2f8d3b33855ee64f131d8d77d6ba3f3472f21eb6
[WebKit.git] / JSTests / ChangeLog
1 2020-06-24  Alexey Shvayka  <shvaikalesh@gmail.com>
2
3         Add DFG/FTL fast path for GetPrototypeOf based on OverridesGetPrototype flag
4         https://bugs.webkit.org/show_bug.cgi?id=213191
5
6         Reviewed by Yusuke Suzuki.
7
8         * microbenchmarks/object-get-prototype-of-object-rare.js: Added.
9         * stress/dfg-object-prototype-of.js: Removed.
10         * stress/dfg-reflect-get-prototype-of.js: Removed.
11         * stress/ftl-object-get-prototype-of.js: Added.
12         * stress/ftl-reflect-get-prototype-of.js: Added.
13
14 2020-06-24  Yusuke Suzuki  <ysuzuki@apple.com>
15
16         [JSC] Clobberize misses `write(Heap)` report in some nodes
17         https://bugs.webkit.org/show_bug.cgi?id=213525
18         <rdar://problem/64642067>
19
20         Reviewed by Mark Lam.
21
22         * stress/missing-clobber-top-validation.js: Added.
23
24 2020-06-23  Mark Lam  <mark.lam@apple.com>
25
26         Handle string overflow in DFG graph dump while validating AI.
27         https://bugs.webkit.org/show_bug.cgi?id=213524
28         <rdar://problem/64635620>
29
30         Reviewed by Saam Barati.
31
32         * stress/string-overflow-in-dfg-graph-dump.js: Added.
33
34 2020-06-21  Michael Catanzaro  <mcatanzaro@gnome.org>
35
36         Attempt to unskip stress test array-buffer-view-watchpoint-can-be-fired-really-add-in-dfg.js on most architectures
37         https://bugs.webkit.org/show_bug.cgi?id=213433
38
39         Reviewed by Darin Adler.
40
41         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
42
43 2020-06-19  Yusuke Suzuki  <ysuzuki@apple.com>
44
45         [JSC] Check Gigacage usage before launching VM
46         https://bugs.webkit.org/show_bug.cgi?id=213410
47
48         Reviewed by Mark Lam.
49
50         * stress/exhaust-gigacage-and-allocate-vm.js: Added.
51         (foo):
52
53 2020-06-19  Yusuke Suzuki  <ysuzuki@apple.com>
54
55         [JSC] Attempt to reduce timeout failures on Apple Watch Series 3
56         https://bugs.webkit.org/show_bug.cgi?id=213419
57
58         Reviewed by Mark Lam.
59
60         Look into timeout tests, and
61
62         1. If the test is using too many iterations, decrease the count.
63         2. If the test is still useful while iteration count is not so much, try attaching `slow!` to see the effect on the bot.
64
65         * stress/memcpy-typed-loops.js:
66         * stress/op_bitand.js:
67         * stress/op_bitor.js:
68         * stress/op_bitxor.js:
69         * stress/op_mul-ConstVar.js:
70         * stress/op_mul-VarConst.js:
71         * stress/op_mul-VarVar.js:
72         * stress/op_sub-ConstVar.js:
73         * stress/op_sub-VarConst.js:
74         * stress/op_sub-VarVar.js:
75         * stress/set-iteration-oas.js:
76         * stress/value-to-boolean.js:
77
78 2020-06-19  Mark Lam  <mark.lam@apple.com>
79
80         Make $vm properties non-configurable, non-enumerable, and non-writable.
81         https://bugs.webkit.org/show_bug.cgi?id=213395
82
83         Reviewed by Saam Barati and Yusuke Suzuki.
84
85         * stress/dollarVM-properties-should-not-be-enumerable.js: Added.
86
87 2020-06-18  Saam Barati  <sbarati@apple.com>
88
89         sampling-profiler-wasm-name-section should run for more iterations
90         https://bugs.webkit.org/show_bug.cgi?id=207576
91         <rdar://problem/59431250>
92
93         Reviewed by Mark Lam.
94
95         This test was flaky because the sampling profiler is inherently probabilistic.
96         We need to run it for more iterations to ensure it's not flaky.
97
98         * stress/sampling-profiler-wasm-name-section.js:
99
100 2020-06-18  Ross Kirsling  <ross.kirsling@sony.com>
101
102         [Intl] Enable RelativeTimeFormat and Locale by default
103         https://bugs.webkit.org/show_bug.cgi?id=213324
104
105         Reviewed by Yusuke Suzuki.
106
107         * stress/intl-locale-as-intl-param.js:
108         * stress/intl-locale.js:
109         * stress/intl-relativetimeformat.js:
110         * test262/config.yaml:
111         Remove feature flags.
112
113 2020-06-18  Alexey Shvayka  <shvaikalesh@gmail.com>
114
115         Promise built-in functions should be anonymous non-constructors
116         https://bugs.webkit.org/show_bug.cgi?id=213317
117
118         Reviewed by Darin Adler.
119
120         * test262/expectations.yaml: Mark 20 test cases as passing.
121
122 2020-06-18  Alexey Shvayka  <shvaikalesh@gmail.com>
123
124         TypedArray.prototype.set is incorrect with primitives
125         https://bugs.webkit.org/show_bug.cgi?id=212730
126
127         Reviewed by Yusuke Suzuki.
128
129         * test262/expectations.yaml: Mark 2 test cases as passing.
130
131 2020-06-17  Saam Barati  <sbarati@apple.com>
132
133         Skip JSTests/stress/check-is-constant-non-cell-should-not-array-profile-during-osr-exit.js on memory limited devices
134         https://bugs.webkit.org/show_bug.cgi?id=213321
135
136         Reviewed by Mark Lam.
137
138         It uses ~1GB of memory and jetsams on iOS devices.
139
140         * stress/check-is-constant-non-cell-should-not-array-profile-during-osr-exit.js:
141
142 2020-06-17  Yusuke Suzuki  <ysuzuki@apple.com>
143
144         [JSC] Freeze JSBigInt when setting it as a constant in AI
145         https://bugs.webkit.org/show_bug.cgi?id=213310
146         <rdar://problem/64450410>
147
148         Reviewed by Mark Lam.
149
150         * stress/bigint-constant-fold-to-numeric.js: Added.
151         (foo):
152
153 2020-06-17  Alexey Shvayka  <shvaikalesh@gmail.com>
154
155         Update test262 to commit 8d3dd2d1a0a5
156         https://bugs.webkit.org/show_bug.cgi?id=213312
157
158         Reviewed by Yusuke Suzuki.
159
160         * test262/expectations.yaml:
161         * test262/latest-changes-summary.txt:
162         * test262/test/*: Updated.
163         * test262/test262-Revision.txt:
164
165 2020-06-17  Keith Miller  <keith_miller@apple.com>
166
167         $vm.haveABadTime/isHavingABadTime should work with non-globalObject parameters
168         https://bugs.webkit.org/show_bug.cgi?id=213304
169
170         Reviewed by Mark Lam.
171
172         * stress/dollarVM-have-a-bad-time-no-params.js: Added.
173         * stress/dollarVM-have-a-bad-time-works-for-non-global-object-params.js: Added.
174
175 2020-06-16  Yusuke Suzuki  <ysuzuki@apple.com>
176
177         [JSC] Check NullSetterFunction under strict-mode context since structure / PropertyCondition are unaware of this
178         https://bugs.webkit.org/show_bug.cgi?id=213266
179
180         Reviewed by Mark Lam.
181
182         * stress/null-setter-frame.js: Added.
183         (shouldBe):
184         (realm.runString.test):
185         (object.get value):
186         (i.catch):
187         * stress/setter-throw-in-strict.js: Added.
188         (foo):
189
190 2020-06-16  Mark Lam  <mark.lam@apple.com>
191
192         Add SIGABRT handler for non OS(DARWIN) builds to the jsc shell with the -s option.
193         https://bugs.webkit.org/show_bug.cgi?id=213200
194
195         Reviewed by Michael Catanzaro.
196
197         * stress/ensure-crash.js:
198         - unskip this test since expected crashes should now be handled on non-darwin builds.
199
200 2020-06-15  Tadeu Zagallo  <tzagallo@apple.com>
201
202         Bytecode liveness should be aware of checkpoints
203         https://bugs.webkit.org/show_bug.cgi?id=213106
204         <rdar://problem/63416838>
205
206         Reviewed by Keith Miller.
207
208         * stress/iterator-open-checkpoint-liveness.js: Added.
209         (f):
210         (next):
211         (iterator):
212         (catch):
213
214 2020-06-15  Alexey Shvayka  <shvaikalesh@gmail.com>
215
216         Expand JSObject::defineOwnIndexedProperty() fast path for existing properties
217         https://bugs.webkit.org/show_bug.cgi?id=213133
218
219         Reviewed by Yusuke Suzuki.
220
221         * microbenchmarks/array-redefine-index-and-reverse.js: Added.
222         * microbenchmarks/array-redefine-index.js: Added.
223         * stress/define-own-indexed-property-fast-path.js: Added.
224
225 2020-06-15  Caio Lima  <ticaiolima@gmail.com>
226
227         [ARMv7][MIPS][JSC] Skip check-is-constant-non-cell-should-not-array-profile-during-osr-exit.js
228         https://bugs.webkit.org/show_bug.cgi?id=213208
229
230         Unreviewed Gardening.
231
232         * stress/check-is-constant-non-cell-should-not-array-profile-during-osr-exit.js:
233
234 2020-06-15  Keith Miller  <keith_miller@apple.com>
235
236         CheckIsConstant should not use BadCache exit kind
237         https://bugs.webkit.org/show_bug.cgi?id=213141
238
239         Reviewed by Yusuke Suzuki.
240
241         * stress/check-is-constant-non-cell-should-not-array-profile-during-osr-exit.js: Added.
242         (foo.bar):
243
244 2020-06-15  Keith Miller  <keith_miller@apple.com>
245
246         JIT thunks should work on arm64_32
247         https://bugs.webkit.org/show_bug.cgi?id=213103
248
249         Reviewed by Saam Barati.
250
251         skip test on memory limited since it breaks on watch with JIT.
252
253         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
254
255 2020-06-15  Caitlin Potter  <caitp@igalia.com>
256
257         [JSC] add machinery to disable JIT tiers when experimental features are enabled
258         https://bugs.webkit.org/show_bug.cgi?id=213193
259
260         Reviewed by Mark Lam.
261
262         * stress/get-private-name.js:
263         * stress/put-by-val-direct-addprivate.js:
264         * stress/put-by-val-direct-putprivate.js:
265
266 2020-06-15  Alexey Shvayka  <shvaikalesh@gmail.com>
267
268         super should not depend on __proto__
269         https://bugs.webkit.org/show_bug.cgi?id=157972
270
271         Reviewed by Saam Barati.
272
273         * microbenchmarks/object-get-prototype-of-primitive.js: Added.
274         * stress/class-syntax-derived-default-constructor.js:
275         * stress/get-prototype-of.js: Added.
276         * stress/super-property-access.js:
277         * test262/expectations.yaml: Mark 4 test cases as passing.
278
279 2020-06-14  Yusuke Suzuki  <ysuzuki@apple.com>
280
281         Add wasm regresion test for loop
282         https://bugs.webkit.org/show_bug.cgi?id=213176
283
284         Reviewed by Darin Adler.
285
286         This patch adds one more regression test for r246134.
287
288         * wasm/regress/regression-with-loop.js: Added.
289
290 2020-06-13  Devin Rousso  <drousso@apple.com>
291
292         Make `errors` an own property of `AggregateError` instead of a prototype accessor
293         https://bugs.webkit.org/show_bug.cgi?id=212677
294
295         Reviewed by Yusuke Suzuki.
296
297         * stress/AggregateError-own-property-errors.js: Added.
298
299         * test262/expectations.yaml:
300         Mark 9 tests as failing while waiting for test262 to update to match the spec.
301
302 2020-06-12  Robin Morisset  <rmorisset@apple.com>
303
304         The ||= operator (and similar ones) should produce valid bytecode even if the right side is a static error
305         https://bugs.webkit.org/show_bug.cgi?id=213154
306
307         Reviewed by Devin Rousso.
308
309         * stress/bytecode-for-rmw-with-invalid-right-side.js: Added.
310         (catch):
311
312 2020-06-12  Yusuke Suzuki  <ysuzuki@apple.com>
313
314         [JSC] el(Greek) characters' upper-case conversion is locale-sensitive
315         https://bugs.webkit.org/show_bug.cgi?id=213155
316         <rdar://problem/55018467>
317
318         Reviewed by Darin Adler.
319
320         * stress/intl-el-case.js: Added.
321         (shouldBe):
322
323 2020-06-12  Keith Miller  <keith_miller@apple.com>
324
325         Tests expecting a crash should use a signal handler in the JSC CLI process
326         https://bugs.webkit.org/show_bug.cgi?id=212479
327
328         Reviewed by Yusuke Suzuki.
329
330         * stress/ensure-crash.js:
331         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-bad-transition-debug.js:
332         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-bad-transition.js:
333         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-debug.js: Removed.
334         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js:
335         * stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten-debug.js:
336
337 2020-06-12  Alexey Shvayka  <shvaikalesh@gmail.com>
338
339         AsyncGenerator should await "return" completions
340         https://bugs.webkit.org/show_bug.cgi?id=212774
341
342         Reviewed by Ross Kirsling.
343
344         With this change, async generator stress tests now pass in Chrome and Firefox (tested manually).
345
346         * stress/async-iteration-yield-star-interface.js:
347         * stress/async-iteration-yield-star.js:
348         * test262/expectations.yaml: Mark 8 test cases as passing.
349
350 2020-06-12  Yusuke Suzuki  <ysuzuki@apple.com>
351
352         [JSC] Add sampling-profiler code-origin lookup test
353         https://bugs.webkit.org/show_bug.cgi?id=213108
354         <rdar://problem/52044072>
355
356         Reviewed by Saam Barati.
357
358         This is fixed by r262920. This patch just adds a test additionally.
359         We are keeping CallSiteIndex valid until corresponding JIT stub is destroyed.
360         This fixes SamplingProfiler too since SamplingProfiler also collects CallSiteIndex and gets corresponding CodeOrigin.
361         Since SamplingProfiler does this CallSiteIndex => CodeOrigin before running GC finalizer, validity of CallSiteIndex
362         should be kept correctly.
363
364         * stress/sampling-profiler-code-origin.js: Added.
365         (let.oThrow.get f):
366         (foo):
367         (return.get f):
368         (f):
369
370 2020-06-11  Yusuke Suzuki  <ysuzuki@apple.com>
371
372         [JSC] Return DisposableCallSiteIndex when destroying GCAwareJITStubRoutineWithExceptionHandler
373         https://bugs.webkit.org/show_bug.cgi?id=213069
374         <rdar://problem/64205186>
375
376         Reviewed by Saam Barati.
377
378         * stress/dont-dispose-callsiteindex-while-executing.js: Added.
379         (emptyFunction):
380         (foo.bar.set catch):
381         (foo.bar):
382         (foo):
383
384 2020-06-11  Alexey Shvayka  <shvaikalesh@gmail.com>
385
386         RegExp.prototype getters should throw on cross-realm access
387         https://bugs.webkit.org/show_bug.cgi?id=213075
388
389         Reviewed by Saam Barati.
390
391         * test262/expectations.yaml: Mark 14 test cases as passing.
392
393 2020-06-10  Ross Kirsling  <ross.kirsling@sony.com>
394
395         REGRESSION(r260697): [Intl] "missing script" locales like zh-TW are no longer mapped
396         https://bugs.webkit.org/show_bug.cgi?id=213007
397
398         Reviewed by Darin Adler.
399
400         * stress/intl-missing-script-locales.js: Added.
401
402 2020-06-10  Caitlin Potter  <caitp@igalia.com>
403
404         [JSC] add stress test for op_get_private_name
405         https://bugs.webkit.org/show_bug.cgi?id=213024
406
407         Reviewed by Mark Lam.
408
409         * stress/get-private-name.js: Added.
410
411 2020-06-09  Mark Lam  <mark.lam@apple.com>
412
413         Stringifier::appendStringifiedValue() should not assume it is always safe to recurse.
414         https://bugs.webkit.org/show_bug.cgi?id=213006
415         <rdar://problem/64154840>
416
417         Reviewed by Keith Miller.
418
419         * stress/json-stringify-executing-in-reserved-zone.js: Added.
420
421 2020-06-09  Mark Lam  <mark.lam@apple.com>
422
423         Disambiguate the OverridesGetPropertyNames structure flag
424         https://bugs.webkit.org/show_bug.cgi?id=212909
425         <rdar://problem/63823557>
426
427         Reviewed by Saam Barati.
428
429         * stress/unexpected-stack-overflow-below-JSObject-getPropertyNames.js: Added.
430
431 2020-06-08  Ross Kirsling  <ross.kirsling@sony.com>
432
433         [Intl] Update tests to support ICU 67
434         https://bugs.webkit.org/show_bug.cgi?id=212943
435
436         Reviewed by Yusuke Suzuki.
437
438         Our tests have been assuming ICU 60-64 results but WinCairo and PlayStation are now on ICU 67,
439         which includes fixes for variant alphabetization and non-explicit "-true" values in locale strings.
440
441         * stress/intl-collator.js:
442         (explicitTrueBeforeICU67):
443         (shouldBe.testCollator.Intl.Collator):
444         * stress/intl-datetimeformat.js:
445         * stress/intl-locale.js:
446         * stress/intl-numberformat.js:
447         * stress/intl-object.js:
448         * stress/intl-pluralrules.js:
449         * stress/intl-relativetimeformat.js:
450
451 2020-06-08  Keith Miller  <keith_miller@apple.com>
452
453         Fix tests that time out on Series 4 Watch
454         https://bugs.webkit.org/show_bug.cgi?id=212911
455
456         Reviewed by Saam Barati.
457
458         Simplify some logic about when to skip microbenchmarks to $jitTests.
459         Also reduce iteration count for
460         dont-range-based-iterate-vector-that-is-mutated.js
461
462         Also, mark wasm tests as not run on watch.
463
464         * microbenchmarks/bit-test-constant.js:
465         * microbenchmarks/bit-test-nonconstant.js:
466         * microbenchmarks/interpreter-wasm.js:
467         * microbenchmarks/memcpy-typed-loop-large.js:
468         * microbenchmarks/memcpy-typed-loop-small.js:
469         * microbenchmarks/mul-immediate-sub.js:
470         * stress/dont-range-based-iterate-vector-that-is-mutated.js:
471         * stress/sampling-profiler-richards.js:
472
473 2020-06-08  Alexey Shvayka  <shvaikalesh@gmail.com>
474
475         JSON.stringify should throw stack overflow error
476         https://bugs.webkit.org/show_bug.cgi?id=143511
477
478         Reviewed by Ross Kirsling and Mark Lam.
479
480         * stress/json-stringify-stack-overflow.js: Added.
481         * stress/json-stringify-string-builder-overflow.js:
482
483 2020-06-05  Saam Barati  <sbarati@apple.com>
484
485         Audit safe to execute
486         https://bugs.webkit.org/show_bug.cgi?id=207075
487         <rdar://problem/59085094>
488
489         Reviewed by Yusuke Suzuki.
490
491         * microbenchmarks/licm-dom-jit.js: Added.
492         (assert):
493         (foo):
494         (bar):
495
496 2020-06-05  Saam Barati  <sbarati@apple.com>
497
498         Try to reduce jetsams further on iOS devices running jsc stress tests
499         https://bugs.webkit.org/show_bug.cgi?id=212786
500
501         Reviewed by Mark Lam.
502
503         * wasm/references/multitable.js:
504         (string_appeared_here.vm.isMemoryLimited.tableInsanity):
505         (string_appeared_here.vm.isMemoryLimited.):
506         (string_appeared_here.vm.isMemoryLimited):
507         (string_appeared_here.tableInsanity): Deleted.
508         (I32Const.0.GetLocal.0.TableSet.1.End.End.WebAssembly.): Deleted.
509         (I32Const.0.GetLocal.0.TableSet.1.End.End.WebAssembly): Deleted.
510
511 2020-06-05  Devin Rousso  <drousso@apple.com>
512
513         Logical Assignment: perform NamedEvaluation of anonymous functions
514         https://bugs.webkit.org/show_bug.cgi?id=212679
515
516         Reviewed by Ross Kirsling.
517
518         * stress/logical-assignment-operator-and.js:
519         * stress/logical-assignment-operator-coalesce.js:
520         * stress/logical-assignment-operator-or.js:
521
522 2020-06-05  Caitlin Potter  <caitp@igalia.com>
523
524         [JSC] Add support for private class fields
525         https://bugs.webkit.org/show_bug.cgi?id=206431
526
527         Reviewed by Saam Barati.
528
529         Expands upon the earlier public fields patch, adding a number of private
530         field tests.
531
532         * stress/class-fields-private-as-function.js: Added.
533         * stress/class-fields-private-cached-bytecode.js: Added.
534         * stress/class-fields-private-freeze-out-of-line.js: Added.
535         * stress/class-fields-private-freeze.js: Added.
536         * stress/class-fields-private-on-proxy.js: Added.
537         * stress/class-fields-private-out-of-line.js: Added.
538         * stress/class-fields-private-prevent-extensions-out-of-line.js: Added.
539         * stress/class-fields-private-prevent-extensions.js: Added.
540         * stress/class-fields-private-seal-out-of-line.js: Added.
541         * stress/class-fields-private-seal.js: Added.
542         * stress/class-fields-private-use-eval.js: Added.
543         * stress/class-fields-stress-instance.js:
544         * stress/optional-chaining-and-private-fields.js: Added.
545         * stress/private-name-access-in-computed-property.js: Added.
546         * stress/put-by-val-direct-addprivate.js: Added.
547         * stress/put-by-val-direct-putprivate.js: Added.
548         * test262/config.yaml:
549
550 2020-06-04  Paulo Matos  <pmatos@igalia.com>
551
552         Skip microbenchmarks/interpreter-wasm.js on MIPS/ARM
553
554         Unreviewed Gardening.
555
556         There's no native wasm support on 32bits atm - skipping.
557
558         * microbenchmarks/interpreter-wasm.js:
559
560 2020-06-04  Ross Kirsling  <ross.kirsling@sony.com>
561
562         Intl classes should have meaningful @@toStringTag values
563         https://bugs.webkit.org/show_bug.cgi?id=212769
564
565         Reviewed by Yusuke Suzuki.
566
567         * test262/expectations.yaml:
568         Mark 16 test cases as passing.
569
570         * stress/intl-collator.js:
571         * stress/intl-datetimeformat.js:
572         * stress/intl-numberformat.js:
573         * stress/intl-pluralrules.js:
574         Update stress tests.
575
576 2020-06-04  Alexey Shvayka  <shvaikalesh@gmail.com>
577
578         GetMethod isn't performed properly on iterators
579         https://bugs.webkit.org/show_bug.cgi?id=212771
580
581         Reviewed by Saam Barati.
582
583         * test262/expectations.yaml: Mark 26 test cases as passing.
584
585 2020-06-04  Alexey Shvayka  <shvaikalesh@gmail.com>
586
587         Update test262 to commit 290ceba31fea
588         https://bugs.webkit.org/show_bug.cgi?id=212752
589
590         Reviewed by Ross Kirsling.
591
592         * test262/config.yaml: Unskip tests fixed in r260990.
593         * test262/expectations.yaml:
594         * test262/latest-changes-summary.txt:
595         * test262/test/*: Updated.
596         * test262/test262-Revision.txt:
597
598 2020-06-03  Tadeu Zagallo  <tzagallo@apple.com>
599
600         Disable B3 hoistLoopInvariantValues by default
601         https://bugs.webkit.org/show_bug.cgi?id=212511
602         <rdar://problem/63813245>
603
604         Reviewed by Mark Lam.
605
606         * microbenchmarks/interpreter-wasm.js: Added.
607         (key.in.Module.Module.hasOwnProperty):
608         (quit_):
609         (locateFile):
610         (ENVIRONMENT_IS_NODE.read_):
611         (ENVIRONMENT_IS_NODE.readBinary):
612         (ENVIRONMENT_IS_NODE.quit_):
613         (ENVIRONMENT_IS_NODE.Module.string_appeared_here):
614         (else.read_):
615         (else.readBinary):
616         (else.quit_):
617         (else):
618         (else.xhr.onload):
619         (else.readAsync):
620         (else.setWindowTitle):
621         (key.in.moduleOverrides.moduleOverrides.hasOwnProperty):
622         (dynamicAlloc):
623         (getNativeTypeSize):
624         (warnOnce):
625         (convertJsFunctionToWasm):
626         (addFunctionWasm):
627         (removeFunctionWasm):
628         (setTempRet0):
629         (setValue):
630         (assert):
631         (getCFunc):
632         (toC.string_appeared_here):
633         (convertReturnValue):
634         (ccall):
635         (UTF8ArrayToString):
636         (UTF8ToString):
637         (stringToUTF8Array):
638         (stringToUTF8):
639         (lengthBytesUTF8):
640         (allocateUTF8OnStack):
641         (writeArrayToMemory):
642         (writeAsciiToMemory):
643         (updateGlobalBufferAndViews):
644         (callRuntimeCallbacks):
645         (preRun):
646         (initRuntime):
647         (preMain):
648         (exitRuntime):
649         (postRun):
650         (addOnPreRun):
651         (addOnPostRun):
652         (addRunDependency):
653         (removeRunDependency):
654         (hasPrefix):
655         (isDataURI):
656         (isFileURI):
657         (getBinary):
658         (getBinaryPromise):
659         (createWasm.receiveInstance):
660         (createWasm.receiveInstantiatedSource):
661         (createWasm.instantiateArrayBuffer):
662         (createWasm.instantiateAsync.):
663         (createWasm.instantiateAsync):
664         (createWasm):
665         (__ATINIT__.push.func):
666         (demangle):
667         (demangleAll):
668         (_emscripten_get_sbrk_ptr):
669         (_emscripten_memcpy_big):
670         (abortOnCannotGrowMemory):
671         (_emscripten_resize_heap):
672         (PATH.splitPath):
673         (PATH.normalizeArray):
674         (PATH.normalize):
675         (PATH.dirname):
676         (PATH.basename):
677         (PATH.extname):
678         (PATH.join):
679         (PATH.join2):
680         (SYSCALLS.printChar):
681         (SYSCALLS.getStr):
682         (SYSCALLS.get64):
683         (_fd_write):
684         (_setTempRet0):
685         (___wasm_call_ctors.Module.string_appeared_here):
686         (_main.Module.string_appeared_here):
687         (_malloc.Module.string_appeared_here):
688         (___errno_location.Module.string_appeared_here):
689         (_free.Module.string_appeared_here):
690         (stackSave.Module.string_appeared_here):
691         (stackAlloc.Module.string_appeared_here):
692         (stackRestore.Module.string_appeared_here):
693         (__growWasmMemory.Module.string_appeared_here):
694         (dynCall_ii.Module.string_appeared_here):
695         (dynCall_iiii.Module.string_appeared_here):
696         (dynCall_jiji.Module.string_appeared_here):
697         (ExitStatus):
698         (dependenciesFulfilled):
699         (callMain):
700         (run.doRun):
701         (run):
702         (exit):
703         * microbenchmarks/interpreter-wasm.wasm: Added.
704
705 2020-06-02  Saam Barati  <sbarati@apple.com>
706
707         MultiDeleteByOffset should not always def
708         https://bugs.webkit.org/show_bug.cgi?id=212621
709         <rdar://problem/63824182>
710
711         Reviewed by Yusuke Suzuki.
712
713         * stress/multi-del-by-offset-doesnt-always-def-osr-entry.js: Added.
714         (foo):
715         * stress/multi-del-by-offset-doesnt-always-def.js: Added.
716         (foo):
717         (let.p.set undefined):
718
719 2020-06-01  Yusuke Suzuki  <ysuzuki@apple.com>
720
721         [JSC] JSBigInt::rightTrim can miss |this| pointer and leads to incorrect GC collection
722         https://bugs.webkit.org/show_bug.cgi?id=212601
723
724         Reviewed by Saam Barati.
725
726         * stress/bigint-should-not-be-collected-while-creating.js: Added.
727         (foo.let.increment.10000n.bar):
728         (foo):
729
730 2020-06-01  Yusuke Suzuki  <ysuzuki@apple.com>
731
732         [JSC] JSValue::toThis should not throw exception
733         https://bugs.webkit.org/show_bug.cgi?id=212595
734
735         Reviewed by Mark Lam.
736
737         * stress/number-proto.js: Added.
738         (shouldBe):
739
740 2020-06-01  Caio Lima  <ticaiolima@gmail.com>
741
742         JSTests/exceptionFuzz/earley-boyer.js fails with early exception thrown.
743         https://bugs.webkit.org/show_bug.cgi?id=212569
744
745         Reviewed by Mark Lam.
746
747         This is a temporary fix to avoid flawky results when running
748         `exceptionFuzz` tests. Right now, exception handler starts after
749         function declarations, since they are hoisted. Since function
750         declarations emit `new_func` bytecode, those bytecodes can
751         throw an exception outside expected exception handler.
752         Embedding them in a function avoid such hoisting to happen.
753
754         * exceptionFuzz/3d-cube.js:
755         * exceptionFuzz/date-format-xparb.js:
756         * exceptionFuzz/earley-boyer.js:
757
758 2020-05-30  Yusuke Suzuki  <ysuzuki@apple.com>
759
760         [JSC] for-in should allocate new temporary register for base
761         https://bugs.webkit.org/show_bug.cgi?id=212519
762         <rdar://problem/63722044>
763
764         Reviewed by Saam Barati.
765
766         * microbenchmarks/has-own-property-for-in-loop-with-heap-variable.js: Added.
767         (assert):
768         (test1.count):
769         (test1):
770         * microbenchmarks/has-own-property-for-in-loop-with-this.js: Added.
771         (assert):
772         (test1.count):
773         (test1):
774         * stress/for-in-body-replace-enumerable.js: Added.
775         (foo):
776         * stress/for-in-enumerable-shadow.js: Added.
777         (assert):
778         (test1.count):
779         (test1):
780         * stress/for-in-enumerable-this-arrow.js: Added.
781         (assert):
782         (test1):
783
784 2020-05-29  Yusuke Suzuki  <ysuzuki@apple.com>
785
786         [JSC] JSBigInt allocation should be graceful for OOM
787         https://bugs.webkit.org/show_bug.cgi?id=212512
788
789         Reviewed by Mark Lam.
790
791         * stress/bigint-can-throw-oom.js: Copied from JSTests/stress/get-function-realm-not-doing-recursion.js.
792         (canThrow):
793         (foo):
794         (get foo):
795         * stress/get-function-realm-not-doing-recursion.js:
796         (canThrow):
797
798 2020-05-29  Yusuke Suzuki  <ysuzuki@apple.com>
799
800         [JSC] Split some of JSC tests / reduce iteration count to make it not timed-out in Debug build
801         https://bugs.webkit.org/show_bug.cgi?id=212557
802
803         Reviewed by Mark Lam.
804
805         * stress/should-not-emit-double-rep-for-bigint.js: Ensured that this iteration count can reproduce the original crash.
806         * stress/tailCallForwardArguments.js: Split tests into 4 files.
807         (let.bodyText): Deleted.
808         (baz4): Deleted.
809         (testFunc): Deleted.
810         (baz5): Deleted.
811         (baz6): Deleted.
812         (arrayEq): Deleted.
813         * stress/tailCallForwardArguments2.js: Added.
814         (putFuncToPrivateName.createBuiltin):
815         (createTailCallForwardingFuncWith):
816         (putFuncToPrivateName):
817         (let.bodyText):
818         (baz4):
819         * stress/tailCallForwardArguments3.js: Added.
820         (putFuncToPrivateName.createBuiltin):
821         (createTailCallForwardingFuncWith):
822         (putFuncToPrivateName):
823         (let.bodyText):
824         (testFunc):
825         (baz5):
826         * stress/tailCallForwardArguments4.js: Added.
827         (putFuncToPrivateName.createBuiltin):
828         (createTailCallForwardingFuncWith):
829         (let.bodyText):
830         (putFuncToPrivateName):
831         (baz6):
832         (arrayEq):
833
834 2020-05-29  Saam Barati  <sbarati@apple.com>
835
836         We need to properly model heap ranges of Delete in DFG/B3
837         https://bugs.webkit.org/show_bug.cgi?id=212538
838         <rdar://problem/63670964>
839
840         Reviewed by Filip Pizlo.
841
842         * stress/delete-inlining-should-model-aliasing-of-future-stores.js: Added.
843
844 2020-05-29  Saam Barati  <sbarati@apple.com>
845
846         Skip a few more JSC tests when $memoryLimited
847         https://bugs.webkit.org/show_bug.cgi?id=212552
848
849         Reviewed by Mark Lam.
850
851         * stress/call-varargs-inlining-should-not-clobber-previous-to-free-register.js:
852         * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js:
853
854 2020-05-27  Keith Miller  <keith_miller@apple.com>
855
856         for-of should check the iterable is a JSArray for FastArray in DFG iterator_open
857         https://bugs.webkit.org/show_bug.cgi?id=212383
858
859         Reviewed by Saam Barati.
860
861         * stress/check-sub-class.js:
862         * stress/for-of-iterator-open-fast-array-should-check-js-type.js: Added.
863         (foo):
864
865 2020-05-27  Saam Barati  <sbarati@apple.com>
866
867         hasOwnProperty inside structure property for-in loop should use an opcode like has_structure_property but for hasOwnProperty
868         https://bugs.webkit.org/show_bug.cgi?id=212248
869
870         Reviewed by Keith Miller.
871
872         * microbenchmarks/has-own-property-for-in-loop.js: Added.
873         * stress/has-own-property-structure-for-in-loop-correctness.js: Added.
874
875 2020-05-27  Yusuke Suzuki  <ysuzuki@apple.com>
876
877         [ macOS iOS ] REGRESSION(r261600?): imported/w3c/web-platform-tests/html/dom/reflection-embedded.html & imported/w3c/web-platform-tests/html/dom/reflection-forms.html are flaky failures
878         https://bugs.webkit.org/show_bug.cgi?id=212430
879
880         Reviewed by Saam Barati.
881
882         * stress/is-constructor-should-be-correct-in-ai.js: Added.
883         (shouldBe):
884         (test):
885
886 2020-05-27  Saam Barati  <sbarati@apple.com>
887
888         Limit memory used by wasm/references/multitable.js on memory limited devices
889         https://bugs.webkit.org/show_bug.cgi?id=212437
890
891         Reviewed by Keith Miller.
892
893         wasm/references/multitable.js was using around ~700MB of memory.
894         This looks like it's causing jetsams on some of our iOS test runners.
895         This patch makes this test use less memory on memory limited devices.
896
897         * wasm/assert.js:
898         * wasm/references/multitable.js:
899         (string_appeared_here.tableInsanity):
900
901 2020-05-27  Keith Miller  <keith_miller@apple.com>
902
903         Unreviwed, catch expected exception in new test.
904
905         * stress/for-in-in-structure-property-constant-virtual-register.js:
906
907 2020-05-27  Keith Miller  <keith_miller@apple.com>
908
909         in_structure_property needs to handle constants on the RHS of the "in"
910         https://bugs.webkit.org/show_bug.cgi?id=212399
911
912         Reviewed by Saam Barati.
913
914         * stress/for-in-in-structure-property-constant-virtual-register.js: Added.
915
916 2020-05-26  Mark Lam  <mark.lam@apple.com>
917
918         JSC stress tests that require --useLLInt=0 should be skipped on --no-jit test runs.
919         https://bugs.webkit.org/show_bug.cgi?id=212400
920
921         Reviewed by Saam Barati.
922
923         That's because using --useLLInt=0 and --useJIT=0 together is not a "coherent"
924         (read "valid") configuration.  We should be able to do a --no-jit test run with
925         the JSC_useJIT=0 environmental variable set.  Before this patch, the following
926         tests will all fail.  This patch skips them.
927
928         * stress/delete-property-poly-proto.js:
929         * stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js:
930         * stress/getter-setter-inlining-should-emit-movhint.js:
931         * stress/merging-ic-variants-should-bail-if-structures-overlap.js:
932         * stress/poly-proto-setter-adds-setter-in-middle.js:
933         * stress/poly-proto-setter-changes-setter-2.js:
934         * stress/poly-proto-setter-changes-setter.js:
935         * stress/racy-gc-cleanup-of-identifier-after-mutator-stops-running.js:
936         * stress/regress-192717.js:
937         * stress/retry-cache-later.js:
938
939 2020-05-26  Alexey Shvayka  <shvaikalesh@gmail.com>
940
941         IteratorClose should suppress GetMethod errors
942         https://bugs.webkit.org/show_bug.cgi?id=212378
943
944         Reviewed by Keith Miller.
945
946         * stress/custom-iterators.js:
947         * stress/iterator-return-abrupt-lookup-builtins.js: Added.
948         * test262/expectations.yaml: Mark 4 test cases as passing.
949
950 2020-05-23  Caio Lima  <ticaiolima@gmail.com>
951
952         [bmalloc] Fix OOM errors on MIPS after r261667
953         https://bugs.webkit.org/show_bug.cgi?id=212016
954
955         Reviewed by Yusuke Suzuki.
956
957         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
958         * stress/big-int-mod-memory-stress.js:
959         * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js:
960
961 2020-05-22  Alexey Shvayka  <shvaikalesh@gmail.com>
962
963         Array.prototype.splice doesn't set "length" of returned object
964         https://bugs.webkit.org/show_bug.cgi?id=212285
965
966         Reviewed by Darin Adler.
967
968         * test262/expectations.yaml: Mark 2 test cases as passing.
969
970 2020-05-22  Saam Barati  <sbarati@apple.com>
971
972         in_by_val inside structure property for-in loop should use an opcode like has_structure_property but for "in"
973         https://bugs.webkit.org/show_bug.cgi?id=212239
974
975         Reviewed by Tadeu Zagallo.
976
977         * microbenchmarks/in-by-val-inside-for-in-loop.js: Added.
978         (assert):
979         (count):
980         * stress/in-by-val-inside-for-in-loop.js: Added.
981         (assert):
982         (test1.count):
983         (test1):
984         (test2.count):
985         (test2):
986         (test3.count):
987         (test3):
988         (test4.count):
989         (test4):
990         (test5.count):
991         (test5):
992         (test6.count):
993         (test6):
994         (test7.count):
995         (test7):
996         (test8.count):
997         (test8):
998
999 2020-05-22  Keith Miller  <keith_miller@apple.com>
1000
1001         Checkpoint inlined call return handler needs an exception check when dispatching
1002         https://bugs.webkit.org/show_bug.cgi?id=212104
1003
1004         Reviewed by Yusuke Suzuki.
1005
1006         * stress/for-of-done-getter-osr-exits-inlined-to-value-getter-with-exception.js: Added.
1007         (let.d.get done):
1008         (let.d.get value):
1009         (foo):
1010         (catch):
1011
1012 2020-05-21  Alexey Shvayka  <shvaikalesh@gmail.com>
1013
1014         Use @isUndefinedOrNull instead of abstract equality with null
1015         https://bugs.webkit.org/show_bug.cgi?id=210954
1016
1017         Reviewed by Yusuke Suzuki.
1018
1019         * test262/expectations.yaml: Mark 16 test cases as passing.
1020
1021 2020-05-21  Alexey Shvayka  <shvaikalesh@gmail.com>
1022
1023         Array.prototype.concat is incorrect with objects whose "length" exceeds 2 ** 32 - 1
1024         https://bugs.webkit.org/show_bug.cgi?id=212167
1025
1026         Reviewed by Saam Barati.
1027
1028         * stress/array-prototype-concat-of-long-spliced-arrays.js:
1029         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
1030         * test262/expectations.yaml: Mark 4 test cases as passing.
1031
1032 2020-05-19  Michael Catanzaro  <mcatanzaro@gnome.org>
1033
1034         Fixups for r261689 "stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js failing on ppc64le and s390x"
1035         https://bugs.webkit.org/show_bug.cgi?id=211724
1036         <rdar://problem/63227393>
1037
1038         Reviewed by Carlos Alberto Lopez Perez.
1039
1040         Separately skip 32-bit and 64-bit PowerPC.
1041
1042         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
1043
1044 2020-05-18  Yusuke Suzuki  <ysuzuki@apple.com>
1045
1046         [JSC] BigInt peephole compare should speculate appropriately
1047         https://bugs.webkit.org/show_bug.cgi?id=212037
1048         <rdar://problem/63346966>
1049
1050         Reviewed by Saam Barati.
1051
1052         * stress/bigint-compare-peephole-branch.js: Added.
1053
1054 2020-05-18  Keith Miller  <keith_miller@apple.com>
1055
1056         OSR loop entry to iterator_next generic needs to CheckNotEmpty on m_next
1057         https://bugs.webkit.org/show_bug.cgi?id=212001
1058
1059         Reviewed by Saam Barati.
1060
1061         * stress/for-of-osr-loop-enter-active-next-differs-from-seen-modes.js: Added.
1062         (foo):
1063
1064 2020-05-18  Paulo Matos  <pmatos@igalia.com>
1065
1066         Skip stress test array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js on MIPS
1067
1068         Unreviewed Gardening.
1069
1070         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
1071
1072 2020-05-16  Keith Miller  <keith_miller@apple.com>
1073
1074         [test262] Update to master for May
1075         https://bugs.webkit.org/show_bug.cgi?id=211985
1076
1077         Reviewed by Mark Lam.
1078
1079         * test262/expectations.yaml:
1080         * test262/harness/testIntl.js:
1081         * test262/latest-changes-summary.txt:
1082         * test262/test/annexB/built-ins/Array/from/iterator-method-emulates-undefined.js: Added.
1083         * test262/test/annexB/built-ins/String/prototype/match/custom-matcher-emulates-undefined.js: Added.
1084         * test262/test/annexB/built-ins/String/prototype/matchAll/custom-matcher-emulates-undefined.js: Added.
1085         * test262/test/annexB/built-ins/String/prototype/replace/custom-replacer-emulates-undefined.js: Added.
1086         * test262/test/annexB/built-ins/String/prototype/replaceAll/custom-replacer-emulates-undefined.js: Added.
1087         * test262/test/annexB/built-ins/String/prototype/search/custom-searcher-emulates-undefined.js: Added.
1088         * test262/test/annexB/built-ins/String/prototype/split/custom-splitter-emulates-undefined.js: Added.
1089         * test262/test/annexB/built-ins/TypedArrayConstructors/from/iterator-method-emulates-undefined.js: Added.
1090         (testWithTypedArrayConstructors):
1091         * test262/test/annexB/language/expressions/yield/star-iterable-throw-emulates-undefined-throws-when-called.js:
1092         * test262/test/built-ins/AsyncGeneratorFunction/proto-from-ctor-realm-prototype.js: Added.
1093         * test262/test/built-ins/Atomics/waitAsync/false-for-timeout-agent.js:
1094         * test262/test/built-ins/Atomics/waitAsync/good-views.js:
1095         * test262/test/built-ins/Atomics/waitAsync/nan-for-timeout-agent.js:
1096         * test262/test/built-ins/Atomics/waitAsync/negative-timeout-agent.js:
1097         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-no-operation.js:
1098         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-on-add.js:
1099         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-on-and.js:
1100         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-on-compareExchange.js:
1101         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-on-exchange.js:
1102         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-on-or.js:
1103         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-on-store.js:
1104         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-on-sub.js:
1105         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-on-xor.js:
1106         * test262/test/built-ins/Atomics/waitAsync/null-for-timeout-agent.js:
1107         * test262/test/built-ins/Atomics/waitAsync/object-for-timeout-agent.js:
1108         * test262/test/built-ins/Atomics/waitAsync/poisoned-object-for-timeout-throws-agent.js:
1109         * test262/test/built-ins/Atomics/waitAsync/symbol-for-index-throws-agent.js:
1110         * test262/test/built-ins/Atomics/waitAsync/symbol-for-timeout-throws-agent.js:
1111         * test262/test/built-ins/Atomics/waitAsync/symbol-for-value-throws-agent.js:
1112         * test262/test/built-ins/Atomics/waitAsync/true-for-timeout-agent.js:
1113         * test262/test/built-ins/Atomics/waitAsync/undefined-for-timeout-agent.js:
1114         * test262/test/built-ins/Atomics/waitAsync/undefined-index-defaults-to-zero-agent.js:
1115         * test262/test/built-ins/Atomics/waitAsync/value-not-equal-agent.js:
1116         * test262/test/built-ins/Atomics/waitAsync/waiterlist-block-indexedposition-wake.js:
1117         * test262/test/built-ins/Atomics/waitAsync/was-woken-before-timeout.js:
1118         * test262/test/built-ins/BigInt/prototype/toString/a-z.js: Added.
1119         * test262/test/built-ins/Function/proto-from-ctor-realm-prototype.js: Added.
1120         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm-prototype.js: Added.
1121         * test262/test/built-ins/NativeErrors/AggregateError/proto-from-ctor-realm.js:
1122         * test262/test/built-ins/Number/isSafeInteger/safe-integers.js:
1123         * test262/test/built-ins/Number/prototype/toString/a-z.js: Added.
1124         * test262/test/built-ins/Object/assign/strings-and-symbol-order-proxy.js: Added.
1125         (getOwnPropertyDescriptor):
1126         (ownKeys):
1127         * test262/test/built-ins/Object/defineProperties/proxy-no-ownkeys-returned-keys-order.js: Added.
1128         (getOwnPropertyDescriptor):
1129         * test262/test/built-ins/Object/freeze/proxy-no-ownkeys-returned-keys-order.js: Added.
1130         (getOwnPropertyDescriptor):
1131         * test262/test/built-ins/Object/getOwnPropertyDescriptors/proxy-no-ownkeys-returned-keys-order.js: Added.
1132         (getOwnPropertyDescriptor):
1133         * test262/test/built-ins/Object/isFrozen/proxy-no-ownkeys-returned-keys-order.js: Added.
1134         (getOwnPropertyDescriptor):
1135         * test262/test/built-ins/Object/isSealed/proxy-no-ownkeys-returned-keys-order.js: Added.
1136         (getOwnPropertyDescriptor):
1137         * test262/test/built-ins/Object/prototype/hasOwnProperty/S15.2.4.5_A10.js: Removed.
1138         * test262/test/built-ins/Object/prototype/hasOwnProperty/S15.2.4.5_A11.js: Removed.
1139         * test262/test/built-ins/Object/prototype/hasOwnProperty/S15.2.4.5_A8.js: Removed.
1140         * test262/test/built-ins/Object/prototype/hasOwnProperty/S15.2.4.5_A9.js: Removed.
1141         * test262/test/built-ins/Object/prototype/hasOwnProperty/length.js: Added.
1142         * test262/test/built-ins/Object/prototype/hasOwnProperty/topropertykey_before_toobject.js: Added.
1143         (coercibleKey1.get toString):
1144         (coercibleKey1.get valueOf):
1145         (coercibleKey2.Symbol.toPrimitive):
1146         * test262/test/built-ins/Object/prototype/toString/proxy-revoked-during-get-call.js: Added.
1147         * test262/test/built-ins/Object/seal/proxy-no-ownkeys-returned-keys-order.js: Added.
1148         (defineProperty):
1149         * test262/test/built-ins/Promise/all/invoke-resolve-get-once-no-calls.js:
1150         * test262/test/built-ins/Promise/all/resolve-not-callable-close.js: Added.
1151         (const.iter.return.return):
1152         (const.iter.Symbol.iterator):
1153         (Promise.all.iter.then):
1154         * test262/test/built-ins/Promise/allSettled/resolve-not-callable-close.js: Added.
1155         (const.iter.return.return):
1156         (const.iter.Symbol.iterator):
1157         (Promise.allSettled.iter.then):
1158         * test262/test/built-ins/Promise/any/resolve-not-callable-close.js: Added.
1159         (const.iter.return.return):
1160         (const.iter.Symbol.iterator):
1161         (Promise.any.iter.then):
1162         * test262/test/built-ins/Promise/race/resolve-not-callable-close.js: Added.
1163         (const.iter.return.return):
1164         (const.iter.Symbol.iterator):
1165         (Promise.race.iter.then):
1166         * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/order-dayPeriod.js:
1167         * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/order-fractionalSecondDigits.js:
1168         * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/order-style.js:
1169         * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/order.js:
1170         * test262/test/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-long.js:
1171         (expected.of.Object.entries):
1172         * test262/test/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-narrow.js:
1173         (expected.of.Object.entries):
1174         * test262/test/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-short.js:
1175         (expected.of.Object.entries):
1176         * test262/test/intl402/RelativeTimeFormat/prototype/formatToParts/pl-pl-style-long.js:
1177         (expected.of.Object.entries):
1178         * test262/test/intl402/RelativeTimeFormat/prototype/formatToParts/pl-pl-style-narrow.js:
1179         (expected.of.Object.entries):
1180         * test262/test/intl402/RelativeTimeFormat/prototype/formatToParts/pl-pl-style-short.js:
1181         (expected.of.Object.entries):
1182         * test262/test/language/expressions/async-generator/named-yield-star-sync-return.js:
1183         (gen):
1184         * test262/test/language/expressions/async-generator/named-yield-star-sync-throw.js:
1185         (gen):
1186         * test262/test/language/expressions/async-generator/yield-star-sync-return.js:
1187         * test262/test/language/expressions/async-generator/yield-star-sync-throw.js:
1188         * test262/test/language/expressions/class/async-gen-method-static/yield-star-sync-return.js:
1189         (C):
1190         * test262/test/language/expressions/class/async-gen-method-static/yield-star-sync-throw.js:
1191         (C):
1192         * test262/test/language/expressions/class/async-gen-method/yield-star-sync-return.js:
1193         * test262/test/language/expressions/class/async-gen-method/yield-star-sync-throw.js:
1194         * test262/test/language/expressions/class/elements/async-gen-private-method-static/yield-star-sync-return.js:
1195         (C):
1196         * test262/test/language/expressions/class/elements/async-gen-private-method-static/yield-star-sync-throw.js:
1197         (C):
1198         * test262/test/language/expressions/class/elements/async-gen-private-method/yield-star-sync-return.js:
1199         * test262/test/language/expressions/class/elements/async-gen-private-method/yield-star-sync-throw.js:
1200         * test262/test/language/expressions/class/elements/field-declaration.js: Added.
1201         * test262/test/language/expressions/class/elements/fields-anonymous-function-length.js:
1202         * test262/test/language/expressions/class/elements/private-method-referenced-from-static-method.js:
1203         * test262/test/language/expressions/object/dstr/object-rest-proxy-ownkeys-returned-keys-order.js: Added.
1204         (getOwnPropertyDescriptor):
1205         (ownKeys):
1206         * test262/test/language/expressions/object/method-definition/async-gen-yield-star-sync-return.js:
1207         * test262/test/language/expressions/object/method-definition/async-gen-yield-star-sync-throw.js:
1208         * test262/test/language/expressions/object/object-spread-proxy-ownkeys-returned-keys-order.js: Added.
1209         (getOwnPropertyDescriptor):
1210         (ownKeys):
1211         * test262/test/language/identifiers/part-unicode-10.0.0-escaped.js:
1212         * test262/test/language/identifiers/part-unicode-10.0.0.js:
1213         * test262/test/language/identifiers/part-unicode-11.0.0-escaped.js:
1214         * test262/test/language/identifiers/part-unicode-11.0.0.js:
1215         * test262/test/language/identifiers/part-unicode-12.0.0-escaped.js:
1216         * test262/test/language/identifiers/part-unicode-12.0.0.js:
1217         * test262/test/language/identifiers/part-unicode-13.0.0-escaped.js:
1218         * test262/test/language/identifiers/part-unicode-13.0.0.js:
1219         * test262/test/language/identifiers/part-unicode-5.2.0-escaped.js:
1220         * test262/test/language/identifiers/part-unicode-5.2.0.js:
1221         * test262/test/language/identifiers/part-unicode-6.0.0-escaped.js:
1222         * test262/test/language/identifiers/part-unicode-6.0.0.js:
1223         * test262/test/language/identifiers/part-unicode-6.1.0-escaped.js:
1224         * test262/test/language/identifiers/part-unicode-6.1.0.js:
1225         * test262/test/language/identifiers/part-unicode-7.0.0-escaped.js:
1226         * test262/test/language/identifiers/part-unicode-7.0.0.js:
1227         * test262/test/language/identifiers/part-unicode-8.0.0-escaped.js:
1228         * test262/test/language/identifiers/part-unicode-8.0.0.js:
1229         * test262/test/language/identifiers/part-unicode-9.0.0-escaped.js:
1230         * test262/test/language/identifiers/part-unicode-9.0.0.js:
1231         * test262/test/language/module-code/eval-rqstd-once.js:
1232         * test262/test/language/module-code/export-star-as-dflt.js: Added.
1233         * test262/test/language/module-code/export-star-as-dflt_FIXTURE.js: Added.
1234         * test262/test/language/statements/async-generator/yield-star-sync-return.js:
1235         * test262/test/language/statements/async-generator/yield-star-sync-throw.js:
1236         * test262/test/language/statements/class/async-gen-method-static/yield-star-sync-return.js:
1237         * test262/test/language/statements/class/async-gen-method-static/yield-star-sync-throw.js:
1238         * test262/test/language/statements/class/async-gen-method/yield-star-sync-return.js:
1239         * test262/test/language/statements/class/async-gen-method/yield-star-sync-throw.js:
1240         * test262/test/language/statements/class/elements/async-gen-private-method-static/yield-star-sync-return.js:
1241         * test262/test/language/statements/class/elements/async-gen-private-method-static/yield-star-sync-throw.js:
1242         * test262/test/language/statements/class/elements/async-gen-private-method/yield-star-sync-return.js:
1243         * test262/test/language/statements/class/elements/async-gen-private-method/yield-star-sync-throw.js:
1244         * test262/test/language/statements/class/elements/field-declaration.js: Added.
1245         (C):
1246         * test262/test/language/statements/class/elements/fields-anonymous-function-length.js:
1247         * test262/test/language/statements/class/elements/private-method-referenced-from-static-method.js:
1248         * test262/test/language/statements/class/subclass/bound-function.js: Removed.
1249         * test262/test/language/statements/class/subclass/class-definition-superclass-generator.js: Removed.
1250         * test262/test/language/statements/class/subclass/superclass-arrow-function.js: Added.
1251         (fn):
1252         (A):
1253         (C):
1254         * test262/test/language/statements/class/subclass/superclass-async-function.js: Added.
1255         (async fn):
1256         (A):
1257         (bound):
1258         (C):
1259         * test262/test/language/statements/class/subclass/superclass-async-generator-function.js: Added.
1260         (async fn):
1261         (A):
1262         (bound):
1263         (async bind):
1264         * test262/test/language/statements/class/subclass/superclass-bound-function.js: Added.
1265         (bound):
1266         * test262/test/language/statements/class/subclass/superclass-generator-function.js: Added.
1267         (fn):
1268         (A):
1269         (bound):
1270         (C):
1271         * test262/test262-Revision.txt:
1272
1273 2020-05-16  Yusuke Suzuki  <ysuzuki@apple.com>
1274
1275         [JSC] Make OutOfMemory error as instance of RangeError
1276         https://bugs.webkit.org/show_bug.cgi?id=211952
1277
1278         Reviewed by Mark Lam.
1279
1280         * ChakraCore/test/Error/outofmem.baseline-jsc:
1281         * es6/String.prototype_methods_String.prototype.padEnd.js:
1282         (TestMemoryLimits):
1283         * es6/String.prototype_methods_String.prototype.padStart.js:
1284         (TestMemoryLimits):
1285         * slowMicrobenchmarks/function-constructor-with-huge-strings.js:
1286         * stress/array-join-on-strings-need-overflow-checks.js:
1287         * stress/big-wasm-memory-grow-no-max.js:
1288         (test):
1289         * stress/big-wasm-memory-grow.js:
1290         (test):
1291         * stress/big-wasm-memory.js:
1292         (test):
1293         * stress/bigint-exponential-oom.js:
1294         (shouldThrow):
1295         * stress/bigint-int32-min-shift.js:
1296         (shouldThrow):
1297         * stress/check-symbol-description-oom.js:
1298         * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js:
1299         * stress/intl-canonicalize-locale-list-error-oom.js:
1300         (shouldThrow):
1301         * stress/joined-strings-should-not-exceed-max-string-length.js:
1302         * stress/js-fixed-array-out-of-memory.js:
1303         (test):
1304         * stress/json-stringified-overflow-2.js:
1305         (catch):
1306         * stress/json-stringified-overflow.js:
1307         (catch):
1308         * stress/json-stringify-string-builder-overflow.js:
1309         * stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js:
1310         * stress/missing-exception-check-in-array-prototype-fastJoin.js:
1311         * stress/missing-exception-check-in-canonicalizeLocaleList.js:
1312         * stress/missing-exception-check-in-json-stringifier-gap.js:
1313         * stress/missing-exception-check-in-string-compare.js:
1314         * stress/missing-exception-check-in-string-greater-than-compare.js:
1315         * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js:
1316         * stress/missing-exception-check-in-string-lastIndexOf.js:
1317         * stress/missing-exception-check-in-string-less-than-compare.js:
1318         * stress/missing-exception-check-in-string-less-than-or-equal-compare.js:
1319         * stress/missing-exception-check-in-string-toLower.js:
1320         * stress/missing-exception-check-in-string-toUpper.js:
1321         * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js:
1322         * stress/out-of-memory-while-constructing-BytecodeGenerator.js:
1323         * stress/regexp-prototype-exec-on-too-long-rope.js:
1324         * stress/regexp-prototype-match-on-too-long-rope.js:
1325         * stress/regexp-prototype-test-on-too-long-rope.js:
1326         * stress/regress-169783.js:
1327         (doTest):
1328         * stress/regress-178385.js:
1329         * stress/regress-178386.js:
1330         * stress/regress-185888.js:
1331         * stress/regress-189132.js:
1332         * stress/regress-190187.js:
1333         * stress/regress-191563.js:
1334         * stress/scoped-arguments-table-should-be-tolerant-for-oom.js:
1335         (i.canThrow):
1336         * stress/string-16bit-repeat-overflow.js:
1337         * stress/string-overflow-createError-builder.js:
1338         * stress/string-overflow-createError-fit.js:
1339         * stress/string-overflow-createError.js:
1340         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
1341         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js:
1342         * stress/switch-string-oom.js:
1343         (testLowerTiers):
1344         (testFTL):
1345         * stress/test-exception-assert-in-ExceptionHelpers-createError.js:
1346         * stress/test-out-of-memory.js:
1347         * stress/typed-array-subarray-can-throw-oom-error.js:
1348         (get bar):
1349         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js:
1350         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js:
1351
1352 2020-05-15  Yusuke Suzuki  <ysuzuki@apple.com>
1353
1354         [JSC] getFunctionRealm should not use recursion
1355         https://bugs.webkit.org/show_bug.cgi?id=211965
1356         <rdar://problem/63268287>
1357
1358         Reviewed by Saam Barati.
1359
1360         * stress/get-function-realm-not-doing-recursion.js: Added.
1361         (canThrow):
1362         (const.emptyFunction):
1363
1364 2020-05-15  Paulo Matos  <pmatos@igalia.com>
1365
1366         Skip tests in ARM and MIPS post r261667
1367
1368         Unreviewed Gardening.
1369         These tests started failing on both ARMv7 and MIPS post r261667.
1370         Skipping for now until an investigation takes place.
1371
1372         * stress/big-int-mod-memory-stress.js:
1373         * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js:
1374
1375 2020-05-14  Saam Barati  <sbarati@apple.com>
1376
1377         GetByVal and PutByVal runtime operations shouldn't fall off a performance cliff when the property is an integer boxed as a double
1378         https://bugs.webkit.org/show_bug.cgi?id=211935
1379
1380         Reviewed by Yusuke Suzuki and Mark Lam.
1381
1382         * microbenchmarks/get-and-put-by-val-double-index-dont-fall-off-a-cliff.js: Added.
1383         (test):
1384
1385 2020-05-14  Devin Rousso  <drousso@apple.com>
1386
1387         [ESNext] enable logical assignment operators by default
1388         https://bugs.webkit.org/show_bug.cgi?id=211921
1389
1390         Reviewed by Yusuke Suzuki.
1391
1392         * test262/config.yaml:
1393         * stress/logical-assignment-operator-and.js:
1394         * stress/logical-assignment-operator-coalesce.js:
1395         * stress/logical-assignment-operator-or.js:
1396
1397 2020-05-14  Keith Miller  <keith_miller@apple.com>
1398
1399         Undecided Arrays shouldn't need to be OriginalArray to covert to GetArrayLength
1400         https://bugs.webkit.org/show_bug.cgi?id=211914
1401
1402         Reviewed by Saam Barati.
1403
1404         * stress/undecided-arrays-should-not-need-original-array-for-length.js: Added.
1405         (findFoo):
1406         (const.nonUndecidedFrequency.1000.SubArray):
1407         (i.i.some):
1408
1409 2020-05-14  Keith Miller  <keith_miller@apple.com>
1410
1411         GetArrayLength should be "blessed" during Fixup phase in the DFG
1412         https://bugs.webkit.org/show_bug.cgi?id=211540
1413
1414         Reviewed by Saam Barati.
1415
1416         * stress/get-array-length-node-should-be-blessed-in-fixup.js: Added.
1417         (foo):
1418
1419 2020-05-13  Keith Miller  <keith_miller@apple.com>
1420
1421         iteration bytecodes need to handle osr exiting from inlined getter frames
1422         https://bugs.webkit.org/show_bug.cgi?id=211873
1423
1424         Reviewed by Saam Barati.
1425
1426         * stress/for-of-done-getter-osr-exit-inlined.js: Added.
1427         (let.d.get done):
1428         (let.d.get value):
1429         * stress/for-of-next-getter-osr-exit-inlined.js: Added.
1430         (let.x.get next):
1431         (foo):
1432         * stress/for-of-value-getter-osr-exit-inlined.js: Added.
1433         (let.d.get value):
1434         (let.d.get done):
1435
1436 2020-05-14  Michael Catanzaro  <mcatanzaro@gnome.org>
1437
1438         stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js failing on ppc64le and s390x
1439         https://bugs.webkit.org/show_bug.cgi?id=211724
1440
1441         Reviewed by Carlos Alberto Lopez Perez.
1442
1443         This test is broken on ppc64le and s390x, so skip it.
1444
1445         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
1446
1447 2020-05-13  Paulo Matos  <pmatos@igalia.com>
1448
1449         Skip on MIPS test stress/has-own-property-name-cache-symbols-and-strings.js
1450
1451         Unreviewed Gardening.
1452         Test started to fail unpredictably with segfault in bots -
1453         requires further investigation.
1454
1455         * stress/has-own-property-name-cache-symbols-and-strings.js:
1456
1457 2020-05-13  Saam Barati  <sbarati@apple.com>
1458
1459         MovHint can see an arguments object be MovHinted to a Tmp
1460         https://bugs.webkit.org/show_bug.cgi?id=211820
1461         <rdar://problem/62882158>
1462
1463         Reviewed by Keith Miller.
1464
1465         * stress/varargs-forwarding-can-see-arguments-mov-hint-to-for-of-tmp.js: Added.
1466         (let.iter.Symbol.iterator.return.next):
1467         (let.iter.Symbol.iterator):
1468
1469 2020-05-13  Alexey Shvayka  <shvaikalesh@gmail.com>
1470
1471         Move @isConstructor checks from fast paths of Array.from and Array.of
1472         https://bugs.webkit.org/show_bug.cgi?id=211805
1473
1474         Reviewed by Keith Miller.
1475
1476         * microbenchmarks/array-from-arraylike.js: Added.
1477         * microbenchmarks/array-of.js: Added.
1478         * stress/new-promise-capabilities-requires-constructor.js:
1479
1480 2020-05-12  Alexey Shvayka  <shvaikalesh@gmail.com>
1481
1482         Implement @isConstructor bytecode intrinsic and bytecode for that
1483         https://bugs.webkit.org/show_bug.cgi?id=144093
1484
1485         Reviewed by Keith Miller.
1486
1487         * microbenchmarks/is-constructor.js: Added.
1488         * stress/async-arrow-function-in-class-heritage.js:
1489         * stress/is-constructor.js:
1490         * test262/expectations.yaml: Mark 2 test cases as passing.
1491
1492 2020-05-12  Robin Morisset  <rmorisset@apple.com>
1493
1494         Exception check for OOM is a bit too late in JSBigInt::exponentiate.
1495         https://bugs.webkit.org/show_bug.cgi?id=211823
1496
1497         Reviewed by Mark Lam.
1498
1499         Just add one more case so that this test now catches this bug (the control-flow through JSBigInt::exponentiate is pretty convoluted).
1500
1501         * stress/bigint-exponential-oom.js:
1502         (shouldThrow):
1503
1504 2020-05-12  Saam Barati  <sbarati@apple.com>
1505
1506         handling of Check in VarargsForwardingPhase is too pessimistic
1507         https://bugs.webkit.org/show_bug.cgi?id=211810
1508
1509         Reviewed by Keith Miller and Filip Pizlo.
1510
1511         * microbenchmarks/forward-varargs-check-shouldnt-escape.js: Added.
1512         (g):
1513         (foo):
1514
1515 2020-05-12  Keith Miller  <keith_miller@apple.com>
1516
1517         The bottom value set for m_value in iterator_next should be materialized after a done getter
1518         https://bugs.webkit.org/show_bug.cgi?id=211811
1519
1520         Reviewed by Saam Barati.
1521
1522         * stress/for-of-done-getter-materialize-bottom-late.js: Added.
1523         (let.d.get done):
1524         * stress/for-of-value-getter-contains-control-flow.js: Added.
1525         (let.d.get value):
1526         (let.d.get done):
1527
1528 2020-05-11  Paulo Matos  <pmatos@igalia.com>
1529
1530         Skip on armv7/linux stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js
1531         https://bugs.webkit.org/show_bug.cgi?id=211721
1532
1533         Unreviewed Gardening.
1534         This test is failing on our linux armv7 bots on a flaky basis and requires investigation.
1535
1536         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
1537
1538 2020-05-08  Alexey Shvayka  <shvaikalesh@gmail.com>
1539
1540         Array.prototype.concat fast path checks should not be observable
1541         https://bugs.webkit.org/show_bug.cgi?id=211643
1542
1543         Reviewed by Ross Kirsling.
1544
1545         While test262 has complete coverage for @@isConcatSpreadable getters in prototype
1546         chain, Proxy cases are covered by stress/array-concat-fast-spread-proxy.js and
1547         stress/array-concat-spread-proxy.js.
1548
1549         * test262/expectations.yaml: Mark 2 test cases as passing.
1550
1551 2020-05-08  Pablo Saavedra  <psaavedra@igalia.com>
1552
1553         Unreviewed, reverting r261010.
1554
1555         Test skipped for all ARM. no evidence of this affecting iOS
1556
1557         Reverted changeset:
1558
1559         "Skip on ARM and MIPS stress/array-buffer-view-watchpoint-can-
1560         be-fired-in-really-add-in-dfg.js added after r260990"
1561         https://bugs.webkit.org/show_bug.cgi?id=211304
1562         https://trac.webkit.org/changeset/261010
1563
1564 2020-05-07  Mark Lam  <mark.lam@apple.com>
1565
1566         Fix broken exceptionFuzz tests.
1567         https://bugs.webkit.org/show_bug.cgi?id=211550
1568
1569         Reviewed by Yusuke Suzuki.
1570
1571         The tests should not be relying on setting a JSC Option at runtime because the
1572         options are already frozen by then.  Instead, we set the needed
1573         --useExceptionFuzz=true option from the command line.
1574
1575         * exceptionFuzz/3d-cube.js:
1576         * exceptionFuzz/date-format-xparb.js:
1577         * exceptionFuzz/earley-boyer.js:
1578
1579 2020-05-06  Keith Miller  <keith_miller@apple.com>
1580
1581         DFG ByVal nodes with ArrayModes should clobberTop until Fixup phase runs.
1582         https://bugs.webkit.org/show_bug.cgi?id=211531
1583
1584         Reviewed by Yusuke Suzuki.
1585
1586         * stress/for-of-get-by-val-marks-clobbers-exit-state.js: Added.
1587         (foo):
1588         * stress/put-by-val-correctly-clobbers-exit-state-when-misprofiling-index.js: Added.
1589         (let.foo.vm.createBuiltin):
1590
1591 2020-05-05  Ross Kirsling  <ross.kirsling@sony.com>
1592
1593         [ECMA-402] Implement Intl.Locale
1594         https://bugs.webkit.org/show_bug.cgi?id=209772
1595
1596         Reviewed by Darin Adler and Saam Barati.
1597
1598         * stress/intl-locale.js: Added.
1599         * stress/intl-locale-as-intl-param.js: Added.
1600
1601         * test262/config.yaml:
1602         Enable Intl.Locale feature with flag.
1603
1604         * test262/expectations.yaml:
1605         Mark known failures.
1606         None of these should be specific to Intl.Locale.
1607
1608 2020-05-05  Yusuke Suzuki  <ysuzuki@apple.com>
1609
1610         [JSC] Implement BigInt.asIntN and BigInt.asUintN
1611         https://bugs.webkit.org/show_bug.cgi?id=181144
1612
1613         Reviewed by Darin Adler.
1614
1615         * stress/bigint-asintn.js: Added.
1616         (shouldBe):
1617         (shouldThrow):
1618         (BigInt.asIntN):
1619         * stress/bigint-asuintn.js: Added.
1620         (shouldBe):
1621         (shouldThrow):
1622         (BigInt.asUintN):
1623         * test262/expectations.yaml:
1624
1625 2020-05-05  Ross Kirsling  <ross.kirsling@sony.com>
1626
1627         [Intl] Alphabetize extension keys and correctly mark const methods
1628         https://bugs.webkit.org/show_bug.cgi?id=211359
1629
1630         Reviewed by Darin Adler.
1631
1632         * stress/intl-collator.js:
1633         * stress/intl-datetimeformat.js:
1634         Add tests.
1635
1636 2020-05-05  Keith Miller  <keith_miller@apple.com>
1637
1638         iterator_open should remap the symbolIterator argument correctly when inlined.
1639         https://bugs.webkit.org/show_bug.cgi?id=211308
1640         <rdar://problem/62287877>
1641
1642         Reviewed by Mark Lam.
1643
1644         * stress/inlining-for-of-should-validate.js: Added.
1645         (bar):
1646         (foo):
1647
1648 2020-05-05  Yusuke Suzuki  <ysuzuki@apple.com>
1649
1650         Unreviewed, reverting r261156.
1651
1652         Break ARM64_32 build due to existing bug
1653
1654         Reverted changeset:
1655
1656         "[JSC] Implement BigInt.asIntN and BigInt.asUintN"
1657         https://bugs.webkit.org/show_bug.cgi?id=181144
1658         https://trac.webkit.org/changeset/261156
1659
1660 2020-05-05  Alexey Shvayka  <shvaikalesh@gmail.com>
1661
1662         Object.prototype.toString is not spec-perfect
1663         https://bugs.webkit.org/show_bug.cgi?id=199138
1664
1665         Reviewed by Darin Adler and Keith Miller.
1666
1667         * ChakraCore.yaml: Skip a test as `global` now has @@toStringTag.
1668         * ChakraCore/test/LetConst/delete.baseline: Removed.
1669         * stress/internal-promise-constructor-not-confusing.js: Use @isPromise.
1670         * stress/object-get-own-property-symbols.js: Adjust test as `global` now has @@toStringTag.
1671         * test262/expectations.yaml: Mark 6 test cases as passing.
1672
1673 2020-05-04  Yusuke Suzuki  <ysuzuki@apple.com>
1674
1675         [JSC] Implement BigInt.asIntN and BigInt.asUintN
1676         https://bugs.webkit.org/show_bug.cgi?id=181144
1677
1678         Reviewed by Darin Adler.
1679
1680         * stress/bigint-asintn.js: Added.
1681         (shouldBe):
1682         (shouldThrow):
1683         (BigInt.asIntN):
1684         * stress/bigint-asuintn.js: Added.
1685         (shouldBe):
1686         (shouldThrow):
1687         (BigInt.asUintN):
1688         * test262/expectations.yaml:
1689
1690 2020-05-04  Yusuke Suzuki  <ysuzuki@apple.com>
1691
1692         [JSC] DFG NotCellUse is used without considering about BigInt32
1693         https://bugs.webkit.org/show_bug.cgi?id=211395
1694
1695         Reviewed by Saam Barati.
1696
1697         * stress/non-cell-nor-bigint-should-be-emitted-for-to-number-target-if-bigint-appears.js: Added.
1698         (shouldThrow):
1699         (test):
1700         (i.shouldThrow):
1701         * stress/non-cell-nor-bigint-should-reject-bigint.js: Added.
1702         (shouldBe):
1703         (test):
1704         * stress/should-not-emit-double-rep-for-bigint.js: Added.
1705         (foo):
1706         * stress/urshift-value-to-int32-should-reject-bigint.js: Added.
1707         (shouldThrow):
1708         (test):
1709         (i.shouldThrow):
1710
1711 2020-05-01  Yusuke Suzuki  <ysuzuki@apple.com>
1712
1713         Fix stress/big-int-negate-jit.js
1714         https://bugs.webkit.org/show_bug.cgi?id=211321
1715
1716         Reviewed by Saam Barati.
1717
1718         This test is assuming that 100000 iteration of 2 negateBigInt calls makes negateBigInt DFG-compiled.
1719         But this is wrong if BigInt negation is fast enough. We made BigInt faster and now this test starts
1720         failing because running this iteration finishes earlier than DFG compilation finishes. We should use `useConcurrentJIT`
1721         to ensure this status.
1722
1723         * stress/big-int-negate-jit.js:
1724
1725 2020-05-01  Yusuke Suzuki  <ysuzuki@apple.com>
1726
1727         REGRESSION (r260990): 8 test262 unicode tests failing
1728         https://bugs.webkit.org/show_bug.cgi?id=211298
1729
1730         Reviewed by Saam Barati.
1731
1732         These unicode identifier tests are marked as PASS in r260990, but they are failing.
1733         Update test262/expectations.yaml by running `test262-runner --release --save`.
1734
1735         * test262/expectations.yaml:
1736
1737 2020-05-01  Pablo Saavedra  <psaavedra@igalia.com>
1738
1739         Skip on ARM and MIPS stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js added after r260990
1740         https://bugs.webkit.org/show_bug.cgi?id=211304
1741
1742         Unreviewed Gardening.
1743
1744         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
1745
1746 2020-05-01  Saam Barati  <sbarati@apple.com>
1747
1748         We can't cast toLength result to unsigned
1749         https://bugs.webkit.org/show_bug.cgi?id=211205
1750         <rdar://problem/62625562>
1751
1752         Reviewed by Yusuke Suzuki.
1753
1754         * stress/array-length-cant-get-casted-to-unsigned.js: Added.
1755         (assert):
1756         (testArrayPop):
1757         (testArrayPush):
1758         (testArrayReverse):
1759         (testArraySplice):
1760         (testArrayUnshift):
1761         (testArrayLastIndexOf):
1762         (shouldThrowTypeError):
1763         (testJSONStringify.get let):
1764         (testJSONStringify):
1765         * test262/expectations.yaml:
1766
1767 2020-04-30  Caio Lima  <ticaiolima@gmail.com>
1768
1769         Investigate stress/v8-bitint32-inc.js failure on mips
1770         https://bugs.webkit.org/show_bug.cgi?id=210907
1771
1772         Unreviewed test gardening.
1773
1774         * stress/v8-bigint32-inc.js:
1775
1776 2020-04-29  Alexey Shvayka  <shvaikalesh@gmail.com>
1777
1778         AsyncFromSyncIterator methods should not pass absent values
1779         https://bugs.webkit.org/show_bug.cgi?id=211147
1780
1781         Reviewed by Ross Kirsling.
1782
1783         * test262/expectations.yaml: Mark 4 test cases as passing.
1784
1785 2020-04-29  Yusuke Suzuki  <ysuzuki@apple.com>
1786
1787         [JSC] JSStringJoiner is missing BigInt handling
1788         https://bugs.webkit.org/show_bug.cgi?id=211174
1789
1790         Reviewed by Mark Lam.
1791
1792         * stress/bigint-to-string-in-array.js: Added.
1793         (shouldBe):
1794
1795 2020-04-28  Yusuke Suzuki  <ysuzuki@apple.com>
1796
1797         [JSC] BigInt constructor should accept larger integers than safe-integers
1798         https://bugs.webkit.org/show_bug.cgi?id=210755
1799
1800         Reviewed by Darin Adler.
1801
1802         * stress/big-int-constructor.js:
1803         * stress/large-number-to-bigint.js: Added.
1804         (shouldBe):
1805         (shouldThrow):
1806         * test262/config.yaml:
1807
1808 2020-04-28  Yusuke Suzuki  <ysuzuki@apple.com>
1809
1810         [JSC] NumberConstructor should accept BigInt
1811         https://bugs.webkit.org/show_bug.cgi?id=210835
1812
1813         Reviewed by Mark Lam.
1814
1815         * stress/number-constructor-bigint-dfg.js: Added.
1816         (shouldBe):
1817         (convert):
1818         * stress/number-constructor-bigint.js: Added.
1819         (shouldBe):
1820         * test262/expectations.yaml:
1821
1822 2020-04-27  Yusuke Suzuki  <ysuzuki@apple.com>
1823
1824         [JSC] Throw OutOfMemoryError instead of RangeError if BigInt is too big
1825         https://bugs.webkit.org/show_bug.cgi?id=211111
1826
1827         Reviewed by Saam Barati.
1828
1829         * stress/big-int-constructor-oom.js:
1830         (catch):
1831         * stress/big-int-left-shift-range-error.js:
1832         (assertThrowRangeError):
1833         * stress/big-int-out-of-memory-tests.js:
1834         (catch):
1835         * stress/bigint-exponential-oom.js: Added.
1836         (shouldThrow):
1837         * stress/bigint-int32-min-shift.js:
1838         (shouldThrow):
1839
1840 2020-04-27  Keith Miller  <keith_miller@apple.com>
1841
1842         stress/generator-containing-for-of-on-map.js and stress/generator-containing-for-of-on-set.js timing out on debug JSC bot
1843         https://bugs.webkit.org/show_bug.cgi?id=211095
1844
1845         Reviewed by Yusuke Suzuki.
1846
1847         Let's try making these tests shorter. Eager compilation should still be interesting with the shorter iterations.
1848
1849         * stress/generator-containing-for-of-on-map.js:
1850         * stress/generator-containing-for-of-on-set.js:
1851
1852 2020-04-27  Yusuke Suzuki  <ysuzuki@apple.com>
1853
1854         [JSC] >>> should call ToNumeric
1855         https://bugs.webkit.org/show_bug.cgi?id=211065
1856
1857         Reviewed by Ross Kirsling.
1858
1859         * stress/bigint-urshift.js: Added.
1860         (shouldBe):
1861         (shouldThrow):
1862         * test262/expectations.yaml:
1863
1864 2020-04-27  Yusuke Suzuki  <ysuzuki@apple.com>
1865
1866         [JSC] Add $vm.assertEnabled() to suppress Debug crash expected tests in release+assert build
1867         https://bugs.webkit.org/show_bug.cgi?id=211089
1868
1869         Reviewed by Keith Miller.
1870
1871         We have ASSERT which only fires when DOM object is wrongly implemented to catch wrong ones.
1872         We are using ASSERT in JSC side since we don't know all the DOM objects are correctly implemented.
1873         If it is not correctly implemented, in Release build, JSC is returning sub-optimal but right results.
1874         But in Debug build, we can catch the wrong ones, which allows us to fix the wrong things while avoiding
1875         catastrophic crashes in release build.
1876
1877         However, the test is assuming that ASSERT is not enabled if it is not Debug build. Release & Debug builds
1878         work, but Release+Assert does not meet this assumption.
1879
1880         So, skip this based on `$vm.assertEnabled()`.
1881
1882         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js:
1883         (vm.assertEnabled.putter):
1884         (vm.assertEnabled):
1885         (putter): Deleted.
1886         (not_string.toString): Deleted.
1887         * stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js:
1888         (vm.assertEnabled):
1889         (not_string.toString): Deleted.
1890
1891 2020-04-26  Alexey Shvayka  <shvaikalesh@gmail.com>
1892
1893         Symbol should have [[Construct]] internal method
1894         https://bugs.webkit.org/show_bug.cgi?id=211050
1895
1896         Reviewed by Yusuke Suzuki.
1897
1898         * stress/is-constructor.js:
1899         * test262/expectations.yaml: Mark 2 test cases as passing.
1900
1901 2020-04-26  Alexey Shvayka  <shvaikalesh@gmail.com>
1902
1903         InternalFunction::createSubclassStructure should use newTarget's globalObject
1904         https://bugs.webkit.org/show_bug.cgi?id=202599
1905
1906         Reviewed by Yusuke Suzuki.
1907
1908         * stress/promise-proto-from-ctor-realm.js: Added.
1909         * test262/expectations.yaml: Mark 88 test cases as passing.
1910
1911 2020-04-26  Yusuke Suzuki  <ysuzuki@apple.com>
1912
1913         [JSC] ValueAdd, VaueSub, ValueMul, Inc, Dec should say SpecBigInt32 prediction based on ArithProfile
1914         https://bugs.webkit.org/show_bug.cgi?id=211038
1915
1916         Reviewed by Filip Pizlo.
1917
1918         * stress/bigint32-add-overflow.js: Added.
1919         (shouldBe):
1920         (add):
1921         (noInline):
1922         * stress/bigint32-dec-overflow.js: Added.
1923         (shouldBe):
1924         (dec):
1925         (noInline):
1926         * stress/bigint32-inc-overflow.js: Added.
1927         (shouldBe):
1928         (inc):
1929         (noInline):
1930         * stress/bigint32-mul-overflow.js: Added.
1931         (shouldBe):
1932         (mul):
1933         (noInline):
1934         * stress/bigint32-sub-overflow.js: Added.
1935         (shouldBe):
1936         (sub):
1937         (noInline):
1938
1939 2020-04-25  Yusuke Suzuki  <ysuzuki@apple.com>
1940
1941         [JSC] Handle BigInt32 INT32_MIN shift amount
1942         https://bugs.webkit.org/show_bug.cgi?id=211030
1943
1944         Reviewed by Darin Adler.
1945
1946         * stress/bigint-int32-min-shift.js: Added.
1947         (shouldBe):
1948         (shouldThrow):
1949
1950 2020-04-25  Yusuke Suzuki  <ysuzuki@apple.com>
1951
1952         [JSC] Add fast path for BigInt32 left-shift
1953         https://bugs.webkit.org/show_bug.cgi?id=211029
1954
1955         Reviewed by Saam Barati.
1956
1957         * stress/bigint-left-shift-overflow.js: Added.
1958         (shouldBe):
1959         (leftShift):
1960         (noInline):
1961         * stress/bigint-right-shift-large.js: Added.
1962         (shouldBe):
1963
1964 2020-04-25  Paulo Matos  <pmatos@igalia.com>
1965
1966         Skip stress/butterfly-zero-unused-butterfly-properties.js on MIPS
1967         https://bugs.webkit.org/show_bug.cgi?id=211016
1968
1969         Unreviewed Gardening.
1970
1971         * stress/butterfly-zero-unused-butterfly-properties.js:
1972
1973 2020-04-25  Ross Kirsling  <ross.kirsling@sony.com>
1974
1975         [Intl] Locale validation/canonicalization should defer to ICU
1976         https://bugs.webkit.org/show_bug.cgi?id=210853
1977
1978         Reviewed by Darin Adler.
1979
1980         * stress/intl-collator.js:
1981         * stress/intl-datetimeformat.js:
1982         * stress/intl-numberformat.js:
1983         * stress/intl-object.js:
1984         * stress/intl-pluralrules.js:
1985         * stress/intl-relativetimeformat.js:
1986         Adjust tests, since one of the two fixes in r260151 no longer applies
1987         (and certain sensitivities apply to older ICU versions).
1988
1989         * test262/expectations.yaml:
1990         Mark eight new passes, two new fails, and six changed failures.
1991         It is an unfortunate and baffling truth that the Intl tests of test262 are often not spec tests at all,
1992         but effectively ICU/CLDR regression tests. These are not carrots worth chasing.
1993
1994 2020-04-24  Alexey Shvayka  <shvaikalesh@gmail.com>
1995
1996         Fix WASM Error classes and re-sync wpt/wasm/jsapi from upstream
1997         https://bugs.webkit.org/show_bug.cgi?id=210980
1998
1999         Reviewed by Keith Miller.
2000
2001         * wasm/modules/js-wasm-cycle.js:
2002         * wasm/modules/wasm-wasm-cycle.js:
2003         * wasm/stress/too-many-locals.js:
2004
2005 2020-04-24  Saam Barati  <sbarati@apple.com>
2006
2007         Return BigInt32 whenever we can
2008         https://bugs.webkit.org/show_bug.cgi?id=210922
2009
2010         Reviewed by Yusuke Suzuki.
2011
2012         * microbenchmarks/sunspider-sha1-big-int.js: Added.
2013         (hex_sha1):
2014         (b64_sha1):
2015         (str_sha1):
2016         (hex_hmac_sha1):
2017         (b64_hmac_sha1):
2018         (str_hmac_sha1):
2019         (bigIntToInt32):
2020         (sha1_vm_test):
2021         (core_sha1):
2022         (sha1_ft):
2023         (sha1_kt):
2024         (core_hmac_sha1):
2025         (safe_add):
2026         (rol):
2027         (str2binb):
2028         (binb2hex):
2029         (binb2b64):
2030         (run):
2031
2032 2020-04-24  Yusuke Suzuki  <ysuzuki@apple.com>
2033
2034         [JSC] DFG compare should speculate BigInt well
2035         https://bugs.webkit.org/show_bug.cgi?id=210892
2036
2037         Reviewed by Saam Barati.
2038
2039         * stress/compare-bigint-with-number.js: Added.
2040         (shouldBe):
2041         (result):
2042         (lessThan):
2043         (lessThanEqual):
2044         (greaterThan):
2045         (greaterThanEqual):
2046         (equal):
2047         * stress/compare-bigint-with-string.js: Added.
2048         (shouldBe):
2049         (result):
2050         (lessThan):
2051         (lessThanEqual):
2052         (greaterThan):
2053         (greaterThanEqual):
2054         (equal):
2055         * stress/compare-bigint.js: Added.
2056         (shouldBe):
2057         (result):
2058         (lessThan):
2059         (lessThanEqual):
2060         (greaterThan):
2061         (greaterThanEqual):
2062         (equal):
2063         * stress/compare-bigint32.js: Added.
2064         (shouldBe):
2065         (result):
2066         (lessThan):
2067         (lessThanEqual):
2068         (greaterThan):
2069         (greaterThanEqual):
2070         (equal):
2071         * stress/compare-heap-bigint.js: Added.
2072         (shouldBe):
2073         (result):
2074         (lessThan):
2075         (lessThanEqual):
2076         (greaterThan):
2077         (greaterThanEqual):
2078         (equal):
2079         * stress/dfg-ai-fold-bigint.js: Added.
2080         (shouldBe):
2081         (allAreTrue):
2082         (allAreFalse):
2083         (lessThan):
2084         (lessThanFalse):
2085         (lessThanEqual):
2086         (lessThanEqualFalse):
2087         (greaterThan):
2088         (greaterThanFalse):
2089         (greaterThanEqual):
2090         (greaterThanEqualFalse):
2091         (equal):
2092         (equalFalse):
2093
2094 2020-04-24  Alexey Shvayka  <shvaikalesh@gmail.com>
2095
2096         Proxy.revocable should not have [[Construct]] slot
2097         https://bugs.webkit.org/show_bug.cgi?id=210959
2098
2099         Reviewed by Darin Adler.
2100
2101         * stress/proxy-revoke.js:
2102         * test262/expectations.yaml: Mark 2 test cases as passing.
2103
2104 2020-04-24  Yusuke Suzuki  <ysuzuki@apple.com>
2105
2106         [JSC] DFG AI for some bitops + BigInt32 should be precise
2107         https://bugs.webkit.org/show_bug.cgi?id=210956
2108
2109         Reviewed by Keith Miller.
2110
2111         * stress/bigint-bitops.js: Added.
2112         (shouldBe):
2113         (test):
2114
2115 2020-04-24  Paulo Matos  <pmatos@igalia.com>
2116
2117         Skip on ARM and MIPS stress/for-of-iterator-open* added at r260585
2118         https://bugs.webkit.org/show_bug.cgi?id=210961
2119
2120         Unreviewed Gardening.
2121
2122         * stress/for-of-iterator-open-osr-at-inlined-return-non-object.js:
2123         * stress/for-of-iterator-open-osr-at-iterator-set-local.js:
2124         * stress/for-of-iterator-open-return-non-object.js:
2125
2126 2020-04-23  Alexey Shvayka  <shvaikalesh@gmail.com>
2127
2128         Remove revoked Proxy checks from ProxyCreate
2129         https://bugs.webkit.org/show_bug.cgi?id=210862
2130
2131         Reviewed by Ross Kirsling.
2132
2133         Removes expectations for 2 invalid ChakraCore tests.
2134
2135         * ChakraCore.yaml: Mark 2 test cases as passing.
2136         * ChakraCore/test/es6/arraywithproxy.baseline: Removed.
2137         * ChakraCore/test/es6/proxytest9.baseline: Removed.
2138         * stress/proxy-revoke.js: Adjust test.
2139         * test262/expectations.yaml: Mark 12 test cases as passing.
2140
2141 2020-04-23  Ross Kirsling  <ross.kirsling@sony.com>
2142
2143         Unreviewed test262 gardening following r260591.
2144
2145         * test262/expectations.yaml:
2146         Fix expectations to reflect ICU 64.
2147
2148 2020-04-23 Alexey Shvayka <shvaikalesh@gmail.com>
2149
2150         Update test262 to commit 31dabb5618e2
2151         https://bugs.webkit.org/show_bug.cgi?id=210921
2152
2153         Reviewed by Ross Kirsling.
2154
2155         * test262/config.yaml: Skip "Atomics.waitAsync" feature.
2156         * test262/expectations.yaml:
2157         * test262/harness/*: Updated.
2158         * test262/latest-changes-summary.txt:
2159         * test262/test/*: Updated.
2160         * test262/test262-Revision.txt:
2161
2162 2020-04-23  Yusuke Suzuki  <ysuzuki@apple.com>
2163
2164         Reduce iteration count and change how it invokes GC to reduce execution time of JSTests/stress/delete-property-dfg-inline.js
2165         https://bugs.webkit.org/show_bug.cgi?id=210933
2166
2167         Reviewed by Keith Miller.
2168
2169         This test takes 7~ seconds in Release build with default run. And it takes 1 mins in several variants of JSC tests, which is too long.
2170         By analyzing this, we found that this takes very long time,
2171
2172             1. due to so frequent synchronous GC run
2173             2. due to large iteration count while function can get FTL with less counts
2174
2175         While ensuring all functions gets FTL, we reduce iteration count and GC invocations to reduce the execution time, the default run gets 200ms.
2176
2177         * stress/delete-property-dfg-inline.js:
2178         (noInline.blackbox.testSingleStructure):
2179         (noInline.testSingleStructure.testInlineSingleStructure):
2180         (noInline.testInlineSingleStructure.testExit):
2181         (noInline.testExit.testSingleStructureMiss):
2182         (noInline.testSingleStructureMiss.testSingleStructureMissStrict):
2183         (noInline.testSingleStructureMissStrict.testSingleStructureMissNonConfigurable):
2184         (noInline.testSingleStructureMissNonConfigurable.testSingleStructureEmpty):
2185         (noInline.testSingleStructureEmpty.testPolymorphic):
2186         (noInline.testPolymorphic.testPolyvariant):
2187         (noInline.testPolyvariant.testConstantFolding):
2188         (noInline.testConstantFolding.testObjectSinking):
2189         (noInline.testObjectSinking.testProxy):
2190         (noInline.testProxy.testTypedArray):
2191         (noInline.testTypedArray.testMissMixed):
2192         (noInline.testMissMixed.testMissNonMixed):
2193         (noInline.testMissNonMixed.testByVal.noInline.test):
2194         (noInline.testMissNonMixed.testByVal):
2195         (noInline.assert.assert_throws): Deleted.
2196
2197 2020-04-22  Keith Miller  <keith_miller@apple.com>
2198
2199         Fix OSR exiting/iterator object checks in for-of bytecodes
2200         https://bugs.webkit.org/show_bug.cgi?id=210882
2201
2202         Reviewed by Saam Barati.
2203
2204         * stress/for-of-iterator-next-osr-at-inlined-return-non-object.js: Added.
2205         (vendNext):
2206         (test):
2207         (catch):
2208         * stress/for-of-iterator-next-osr-at-next-set-local.js: Added.
2209         (vendNext):
2210         (test):
2211         (catch):
2212         * stress/for-of-iterator-open-osr-at-inlined-return-non-object.js: Added.
2213         (vendIterator):
2214         (test):
2215         (catch):
2216         * stress/for-of-iterator-open-osr-at-iterator-set-local.js: Added.
2217         (vendIterator):
2218         (test):
2219         (catch):
2220         * stress/for-of-iterator-open-return-non-object.js: Added.
2221         (vendIterator):
2222         (test):
2223         (i.catch):
2224         * stress/test-for-of-cfg-simplication-exit-ok.js: Added.
2225         (z.__proto__):
2226
2227 2020-04-23  Paulo Matos  <pmatos@igalia.com>
2228
2229         Skip stress/v8-bitint32-inc.js on mips
2230         https://bugs.webkit.org/show_bug.cgi?id=210906
2231
2232         Unreviewed Gardening.
2233
2234         * stress/v8-bigint32-inc.js:
2235
2236 2020-04-22  Yusuke Suzuki  <ysuzuki@apple.com>
2237
2238         [JSC] branchIfBigInt32 can use BigInt32Mask and remove branchIfNumber filter
2239         https://bugs.webkit.org/show_bug.cgi?id=210870
2240
2241         Reviewed by Saam Barati.
2242
2243         * stress/anybigintuse-should-filter-number-correctly.js: Added.
2244         (shouldBe):
2245         (test):
2246
2247 2020-04-22  Saam Barati  <sbarati@apple.com>
2248
2249         BigInt32 parsing should be precise
2250         https://bugs.webkit.org/show_bug.cgi?id=210869
2251
2252         Reviewed by Robin Morisset.
2253
2254         * stress/big-int-32-parsing-should-be-precise.js: Added.
2255
2256 2020-04-22  Yusuke Suzuki  <ysuzuki@apple.com>
2257
2258         [JSC] JSBigInt inc operation does not produce right HeapBigInt zero
2259         https://bugs.webkit.org/show_bug.cgi?id=210860
2260
2261         Reviewed by Mark Lam.
2262
2263         * stress/bigint-zero-canonicalized.js: Added.
2264         (shouldBe):
2265
2266 2020-04-22  Saam Barati  <sbarati@apple.com>
2267
2268         ValueBitNot is wrong in FTL with AnyBigIntUse
2269         https://bugs.webkit.org/show_bug.cgi?id=210846
2270
2271         Reviewed by Yusuke Suzuki.
2272
2273         * stress/big-int-value-bit-not-spec-any-big-int.js: Added.
2274         (assert):
2275         (foo):
2276
2277 2020-04-22  Yusuke Suzuki  <ysuzuki@apple.com>
2278
2279         [JSC] AI results of BigInt32 Bitwise shift operation does not match to runtime results
2280         https://bugs.webkit.org/show_bug.cgi?id=210839
2281
2282         Reviewed by Saam Barati.
2283
2284         * stress/v8-bigint32-add.js: Added.
2285         (main):
2286         * stress/v8-bigint32-and.js: Added.
2287         (main):
2288         * stress/v8-bigint32-dec.js: Added.
2289         (main):
2290         * stress/v8-bigint32-div.js: Added.
2291         (main):
2292         * stress/v8-bigint32-inc.js: Added.
2293         (main):
2294         * stress/v8-bigint32-mod.js: Added.
2295         (main):
2296         * stress/v8-bigint32-mul.js: Added.
2297         (main):
2298         * stress/v8-bigint32-neg.js: Added.
2299         (main):
2300         * stress/v8-bigint32-not.js: Added.
2301         (main):
2302         * stress/v8-bigint32-or.js: Added.
2303         (main):
2304         * stress/v8-bigint32-sar.js: Added.
2305         (main):
2306         * stress/v8-bigint32-shl.js: Added.
2307         (main):
2308         * stress/v8-bigint32-sub.js: Added.
2309         (main):
2310         * stress/v8-bigint32-xor.js: Added.
2311         (main):
2312
2313 2020-04-21  Yusuke Suzuki  <ysuzuki@apple.com>
2314
2315         [JSC] SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq should expect AnyBigIntUse
2316         https://bugs.webkit.org/show_bug.cgi?id=210832
2317
2318         Reviewed by Mark Lam.
2319
2320         * stress/heap-and-32-bigint-eq.js: Added.
2321         (shouldBe):
2322         * stress/heap-and-32-bigint-stricteq.js: Added.
2323         (shouldBe):
2324
2325 2020-04-21  Alexey Shvayka  <shvaikalesh@gmail.com>
2326
2327         constructObjectFromPropertyDescriptor() is incorrect with partial descriptors
2328         https://bugs.webkit.org/show_bug.cgi?id=184629
2329
2330         Reviewed by Ross Kirsling.
2331
2332         * test262/expectations.yaml: Mark 4 test cases as passing.
2333
2334 2020-04-21  Yusuke Suzuki  <ysuzuki@apple.com>
2335
2336         Move value-pow-ai-rule-should-box-the-same-way-as-the-runtime.js to JSTests/stress/
2337         https://bugs.webkit.org/show_bug.cgi?id=210805
2338
2339         Reviewed by Saam Barati.
2340
2341         r251408 accidentally puts value-pow-ai-rule-should-box-the-same-way-as-the-runtime.js in JSTests/ instead of JSTests/stress/.
2342         This patch fixes that.
2343
2344         * stress/value-pow-ai-rule-should-box-the-same-way-as-the-runtime.js: Renamed from JSTests/value-pow-ai-rule-should-box-the-same-way-as-the-runtime.js.
2345
2346 2020-04-21  Paulo Matos  <pmatos@igalia.com>
2347
2348         [ARMv7][EWS] stress/check-stack-overflow-before-value-profiling-arguments.js is failing
2349         https://bugs.webkit.org/show_bug.cgi?id=210720
2350
2351         Unreviewed gardening.
2352
2353         Skip test on arm since it is failing on EWS, causing significant delays.
2354
2355         * stress/check-stack-overflow-before-value-profiling-arguments.js:
2356
2357 2020-04-21  Paulo Matos  <pmatos@igalia.com>
2358
2359         Re-enable previously skipped mips tests
2360         https://bugs.webkit.org/show_bug.cgi?id=209964
2361
2362         Reviewed by Mark Lam.
2363
2364         Followup to r259454 - where we re-enabled a few stress tests for arm.
2365
2366         * stress/JSArrayBufferView-byteOffset-is-racy-from-compiler-thread.js:
2367         * stress/dont-range-based-iterate-vector-that-is-mutated.js:
2368         * stress/ensure-code-block-is-not-precise-allocation.js:
2369         * stress/generator-cell-with-type.js:
2370         * stress/racy-slow-put-cloned-arguments-when-having-a-bad-time.js:
2371         * stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js:
2372         * stress/toctou-having-a-bad-time-new-array.js:
2373
2374 2020-04-20  Yusuke Suzuki  <ysuzuki@apple.com>
2375
2376         [JSC] Import V8 BigInt tests generated by bigint-tester.py
2377         https://bugs.webkit.org/show_bug.cgi?id=210783
2378
2379         Reviewed by Ross Kirsling.
2380
2381         This patch adds BigInt tests generated by V8 bigint-tester.py, which is modified for JSC use.
2382
2383         * stress/v8-bigint-add.js: Added.
2384         * stress/v8-bigint-and.js: Added.
2385         * stress/v8-bigint-dec.js: Added.
2386         * stress/v8-bigint-div.js: Added.
2387         * stress/v8-bigint-inc.js: Added.
2388         * stress/v8-bigint-mod.js: Added.
2389         * stress/v8-bigint-mul.js: Added.
2390         * stress/v8-bigint-neg.js: Added.
2391         * stress/v8-bigint-not.js: Added.
2392         * stress/v8-bigint-or.js: Added.
2393         * stress/v8-bigint-sar.js: Added.
2394         * stress/v8-bigint-shl.js: Added.
2395         * stress/v8-bigint-sub.js: Added.
2396         * stress/v8-bigint-xor.js: Added.
2397
2398 2020-04-20  Yusuke Suzuki  <ysuzuki@apple.com>
2399
2400         [JSC] Skip test262 for non-safe-integer range BigIntConstructor
2401         https://bugs.webkit.org/show_bug.cgi?id=210749
2402
2403         Reviewed by Keith Miller.
2404
2405         We skip test262 test/built-ins/BigInt/constructor-integer.js for now. As it is shown in old test262 JSTests/test262/expectations.yaml,
2406         this test was failing before BigInt flag is enabled. And new BigInt patch changes error message while we are failing in the same way.
2407         While we implemented BigInt, this test is based on spec change introduced[1], and we are not implementing this. So we mark it skipped,
2408         as it is skipped before BigInt is enabled.
2409
2410         [1]: https://github.com/tc39/proposal-bigint/pull/138
2411
2412         * test262/config.yaml:
2413
2414 2020-04-20  Keith Miller  <keith_miller@apple.com>
2415
2416         Unreviewed, revert accidental test changes.
2417
2418         * microbenchmarks/for-of-iterate-array-entries.js:
2419         (foo):
2420
2421 2020-04-20  Paulo Matos  <pmatos@igalia.com>
2422
2423         [32-bits] stress/for-of-array-different-globals.js is failing
2424         https://bugs.webkit.org/show_bug.cgi?id=210718
2425
2426         Unreviewed gardening.
2427
2428         Skip test for arm and mips, failing due to r260323
2429
2430         * stress/for-of-array-different-globals.js:
2431
2432 2020-04-19  Ross Kirsling  <ross.kirsling@sony.com>
2433
2434         [ECMA-402] Intl.RelativeTimeFormat missing in WebKit
2435         https://bugs.webkit.org/show_bug.cgi?id=209770
2436
2437         Reviewed by Darin Adler.
2438
2439         * stress/intl-relativetimeformat.js: Added.
2440
2441         * test262/config.yaml:
2442         Enable Intl.RelativeTimeFormat feature with flag.
2443
2444         * test262/expectations.yaml:
2445         Mark known failures.
2446         Test for locale validation is not specific to RelativeTimeFormat and should be investigated separately.
2447         Tests for Polish appear to be wrong and should be corrected in test262.
2448
2449 2020-04-18  Keith Miller  <keith_miller@apple.com>
2450
2451         Unreviewed, mark test passing.
2452
2453         * test262/expectations.yaml:
2454
2455 2020-04-18  Robin Morisset  <rmorisset@apple.com>
2456
2457         Support an inlined representation in JSValue of small BigInts ("BigInt32")
2458         https://bugs.webkit.org/show_bug.cgi?id=206182
2459
2460         Reviewed by Yusuke Suzuki.
2461
2462         I improved several of the tests to give more informative error messages in the process of fixing them.
2463
2464         More interestingly I had to modify "missing-exception-check-in-string-compare" because it relied on "s1 == s1" resolving ropes, and we now just return true.
2465
2466         * stress/big-int-division.js:
2467         (testDiv):
2468         * stress/big-int-left-shift-wrapped-value.js:
2469         (assert.sameValue):
2470         * stress/big-int-logical-not.js:
2471         (assert):
2472         * stress/big-int-mod-jit.js:
2473         * stress/big-int-right-shift-general.js:
2474         (testRightShift):
2475         * stress/big-int-type-of-proven-type.js:
2476         (assert):
2477         * stress/compare-strict-eq-on-various-types.js:
2478         (testAllTypesCall):
2479         * stress/ftl-string-strict-equality.js:
2480         * stress/missing-exception-check-in-string-compare.js:
2481
2482 2020-04-18  Keith Miller  <keith_miller@apple.com>
2483
2484         Redesign how we do for-of iteration for JSArrays
2485         https://bugs.webkit.org/show_bug.cgi?id=175454
2486
2487         Reviewed by Filip Pizlo.
2488
2489         * microbenchmarks/for-of-iterate-array-entries.js:
2490         (foo):
2491         * stress/custom-iterators.js:
2492         (catch):
2493         (iter.return):
2494         (iteratorInterfaceErrorTest):
2495         (iteratorInterfaceErrorTestReturn):
2496         (iteratorInterfaceBreakTestReturn):
2497         * stress/for-of-array-different-globals.js: Added.
2498         (foo):
2499         (array.Symbol.iterator.__proto__.next):
2500         * stress/for-of-array-mixed-values.js: Added.
2501         (test):
2502         * stress/for-of-no-direct-loop-back-edge-osr.js: Added.
2503         (osrIfFinalTier):
2504         (test):
2505         * stress/generator-containing-for-of-on-map.js: Added.
2506         (find):
2507         (i.let.v.of.find):
2508         * stress/generator-containing-for-of-on-set.js: Added.
2509         (find):
2510         (set add):
2511         * stress/osr-from-for-of-done-getter.js: Added.
2512         (i.let.iterable.next.return.get done):
2513         (i.let.iterable.next):
2514         (i.let.iterable.Symbol.iterator):
2515         (i.let.iterable.return):
2516         * stress/osr-from-for-of-value-getter.js: Added.
2517         (i.let.iterable.next.return.get value):
2518         (i.let.iterable.next):
2519         (i.let.iterable.Symbol.iterator):
2520         (i.let.iterable.return):
2521         * stress/throw-for-of-next-returns-non-object.js: Added.
2522         (i.let.iterable.next):
2523         (i.let.iterable.Symbol.iterator):
2524         (i.let.iterable.return):
2525         (i.catch):
2526         * stress/throw-from-done-getter-in-for-of-header.js: Added.
2527         (i.let.iterable.next):
2528         (i.let.iterable.get done):
2529         (i.let.iterable.Symbol.iterator):
2530         (i.let.iterable.return):
2531         (i.catch):
2532         * stress/throw-from-next-in-for-of-header.js: Added.
2533         (i.let.iterable.next):
2534         (i.let.iterable.Symbol.iterator):
2535         (i.let.iterable.return):
2536         (i.catch):
2537         * stress/throw-from-value-getter-in-for-of-header.js: Added.
2538         (i.let.iterable.next):
2539         (i.let.iterable.get value):
2540         (i.let.iterable.Symbol.iterator):
2541         (i.let.iterable.return):
2542         (i.catch):
2543         * stress/webidl-tokenizer-for-of.js: Added.
2544         (tokenise.attemptTokenMatch):
2545         (tokenise):
2546         (Tokeniser):
2547         (Tokeniser.prototype.probe):
2548         (Tokeniser.prototype.consume):
2549         (Tokeniser.prototype.unconsume):
2550
2551 2020-04-18  Alexey Shvayka  <shvaikalesh@gmail.com>
2552
2553         RegExp.prototype[@@search] should use SameValue
2554         https://bugs.webkit.org/show_bug.cgi?id=173226
2555
2556         Reviewed by Yusuke Suzuki.
2557
2558         * stress/same-value-intrinsic.js: Added.
2559         * test262/expectations.yaml: Mark 4 test cases as passing.
2560
2561 2020-04-17  Saam Barati  <sbarati@apple.com>
2562
2563         GetTypedArrayByteOffset is broken on arm64e
2564         https://bugs.webkit.org/show_bug.cgi?id=210631
2565
2566         Reviewed by Mark Lam.
2567
2568         * stress/byte-offset-on-wasteful-neutered-arm64e.js: Added.
2569         (foo):
2570         (assert):
2571         (transferArrayBuffer.array.buffer):
2572
2573 2020-04-17  Devin Rousso  <drousso@apple.com>
2574
2575         Rename NullishEq / NULLISHEQUAL to CoalesceEq / COALESCEEQUAL to match the spec
2576         https://bugs.webkit.org/show_bug.cgi?id=210663
2577
2578         Reviewed by Ross Kirsling.
2579
2580         * stress/logical-assignment-operator-coalesce.js: Renamed from stress/logical-assignment-operator-nullish.js.
2581
2582 2020-04-17  Devin Rousso  <drousso@apple.com>
2583
2584         Implement Promise.any and AggregateError
2585         https://bugs.webkit.org/show_bug.cgi?id=202566
2586
2587         Reviewed by Yusuke Suzuki.
2588
2589         * test262/config.yaml:
2590         * test262/expectations.yaml:
2591
2592 2020-04-17  Paulo Matos  <pmatos@igalia.com>
2593
2594         Reduce test iterations for stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js on mips
2595         https://bugs.webkit.org/show_bug.cgi?id=210641
2596
2597         Reviewed by Yusuke Suzuki.
2598
2599         Reduce test iteration count on mips for which the current value is too high.
2600
2601         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
2602
2603 2020-04-17  Yusuke Suzuki  <ysuzuki@apple.com>
2604
2605         [JSC] Map/Set iterator creation functions should fail with BadType etc. before executing insertChecks
2606         https://bugs.webkit.org/show_bug.cgi?id=210649
2607         <rdar://problem/61925452>
2608
2609         Reviewed by Mark Lam.
2610
2611         * stress/map-iterator-check-before-fail.js: Added.
2612         (test):
2613         * stress/set-iterator-check-before-fail.js: Added.
2614         (set new):
2615         (set var):
2616
2617 2020-04-16  Ross Kirsling  <ross.kirsling@sony.com>
2618
2619         REGRESSION(r259480): Two new failing i18n tests
2620         https://bugs.webkit.org/show_bug.cgi?id=210605
2621
2622         Reviewed by Darin Adler.
2623
2624         * stress/date-toLocaleString.js:
2625         Tests shouldn't rely on system default time zone.
2626
2627 2020-04-16  Yusuke Suzuki  <ysuzuki@apple.com>
2628
2629         Unreviewed, reduce # of iteration since this test is timed out in slow devices
2630         https://bugs.webkit.org/show_bug.cgi?id=210023
2631
2632         * stress/map-iteration-oas.js:
2633
2634 2020-04-16  Yusuke Suzuki  <ysuzuki@apple.com>
2635
2636         [JSC] Implement JSMapIterator/JSSetIterator with JSInternalFieldObjectImpl
2637         https://bugs.webkit.org/show_bug.cgi?id=210023
2638
2639         Reviewed by Keith Miller.
2640
2641         * stress/map-iteration-oas.js: Added.
2642         (shouldBe):
2643         (test):
2644         * stress/map-iterator-creation-fail-dfg.js: Added.
2645         (shouldThrow):
2646         (test2):
2647         (test3):
2648         * stress/map-iterator-creation-fail.js: Added.
2649         (shouldThrow):
2650         (i.shouldThrow):
2651         (test2):
2652         (test3):
2653         * stress/set-iteration-oas.js: Added.
2654         (shouldBe):
2655         * stress/set-iterator-creation-fail-dfg.js: Added.
2656         (shouldThrow):
2657         (set shouldThrow):
2658         * stress/set-iterator-creation-fail.js: Added.
2659         (shouldThrow):
2660         (i.shouldThrow):
2661         (test2):
2662         (test3):
2663
2664 2020-04-15  Ross Kirsling  <ross.kirsling@sony.com>
2665
2666         [ECMA-402] Extension values should default to true, canonicalize without "-true"
2667         https://bugs.webkit.org/show_bug.cgi?id=210457
2668
2669         Reviewed by Yusuke Suzuki.
2670
2671         * stress/intl-collator.js:
2672         * stress/intl-datetimeformat.js:
2673         * stress/intl-numberformat.js:
2674         * stress/intl-object.js:
2675         * stress/intl-pluralrules.js:
2676         Fix tests.
2677
2678         * test262/expectations.yaml:
2679         Mark two test cases as passing.
2680
2681 2020-04-15  Justin Michaud  <justin@justinmichaud.com>
2682
2683         stress/delete-property-dfg-inline.js.ftl-no-cjit-small-pool consistently timing out on debug JSC bot
2684         https://bugs.webkit.org/show_bug.cgi?id=210513
2685
2686         Reviewed by Saam Barati.
2687
2688         * stress/delete-property-dfg-inline.js:
2689
2690 2020-04-15  Ross Kirsling  <ross.kirsling@sony.com>
2691
2692         [ECMA-402] Fix Intl.DateTimeFormat patterns and fields in WebKit
2693         https://bugs.webkit.org/show_bug.cgi?id=209783
2694
2695         Reviewed by Keith Miller.
2696
2697         * stress/date-toLocaleString.js:
2698         * stress/intl-datetimeformat.js:
2699         Add tests and fix some existing ones.
2700
2701         * test262/config.yaml:
2702         * test262/expectations.yaml:
2703         Mark eight test cases passing...but skip half of them due to outdated CLDR data in macOS system ICU.
2704
2705 2020-04-15  Devin Rousso  <drousso@apple.com>
2706
2707         [ESNext] Implement logical assignment operators
2708         https://bugs.webkit.org/show_bug.cgi?id=209716
2709
2710         Reviewed by Ross Kirsling.
2711
2712         * stress/logical-assignment-operator-and.js: Added.
2713         * stress/logical-assignment-operator-nullish.js: Added.
2714         * stress/logical-assignment-operator-or.js: Added.
2715
2716         * test262/config.yaml:
2717         * test262/expectations.yaml:
2718         Right now, test262 expects an early error to be thrown if the lhs is not simple, which does
2719         not match what we do with other read-modify assignment operators. This is likely to change
2720         in the future to match existing behavior (throw a `ReferenceError`) [1].
2721
2722         [1]: <https://github.com/tc39/ecma262/issues/257#issuecomment-502878708>
2723
2724 2020-04-14  Saam Barati  <sbarati@apple.com>
2725
2726         Skip all low executable memory wasm tests on arm64
2727         https://bugs.webkit.org/show_bug.cgi?id=210522
2728
2729         Reviewed by Tadeu Zagallo.
2730
2731         In my original JIT islands patch, I only skipped one of the "low executable
2732         memory" tests. But the others are also causing problems on the iOS JSC test
2733         runners, so let's just skip them all.
2734
2735         * wasm/lowExecutableMemory/exports-oom.js:
2736         * wasm/lowExecutableMemory/imports-oom.js:
2737
2738 2020-04-14  Yusuke Suzuki  <ysuzuki@apple.com>
2739
2740         Unreviewed, reduce iteration count and introduce early return to make typed-array-subarray-can-throw-oom-error.js execution time short while throwing an error
2741         https://bugs.webkit.org/show_bug.cgi?id=210507
2742
2743         * stress/typed-array-subarray-can-throw-oom-error.js:
2744         (canThrow):
2745         (bar):
2746         (get bar):
2747
2748 2020-04-13  Michael Saboff  <msaboff@apple.com>
2749
2750         [YARR] Allow for Unicode named capture group identifiers in non-Unicode regular expressions
2751         https://bugs.webkit.org/show_bug.cgi?id=210309
2752
2753         Reviewed by Ross Kirsling.
2754
2755         * stress/regexp-named-capture-groups.js: New test added.
2756         (shouldBe):
2757         (shouldThrowInvalidGroupSpecifierName):
2758         * test262/expectations.yaml: Updated for now failing tests.
2759         When test262 gets updated for this change, this can be reverted.
2760
2761 2020-04-12  Ross Kirsling  <ross.kirsling@sony.com>
2762
2763         [ECMA-402] WebKit Intl does not allow calendar and numberingSystem options
2764         https://bugs.webkit.org/show_bug.cgi?id=209784
2765
2766         Reviewed by Myles C. Maxfield.
2767
2768         * stress/intl-datetimeformat.js:
2769         Fix two test cases for old behavior.
2770
2771         * test262/expectations.yaml:
2772         Mark 16 test cases as passing.
2773
2774 2020-04-10  Ross Kirsling  <ross.kirsling@sony.com>
2775
2776         [ECMA-402] Properly implement BigInt.prototype.toLocaleString
2777         https://bugs.webkit.org/show_bug.cgi?id=209782
2778
2779         Reviewed by Darin Adler.
2780
2781         * stress/bigint-toLocaleString.js: Added.
2782         * stress/intl-numberformat.js: Add test cases.
2783         * test262/expectations.yaml: Mark 10 test cases as passing.
2784
2785 2020-04-10  Ross Kirsling  <ross.kirsling@sony.com>
2786
2787         Unreviewed gardening for JSTests/stress. Remove skips that were forgotten in r259658.
2788
2789         * stress/array-toLocaleString.js:
2790         * stress/date-toLocaleString.js:
2791         * stress/number-toLocaleString.js:
2792         * stress/string-localeCompare.js:
2793         * stress/string-toLocaleLowerCase.js:
2794         * stress/string-toLocaleUpperCase.js:
2795
2796 2020-04-10  Devin Rousso  <drousso@apple.com>
2797
2798         The rhs in `ReadModifyResolveNode` should be evaluated before throwing an exception if the lhs is read-only
2799         https://bugs.webkit.org/show_bug.cgi?id=210317
2800
2801         Reviewed by Ross Kirsling.
2802
2803         * stress/const-read-modify-assignment-eval-rhs-before-exception.js: Added.
2804
2805 2020-04-09  Yusuke Suzuki  <ysuzuki@apple.com>
2806
2807         [JSC] ModuleEnvironment do not have JSGlobalLexicalEnvironment as its upper scope
2808         https://bugs.webkit.org/show_bug.cgi?id=193347
2809
2810         Reviewed by Tadeu Zagallo.
2811
2812         * stress/global-lexical-environment-access-from-module.js: Added.
2813         (shouldBe):
2814         (import.string_appeared_here.then):
2815         * stress/resources/global-lexical-environment-access-from-module-child.js: Added.
2816         (export.read):
2817         (export.write):
2818
2819 2020-04-09  Yusuke Suzuki  <ysuzuki@apple.com>
2820
2821         Unreviewed, skip JSTests/stress/intl-canonicalize-locale-list-error-oom.js if memoryLimited
2822         <rdar://problem/61533598>
2823
2824         * stress/intl-canonicalize-locale-list-error-oom.js:
2825
2826 2020-04-09  Alexey Shvayka  <shvaikalesh@gmail.com>
2827
2828         ProxyObject::defineOwnProperty() should conditionally throw on falsy trap result
2829         https://bugs.webkit.org/show_bug.cgi?id=210267
2830
2831         Reviewed by Ross Kirsling.
2832
2833         * test262/expectations.yaml: Mark 2 test cases as passing.
2834
2835 2020-04-09  Saam Barati  <sbarati@apple.com>
2836
2837         We can still cache delete in strict mode as long as the property is not "non-configurable"
2838         https://bugs.webkit.org/show_bug.cgi?id=210148
2839
2840         Reviewed by Tadeu Zagallo.
2841
2842         * microbenchmarks/delete-cache-strict-mode.js: Added.
2843         (assert):
2844         (doDel):
2845         (doDelByVal):
2846
2847 2020-04-09  Alexey Shvayka  <shvaikalesh@gmail.com>
2848
2849         getOwnPropertyDescriptor() is incorrect with Proxy of exotic object
2850         https://bugs.webkit.org/show_bug.cgi?id=200560
2851
2852         Reviewed by Yusuke Suzuki.
2853
2854         * test262/expectations.yaml: Mark 14 test cases as passing.
2855
2856 2020-04-08  Yusuke Suzuki  <ysuzuki@apple.com>
2857
2858         [JSC] MultiDeleteByOffset should tell correct result AbstractValue in AI
2859         https://bugs.webkit.org/show_bug.cgi?id=210175
2860         <rdar://problem/61433817>
2861
2862         Reviewed by Saam Barati.
2863
2864         * stress/multi-delete-by-offset-ai-result.js: Added.
2865         (foo):
2866
2867 2020-04-07  Yusuke Suzuki  <ysuzuki@apple.com>
2868
2869         [JSC] Collect-continuously thread should take m_collectContinuouslyLock while it is waking up concurrent collector thread
2870         https://bugs.webkit.org/show_bug.cgi?id=210163
2871
2872         Reviewed by Saam Barati.
2873
2874         * stress/collect-continuously-should-not-wake-concurrent-collector-after-prevent-collection-is-called.js: Added.
2875         (let.theCode):
2876
2877 2020-04-07  Saam Barati  <sbarati@apple.com>
2878
2879         Delete ICs can't cache dictionaries
2880         https://bugs.webkit.org/show_bug.cgi?id=210147
2881         <rdar://problem/61382405>
2882
2883         Reviewed by Tadeu Zagallo.
2884
2885         * stress/dont-cache-delete-ic-on-dictionary-2.js: Added.
2886         (assert):
2887         (makeDictionary):
2888         (foo):
2889         * stress/dont-cache-delete-ic-on-dictionary.js: Added.
2890         (assert):
2891         (foo):
2892
2893 2020-04-07  Tadeu Zagallo  <tzagallo@apple.com>
2894
2895         Not using strict mode within ClassDeclaration statement
2896         https://bugs.webkit.org/show_bug.cgi?id=205578
2897         <rdar://problem/58194589>
2898
2899         Reviewed by Yusuke Suzuki.
2900
2901         * stress/inline-strict-delete.js: Added.
2902         (assert):
2903         (bar):
2904         (foo):
2905         * stress/superclass-expression-strictness.js: Added.
2906         (f.try.c):
2907         (f):
2908
2909 2020-04-07  Alexey Shvayka  <shvaikalesh@gmail.com>
2910
2911         test262/Runner.pm ignores "async" flag
2912         https://bugs.webkit.org/show_bug.cgi?id=210127
2913
2914         Reviewed by Ross Kirsling.
2915
2916         * test262/expectations.yaml: Mark 56 test cases as failing.
2917
2918 2020-04-07  Ross Kirsling  <ross.kirsling@sony.com>
2919
2920         Update JSTests to assume ICU 60+
2921         https://bugs.webkit.org/show_bug.cgi?id=210085
2922
2923         Reviewed by Yusuke Suzuki.
2924
2925         * stress/intl-collator.js:
2926         * stress/intl-constructors-with-proxy.js:
2927         * stress/intl-datetimeformat.js:
2928         * stress/intl-default-locale.js:
2929         * stress/intl-numberformat-format-to-parts.js:
2930         * stress/intl-numberformat.js: Ensure a test case doesn't depend on behavior changed in ICU 64.
2931         * stress/intl-object.js:
2932         * stress/intl-pluralrules.js: Correct two invalid test cases.
2933         * test262/config.yaml:
2934         Remove skips.
2935
2936 2020-04-07  Yusuke Suzuki  <ysuzuki@apple.com>
2937
2938         [JSC] ScopedArgumentsTable should handle OOM in tolerant manner
2939         https://bugs.webkit.org/show_bug.cgi?id=210126
2940
2941         Reviewed by Mark Lam.
2942
2943         * stress/scoped-arguments-table-should-be-tolerant-for-oom.js: Added.
2944         (canThrow):
2945         (bar):
2946         (get bar):
2947         (foo):
2948         (i.canThrow):
2949
2950 2020-04-07  Yusuke Suzuki  <ysuzuki@apple.com>
2951
2952         [JSC] Inlined IC should get right JSGlobalObject
2953         https://bugs.webkit.org/show_bug.cgi?id=210092
2954
2955         Reviewed by Tadeu Zagallo.
2956
2957         * stress/getter-setter-globalobject-in-ic.js: Added.
2958         (shouldBe):
2959         (valueFunc):
2960         (accessorFunc):
2961         (valueTest):
2962         (accessorTest):
2963
2964 2020-04-07  Yusuke Suzuki  <ysuzuki@apple.com>
2965
2966         [JSC] $.evalScript should check exception when accessing "global"
2967         https://bugs.webkit.org/show_bug.cgi?id=210114
2968         <rdar://problem/61388482>
2969
2970         Reviewed by Keith Miller.
2971
2972         * stress/eval-script-global-access-exception-check.js: Added.
2973         (shouldThrow):
2974
2975 2020-04-06  Rick Waldron  <waldron.rick@gmail.com> and Alexey Shvayka  <shvaikalesh@gmail.com>
2976
2977         Remove unnecessary Test262 harness file and implement $262.IsHTMLDDA
2978         https://bugs.webkit.org/show_bug.cgi?id=187526
2979
2980         Reviewed by Darin Adler.
2981
2982         * stress/optional-chaining.js: Adjust test for callable masquerader.
2983
2984 2020-04-06  Justin Michaud  <justin_michaud@apple.com>
2985
2986         Allow deleteById to be cached in the DFG
2987         https://bugs.webkit.org/show_bug.cgi?id=208664
2988
2989         Reviewed by Saam Barati.
2990
2991         * microbenchmarks/delete-property-allocation-sinking.js: Added.
2992         (assert):
2993         (noInline.assert.blackbox):
2994         (noInline.blackbox.doAlloc1):
2995         (noInline.doAlloc1):
2996         * microbenchmarks/polyvariant-delete-property.js: Added.
2997         (assert):
2998         (blackbox):
2999         (noInline.blackbox.polyvariant):
3000         (doAlloc1):
3001         (noInline.doAlloc1.doAlloc2):
3002         (noInline.doAlloc2):
3003         * stress/delete-property-dfg-inline.js: Added.
3004         (assert):
3005         (noInline.assert.assert_throws):
3006         (noInline.assert_throws.blackbox):
3007         (noInline.blackbox.testSingleStructure.doAlloc1):
3008         (noInline.blackbox.testSingleStructure):
3009         (noInline.testSingleStructure.testInlineSingleStructure.doDelete2):
3010         (noInline.testSingleStructure.testInlineSingleStructure.doAlloc2):
3011         (noInline.testSingleStructure.testInlineSingleStructure):
3012         (noInline.testInlineSingleStructure.testExit.doDelete3):
3013         (noInline.testInlineSingleStructure.testExit):
3014         (noInline.testExit.testSingleStructureMiss.doAlloc4):
3015         (noInline.testExit.testSingleStructureMiss):
3016         (noInline.testSingleStructureMiss.testSingleStructureMissStrict.string_appeared_here.doAlloc5):
3017         (noInline.testSingleStructureMiss.testSingleStructureMissStrict):
3018         (noInline.testSingleStructureMissStrict.testSingleStructureMissNonConfigurable.doAlloc6):
3019         (noInline.testSingleStructureMissStrict.testSingleStructureMissNonConfigurable):
3020         (noInline.testSingleStructureMissNonConfigurable.testSingleStructureEmpty.doAlloc7):
3021         (noInline.testSingleStructureMissNonConfigurable.testSingleStructureEmpty):
3022         (noInline.testSingleStructureEmpty.testPolymorphic.doDelete8):
3023         (noInline.testSingleStructureEmpty.testPolymorphic):
3024         (noInline.testPolymorphic.testPolyvariant.doDelete9):
3025         (noInline.testPolymorphic.testPolyvariant.polyvariant):
3026         (noInline.testPolymorphic.testPolyvariant):
3027         (noInline.testPolyvariant.testConstantFolding.doDelete10):
3028         (noInline.testPolyvariant.testConstantFolding):
3029         (noInline.testConstantFolding.testObjectSinking.doAlloc11):
3030         (noInline.testConstantFolding.testObjectSinking):
3031         (noInline.testObjectSinking.testProxy.doAlloc12):
3032         (noInline.testObjectSinking.testProxy.noInline.doDelete12):
3033         (noInline.testObjectSinking.testProxy):
3034         (noInline.testProxy.testTypedArray.doDelete12):
3035         (noInline.testProxy.testTypedArray):
3036         (noInline.testTypedArray.testMissMixed.doDelete13):
3037         (noInline.testTypedArray.testMissMixed):
3038         (noInline.testMissMixed.testMissNonMixed.doDelete14):
3039         (noInline.testMissMixed.testMissNonMixed):
3040         (noInline.testMissNonMixed.testByVal.doDelete15):
3041         (noInline.testMissNonMixed.testByVal):
3042
3043 2020-04-06  Saam Barati  <sbarati@apple.com>
3044
3045         Implement 1GB of executable memory on arm64
3046         https://bugs.webkit.org/show_bug.cgi?id=208490
3047         <rdar://problem/60797127>
3048
3049         Reviewed by Keith Miller.
3050
3051         Run JetStream2 wasm tests.
3052
3053         * wasm.yaml:
3054         * wasm/lowExecutableMemory/executable-memory-oom.js:
3055
3056 2020-04-06  Yusuke Suzuki  <ysuzuki@apple.com>
3057
3058         [JSC] Since ArrayBufferViewWatchpointAdaptor::add can fire watchpoints, DFG::Plan should check validity of CodeBlock after executing reallyAdd
3059         https://bugs.webkit.org/show_bug.cgi?id=210055
3060         <rdar://problem/61331962>
3061
3062         Reviewed by Keith Miller.
3063
3064         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js: Added.
3065         (xxx.foo):
3066
3067 2020-04-05  Ross Kirsling  <ross.kirsling@sony.com>
3068
3069         JSC shell shouldn't treat NUL as a terminator when printing a JS string
3070         https://bugs.webkit.org/show_bug.cgi?id=210037
3071
3072         Reviewed by Darin Adler.
3073
3074         * .gitattributes:
3075         * ChakraCore.yaml:
3076         * ChakraCore/test/es5/hasItem.baseline-jsc: Added.
3077         Update baseline and mark it diffable (as plaintext) in spite of containing \0.
3078
3079 2020-04-05  Alexey Shvayka  <shvaikalesh@gmail.com>
3080
3081         Octal escapes should be max 3 digits and syntax errors in Unicode patterns
3082         https://bugs.webkit.org/show_bug.cgi?id=167067
3083
3084         Reviewed by Ross Kirsling.
3085
3086         * test262/expectations.yaml: Mark 4 test cases as passing.
3087
3088 2020-04-04  Alexey Shvayka  <shvaikalesh@gmail.com>
3089
3090         '\u' should throw an early SyntaxError exception, but instead evaluates to 'u'
3091         https://bugs.webkit.org/show_bug.cgi?id=198790
3092
3093         Reviewed by Yusuke Suzuki.
3094
3095         * mozilla/ecma/Array/15.4.5.1-1.js:
3096         * mozilla/ecma/LexicalConventions/7.7.4.js:
3097         * test262/expectations.yaml: Mark 4 test cases as passing.
3098
3099 2020-04-04  Yusuke Suzuki  <ysuzuki@apple.com>
3100
3101         Unreviewed, skip stress/typed-array-subarray-can-throw-oom-error.js on memory-limited archs, and mark it slow
3102         https://bugs.webkit.org/show_bug.cgi?id=209974
3103
3104         * stress/typed-array-subarray-can-throw-oom-error.js:
3105
3106 2020-04-04  Mark Lam  <mark.lam@apple.com>
3107
3108         Gardening: skip test for ARMv7 and MIPS to green the bots until the failure can be investigated.
3109         https://bugs.webkit.org/show_bug.cgi?id=210003
3110
3111         Not reviewed.
3112
3113         * stress/typed-array-subarray-can-throw-oom-error.js:
3114
3115 2020-04-03  Alexey Shvayka  <shvaikalesh@gmail.com>
3116
3117         Update test262 to commit 62b8fce38971
3118         https://bugs.webkit.org/show_bug.cgi?id=209979
3119
3120         Reviewed by Ross Kirsling.
3121
3122         * .gitattributes: Added.
3123         * test262/config.yaml: Skip "logical-assignment-operators" and "Promise.any" features.
3124         * test262/expectations.yaml:
3125         * test262/harness/*: Updated.
3126         * test262/latest-changes-summary.txt:
3127         * test262/test/*: Updated.
3128         * test262/test262-Revision.txt:
3129
3130 2020-04-03  Yusuke Suzuki  <ysuzuki@apple.com>
3131
3132         [JSC] canonicalizeLocaleList should gracefully throw OOM error if input + error message is too large
3133         https://bugs.webkit.org/show_bug.cgi?id=209971
3134         <rdar://problem/61258621>
3135
3136         Reviewed by Mark Lam.
3137
3138         * stress/intl-canonicalize-locale-list-error-oom.js: Added.
3139         (shouldThrow):
3140
3141 2020-04-03  Ross Kirsling  <ross.kirsling@sony.com>
3142
3143         Move Intl tests from LayoutTests to JSTests
3144         https://bugs.webkit.org/show_bug.cgi?id=209922
3145
3146         Reviewed by Yusuke Suzuki.
3147
3148         Intl doesn't depend on WebCore, so these tests shouldn't be layout tests.
3149         (They do, however, require one method to be added to $vm.)
3150
3151         Since LayoutTests/js has its own test harness, I've also migrated each test case to use simpler assertions.
3152
3153         * stress/array-to-locale-string.js: Removed -- subsumed by the following test.
3154         * stress/array-toLocaleString.js: Added.
3155         * stress/date-toLocaleString.js: Added.
3156         * stress/intl-collator.js: Added.
3157         * stress/intl-datetimeformat.js: Added.
3158         * stress/intl-default-locale.js: Added.
3159         * stress/intl-numberformat-format-to-parts.js: Added.
3160         * stress/intl-numberformat.js: Added.
3161         * stress/intl-object.js: Added.
3162         * stress/intl-pluralrules.js: Added.
3163         * stress/number-toLocaleString.js: Added.
3164         * stress/string-localeCompare.js: Added.
3165         * stress/string-toLocaleLowerCase.js: Added.
3166         * stress/string-toLocaleUpperCase.js: Added.
3167
3168 2020-04-03  Yusuke Suzuki  <ysuzuki@apple.com>
3169
3170         [JSC] TypedArray#subarray should throw OOM error gracefully
3171         https://bugs.webkit.org/show_bug.cgi?id=209974
3172         <rdar://problem/61253901>
3173
3174         Reviewed by Mark Lam.
3175
3176         * stress/typed-array-subarray-can-throw-oom-error.js: Added.
3177         (foo):
3178         (canThrow):
3179         (bar):
3180         (get bar):
3181
3182 2020-04-03  Paulo Matos  <pmatos@igalia.com>
3183
3184         Re-enable previously skipped arm tests
3185         https://bugs.webkit.org/show_bug.cgi?id=209958
3186
3187         Reviewed by Adrian Perez de Castro.
3188
3189         In the past year, some arm tests were skipped to keep the bots green.
3190         All known issues affecting these tests were fixed and now can be unskipped.
3191
3192         * stress/JSArrayBufferView-byteOffset-is-racy-from-compiler-thread.js:
3193         * stress/dont-range-based-iterate-vector-that-is-mutated.js:
3194         * stress/generator-cell-with-type.js:
3195         * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js:
3196         * stress/racy-slow-put-cloned-arguments-when-having-a-bad-time.js:
3197         * stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js:
3198         * stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js:
3199         * stress/toctou-having-a-bad-time-new-array.js:
3200
3201 2020-04-03  Paulo Matos  <pmatos@igalia.com>
3202
3203         stress/ftl-gettypedarrayoffset-wasteful.js times out on arm/linux
3204         https://bugs.webkit.org/show_bug.cgi?id=198754
3205
3206         Reviewed by Žan Doberšek.
3207
3208         Unskip test.
3209
3210         * stress/ftl-gettypedarrayoffset-wasteful.js:
3211
3212 2020-04-02  Alexey Shvayka  <shvaikalesh@gmail.com>
3213
3214         TypedArray's [[DefineOwnProperty]] is incorrect with partial descriptors
3215         https://bugs.webkit.org/show_bug.cgi?id=188875
3216
3217         Reviewed by Ross Kirsling.
3218
3219         * stress/typedarray-configure-index.js:
3220         * test262/expectations.yaml: Mark 10 test cases as passing.
3221
3222 2020-04-01  Ross Kirsling  <ross.kirsling@sony.com>
3223
3224         Intl.NumberFormat.prototype.format must preserve sign of -0
3225         https://bugs.webkit.org/show_bug.cgi?id=209880
3226
3227         Reviewed by Keith Miller.
3228
3229         * test262/config.yaml:
3230         This test was skipped as ICU version-dependent, but it shouldn't be.
3231
3232         * test262/expectations.yaml:
3233         Mark four test cases as passing.
3234
3235 2020-04-01  Justin Michaud  <justin@justinmichaud.com>
3236
3237         Delete IC incorrectly caches for proxies
3238         https://bugs.webkit.org/show_bug.cgi?id=209777
3239
3240         Reviewed by Mark Lam.
3241
3242         * stress/delete-property-ic-proxy.js: Added.
3243         (obj1.this.foo1):
3244         (foo1.foo2):
3245         (foo1):
3246         (foo2.foo3):
3247         (foo2):
3248         * stress/delete-property-inline-cache.js:
3249
3250 2020-04-01  Paulo Matos  <pmatos@igalia.com>
3251
3252         [JSC] Reenable non-cloop LLint, JIT and DFG on 32-bit platforms
3253         https://bugs.webkit.org/show_bug.cgi?id=191163
3254
3255         Reviewed by Adrian Perez de Castro.
3256
3257         Re-enable tests for 32bits.
3258
3259         * stress/op_add.js:
3260         * stress/op_bitand.js:
3261         * stress/op_bitor.js:
3262         * stress/op_bitxor.js:
3263         * stress/op_lshift-ConstVar.js:
3264         * stress/op_lshift-VarConst.js:
3265         * stress/op_lshift-VarVar.js:
3266         * stress/op_mod-ConstVar.js:
3267         * stress/op_mod-VarConst.js:
3268         * stress/op_mod-VarVar.js:
3269         * stress/op_mul-ConstVar.js:
3270         * stress/op_mul-VarConst.js:
3271         * stress/op_mul-VarVar.js:
3272         * stress/op_rshift-ConstVar.js:
3273         * stress/op_rshift-VarConst.js:
3274         * stress/op_rshift-VarVar.js:
3275         * stress/op_sub-ConstVar.js:
3276         * stress/op_sub-VarConst.js:
3277         * stress/op_sub-VarVar.js:
3278         * stress/op_urshift-ConstVar.js:
3279         * stress/op_urshift-VarConst.js:
3280         * stress/op_urshift-VarVar.js:
3281         * stress/spread-forward-call-varargs-stack-overflow.js:
3282         * stress/value-to-boolean.js:
3283
3284 2020-03-30  Alexey Shvayka  <shvaikalesh@gmail.com>
3285
3286         Add support in named capture group identifiers for direct surrogate pairs
3287         https://bugs.webkit.org/show_bug.cgi?id=178174
3288
3289         Reviewed by Darin Adler and Michael Saboff.
3290
3291         * test262/expectations.yaml: Mark 2 test cases as passing.
3292
3293 2020-03-30  Ross Kirsling  <ross.kirsling@sony.com>
3294
3295         RegExp.prototype.exec must always access lastIndex
3296         https://bugs.webkit.org/show_bug.cgi?id=209375
3297
3298         Reviewed by Saam Barati.
3299
3300         * mozilla/ecma_3/RegExp/15.10.6.2-2.js:
3301         Sync test with mozilla-central's copy.
3302         (https://searchfox.org/mozilla-central/source/js/src/tests/non262/RegExp/15.10.6.2-2.js)
3303
3304         * stress/regexp-exec-always-accesses-lastindex.js: Added.
3305
3306         * test262/expectations.yaml:
3307         Mark eight test cases as passing.
3308
3309 2020-03-30  Caio Lima  <ticaiolima@gmail.com>
3310
3311         [JSC] Public class field should accept "static" as field name
3312         https://bugs.webkit.org/show_bug.cgi?id=209703
3313
3314         Reviewed by Ross Kirsling.
3315
3316         * stress/class-fields-with-special-names.js: Added.
3317
3318 2020-03-28  Caio Lima  <ticaiolima@gmail.com>
3319
3320         stress/test-out-of-memory.js test gaderning
3321         https://bugs.webkit.org/show_bug.cgi?id=209701
3322
3323         Unreviewed test gardening.
3324
3325         * stress/test-out-of-memory.js:
3326
3327 2020-03-27  Mark Lam  <mark.lam@apple.com>
3328
3329         Skip stress/test-out-of-memory.js on memory limited devices.
3330         https://bugs.webkit.org/show_bug.cgi?id=209690
3331         <rdar://problem/60659198>
3332
3333         Reviewed by Keith Miller.
3334
3335         * stress/test-out-of-memory.js:
3336
3337 2020-03-27  Paulo Matos  <pmatos@igalia.com>
3338
3339         Skip new memory test stress/typed-array-oom-in... in memory limited devices
3340         https://bugs.webkit.org/show_bug.cgi?id=209661
3341
3342         Reviewed by Keith Miller.
3343
3344         * stress/typed-array-oom-in-buffer-accessor.js:
3345
3346 2020-03-27  Paulo Matos  <pmatos@igalia.com>
3347
3348         Pass hardness for test numberingSystemsForLocale-cached-... through test header
3349         https://bugs.webkit.org/show_bug.cgi?id=209476
3350
3351         Reviewed by Yusuke Suzuki.
3352
3353         Improvement over change r258190. Instead of creating a new test file
3354         duplicating contents where a hardness parameter is different, pass this
3355         through the test header using the -e flag to jsc.
3356
3357         * stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js:
3358         * stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access_memory-limited.js: Removed.
3359
3360 2020-03-26  Michael Saboff  <msaboff@apple.com>
3361
3362         Refactor YARR Stack Overflow Checks
3363         https://bugs.webkit.org/show_bug.cgi?id=209435
3364         rdar://problem/58988252
3365
3366         Reviewed by Mark Lam.
3367
3368         Added a new test and removed a now obsolete test.
3369
3370         * stress/regexp-compile-oom.js: Removed because the test is no longer valid.
3371         Previously when therer where different stack check mechanisims we failed different.
3372         This test was based on the different failure modes.  With these changes, most of
3373         the contain subtests no longer throw as this test expects.
3374         * stress/regexp-huge-oom.js: Added.
3375         (shouldBe):
3376         (shouldThrow):
3377
3378 2020-03-26  Keith Miller  <keith_miller@apple.com>
3379
3380         TypedArrays should more gracefully handle OOM during slowDownAndWasteMemory
3381         https://bugs.webkit.org/show_bug.cgi?id=209611
3382
3383         Reviewed by Tadeu Zagallo.
3384
3385         * stress/typed-array-oom-in-buffer-accessor.js: Added.
3386         (try.foo):
3387
3388 2020-03-25  Ross Kirsling  <ross.kirsling@sony.com>
3389
3390         Unreviewed, reimport test262 once more to make bot green.
3391
3392         * test262/expectations.yaml:
3393         * test262/harness/assert.js:
3394         * test262/harness/propertyHelper.js:
3395         * test262/latest-changes-summary.txt:
3396         * test262/test/built-ins/JSON/stringify/replacer-function-stack-overflow.js: Removed.
3397         * test262/test/built-ins/JSON/stringify/value-tojson-stack-overflow.js: Removed.
3398         * test262/test/built-ins/NativeErrors/AggregateError/newtarget-is-undefined.js: Added.
3399         * test262/test/built-ins/RegExp/prototype/Symbol.replace/poisoned-stdlib.js:
3400         * test262/test/harness/assert-samevalue-zeros.js:
3401         * test262/test/language/expressions/class/elements/private-field-after-optional-chain.js: Added.
3402         * test262/test/language/statements/class/elements/private-field-after-optional-chain.js: Added.
3403         * test262/test262-Revision.txt:
3404
3405 2020-03-25  Alexey Shvayka  <shvaikalesh@gmail.com>
3406
3407         RegExp.prototype[@@replace] relies on globals and doesn't perform ToLength
3408         https://bugs.webkit.org/show_bug.cgi?id=173867
3409
3410         Reviewed by Ross Kirsling.
3411
3412         * test262/expectations.yaml: Mark 4 test cases as passing.
3413
3414 2020-03-25  Alexey Shvayka  <shvaikalesh@gmail.com>
3415
3416         Invalid numeric and named references should be early syntax errors
3417         https://bugs.webkit.org/show_bug.cgi?id=178175
3418
3419         Reviewed by Ross Kirsling.
3420
3421         * test262/expectations.yaml: Mark 44 test cases as passing.
3422
3423 2020-03-25  Alexey Shvayka  <shvaikalesh@gmail.com>
3424
3425         \b escapes inside character classes should be valid in Unicode patterns
3426         https://bugs.webkit.org/show_bug.cgi?id=209528
3427
3428         Reviewed by Darin Adler.
3429
3430         * test262/expectations.yaml: Mark 2 test cases as passing.
3431
3432 2020-03-24  Tadeu Zagallo  <tzagallo@apple.com>
3433
3434         LLIntGenerator must link switch jumps to otherwise redundant labels
3435         https://bugs.webkit.org/show_bug.cgi?id=209333
3436         <rdar://problem/60827987>
3437
3438         Reviewed by Saam Barati.
3439
3440         * wasm/stress/terminal-jump-switch-target.js: Added.
3441
3442 2020-03-24  Alexey Shvayka  <shvaikalesh@gmail.com>
3443
3444         Update test262 to commit dfc7ecc6785e
3445         https://bugs.webkit.org/show_bug.cgi?id=209449
3446
3447         Unreviewed test gardening.
3448
3449         * test262/expectations.yaml:
3450         * test262/harness/propertyHelper.js:
3451         * test262/latest-changes-summary.txt:
3452         * test262/test/*: Updated.
3453         * test262/test262-Revision.txt:
3454
3455 2020-03-24  Alexey Shvayka  <shvaikalesh@gmail.com>
3456
3457         Update test262 to commit 79146e5cf48d
3458         https://bugs.webkit.org/show_bug.cgi?id=209449
3459
3460         Reviewed by Keith Miller.
3461
3462         * test262/config.yaml: Add 3 tests that timeout.
3463         * test262/expectations.yaml:
3464         * test262/latest-changes-summary.txt:
3465         * test262/test/*: Updated.
3466         * test262/test262-Revision.txt:
3467
3468 2020-03-23  Yusuke Suzuki  <ysuzuki@apple.com>
3469
3470         [JSC] Caller of Delete IC should emit write-barrier onto owner
3471         https://bugs.webkit.org/show_bug.cgi?id=209392
3472         <rdar://problem/60683173>
3473
3474         Reviewed by Saam Barati.
3475
3476         * stress/delete-ic-requires-write-barrier.js: Added.
3477         (foo):
3478
3479 2020-03-23  Yusuke Suzuki  <ysuzuki@apple.com>
3480
3481         [JSC] DFG OSR exit cannot find StructureStubInfo for put_by_val if CodeBlock is once converved from Baseline to LLInt
3482         https://bugs.webkit.org/show_bug.cgi?id=209327
3483         <rdar://problem/60631061>
3484
3485         Reviewed by Saam Barati.
3486
3487         * stress/osr-exit-attempts-to-find-stubinfo-which-is-cleared-by-previous-baseline-to-llint-conversion.js: Added.
3488         (setter):
3489         (foo):
3490
3491 2020-03-23  Ross Kirsling  <ross.kirsling@sony.com>
3492
3493         Catch parameters must not be lexically redeclared
3494         https://bugs.webkit.org/show_bug.cgi?id=208976
3495
3496         Reviewed by Keith Miller.
3497
3498         * test262/expectations.yaml:
3499         Mark four test cases as passing.
3500
3501 2020-03-20  Ross Kirsling  <ross.kirsling@sony.com>
3502
3503         hasObservableSideEffectsForRegExpSplit doesn't check for @@match override
3504         https://bugs.webkit.org/show_bug.cgi?id=209363
3505
3506         Reviewed by Michael Saboff.
3507
3508         * test262/expectations.yaml:
3509         Mark two test cases as passing.
3510
3511 2020-03-20  Ross Kirsling  <ross.kirsling@sony.com>
3512
3513         RegExp.prototype[@@replace] doesn't coerce result index to integer
3514         https://bugs.webkit.org/show_bug.cgi?id=209323
3515
3516         Reviewed by Yusuke Suzuki.
3517
3518         * test262/expectations.yaml:
3519         Mark six test cases as passing.
3520
3521 2020-03-19  Tomas Popela  <tpopela@redhat.com>
3522
3523         [JSC][BigEndians] Several JSC stress tests failing
3524         https://bugs.webkit.org/show_bug.cgi?id=194007
3525
3526         Reviewed by Michael Catanzaro.
3527
3528         Adapt the DataView tests to be able to pass on little endian as well
3529         as the big endian hardware. Do so by introducing method that determine
3530         the endianess and based on its value it saves the expected results in
3531         the right format.
3532
3533         * stress/dataview-get-cse.js:
3534         (getIsLittleEndian):
3535         (adjustForEndianess):
3536         (test3.foo):
3537         (test3):
3538         * stress/dataview-jit-get.js:
3539         (getIsLittleEndian):
3540         (test1.adjustForEndianess):
3541         (test1):
3542         (test2.adjustForEndianess):
3543         (test2):
3544         (test3.adjustForEndianess):
3545         (test3):
3546         (adjustForEndianessUint32):
3547         (test4):
3548         (test5):
3549         (test6):
3550         (test7):
3551         (test8):
3552         * stress/dataview-jit-neuter.js:
3553         (getIsLittleEndian):
3554         (adjustForEndianess):
3555         (test):
3556         (test2):
3557         * stress/dataview-jit-set-nan.js:
3558         (getIsLittleEndian):
3559         (adjustForEndianessFloat32):
3560         (test):
3561         * stress/dataview-jit-set.js:
3562         (getIsLittleEndian):
3563         (readHex):
3564         (adjustForEndianessUint16):
3565         (test):
3566         (test2):
3567         (adjustForEndianessUint32):
3568         (test3):
3569         (test4):
3570         (adjustForEndianessFloat32):
3571         (test5):
3572         (adjustForEndianessFloat64):
3573         (test6):
3574         (isLittleEndian): Deleted.
3575
3576 2020-03-18  Yusuke Suzuki  <ysuzuki@apple.com>
3577
3578         Add a way to mark a rejected promise as handled
3579         https://bugs.webkit.org/show_bug.cgi?id=209241
3580
3581         Reviewed by Michael Saboff.
3582
3583         * stress/reject-as-handled.js: Added.
3584         (shouldBe):
3585         (set new):
3586
3587 2020-03-16  Keith Miller  <keith_miller@apple.com>
3588
3589         JavaScript identifier grammar supports unescaped astral symbols, but JSC doesn’t
3590         https://bugs.webkit.org/show_bug.cgi?id=208998
3591
3592         Reviewed by Michael Saboff.
3593
3594         * stress/unicode-identifiers-with-surrogate-pairs.js: Added.
3595         (let.c.of.chars.eval.foo):
3596         (throwsSyntaxError):
3597         (let.c.of.continueChars.throwsSyntaxError.foo):
3598
3599 2020-03-13  Saam Barati  <sbarati@apple.com>
3600
3601         skip wasm/function-tests/grow-memory-cause-gc.js on memory limited devices
3602         https://bugs.webkit.org/show_bug.cgi?id=209069
3603         <rdar://problem/59954558>
3604
3605         Reviewed by Yusuke Suzuki.
3606
3607         * wasm/function-tests/grow-memory-cause-gc.js:
3608
3609 2020-03-13  Alexey Shvayka  <shvaikalesh@gmail.com>
3610
3611         Bound functions should pass correct NewTarget value
3612         https://bugs.webkit.org/show_bug.cgi?id=209057
3613
3614         Reviewed by Keith Miller.
3615
3616         * test262/expectations.yaml: Mark 4 test cases as passing.
3617
3618 2020-03-11  Keith Miller  <keith_miller@apple.com>
3619
3620         Test262-runner should always consider crashes as new failures
3621         https://bugs.webkit.org/show_bug.cgi?id=208943
3622
3623         Reviewed by Yusuke Suzuki.
3624
3625         * test262/expectations.yaml:
3626
3627 2020-03-11  Keith Miller  <keith_miller@apple.com>
3628
3629         Throws incorrectly a syntax error when declaring a top level catch variable the same as a parameter
3630         https://bugs.webkit.org/show_bug.cgi?id=189914
3631
3632         Reviewed by Saam Barati.
3633
3634         * ChakraCore/test/es6/globalParamCatchNewTargetSyntaxError.baseline-jsc:
3635         * stress/catch-destructuring-shadow-lexical-const-variable-global.js: Added.
3636         (catch):
3637         * stress/catch-destructuring-shadow-lexical-variable-class.js: Added.
3638         (Foo):
3639         (Bar):
3640         (Baz):
3641         * stress/catch-destructuring-shadow-lexical-variable-function.js: Added.
3642         (foo):
3643         (bar):
3644         * stress/catch-destructuring-shadow-lexical-variable-global.js: Added.
3645         (catch):
3646         * stress/catch-destructuring-shadow-var-global.js: Added.
3647         (catch):
3648         * test262/expectations.yaml:
3649
3650 2020-03-10  Ross Kirsling  <ross.kirsling@sony.com>
3651
3652         Re-import test262 to acquire DST fix
3653         https://bugs.webkit.org/show_bug.cgi?id=208901
3654
3655         Reviewed by Don Olmstead.
3656
3657         * test262/latest-changes-summary.txt:
3658         * test262/test/built-ins/AggregateError/newtarget-proto-fallback.js:
3659         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
3660         * test262/test/built-ins/Array/prototype/indexOf/15.4.4.14-4-4.js:
3661         * test262/test/built-ins/Date/parse/without-utc-offset.js:
3662         * test262/test262-Revision.txt:
3663
3664 2020-03-10  Paulo Matos  <pmatos@igalia.com>
3665
3666         JSC 32bits is failing on new test stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js
3667         https://bugs.webkit.org/show_bug.cgi?id=206864
3668
3669         Reviewed by Yusuke Suzuki.
3670
3671         Add new test to memory limited devices - behaviour is the same as 
3672         numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js
3673         but it creates 25 threads instead of 100.
3674
3675         * stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access_memory-limited.js: Added.
3676         (let.theCode):
3677
3678 2020-03-09  Alexey Shvayka  <shvaikalesh@gmail.com>
3679
3680         @putByValDirect does not perform [[DefineOwnProperty]] correctly
3681         https://bugs.webkit.org/show_bug.cgi?id=208708
3682
3683         Reviewed by Yusuke Suzuki.
3684
3685         * test262/expectations.yaml: Mark 46 test cases as passing.
3686
3687 2020-03-09  Caio Lima  <ticaiolima@gmail.com>
3688
3689         Tail calls are broken on ARM_THUMB2 and MIPS
3690         https://bugs.webkit.org/show_bug.cgi?id=197797
3691
3692         Reviewed by Yusuke Suzuki.
3693
3694         * stress/tail-call-with-spilled-registers.js: Added.
3695
3696 2020-03-07  Mark Lam  <mark.lam@apple.com>
3697
3698         Remove bad assertion in FTLLowerDFGToB3's compileDelBy().
3699         https://bugs.webkit.org/show_bug.cgi?id=208764
3700         <rdar://problem/59940095>
3701
3702         Reviewed by Keith Miller.
3703
3704         * stress/delete-by-val-with-base-and-subscript-using-same-cell.js: Added.
3705         * stress/delete-by-val-with-base-and-subscript-using-same-non-cell.js: Added.
3706
3707 2020-03-06  Yusuke Suzuki  <ysuzuki@apple.com>
3708
3709         [JSC] Enable public class fields
3710         https://bugs.webkit.org/show_bug.cgi?id=208756
3711
3712         Reviewed by Mark Lam.
3713
3714         Rename useClassFields to usePublicClassFields to keep separate from usePrivateClassFields once
3715         it is implemented.
3716
3717         * stress/big-int-as-property-name.js:
3718         * stress/class-fields-bytecode-cache.js:
3719         * stress/class-fields-computed-to-property-key.js:
3720         * stress/class-fields-function-name.js:
3721         * stress/class-fields-harmony.js:
3722         * stress/class-fields-proxy-define-property.js:
3723         * stress/class-fields-stress-instance.js:
3724         * stress/class-fields-to-property-key-const-string-ftl.js:
3725         * stress/class-fields-to-property-key-const-symbol-ftl.js:
3726         * stress/class-fields-to-property-key-slow-object-tostring-ftl.js:
3727         * stress/class-fields-to-property-key-slow-object-valueof-ftl.js:
3728         * stress/class-fields-to-property-key-string-object-ftl.js:
3729         * stress/class-fields-to-property-key-string-or-string-object-ftl.js:
3730         * stress/generator-syntax.js:
3731         * stress/method-name.js:
3732         * test262/config.yaml:
3733
3734 2020-03-06  Alexey Shvayka  <shvaikalesh@gmail.com>
3735
3736         JSON.stringify should call replacer on deleted properties
3737         https://bugs.webkit.org/show_bug.cgi?id=208725
3738
3739         Reviewed by Ross Kirsling.
3740
3741         * microbenchmarks/json-stringify-many-objects-to-json.js: Added.
3742         * microbenchmarks/json-stringify-many-objects.js: Added.
3743         * test262/expectations.yaml: Mark 2 test cases as passing.
3744
3745 2020-03-04  Mark Lam  <mark.lam@apple.com>
3746
3747         Handle an out of memory error while constructing the BytecodeGenerator.
3748         https://bugs.webkit.org/show_bug.cgi?id=208622
3749         <rdar://problem/59341136>
3750
3751         Reviewed by Saam Barati.
3752
3753         * stress/out-of-memory-while-constructing-BytecodeGenerator.js: Added.
3754
3755 2020-03-03  Yusuke Suzuki  <ysuzuki@apple.com>
3756
3757         [JSC] @hasOwnLengthProperty returns wrong value if "length" is attempted to be modified
3758         https://bugs.webkit.org/show_bug.cgi?id=208497
3759         <rdar://problem/59913544>
3760
3761         Reviewed by Mark Lam.
3762
3763         * stress/function-length-update.js: Added.
3764         (shouldBe):
3765         (userFunction):
3766         (userFunction2):
3767
3768 2020-03-02  Saam Barati  <sbarati@apple.com>
3769
3770         Don't skip tests unnecessarily on arm64
3771         https://bugs.webkit.org/show_bug.cgi?id=208470
3772         <rdar://problem/59968869>
3773
3774         Reviewed by Tadeu Zagallo.
3775
3776         * microbenchmarks/bit-test-constant.js:
3777         * microbenchmarks/bit-test-nonconstant.js:
3778         * microbenchmarks/memcpy-typed-loop-large.js:
3779         * microbenchmarks/memcpy-typed-loop-small.js:
3780         * microbenchmarks/mul-immediate-sub.js:
3781         * stress/dont-range-based-iterate-vector-that-is-mutated.js:
3782         * stress/dont-reserve-huge-capacity-lexer.js:
3783         * stress/new-largeish-contiguous-array-with-size.js:
3784         * stress/sampling-profiler-richards.js:
3785         * typeProfiler/deltablue-for-of.js:
3786         * typeProfiler/getter-richards.js:
3787         * wasm/regress/llint-callee-saves-with-fast-memory.js:
3788
3789 2020-03-02  Justin Michaud  <justin_michaud@apple.com>
3790
3791         Delete by val caching does not keep the subscript alive
3792         https://bugs.webkit.org/show_bug.cgi?id=208393
3793
3794         Reviewed by Yusuke Suzuki.
3795
3796         * stress/delete-property-ic-stress.js: Added.
3797
3798 2020-02-27  Justin Michaud  <justin_michaud@apple.com>
3799
3800         Poly proto should work with property delete transitions
3801         https://bugs.webkit.org/show_bug.cgi?id=208261
3802
3803         Reviewed by Saam Barati.
3804
3805         * stress/delete-property-poly-proto.js: Added.
3806         (A.prototype.set x):
3807         (A):
3808         (B):
3809
3810 2020-02-27  Ross Kirsling  <ross.kirsling@sony.com>
3811
3812         Update test262 (2020.02.26)
3813         https://bugs.webkit.org/show_bug.cgi?id=208280
3814
3815         Reviewed by Yusuke Suzuki.
3816
3817         * test262/config.yaml:
3818         * test262/expectations.yaml:
3819         * test262/harness/async-gc.js:
3820         * test262/latest-changes-summary.txt:
3821         * test262/test/:
3822         * test262/test262-Revision.txt:
3823
3824 2020-02-26  Caio Lima  <ticaiolima@gmail.com>
3825
3826         [JSC][MIPS] Adding support to Checkpoints
3827         https://bugs.webkit.org/show_bug.cgi?id=208196
3828
3829         Reviewed by Yusuke Suzuki.
3830
3831         * microbenchmarks/memcpy-typed-loop.js:
3832
3833 2020-02-25  Justin Michaud  <justin_michaud@apple.com>
3834
3835         Inline Cache delete by id/val
3836         https://bugs.webkit.org/show_bug.cgi?id=207522
3837
3838         Reviewed by Keith Miller and Filip Pizlo. 
3839
3840         * microbenchmarks/delete-property-from-prototype-chain.js:
3841         (delete.C.prototype.z):
3842         * microbenchmarks/delete-property-inline-cache-polymorphic.js: Added.
3843         (C):
3844         (noInline.C.foo):
3845         (noInline.foo.F):
3846         (noInline.F):
3847         * microbenchmarks/delete-property-inline-cache.js: Added.
3848         (C):
3849         (noInline.C.D):
3850         (noInline.D.foo):
3851         (noInline.foo.E):
3852         (noInline.E.F):
3853         (noInline.F):
3854         * microbenchmarks/delete-property-keeps-cacheable-structure.js:
3855         * stress/delete-property-check-structure-transition.js:
3856         (sd): Deleted.
3857         (testDeleteIsNotUncacheable): Deleted.
3858         (): Deleted.
3859         (testCanFlatten): Deleted.
3860         (testDeleteWithInlineCache.Object.prototype.globalProperty.42.makeFoo): Deleted.
3861         (testDeleteWithInlineCache.noInline.doTest): Deleted.
3862         (testDeleteWithInlineCache): Deleted.
3863         * stress/delete-property-inline-cache.js: Added.
3864         (assert):
3865         (assert_eq):
3866         (assert_neq):
3867         (assert_throws):
3868         (noInline.assert.noInline.assert_eq.noInline.assert_neq.noInline.assert_throws.testCacheableDeleteById.makeFoo):
3869         (noInline.assert.noInline.assert_eq.noInline.assert_neq.noInline.assert_throws.testCacheableDeleteById):
3870         (noInline.testCacheableDeleteById.testCacheableDeleteByVal.makeFoo2):
3871         (noInline.testCacheableDeleteById.testCacheableDeleteByVal):
3872         (noInline.testCacheableDeleteByVal.testCacheableEmptyDeleteById.makeFoo3):
3873         (noInline.testCacheableDeleteByVal.testCacheableEmptyDeleteById):
3874         (noInline.testCacheableEmptyDeleteById.testCacheableDeleteByIdMiss.makeFoo4):
3875         (noInline.testCacheableEmptyDeleteById.testCacheableDeleteByIdMiss):
3876         (noInline.testCacheableDeleteByIdMiss.testDeleteIndex.makeFoo5):
3877         (noInline.testCacheableDeleteByIdMiss.testDeleteIndex):
3878         (noInline.testDeleteIndex.testPolymorphicDelByVal.makeFoo6):
3879         (noInline.testDeleteIndex.testPolymorphicDelByVal):
3880         (noInline.testPolymorphicDelByVal.testBigintDeleteByVal.makeFoo7):
3881         (noInline.testPolymorphicDelByVal.testBigintDeleteByVal):
3882         (noInline.testBigintDeleteByVal.testSymbolDeleteByVal.makeFoo8):
3883         (noInline.testBigintDeleteByVal.testSymbolDeleteByVal):
3884         (noInline.testSymbolDeleteByVal.testObjDeleteByVal.makeFoo9):
3885         (noInline.testSymbolDeleteByVal.testObjDeleteByVal):
3886         (noInline.testObjDeleteByVal.testStrict.makeFoo10):
3887         (noInline.testObjDeleteByVal.testStrict):
3888         (noInline.testStrict.testOverride.arr.j):
3889         (noInline.testStrict.testOverride):
3890         (noInline.testOverride.testNonObject.deleteIt):
3891         (noInline.testOverride.testNonObject):
3892         (noInline.testNonObject.testNonObjectStrict.deleteIt):
3893         (noInline.testNonObject.testNonObjectStrict):
3894         (noInline.testNonObjectStrict.testExceptionUnwind.mutateThem):
3895         (noInline.testNonObjectStrict.testExceptionUnwind.noInline.deleteIt):
3896         (noInline.testNonObjectStrict.testExceptionUnwind):
3897         (noInline.testExceptionUnwind.testTDZ):
3898         (noInline.testTDZ):
3899
3900 2020-02-19  Ross Kirsling  <ross.kirsling@sony.com>
3901
3902         Computed Properties with increment sometimes produces incorrect results
3903         https://bugs.webkit.org/show_bug.cgi?id=170934
3904
3905         Reviewed by Yusuke Suzuki.
3906
3907         * stress/computed-property-increment.js: Added.
3908         * test262/expectations.yaml: Mark two test cases as passing.
3909
3910 2020-02-19  Keith Miller  <keith_miller@apple.com>
3911
3912         Disable Wasm reference types by default
3913         https://bugs.webkit.org/show_bug.cgi?id=207952
3914
3915         Reviewed by Mark Lam.
3916
3917         * wasm/stress/immutable-globals.js:
3918         * wasm/stress/local-ref.js:
3919         * wasm/stress/mutable-globals.js:
3920
3921 2020-02-18  Ross Kirsling  <ross.kirsling@sony.com>
3922
3923         [JSC] Computed function properties compute their keys twice
3924         https://bugs.webkit.org/show_bug.cgi?id=207297
3925
3926         Reviewed by Keith Miller.
3927
3928         * stress/computed-property-key-side-effects.js: Added.
3929         * test262/expectations.yaml: Mark 6 test cases as passing.
3930
3931 2020-02-17  Yusuke Suzuki  <ysuzuki@apple.com>
3932
3933         [JSC] JITThunk should be HashSet<Weak<NativeExecutable>> with appropriate GC weakness handling
3934         https://bugs.webkit.org/show_bug.cgi?id=207715
3935
3936         Reviewed by Darin Adler.
3937
3938         * stress/stress-jitthunks.js: Added.
3939         (let.set newGlobal):
3940         (set catch):
3941
3942 2020-02-17  Tadeu Zagallo  <tzagallo@apple.com>
3943
3944         [Wasm] REGRESSION(r256665): Wasm->JS call IC needs to save memory size register
3945         https://bugs.webkit.org/show_bug.cgi?id=207849
3946
3947         Reviewed by Mark Lam.
3948
3949         * wasm/regress/regress-256665.js: Added.
3950         (f):
3951
3952 2020-02-14  Tadeu Zagallo  <tzagallo@apple.com>
3953
3954         Unreviewed: fix broken tests added in r256665
3955         https://bugs.webkit.org/show_bug.cgi?id=207727
3956
3957         Our inline WAT doesn't seem to like named blocks/branch targets.
3958
3959         * wasm/regress/llint-callee-saves-with-fast-memory.js:
3960         * wasm/regress/llint-callee-saves-without-fast-memory.js:
3961
3962 2020-02-14  Tadeu Zagallo  <tzagallo@apple.com>
3963
3964         [WASM] Wasm interpreter's calling convention doesn't match Wasm JIT's convention.
3965         https://bugs.webkit.org/show_bug.cgi?id=207727
3966
3967         Reviewed by Mark Lam.
3968
3969         * wasm/regress/llint-callee-saves-with-fast-memory.js: Added.
3970         * wasm/regress/llint-callee-saves-without-fast-memory.js: Added.
3971
3972 2020-02-13  Caio Lima  <ticaiolima@gmail.com>
3973
3974         [ESNext][BigInt] We don't support BigInt literal as PropertyName
3975         https://bugs.webkit.org/show_bug.cgi?id=206888
3976
3977         Reviewed by Ross Kirsling.
3978
3979         * stress/big-int-as-property-name.js: Added.
3980
3981 2020-02-10  Mark Lam  <mark.lam@apple.com>
3982
3983         Placate exception check validator in GenericArguments<Type>::put().
3984         https://bugs.webkit.org/show_bug.cgi?id=207485
3985         <rdar://problem/59302535>
3986
3987         Reviewed by Robin Morisset.
3988
3989         * stress/placate-exception-check-validator-in-GenericArguments-put.js: Added.
3990
3991 2020-02-10  Justin Michaud  <justin_michaud@apple.com>
3992
3993         arm64_32: microbenchmarks/delete-property-keeps-cacheable-structure.js is timing out
3994         https://bugs.webkit.org/show_bug.cgi?id=207484
3995
3996         Reviewed by Yusuke Suzuki.
3997
3998         * microbenchmarks/delete-property-keeps-cacheable-structure.js:
3999
4000 2020-02-10  Mark Lam  <mark.lam@apple.com>
4001
4002         Missing exception check in GenericArguments<Type>::deletePropertyByIndex().
4003         https://bugs.webkit.org/show_bug.cgi?id=207483
4004         <rdar://problem/59302616>
4005
4006         Reviewed by Yusuke Suzuki.
4007
4008         * stress/missing-exception-check-in-GenericArguments-deletePropertyByIndex.js: Added.
4009
4010 2020-02-06  Sukolsak Sakshuwong  <sukolsak@gmail.com> and Alexey Shvayka  <shvaikalesh@gmail.com>
4011
4012         JavaScript string corruption using RegExp with unicode character
4013         https://bugs.webkit.org/show_bug.cgi?id=187947
4014
4015         Reviewed by Yusuke Suzuki.
4016
4017         This change adds regression test for string corruption that occured after
4018         non-BMP character was removed by String.prototype.replace.
4019         The issue was fixed in https://trac.webkit.org/changeset/253648/webkit.
4020
4021         Also, this patch brings back:
4022         1. An out-of-order character class range test.
4023         2. Dangling and combined surrogates tests (as webkit.org/b/154863 is now resolved).
4024
4025         * stress/regress-187947.js: Added.
4026
4027 2020-02-05  Justin Michaud  <justin_michaud@apple.com>
4028
4029         Deleting a property should not turn structures into uncacheable dictionaries
4030         https://bugs.webkit.org/show_bug.cgi?id=206430
4031
4032         Reviewed by Yusuke Suzuki.
4033
4034         * microbenchmarks/delete-property-from-prototype-chain.js: Added.
4035         (assert):
4036         (noInline.assert.getZ):
4037         (noInline.getZ.C):
4038         (doTest):
4039         (delete.C.prototype.z):
4040         * microbenchmarks/delete-property-keeps-cacheable-structure.js: Added.
4041         (assert):
4042         (C):
4043         (doTest):
4044         * stress/cache-put-by-id-different-attributes.js:
4045         (makePrototypeDict):
4046         (set x):
4047         * stress/cache-put-by-id-different-offset.js:
4048         (makePrototypeDict):
4049         (set x):
4050         * stress/cache-put-by-id-poly-proto.js:
4051         (makePrototypeDict):
4052         (set _):
4053         * stress/delete-property-check-structure-transition.js: Added.
4054         (assert):
4055         (assert_eq):
4056         (assert_neq):
4057         (sd):
4058         (sid):
4059         (testDeleteIsNotUncacheable):
4060         (testCanMaterializeDeletes):
4061         (testCanFlatten):
4062         (testDeleteWithInlineCache.Object.prototype.globalProperty.42.makeFoo):
4063         (testDeleteWithInlineCache.noInline.doTest):
4064         (testDeleteWithInlineCache):
4065         * stress/flatten-object-zero-unused-inline-properties.js:
4066
4067 2020-02-04  Alexey Shvayka  <shvaikalesh@gmail.com>
4068
4069         Quantifiers after lookahead assertions should be syntax errors in Unicode patterns only
4070         https://bugs.webkit.org/show_bug.cgi?id=206988
4071
4072         Reviewed by Darin Adler and Ross Kirsling.
4073
4074         * test262/expectations.yaml: Mark 10 test cases as passing.
4075
4076 2020-02-03  Alexey Shvayka  <shvaikalesh@gmail.com>
4077
4078         \0 identity escapes should be syntax errors in Unicode patterns only
4079         https://bugs.webkit.org/show_bug.cgi?id=207114
4080
4081         Reviewed by Darin Adler.
4082
4083         * test262/expectations.yaml: Mark 2 test cases as passing.
4084
4085 2020-02-01  Alexey Shvayka  <shvaikalesh@gmail.com>
4086
4087         Non-alphabetical \c escapes should be syntax errors in Unicode patterns only
4088         https://bugs.webkit.org/show_bug.cgi?id=207091
4089
4090         Reviewed by Darin Adler.
4091
4092         * test262/expectations.yaml: Mark 4 test cases as passing.
4093
4094 2020-01-31  Saam Barati  <sbarati@apple.com>
4095
4096         Unreviewed. Don't dump disassembly in test.
4097
4098         * stress/get-getter-setter-by-offset-not-always-safe-to-execute.js:
4099
4100 2020-01-31  Saam Barati  <sbarati@apple.com>
4101
4102         GetGetterSetterByOffset and GetGetter/GetSetter are not always safe to execute
4103         https://bugs.webkit.org/show_bug.cgi?id=206805
4104         <rdar://problem/58898161>
4105
4106         Reviewed by Yusuke Suzuki.
4107
4108         * stress/get-getter-setter-by-offset-not-always-safe-to-execute.js: Added.
4109
4110 2020-01-31  Alexey Shvayka  <shvaikalesh@gmail.com>
4111
4112         Unmatched ] or } brackets should be syntax errors in Unicode patterns only
4113         https://bugs.webkit.org/show_bug.cgi?id=207023
4114
4115         Reviewed by Darin Adler.
4116
4117         * test262/expectations.yaml: Mark 2 test cases as passing.
4118
4119 2020-01-30  Alexey Shvayka  <shvaikalesh@gmail.com>
4120
4121         Incomplete braced quantifiers should be banned in Unicode patterns only
4122         https://bugs.webkit.org/show_bug.cgi?id=206776
4123
4124         Reviewed by Darin Adler.
4125
4126         Although the change does not affect Unicode property escapes, a few
4127         test/built-ins/RegExp/property-escapes/non-existent-property-value*.js files
4128         are now passing because they had \\p or \\P instead of CharacterClassEscape.
4129
4130         * test262/expectations.yaml: Mark 18 test cases as passing.
4131
4132 2020-01-30  Keith Miller  <keith_miller@apple.com>
4133
4134         Parser needs to restore unary stack state when backtracking
4135         https://bugs.webkit.org/show_bug.cgi?id=206972
4136
4137         Reviewed by Saam Barati.
4138
4139         * stress/parser-save-state-remove-stale-entries.js: Added.
4140         * stress/parser-syntax-checker-assignments-are-not-resolve-expressions.js: Added.
4141         (foo):
4142
4143 2020-01-29  Mark Lam  <mark.lam@apple.com>
4144
4145         Fix bad assertion in InternalFunctionAllocationProfile::createAllocationStructureFromBase().
4146         https://bugs.webkit.org/show_bug.cgi?id=206981
4147         <rdar://problem/58985736>
4148
4149         Reviewed by Keith Miller.
4150
4151         * stress/InternalFunctionAllocationProfile-createAllocationStructureFromBase-should-allow-for-same-classInfo-from-different-globals.js: Added.
4152
4153 2020-01-29  Yusuke Suzuki  <ysuzuki@apple.com>
4154
4155         Unreviewed, update tests
4156         https://bugs.webkit.org/show_bug.cgi?id=206846
4157
4158         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-debug.js: Copied from JSTests/stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js.
4159         (shouldBe):
4160         (putter):
4161         (not_string.toString):
4162         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js:
4163         * stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten-debug.js: Copied from JSTests/stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js.
4164         (shouldBe):
4165         (dictionary):
4166         (putter):
4167         (not_string.toString):
4168         * stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js:
4169
4170 2020-01-28  Yusuke Suzuki  <ysuzuki@apple.com>
4171
4172         [JSC] Give up IC when unknown structure transition happens
4173         https://bugs.webkit.org/show_bug.cgi?id=206846
4174
4175         Reviewed by Mark Lam.
4176
4177         * stress/ensure-crash.js: Added.
4178         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-bad-transition-debug.js: Added.
4179         (shouldBe):
4180         (putter):
4181         (not_string.toString):
4182         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-bad-transition.js: Added.
4183         (shouldBe):
4184         (putter):
4185         (not_string.toString):
4186         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js: Added.
4187         (shouldBe):
4188         (putter):
4189         (not_string.toString):
4190         * stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js: Added.
4191         (shouldBe):
4192         (dictionary):
4193         (putter):
4194         (not_string.toString):
4195
4196 2020-01-29  Paulo Matos  <pmatos@igalia.com>
4197
4198         Skip slow test operand-should-fit-in-abstract-heap-encoded-payload-format.js on mips and arm
4199         https://bugs.webkit.org/show_bug.cgi?id=206926
4200
4201         Unreviewed test gardening.
4202
4203         This test has quadratic behaviour with the size of a, and on mips and arm it just takes too
4204         long to run with such high value of a. Therefore we skip.
4205
4206         * stress/operand-should-fit-in-abstract-heap-encoded-payload-format.js:
4207
4208 2020-01-28  Paulo Matos  <pmatos@igalia.com>
4209
4210         Skip test numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js in arm and mips
4211         https://bugs.webkit.org/show_bug.cgi?id=206865
4212
4213         Reviewed by Žan Doberšek.
4214
4215         * stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js:
4216
4217 2020-01-26  Alexey Shvayka  <shvaikalesh@gmail.com>
4218
4219         Invalid ranges in character classes should be banned in Unicode patterns only
4220         https://bugs.webkit.org/show_bug.cgi?id=206768
4221
4222         Reviewed by Darin Adler.
4223
4224         * test262/expectations.yaml: Mark 18 test cases as passing.
4225
4226 2020-01-24  Mark Lam  <mark.lam@apple.com>
4227
4228         IntlObject's cached strings should be immortal and safe for concurrent access.
4229         https://bugs.webkit.org/show_bug.cgi?id=206779
4230         <rdar://problem/58831763>
4231
4232         Reviewed by Yusuke Suzuki.
4233
4234         * stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js: Added.
4235
4236 2020-01-24  Yusuke Suzuki  <ysuzuki@apple.com>
4237
4238         REGRESSION (r254964-r254970?): Catalina Debug JSC bot timing out while running tests
4239         https://bugs.webkit.org/show_bug.cgi?id=206785
4240
4241         Unreviewed, skipping the test if $buildType is "debug".
4242
4243         * stress/operand-should-fit-in-abstract-heap-encoded-payload-format.js:
4244
4245 2020-01-23  Yusuke Suzuki  <ysuzuki@apple.com>
4246
4247         [JSC] DFG OSR exit is not marking CodeBlock::m_hasLinkedOSRExit when the exit target is checkpoint
4248         https://bugs.webkit.org/show_bug.cgi?id=206726
4249         <rdar://problem/58827849>
4250
4251         Reviewed by Saam Barati.
4252
4253         * stress/exit-target-code-block-can-be-changed-between-llint-and-baseline.js: Added.
4254         (bar):
4255         (foo):
4256
4257 2020-01-22  Yusuke Suzuki  <ysuzuki@apple.com>
4258
4259         [JSC] Bits from Operand should fit in bits reserved in AbstractHeap's Payload
4260         https://bugs.webkit.org/show_bug.cgi?id=206619
4261         <rdar://problem/58270260>
4262
4263         Reviewed by Keith Miller.
4264
4265         * stress/operand-should-fit-in-abstract-heap-encoded-payload-format.js: Added.
4266
4267 2020-01-22  Keith Miller  <keith_miller@apple.com>
4268
4269         InternalField and CheckNeutered DFG nodes are not always safe to execute
4270         https://bugs.webkit.org/show_bug.cgi?id=206632
4271
4272         Reviewed by Saam Barati.
4273
4274         * stress/for-of-bad-internal-field-hoist.js: Added.
4275         (foo):
4276
4277 2020-01-22  Yusuke Suzuki  <ysuzuki@apple.com>
4278
4279         [JSC] DateMath should accept more ISO-8601 timezone designators even if they are not included in ECMA262 to produce expected results in the wild code
4280         https://bugs.webkit.org/show_bug.cgi?id=160287
4281
4282         Reviewed by Ross Kirsling.
4283
4284         * stress/relaxed-timezone-designators.js: Added.
4285         (shouldBe):
4286         (parsedDate):
4287
4288 2020-01-22  Yusuke Suzuki  <ysuzuki@apple.com>
4289
4290         [JSC] Add CheckArrayOrEmpty to handle the case when hoisting CheckArray for places where input can be empty
4291         https://bugs.webkit.org/show_bug.cgi?id=206571
4292         <rdar://problem/58757016>
4293
4294         Reviewed by Saam Barati.
4295
4296         * stress/check-array-or-empty.js: Added.
4297         (C):
4298
4299 2020-01-21  Tadeu Zagallo  <tzagallo@apple.com>
4300
4301         Object allocation sinking is missing PutHint for allocations unreachable in the graph
4302         https://bugs.webkit.org/show_bug.cgi?id=203799
4303         <rdar://problem/56852162>
4304
4305         Reviewed by Saam Barati.
4306
4307         * stress/allocation-sinking-puthint-control-flow-2.js: Added.
4308         (f.handler.construct):
4309         (f):
4310
4311 2020-01-20  Gus Caplan  <me@gus.host>
4312
4313         Remove own toString from NativeError prototype
4314         https://bugs.webkit.org/show_bug.cgi?id=204629
4315
4316         Reviewed by Ross Kirsling.
4317
4318         NativeError prototypes are expected to inherit toString from
4319         Error.prototype. See https://github.com/tc39/ecma262/issues/1794
4320         for additional details.
4321
4322         * stress/nativeerror-prototype-tostring.js:
4323
4324 2020-01-20  Caio Lima  <ticaiolima@gmail.com>
4325
4326         Skip tests when there is no JIT build on ARMv7 and MIPS
4327         https://bugs.webkit.org/show_bug.cgi?id=206496
4328
4329         Unreviewed gardening.
4330
4331         * microbenchmarks/bit-test-constant.js:
4332         * microbenchmarks/bit-test-nonconstant.js:
4333         * microbenchmarks/memcpy-typed-loop-large.js:
4334         * microbenchmarks/memcpy-typed-loop-small.js:
4335         * microbenchmarks/mul-immediate-sub.js:
4336         * stress/dont-range-based-iterate-vector-that-is-mutated.js:
4337         * stress/int8-repeat-in-then-out-of-bounds.js:
4338         * stress/sampling-profiler-richards.js:
4339
4340 2020-01-18  Caitlin Potter  <caitp@igalia.com>
4341
4342         [JSC] add DFG/FTL support for op_to_property_key
4343         https://bugs.webkit.org/show_bug.cgi?id=206368
4344
4345         Reviewed by Saam Barati.
4346
4347         * stress/class-fields-to-property-key-const-string-ftl.js: Added.
4348         * stress/class-fields-to-property-key-const-symbol-ftl.js: Added.
4349         * stress/class-fields-to-property-key-slow-object-tostring-ftl.js: Added.
4350         * stress/class-fields-to-property-key-slow-object-valueof-ftl.js: Added.
4351         * stress/class-fields-to-property-key-string-object-ftl.js: Added.
4352         * stress/class-fields-to-property-key-string-or-string-object-ftl.js: Added.
4353
4354 2020-01-17  Saam Barati  <sbarati@apple.com>
4355
4356         Air O0 should have better stack allocation
4357         https://bugs.webkit.org/show_bug.cgi?id=206436
4358
4359         Reviewed by Tadeu Zagallo.
4360
4361         * wasm/stress/dont-stack-overflow-in-air.js: Added.
4362
4363 2020-01-17  Mark Lam  <mark.lam@apple.com>
4364
4365         JSModuleLoader's printableModuleKey() should never throw.
4366         https://bugs.webkit.org/show_bug.cgi?id=206461
4367         <rdar://problem/58696678>
4368
4369         Reviewed by Michael Saboff.
4370
4371         * stress/printableModuleKey-should-never-throw.js: Added.
4372
4373 2020-01-17  Alexey Shvayka  <shvaikalesh@gmail.com>
4374
4375         JSON.parse should lookup prototype chains during revival
4376         https://bugs.webkit.org/show_bug.cgi?id=205769
4377
4378         Reviewed by Saam Barati.
4379
4380         * test262/expectations.yaml: Mark 4 test cases as passing.
4381
4382 2020-01-16  Robin Morisset  <rmorisset@apple.com>
4383
4384         [ESNext] Enables a way to throw an error on ByteCodeGenerator step
4385         https://bugs.webkit.org/show_bug.cgi?id=180139
4386
4387         Reviewed by Mark Lam.
4388
4389         * stress/eval-huge-big-int-memory-overflow.js: Added.
4390
4391 2020-01-16  Keith Miller  <keith_miller@apple.com>
4392
4393         Reland bytecode checkpoints since bugs have been fixed
4394         https://bugs.webkit.org/show_bug.cgi?id=206361
4395
4396         Unreviewed, reland.
4397
4398         The watch bugs have been fixed by https://trac.webkit.org/changeset/254674
4399
4400         * stress/apply-osr-exit-should-get-length-once-exceptions-occasionally.js: Added.
4401         (expectedArgCount):
4402         (callee):
4403         (test):
4404         (let.array.get length):
4405         * stress/apply-osr-exit-should-get-length-once.js: Added.
4406         (expectedArgCount):
4407         (callee):
4408         (test):
4409         (let.array.get length):
4410         * stress/load-varargs-then-inlined-call-and-exit-strict.js:
4411         (checkEqual):
4412         * stress/recursive-tail-call-with-different-argument-count.js:
4413         * stress/rest-varargs-osr-exit-to-checkpoint.js: Added.
4414         (foo):
4415         (bar):
4416
4417 2020-01-16  Keith Miller  <keith_miller@apple.com>
4418
4419         Revert 254725 since it breaks tests
4420         https://bugs.webkit.org/show_bug.cgi?id=206391
4421
4422         Unreviewed, revert.
4423
4424         * stress/allocation-sinking-puthint-control-flow-2.js: Removed.
4425
4426 2020-01-16  Tadeu Zagallo  <tzagallo@apple.com>
4427
4428         Object allocation sinking is missing PutHint for allocations unreachable in the graph
4429         https://bugs.webkit.org/show_bug.cgi?id=203799
4430         <rdar://problem/56852162>
4431
4432         Reviewed by Saam Barati.
4433
4434         * stress/allocation-sinking-puthint-control-flow-2.js: Added.
4435         (f.handler.construct):
4436         (f):
4437
4438 2020-01-16  Robin Morisset  <rmorisset@apple.com>
4439
4440         Teach the bytecode that arithmetic operations can return bigints
4441         https://bugs.webkit.org/show_bug.cgi?id=205416
4442
4443         Reviewed by Yusuke Suzuki.
4444
4445         This file crashes in debug mode without the fix.
4446
4447         * stress/big-int-arithmetic-return-big-int.js: Added.
4448         (fooAdd):
4449         (fooSub):
4450         (fooMul):
4451         (fooDiv):
4452
4453 2020-01-16  Mark Lam  <mark.lam@apple.com>
4454
4455         operationToObject() should check for a null errorMessage.
4456         https://bugs.webkit.org/show_bug.cgi?id=206339
4457         <rdar://problem/58449666>
4458
4459         Reviewed by Yusuke Suzuki.
4460
4461         * stress/operationToObject-should-check-for-null-errorMessage.js: Added.
4462
4463 2020-01-15  Caitlin Potter <caitp@igalia.com>
4464
4465         [JSC] Add support for public class fields
4466         https://bugs.webkit.org/show_bug.cgi?id=174212
4467
4468         Reviewed by Yusuke Suzuki.
4469
4470         New syntax invalidates some test expectations:
4471
4472         "async <linefeed> MethodDefinition" is no longer an unexpected "async"
4473         token. It is now an instance field named "async" with no initializer,
4474         and an automatic semicolon, followed by MethodDefinition.
4475
4476         "get|set GeneratorMethodDefinition"'s error message has changed, due to "get"
4477         being valid class field names.
4478
4479         Many class-syntax tests relating to automatic semicolon insertion are
4480         no longer valid, as a line containing nothing but an identifier is now
4481         a valid class element.
4482
4483         * stress/async-await-syntax.js:
4484         * stress/class-fields-bytecode-cache.js: Added.
4485         * stress/class-fields-computed-to-property-key.js: Added.
4486         * stress/class-fields-function-name.js: Added.
4487         * stress/class-fields-harmony.js: Added.
4488         * stress/class-fields-proxy-define-property.js: Added.
4489         * stress/class-fields-stress-instance.js: Added.
4490         * stress/generator-syntax.js:
4491         * stress/method-name.js:
4492         * test262/config.yaml:
4493
4494 2020-01-15  Keith Miller  <keith_miller@apple.com>
4495
4496         Revert bytecode checkpoints since it breaks watch
4497         https://bugs.webkit.org/show_bug.cgi?id=206301
4498
4499         Unreviewed, revert.
4500
4501 2020-01-15  Alexey Shvayka  <shvaikalesh@gmail.com>
4502
4503         Object.preventExtensions should throw if not successful
4504         https://bugs.webkit.org/show_bug.cgi?id=206131
4505
4506         Reviewed by Ross Kirsling.
4507
4508         * test262/expectations.yaml: Mark 2 test cases as passing.
4509
4510 2020-01-14  Commit Queue  <commit-queue@webkit.org>
4511
4512         Unreviewed, rolling out r254480, r254496, and r254517.
4513         https://bugs.webkit.org/show_bug.cgi?id=206278
4514
4515         "It regressed JetStream2 and Speedometer2" (Requested by
4516         saamyjoon on #webkit).
4517
4518         Reverted changesets:
4519
4520         "Throw away baseline code if there is an optimized
4521         replacement"
4522         https://bugs.webkit.org/show_bug.cgi?id=202503
4523         https://trac.webkit.org/changeset/254480
4524
4525         "Unreviewed. Change useLLInt=0 to forceBaseline=1"
4526         https://trac.webkit.org/changeset/254496
4527
4528         "Add an option that enables/disables throwing away baseline
4529         JIT code"
4530         https://bugs.webkit.org/show_bug.cgi?id=206244
4531         https://trac.webkit.org/changeset/254517
4532
4533 2020-01-13  Saam Barati  <sbarati@apple.com>
4534
4535         Unreviewed. Change useLLInt=0 to forceBaseline=1
4536
4537         * stress/racy-gc-cleanup-of-identifier-after-mutator-stops-running.js:
4538
4539 2020-01-13  Keith Miller  <keith_miller@apple.com>
4540