[JSC] llintTrue / jitTrue can encounter native functions
[WebKit.git] / JSTests / ChangeLog
1 2020-06-24  Yusuke Suzuki  <ysuzuki@apple.com>
2
3         [JSC] llintTrue / jitTrue can encounter native functions
4         https://bugs.webkit.org/show_bug.cgi?id=213442
5         <rdar://problem/64257914>
6
7         Reviewed by Mark Lam.
8
9         * stress/baselinejittrue.js: Added.
10         (shouldBe):
11         (jitCode1):
12         (jitCode2):
13         * stress/baselintjittrue.js: Added.
14         (shouldBe):
15         (llintCode1):
16         (llintCode2):
17         * stress/llinttrue-in-eval.js: Added.
18         * stress/llinttrue.js: Added.
19         (shouldBe):
20         (llintCode1):
21         (llintCode2):
22
23 2020-06-24  Alexey Shvayka  <shvaikalesh@gmail.com>
24
25         Add DFG/FTL fast path for GetPrototypeOf based on OverridesGetPrototype flag
26         https://bugs.webkit.org/show_bug.cgi?id=213191
27
28         Reviewed by Yusuke Suzuki.
29
30         * microbenchmarks/object-get-prototype-of-object-rare.js: Added.
31         * stress/dfg-object-prototype-of.js: Removed.
32         * stress/dfg-reflect-get-prototype-of.js: Removed.
33         * stress/ftl-object-get-prototype-of.js: Added.
34         * stress/ftl-reflect-get-prototype-of.js: Added.
35
36 2020-06-24  Yusuke Suzuki  <ysuzuki@apple.com>
37
38         [JSC] Clobberize misses `write(Heap)` report in some nodes
39         https://bugs.webkit.org/show_bug.cgi?id=213525
40         <rdar://problem/64642067>
41
42         Reviewed by Mark Lam.
43
44         * stress/missing-clobber-top-validation.js: Added.
45
46 2020-06-23  Mark Lam  <mark.lam@apple.com>
47
48         Handle string overflow in DFG graph dump while validating AI.
49         https://bugs.webkit.org/show_bug.cgi?id=213524
50         <rdar://problem/64635620>
51
52         Reviewed by Saam Barati.
53
54         * stress/string-overflow-in-dfg-graph-dump.js: Added.
55
56 2020-06-21  Michael Catanzaro  <mcatanzaro@gnome.org>
57
58         Attempt to unskip stress test array-buffer-view-watchpoint-can-be-fired-really-add-in-dfg.js on most architectures
59         https://bugs.webkit.org/show_bug.cgi?id=213433
60
61         Reviewed by Darin Adler.
62
63         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
64
65 2020-06-19  Yusuke Suzuki  <ysuzuki@apple.com>
66
67         [JSC] Check Gigacage usage before launching VM
68         https://bugs.webkit.org/show_bug.cgi?id=213410
69
70         Reviewed by Mark Lam.
71
72         * stress/exhaust-gigacage-and-allocate-vm.js: Added.
73         (foo):
74
75 2020-06-19  Yusuke Suzuki  <ysuzuki@apple.com>
76
77         [JSC] Attempt to reduce timeout failures on Apple Watch Series 3
78         https://bugs.webkit.org/show_bug.cgi?id=213419
79
80         Reviewed by Mark Lam.
81
82         Look into timeout tests, and
83
84         1. If the test is using too many iterations, decrease the count.
85         2. If the test is still useful while iteration count is not so much, try attaching `slow!` to see the effect on the bot.
86
87         * stress/memcpy-typed-loops.js:
88         * stress/op_bitand.js:
89         * stress/op_bitor.js:
90         * stress/op_bitxor.js:
91         * stress/op_mul-ConstVar.js:
92         * stress/op_mul-VarConst.js:
93         * stress/op_mul-VarVar.js:
94         * stress/op_sub-ConstVar.js:
95         * stress/op_sub-VarConst.js:
96         * stress/op_sub-VarVar.js:
97         * stress/set-iteration-oas.js:
98         * stress/value-to-boolean.js:
99
100 2020-06-19  Mark Lam  <mark.lam@apple.com>
101
102         Make $vm properties non-configurable, non-enumerable, and non-writable.
103         https://bugs.webkit.org/show_bug.cgi?id=213395
104
105         Reviewed by Saam Barati and Yusuke Suzuki.
106
107         * stress/dollarVM-properties-should-not-be-enumerable.js: Added.
108
109 2020-06-18  Saam Barati  <sbarati@apple.com>
110
111         sampling-profiler-wasm-name-section should run for more iterations
112         https://bugs.webkit.org/show_bug.cgi?id=207576
113         <rdar://problem/59431250>
114
115         Reviewed by Mark Lam.
116
117         This test was flaky because the sampling profiler is inherently probabilistic.
118         We need to run it for more iterations to ensure it's not flaky.
119
120         * stress/sampling-profiler-wasm-name-section.js:
121
122 2020-06-18  Ross Kirsling  <ross.kirsling@sony.com>
123
124         [Intl] Enable RelativeTimeFormat and Locale by default
125         https://bugs.webkit.org/show_bug.cgi?id=213324
126
127         Reviewed by Yusuke Suzuki.
128
129         * stress/intl-locale-as-intl-param.js:
130         * stress/intl-locale.js:
131         * stress/intl-relativetimeformat.js:
132         * test262/config.yaml:
133         Remove feature flags.
134
135 2020-06-18  Alexey Shvayka  <shvaikalesh@gmail.com>
136
137         Promise built-in functions should be anonymous non-constructors
138         https://bugs.webkit.org/show_bug.cgi?id=213317
139
140         Reviewed by Darin Adler.
141
142         * test262/expectations.yaml: Mark 20 test cases as passing.
143
144 2020-06-18  Alexey Shvayka  <shvaikalesh@gmail.com>
145
146         TypedArray.prototype.set is incorrect with primitives
147         https://bugs.webkit.org/show_bug.cgi?id=212730
148
149         Reviewed by Yusuke Suzuki.
150
151         * test262/expectations.yaml: Mark 2 test cases as passing.
152
153 2020-06-17  Saam Barati  <sbarati@apple.com>
154
155         Skip JSTests/stress/check-is-constant-non-cell-should-not-array-profile-during-osr-exit.js on memory limited devices
156         https://bugs.webkit.org/show_bug.cgi?id=213321
157
158         Reviewed by Mark Lam.
159
160         It uses ~1GB of memory and jetsams on iOS devices.
161
162         * stress/check-is-constant-non-cell-should-not-array-profile-during-osr-exit.js:
163
164 2020-06-17  Yusuke Suzuki  <ysuzuki@apple.com>
165
166         [JSC] Freeze JSBigInt when setting it as a constant in AI
167         https://bugs.webkit.org/show_bug.cgi?id=213310
168         <rdar://problem/64450410>
169
170         Reviewed by Mark Lam.
171
172         * stress/bigint-constant-fold-to-numeric.js: Added.
173         (foo):
174
175 2020-06-17  Alexey Shvayka  <shvaikalesh@gmail.com>
176
177         Update test262 to commit 8d3dd2d1a0a5
178         https://bugs.webkit.org/show_bug.cgi?id=213312
179
180         Reviewed by Yusuke Suzuki.
181
182         * test262/expectations.yaml:
183         * test262/latest-changes-summary.txt:
184         * test262/test/*: Updated.
185         * test262/test262-Revision.txt:
186
187 2020-06-17  Keith Miller  <keith_miller@apple.com>
188
189         $vm.haveABadTime/isHavingABadTime should work with non-globalObject parameters
190         https://bugs.webkit.org/show_bug.cgi?id=213304
191
192         Reviewed by Mark Lam.
193
194         * stress/dollarVM-have-a-bad-time-no-params.js: Added.
195         * stress/dollarVM-have-a-bad-time-works-for-non-global-object-params.js: Added.
196
197 2020-06-16  Yusuke Suzuki  <ysuzuki@apple.com>
198
199         [JSC] Check NullSetterFunction under strict-mode context since structure / PropertyCondition are unaware of this
200         https://bugs.webkit.org/show_bug.cgi?id=213266
201
202         Reviewed by Mark Lam.
203
204         * stress/null-setter-frame.js: Added.
205         (shouldBe):
206         (realm.runString.test):
207         (object.get value):
208         (i.catch):
209         * stress/setter-throw-in-strict.js: Added.
210         (foo):
211
212 2020-06-16  Mark Lam  <mark.lam@apple.com>
213
214         Add SIGABRT handler for non OS(DARWIN) builds to the jsc shell with the -s option.
215         https://bugs.webkit.org/show_bug.cgi?id=213200
216
217         Reviewed by Michael Catanzaro.
218
219         * stress/ensure-crash.js:
220         - unskip this test since expected crashes should now be handled on non-darwin builds.
221
222 2020-06-15  Tadeu Zagallo  <tzagallo@apple.com>
223
224         Bytecode liveness should be aware of checkpoints
225         https://bugs.webkit.org/show_bug.cgi?id=213106
226         <rdar://problem/63416838>
227
228         Reviewed by Keith Miller.
229
230         * stress/iterator-open-checkpoint-liveness.js: Added.
231         (f):
232         (next):
233         (iterator):
234         (catch):
235
236 2020-06-15  Alexey Shvayka  <shvaikalesh@gmail.com>
237
238         Expand JSObject::defineOwnIndexedProperty() fast path for existing properties
239         https://bugs.webkit.org/show_bug.cgi?id=213133
240
241         Reviewed by Yusuke Suzuki.
242
243         * microbenchmarks/array-redefine-index-and-reverse.js: Added.
244         * microbenchmarks/array-redefine-index.js: Added.
245         * stress/define-own-indexed-property-fast-path.js: Added.
246
247 2020-06-15  Caio Lima  <ticaiolima@gmail.com>
248
249         [ARMv7][MIPS][JSC] Skip check-is-constant-non-cell-should-not-array-profile-during-osr-exit.js
250         https://bugs.webkit.org/show_bug.cgi?id=213208
251
252         Unreviewed Gardening.
253
254         * stress/check-is-constant-non-cell-should-not-array-profile-during-osr-exit.js:
255
256 2020-06-15  Keith Miller  <keith_miller@apple.com>
257
258         CheckIsConstant should not use BadCache exit kind
259         https://bugs.webkit.org/show_bug.cgi?id=213141
260
261         Reviewed by Yusuke Suzuki.
262
263         * stress/check-is-constant-non-cell-should-not-array-profile-during-osr-exit.js: Added.
264         (foo.bar):
265
266 2020-06-15  Keith Miller  <keith_miller@apple.com>
267
268         JIT thunks should work on arm64_32
269         https://bugs.webkit.org/show_bug.cgi?id=213103
270
271         Reviewed by Saam Barati.
272
273         skip test on memory limited since it breaks on watch with JIT.
274
275         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
276
277 2020-06-15  Caitlin Potter  <caitp@igalia.com>
278
279         [JSC] add machinery to disable JIT tiers when experimental features are enabled
280         https://bugs.webkit.org/show_bug.cgi?id=213193
281
282         Reviewed by Mark Lam.
283
284         * stress/get-private-name.js:
285         * stress/put-by-val-direct-addprivate.js:
286         * stress/put-by-val-direct-putprivate.js:
287
288 2020-06-15  Alexey Shvayka  <shvaikalesh@gmail.com>
289
290         super should not depend on __proto__
291         https://bugs.webkit.org/show_bug.cgi?id=157972
292
293         Reviewed by Saam Barati.
294
295         * microbenchmarks/object-get-prototype-of-primitive.js: Added.
296         * stress/class-syntax-derived-default-constructor.js:
297         * stress/get-prototype-of.js: Added.
298         * stress/super-property-access.js:
299         * test262/expectations.yaml: Mark 4 test cases as passing.
300
301 2020-06-14  Yusuke Suzuki  <ysuzuki@apple.com>
302
303         Add wasm regresion test for loop
304         https://bugs.webkit.org/show_bug.cgi?id=213176
305
306         Reviewed by Darin Adler.
307
308         This patch adds one more regression test for r246134.
309
310         * wasm/regress/regression-with-loop.js: Added.
311
312 2020-06-13  Devin Rousso  <drousso@apple.com>
313
314         Make `errors` an own property of `AggregateError` instead of a prototype accessor
315         https://bugs.webkit.org/show_bug.cgi?id=212677
316
317         Reviewed by Yusuke Suzuki.
318
319         * stress/AggregateError-own-property-errors.js: Added.
320
321         * test262/expectations.yaml:
322         Mark 9 tests as failing while waiting for test262 to update to match the spec.
323
324 2020-06-12  Robin Morisset  <rmorisset@apple.com>
325
326         The ||= operator (and similar ones) should produce valid bytecode even if the right side is a static error
327         https://bugs.webkit.org/show_bug.cgi?id=213154
328
329         Reviewed by Devin Rousso.
330
331         * stress/bytecode-for-rmw-with-invalid-right-side.js: Added.
332         (catch):
333
334 2020-06-12  Yusuke Suzuki  <ysuzuki@apple.com>
335
336         [JSC] el(Greek) characters' upper-case conversion is locale-sensitive
337         https://bugs.webkit.org/show_bug.cgi?id=213155
338         <rdar://problem/55018467>
339
340         Reviewed by Darin Adler.
341
342         * stress/intl-el-case.js: Added.
343         (shouldBe):
344
345 2020-06-12  Keith Miller  <keith_miller@apple.com>
346
347         Tests expecting a crash should use a signal handler in the JSC CLI process
348         https://bugs.webkit.org/show_bug.cgi?id=212479
349
350         Reviewed by Yusuke Suzuki.
351
352         * stress/ensure-crash.js:
353         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-bad-transition-debug.js:
354         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-bad-transition.js:
355         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-debug.js: Removed.
356         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js:
357         * stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten-debug.js:
358
359 2020-06-12  Alexey Shvayka  <shvaikalesh@gmail.com>
360
361         AsyncGenerator should await "return" completions
362         https://bugs.webkit.org/show_bug.cgi?id=212774
363
364         Reviewed by Ross Kirsling.
365
366         With this change, async generator stress tests now pass in Chrome and Firefox (tested manually).
367
368         * stress/async-iteration-yield-star-interface.js:
369         * stress/async-iteration-yield-star.js:
370         * test262/expectations.yaml: Mark 8 test cases as passing.
371
372 2020-06-12  Yusuke Suzuki  <ysuzuki@apple.com>
373
374         [JSC] Add sampling-profiler code-origin lookup test
375         https://bugs.webkit.org/show_bug.cgi?id=213108
376         <rdar://problem/52044072>
377
378         Reviewed by Saam Barati.
379
380         This is fixed by r262920. This patch just adds a test additionally.
381         We are keeping CallSiteIndex valid until corresponding JIT stub is destroyed.
382         This fixes SamplingProfiler too since SamplingProfiler also collects CallSiteIndex and gets corresponding CodeOrigin.
383         Since SamplingProfiler does this CallSiteIndex => CodeOrigin before running GC finalizer, validity of CallSiteIndex
384         should be kept correctly.
385
386         * stress/sampling-profiler-code-origin.js: Added.
387         (let.oThrow.get f):
388         (foo):
389         (return.get f):
390         (f):
391
392 2020-06-11  Yusuke Suzuki  <ysuzuki@apple.com>
393
394         [JSC] Return DisposableCallSiteIndex when destroying GCAwareJITStubRoutineWithExceptionHandler
395         https://bugs.webkit.org/show_bug.cgi?id=213069
396         <rdar://problem/64205186>
397
398         Reviewed by Saam Barati.
399
400         * stress/dont-dispose-callsiteindex-while-executing.js: Added.
401         (emptyFunction):
402         (foo.bar.set catch):
403         (foo.bar):
404         (foo):
405
406 2020-06-11  Alexey Shvayka  <shvaikalesh@gmail.com>
407
408         RegExp.prototype getters should throw on cross-realm access
409         https://bugs.webkit.org/show_bug.cgi?id=213075
410
411         Reviewed by Saam Barati.
412
413         * test262/expectations.yaml: Mark 14 test cases as passing.
414
415 2020-06-10  Ross Kirsling  <ross.kirsling@sony.com>
416
417         REGRESSION(r260697): [Intl] "missing script" locales like zh-TW are no longer mapped
418         https://bugs.webkit.org/show_bug.cgi?id=213007
419
420         Reviewed by Darin Adler.
421
422         * stress/intl-missing-script-locales.js: Added.
423
424 2020-06-10  Caitlin Potter  <caitp@igalia.com>
425
426         [JSC] add stress test for op_get_private_name
427         https://bugs.webkit.org/show_bug.cgi?id=213024
428
429         Reviewed by Mark Lam.
430
431         * stress/get-private-name.js: Added.
432
433 2020-06-09  Mark Lam  <mark.lam@apple.com>
434
435         Stringifier::appendStringifiedValue() should not assume it is always safe to recurse.
436         https://bugs.webkit.org/show_bug.cgi?id=213006
437         <rdar://problem/64154840>
438
439         Reviewed by Keith Miller.
440
441         * stress/json-stringify-executing-in-reserved-zone.js: Added.
442
443 2020-06-09  Mark Lam  <mark.lam@apple.com>
444
445         Disambiguate the OverridesGetPropertyNames structure flag
446         https://bugs.webkit.org/show_bug.cgi?id=212909
447         <rdar://problem/63823557>
448
449         Reviewed by Saam Barati.
450
451         * stress/unexpected-stack-overflow-below-JSObject-getPropertyNames.js: Added.
452
453 2020-06-08  Ross Kirsling  <ross.kirsling@sony.com>
454
455         [Intl] Update tests to support ICU 67
456         https://bugs.webkit.org/show_bug.cgi?id=212943
457
458         Reviewed by Yusuke Suzuki.
459
460         Our tests have been assuming ICU 60-64 results but WinCairo and PlayStation are now on ICU 67,
461         which includes fixes for variant alphabetization and non-explicit "-true" values in locale strings.
462
463         * stress/intl-collator.js:
464         (explicitTrueBeforeICU67):
465         (shouldBe.testCollator.Intl.Collator):
466         * stress/intl-datetimeformat.js:
467         * stress/intl-locale.js:
468         * stress/intl-numberformat.js:
469         * stress/intl-object.js:
470         * stress/intl-pluralrules.js:
471         * stress/intl-relativetimeformat.js:
472
473 2020-06-08  Keith Miller  <keith_miller@apple.com>
474
475         Fix tests that time out on Series 4 Watch
476         https://bugs.webkit.org/show_bug.cgi?id=212911
477
478         Reviewed by Saam Barati.
479
480         Simplify some logic about when to skip microbenchmarks to $jitTests.
481         Also reduce iteration count for
482         dont-range-based-iterate-vector-that-is-mutated.js
483
484         Also, mark wasm tests as not run on watch.
485
486         * microbenchmarks/bit-test-constant.js:
487         * microbenchmarks/bit-test-nonconstant.js:
488         * microbenchmarks/interpreter-wasm.js:
489         * microbenchmarks/memcpy-typed-loop-large.js:
490         * microbenchmarks/memcpy-typed-loop-small.js:
491         * microbenchmarks/mul-immediate-sub.js:
492         * stress/dont-range-based-iterate-vector-that-is-mutated.js:
493         * stress/sampling-profiler-richards.js:
494
495 2020-06-08  Alexey Shvayka  <shvaikalesh@gmail.com>
496
497         JSON.stringify should throw stack overflow error
498         https://bugs.webkit.org/show_bug.cgi?id=143511
499
500         Reviewed by Ross Kirsling and Mark Lam.
501
502         * stress/json-stringify-stack-overflow.js: Added.
503         * stress/json-stringify-string-builder-overflow.js:
504
505 2020-06-05  Saam Barati  <sbarati@apple.com>
506
507         Audit safe to execute
508         https://bugs.webkit.org/show_bug.cgi?id=207075
509         <rdar://problem/59085094>
510
511         Reviewed by Yusuke Suzuki.
512
513         * microbenchmarks/licm-dom-jit.js: Added.
514         (assert):
515         (foo):
516         (bar):
517
518 2020-06-05  Saam Barati  <sbarati@apple.com>
519
520         Try to reduce jetsams further on iOS devices running jsc stress tests
521         https://bugs.webkit.org/show_bug.cgi?id=212786
522
523         Reviewed by Mark Lam.
524
525         * wasm/references/multitable.js:
526         (string_appeared_here.vm.isMemoryLimited.tableInsanity):
527         (string_appeared_here.vm.isMemoryLimited.):
528         (string_appeared_here.vm.isMemoryLimited):
529         (string_appeared_here.tableInsanity): Deleted.
530         (I32Const.0.GetLocal.0.TableSet.1.End.End.WebAssembly.): Deleted.
531         (I32Const.0.GetLocal.0.TableSet.1.End.End.WebAssembly): Deleted.
532
533 2020-06-05  Devin Rousso  <drousso@apple.com>
534
535         Logical Assignment: perform NamedEvaluation of anonymous functions
536         https://bugs.webkit.org/show_bug.cgi?id=212679
537
538         Reviewed by Ross Kirsling.
539
540         * stress/logical-assignment-operator-and.js:
541         * stress/logical-assignment-operator-coalesce.js:
542         * stress/logical-assignment-operator-or.js:
543
544 2020-06-05  Caitlin Potter  <caitp@igalia.com>
545
546         [JSC] Add support for private class fields
547         https://bugs.webkit.org/show_bug.cgi?id=206431
548
549         Reviewed by Saam Barati.
550
551         Expands upon the earlier public fields patch, adding a number of private
552         field tests.
553
554         * stress/class-fields-private-as-function.js: Added.
555         * stress/class-fields-private-cached-bytecode.js: Added.
556         * stress/class-fields-private-freeze-out-of-line.js: Added.
557         * stress/class-fields-private-freeze.js: Added.
558         * stress/class-fields-private-on-proxy.js: Added.
559         * stress/class-fields-private-out-of-line.js: Added.
560         * stress/class-fields-private-prevent-extensions-out-of-line.js: Added.
561         * stress/class-fields-private-prevent-extensions.js: Added.
562         * stress/class-fields-private-seal-out-of-line.js: Added.
563         * stress/class-fields-private-seal.js: Added.
564         * stress/class-fields-private-use-eval.js: Added.
565         * stress/class-fields-stress-instance.js:
566         * stress/optional-chaining-and-private-fields.js: Added.
567         * stress/private-name-access-in-computed-property.js: Added.
568         * stress/put-by-val-direct-addprivate.js: Added.
569         * stress/put-by-val-direct-putprivate.js: Added.
570         * test262/config.yaml:
571
572 2020-06-04  Paulo Matos  <pmatos@igalia.com>
573
574         Skip microbenchmarks/interpreter-wasm.js on MIPS/ARM
575
576         Unreviewed Gardening.
577
578         There's no native wasm support on 32bits atm - skipping.
579
580         * microbenchmarks/interpreter-wasm.js:
581
582 2020-06-04  Ross Kirsling  <ross.kirsling@sony.com>
583
584         Intl classes should have meaningful @@toStringTag values
585         https://bugs.webkit.org/show_bug.cgi?id=212769
586
587         Reviewed by Yusuke Suzuki.
588
589         * test262/expectations.yaml:
590         Mark 16 test cases as passing.
591
592         * stress/intl-collator.js:
593         * stress/intl-datetimeformat.js:
594         * stress/intl-numberformat.js:
595         * stress/intl-pluralrules.js:
596         Update stress tests.
597
598 2020-06-04  Alexey Shvayka  <shvaikalesh@gmail.com>
599
600         GetMethod isn't performed properly on iterators
601         https://bugs.webkit.org/show_bug.cgi?id=212771
602
603         Reviewed by Saam Barati.
604
605         * test262/expectations.yaml: Mark 26 test cases as passing.
606
607 2020-06-04  Alexey Shvayka  <shvaikalesh@gmail.com>
608
609         Update test262 to commit 290ceba31fea
610         https://bugs.webkit.org/show_bug.cgi?id=212752
611
612         Reviewed by Ross Kirsling.
613
614         * test262/config.yaml: Unskip tests fixed in r260990.
615         * test262/expectations.yaml:
616         * test262/latest-changes-summary.txt:
617         * test262/test/*: Updated.
618         * test262/test262-Revision.txt:
619
620 2020-06-03  Tadeu Zagallo  <tzagallo@apple.com>
621
622         Disable B3 hoistLoopInvariantValues by default
623         https://bugs.webkit.org/show_bug.cgi?id=212511
624         <rdar://problem/63813245>
625
626         Reviewed by Mark Lam.
627
628         * microbenchmarks/interpreter-wasm.js: Added.
629         (key.in.Module.Module.hasOwnProperty):
630         (quit_):
631         (locateFile):
632         (ENVIRONMENT_IS_NODE.read_):
633         (ENVIRONMENT_IS_NODE.readBinary):
634         (ENVIRONMENT_IS_NODE.quit_):
635         (ENVIRONMENT_IS_NODE.Module.string_appeared_here):
636         (else.read_):
637         (else.readBinary):
638         (else.quit_):
639         (else):
640         (else.xhr.onload):
641         (else.readAsync):
642         (else.setWindowTitle):
643         (key.in.moduleOverrides.moduleOverrides.hasOwnProperty):
644         (dynamicAlloc):
645         (getNativeTypeSize):
646         (warnOnce):
647         (convertJsFunctionToWasm):
648         (addFunctionWasm):
649         (removeFunctionWasm):
650         (setTempRet0):
651         (setValue):
652         (assert):
653         (getCFunc):
654         (toC.string_appeared_here):
655         (convertReturnValue):
656         (ccall):
657         (UTF8ArrayToString):
658         (UTF8ToString):
659         (stringToUTF8Array):
660         (stringToUTF8):
661         (lengthBytesUTF8):
662         (allocateUTF8OnStack):
663         (writeArrayToMemory):
664         (writeAsciiToMemory):
665         (updateGlobalBufferAndViews):
666         (callRuntimeCallbacks):
667         (preRun):
668         (initRuntime):
669         (preMain):
670         (exitRuntime):
671         (postRun):
672         (addOnPreRun):
673         (addOnPostRun):
674         (addRunDependency):
675         (removeRunDependency):
676         (hasPrefix):
677         (isDataURI):
678         (isFileURI):
679         (getBinary):
680         (getBinaryPromise):
681         (createWasm.receiveInstance):
682         (createWasm.receiveInstantiatedSource):
683         (createWasm.instantiateArrayBuffer):
684         (createWasm.instantiateAsync.):
685         (createWasm.instantiateAsync):
686         (createWasm):
687         (__ATINIT__.push.func):
688         (demangle):
689         (demangleAll):
690         (_emscripten_get_sbrk_ptr):
691         (_emscripten_memcpy_big):
692         (abortOnCannotGrowMemory):
693         (_emscripten_resize_heap):
694         (PATH.splitPath):
695         (PATH.normalizeArray):
696         (PATH.normalize):
697         (PATH.dirname):
698         (PATH.basename):
699         (PATH.extname):
700         (PATH.join):
701         (PATH.join2):
702         (SYSCALLS.printChar):
703         (SYSCALLS.getStr):
704         (SYSCALLS.get64):
705         (_fd_write):
706         (_setTempRet0):
707         (___wasm_call_ctors.Module.string_appeared_here):
708         (_main.Module.string_appeared_here):
709         (_malloc.Module.string_appeared_here):
710         (___errno_location.Module.string_appeared_here):
711         (_free.Module.string_appeared_here):
712         (stackSave.Module.string_appeared_here):
713         (stackAlloc.Module.string_appeared_here):
714         (stackRestore.Module.string_appeared_here):
715         (__growWasmMemory.Module.string_appeared_here):
716         (dynCall_ii.Module.string_appeared_here):
717         (dynCall_iiii.Module.string_appeared_here):
718         (dynCall_jiji.Module.string_appeared_here):
719         (ExitStatus):
720         (dependenciesFulfilled):
721         (callMain):
722         (run.doRun):
723         (run):
724         (exit):
725         * microbenchmarks/interpreter-wasm.wasm: Added.
726
727 2020-06-02  Saam Barati  <sbarati@apple.com>
728
729         MultiDeleteByOffset should not always def
730         https://bugs.webkit.org/show_bug.cgi?id=212621
731         <rdar://problem/63824182>
732
733         Reviewed by Yusuke Suzuki.
734
735         * stress/multi-del-by-offset-doesnt-always-def-osr-entry.js: Added.
736         (foo):
737         * stress/multi-del-by-offset-doesnt-always-def.js: Added.
738         (foo):
739         (let.p.set undefined):
740
741 2020-06-01  Yusuke Suzuki  <ysuzuki@apple.com>
742
743         [JSC] JSBigInt::rightTrim can miss |this| pointer and leads to incorrect GC collection
744         https://bugs.webkit.org/show_bug.cgi?id=212601
745
746         Reviewed by Saam Barati.
747
748         * stress/bigint-should-not-be-collected-while-creating.js: Added.
749         (foo.let.increment.10000n.bar):
750         (foo):
751
752 2020-06-01  Yusuke Suzuki  <ysuzuki@apple.com>
753
754         [JSC] JSValue::toThis should not throw exception
755         https://bugs.webkit.org/show_bug.cgi?id=212595
756
757         Reviewed by Mark Lam.
758
759         * stress/number-proto.js: Added.
760         (shouldBe):
761
762 2020-06-01  Caio Lima  <ticaiolima@gmail.com>
763
764         JSTests/exceptionFuzz/earley-boyer.js fails with early exception thrown.
765         https://bugs.webkit.org/show_bug.cgi?id=212569
766
767         Reviewed by Mark Lam.
768
769         This is a temporary fix to avoid flawky results when running
770         `exceptionFuzz` tests. Right now, exception handler starts after
771         function declarations, since they are hoisted. Since function
772         declarations emit `new_func` bytecode, those bytecodes can
773         throw an exception outside expected exception handler.
774         Embedding them in a function avoid such hoisting to happen.
775
776         * exceptionFuzz/3d-cube.js:
777         * exceptionFuzz/date-format-xparb.js:
778         * exceptionFuzz/earley-boyer.js:
779
780 2020-05-30  Yusuke Suzuki  <ysuzuki@apple.com>
781
782         [JSC] for-in should allocate new temporary register for base
783         https://bugs.webkit.org/show_bug.cgi?id=212519
784         <rdar://problem/63722044>
785
786         Reviewed by Saam Barati.
787
788         * microbenchmarks/has-own-property-for-in-loop-with-heap-variable.js: Added.
789         (assert):
790         (test1.count):
791         (test1):
792         * microbenchmarks/has-own-property-for-in-loop-with-this.js: Added.
793         (assert):
794         (test1.count):
795         (test1):
796         * stress/for-in-body-replace-enumerable.js: Added.
797         (foo):
798         * stress/for-in-enumerable-shadow.js: Added.
799         (assert):
800         (test1.count):
801         (test1):
802         * stress/for-in-enumerable-this-arrow.js: Added.
803         (assert):
804         (test1):
805
806 2020-05-29  Yusuke Suzuki  <ysuzuki@apple.com>
807
808         [JSC] JSBigInt allocation should be graceful for OOM
809         https://bugs.webkit.org/show_bug.cgi?id=212512
810
811         Reviewed by Mark Lam.
812
813         * stress/bigint-can-throw-oom.js: Copied from JSTests/stress/get-function-realm-not-doing-recursion.js.
814         (canThrow):
815         (foo):
816         (get foo):
817         * stress/get-function-realm-not-doing-recursion.js:
818         (canThrow):
819
820 2020-05-29  Yusuke Suzuki  <ysuzuki@apple.com>
821
822         [JSC] Split some of JSC tests / reduce iteration count to make it not timed-out in Debug build
823         https://bugs.webkit.org/show_bug.cgi?id=212557
824
825         Reviewed by Mark Lam.
826
827         * stress/should-not-emit-double-rep-for-bigint.js: Ensured that this iteration count can reproduce the original crash.
828         * stress/tailCallForwardArguments.js: Split tests into 4 files.
829         (let.bodyText): Deleted.
830         (baz4): Deleted.
831         (testFunc): Deleted.
832         (baz5): Deleted.
833         (baz6): Deleted.
834         (arrayEq): Deleted.
835         * stress/tailCallForwardArguments2.js: Added.
836         (putFuncToPrivateName.createBuiltin):
837         (createTailCallForwardingFuncWith):
838         (putFuncToPrivateName):
839         (let.bodyText):
840         (baz4):
841         * stress/tailCallForwardArguments3.js: Added.
842         (putFuncToPrivateName.createBuiltin):
843         (createTailCallForwardingFuncWith):
844         (putFuncToPrivateName):
845         (let.bodyText):
846         (testFunc):
847         (baz5):
848         * stress/tailCallForwardArguments4.js: Added.
849         (putFuncToPrivateName.createBuiltin):
850         (createTailCallForwardingFuncWith):
851         (let.bodyText):
852         (putFuncToPrivateName):
853         (baz6):
854         (arrayEq):
855
856 2020-05-29  Saam Barati  <sbarati@apple.com>
857
858         We need to properly model heap ranges of Delete in DFG/B3
859         https://bugs.webkit.org/show_bug.cgi?id=212538
860         <rdar://problem/63670964>
861
862         Reviewed by Filip Pizlo.
863
864         * stress/delete-inlining-should-model-aliasing-of-future-stores.js: Added.
865
866 2020-05-29  Saam Barati  <sbarati@apple.com>
867
868         Skip a few more JSC tests when $memoryLimited
869         https://bugs.webkit.org/show_bug.cgi?id=212552
870
871         Reviewed by Mark Lam.
872
873         * stress/call-varargs-inlining-should-not-clobber-previous-to-free-register.js:
874         * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js:
875
876 2020-05-27  Keith Miller  <keith_miller@apple.com>
877
878         for-of should check the iterable is a JSArray for FastArray in DFG iterator_open
879         https://bugs.webkit.org/show_bug.cgi?id=212383
880
881         Reviewed by Saam Barati.
882
883         * stress/check-sub-class.js:
884         * stress/for-of-iterator-open-fast-array-should-check-js-type.js: Added.
885         (foo):
886
887 2020-05-27  Saam Barati  <sbarati@apple.com>
888
889         hasOwnProperty inside structure property for-in loop should use an opcode like has_structure_property but for hasOwnProperty
890         https://bugs.webkit.org/show_bug.cgi?id=212248
891
892         Reviewed by Keith Miller.
893
894         * microbenchmarks/has-own-property-for-in-loop.js: Added.
895         * stress/has-own-property-structure-for-in-loop-correctness.js: Added.
896
897 2020-05-27  Yusuke Suzuki  <ysuzuki@apple.com>
898
899         [ macOS iOS ] REGRESSION(r261600?): imported/w3c/web-platform-tests/html/dom/reflection-embedded.html & imported/w3c/web-platform-tests/html/dom/reflection-forms.html are flaky failures
900         https://bugs.webkit.org/show_bug.cgi?id=212430
901
902         Reviewed by Saam Barati.
903
904         * stress/is-constructor-should-be-correct-in-ai.js: Added.
905         (shouldBe):
906         (test):
907
908 2020-05-27  Saam Barati  <sbarati@apple.com>
909
910         Limit memory used by wasm/references/multitable.js on memory limited devices
911         https://bugs.webkit.org/show_bug.cgi?id=212437
912
913         Reviewed by Keith Miller.
914
915         wasm/references/multitable.js was using around ~700MB of memory.
916         This looks like it's causing jetsams on some of our iOS test runners.
917         This patch makes this test use less memory on memory limited devices.
918
919         * wasm/assert.js:
920         * wasm/references/multitable.js:
921         (string_appeared_here.tableInsanity):
922
923 2020-05-27  Keith Miller  <keith_miller@apple.com>
924
925         Unreviwed, catch expected exception in new test.
926
927         * stress/for-in-in-structure-property-constant-virtual-register.js:
928
929 2020-05-27  Keith Miller  <keith_miller@apple.com>
930
931         in_structure_property needs to handle constants on the RHS of the "in"
932         https://bugs.webkit.org/show_bug.cgi?id=212399
933
934         Reviewed by Saam Barati.
935
936         * stress/for-in-in-structure-property-constant-virtual-register.js: Added.
937
938 2020-05-26  Mark Lam  <mark.lam@apple.com>
939
940         JSC stress tests that require --useLLInt=0 should be skipped on --no-jit test runs.
941         https://bugs.webkit.org/show_bug.cgi?id=212400
942
943         Reviewed by Saam Barati.
944
945         That's because using --useLLInt=0 and --useJIT=0 together is not a "coherent"
946         (read "valid") configuration.  We should be able to do a --no-jit test run with
947         the JSC_useJIT=0 environmental variable set.  Before this patch, the following
948         tests will all fail.  This patch skips them.
949
950         * stress/delete-property-poly-proto.js:
951         * stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js:
952         * stress/getter-setter-inlining-should-emit-movhint.js:
953         * stress/merging-ic-variants-should-bail-if-structures-overlap.js:
954         * stress/poly-proto-setter-adds-setter-in-middle.js:
955         * stress/poly-proto-setter-changes-setter-2.js:
956         * stress/poly-proto-setter-changes-setter.js:
957         * stress/racy-gc-cleanup-of-identifier-after-mutator-stops-running.js:
958         * stress/regress-192717.js:
959         * stress/retry-cache-later.js:
960
961 2020-05-26  Alexey Shvayka  <shvaikalesh@gmail.com>
962
963         IteratorClose should suppress GetMethod errors
964         https://bugs.webkit.org/show_bug.cgi?id=212378
965
966         Reviewed by Keith Miller.
967
968         * stress/custom-iterators.js:
969         * stress/iterator-return-abrupt-lookup-builtins.js: Added.
970         * test262/expectations.yaml: Mark 4 test cases as passing.
971
972 2020-05-23  Caio Lima  <ticaiolima@gmail.com>
973
974         [bmalloc] Fix OOM errors on MIPS after r261667
975         https://bugs.webkit.org/show_bug.cgi?id=212016
976
977         Reviewed by Yusuke Suzuki.
978
979         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
980         * stress/big-int-mod-memory-stress.js:
981         * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js:
982
983 2020-05-22  Alexey Shvayka  <shvaikalesh@gmail.com>
984
985         Array.prototype.splice doesn't set "length" of returned object
986         https://bugs.webkit.org/show_bug.cgi?id=212285
987
988         Reviewed by Darin Adler.
989
990         * test262/expectations.yaml: Mark 2 test cases as passing.
991
992 2020-05-22  Saam Barati  <sbarati@apple.com>
993
994         in_by_val inside structure property for-in loop should use an opcode like has_structure_property but for "in"
995         https://bugs.webkit.org/show_bug.cgi?id=212239
996
997         Reviewed by Tadeu Zagallo.
998
999         * microbenchmarks/in-by-val-inside-for-in-loop.js: Added.
1000         (assert):
1001         (count):
1002         * stress/in-by-val-inside-for-in-loop.js: Added.
1003         (assert):
1004         (test1.count):
1005         (test1):
1006         (test2.count):
1007         (test2):
1008         (test3.count):
1009         (test3):
1010         (test4.count):
1011         (test4):
1012         (test5.count):
1013         (test5):
1014         (test6.count):
1015         (test6):
1016         (test7.count):
1017         (test7):
1018         (test8.count):
1019         (test8):
1020
1021 2020-05-22  Keith Miller  <keith_miller@apple.com>
1022
1023         Checkpoint inlined call return handler needs an exception check when dispatching
1024         https://bugs.webkit.org/show_bug.cgi?id=212104
1025
1026         Reviewed by Yusuke Suzuki.
1027
1028         * stress/for-of-done-getter-osr-exits-inlined-to-value-getter-with-exception.js: Added.
1029         (let.d.get done):
1030         (let.d.get value):
1031         (foo):
1032         (catch):
1033
1034 2020-05-21  Alexey Shvayka  <shvaikalesh@gmail.com>
1035
1036         Use @isUndefinedOrNull instead of abstract equality with null
1037         https://bugs.webkit.org/show_bug.cgi?id=210954
1038
1039         Reviewed by Yusuke Suzuki.
1040
1041         * test262/expectations.yaml: Mark 16 test cases as passing.
1042
1043 2020-05-21  Alexey Shvayka  <shvaikalesh@gmail.com>
1044
1045         Array.prototype.concat is incorrect with objects whose "length" exceeds 2 ** 32 - 1
1046         https://bugs.webkit.org/show_bug.cgi?id=212167
1047
1048         Reviewed by Saam Barati.
1049
1050         * stress/array-prototype-concat-of-long-spliced-arrays.js:
1051         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
1052         * test262/expectations.yaml: Mark 4 test cases as passing.
1053
1054 2020-05-19  Michael Catanzaro  <mcatanzaro@gnome.org>
1055
1056         Fixups for r261689 "stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js failing on ppc64le and s390x"
1057         https://bugs.webkit.org/show_bug.cgi?id=211724
1058         <rdar://problem/63227393>
1059
1060         Reviewed by Carlos Alberto Lopez Perez.
1061
1062         Separately skip 32-bit and 64-bit PowerPC.
1063
1064         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
1065
1066 2020-05-18  Yusuke Suzuki  <ysuzuki@apple.com>
1067
1068         [JSC] BigInt peephole compare should speculate appropriately
1069         https://bugs.webkit.org/show_bug.cgi?id=212037
1070         <rdar://problem/63346966>
1071
1072         Reviewed by Saam Barati.
1073
1074         * stress/bigint-compare-peephole-branch.js: Added.
1075
1076 2020-05-18  Keith Miller  <keith_miller@apple.com>
1077
1078         OSR loop entry to iterator_next generic needs to CheckNotEmpty on m_next
1079         https://bugs.webkit.org/show_bug.cgi?id=212001
1080
1081         Reviewed by Saam Barati.
1082
1083         * stress/for-of-osr-loop-enter-active-next-differs-from-seen-modes.js: Added.
1084         (foo):
1085
1086 2020-05-18  Paulo Matos  <pmatos@igalia.com>
1087
1088         Skip stress test array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js on MIPS
1089
1090         Unreviewed Gardening.
1091
1092         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
1093
1094 2020-05-16  Keith Miller  <keith_miller@apple.com>
1095
1096         [test262] Update to master for May
1097         https://bugs.webkit.org/show_bug.cgi?id=211985
1098
1099         Reviewed by Mark Lam.
1100
1101         * test262/expectations.yaml:
1102         * test262/harness/testIntl.js:
1103         * test262/latest-changes-summary.txt:
1104         * test262/test/annexB/built-ins/Array/from/iterator-method-emulates-undefined.js: Added.
1105         * test262/test/annexB/built-ins/String/prototype/match/custom-matcher-emulates-undefined.js: Added.
1106         * test262/test/annexB/built-ins/String/prototype/matchAll/custom-matcher-emulates-undefined.js: Added.
1107         * test262/test/annexB/built-ins/String/prototype/replace/custom-replacer-emulates-undefined.js: Added.
1108         * test262/test/annexB/built-ins/String/prototype/replaceAll/custom-replacer-emulates-undefined.js: Added.
1109         * test262/test/annexB/built-ins/String/prototype/search/custom-searcher-emulates-undefined.js: Added.
1110         * test262/test/annexB/built-ins/String/prototype/split/custom-splitter-emulates-undefined.js: Added.
1111         * test262/test/annexB/built-ins/TypedArrayConstructors/from/iterator-method-emulates-undefined.js: Added.
1112         (testWithTypedArrayConstructors):
1113         * test262/test/annexB/language/expressions/yield/star-iterable-throw-emulates-undefined-throws-when-called.js:
1114         * test262/test/built-ins/AsyncGeneratorFunction/proto-from-ctor-realm-prototype.js: Added.
1115         * test262/test/built-ins/Atomics/waitAsync/false-for-timeout-agent.js:
1116         * test262/test/built-ins/Atomics/waitAsync/good-views.js:
1117         * test262/test/built-ins/Atomics/waitAsync/nan-for-timeout-agent.js:
1118         * test262/test/built-ins/Atomics/waitAsync/negative-timeout-agent.js:
1119         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-no-operation.js:
1120         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-on-add.js:
1121         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-on-and.js:
1122         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-on-compareExchange.js:
1123         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-on-exchange.js:
1124         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-on-or.js:
1125         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-on-store.js:
1126         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-on-sub.js:
1127         * test262/test/built-ins/Atomics/waitAsync/no-spurious-wakeup-on-xor.js:
1128         * test262/test/built-ins/Atomics/waitAsync/null-for-timeout-agent.js:
1129         * test262/test/built-ins/Atomics/waitAsync/object-for-timeout-agent.js:
1130         * test262/test/built-ins/Atomics/waitAsync/poisoned-object-for-timeout-throws-agent.js:
1131         * test262/test/built-ins/Atomics/waitAsync/symbol-for-index-throws-agent.js:
1132         * test262/test/built-ins/Atomics/waitAsync/symbol-for-timeout-throws-agent.js:
1133         * test262/test/built-ins/Atomics/waitAsync/symbol-for-value-throws-agent.js:
1134         * test262/test/built-ins/Atomics/waitAsync/true-for-timeout-agent.js:
1135         * test262/test/built-ins/Atomics/waitAsync/undefined-for-timeout-agent.js:
1136         * test262/test/built-ins/Atomics/waitAsync/undefined-index-defaults-to-zero-agent.js:
1137         * test262/test/built-ins/Atomics/waitAsync/value-not-equal-agent.js:
1138         * test262/test/built-ins/Atomics/waitAsync/waiterlist-block-indexedposition-wake.js:
1139         * test262/test/built-ins/Atomics/waitAsync/was-woken-before-timeout.js:
1140         * test262/test/built-ins/BigInt/prototype/toString/a-z.js: Added.
1141         * test262/test/built-ins/Function/proto-from-ctor-realm-prototype.js: Added.
1142         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm-prototype.js: Added.
1143         * test262/test/built-ins/NativeErrors/AggregateError/proto-from-ctor-realm.js:
1144         * test262/test/built-ins/Number/isSafeInteger/safe-integers.js:
1145         * test262/test/built-ins/Number/prototype/toString/a-z.js: Added.
1146         * test262/test/built-ins/Object/assign/strings-and-symbol-order-proxy.js: Added.
1147         (getOwnPropertyDescriptor):
1148         (ownKeys):
1149         * test262/test/built-ins/Object/defineProperties/proxy-no-ownkeys-returned-keys-order.js: Added.
1150         (getOwnPropertyDescriptor):
1151         * test262/test/built-ins/Object/freeze/proxy-no-ownkeys-returned-keys-order.js: Added.
1152         (getOwnPropertyDescriptor):
1153         * test262/test/built-ins/Object/getOwnPropertyDescriptors/proxy-no-ownkeys-returned-keys-order.js: Added.
1154         (getOwnPropertyDescriptor):
1155         * test262/test/built-ins/Object/isFrozen/proxy-no-ownkeys-returned-keys-order.js: Added.
1156         (getOwnPropertyDescriptor):
1157         * test262/test/built-ins/Object/isSealed/proxy-no-ownkeys-returned-keys-order.js: Added.
1158         (getOwnPropertyDescriptor):
1159         * test262/test/built-ins/Object/prototype/hasOwnProperty/S15.2.4.5_A10.js: Removed.
1160         * test262/test/built-ins/Object/prototype/hasOwnProperty/S15.2.4.5_A11.js: Removed.
1161         * test262/test/built-ins/Object/prototype/hasOwnProperty/S15.2.4.5_A8.js: Removed.
1162         * test262/test/built-ins/Object/prototype/hasOwnProperty/S15.2.4.5_A9.js: Removed.
1163         * test262/test/built-ins/Object/prototype/hasOwnProperty/length.js: Added.
1164         * test262/test/built-ins/Object/prototype/hasOwnProperty/topropertykey_before_toobject.js: Added.
1165         (coercibleKey1.get toString):
1166         (coercibleKey1.get valueOf):
1167         (coercibleKey2.Symbol.toPrimitive):
1168         * test262/test/built-ins/Object/prototype/toString/proxy-revoked-during-get-call.js: Added.
1169         * test262/test/built-ins/Object/seal/proxy-no-ownkeys-returned-keys-order.js: Added.
1170         (defineProperty):
1171         * test262/test/built-ins/Promise/all/invoke-resolve-get-once-no-calls.js:
1172         * test262/test/built-ins/Promise/all/resolve-not-callable-close.js: Added.
1173         (const.iter.return.return):
1174         (const.iter.Symbol.iterator):
1175         (Promise.all.iter.then):
1176         * test262/test/built-ins/Promise/allSettled/resolve-not-callable-close.js: Added.
1177         (const.iter.return.return):
1178         (const.iter.Symbol.iterator):
1179         (Promise.allSettled.iter.then):
1180         * test262/test/built-ins/Promise/any/resolve-not-callable-close.js: Added.
1181         (const.iter.return.return):
1182         (const.iter.Symbol.iterator):
1183         (Promise.any.iter.then):
1184         * test262/test/built-ins/Promise/race/resolve-not-callable-close.js: Added.
1185         (const.iter.return.return):
1186         (const.iter.Symbol.iterator):
1187         (Promise.race.iter.then):
1188         * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/order-dayPeriod.js:
1189         * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/order-fractionalSecondDigits.js:
1190         * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/order-style.js:
1191         * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/order.js:
1192         * test262/test/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-long.js:
1193         (expected.of.Object.entries):
1194         * test262/test/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-narrow.js:
1195         (expected.of.Object.entries):
1196         * test262/test/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-short.js:
1197         (expected.of.Object.entries):
1198         * test262/test/intl402/RelativeTimeFormat/prototype/formatToParts/pl-pl-style-long.js:
1199         (expected.of.Object.entries):
1200         * test262/test/intl402/RelativeTimeFormat/prototype/formatToParts/pl-pl-style-narrow.js:
1201         (expected.of.Object.entries):
1202         * test262/test/intl402/RelativeTimeFormat/prototype/formatToParts/pl-pl-style-short.js:
1203         (expected.of.Object.entries):
1204         * test262/test/language/expressions/async-generator/named-yield-star-sync-return.js:
1205         (gen):
1206         * test262/test/language/expressions/async-generator/named-yield-star-sync-throw.js:
1207         (gen):
1208         * test262/test/language/expressions/async-generator/yield-star-sync-return.js:
1209         * test262/test/language/expressions/async-generator/yield-star-sync-throw.js:
1210         * test262/test/language/expressions/class/async-gen-method-static/yield-star-sync-return.js:
1211         (C):
1212         * test262/test/language/expressions/class/async-gen-method-static/yield-star-sync-throw.js:
1213         (C):
1214         * test262/test/language/expressions/class/async-gen-method/yield-star-sync-return.js:
1215         * test262/test/language/expressions/class/async-gen-method/yield-star-sync-throw.js:
1216         * test262/test/language/expressions/class/elements/async-gen-private-method-static/yield-star-sync-return.js:
1217         (C):
1218         * test262/test/language/expressions/class/elements/async-gen-private-method-static/yield-star-sync-throw.js:
1219         (C):
1220         * test262/test/language/expressions/class/elements/async-gen-private-method/yield-star-sync-return.js:
1221         * test262/test/language/expressions/class/elements/async-gen-private-method/yield-star-sync-throw.js:
1222         * test262/test/language/expressions/class/elements/field-declaration.js: Added.
1223         * test262/test/language/expressions/class/elements/fields-anonymous-function-length.js:
1224         * test262/test/language/expressions/class/elements/private-method-referenced-from-static-method.js:
1225         * test262/test/language/expressions/object/dstr/object-rest-proxy-ownkeys-returned-keys-order.js: Added.
1226         (getOwnPropertyDescriptor):
1227         (ownKeys):
1228         * test262/test/language/expressions/object/method-definition/async-gen-yield-star-sync-return.js:
1229         * test262/test/language/expressions/object/method-definition/async-gen-yield-star-sync-throw.js:
1230         * test262/test/language/expressions/object/object-spread-proxy-ownkeys-returned-keys-order.js: Added.
1231         (getOwnPropertyDescriptor):
1232         (ownKeys):
1233         * test262/test/language/identifiers/part-unicode-10.0.0-escaped.js:
1234         * test262/test/language/identifiers/part-unicode-10.0.0.js:
1235         * test262/test/language/identifiers/part-unicode-11.0.0-escaped.js:
1236         * test262/test/language/identifiers/part-unicode-11.0.0.js:
1237         * test262/test/language/identifiers/part-unicode-12.0.0-escaped.js:
1238         * test262/test/language/identifiers/part-unicode-12.0.0.js:
1239         * test262/test/language/identifiers/part-unicode-13.0.0-escaped.js:
1240         * test262/test/language/identifiers/part-unicode-13.0.0.js:
1241         * test262/test/language/identifiers/part-unicode-5.2.0-escaped.js:
1242         * test262/test/language/identifiers/part-unicode-5.2.0.js:
1243         * test262/test/language/identifiers/part-unicode-6.0.0-escaped.js:
1244         * test262/test/language/identifiers/part-unicode-6.0.0.js:
1245         * test262/test/language/identifiers/part-unicode-6.1.0-escaped.js:
1246         * test262/test/language/identifiers/part-unicode-6.1.0.js:
1247         * test262/test/language/identifiers/part-unicode-7.0.0-escaped.js:
1248         * test262/test/language/identifiers/part-unicode-7.0.0.js:
1249         * test262/test/language/identifiers/part-unicode-8.0.0-escaped.js:
1250         * test262/test/language/identifiers/part-unicode-8.0.0.js:
1251         * test262/test/language/identifiers/part-unicode-9.0.0-escaped.js:
1252         * test262/test/language/identifiers/part-unicode-9.0.0.js:
1253         * test262/test/language/module-code/eval-rqstd-once.js:
1254         * test262/test/language/module-code/export-star-as-dflt.js: Added.
1255         * test262/test/language/module-code/export-star-as-dflt_FIXTURE.js: Added.
1256         * test262/test/language/statements/async-generator/yield-star-sync-return.js:
1257         * test262/test/language/statements/async-generator/yield-star-sync-throw.js:
1258         * test262/test/language/statements/class/async-gen-method-static/yield-star-sync-return.js:
1259         * test262/test/language/statements/class/async-gen-method-static/yield-star-sync-throw.js:
1260         * test262/test/language/statements/class/async-gen-method/yield-star-sync-return.js:
1261         * test262/test/language/statements/class/async-gen-method/yield-star-sync-throw.js:
1262         * test262/test/language/statements/class/elements/async-gen-private-method-static/yield-star-sync-return.js:
1263         * test262/test/language/statements/class/elements/async-gen-private-method-static/yield-star-sync-throw.js:
1264         * test262/test/language/statements/class/elements/async-gen-private-method/yield-star-sync-return.js:
1265         * test262/test/language/statements/class/elements/async-gen-private-method/yield-star-sync-throw.js:
1266         * test262/test/language/statements/class/elements/field-declaration.js: Added.
1267         (C):
1268         * test262/test/language/statements/class/elements/fields-anonymous-function-length.js:
1269         * test262/test/language/statements/class/elements/private-method-referenced-from-static-method.js:
1270         * test262/test/language/statements/class/subclass/bound-function.js: Removed.
1271         * test262/test/language/statements/class/subclass/class-definition-superclass-generator.js: Removed.
1272         * test262/test/language/statements/class/subclass/superclass-arrow-function.js: Added.
1273         (fn):
1274         (A):
1275         (C):
1276         * test262/test/language/statements/class/subclass/superclass-async-function.js: Added.
1277         (async fn):
1278         (A):
1279         (bound):
1280         (C):
1281         * test262/test/language/statements/class/subclass/superclass-async-generator-function.js: Added.
1282         (async fn):
1283         (A):
1284         (bound):
1285         (async bind):
1286         * test262/test/language/statements/class/subclass/superclass-bound-function.js: Added.
1287         (bound):
1288         * test262/test/language/statements/class/subclass/superclass-generator-function.js: Added.
1289         (fn):
1290         (A):
1291         (bound):
1292         (C):
1293         * test262/test262-Revision.txt:
1294
1295 2020-05-16  Yusuke Suzuki  <ysuzuki@apple.com>
1296
1297         [JSC] Make OutOfMemory error as instance of RangeError
1298         https://bugs.webkit.org/show_bug.cgi?id=211952
1299
1300         Reviewed by Mark Lam.
1301
1302         * ChakraCore/test/Error/outofmem.baseline-jsc:
1303         * es6/String.prototype_methods_String.prototype.padEnd.js:
1304         (TestMemoryLimits):
1305         * es6/String.prototype_methods_String.prototype.padStart.js:
1306         (TestMemoryLimits):
1307         * slowMicrobenchmarks/function-constructor-with-huge-strings.js:
1308         * stress/array-join-on-strings-need-overflow-checks.js:
1309         * stress/big-wasm-memory-grow-no-max.js:
1310         (test):
1311         * stress/big-wasm-memory-grow.js:
1312         (test):
1313         * stress/big-wasm-memory.js:
1314         (test):
1315         * stress/bigint-exponential-oom.js:
1316         (shouldThrow):
1317         * stress/bigint-int32-min-shift.js:
1318         (shouldThrow):
1319         * stress/check-symbol-description-oom.js:
1320         * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js:
1321         * stress/intl-canonicalize-locale-list-error-oom.js:
1322         (shouldThrow):
1323         * stress/joined-strings-should-not-exceed-max-string-length.js:
1324         * stress/js-fixed-array-out-of-memory.js:
1325         (test):
1326         * stress/json-stringified-overflow-2.js:
1327         (catch):
1328         * stress/json-stringified-overflow.js:
1329         (catch):
1330         * stress/json-stringify-string-builder-overflow.js:
1331         * stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js:
1332         * stress/missing-exception-check-in-array-prototype-fastJoin.js:
1333         * stress/missing-exception-check-in-canonicalizeLocaleList.js:
1334         * stress/missing-exception-check-in-json-stringifier-gap.js:
1335         * stress/missing-exception-check-in-string-compare.js:
1336         * stress/missing-exception-check-in-string-greater-than-compare.js:
1337         * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js:
1338         * stress/missing-exception-check-in-string-lastIndexOf.js:
1339         * stress/missing-exception-check-in-string-less-than-compare.js:
1340         * stress/missing-exception-check-in-string-less-than-or-equal-compare.js:
1341         * stress/missing-exception-check-in-string-toLower.js:
1342         * stress/missing-exception-check-in-string-toUpper.js:
1343         * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js:
1344         * stress/out-of-memory-while-constructing-BytecodeGenerator.js:
1345         * stress/regexp-prototype-exec-on-too-long-rope.js:
1346         * stress/regexp-prototype-match-on-too-long-rope.js:
1347         * stress/regexp-prototype-test-on-too-long-rope.js:
1348         * stress/regress-169783.js:
1349         (doTest):
1350         * stress/regress-178385.js:
1351         * stress/regress-178386.js:
1352         * stress/regress-185888.js:
1353         * stress/regress-189132.js:
1354         * stress/regress-190187.js:
1355         * stress/regress-191563.js:
1356         * stress/scoped-arguments-table-should-be-tolerant-for-oom.js:
1357         (i.canThrow):
1358         * stress/string-16bit-repeat-overflow.js:
1359         * stress/string-overflow-createError-builder.js:
1360         * stress/string-overflow-createError-fit.js:
1361         * stress/string-overflow-createError.js:
1362         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
1363         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js:
1364         * stress/switch-string-oom.js:
1365         (testLowerTiers):
1366         (testFTL):
1367         * stress/test-exception-assert-in-ExceptionHelpers-createError.js:
1368         * stress/test-out-of-memory.js:
1369         * stress/typed-array-subarray-can-throw-oom-error.js:
1370         (get bar):
1371         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js:
1372         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js:
1373
1374 2020-05-15  Yusuke Suzuki  <ysuzuki@apple.com>
1375
1376         [JSC] getFunctionRealm should not use recursion
1377         https://bugs.webkit.org/show_bug.cgi?id=211965
1378         <rdar://problem/63268287>
1379
1380         Reviewed by Saam Barati.
1381
1382         * stress/get-function-realm-not-doing-recursion.js: Added.
1383         (canThrow):
1384         (const.emptyFunction):
1385
1386 2020-05-15  Paulo Matos  <pmatos@igalia.com>
1387
1388         Skip tests in ARM and MIPS post r261667
1389
1390         Unreviewed Gardening.
1391         These tests started failing on both ARMv7 and MIPS post r261667.
1392         Skipping for now until an investigation takes place.
1393
1394         * stress/big-int-mod-memory-stress.js:
1395         * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js:
1396
1397 2020-05-14  Saam Barati  <sbarati@apple.com>
1398
1399         GetByVal and PutByVal runtime operations shouldn't fall off a performance cliff when the property is an integer boxed as a double
1400         https://bugs.webkit.org/show_bug.cgi?id=211935
1401
1402         Reviewed by Yusuke Suzuki and Mark Lam.
1403
1404         * microbenchmarks/get-and-put-by-val-double-index-dont-fall-off-a-cliff.js: Added.
1405         (test):
1406
1407 2020-05-14  Devin Rousso  <drousso@apple.com>
1408
1409         [ESNext] enable logical assignment operators by default
1410         https://bugs.webkit.org/show_bug.cgi?id=211921
1411
1412         Reviewed by Yusuke Suzuki.
1413
1414         * test262/config.yaml:
1415         * stress/logical-assignment-operator-and.js:
1416         * stress/logical-assignment-operator-coalesce.js:
1417         * stress/logical-assignment-operator-or.js:
1418
1419 2020-05-14  Keith Miller  <keith_miller@apple.com>
1420
1421         Undecided Arrays shouldn't need to be OriginalArray to covert to GetArrayLength
1422         https://bugs.webkit.org/show_bug.cgi?id=211914
1423
1424         Reviewed by Saam Barati.
1425
1426         * stress/undecided-arrays-should-not-need-original-array-for-length.js: Added.
1427         (findFoo):
1428         (const.nonUndecidedFrequency.1000.SubArray):
1429         (i.i.some):
1430
1431 2020-05-14  Keith Miller  <keith_miller@apple.com>
1432
1433         GetArrayLength should be "blessed" during Fixup phase in the DFG
1434         https://bugs.webkit.org/show_bug.cgi?id=211540
1435
1436         Reviewed by Saam Barati.
1437
1438         * stress/get-array-length-node-should-be-blessed-in-fixup.js: Added.
1439         (foo):
1440
1441 2020-05-13  Keith Miller  <keith_miller@apple.com>
1442
1443         iteration bytecodes need to handle osr exiting from inlined getter frames
1444         https://bugs.webkit.org/show_bug.cgi?id=211873
1445
1446         Reviewed by Saam Barati.
1447
1448         * stress/for-of-done-getter-osr-exit-inlined.js: Added.
1449         (let.d.get done):
1450         (let.d.get value):
1451         * stress/for-of-next-getter-osr-exit-inlined.js: Added.
1452         (let.x.get next):
1453         (foo):
1454         * stress/for-of-value-getter-osr-exit-inlined.js: Added.
1455         (let.d.get value):
1456         (let.d.get done):
1457
1458 2020-05-14  Michael Catanzaro  <mcatanzaro@gnome.org>
1459
1460         stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js failing on ppc64le and s390x
1461         https://bugs.webkit.org/show_bug.cgi?id=211724
1462
1463         Reviewed by Carlos Alberto Lopez Perez.
1464
1465         This test is broken on ppc64le and s390x, so skip it.
1466
1467         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
1468
1469 2020-05-13  Paulo Matos  <pmatos@igalia.com>
1470
1471         Skip on MIPS test stress/has-own-property-name-cache-symbols-and-strings.js
1472
1473         Unreviewed Gardening.
1474         Test started to fail unpredictably with segfault in bots -
1475         requires further investigation.
1476
1477         * stress/has-own-property-name-cache-symbols-and-strings.js:
1478
1479 2020-05-13  Saam Barati  <sbarati@apple.com>
1480
1481         MovHint can see an arguments object be MovHinted to a Tmp
1482         https://bugs.webkit.org/show_bug.cgi?id=211820
1483         <rdar://problem/62882158>
1484
1485         Reviewed by Keith Miller.
1486
1487         * stress/varargs-forwarding-can-see-arguments-mov-hint-to-for-of-tmp.js: Added.
1488         (let.iter.Symbol.iterator.return.next):
1489         (let.iter.Symbol.iterator):
1490
1491 2020-05-13  Alexey Shvayka  <shvaikalesh@gmail.com>
1492
1493         Move @isConstructor checks from fast paths of Array.from and Array.of
1494         https://bugs.webkit.org/show_bug.cgi?id=211805
1495
1496         Reviewed by Keith Miller.
1497
1498         * microbenchmarks/array-from-arraylike.js: Added.
1499         * microbenchmarks/array-of.js: Added.
1500         * stress/new-promise-capabilities-requires-constructor.js:
1501
1502 2020-05-12  Alexey Shvayka  <shvaikalesh@gmail.com>
1503
1504         Implement @isConstructor bytecode intrinsic and bytecode for that
1505         https://bugs.webkit.org/show_bug.cgi?id=144093
1506
1507         Reviewed by Keith Miller.
1508
1509         * microbenchmarks/is-constructor.js: Added.
1510         * stress/async-arrow-function-in-class-heritage.js:
1511         * stress/is-constructor.js:
1512         * test262/expectations.yaml: Mark 2 test cases as passing.
1513
1514 2020-05-12  Robin Morisset  <rmorisset@apple.com>
1515
1516         Exception check for OOM is a bit too late in JSBigInt::exponentiate.
1517         https://bugs.webkit.org/show_bug.cgi?id=211823
1518
1519         Reviewed by Mark Lam.
1520
1521         Just add one more case so that this test now catches this bug (the control-flow through JSBigInt::exponentiate is pretty convoluted).
1522
1523         * stress/bigint-exponential-oom.js:
1524         (shouldThrow):
1525
1526 2020-05-12  Saam Barati  <sbarati@apple.com>
1527
1528         handling of Check in VarargsForwardingPhase is too pessimistic
1529         https://bugs.webkit.org/show_bug.cgi?id=211810
1530
1531         Reviewed by Keith Miller and Filip Pizlo.
1532
1533         * microbenchmarks/forward-varargs-check-shouldnt-escape.js: Added.
1534         (g):
1535         (foo):
1536
1537 2020-05-12  Keith Miller  <keith_miller@apple.com>
1538
1539         The bottom value set for m_value in iterator_next should be materialized after a done getter
1540         https://bugs.webkit.org/show_bug.cgi?id=211811
1541
1542         Reviewed by Saam Barati.
1543
1544         * stress/for-of-done-getter-materialize-bottom-late.js: Added.
1545         (let.d.get done):
1546         * stress/for-of-value-getter-contains-control-flow.js: Added.
1547         (let.d.get value):
1548         (let.d.get done):
1549
1550 2020-05-11  Paulo Matos  <pmatos@igalia.com>
1551
1552         Skip on armv7/linux stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js
1553         https://bugs.webkit.org/show_bug.cgi?id=211721
1554
1555         Unreviewed Gardening.
1556         This test is failing on our linux armv7 bots on a flaky basis and requires investigation.
1557
1558         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
1559
1560 2020-05-08  Alexey Shvayka  <shvaikalesh@gmail.com>
1561
1562         Array.prototype.concat fast path checks should not be observable
1563         https://bugs.webkit.org/show_bug.cgi?id=211643
1564
1565         Reviewed by Ross Kirsling.
1566
1567         While test262 has complete coverage for @@isConcatSpreadable getters in prototype
1568         chain, Proxy cases are covered by stress/array-concat-fast-spread-proxy.js and
1569         stress/array-concat-spread-proxy.js.
1570
1571         * test262/expectations.yaml: Mark 2 test cases as passing.
1572
1573 2020-05-08  Pablo Saavedra  <psaavedra@igalia.com>
1574
1575         Unreviewed, reverting r261010.
1576
1577         Test skipped for all ARM. no evidence of this affecting iOS
1578
1579         Reverted changeset:
1580
1581         "Skip on ARM and MIPS stress/array-buffer-view-watchpoint-can-
1582         be-fired-in-really-add-in-dfg.js added after r260990"
1583         https://bugs.webkit.org/show_bug.cgi?id=211304
1584         https://trac.webkit.org/changeset/261010
1585
1586 2020-05-07  Mark Lam  <mark.lam@apple.com>
1587
1588         Fix broken exceptionFuzz tests.
1589         https://bugs.webkit.org/show_bug.cgi?id=211550
1590
1591         Reviewed by Yusuke Suzuki.
1592
1593         The tests should not be relying on setting a JSC Option at runtime because the
1594         options are already frozen by then.  Instead, we set the needed
1595         --useExceptionFuzz=true option from the command line.
1596
1597         * exceptionFuzz/3d-cube.js:
1598         * exceptionFuzz/date-format-xparb.js:
1599         * exceptionFuzz/earley-boyer.js:
1600
1601 2020-05-06  Keith Miller  <keith_miller@apple.com>
1602
1603         DFG ByVal nodes with ArrayModes should clobberTop until Fixup phase runs.
1604         https://bugs.webkit.org/show_bug.cgi?id=211531
1605
1606         Reviewed by Yusuke Suzuki.
1607
1608         * stress/for-of-get-by-val-marks-clobbers-exit-state.js: Added.
1609         (foo):
1610         * stress/put-by-val-correctly-clobbers-exit-state-when-misprofiling-index.js: Added.
1611         (let.foo.vm.createBuiltin):
1612
1613 2020-05-05  Ross Kirsling  <ross.kirsling@sony.com>
1614
1615         [ECMA-402] Implement Intl.Locale
1616         https://bugs.webkit.org/show_bug.cgi?id=209772
1617
1618         Reviewed by Darin Adler and Saam Barati.
1619
1620         * stress/intl-locale.js: Added.
1621         * stress/intl-locale-as-intl-param.js: Added.
1622
1623         * test262/config.yaml:
1624         Enable Intl.Locale feature with flag.
1625
1626         * test262/expectations.yaml:
1627         Mark known failures.
1628         None of these should be specific to Intl.Locale.
1629
1630 2020-05-05  Yusuke Suzuki  <ysuzuki@apple.com>
1631
1632         [JSC] Implement BigInt.asIntN and BigInt.asUintN
1633         https://bugs.webkit.org/show_bug.cgi?id=181144
1634
1635         Reviewed by Darin Adler.
1636
1637         * stress/bigint-asintn.js: Added.
1638         (shouldBe):
1639         (shouldThrow):
1640         (BigInt.asIntN):
1641         * stress/bigint-asuintn.js: Added.
1642         (shouldBe):
1643         (shouldThrow):
1644         (BigInt.asUintN):
1645         * test262/expectations.yaml:
1646
1647 2020-05-05  Ross Kirsling  <ross.kirsling@sony.com>
1648
1649         [Intl] Alphabetize extension keys and correctly mark const methods
1650         https://bugs.webkit.org/show_bug.cgi?id=211359
1651
1652         Reviewed by Darin Adler.
1653
1654         * stress/intl-collator.js:
1655         * stress/intl-datetimeformat.js:
1656         Add tests.
1657
1658 2020-05-05  Keith Miller  <keith_miller@apple.com>
1659
1660         iterator_open should remap the symbolIterator argument correctly when inlined.
1661         https://bugs.webkit.org/show_bug.cgi?id=211308
1662         <rdar://problem/62287877>
1663
1664         Reviewed by Mark Lam.
1665
1666         * stress/inlining-for-of-should-validate.js: Added.
1667         (bar):
1668         (foo):
1669
1670 2020-05-05  Yusuke Suzuki  <ysuzuki@apple.com>
1671
1672         Unreviewed, reverting r261156.
1673
1674         Break ARM64_32 build due to existing bug
1675
1676         Reverted changeset:
1677
1678         "[JSC] Implement BigInt.asIntN and BigInt.asUintN"
1679         https://bugs.webkit.org/show_bug.cgi?id=181144
1680         https://trac.webkit.org/changeset/261156
1681
1682 2020-05-05  Alexey Shvayka  <shvaikalesh@gmail.com>
1683
1684         Object.prototype.toString is not spec-perfect
1685         https://bugs.webkit.org/show_bug.cgi?id=199138
1686
1687         Reviewed by Darin Adler and Keith Miller.
1688
1689         * ChakraCore.yaml: Skip a test as `global` now has @@toStringTag.
1690         * ChakraCore/test/LetConst/delete.baseline: Removed.
1691         * stress/internal-promise-constructor-not-confusing.js: Use @isPromise.
1692         * stress/object-get-own-property-symbols.js: Adjust test as `global` now has @@toStringTag.
1693         * test262/expectations.yaml: Mark 6 test cases as passing.
1694
1695 2020-05-04  Yusuke Suzuki  <ysuzuki@apple.com>
1696
1697         [JSC] Implement BigInt.asIntN and BigInt.asUintN
1698         https://bugs.webkit.org/show_bug.cgi?id=181144
1699
1700         Reviewed by Darin Adler.
1701
1702         * stress/bigint-asintn.js: Added.
1703         (shouldBe):
1704         (shouldThrow):
1705         (BigInt.asIntN):
1706         * stress/bigint-asuintn.js: Added.
1707         (shouldBe):
1708         (shouldThrow):
1709         (BigInt.asUintN):
1710         * test262/expectations.yaml:
1711
1712 2020-05-04  Yusuke Suzuki  <ysuzuki@apple.com>
1713
1714         [JSC] DFG NotCellUse is used without considering about BigInt32
1715         https://bugs.webkit.org/show_bug.cgi?id=211395
1716
1717         Reviewed by Saam Barati.
1718
1719         * stress/non-cell-nor-bigint-should-be-emitted-for-to-number-target-if-bigint-appears.js: Added.
1720         (shouldThrow):
1721         (test):
1722         (i.shouldThrow):
1723         * stress/non-cell-nor-bigint-should-reject-bigint.js: Added.
1724         (shouldBe):
1725         (test):
1726         * stress/should-not-emit-double-rep-for-bigint.js: Added.
1727         (foo):
1728         * stress/urshift-value-to-int32-should-reject-bigint.js: Added.
1729         (shouldThrow):
1730         (test):
1731         (i.shouldThrow):
1732
1733 2020-05-01  Yusuke Suzuki  <ysuzuki@apple.com>
1734
1735         Fix stress/big-int-negate-jit.js
1736         https://bugs.webkit.org/show_bug.cgi?id=211321
1737
1738         Reviewed by Saam Barati.
1739
1740         This test is assuming that 100000 iteration of 2 negateBigInt calls makes negateBigInt DFG-compiled.
1741         But this is wrong if BigInt negation is fast enough. We made BigInt faster and now this test starts
1742         failing because running this iteration finishes earlier than DFG compilation finishes. We should use `useConcurrentJIT`
1743         to ensure this status.
1744
1745         * stress/big-int-negate-jit.js:
1746
1747 2020-05-01  Yusuke Suzuki  <ysuzuki@apple.com>
1748
1749         REGRESSION (r260990): 8 test262 unicode tests failing
1750         https://bugs.webkit.org/show_bug.cgi?id=211298
1751
1752         Reviewed by Saam Barati.
1753
1754         These unicode identifier tests are marked as PASS in r260990, but they are failing.
1755         Update test262/expectations.yaml by running `test262-runner --release --save`.
1756
1757         * test262/expectations.yaml:
1758
1759 2020-05-01  Pablo Saavedra  <psaavedra@igalia.com>
1760
1761         Skip on ARM and MIPS stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js added after r260990
1762         https://bugs.webkit.org/show_bug.cgi?id=211304
1763
1764         Unreviewed Gardening.
1765
1766         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
1767
1768 2020-05-01  Saam Barati  <sbarati@apple.com>
1769
1770         We can't cast toLength result to unsigned
1771         https://bugs.webkit.org/show_bug.cgi?id=211205
1772         <rdar://problem/62625562>
1773
1774         Reviewed by Yusuke Suzuki.
1775
1776         * stress/array-length-cant-get-casted-to-unsigned.js: Added.
1777         (assert):
1778         (testArrayPop):
1779         (testArrayPush):
1780         (testArrayReverse):
1781         (testArraySplice):
1782         (testArrayUnshift):
1783         (testArrayLastIndexOf):
1784         (shouldThrowTypeError):
1785         (testJSONStringify.get let):
1786         (testJSONStringify):
1787         * test262/expectations.yaml:
1788
1789 2020-04-30  Caio Lima  <ticaiolima@gmail.com>
1790
1791         Investigate stress/v8-bitint32-inc.js failure on mips
1792         https://bugs.webkit.org/show_bug.cgi?id=210907
1793
1794         Unreviewed test gardening.
1795
1796         * stress/v8-bigint32-inc.js:
1797
1798 2020-04-29  Alexey Shvayka  <shvaikalesh@gmail.com>
1799
1800         AsyncFromSyncIterator methods should not pass absent values
1801         https://bugs.webkit.org/show_bug.cgi?id=211147
1802
1803         Reviewed by Ross Kirsling.
1804
1805         * test262/expectations.yaml: Mark 4 test cases as passing.
1806
1807 2020-04-29  Yusuke Suzuki  <ysuzuki@apple.com>
1808
1809         [JSC] JSStringJoiner is missing BigInt handling
1810         https://bugs.webkit.org/show_bug.cgi?id=211174
1811
1812         Reviewed by Mark Lam.
1813
1814         * stress/bigint-to-string-in-array.js: Added.
1815         (shouldBe):
1816
1817 2020-04-28  Yusuke Suzuki  <ysuzuki@apple.com>
1818
1819         [JSC] BigInt constructor should accept larger integers than safe-integers
1820         https://bugs.webkit.org/show_bug.cgi?id=210755
1821
1822         Reviewed by Darin Adler.
1823
1824         * stress/big-int-constructor.js:
1825         * stress/large-number-to-bigint.js: Added.
1826         (shouldBe):
1827         (shouldThrow):
1828         * test262/config.yaml:
1829
1830 2020-04-28  Yusuke Suzuki  <ysuzuki@apple.com>
1831
1832         [JSC] NumberConstructor should accept BigInt
1833         https://bugs.webkit.org/show_bug.cgi?id=210835
1834
1835         Reviewed by Mark Lam.
1836
1837         * stress/number-constructor-bigint-dfg.js: Added.
1838         (shouldBe):
1839         (convert):
1840         * stress/number-constructor-bigint.js: Added.
1841         (shouldBe):
1842         * test262/expectations.yaml:
1843
1844 2020-04-27  Yusuke Suzuki  <ysuzuki@apple.com>
1845
1846         [JSC] Throw OutOfMemoryError instead of RangeError if BigInt is too big
1847         https://bugs.webkit.org/show_bug.cgi?id=211111
1848
1849         Reviewed by Saam Barati.
1850
1851         * stress/big-int-constructor-oom.js:
1852         (catch):
1853         * stress/big-int-left-shift-range-error.js:
1854         (assertThrowRangeError):
1855         * stress/big-int-out-of-memory-tests.js:
1856         (catch):
1857         * stress/bigint-exponential-oom.js: Added.
1858         (shouldThrow):
1859         * stress/bigint-int32-min-shift.js:
1860         (shouldThrow):
1861
1862 2020-04-27  Keith Miller  <keith_miller@apple.com>
1863
1864         stress/generator-containing-for-of-on-map.js and stress/generator-containing-for-of-on-set.js timing out on debug JSC bot
1865         https://bugs.webkit.org/show_bug.cgi?id=211095
1866
1867         Reviewed by Yusuke Suzuki.
1868
1869         Let's try making these tests shorter. Eager compilation should still be interesting with the shorter iterations.
1870
1871         * stress/generator-containing-for-of-on-map.js:
1872         * stress/generator-containing-for-of-on-set.js:
1873
1874 2020-04-27  Yusuke Suzuki  <ysuzuki@apple.com>
1875
1876         [JSC] >>> should call ToNumeric
1877         https://bugs.webkit.org/show_bug.cgi?id=211065
1878
1879         Reviewed by Ross Kirsling.
1880
1881         * stress/bigint-urshift.js: Added.
1882         (shouldBe):
1883         (shouldThrow):
1884         * test262/expectations.yaml:
1885
1886 2020-04-27  Yusuke Suzuki  <ysuzuki@apple.com>
1887
1888         [JSC] Add $vm.assertEnabled() to suppress Debug crash expected tests in release+assert build
1889         https://bugs.webkit.org/show_bug.cgi?id=211089
1890
1891         Reviewed by Keith Miller.
1892
1893         We have ASSERT which only fires when DOM object is wrongly implemented to catch wrong ones.
1894         We are using ASSERT in JSC side since we don't know all the DOM objects are correctly implemented.
1895         If it is not correctly implemented, in Release build, JSC is returning sub-optimal but right results.
1896         But in Debug build, we can catch the wrong ones, which allows us to fix the wrong things while avoiding
1897         catastrophic crashes in release build.
1898
1899         However, the test is assuming that ASSERT is not enabled if it is not Debug build. Release & Debug builds
1900         work, but Release+Assert does not meet this assumption.
1901
1902         So, skip this based on `$vm.assertEnabled()`.
1903
1904         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js:
1905         (vm.assertEnabled.putter):
1906         (vm.assertEnabled):
1907         (putter): Deleted.
1908         (not_string.toString): Deleted.
1909         * stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js:
1910         (vm.assertEnabled):
1911         (not_string.toString): Deleted.
1912
1913 2020-04-26  Alexey Shvayka  <shvaikalesh@gmail.com>
1914
1915         Symbol should have [[Construct]] internal method
1916         https://bugs.webkit.org/show_bug.cgi?id=211050
1917
1918         Reviewed by Yusuke Suzuki.
1919
1920         * stress/is-constructor.js:
1921         * test262/expectations.yaml: Mark 2 test cases as passing.
1922
1923 2020-04-26  Alexey Shvayka  <shvaikalesh@gmail.com>
1924
1925         InternalFunction::createSubclassStructure should use newTarget's globalObject
1926         https://bugs.webkit.org/show_bug.cgi?id=202599
1927
1928         Reviewed by Yusuke Suzuki.
1929
1930         * stress/promise-proto-from-ctor-realm.js: Added.
1931         * test262/expectations.yaml: Mark 88 test cases as passing.
1932
1933 2020-04-26  Yusuke Suzuki  <ysuzuki@apple.com>
1934
1935         [JSC] ValueAdd, VaueSub, ValueMul, Inc, Dec should say SpecBigInt32 prediction based on ArithProfile
1936         https://bugs.webkit.org/show_bug.cgi?id=211038
1937
1938         Reviewed by Filip Pizlo.
1939
1940         * stress/bigint32-add-overflow.js: Added.
1941         (shouldBe):
1942         (add):
1943         (noInline):
1944         * stress/bigint32-dec-overflow.js: Added.
1945         (shouldBe):
1946         (dec):
1947         (noInline):
1948         * stress/bigint32-inc-overflow.js: Added.
1949         (shouldBe):
1950         (inc):
1951         (noInline):
1952         * stress/bigint32-mul-overflow.js: Added.
1953         (shouldBe):
1954         (mul):
1955         (noInline):
1956         * stress/bigint32-sub-overflow.js: Added.
1957         (shouldBe):
1958         (sub):
1959         (noInline):
1960
1961 2020-04-25  Yusuke Suzuki  <ysuzuki@apple.com>
1962
1963         [JSC] Handle BigInt32 INT32_MIN shift amount
1964         https://bugs.webkit.org/show_bug.cgi?id=211030
1965
1966         Reviewed by Darin Adler.
1967
1968         * stress/bigint-int32-min-shift.js: Added.
1969         (shouldBe):
1970         (shouldThrow):
1971
1972 2020-04-25  Yusuke Suzuki  <ysuzuki@apple.com>
1973
1974         [JSC] Add fast path for BigInt32 left-shift
1975         https://bugs.webkit.org/show_bug.cgi?id=211029
1976
1977         Reviewed by Saam Barati.
1978
1979         * stress/bigint-left-shift-overflow.js: Added.
1980         (shouldBe):
1981         (leftShift):
1982         (noInline):
1983         * stress/bigint-right-shift-large.js: Added.
1984         (shouldBe):
1985
1986 2020-04-25  Paulo Matos  <pmatos@igalia.com>
1987
1988         Skip stress/butterfly-zero-unused-butterfly-properties.js on MIPS
1989         https://bugs.webkit.org/show_bug.cgi?id=211016
1990
1991         Unreviewed Gardening.
1992
1993         * stress/butterfly-zero-unused-butterfly-properties.js:
1994
1995 2020-04-25  Ross Kirsling  <ross.kirsling@sony.com>
1996
1997         [Intl] Locale validation/canonicalization should defer to ICU
1998         https://bugs.webkit.org/show_bug.cgi?id=210853
1999
2000         Reviewed by Darin Adler.
2001
2002         * stress/intl-collator.js:
2003         * stress/intl-datetimeformat.js:
2004         * stress/intl-numberformat.js:
2005         * stress/intl-object.js:
2006         * stress/intl-pluralrules.js:
2007         * stress/intl-relativetimeformat.js:
2008         Adjust tests, since one of the two fixes in r260151 no longer applies
2009         (and certain sensitivities apply to older ICU versions).
2010
2011         * test262/expectations.yaml:
2012         Mark eight new passes, two new fails, and six changed failures.
2013         It is an unfortunate and baffling truth that the Intl tests of test262 are often not spec tests at all,
2014         but effectively ICU/CLDR regression tests. These are not carrots worth chasing.
2015
2016 2020-04-24  Alexey Shvayka  <shvaikalesh@gmail.com>
2017
2018         Fix WASM Error classes and re-sync wpt/wasm/jsapi from upstream
2019         https://bugs.webkit.org/show_bug.cgi?id=210980
2020
2021         Reviewed by Keith Miller.
2022
2023         * wasm/modules/js-wasm-cycle.js:
2024         * wasm/modules/wasm-wasm-cycle.js:
2025         * wasm/stress/too-many-locals.js:
2026
2027 2020-04-24  Saam Barati  <sbarati@apple.com>
2028
2029         Return BigInt32 whenever we can
2030         https://bugs.webkit.org/show_bug.cgi?id=210922
2031
2032         Reviewed by Yusuke Suzuki.
2033
2034         * microbenchmarks/sunspider-sha1-big-int.js: Added.
2035         (hex_sha1):
2036         (b64_sha1):
2037         (str_sha1):
2038         (hex_hmac_sha1):
2039         (b64_hmac_sha1):
2040         (str_hmac_sha1):
2041         (bigIntToInt32):
2042         (sha1_vm_test):
2043         (core_sha1):
2044         (sha1_ft):
2045         (sha1_kt):
2046         (core_hmac_sha1):
2047         (safe_add):
2048         (rol):
2049         (str2binb):
2050         (binb2hex):
2051         (binb2b64):
2052         (run):
2053
2054 2020-04-24  Yusuke Suzuki  <ysuzuki@apple.com>
2055
2056         [JSC] DFG compare should speculate BigInt well
2057         https://bugs.webkit.org/show_bug.cgi?id=210892
2058
2059         Reviewed by Saam Barati.
2060
2061         * stress/compare-bigint-with-number.js: Added.
2062         (shouldBe):
2063         (result):
2064         (lessThan):
2065         (lessThanEqual):
2066         (greaterThan):
2067         (greaterThanEqual):
2068         (equal):
2069         * stress/compare-bigint-with-string.js: Added.
2070         (shouldBe):
2071         (result):
2072         (lessThan):
2073         (lessThanEqual):
2074         (greaterThan):
2075         (greaterThanEqual):
2076         (equal):
2077         * stress/compare-bigint.js: Added.
2078         (shouldBe):
2079         (result):
2080         (lessThan):
2081         (lessThanEqual):
2082         (greaterThan):
2083         (greaterThanEqual):
2084         (equal):
2085         * stress/compare-bigint32.js: Added.
2086         (shouldBe):
2087         (result):
2088         (lessThan):
2089         (lessThanEqual):
2090         (greaterThan):
2091         (greaterThanEqual):
2092         (equal):
2093         * stress/compare-heap-bigint.js: Added.
2094         (shouldBe):
2095         (result):
2096         (lessThan):
2097         (lessThanEqual):
2098         (greaterThan):
2099         (greaterThanEqual):
2100         (equal):
2101         * stress/dfg-ai-fold-bigint.js: Added.
2102         (shouldBe):
2103         (allAreTrue):
2104         (allAreFalse):
2105         (lessThan):
2106         (lessThanFalse):
2107         (lessThanEqual):
2108         (lessThanEqualFalse):
2109         (greaterThan):
2110         (greaterThanFalse):
2111         (greaterThanEqual):
2112         (greaterThanEqualFalse):
2113         (equal):
2114         (equalFalse):
2115
2116 2020-04-24  Alexey Shvayka  <shvaikalesh@gmail.com>
2117
2118         Proxy.revocable should not have [[Construct]] slot
2119         https://bugs.webkit.org/show_bug.cgi?id=210959
2120
2121         Reviewed by Darin Adler.
2122
2123         * stress/proxy-revoke.js:
2124         * test262/expectations.yaml: Mark 2 test cases as passing.
2125
2126 2020-04-24  Yusuke Suzuki  <ysuzuki@apple.com>
2127
2128         [JSC] DFG AI for some bitops + BigInt32 should be precise
2129         https://bugs.webkit.org/show_bug.cgi?id=210956
2130
2131         Reviewed by Keith Miller.
2132
2133         * stress/bigint-bitops.js: Added.
2134         (shouldBe):
2135         (test):
2136
2137 2020-04-24  Paulo Matos  <pmatos@igalia.com>
2138
2139         Skip on ARM and MIPS stress/for-of-iterator-open* added at r260585
2140         https://bugs.webkit.org/show_bug.cgi?id=210961
2141
2142         Unreviewed Gardening.
2143
2144         * stress/for-of-iterator-open-osr-at-inlined-return-non-object.js:
2145         * stress/for-of-iterator-open-osr-at-iterator-set-local.js:
2146         * stress/for-of-iterator-open-return-non-object.js:
2147
2148 2020-04-23  Alexey Shvayka  <shvaikalesh@gmail.com>
2149
2150         Remove revoked Proxy checks from ProxyCreate
2151         https://bugs.webkit.org/show_bug.cgi?id=210862
2152
2153         Reviewed by Ross Kirsling.
2154
2155         Removes expectations for 2 invalid ChakraCore tests.
2156
2157         * ChakraCore.yaml: Mark 2 test cases as passing.
2158         * ChakraCore/test/es6/arraywithproxy.baseline: Removed.
2159         * ChakraCore/test/es6/proxytest9.baseline: Removed.
2160         * stress/proxy-revoke.js: Adjust test.
2161         * test262/expectations.yaml: Mark 12 test cases as passing.
2162
2163 2020-04-23  Ross Kirsling  <ross.kirsling@sony.com>
2164
2165         Unreviewed test262 gardening following r260591.
2166
2167         * test262/expectations.yaml:
2168         Fix expectations to reflect ICU 64.
2169
2170 2020-04-23 Alexey Shvayka <shvaikalesh@gmail.com>
2171
2172         Update test262 to commit 31dabb5618e2
2173         https://bugs.webkit.org/show_bug.cgi?id=210921
2174
2175         Reviewed by Ross Kirsling.
2176
2177         * test262/config.yaml: Skip "Atomics.waitAsync" feature.
2178         * test262/expectations.yaml:
2179         * test262/harness/*: Updated.
2180         * test262/latest-changes-summary.txt:
2181         * test262/test/*: Updated.
2182         * test262/test262-Revision.txt:
2183
2184 2020-04-23  Yusuke Suzuki  <ysuzuki@apple.com>
2185
2186         Reduce iteration count and change how it invokes GC to reduce execution time of JSTests/stress/delete-property-dfg-inline.js
2187         https://bugs.webkit.org/show_bug.cgi?id=210933
2188
2189         Reviewed by Keith Miller.
2190
2191         This test takes 7~ seconds in Release build with default run. And it takes 1 mins in several variants of JSC tests, which is too long.
2192         By analyzing this, we found that this takes very long time,
2193
2194             1. due to so frequent synchronous GC run
2195             2. due to large iteration count while function can get FTL with less counts
2196
2197         While ensuring all functions gets FTL, we reduce iteration count and GC invocations to reduce the execution time, the default run gets 200ms.
2198
2199         * stress/delete-property-dfg-inline.js:
2200         (noInline.blackbox.testSingleStructure):
2201         (noInline.testSingleStructure.testInlineSingleStructure):
2202         (noInline.testInlineSingleStructure.testExit):
2203         (noInline.testExit.testSingleStructureMiss):
2204         (noInline.testSingleStructureMiss.testSingleStructureMissStrict):
2205         (noInline.testSingleStructureMissStrict.testSingleStructureMissNonConfigurable):
2206         (noInline.testSingleStructureMissNonConfigurable.testSingleStructureEmpty):
2207         (noInline.testSingleStructureEmpty.testPolymorphic):
2208         (noInline.testPolymorphic.testPolyvariant):
2209         (noInline.testPolyvariant.testConstantFolding):
2210         (noInline.testConstantFolding.testObjectSinking):
2211         (noInline.testObjectSinking.testProxy):
2212         (noInline.testProxy.testTypedArray):
2213         (noInline.testTypedArray.testMissMixed):
2214         (noInline.testMissMixed.testMissNonMixed):
2215         (noInline.testMissNonMixed.testByVal.noInline.test):
2216         (noInline.testMissNonMixed.testByVal):
2217         (noInline.assert.assert_throws): Deleted.
2218
2219 2020-04-22  Keith Miller  <keith_miller@apple.com>
2220
2221         Fix OSR exiting/iterator object checks in for-of bytecodes
2222         https://bugs.webkit.org/show_bug.cgi?id=210882
2223
2224         Reviewed by Saam Barati.
2225
2226         * stress/for-of-iterator-next-osr-at-inlined-return-non-object.js: Added.
2227         (vendNext):
2228         (test):
2229         (catch):
2230         * stress/for-of-iterator-next-osr-at-next-set-local.js: Added.
2231         (vendNext):
2232         (test):
2233         (catch):
2234         * stress/for-of-iterator-open-osr-at-inlined-return-non-object.js: Added.
2235         (vendIterator):
2236         (test):
2237         (catch):
2238         * stress/for-of-iterator-open-osr-at-iterator-set-local.js: Added.
2239         (vendIterator):
2240         (test):
2241         (catch):
2242         * stress/for-of-iterator-open-return-non-object.js: Added.
2243         (vendIterator):
2244         (test):
2245         (i.catch):
2246         * stress/test-for-of-cfg-simplication-exit-ok.js: Added.
2247         (z.__proto__):
2248
2249 2020-04-23  Paulo Matos  <pmatos@igalia.com>
2250
2251         Skip stress/v8-bitint32-inc.js on mips
2252         https://bugs.webkit.org/show_bug.cgi?id=210906
2253
2254         Unreviewed Gardening.
2255
2256         * stress/v8-bigint32-inc.js:
2257
2258 2020-04-22  Yusuke Suzuki  <ysuzuki@apple.com>
2259
2260         [JSC] branchIfBigInt32 can use BigInt32Mask and remove branchIfNumber filter
2261         https://bugs.webkit.org/show_bug.cgi?id=210870
2262
2263         Reviewed by Saam Barati.
2264
2265         * stress/anybigintuse-should-filter-number-correctly.js: Added.
2266         (shouldBe):
2267         (test):
2268
2269 2020-04-22  Saam Barati  <sbarati@apple.com>
2270
2271         BigInt32 parsing should be precise
2272         https://bugs.webkit.org/show_bug.cgi?id=210869
2273
2274         Reviewed by Robin Morisset.
2275
2276         * stress/big-int-32-parsing-should-be-precise.js: Added.
2277
2278 2020-04-22  Yusuke Suzuki  <ysuzuki@apple.com>
2279
2280         [JSC] JSBigInt inc operation does not produce right HeapBigInt zero
2281         https://bugs.webkit.org/show_bug.cgi?id=210860
2282
2283         Reviewed by Mark Lam.
2284
2285         * stress/bigint-zero-canonicalized.js: Added.
2286         (shouldBe):
2287
2288 2020-04-22  Saam Barati  <sbarati@apple.com>
2289
2290         ValueBitNot is wrong in FTL with AnyBigIntUse
2291         https://bugs.webkit.org/show_bug.cgi?id=210846
2292
2293         Reviewed by Yusuke Suzuki.
2294
2295         * stress/big-int-value-bit-not-spec-any-big-int.js: Added.
2296         (assert):
2297         (foo):
2298
2299 2020-04-22  Yusuke Suzuki  <ysuzuki@apple.com>
2300
2301         [JSC] AI results of BigInt32 Bitwise shift operation does not match to runtime results
2302         https://bugs.webkit.org/show_bug.cgi?id=210839
2303
2304         Reviewed by Saam Barati.
2305
2306         * stress/v8-bigint32-add.js: Added.
2307         (main):
2308         * stress/v8-bigint32-and.js: Added.
2309         (main):
2310         * stress/v8-bigint32-dec.js: Added.
2311         (main):
2312         * stress/v8-bigint32-div.js: Added.
2313         (main):
2314         * stress/v8-bigint32-inc.js: Added.
2315         (main):
2316         * stress/v8-bigint32-mod.js: Added.
2317         (main):
2318         * stress/v8-bigint32-mul.js: Added.
2319         (main):
2320         * stress/v8-bigint32-neg.js: Added.
2321         (main):
2322         * stress/v8-bigint32-not.js: Added.
2323         (main):
2324         * stress/v8-bigint32-or.js: Added.
2325         (main):
2326         * stress/v8-bigint32-sar.js: Added.
2327         (main):
2328         * stress/v8-bigint32-shl.js: Added.
2329         (main):
2330         * stress/v8-bigint32-sub.js: Added.
2331         (main):
2332         * stress/v8-bigint32-xor.js: Added.
2333         (main):
2334
2335 2020-04-21  Yusuke Suzuki  <ysuzuki@apple.com>
2336
2337         [JSC] SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq should expect AnyBigIntUse
2338         https://bugs.webkit.org/show_bug.cgi?id=210832
2339
2340         Reviewed by Mark Lam.
2341
2342         * stress/heap-and-32-bigint-eq.js: Added.
2343         (shouldBe):
2344         * stress/heap-and-32-bigint-stricteq.js: Added.
2345         (shouldBe):
2346
2347 2020-04-21  Alexey Shvayka  <shvaikalesh@gmail.com>
2348
2349         constructObjectFromPropertyDescriptor() is incorrect with partial descriptors
2350         https://bugs.webkit.org/show_bug.cgi?id=184629
2351
2352         Reviewed by Ross Kirsling.
2353
2354         * test262/expectations.yaml: Mark 4 test cases as passing.
2355
2356 2020-04-21  Yusuke Suzuki  <ysuzuki@apple.com>
2357
2358         Move value-pow-ai-rule-should-box-the-same-way-as-the-runtime.js to JSTests/stress/
2359         https://bugs.webkit.org/show_bug.cgi?id=210805
2360
2361         Reviewed by Saam Barati.
2362
2363         r251408 accidentally puts value-pow-ai-rule-should-box-the-same-way-as-the-runtime.js in JSTests/ instead of JSTests/stress/.
2364         This patch fixes that.
2365
2366         * stress/value-pow-ai-rule-should-box-the-same-way-as-the-runtime.js: Renamed from JSTests/value-pow-ai-rule-should-box-the-same-way-as-the-runtime.js.
2367
2368 2020-04-21  Paulo Matos  <pmatos@igalia.com>
2369
2370         [ARMv7][EWS] stress/check-stack-overflow-before-value-profiling-arguments.js is failing
2371         https://bugs.webkit.org/show_bug.cgi?id=210720
2372
2373         Unreviewed gardening.
2374
2375         Skip test on arm since it is failing on EWS, causing significant delays.
2376
2377         * stress/check-stack-overflow-before-value-profiling-arguments.js:
2378
2379 2020-04-21  Paulo Matos  <pmatos@igalia.com>
2380
2381         Re-enable previously skipped mips tests
2382         https://bugs.webkit.org/show_bug.cgi?id=209964
2383
2384         Reviewed by Mark Lam.
2385
2386         Followup to r259454 - where we re-enabled a few stress tests for arm.
2387
2388         * stress/JSArrayBufferView-byteOffset-is-racy-from-compiler-thread.js:
2389         * stress/dont-range-based-iterate-vector-that-is-mutated.js:
2390         * stress/ensure-code-block-is-not-precise-allocation.js:
2391         * stress/generator-cell-with-type.js:
2392         * stress/racy-slow-put-cloned-arguments-when-having-a-bad-time.js:
2393         * stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js:
2394         * stress/toctou-having-a-bad-time-new-array.js:
2395
2396 2020-04-20  Yusuke Suzuki  <ysuzuki@apple.com>
2397
2398         [JSC] Import V8 BigInt tests generated by bigint-tester.py
2399         https://bugs.webkit.org/show_bug.cgi?id=210783
2400
2401         Reviewed by Ross Kirsling.
2402
2403         This patch adds BigInt tests generated by V8 bigint-tester.py, which is modified for JSC use.
2404
2405         * stress/v8-bigint-add.js: Added.
2406         * stress/v8-bigint-and.js: Added.
2407         * stress/v8-bigint-dec.js: Added.
2408         * stress/v8-bigint-div.js: Added.
2409         * stress/v8-bigint-inc.js: Added.
2410         * stress/v8-bigint-mod.js: Added.
2411         * stress/v8-bigint-mul.js: Added.
2412         * stress/v8-bigint-neg.js: Added.
2413         * stress/v8-bigint-not.js: Added.
2414         * stress/v8-bigint-or.js: Added.
2415         * stress/v8-bigint-sar.js: Added.
2416         * stress/v8-bigint-shl.js: Added.
2417         * stress/v8-bigint-sub.js: Added.
2418         * stress/v8-bigint-xor.js: Added.
2419
2420 2020-04-20  Yusuke Suzuki  <ysuzuki@apple.com>
2421
2422         [JSC] Skip test262 for non-safe-integer range BigIntConstructor
2423         https://bugs.webkit.org/show_bug.cgi?id=210749
2424
2425         Reviewed by Keith Miller.
2426
2427         We skip test262 test/built-ins/BigInt/constructor-integer.js for now. As it is shown in old test262 JSTests/test262/expectations.yaml,
2428         this test was failing before BigInt flag is enabled. And new BigInt patch changes error message while we are failing in the same way.
2429         While we implemented BigInt, this test is based on spec change introduced[1], and we are not implementing this. So we mark it skipped,
2430         as it is skipped before BigInt is enabled.
2431
2432         [1]: https://github.com/tc39/proposal-bigint/pull/138
2433
2434         * test262/config.yaml:
2435
2436 2020-04-20  Keith Miller  <keith_miller@apple.com>
2437
2438         Unreviewed, revert accidental test changes.
2439
2440         * microbenchmarks/for-of-iterate-array-entries.js:
2441         (foo):
2442
2443 2020-04-20  Paulo Matos  <pmatos@igalia.com>
2444
2445         [32-bits] stress/for-of-array-different-globals.js is failing
2446         https://bugs.webkit.org/show_bug.cgi?id=210718
2447
2448         Unreviewed gardening.
2449
2450         Skip test for arm and mips, failing due to r260323
2451
2452         * stress/for-of-array-different-globals.js:
2453
2454 2020-04-19  Ross Kirsling  <ross.kirsling@sony.com>
2455
2456         [ECMA-402] Intl.RelativeTimeFormat missing in WebKit
2457         https://bugs.webkit.org/show_bug.cgi?id=209770
2458
2459         Reviewed by Darin Adler.
2460
2461         * stress/intl-relativetimeformat.js: Added.
2462
2463         * test262/config.yaml:
2464         Enable Intl.RelativeTimeFormat feature with flag.
2465
2466         * test262/expectations.yaml:
2467         Mark known failures.
2468         Test for locale validation is not specific to RelativeTimeFormat and should be investigated separately.
2469         Tests for Polish appear to be wrong and should be corrected in test262.
2470
2471 2020-04-18  Keith Miller  <keith_miller@apple.com>
2472
2473         Unreviewed, mark test passing.
2474
2475         * test262/expectations.yaml:
2476
2477 2020-04-18  Robin Morisset  <rmorisset@apple.com>
2478
2479         Support an inlined representation in JSValue of small BigInts ("BigInt32")
2480         https://bugs.webkit.org/show_bug.cgi?id=206182
2481
2482         Reviewed by Yusuke Suzuki.
2483
2484         I improved several of the tests to give more informative error messages in the process of fixing them.
2485
2486         More interestingly I had to modify "missing-exception-check-in-string-compare" because it relied on "s1 == s1" resolving ropes, and we now just return true.
2487
2488         * stress/big-int-division.js:
2489         (testDiv):
2490         * stress/big-int-left-shift-wrapped-value.js:
2491         (assert.sameValue):
2492         * stress/big-int-logical-not.js:
2493         (assert):
2494         * stress/big-int-mod-jit.js:
2495         * stress/big-int-right-shift-general.js:
2496         (testRightShift):
2497         * stress/big-int-type-of-proven-type.js:
2498         (assert):
2499         * stress/compare-strict-eq-on-various-types.js:
2500         (testAllTypesCall):
2501         * stress/ftl-string-strict-equality.js:
2502         * stress/missing-exception-check-in-string-compare.js:
2503
2504 2020-04-18  Keith Miller  <keith_miller@apple.com>
2505
2506         Redesign how we do for-of iteration for JSArrays
2507         https://bugs.webkit.org/show_bug.cgi?id=175454
2508
2509         Reviewed by Filip Pizlo.
2510
2511         * microbenchmarks/for-of-iterate-array-entries.js:
2512         (foo):
2513         * stress/custom-iterators.js:
2514         (catch):
2515         (iter.return):
2516         (iteratorInterfaceErrorTest):
2517         (iteratorInterfaceErrorTestReturn):
2518         (iteratorInterfaceBreakTestReturn):
2519         * stress/for-of-array-different-globals.js: Added.
2520         (foo):
2521         (array.Symbol.iterator.__proto__.next):
2522         * stress/for-of-array-mixed-values.js: Added.
2523         (test):
2524         * stress/for-of-no-direct-loop-back-edge-osr.js: Added.
2525         (osrIfFinalTier):
2526         (test):
2527         * stress/generator-containing-for-of-on-map.js: Added.
2528         (find):
2529         (i.let.v.of.find):
2530         * stress/generator-containing-for-of-on-set.js: Added.
2531         (find):
2532         (set add):
2533         * stress/osr-from-for-of-done-getter.js: Added.
2534         (i.let.iterable.next.return.get done):
2535         (i.let.iterable.next):
2536         (i.let.iterable.Symbol.iterator):
2537         (i.let.iterable.return):
2538         * stress/osr-from-for-of-value-getter.js: Added.
2539         (i.let.iterable.next.return.get value):
2540         (i.let.iterable.next):
2541         (i.let.iterable.Symbol.iterator):
2542         (i.let.iterable.return):
2543         * stress/throw-for-of-next-returns-non-object.js: Added.
2544         (i.let.iterable.next):
2545         (i.let.iterable.Symbol.iterator):
2546         (i.let.iterable.return):
2547         (i.catch):
2548         * stress/throw-from-done-getter-in-for-of-header.js: Added.
2549         (i.let.iterable.next):
2550         (i.let.iterable.get done):
2551         (i.let.iterable.Symbol.iterator):
2552         (i.let.iterable.return):
2553         (i.catch):
2554         * stress/throw-from-next-in-for-of-header.js: Added.
2555         (i.let.iterable.next):
2556         (i.let.iterable.Symbol.iterator):
2557         (i.let.iterable.return):
2558         (i.catch):
2559         * stress/throw-from-value-getter-in-for-of-header.js: Added.
2560         (i.let.iterable.next):
2561         (i.let.iterable.get value):
2562         (i.let.iterable.Symbol.iterator):
2563         (i.let.iterable.return):
2564         (i.catch):
2565         * stress/webidl-tokenizer-for-of.js: Added.
2566         (tokenise.attemptTokenMatch):
2567         (tokenise):
2568         (Tokeniser):
2569         (Tokeniser.prototype.probe):
2570         (Tokeniser.prototype.consume):
2571         (Tokeniser.prototype.unconsume):
2572
2573 2020-04-18  Alexey Shvayka  <shvaikalesh@gmail.com>
2574
2575         RegExp.prototype[@@search] should use SameValue
2576         https://bugs.webkit.org/show_bug.cgi?id=173226
2577
2578         Reviewed by Yusuke Suzuki.
2579
2580         * stress/same-value-intrinsic.js: Added.
2581         * test262/expectations.yaml: Mark 4 test cases as passing.
2582
2583 2020-04-17  Saam Barati  <sbarati@apple.com>
2584
2585         GetTypedArrayByteOffset is broken on arm64e
2586         https://bugs.webkit.org/show_bug.cgi?id=210631
2587
2588         Reviewed by Mark Lam.
2589
2590         * stress/byte-offset-on-wasteful-neutered-arm64e.js: Added.
2591         (foo):
2592         (assert):
2593         (transferArrayBuffer.array.buffer):
2594
2595 2020-04-17  Devin Rousso  <drousso@apple.com>
2596
2597         Rename NullishEq / NULLISHEQUAL to CoalesceEq / COALESCEEQUAL to match the spec
2598         https://bugs.webkit.org/show_bug.cgi?id=210663
2599
2600         Reviewed by Ross Kirsling.
2601
2602         * stress/logical-assignment-operator-coalesce.js: Renamed from stress/logical-assignment-operator-nullish.js.
2603
2604 2020-04-17  Devin Rousso  <drousso@apple.com>
2605
2606         Implement Promise.any and AggregateError
2607         https://bugs.webkit.org/show_bug.cgi?id=202566
2608
2609         Reviewed by Yusuke Suzuki.
2610
2611         * test262/config.yaml:
2612         * test262/expectations.yaml:
2613
2614 2020-04-17  Paulo Matos  <pmatos@igalia.com>
2615
2616         Reduce test iterations for stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js on mips
2617         https://bugs.webkit.org/show_bug.cgi?id=210641
2618
2619         Reviewed by Yusuke Suzuki.
2620
2621         Reduce test iteration count on mips for which the current value is too high.
2622
2623         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
2624
2625 2020-04-17  Yusuke Suzuki  <ysuzuki@apple.com>
2626
2627         [JSC] Map/Set iterator creation functions should fail with BadType etc. before executing insertChecks
2628         https://bugs.webkit.org/show_bug.cgi?id=210649
2629         <rdar://problem/61925452>
2630
2631         Reviewed by Mark Lam.
2632
2633         * stress/map-iterator-check-before-fail.js: Added.
2634         (test):
2635         * stress/set-iterator-check-before-fail.js: Added.
2636         (set new):
2637         (set var):
2638
2639 2020-04-16  Ross Kirsling  <ross.kirsling@sony.com>
2640
2641         REGRESSION(r259480): Two new failing i18n tests
2642         https://bugs.webkit.org/show_bug.cgi?id=210605
2643
2644         Reviewed by Darin Adler.
2645
2646         * stress/date-toLocaleString.js:
2647         Tests shouldn't rely on system default time zone.
2648
2649 2020-04-16  Yusuke Suzuki  <ysuzuki@apple.com>
2650
2651         Unreviewed, reduce # of iteration since this test is timed out in slow devices
2652         https://bugs.webkit.org/show_bug.cgi?id=210023
2653
2654         * stress/map-iteration-oas.js:
2655
2656 2020-04-16  Yusuke Suzuki  <ysuzuki@apple.com>
2657
2658         [JSC] Implement JSMapIterator/JSSetIterator with JSInternalFieldObjectImpl
2659         https://bugs.webkit.org/show_bug.cgi?id=210023
2660
2661         Reviewed by Keith Miller.
2662
2663         * stress/map-iteration-oas.js: Added.
2664         (shouldBe):
2665         (test):
2666         * stress/map-iterator-creation-fail-dfg.js: Added.
2667         (shouldThrow):
2668         (test2):
2669         (test3):
2670         * stress/map-iterator-creation-fail.js: Added.
2671         (shouldThrow):
2672         (i.shouldThrow):
2673         (test2):
2674         (test3):
2675         * stress/set-iteration-oas.js: Added.
2676         (shouldBe):
2677         * stress/set-iterator-creation-fail-dfg.js: Added.
2678         (shouldThrow):
2679         (set shouldThrow):
2680         * stress/set-iterator-creation-fail.js: Added.
2681         (shouldThrow):
2682         (i.shouldThrow):
2683         (test2):
2684         (test3):
2685
2686 2020-04-15  Ross Kirsling  <ross.kirsling@sony.com>
2687
2688         [ECMA-402] Extension values should default to true, canonicalize without "-true"
2689         https://bugs.webkit.org/show_bug.cgi?id=210457
2690
2691         Reviewed by Yusuke Suzuki.
2692
2693         * stress/intl-collator.js:
2694         * stress/intl-datetimeformat.js:
2695         * stress/intl-numberformat.js:
2696         * stress/intl-object.js:
2697         * stress/intl-pluralrules.js:
2698         Fix tests.
2699
2700         * test262/expectations.yaml:
2701         Mark two test cases as passing.
2702
2703 2020-04-15  Justin Michaud  <justin@justinmichaud.com>
2704
2705         stress/delete-property-dfg-inline.js.ftl-no-cjit-small-pool consistently timing out on debug JSC bot
2706         https://bugs.webkit.org/show_bug.cgi?id=210513
2707
2708         Reviewed by Saam Barati.
2709
2710         * stress/delete-property-dfg-inline.js:
2711
2712 2020-04-15  Ross Kirsling  <ross.kirsling@sony.com>
2713
2714         [ECMA-402] Fix Intl.DateTimeFormat patterns and fields in WebKit
2715         https://bugs.webkit.org/show_bug.cgi?id=209783
2716
2717         Reviewed by Keith Miller.
2718
2719         * stress/date-toLocaleString.js:
2720         * stress/intl-datetimeformat.js:
2721         Add tests and fix some existing ones.
2722
2723         * test262/config.yaml:
2724         * test262/expectations.yaml:
2725         Mark eight test cases passing...but skip half of them due to outdated CLDR data in macOS system ICU.
2726
2727 2020-04-15  Devin Rousso  <drousso@apple.com>
2728
2729         [ESNext] Implement logical assignment operators
2730         https://bugs.webkit.org/show_bug.cgi?id=209716
2731
2732         Reviewed by Ross Kirsling.
2733
2734         * stress/logical-assignment-operator-and.js: Added.
2735         * stress/logical-assignment-operator-nullish.js: Added.
2736         * stress/logical-assignment-operator-or.js: Added.
2737
2738         * test262/config.yaml:
2739         * test262/expectations.yaml:
2740         Right now, test262 expects an early error to be thrown if the lhs is not simple, which does
2741         not match what we do with other read-modify assignment operators. This is likely to change
2742         in the future to match existing behavior (throw a `ReferenceError`) [1].
2743
2744         [1]: <https://github.com/tc39/ecma262/issues/257#issuecomment-502878708>
2745
2746 2020-04-14  Saam Barati  <sbarati@apple.com>
2747
2748         Skip all low executable memory wasm tests on arm64
2749         https://bugs.webkit.org/show_bug.cgi?id=210522
2750
2751         Reviewed by Tadeu Zagallo.
2752
2753         In my original JIT islands patch, I only skipped one of the "low executable
2754         memory" tests. But the others are also causing problems on the iOS JSC test
2755         runners, so let's just skip them all.
2756
2757         * wasm/lowExecutableMemory/exports-oom.js:
2758         * wasm/lowExecutableMemory/imports-oom.js:
2759
2760 2020-04-14  Yusuke Suzuki  <ysuzuki@apple.com>
2761
2762         Unreviewed, reduce iteration count and introduce early return to make typed-array-subarray-can-throw-oom-error.js execution time short while throwing an error
2763         https://bugs.webkit.org/show_bug.cgi?id=210507
2764
2765         * stress/typed-array-subarray-can-throw-oom-error.js:
2766         (canThrow):
2767         (bar):
2768         (get bar):
2769
2770 2020-04-13  Michael Saboff  <msaboff@apple.com>
2771
2772         [YARR] Allow for Unicode named capture group identifiers in non-Unicode regular expressions
2773         https://bugs.webkit.org/show_bug.cgi?id=210309
2774
2775         Reviewed by Ross Kirsling.
2776
2777         * stress/regexp-named-capture-groups.js: New test added.
2778         (shouldBe):
2779         (shouldThrowInvalidGroupSpecifierName):
2780         * test262/expectations.yaml: Updated for now failing tests.
2781         When test262 gets updated for this change, this can be reverted.
2782
2783 2020-04-12  Ross Kirsling  <ross.kirsling@sony.com>
2784
2785         [ECMA-402] WebKit Intl does not allow calendar and numberingSystem options
2786         https://bugs.webkit.org/show_bug.cgi?id=209784
2787
2788         Reviewed by Myles C. Maxfield.
2789
2790         * stress/intl-datetimeformat.js:
2791         Fix two test cases for old behavior.
2792
2793         * test262/expectations.yaml:
2794         Mark 16 test cases as passing.
2795
2796 2020-04-10  Ross Kirsling  <ross.kirsling@sony.com>
2797
2798         [ECMA-402] Properly implement BigInt.prototype.toLocaleString
2799         https://bugs.webkit.org/show_bug.cgi?id=209782
2800
2801         Reviewed by Darin Adler.
2802
2803         * stress/bigint-toLocaleString.js: Added.
2804         * stress/intl-numberformat.js: Add test cases.
2805         * test262/expectations.yaml: Mark 10 test cases as passing.
2806
2807 2020-04-10  Ross Kirsling  <ross.kirsling@sony.com>
2808
2809         Unreviewed gardening for JSTests/stress. Remove skips that were forgotten in r259658.
2810
2811         * stress/array-toLocaleString.js:
2812         * stress/date-toLocaleString.js:
2813         * stress/number-toLocaleString.js:
2814         * stress/string-localeCompare.js:
2815         * stress/string-toLocaleLowerCase.js:
2816         * stress/string-toLocaleUpperCase.js:
2817
2818 2020-04-10  Devin Rousso  <drousso@apple.com>
2819
2820         The rhs in `ReadModifyResolveNode` should be evaluated before throwing an exception if the lhs is read-only
2821         https://bugs.webkit.org/show_bug.cgi?id=210317
2822
2823         Reviewed by Ross Kirsling.
2824
2825         * stress/const-read-modify-assignment-eval-rhs-before-exception.js: Added.
2826
2827 2020-04-09  Yusuke Suzuki  <ysuzuki@apple.com>
2828
2829         [JSC] ModuleEnvironment do not have JSGlobalLexicalEnvironment as its upper scope
2830         https://bugs.webkit.org/show_bug.cgi?id=193347
2831
2832         Reviewed by Tadeu Zagallo.
2833
2834         * stress/global-lexical-environment-access-from-module.js: Added.
2835         (shouldBe):
2836         (import.string_appeared_here.then):
2837         * stress/resources/global-lexical-environment-access-from-module-child.js: Added.
2838         (export.read):
2839         (export.write):
2840
2841 2020-04-09  Yusuke Suzuki  <ysuzuki@apple.com>
2842
2843         Unreviewed, skip JSTests/stress/intl-canonicalize-locale-list-error-oom.js if memoryLimited
2844         <rdar://problem/61533598>
2845
2846         * stress/intl-canonicalize-locale-list-error-oom.js:
2847
2848 2020-04-09  Alexey Shvayka  <shvaikalesh@gmail.com>
2849
2850         ProxyObject::defineOwnProperty() should conditionally throw on falsy trap result
2851         https://bugs.webkit.org/show_bug.cgi?id=210267
2852
2853         Reviewed by Ross Kirsling.
2854
2855         * test262/expectations.yaml: Mark 2 test cases as passing.
2856
2857 2020-04-09  Saam Barati  <sbarati@apple.com>
2858
2859         We can still cache delete in strict mode as long as the property is not "non-configurable"
2860         https://bugs.webkit.org/show_bug.cgi?id=210148
2861
2862         Reviewed by Tadeu Zagallo.
2863
2864         * microbenchmarks/delete-cache-strict-mode.js: Added.
2865         (assert):
2866         (doDel):
2867         (doDelByVal):
2868
2869 2020-04-09  Alexey Shvayka  <shvaikalesh@gmail.com>
2870
2871         getOwnPropertyDescriptor() is incorrect with Proxy of exotic object
2872         https://bugs.webkit.org/show_bug.cgi?id=200560
2873
2874         Reviewed by Yusuke Suzuki.
2875
2876         * test262/expectations.yaml: Mark 14 test cases as passing.
2877
2878 2020-04-08  Yusuke Suzuki  <ysuzuki@apple.com>
2879
2880         [JSC] MultiDeleteByOffset should tell correct result AbstractValue in AI
2881         https://bugs.webkit.org/show_bug.cgi?id=210175
2882         <rdar://problem/61433817>
2883
2884         Reviewed by Saam Barati.
2885
2886         * stress/multi-delete-by-offset-ai-result.js: Added.
2887         (foo):
2888
2889 2020-04-07  Yusuke Suzuki  <ysuzuki@apple.com>
2890
2891         [JSC] Collect-continuously thread should take m_collectContinuouslyLock while it is waking up concurrent collector thread
2892         https://bugs.webkit.org/show_bug.cgi?id=210163
2893
2894         Reviewed by Saam Barati.
2895
2896         * stress/collect-continuously-should-not-wake-concurrent-collector-after-prevent-collection-is-called.js: Added.
2897         (let.theCode):
2898
2899 2020-04-07  Saam Barati  <sbarati@apple.com>
2900
2901         Delete ICs can't cache dictionaries
2902         https://bugs.webkit.org/show_bug.cgi?id=210147
2903         <rdar://problem/61382405>
2904
2905         Reviewed by Tadeu Zagallo.
2906
2907         * stress/dont-cache-delete-ic-on-dictionary-2.js: Added.
2908         (assert):
2909         (makeDictionary):
2910         (foo):
2911         * stress/dont-cache-delete-ic-on-dictionary.js: Added.
2912         (assert):
2913         (foo):
2914
2915 2020-04-07  Tadeu Zagallo  <tzagallo@apple.com>
2916
2917         Not using strict mode within ClassDeclaration statement
2918         https://bugs.webkit.org/show_bug.cgi?id=205578
2919         <rdar://problem/58194589>
2920
2921         Reviewed by Yusuke Suzuki.
2922
2923         * stress/inline-strict-delete.js: Added.
2924         (assert):
2925         (bar):
2926         (foo):
2927         * stress/superclass-expression-strictness.js: Added.
2928         (f.try.c):
2929         (f):
2930
2931 2020-04-07  Alexey Shvayka  <shvaikalesh@gmail.com>
2932
2933         test262/Runner.pm ignores "async" flag
2934         https://bugs.webkit.org/show_bug.cgi?id=210127
2935
2936         Reviewed by Ross Kirsling.
2937
2938         * test262/expectations.yaml: Mark 56 test cases as failing.
2939
2940 2020-04-07  Ross Kirsling  <ross.kirsling@sony.com>
2941
2942         Update JSTests to assume ICU 60+
2943         https://bugs.webkit.org/show_bug.cgi?id=210085
2944
2945         Reviewed by Yusuke Suzuki.
2946
2947         * stress/intl-collator.js:
2948         * stress/intl-constructors-with-proxy.js:
2949         * stress/intl-datetimeformat.js:
2950         * stress/intl-default-locale.js:
2951         * stress/intl-numberformat-format-to-parts.js:
2952         * stress/intl-numberformat.js: Ensure a test case doesn't depend on behavior changed in ICU 64.
2953         * stress/intl-object.js:
2954         * stress/intl-pluralrules.js: Correct two invalid test cases.
2955         * test262/config.yaml:
2956         Remove skips.
2957
2958 2020-04-07  Yusuke Suzuki  <ysuzuki@apple.com>
2959
2960         [JSC] ScopedArgumentsTable should handle OOM in tolerant manner
2961         https://bugs.webkit.org/show_bug.cgi?id=210126
2962
2963         Reviewed by Mark Lam.
2964
2965         * stress/scoped-arguments-table-should-be-tolerant-for-oom.js: Added.
2966         (canThrow):
2967         (bar):
2968         (get bar):
2969         (foo):
2970         (i.canThrow):
2971
2972 2020-04-07  Yusuke Suzuki  <ysuzuki@apple.com>
2973
2974         [JSC] Inlined IC should get right JSGlobalObject
2975         https://bugs.webkit.org/show_bug.cgi?id=210092
2976
2977         Reviewed by Tadeu Zagallo.
2978
2979         * stress/getter-setter-globalobject-in-ic.js: Added.
2980         (shouldBe):
2981         (valueFunc):
2982         (accessorFunc):
2983         (valueTest):
2984         (accessorTest):
2985
2986 2020-04-07  Yusuke Suzuki  <ysuzuki@apple.com>
2987
2988         [JSC] $.evalScript should check exception when accessing "global"
2989         https://bugs.webkit.org/show_bug.cgi?id=210114
2990         <rdar://problem/61388482>
2991
2992         Reviewed by Keith Miller.
2993
2994         * stress/eval-script-global-access-exception-check.js: Added.
2995         (shouldThrow):
2996
2997 2020-04-06  Rick Waldron  <waldron.rick@gmail.com> and Alexey Shvayka  <shvaikalesh@gmail.com>
2998
2999         Remove unnecessary Test262 harness file and implement $262.IsHTMLDDA
3000         https://bugs.webkit.org/show_bug.cgi?id=187526
3001
3002         Reviewed by Darin Adler.
3003
3004         * stress/optional-chaining.js: Adjust test for callable masquerader.
3005
3006 2020-04-06  Justin Michaud  <justin_michaud@apple.com>
3007
3008         Allow deleteById to be cached in the DFG
3009         https://bugs.webkit.org/show_bug.cgi?id=208664
3010
3011         Reviewed by Saam Barati.
3012
3013         * microbenchmarks/delete-property-allocation-sinking.js: Added.
3014         (assert):
3015         (noInline.assert.blackbox):
3016         (noInline.blackbox.doAlloc1):
3017         (noInline.doAlloc1):
3018         * microbenchmarks/polyvariant-delete-property.js: Added.
3019         (assert):
3020         (blackbox):
3021         (noInline.blackbox.polyvariant):
3022         (doAlloc1):
3023         (noInline.doAlloc1.doAlloc2):
3024         (noInline.doAlloc2):
3025         * stress/delete-property-dfg-inline.js: Added.
3026         (assert):
3027         (noInline.assert.assert_throws):
3028         (noInline.assert_throws.blackbox):
3029         (noInline.blackbox.testSingleStructure.doAlloc1):
3030         (noInline.blackbox.testSingleStructure):
3031         (noInline.testSingleStructure.testInlineSingleStructure.doDelete2):
3032         (noInline.testSingleStructure.testInlineSingleStructure.doAlloc2):
3033         (noInline.testSingleStructure.testInlineSingleStructure):
3034         (noInline.testInlineSingleStructure.testExit.doDelete3):
3035         (noInline.testInlineSingleStructure.testExit):
3036         (noInline.testExit.testSingleStructureMiss.doAlloc4):
3037         (noInline.testExit.testSingleStructureMiss):
3038         (noInline.testSingleStructureMiss.testSingleStructureMissStrict.string_appeared_here.doAlloc5):
3039         (noInline.testSingleStructureMiss.testSingleStructureMissStrict):
3040         (noInline.testSingleStructureMissStrict.testSingleStructureMissNonConfigurable.doAlloc6):
3041         (noInline.testSingleStructureMissStrict.testSingleStructureMissNonConfigurable):
3042         (noInline.testSingleStructureMissNonConfigurable.testSingleStructureEmpty.doAlloc7):
3043         (noInline.testSingleStructureMissNonConfigurable.testSingleStructureEmpty):
3044         (noInline.testSingleStructureEmpty.testPolymorphic.doDelete8):
3045         (noInline.testSingleStructureEmpty.testPolymorphic):
3046         (noInline.testPolymorphic.testPolyvariant.doDelete9):
3047         (noInline.testPolymorphic.testPolyvariant.polyvariant):
3048         (noInline.testPolymorphic.testPolyvariant):
3049         (noInline.testPolyvariant.testConstantFolding.doDelete10):
3050         (noInline.testPolyvariant.testConstantFolding):
3051         (noInline.testConstantFolding.testObjectSinking.doAlloc11):
3052         (noInline.testConstantFolding.testObjectSinking):
3053         (noInline.testObjectSinking.testProxy.doAlloc12):
3054         (noInline.testObjectSinking.testProxy.noInline.doDelete12):
3055         (noInline.testObjectSinking.testProxy):
3056         (noInline.testProxy.testTypedArray.doDelete12):
3057         (noInline.testProxy.testTypedArray):
3058         (noInline.testTypedArray.testMissMixed.doDelete13):
3059         (noInline.testTypedArray.testMissMixed):
3060         (noInline.testMissMixed.testMissNonMixed.doDelete14):
3061         (noInline.testMissMixed.testMissNonMixed):
3062         (noInline.testMissNonMixed.testByVal.doDelete15):
3063         (noInline.testMissNonMixed.testByVal):
3064
3065 2020-04-06  Saam Barati  <sbarati@apple.com>
3066
3067         Implement 1GB of executable memory on arm64
3068         https://bugs.webkit.org/show_bug.cgi?id=208490
3069         <rdar://problem/60797127>
3070
3071         Reviewed by Keith Miller.
3072
3073         Run JetStream2 wasm tests.
3074
3075         * wasm.yaml:
3076         * wasm/lowExecutableMemory/executable-memory-oom.js:
3077
3078 2020-04-06  Yusuke Suzuki  <ysuzuki@apple.com>
3079
3080         [JSC] Since ArrayBufferViewWatchpointAdaptor::add can fire watchpoints, DFG::Plan should check validity of CodeBlock after executing reallyAdd
3081         https://bugs.webkit.org/show_bug.cgi?id=210055
3082         <rdar://problem/61331962>
3083
3084         Reviewed by Keith Miller.
3085
3086         * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js: Added.
3087         (xxx.foo):
3088
3089 2020-04-05  Ross Kirsling  <ross.kirsling@sony.com>
3090
3091         JSC shell shouldn't treat NUL as a terminator when printing a JS string
3092         https://bugs.webkit.org/show_bug.cgi?id=210037
3093
3094         Reviewed by Darin Adler.
3095
3096         * .gitattributes:
3097         * ChakraCore.yaml:
3098         * ChakraCore/test/es5/hasItem.baseline-jsc: Added.
3099         Update baseline and mark it diffable (as plaintext) in spite of containing \0.
3100
3101 2020-04-05  Alexey Shvayka  <shvaikalesh@gmail.com>
3102
3103         Octal escapes should be max 3 digits and syntax errors in Unicode patterns
3104         https://bugs.webkit.org/show_bug.cgi?id=167067
3105
3106         Reviewed by Ross Kirsling.
3107
3108         * test262/expectations.yaml: Mark 4 test cases as passing.
3109
3110 2020-04-04  Alexey Shvayka  <shvaikalesh@gmail.com>
3111
3112         '\u' should throw an early SyntaxError exception, but instead evaluates to 'u'
3113         https://bugs.webkit.org/show_bug.cgi?id=198790
3114
3115         Reviewed by Yusuke Suzuki.
3116
3117         * mozilla/ecma/Array/15.4.5.1-1.js:
3118         * mozilla/ecma/LexicalConventions/7.7.4.js:
3119         * test262/expectations.yaml: Mark 4 test cases as passing.
3120
3121 2020-04-04  Yusuke Suzuki  <ysuzuki@apple.com>
3122
3123         Unreviewed, skip stress/typed-array-subarray-can-throw-oom-error.js on memory-limited archs, and mark it slow
3124         https://bugs.webkit.org/show_bug.cgi?id=209974
3125
3126         * stress/typed-array-subarray-can-throw-oom-error.js:
3127
3128 2020-04-04  Mark Lam  <mark.lam@apple.com>
3129
3130         Gardening: skip test for ARMv7 and MIPS to green the bots until the failure can be investigated.
3131         https://bugs.webkit.org/show_bug.cgi?id=210003
3132
3133         Not reviewed.
3134
3135         * stress/typed-array-subarray-can-throw-oom-error.js:
3136
3137 2020-04-03  Alexey Shvayka  <shvaikalesh@gmail.com>
3138
3139         Update test262 to commit 62b8fce38971
3140         https://bugs.webkit.org/show_bug.cgi?id=209979
3141
3142         Reviewed by Ross Kirsling.
3143
3144         * .gitattributes: Added.
3145         * test262/config.yaml: Skip "logical-assignment-operators" and "Promise.any" features.
3146         * test262/expectations.yaml:
3147         * test262/harness/*: Updated.
3148         * test262/latest-changes-summary.txt:
3149         * test262/test/*: Updated.
3150         * test262/test262-Revision.txt:
3151
3152 2020-04-03  Yusuke Suzuki  <ysuzuki@apple.com>
3153
3154         [JSC] canonicalizeLocaleList should gracefully throw OOM error if input + error message is too large
3155         https://bugs.webkit.org/show_bug.cgi?id=209971
3156         <rdar://problem/61258621>
3157
3158         Reviewed by Mark Lam.
3159
3160         * stress/intl-canonicalize-locale-list-error-oom.js: Added.
3161         (shouldThrow):
3162
3163 2020-04-03  Ross Kirsling  <ross.kirsling@sony.com>
3164
3165         Move Intl tests from LayoutTests to JSTests
3166         https://bugs.webkit.org/show_bug.cgi?id=209922
3167
3168         Reviewed by Yusuke Suzuki.
3169
3170         Intl doesn't depend on WebCore, so these tests shouldn't be layout tests.
3171         (They do, however, require one method to be added to $vm.)
3172
3173         Since LayoutTests/js has its own test harness, I've also migrated each test case to use simpler assertions.
3174
3175         * stress/array-to-locale-string.js: Removed -- subsumed by the following test.
3176         * stress/array-toLocaleString.js: Added.
3177         * stress/date-toLocaleString.js: Added.
3178         * stress/intl-collator.js: Added.
3179         * stress/intl-datetimeformat.js: Added.
3180         * stress/intl-default-locale.js: Added.
3181         * stress/intl-numberformat-format-to-parts.js: Added.
3182         * stress/intl-numberformat.js: Added.
3183         * stress/intl-object.js: Added.
3184         * stress/intl-pluralrules.js: Added.
3185         * stress/number-toLocaleString.js: Added.
3186         * stress/string-localeCompare.js: Added.
3187         * stress/string-toLocaleLowerCase.js: Added.
3188         * stress/string-toLocaleUpperCase.js: Added.
3189
3190 2020-04-03  Yusuke Suzuki  <ysuzuki@apple.com>
3191
3192         [JSC] TypedArray#subarray should throw OOM error gracefully
3193         https://bugs.webkit.org/show_bug.cgi?id=209974
3194         <rdar://problem/61253901>
3195
3196         Reviewed by Mark Lam.
3197
3198         * stress/typed-array-subarray-can-throw-oom-error.js: Added.
3199         (foo):
3200         (canThrow):
3201         (bar):
3202         (get bar):
3203
3204 2020-04-03  Paulo Matos  <pmatos@igalia.com>
3205
3206         Re-enable previously skipped arm tests
3207         https://bugs.webkit.org/show_bug.cgi?id=209958
3208
3209         Reviewed by Adrian Perez de Castro.
3210
3211         In the past year, some arm tests were skipped to keep the bots green.
3212         All known issues affecting these tests were fixed and now can be unskipped.
3213
3214         * stress/JSArrayBufferView-byteOffset-is-racy-from-compiler-thread.js:
3215         * stress/dont-range-based-iterate-vector-that-is-mutated.js:
3216         * stress/generator-cell-with-type.js:
3217         * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js:
3218         * stress/racy-slow-put-cloned-arguments-when-having-a-bad-time.js:
3219         * stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js:
3220         * stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js:
3221         * stress/toctou-having-a-bad-time-new-array.js:
3222
3223 2020-04-03  Paulo Matos  <pmatos@igalia.com>
3224
3225         stress/ftl-gettypedarrayoffset-wasteful.js times out on arm/linux
3226         https://bugs.webkit.org/show_bug.cgi?id=198754
3227
3228         Reviewed by Žan Doberšek.
3229
3230         Unskip test.
3231
3232         * stress/ftl-gettypedarrayoffset-wasteful.js:
3233
3234 2020-04-02  Alexey Shvayka  <shvaikalesh@gmail.com>
3235
3236         TypedArray's [[DefineOwnProperty]] is incorrect with partial descriptors
3237         https://bugs.webkit.org/show_bug.cgi?id=188875
3238
3239         Reviewed by Ross Kirsling.
3240
3241         * stress/typedarray-configure-index.js:
3242         * test262/expectations.yaml: Mark 10 test cases as passing.
3243
3244 2020-04-01  Ross Kirsling  <ross.kirsling@sony.com>
3245
3246         Intl.NumberFormat.prototype.format must preserve sign of -0
3247         https://bugs.webkit.org/show_bug.cgi?id=209880
3248
3249         Reviewed by Keith Miller.
3250
3251         * test262/config.yaml:
3252         This test was skipped as ICU version-dependent, but it shouldn't be.
3253
3254         * test262/expectations.yaml:
3255         Mark four test cases as passing.
3256
3257 2020-04-01  Justin Michaud  <justin@justinmichaud.com>
3258
3259         Delete IC incorrectly caches for proxies
3260         https://bugs.webkit.org/show_bug.cgi?id=209777
3261
3262         Reviewed by Mark Lam.
3263
3264         * stress/delete-property-ic-proxy.js: Added.
3265         (obj1.this.foo1):
3266         (foo1.foo2):
3267         (foo1):
3268         (foo2.foo3):
3269         (foo2):
3270         * stress/delete-property-inline-cache.js:
3271
3272 2020-04-01  Paulo Matos  <pmatos@igalia.com>
3273
3274         [JSC] Reenable non-cloop LLint, JIT and DFG on 32-bit platforms
3275         https://bugs.webkit.org/show_bug.cgi?id=191163
3276
3277         Reviewed by Adrian Perez de Castro.
3278
3279         Re-enable tests for 32bits.
3280
3281         * stress/op_add.js:
3282         * stress/op_bitand.js:
3283         * stress/op_bitor.js:
3284         * stress/op_bitxor.js:
3285         * stress/op_lshift-ConstVar.js:
3286         * stress/op_lshift-VarConst.js:
3287         * stress/op_lshift-VarVar.js:
3288         * stress/op_mod-ConstVar.js:
3289         * stress/op_mod-VarConst.js:
3290         * stress/op_mod-VarVar.js:
3291         * stress/op_mul-ConstVar.js:
3292         * stress/op_mul-VarConst.js:
3293         * stress/op_mul-VarVar.js:
3294         * stress/op_rshift-ConstVar.js:
3295         * stress/op_rshift-VarConst.js:
3296         * stress/op_rshift-VarVar.js:
3297         * stress/op_sub-ConstVar.js:
3298         * stress/op_sub-VarConst.js:
3299         * stress/op_sub-VarVar.js:
3300         * stress/op_urshift-ConstVar.js:
3301         * stress/op_urshift-VarConst.js:
3302         * stress/op_urshift-VarVar.js:
3303         * stress/spread-forward-call-varargs-stack-overflow.js:
3304         * stress/value-to-boolean.js:
3305
3306 2020-03-30  Alexey Shvayka  <shvaikalesh@gmail.com>
3307
3308         Add support in named capture group identifiers for direct surrogate pairs
3309         https://bugs.webkit.org/show_bug.cgi?id=178174
3310
3311         Reviewed by Darin Adler and Michael Saboff.
3312
3313         * test262/expectations.yaml: Mark 2 test cases as passing.
3314
3315 2020-03-30  Ross Kirsling  <ross.kirsling@sony.com>
3316
3317         RegExp.prototype.exec must always access lastIndex
3318         https://bugs.webkit.org/show_bug.cgi?id=209375
3319
3320         Reviewed by Saam Barati.
3321
3322         * mozilla/ecma_3/RegExp/15.10.6.2-2.js:
3323         Sync test with mozilla-central's copy.
3324         (https://searchfox.org/mozilla-central/source/js/src/tests/non262/RegExp/15.10.6.2-2.js)
3325
3326         * stress/regexp-exec-always-accesses-lastindex.js: Added.
3327
3328         * test262/expectations.yaml:
3329         Mark eight test cases as passing.
3330
3331 2020-03-30  Caio Lima  <ticaiolima@gmail.com>
3332
3333         [JSC] Public class field should accept "static" as field name
3334         https://bugs.webkit.org/show_bug.cgi?id=209703
3335
3336         Reviewed by Ross Kirsling.
3337
3338         * stress/class-fields-with-special-names.js: Added.
3339
3340 2020-03-28  Caio Lima  <ticaiolima@gmail.com>
3341
3342         stress/test-out-of-memory.js test gaderning
3343         https://bugs.webkit.org/show_bug.cgi?id=209701
3344
3345         Unreviewed test gardening.
3346
3347         * stress/test-out-of-memory.js:
3348
3349 2020-03-27  Mark Lam  <mark.lam@apple.com>
3350
3351         Skip stress/test-out-of-memory.js on memory limited devices.
3352         https://bugs.webkit.org/show_bug.cgi?id=209690
3353         <rdar://problem/60659198>
3354
3355         Reviewed by Keith Miller.
3356
3357         * stress/test-out-of-memory.js:
3358
3359 2020-03-27  Paulo Matos  <pmatos@igalia.com>
3360
3361         Skip new memory test stress/typed-array-oom-in... in memory limited devices
3362         https://bugs.webkit.org/show_bug.cgi?id=209661
3363
3364         Reviewed by Keith Miller.
3365
3366         * stress/typed-array-oom-in-buffer-accessor.js:
3367
3368 2020-03-27  Paulo Matos  <pmatos@igalia.com>
3369
3370         Pass hardness for test numberingSystemsForLocale-cached-... through test header
3371         https://bugs.webkit.org/show_bug.cgi?id=209476
3372
3373         Reviewed by Yusuke Suzuki.
3374
3375         Improvement over change r258190. Instead of creating a new test file
3376         duplicating contents where a hardness parameter is different, pass this
3377         through the test header using the -e flag to jsc.
3378
3379         * stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js:
3380         * stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access_memory-limited.js: Removed.
3381
3382 2020-03-26  Michael Saboff  <msaboff@apple.com>
3383
3384         Refactor YARR Stack Overflow Checks
3385         https://bugs.webkit.org/show_bug.cgi?id=209435
3386         rdar://problem/58988252
3387
3388         Reviewed by Mark Lam.
3389
3390         Added a new test and removed a now obsolete test.
3391
3392         * stress/regexp-compile-oom.js: Removed because the test is no longer valid.
3393         Previously when therer where different stack check mechanisims we failed different.
3394         This test was based on the different failure modes.  With these changes, most of
3395         the contain subtests no longer throw as this test expects.
3396         * stress/regexp-huge-oom.js: Added.
3397         (shouldBe):
3398         (shouldThrow):
3399
3400 2020-03-26  Keith Miller  <keith_miller@apple.com>
3401
3402         TypedArrays should more gracefully handle OOM during slowDownAndWasteMemory
3403         https://bugs.webkit.org/show_bug.cgi?id=209611
3404
3405         Reviewed by Tadeu Zagallo.
3406
3407         * stress/typed-array-oom-in-buffer-accessor.js: Added.
3408         (try.foo):
3409
3410 2020-03-25  Ross Kirsling  <ross.kirsling@sony.com>
3411
3412         Unreviewed, reimport test262 once more to make bot green.
3413
3414         * test262/expectations.yaml:
3415         * test262/harness/assert.js:
3416         * test262/harness/propertyHelper.js:
3417         * test262/latest-changes-summary.txt:
3418         * test262/test/built-ins/JSON/stringify/replacer-function-stack-overflow.js: Removed.
3419         * test262/test/built-ins/JSON/stringify/value-tojson-stack-overflow.js: Removed.
3420         * test262/test/built-ins/NativeErrors/AggregateError/newtarget-is-undefined.js: Added.
3421         * test262/test/built-ins/RegExp/prototype/Symbol.replace/poisoned-stdlib.js:
3422         * test262/test/harness/assert-samevalue-zeros.js:
3423         * test262/test/language/expressions/class/elements/private-field-after-optional-chain.js: Added.
3424         * test262/test/language/statements/class/elements/private-field-after-optional-chain.js: Added.
3425         * test262/test262-Revision.txt:
3426
3427 2020-03-25  Alexey Shvayka  <shvaikalesh@gmail.com>
3428
3429         RegExp.prototype[@@replace] relies on globals and doesn't perform ToLength
3430         https://bugs.webkit.org/show_bug.cgi?id=173867
3431
3432         Reviewed by Ross Kirsling.
3433
3434         * test262/expectations.yaml: Mark 4 test cases as passing.
3435
3436 2020-03-25  Alexey Shvayka  <shvaikalesh@gmail.com>
3437
3438         Invalid numeric and named references should be early syntax errors
3439         https://bugs.webkit.org/show_bug.cgi?id=178175
3440
3441         Reviewed by Ross Kirsling.
3442
3443         * test262/expectations.yaml: Mark 44 test cases as passing.
3444
3445 2020-03-25  Alexey Shvayka  <shvaikalesh@gmail.com>
3446
3447         \b escapes inside character classes should be valid in Unicode patterns
3448         https://bugs.webkit.org/show_bug.cgi?id=209528
3449
3450         Reviewed by Darin Adler.
3451
3452         * test262/expectations.yaml: Mark 2 test cases as passing.
3453
3454 2020-03-24  Tadeu Zagallo  <tzagallo@apple.com>
3455
3456         LLIntGenerator must link switch jumps to otherwise redundant labels
3457         https://bugs.webkit.org/show_bug.cgi?id=209333
3458         <rdar://problem/60827987>
3459
3460         Reviewed by Saam Barati.
3461
3462         * wasm/stress/terminal-jump-switch-target.js: Added.
3463
3464 2020-03-24  Alexey Shvayka  <shvaikalesh@gmail.com>
3465
3466         Update test262 to commit dfc7ecc6785e
3467         https://bugs.webkit.org/show_bug.cgi?id=209449
3468
3469         Unreviewed test gardening.
3470
3471         * test262/expectations.yaml:
3472         * test262/harness/propertyHelper.js:
3473         * test262/latest-changes-summary.txt:
3474         * test262/test/*: Updated.
3475         * test262/test262-Revision.txt:
3476
3477 2020-03-24  Alexey Shvayka  <shvaikalesh@gmail.com>
3478
3479         Update test262 to commit 79146e5cf48d
3480         https://bugs.webkit.org/show_bug.cgi?id=209449
3481
3482         Reviewed by Keith Miller.
3483
3484         * test262/config.yaml: Add 3 tests that timeout.
3485         * test262/expectations.yaml:
3486         * test262/latest-changes-summary.txt:
3487         * test262/test/*: Updated.
3488         * test262/test262-Revision.txt:
3489
3490 2020-03-23  Yusuke Suzuki  <ysuzuki@apple.com>
3491
3492         [JSC] Caller of Delete IC should emit write-barrier onto owner
3493         https://bugs.webkit.org/show_bug.cgi?id=209392
3494         <rdar://problem/60683173>
3495
3496         Reviewed by Saam Barati.
3497
3498         * stress/delete-ic-requires-write-barrier.js: Added.
3499         (foo):
3500
3501 2020-03-23  Yusuke Suzuki  <ysuzuki@apple.com>
3502
3503         [JSC] DFG OSR exit cannot find StructureStubInfo for put_by_val if CodeBlock is once converved from Baseline to LLInt
3504         https://bugs.webkit.org/show_bug.cgi?id=209327
3505         <rdar://problem/60631061>
3506
3507         Reviewed by Saam Barati.
3508
3509         * stress/osr-exit-attempts-to-find-stubinfo-which-is-cleared-by-previous-baseline-to-llint-conversion.js: Added.
3510         (setter):
3511         (foo):
3512
3513 2020-03-23  Ross Kirsling  <ross.kirsling@sony.com>
3514
3515         Catch parameters must not be lexically redeclared
3516         https://bugs.webkit.org/show_bug.cgi?id=208976
3517
3518         Reviewed by Keith Miller.
3519
3520         * test262/expectations.yaml:
3521         Mark four test cases as passing.
3522
3523 2020-03-20  Ross Kirsling  <ross.kirsling@sony.com>
3524
3525         hasObservableSideEffectsForRegExpSplit doesn't check for @@match override
3526         https://bugs.webkit.org/show_bug.cgi?id=209363
3527
3528         Reviewed by Michael Saboff.
3529
3530         * test262/expectations.yaml:
3531         Mark two test cases as passing.
3532
3533 2020-03-20  Ross Kirsling  <ross.kirsling@sony.com>
3534
3535         RegExp.prototype[@@replace] doesn't coerce result index to integer
3536         https://bugs.webkit.org/show_bug.cgi?id=209323
3537
3538         Reviewed by Yusuke Suzuki.
3539
3540         * test262/expectations.yaml:
3541         Mark six test cases as passing.
3542
3543 2020-03-19  Tomas Popela  <tpopela@redhat.com>
3544
3545         [JSC][BigEndians] Several JSC stress tests failing
3546         https://bugs.webkit.org/show_bug.cgi?id=194007
3547
3548         Reviewed by Michael Catanzaro.
3549
3550         Adapt the DataView tests to be able to pass on little endian as well
3551         as the big endian hardware. Do so by introducing method that determine
3552         the endianess and based on its value it saves the expected results in
3553         the right format.
3554
3555         * stress/dataview-get-cse.js:
3556         (getIsLittleEndian):
3557         (adjustForEndianess):
3558         (test3.foo):
3559         (test3):
3560         * stress/dataview-jit-get.js:
3561         (getIsLittleEndian):
3562         (test1.adjustForEndianess):
3563         (test1):
3564         (test2.adjustForEndianess):
3565         (test2):
3566         (test3.adjustForEndianess):
3567         (test3):
3568         (adjustForEndianessUint32):
3569         (test4):
3570         (test5):
3571         (test6):
3572         (test7):
3573         (test8):
3574         * stress/dataview-jit-neuter.js:
3575         (getIsLittleEndian):
3576         (adjustForEndianess):
3577         (test):
3578         (test2):
3579         * stress/dataview-jit-set-nan.js:
3580         (getIsLittleEndian):
3581         (adjustForEndianessFloat32):
3582         (test):
3583         * stress/dataview-jit-set.js:
3584         (getIsLittleEndian):
3585         (readHex):
3586         (adjustForEndianessUint16):
3587         (test):
3588         (test2):
3589         (adjustForEndianessUint32):
3590         (test3):
3591         (test4):
3592         (adjustForEndianessFloat32):
3593         (test5):
3594         (adjustForEndianessFloat64):
3595         (test6):
3596         (isLittleEndian): Deleted.
3597
3598 2020-03-18  Yusuke Suzuki  <ysuzuki@apple.com>
3599
3600         Add a way to mark a rejected promise as handled
3601         https://bugs.webkit.org/show_bug.cgi?id=209241
3602
3603         Reviewed by Michael Saboff.
3604
3605         * stress/reject-as-handled.js: Added.
3606         (shouldBe):
3607         (set new):
3608
3609 2020-03-16  Keith Miller  <keith_miller@apple.com>
3610
3611         JavaScript identifier grammar supports unescaped astral symbols, but JSC doesn’t
3612         https://bugs.webkit.org/show_bug.cgi?id=208998
3613
3614         Reviewed by Michael Saboff.
3615
3616         * stress/unicode-identifiers-with-surrogate-pairs.js: Added.
3617         (let.c.of.chars.eval.foo):
3618         (throwsSyntaxError):
3619         (let.c.of.continueChars.throwsSyntaxError.foo):
3620
3621 2020-03-13  Saam Barati  <sbarati@apple.com>
3622
3623         skip wasm/function-tests/grow-memory-cause-gc.js on memory limited devices
3624         https://bugs.webkit.org/show_bug.cgi?id=209069
3625         <rdar://problem/59954558>
3626
3627         Reviewed by Yusuke Suzuki.
3628
3629         * wasm/function-tests/grow-memory-cause-gc.js:
3630
3631 2020-03-13  Alexey Shvayka  <shvaikalesh@gmail.com>
3632
3633         Bound functions should pass correct NewTarget value
3634         https://bugs.webkit.org/show_bug.cgi?id=209057
3635
3636         Reviewed by Keith Miller.
3637
3638         * test262/expectations.yaml: Mark 4 test cases as passing.
3639
3640 2020-03-11  Keith Miller  <keith_miller@apple.com>
3641
3642         Test262-runner should always consider crashes as new failures
3643         https://bugs.webkit.org/show_bug.cgi?id=208943
3644
3645         Reviewed by Yusuke Suzuki.
3646
3647         * test262/expectations.yaml:
3648
3649 2020-03-11  Keith Miller  <keith_miller@apple.com>
3650
3651         Throws incorrectly a syntax error when declaring a top level catch variable the same as a parameter
3652         https://bugs.webkit.org/show_bug.cgi?id=189914
3653
3654         Reviewed by Saam Barati.
3655
3656         * ChakraCore/test/es6/globalParamCatchNewTargetSyntaxError.baseline-jsc:
3657         * stress/catch-destructuring-shadow-lexical-const-variable-global.js: Added.
3658         (catch):
3659         * stress/catch-destructuring-shadow-lexical-variable-class.js: Added.
3660         (Foo):
3661         (Bar):
3662         (Baz):
3663         * stress/catch-destructuring-shadow-lexical-variable-function.js: Added.
3664         (foo):
3665         (bar):
3666         * stress/catch-destructuring-shadow-lexical-variable-global.js: Added.
3667         (catch):
3668         * stress/catch-destructuring-shadow-var-global.js: Added.
3669         (catch):
3670         * test262/expectations.yaml:
3671
3672 2020-03-10  Ross Kirsling  <ross.kirsling@sony.com>
3673
3674         Re-import test262 to acquire DST fix
3675         https://bugs.webkit.org/show_bug.cgi?id=208901
3676
3677         Reviewed by Don Olmstead.
3678
3679         * test262/latest-changes-summary.txt:
3680         * test262/test/built-ins/AggregateError/newtarget-proto-fallback.js:
3681         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
3682         * test262/test/built-ins/Array/prototype/indexOf/15.4.4.14-4-4.js:
3683         * test262/test/built-ins/Date/parse/without-utc-offset.js:
3684         * test262/test262-Revision.txt:
3685
3686 2020-03-10  Paulo Matos  <pmatos@igalia.com>
3687
3688         JSC 32bits is failing on new test stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js
3689         https://bugs.webkit.org/show_bug.cgi?id=206864
3690
3691         Reviewed by Yusuke Suzuki.
3692
3693         Add new test to memory limited devices - behaviour is the same as 
3694         numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js
3695         but it creates 25 threads instead of 100.
3696
3697         * stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access_memory-limited.js: Added.
3698         (let.theCode):
3699
3700 2020-03-09  Alexey Shvayka  <shvaikalesh@gmail.com>
3701
3702         @putByValDirect does not perform [[DefineOwnProperty]] correctly
3703         https://bugs.webkit.org/show_bug.cgi?id=208708
3704
3705         Reviewed by Yusuke Suzuki.
3706
3707         * test262/expectations.yaml: Mark 46 test cases as passing.
3708
3709 2020-03-09  Caio Lima  <ticaiolima@gmail.com>
3710
3711         Tail calls are broken on ARM_THUMB2 and MIPS
3712         https://bugs.webkit.org/show_bug.cgi?id=197797
3713
3714         Reviewed by Yusuke Suzuki.
3715
3716         * stress/tail-call-with-spilled-registers.js: Added.
3717
3718 2020-03-07  Mark Lam  <mark.lam@apple.com>
3719
3720         Remove bad assertion in FTLLowerDFGToB3's compileDelBy().
3721         https://bugs.webkit.org/show_bug.cgi?id=208764
3722         <rdar://problem/59940095>
3723
3724         Reviewed by Keith Miller.
3725
3726         * stress/delete-by-val-with-base-and-subscript-using-same-cell.js: Added.
3727         * stress/delete-by-val-with-base-and-subscript-using-same-non-cell.js: Added.
3728
3729 2020-03-06  Yusuke Suzuki  <ysuzuki@apple.com>
3730
3731         [JSC] Enable public class fields
3732         https://bugs.webkit.org/show_bug.cgi?id=208756
3733
3734         Reviewed by Mark Lam.
3735
3736         Rename useClassFields to usePublicClassFields to keep separate from usePrivateClassFields once
3737         it is implemented.
3738
3739         * stress/big-int-as-property-name.js:
3740         * stress/class-fields-bytecode-cache.js:
3741         * stress/class-fields-computed-to-property-key.js:
3742         * stress/class-fields-function-name.js:
3743         * stress/class-fields-harmony.js:
3744         * stress/class-fields-proxy-define-property.js:
3745         * stress/class-fields-stress-instance.js:
3746         * stress/class-fields-to-property-key-const-string-ftl.js:
3747         * stress/class-fields-to-property-key-const-symbol-ftl.js:
3748         * stress/class-fields-to-property-key-slow-object-tostring-ftl.js:
3749         * stress/class-fields-to-property-key-slow-object-valueof-ftl.js:
3750         * stress/class-fields-to-property-key-string-object-ftl.js:
3751         * stress/class-fields-to-property-key-string-or-string-object-ftl.js:
3752         * stress/generator-syntax.js:
3753         * stress/method-name.js:
3754         * test262/config.yaml:
3755
3756 2020-03-06  Alexey Shvayka  <shvaikalesh@gmail.com>
3757
3758         JSON.stringify should call replacer on deleted properties
3759         https://bugs.webkit.org/show_bug.cgi?id=208725
3760
3761         Reviewed by Ross Kirsling.
3762
3763         * microbenchmarks/json-stringify-many-objects-to-json.js: Added.
3764         * microbenchmarks/json-stringify-many-objects.js: Added.
3765         * test262/expectations.yaml: Mark 2 test cases as passing.
3766
3767 2020-03-04  Mark Lam  <mark.lam@apple.com>
3768
3769         Handle an out of memory error while constructing the BytecodeGenerator.
3770         https://bugs.webkit.org/show_bug.cgi?id=208622
3771         <rdar://problem/59341136>
3772
3773         Reviewed by Saam Barati.
3774
3775         * stress/out-of-memory-while-constructing-BytecodeGenerator.js: Added.
3776
3777 2020-03-03  Yusuke Suzuki  <ysuzuki@apple.com>
3778
3779         [JSC] @hasOwnLengthProperty returns wrong value if "length" is attempted to be modified
3780         https://bugs.webkit.org/show_bug.cgi?id=208497
3781         <rdar://problem/59913544>
3782
3783         Reviewed by Mark Lam.
3784
3785         * stress/function-length-update.js: Added.
3786         (shouldBe):
3787         (userFunction):
3788         (userFunction2):
3789
3790 2020-03-02  Saam Barati  <sbarati@apple.com>
3791
3792         Don't skip tests unnecessarily on arm64
3793         https://bugs.webkit.org/show_bug.cgi?id=208470
3794         <rdar://problem/59968869>
3795
3796         Reviewed by Tadeu Zagallo.
3797
3798         * microbenchmarks/bit-test-constant.js:
3799         * microbenchmarks/bit-test-nonconstant.js:
3800         * microbenchmarks/memcpy-typed-loop-large.js:
3801         * microbenchmarks/memcpy-typed-loop-small.js:
3802         * microbenchmarks/mul-immediate-sub.js:
3803         * stress/dont-range-based-iterate-vector-that-is-mutated.js:
3804         * stress/dont-reserve-huge-capacity-lexer.js:
3805         * stress/new-largeish-contiguous-array-with-size.js: