-objects are passed to with.
3294
3295         * stress/with.js:
3296         (foo):
3297         (i.catch):
3298         (i.with): Deleted.
3299
3300 2017-08-14  Keith Miller  <keith_miller@apple.com>
3301
3302         Add testing tool to lie to the DFG about profiles
3303         https://bugs.webkit.org/show_bug.cgi?id=175487
3304
3305         Reviewed by Saam Barati.
3306
3307         * stress/compare-eq-incomplete-profile.js: Added.
3308         (const.test.createBuiltin):
3309
3310 2017-08-14  Robin Morisset  <rmorisset@apple.com>
3311
3312         Support the with keyword in DFG
3313         https://bugs.webkit.org/show_bug.cgi?id=175470
3314
3315         Reviewed by Saam Barati.
3316
3317         Added a new stress-test for the 'with' keyword, that caught a bug in a
3318         previous version of this code.
3319
3320         * stress/with.js: Added.
3321         (i.with):
3322
3323 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
3324
3325         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
3326         https://bugs.webkit.org/show_bug.cgi?id=175544
3327
3328         Unreviewed test gardening.
3329
3330         * ChakraCore.yaml:
3331
3332 2017-08-09  Caitlin Potter  <caitp@igalia.com>
3333
3334         Early error on ANY operator before new.target
3335         https://bugs.webkit.org/show_bug.cgi?id=157970
3336
3337         Reviewed by Saam Barati.
3338
3339         Instead of throwing if any unary operator precedes new.target, only
3340         throw if the unary operator updates the reference.
3341
3342         The following become legal in JSC:
3343
3344         ```
3345         !new.target
3346         ~new.target
3347         typeof new.target
3348         delete new.target
3349         void new.target
3350         ```
3351
3352         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
3353
3354         * stress/new-target-syntax-errors.js:
3355         * stress/new-target.js:
3356
3357 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
3358
3359         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
3360         https://bugs.webkit.org/show_bug.cgi?id=175255
3361
3362         Unreviewed test gardening.
3363
3364         * stress/regress-169783.js:
3365         * wasm/stress/oom.js:
3366
3367 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
3368
3369         REGRESSION: 2 test262/test/language/statements/async-function failures
3370         https://bugs.webkit.org/show_bug.cgi?id=175334
3371
3372         Reviewed by Yusuke Suzuki.
3373
3374         Add @skip parameters to tests, and remove test for async iterator from 
3375         async await syntax test because it is already covered by async-iterator-syntax.js
3376
3377         * stress/async-await-syntax.js:
3378         * stress/async-iteration-syntax.js:
3379
3380 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3381
3382         Unreviewed, gardening test262 for Promise resolve / reject function length
3383         https://bugs.webkit.org/show_bug.cgi?id=175333
3384
3385         * test262.yaml:
3386
3387 2017-08-07  Robin Morisset  <rmorisset@apple.com>
3388
3389         GetOwnProperty of TypedArray indexed fields is wrongly configurable
3390         https://bugs.webkit.org/show_bug.cgi?id=175307
3391
3392         Reviewed by Saam Barati.
3393
3394         * stress/typedarray-getownproperty-not-configurable.js: Added.
3395         (assert):
3396         (foo):
3397
3398 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
3399
3400         Promise resolve and reject function should have length = 1
3401         https://bugs.webkit.org/show_bug.cgi?id=175242
3402
3403         Reviewed by Saam Barati.
3404
3405         * stress/builtin-function-length.js: Added.
3406         (shouldBe):
3407         (shouldThrow):
3408         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3409         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3410
3411 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
3412
3413         [ESNext] Async iteration - Implement Async Generator - parser
3414         https://bugs.webkit.org/show_bug.cgi?id=175210
3415
3416         Reviewed by Yusuke Suzuki.
3417
3418         * stress/async-await-syntax.js:
3419         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
3420         * stress/async-iteration-syntax.js: Added.
3421         (assert):
3422         (checkSyntax):
3423         (checkSyntaxError):
3424         (checkSimpleAsyncGeneratorSloppyMode):
3425         (checkSimpleAsyncGeneratorStrictMode):
3426         (checkNestedAsyncGenerators):
3427         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3428         * stress/generator-class-methods-syntax.js:
3429
3430 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3431
3432         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
3433         https://bugs.webkit.org/show_bug.cgi?id=175150
3434
3435         Unreviewed test gardening.
3436
3437         * wasm/js-api/test_memory_constructor.js:
3438
3439 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3440
3441         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
3442         https://bugs.webkit.org/show_bug.cgi?id=175100
3443
3444         Reviewed by Mark Lam.
3445
3446         The JSC test JSTests/wasm/stress/oom.js tries to use all the
3447         available memory until an out of memory exception happens.
3448
3449         The Linux kernel is more tuned for server workloads than for GUI
3450         responsiveness. When a process tries to use a lot of memory, Linux
3451         will do its best to serve the request. This usually translates to
3452         free physical RAM by writing to disk dirty pages and/or moving out
3453         less recently used pages to swap (disk storage).
3454         Meanwhile it does this, the system will become unresponsive and this
3455         leads to freezes that can last even some minutes on the worst cases.
3456
3457         Therefore, let's skip this test on Linux as it will cause more harm
3458         than good on the Linux bots or on the machines of Linux developers.
3459
3460         * wasm/stress/oom.js:
3461
3462 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
3463
3464         [JSC] Remove unnecessary print from stress\promise-finally.js test
3465         https://bugs.webkit.org/show_bug.cgi?id=175015
3466
3467         Reviewed by Yusuke Suzuki.
3468
3469         * stress/promise-finally.js:
3470         (p.finally):
3471         (then):
3472
3473 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3474
3475         Unreviewed, update test262 results for optional catch binding
3476
3477         * test262.yaml:
3478
3479 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3480
3481         [JSC] Support optional catch binding
3482         https://bugs.webkit.org/show_bug.cgi?id=174981
3483
3484         Reviewed by Saam Barati.
3485
3486         * stress/optional-catch-binding-syntax.js: Added.
3487         (testSyntax):
3488         (testSyntaxError):
3489         (catch.catch):
3490         * stress/optional-catch-binding.js: Added.
3491         (shouldBe):
3492         (throwException):
3493
3494 2017-07-28  Mark Lam  <mark.lam@apple.com>
3495
3496         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
3497         https://bugs.webkit.org/show_bug.cgi?id=174948
3498         <rdar://problem/33495680>
3499
3500         Reviewed by Filip Pizlo.
3501
3502         * stress/regress-174948.js: Added.
3503
3504 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
3505
3506         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
3507         https://bugs.webkit.org/show_bug.cgi?id=174900
3508
3509         Reviewed by Saam Barati.
3510
3511         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
3512         (sideEffect):
3513         (args):
3514         (test):
3515
3516 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3517
3518         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
3519         https://bugs.webkit.org/show_bug.cgi?id=171637
3520
3521         Reviewed by Darin Adler.
3522
3523         * stress/domjit-getter-complex-with-incorrect-object.js:
3524         (i.shouldThrow):
3525         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
3526         (shouldBe):
3527         (i.shouldThrow):
3528
3529 2017-07-26  JF Bastien  <jfbastien@apple.com>
3530
3531         WebAssembly: test throwing out of the start function
3532         https://bugs.webkit.org/show_bug.cgi?id=165714
3533         <rdar://problem/29760251>
3534
3535         Reviewed by Keith Miller.
3536
3537         * wasm/assert.js:
3538         * wasm/function-tests/trap-from-start.js: Added.
3539         (StartTraps):
3540         * wasm/function-tests/trap-from-start-async.js: Added.
3541         (async.StartTrapsAsync):
3542
3543 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3544
3545         [FTL] Arguments elimination is suppressed by unreachable blocks
3546         https://bugs.webkit.org/show_bug.cgi?id=174352
3547
3548         Reviewed by Filip Pizlo.
3549
3550         * stress/arguments-elimination-force-exit.js: Added.
3551         (shouldBe):
3552         (strict):
3553         (sloppy):
3554         * stress/arguments-elimination-throw.js: Added.
3555         (shouldBe):
3556         (shouldThrow):
3557         (sloppy):
3558         (isArguments):
3559
3560 2017-07-13  Mark Lam  <mark.lam@apple.com>
3561
3562         Add some additional test cases for bug 170896.
3563         https://bugs.webkit.org/show_bug.cgi?id=174491
3564
3565         Reviewed by Filip Pizlo.
3566
3567         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
3568         * stress/regress-170896-with-double-shape-profile.js: Added.
3569         (test):
3570         * stress/regress-170896-with-int32-shape-profile.js: Added.
3571         (test):
3572         * stress/regress-170896.js: Removed.
3573
3574 2017-07-13  Saam Barati  <sbarati@apple.com>
3575
3576         Missing exception check in JSObject::hasInstance
3577         https://bugs.webkit.org/show_bug.cgi?id=174455
3578         <rdar://problem/31384608>
3579
3580         Reviewed by Mark Lam.
3581
3582         * stress/has-instance-exception-check.js: Added.
3583         (assert):
3584         (let.getter.Object.getOwnPropertyDescriptor.get foo):
3585
3586 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
3587
3588         [ESnext] Implement Object Spread
3589         https://bugs.webkit.org/show_bug.cgi?id=167963
3590
3591         Reviewed by Saam Barati.
3592
3593         * stress/obj-rest-destructuring-order.js: Added.
3594         (assert):
3595         (o.get z):
3596         (o.get a):
3597         * stress/obj-spread-order.js: Added.
3598         (assert):
3599         (o.get z):
3600         (o.get a):
3601         * stress/object-spread.js: Added.
3602         (let.assert):
3603         (assert.sameValue):
3604         (let.o.get a):
3605         (let.obj.get c):
3606         (cthulhu.get x):
3607         (let.obj.set c):
3608         (calls.o.get z):
3609         (calls.o.get a):
3610         (try.let.obj.get foo):
3611         (get calls):
3612
3613 2017-07-12  Saam Barati  <sbarati@apple.com>
3614
3615         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
3616         https://bugs.webkit.org/show_bug.cgi?id=174411
3617         <rdar://problem/31696186>
3618
3619         Reviewed by Mark Lam.
3620
3621         * stress/generic-arguments-correct-delete-behavior.js: Added.
3622         (assert):
3623         (makeTest):
3624
3625 2017-07-07  Mark Lam  <mark.lam@apple.com>
3626
3627         \n\r is not the same as \r\n.
3628         https://bugs.webkit.org/show_bug.cgi?id=173053
3629
3630         Reviewed by Keith Miller.
3631
3632         * stress/regress-173053.js: Added.
3633         * stress/template-literal-line-terminators.js:
3634
3635 2017-07-06  Saam Barati  <sbarati@apple.com>
3636
3637         We are missing places where we invalidate the for-in context
3638         https://bugs.webkit.org/show_bug.cgi?id=174184
3639
3640         Reviewed by Geoffrey Garen.
3641
3642         * stress/for-in-invalidate-context-weird-assignments.js: Added.
3643         (assert):
3644         (test):
3645
3646 2017-07-05  Saam Barati  <sbarati@apple.com>
3647
3648         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
3649         https://bugs.webkit.org/show_bug.cgi?id=174188
3650         <rdar://problem/30581423>
3651
3652         Reviewed by Mark Lam.
3653
3654         * stress/new-array-having-a-bad-time-double.js: Added.
3655         (assert):
3656         (foo):
3657
3658 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
3659
3660         WTF::StringImpl::copyChars segfaults when built with GCC 7
3661         https://bugs.webkit.org/show_bug.cgi?id=173407
3662
3663         Reviewed by Andreas Kling.
3664
3665         * stress/string-repeat-copy-chars-crash.js: Added.
3666         (shouldBe):
3667
3668 2017-07-03  Saam Barati  <sbarati@apple.com>
3669
3670         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
3671
3672         * stress/unshiftCountSlowCase-correct-postCapacity.js:
3673
3674 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3675
3676         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
3677
3678         It requires too much memory.
3679
3680         * stress/dont-reserve-huge-capacity-lexer.js:
3681
3682 2017-06-30  Michael Saboff  <msaboff@apple.com>
3683
3684         Skip a test on ARM64 platform since we run out of address space.
3685
3686         Rubber stamped by Saam Barati.
3687
3688         * stress/dont-reserve-huge-capacity-lexer.js:
3689
3690 2017-06-30  Michael Saboff  <msaboff@apple.com>
3691
3692         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
3693         https://bugs.webkit.org/show_bug.cgi?id=174044
3694
3695         Reviewed by Oliver Hunt.
3696
3697         New regression test.
3698
3699         * stress/regress-174044.js: Added.
3700         (test1):
3701         (test2):
3702
3703 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
3704
3705         RegExpCachedResult::setInput should reify left and right contexts
3706         https://bugs.webkit.org/show_bug.cgi?id=173818
3707
3708         Reviewed by Keith Miller.
3709
3710         * stress/right-left-context-invalidated-by-input.js: Added.
3711         (test.validateContexts):
3712         (test):
3713
3714 2017-06-29  Saam Barati  <sbarati@apple.com>
3715
3716         Calculating postCapacity in unshiftCountSlowCase is wrong
3717         https://bugs.webkit.org/show_bug.cgi?id=173992
3718         <rdar://problem/32283199>
3719
3720         Reviewed by Keith Miller.
3721
3722         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
3723         (temp):
3724
3725 2017-06-29  Commit Queue  <commit-queue@webkit.org>
3726
3727         Unreviewed, rolling out r218512.
3728         https://bugs.webkit.org/show_bug.cgi?id=173981
3729
3730         "It changes the behavior of the JS API's JSEvaluateScript
3731         which breaks TurboTax" (Requested by saamyjoon on #webkit).
3732
3733         Reverted changeset:
3734
3735         "test262: Completion values for control flow do not match the
3736         spec"
3737         https://bugs.webkit.org/show_bug.cgi?id=171265
3738         http://trac.webkit.org/changeset/218512
3739
3740 2017-06-27  JF Bastien  <jfbastien@apple.com>
3741
3742         WebAssembly: running out of executable memory should throw OoM
3743         https://bugs.webkit.org/show_bug.cgi?id=171537
3744         <rdar://problem/32963338>
3745
3746         Reviewed by Saam Barati.
3747
3748         * wasm.yaml:
3749         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
3750         (const.invoke):
3751         (failCount.0.catch):
3752         (failCount.0.module.undefined.catch):
3753         * wasm/lowExecutableMemory/exports-oom.js: Added.
3754         (const.type):
3755         (const.params):
3756         (const.randomProgram):
3757         (failCount.0.catch):
3758         (failCount.0.module.undefined.catch):
3759         * wasm/lowExecutableMemory/imports-oom.js: Added.
3760         (const.type):
3761         (const.params):
3762         (const.randomProgram):
3763         (f.imports.push):
3764         (failCount.0.catch):
3765         (failCount.0.module.undefined.catch):
3766
3767 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
3768
3769         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
3770         https://bugs.webkit.org/show_bug.cgi?id=167962
3771
3772         Reviewed by Saam Barati.
3773
3774         * stress/object-rest-deconstruct.js: Added.
3775         (let.assert):
3776         (let.assertPropDescriptor):
3777         (catch):
3778         (get 3):
3779         (foo):
3780         (let.src.get y):
3781         (let.src.set y):
3782         (let.gen):
3783
3784 2017-06-27  Saam Barati  <sbarati@apple.com>
3785
3786         Function constructor needs to follow the spec and validate parameters and body independently
3787         https://bugs.webkit.org/show_bug.cgi?id=173303
3788         <rdar://problem/32732526>
3789
3790         Reviewed by Keith Miller.
3791
3792         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
3793         * stress/function-constructor-semantics.js: Added.
3794         (assert):
3795         (hasSyntaxError):
3796         (foo):
3797         (async.foo):
3798         (testError):
3799         (testOK.toString):
3800         (toString):
3801
3802 2017-06-26  Saam Barati  <sbarati@apple.com>
3803
3804         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
3805         https://bugs.webkit.org/show_bug.cgi?id=173740
3806
3807         Reviewed by Mark Lam.
3808
3809         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
3810         (Array.prototype.Symbol.iterator):
3811
3812 2017-06-26  Saam Barati  <sbarati@apple.com>
3813
3814         Skip a test on 32-bit platforms since we run out of address space.
3815
3816         Rubber stamped by Mark Lam.
3817
3818         * stress/dont-reserve-huge-capacity-lexer.js:
3819
3820 2017-06-26  Saam Barati  <sbarati@apple.com>
3821
3822         Crash in JSC::Lexer<unsigned char>::setCode
3823         https://bugs.webkit.org/show_bug.cgi?id=172754
3824
3825         Reviewed by Mark Lam.
3826
3827         * stress/dont-reserve-huge-capacity-lexer.js: Added.
3828         (catch):
3829
3830 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3831
3832         [JSC] Clean up Object.entries implementation
3833         https://bugs.webkit.org/show_bug.cgi?id=173759
3834
3835         Reviewed by Sam Weinig.
3836
3837         * microbenchmarks/object-entries.js: Added.
3838         (test):
3839
3840 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
3841
3842         Remove Reflect.enumerate
3843         https://bugs.webkit.org/show_bug.cgi?id=173806
3844
3845         Reviewed by Yusuke Suzuki.
3846
3847         * ChakraCore.yaml:
3848         * es6.yaml:
3849         These tests now fail because they use Reflect.enumerate.
3850
3851         * test262.yaml:
3852         This test now passes, it checked that Reflect.enumerate is undefined!
3853
3854         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
3855         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
3856
3857         * stress/reflect-enumerate.js: Removed.
3858         Remove a test solely for Reflect.enumerate.
3859
3860 2017-06-22  Saam Barati  <sbarati@apple.com>
3861
3862         ValueRep(DoubleRep(@v)) can not simply convert to @v
3863         https://bugs.webkit.org/show_bug.cgi?id=173687
3864         <rdar://problem/32855563>
3865
3866         Reviewed by Mark Lam.
3867
3868         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
3869         (i.catch):
3870
3871 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
3872
3873         [JSC] Object.values should be implemented in C++
3874         https://bugs.webkit.org/show_bug.cgi?id=173703
3875
3876         Reviewed by Sam Weinig.
3877
3878         * microbenchmarks/object-keys-map-values.js: Added.
3879         (test):
3880         * microbenchmarks/object-values.js: Added.
3881         (test):
3882         * stress/object-values-changing-properties.js: Added.
3883         (shouldBe):
3884         (throw.new.Error.let.source.get x):
3885         (throw.new.Error):
3886         (shouldBe.let.handler.get order):
3887         (get let):
3888         (shouldBe.let.handler.get return):
3889         (let.handler.get order):
3890
3891 2017-06-21  Saam Barati  <sbarati@apple.com>
3892
3893         eval virtual call is incorrect in the baseline JIT
3894         https://bugs.webkit.org/show_bug.cgi?id=173587
3895         <rdar://problem/32867897>
3896
3897         Reviewed by Michael Saboff.
3898
3899         * stress/do-eval-virtual-call-correctly.js: Added.
3900         (assert):
3901         (f):
3902         (i.test):
3903         (catch):
3904
3905 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
3906
3907         Update test262 test expectations after r218581.
3908
3909         Unreviewed test gardening.
3910
3911         * test262.yaml:
3912
3913 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
3914
3915         Revert changes in bug#160417 about extending `null` not being a derived class
3916         https://bugs.webkit.org/show_bug.cgi?id=169293
3917
3918         Reviewed by Saam Barati.
3919
3920         * stress/class-derived-from-null.js:
3921         (assertThrow):
3922         (test1):
3923         (test2):
3924         (test3):
3925         (test4):
3926         (test5):
3927         (test6):
3928
3929 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3930
3931         [DFG] More ArrayIndexOf fixups for various types
3932         https://bugs.webkit.org/show_bug.cgi?id=173176
3933
3934         Reviewed by Saam Barati.
3935
3936         * stress/array-indexof-arraystorage.js: Added.
3937         (shouldBe):
3938         (indexOfInt32Other):
3939         (indexOfInt32Cell):
3940         (indexOfInt32Boolean):
3941         (indexOfDoubleOther):
3942         (indexOfDoubleCell):
3943         (indexOfDoubleBoolean):
3944         (indexOfInt32):
3945         (indexOfDouble):
3946         * stress/array-indexof-constant-folding.js: Added.
3947         (shouldBe):
3948         (indexOfInt32Other):
3949         (indexOfInt32Cell):
3950         (indexOfInt32Boolean):
3951         (indexOfDoubleOther):
3952         (indexOfDoubleCell):
3953         (indexOfDoubleBoolean):
3954         * stress/array-indexof-hole-and-other.js: Added.
3955         (shouldBe):
3956         (indexOf):
3957         * stress/array-indexof-other.js: Added.
3958         (shouldBe):
3959         (indexOfInt32):
3960         (indexOfDouble):
3961         (indexOfString):
3962         (indexOfObject):
3963         * stress/array-indexof-symbol.js: Added.
3964         (shouldBe):
3965         (indexOfInt32):
3966         (indexOfDouble):
3967         (indexOfString):
3968         (indexOfObject):
3969
3970 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
3971
3972         test262: Completion values for control flow do not match the spec
3973         https://bugs.webkit.org/show_bug.cgi?id=171265
3974
3975         Reviewed by Saam Barati.
3976
3977         * stress/completion-value.js:
3978         Condensed test for completion values in top level statements.
3979
3980         * stress/super-get-by-id.js:
3981         ClassDeclaration when evaled no longer produce values. Convert
3982         these to ClassExpressions so they produce the class value.
3983         
3984         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3985         This is a progression for currect spec behavior.
3986
3987         * mozilla/mozilla-tests.yaml:
3988         This test is now outdated, so mark it as failing for that reason.
3989
3990         * test262.yaml:
3991         Passing all "cptn" completion value tests.
3992
3993 2017-06-17  Keith Miller  <keith_miller@apple.com>
3994
3995         ArrayBuffer constructor needs to create subclass structures before its buffer
3996         https://bugs.webkit.org/show_bug.cgi?id=173510
3997
3998         Reviewed by Yusuke Suzuki.
3999
4000         * test262.yaml:
4001
4002 2017-06-17  Keith Miller  <keith_miller@apple.com>
4003
4004         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
4005         https://bugs.webkit.org/show_bug.cgi?id=173506
4006
4007         Reviewed by Ryosuke Niwa.
4008
4009         Re-baseline tests.
4010
4011         * ChakraCore/test/Function/apply3.baseline-jsc:
4012         * test262.yaml:
4013
4014 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
4015
4016         [JSC] Add fast path for Object.assign
4017         https://bugs.webkit.org/show_bug.cgi?id=173416
4018
4019         Reviewed by Mark Lam.
4020
4021         * stress/object-assign-changing-properties.js: Added.
4022         (shouldBe):
4023         (throw.new.Error.let.source.get x):
4024         (throw.new.Error):
4025         (shouldBe.let.source.get x):
4026         (shouldBe.let.target.set x):
4027         (shouldBe.let.target.get x):
4028         * stress/object-assign-proxy.js: Added.
4029         (shouldBe):
4030         (throw.new.Error.let.handler.get order):
4031
4032 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
4033
4034         [JSC] Implement Object.assign in C++
4035         https://bugs.webkit.org/show_bug.cgi?id=173414
4036
4037         Reviewed by Saam Barati.
4038
4039         * stress/object-assign-string-first.js: Added.
4040         (shouldBe):
4041         (source.get Symbol):
4042         (source.get 1):
4043         (source.get cocoa):
4044
4045 2017-06-14  JF Bastien  <jfbastien@apple.com>
4046
4047         WebAssembly: remove empty test files
4048         https://bugs.webkit.org/show_bug.cgi?id=173382
4049
4050         Reviewed by Saam Barati.
4051
4052         The following files:
4053                 JSTests/wasm/function-tests/call-indirect-params.js
4054                 JSTests/wasm/function-tests/call-indirect.js
4055                 JSTests/wasm/js-api/call-indirect-results.js
4056         Were changed to empty files in https://trac.webkit.org/changeset/209771
4057
4058         They were testing call_indirect with the wrong semantics, before
4059         we implemented tables. That change implemented tables and
4060         therefore removed the erroneous tests.
4061
4062         We have a few tests for call_indirect which already do the right thing:
4063                 JSTests/wasm/function-tests/context-switch.js
4064                 JSTests/wasm/function-tests/exceptions.js
4065                 JSTests/wasm/function-tests/grow-memory-2.js
4066                 JSTests/wasm/function-tests/stack-overflow.js
4067                 JSTests/wasm/function-tests/table-basic-2.js
4068                 JSTests/wasm/function-tests/table-basic.js
4069                 JSTests/wasm/js-api/call-indirect.js
4070                 JSTests/wasm/js-api/table.js
4071                 JSTests/wasm/js-api/unique-signature.js
4072                 JSTests/wasm/js-api/wrapper-function.js
4073
4074         I also just imported the updated spec tests which, among other
4075         things, test call_indirect:
4076                 core/br.wast
4077                 core/br_table.wast
4078                 core/call_indirect.wast
4079                 core/func.wast
4080                 core/func_ptrs.wast
4081                 core/imports.wast
4082                 core/left-to-right.wast
4083                 core/linking.wast
4084                 core/nop.wast
4085                 core/return.wast
4086                 core/typecheck.wast
4087                 core/unreachable.wast
4088
4089         So I think it's OK to just delete the tests which should just have
4090         been deleted back when tables were added.
4091
4092         * wasm/function-tests/call-indirect-params.js: Removed.
4093         * wasm/function-tests/call-indirect.js: Removed.
4094         * wasm/js-api/call-indirect-results.js: Removed.
4095
4096 2017-06-13  JF Bastien  <jfbastien@apple.com>
4097
4098         WebAssembly: import updated spec tests
4099         https://bugs.webkit.org/show_bug.cgi?id=173287
4100         <rdar://problem/32725975>
4101
4102         Reviewed by Saam Barati.
4103
4104         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
4105         with a few modifications so things work.
4106
4107         Fix a bunch of bugs found through this process, and punt a few tests (which I
4108         marked as blocked by this bug).
4109
4110         Fixes:
4111
4112         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
4113         instead of byte alignment. It was also missing memory-alignment.js despite it
4114         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
4115         pass.
4116
4117         Tables can be imported or in a section. There can be only one, but sections can
4118         be empty. An Elements section can exist if there's no Table, as long as it is
4119         also empty.
4120
4121         Memories can be imported or in a section. There can be only one, but sections
4122         can be empty. A Data section can exist if there's no Memory, as long as it is
4123         also empty.
4124
4125         Prototypes: stringify without .prototype. in the string.
4126
4127         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
4128         not a final size, and throws a RangeError on failure, not a TypeError.
4129
4130         Fix compile / instantiate so the reject the promise if given an argument of the
4131         wrong type (instead of failing instantly).
4132
4133         Fix async on neuter test.
4134
4135         Element section shouldn't affect any Table if any of the elements are out of
4136         bounds. We need to process it in two passes.
4137
4138         Segment section shouldn't affect any Data if any of the segments are out of
4139         bounds. We need to process it in two passes.
4140
4141         Empty data segments are valid, but only when there is no memory. Their index
4142         still gets validated, and has to be zero.
4143
4144         Punts:
4145
4146         Error messages with context, the test seems overly restrictive but this is
4147         minor.
4148
4149         compile/instantiate/validate property descriptors.
4150
4151         UTF-8 bugs.
4152
4153         Temporarily disable NaN tests. We need to go back and implement the following
4154         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
4155         much as getting all the other tests passing.
4156
4157         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
4158         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
4159         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
4160         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
4161         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
4162         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
4163         why they're not allowed.
4164
4165         * wasm.yaml:
4166         * wasm/function-tests/i32-load8-s.js:
4167         * wasm/function-tests/memory-access-past-4gib.js:
4168         (const.op.of.WASM.opcodes):
4169         * wasm/function-tests/memory-alignment.js: Added.
4170         (const.op.of.WASM.opcodes):
4171         * wasm/function-tests/memory-section-and-import.js:
4172         * wasm/js-api/Module-compile.js:
4173         (async.testPromiseAPI):
4174         * wasm/js-api/dont-mmap-zero-byte-memory.js:
4175         (testMems):
4176         * wasm/js-api/element.js:
4177         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
4178         * wasm/js-api/neutered-inputs.js:
4179         (const.testFunction): Deleted.
4180         (const.testConstructor): Deleted.
4181         * wasm/js-api/table.js:
4182         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
4183         (new.WebAssembly.Module):
4184         (assert.throws):
4185         (assertBadTableImport):
4186         (assert.throws.WebAssembly.Table.prototype.grow):
4187         (assertBadTableInstance): Deleted.
4188         * wasm/js-api/test_Data.js:
4189         (DataSectionWithoutMemory):
4190         * wasm/spec-harness/index.js:
4191         (module):
4192         (uniqueTest): Deleted.
4193         (assert_invalid): Deleted.
4194         (assert_soft_invalid): Deleted.
4195         (register): Deleted.
4196         (call): Deleted.
4197         (get instance): Deleted.
4198         (exports): Deleted.
4199         (run): Deleted.
4200         (assert_unlinkable): Deleted.
4201         (assert_uninstantiable): Deleted.
4202         (assert_trap): Deleted.
4203         (try.f): Deleted.
4204         (catch): Deleted.
4205         (assert_exhaustion): Deleted.
4206         (assert_return): Deleted.
4207         (assert_return_nan): Deleted.
4208         * wasm/spec-harness/testharness.css: Removed.
4209         * wasm/spec-harness/testharness.js: Removed.
4210         * wasm/spec-harness/testharnessreport.js: Removed.
4211         * wasm/spec-harness/wasm-constants.js:
4212         (assertTraps):
4213         (assertWasmThrows):
4214         * wasm/spec-harness/wasm-module-builder.js:
4215         (Binary.prototype.emit_section):
4216         (Binary):
4217         (WasmFunctionBuilder.prototype.addBody):
4218         (WasmFunctionBuilder.prototype.end):
4219         (WasmFunctionBuilder):
4220         (WasmModuleBuilder.prototype.stringToBytes):
4221         (WasmModuleBuilder.prototype.addCustomSection):
4222         (WasmModuleBuilder.prototype.addFunctionTableInit):
4223         (WasmModuleBuilder.prototype.appendToTable):
4224         (WasmModuleBuilder.prototype.toArray):
4225         (WasmModuleBuilder.prototype.toBuffer):
4226         (WasmModuleBuilder.prototype.instantiate):
4227         (WasmModuleBuilder):
4228         * wasm/spec-tests/address.wast.js:
4229         * wasm/spec-tests/align.wast.js: Added.
4230         * wasm/spec-tests/binary.wast.js:
4231         * wasm/spec-tests/block.wast.js:
4232         * wasm/spec-tests/br.wast.js:
4233         * wasm/spec-tests/br_if.wast.js:
4234         * wasm/spec-tests/br_table.wast.js:
4235         * wasm/spec-tests/call.wast.js:
4236         * wasm/spec-tests/call_indirect.wast.js:
4237         * wasm/spec-tests/comments.wast.js:
4238         * wasm/spec-tests/const.wast.js: Added.
4239         * wasm/spec-tests/conversions.wast.js: Added.
4240         * wasm/spec-tests/custom_section.wast.js:
4241         * wasm/spec-tests/exports.wast.js:
4242         * wasm/spec-tests/f32.wast.js: Added.
4243         * wasm/spec-tests/f64.wast.js: Added.
4244         * wasm/spec-tests/fac.wast.js:
4245         * wasm/spec-tests/float_exprs.wast.js: Added.
4246         * wasm/spec-tests/float_misc.wast.js: Added.
4247         * wasm/spec-tests/func.wast.js:
4248         * wasm/spec-tests/globals.wast.js:
4249         * wasm/spec-tests/if.wast.js:
4250         * wasm/spec-tests/imports.wast.js:
4251         * wasm/spec-tests/inline-module.wast.js: Added.
4252         * wasm/spec-tests/jsapi.js:
4253         (testJSAPI.test):
4254         (testJSAPI):
4255         * wasm/spec-tests/labels.wast.js:
4256         * wasm/spec-tests/loop.wast.js:
4257         * wasm/spec-tests/memory.wast.js:
4258         * wasm/spec-tests/memory_trap.wast.js: Added.
4259         * wasm/spec-tests/names.wast.js:
4260         * wasm/spec-tests/nop.wast.js:
4261         * wasm/spec-tests/return.wast.js:
4262         * wasm/spec-tests/stack.wast.js:
4263         * wasm/spec-tests/token.wast.js: Added.
4264         * wasm/spec-tests/type.wast.js: Added.
4265         * wasm/spec-tests/typecheck.wast.js:
4266         * wasm/spec-tests/unreachable.wast.js:
4267         * wasm/spec-tests/unreached-invalid.wast.js:
4268         * wasm/spec-tests/unwind.wast.js:
4269         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
4270         * wasm/spec-tests/utf8-import-field.wast.js: Added.
4271         * wasm/spec-tests/utf8-import-module.wast.js: Added.
4272
4273 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
4274
4275         Unreviewed JSC test gardening.
4276
4277         * stress/check-string-ident.js:
4278         * stress/new-largeish-contiguous-array-with-size.js:
4279
4280 2017-06-13  Michael Saboff  <msaboff@apple.com>
4281
4282         DFG doesn't properly handle a property that is change to read only in a prototype
4283         https://bugs.webkit.org/show_bug.cgi?id=173321
4284
4285         Reviewed by Filip Pizlo.
4286
4287         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
4288         * stress/regress-173321.js: Added new regression test.
4289         (shouldBe):
4290         (SimpleObject):
4291         (test):
4292
4293 2017-06-12  Saam Barati  <sbarati@apple.com>
4294
4295         Update test262 test expectation since r218082 makes new tests pass.
4296
4297         * test262.yaml:
4298
4299 2017-06-12  Saam Barati  <sbarati@apple.com>
4300
4301         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
4302         https://bugs.webkit.org/show_bug.cgi?id=172957
4303         <rdar://problem/32602704>
4304
4305         Reviewed by Filip Pizlo.
4306
4307         * stress/spec-empty-flows-through-cell-checks.js: Added.
4308         (A):
4309         (B):
4310         (i.catch):
4311
4312 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
4313
4314         We incorrectly allow escaped characters in keyword tokens
4315         https://bugs.webkit.org/show_bug.cgi?id=171310
4316
4317         Reviewed by Yusuke Suzuki.
4318
4319         * stress/destructuring-assignment-syntax.js:
4320         * stress/error-messages-for-in-operator-should-not-crash.js:
4321         (catch):
4322         * stress/reserved-word-with-escape.js:
4323         (testSyntaxError.String.raw.v):
4324         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
4325         (testSyntaxError.String.raw.a):
4326         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
4327
4328 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
4329
4330         [DFG] Add ArrayIndexOf intrinsic
4331         https://bugs.webkit.org/show_bug.cgi?id=172421
4332
4333         Reviewed by Saam Barati.
4334
4335         * stress/array-indexof-array-prototype-change.js: Added.
4336         (shouldBe):
4337         (indexOfInt32):
4338         * stress/array-indexof-have-a-bad-time-getter.js: Added.
4339         (shouldBe):
4340         (indexOfInt32):
4341         * stress/array-indexof-have-a-bad-time.js: Added.
4342         (shouldBe):
4343         (indexOfInt32):
4344         * stress/array-indexof-hole-with-prototype.js: Added.
4345         (shouldBe):
4346         (indexOf):
4347         * stress/array-indexof-hole.js: Added.
4348         (shouldBe):
4349         (indexOf):
4350         * stress/array-indexof-index.js: Added.
4351         (shouldBe):
4352         (indexOfInt32):
4353         (indexOfDouble):
4354         (indexOfString):
4355         (indexOfObject):
4356         (indexOfValue):
4357         * stress/array-indexof-negative-index.js: Added.
4358         (shouldBe):
4359         (indexOfInt32):
4360         (indexOfDouble):
4361         (indexOfString):
4362         (indexOfObject):
4363         (indexOfValue):
4364         * stress/array-indexof-non-int32-start-index.js: Added.
4365         (shouldBe):
4366         (indexOf):
4367         (object.valueOf):
4368         * stress/array-indexof-object-prototype-change.js: Added.
4369         (shouldBe):
4370         (indexOfInt32):
4371         * stress/array-indexof-object.js: Added.
4372         (shouldBe):
4373         (indexOf):
4374         * stress/array-indexof-original-array.js: Added.
4375         (shouldBe):
4376         (indexOfInt32):
4377         * stress/array-indexof-string.js: Added.
4378         (shouldBe):
4379         (indexOf):
4380         * stress/array-indexof-structure-change-convert.js: Added.
4381         (shouldBe):
4382         (indexOf):
4383         * stress/array-indexof-structure-change.js: Added.
4384         (shouldBe):
4385         (indexOf):
4386         * stress/array-indexof.js: Added.
4387         (shouldBe):
4388         (indexOf):
4389
4390 2017-06-11  Keith Miller  <keith_miller@apple.com>
4391
4392         TypedArray constructor with string shouldn't throw
4393         https://bugs.webkit.org/show_bug.cgi?id=173181
4394
4395         Reviewed by JF Bastien.
4396
4397         We should be coercing primitive arguments to numbers in the various
4398         TypedArray constructors.
4399
4400         * stress/typedarray-constructor.js:
4401
4402 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
4403
4404         Unreviewed, update test results part 3
4405         https://bugs.webkit.org/show_bug.cgi?id=173227
4406
4407         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
4408
4409 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
4410
4411         Unreviewed, update test results part 2
4412         https://bugs.webkit.org/show_bug.cgi?id=173227
4413
4414         * test262.yaml:
4415
4416 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
4417
4418         Unreviewed, update test results
4419         https://bugs.webkit.org/show_bug.cgi?id=173227
4420
4421         * microbenchmarks/string-prototype-search-observable-side-effects.js:
4422         * test262.yaml:
4423
4424 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
4425
4426         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
4427        &nb