JSTests/ChangeLog

   1 2019-10-17  Mark Lam  <mark.lam@apple.com>
   2
   3         Add missing checks after calls to the sameValue() JSValue comparator.
   4         https://bugs.webkit.org/show_bug.cgi?id=203126
   5         <rdar://problem/56366561>
   6
   7         Reviewed by Saam Barati.
   8
   9         * stress/validate-exception-check-in-proxy-object-put.js: Added.
  10
  11 2019-10-17  Saam Barati  <sbarati@apple.com>
  12
  13         GetByVal and PutByVal on ArrayStorage need to use the same AbstractHeap
  14         https://bugs.webkit.org/show_bug.cgi?id=203124
  15         <rdar://problem/55988183>
  16
  17         Reviewed by Yusuke Suzuki.
  18
  19         * stress/licm-array-storage-get-and-put-by-val.js: Added.
  20         (assert):
  21         (foo):
  22
  23 2019-10-16  Keith Miller  <keith_miller@apple.com>
  24
  25         Move assert in Wasm::Plan::fail.
  26         https://bugs.webkit.org/show_bug.cgi?id=203052
  27
  28         Reviewed by Mark Lam.
  29
  30         * wasm/regress/wasm-plan-fail-bad-error-message-assert.js: Added.
  31         (Binary):
  32         (Binary.prototype.trunc_buffer):
  33         (Binary.prototype.emit_leb_u):
  34         (Binary.prototype.emit_u32v):
  35         (Binary.prototype.emit_bytes):
  36         (Binary.prototype.emit_header):
  37         (__f_576):
  38         (__f_587):
  39
  40 2019-10-15  Mark Lam  <mark.lam@apple.com>
  41
  42         operationSwitchCharWithUnknownKeyType failed to handle OOME when resolving rope string.
  43         https://bugs.webkit.org/show_bug.cgi?id=202312
  44         <rdar://problem/55782280>
  45
  46         Reviewed by Yusuke Suzuki.
  47
  48         * stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings.js: Added.
  49         * stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings2.js: Added.
  50         * stress/switch-on-char-llint-rope.js:
  51         - Changed this test to make a new rope string for each iterations.  Otherwise,
  52           the rope will get resolved, and subsequent tiers will not be testing with a rope.
  53
  54 2019-10-14  Yusuke Suzuki  <ysuzuki@apple.com>
  55
  56         [JSC] GetterSetter should be JSCell, not JSObject
  57         https://bugs.webkit.org/show_bug.cgi?id=202656
  58
  59         Reviewed by Tadeu Zagallo and Saam Barati.
  60
  61         * stress/getter-setter-should-be-cell.js: Added.
  62         (foo.with.):
  63         (foo.with.get for):
  64         (foo.with.bar):
  65         (foo):
  66
  67 2019-10-14  Saam Barati  <sbarati@apple.com>
  68
  69         Canonicalize how we prepare the prototype chain for inline caching
  70         https://bugs.webkit.org/show_bug.cgi?id=202827
  71         <rdar://problem/56193919>
  72
  73         Reviewed by Yusuke Suzuki.
  74
  75         * stress/cache-correct-offset-after-flattening.js: Added.
  76         (assert):
  77
  78 2019-10-14  Paulo Matos  <pmatos@igalia.com>
  79
  80         Skip memcpy-typed-loop timing out on ARMv7 pending investigation
  81         https://bugs.webkit.org/show_bug.cgi?id=202923
  82
  83         Reviewed by Adrian Perez de Castro.
  84
  85         * microbenchmarks/memcpy-typed-loop.js:
  86
  87 2019-10-11  Keith Miller  <keith_miller@apple.com>
  88
  89         Wasm B3IRGenerator should use arguments for control data.
  90         https://bugs.webkit.org/show_bug.cgi?id=202855
  91
  92         Reviewed by Yusuke Suzuki.
  93
  94         * wasm/stress/loop-more-args-than-results.js: Added.
  95
  96 2019-10-10  Mark Lam  <mark.lam@apple.com>
  97
  98         Modify JSTests/stress/string-overflow-createError-*.js tests to allow an OOME result.
  99         https://bugs.webkit.org/show_bug.cgi?id=202828
 100
 101         Reviewed by Yusuke Suzuki.
 102
 103         The tests intentionally allocate a very large string.  Hence, for some memory
 104         limited configurations, it is perfectly reasonable for the test to throw an Out
 105         Of Memory error.
 106
 107         * stress/string-overflow-createError-builder.js:
 108         * stress/string-overflow-createError-fit.js:
 109
 110 2019-10-09  Yusuke Suzuki  <ysuzuki@apple.com>
 111
 112         Unreviewed, roll out r250878
 113         https://bugs.webkit.org/show_bug.cgi?id=202656
 114
 115         Breaking vimeo page.
 116
 117         * stress/getter-setter-should-be-cell.js: Removed.
 118
 119 2019-10-08  Yusuke Suzuki  <ysuzuki@apple.com>
 120
 121         [JSC] GetterSetter should be JSCell, not JSObject
 122         https://bugs.webkit.org/show_bug.cgi?id=202656
 123
 124         Reviewed by Tadeu Zagallo and Saam Barati.
 125
 126         * stress/getter-setter-should-be-cell.js: Added.
 127         (foo.with.):
 128         (foo.with.get for):
 129         (foo.with.bar):
 130         (foo):
 131
 132 2019-10-08  Alexey Shvayka  <shvaikalesh@gmail.com>
 133
 134         JSON.parse incorrectly handles array proxies
 135         https://bugs.webkit.org/show_bug.cgi?id=199292
 136
 137         Reviewed by Saam Barati.
 138
 139         * microbenchmarks/json-parse-array-reviver-same-value.js: Added.
 140         * microbenchmarks/json-parse-array-reviver.js: Added.
 141         * microbenchmarks/json-parse-object-reviver-same-value.js: Added.
 142         * microbenchmarks/json-parse-object-reviver.js: Added.
 143         * stress/json-parse-reviver-array-proxy.js: Added.
 144         * stress/json-parse-reviver-revoked-proxy.js: Added.
 145         * test262/expectations.yaml: Mark 6 test cases as passing.
 146
 147 2019-10-08  Ross Kirsling  <ross.kirsling@sony.com>
 148
 149         Update test262 (2019.10.08).
 150
 151         Rubber-stamped by Keith Miller.
 152
 153         * test262/config.yaml:
 154         * test262/expectations.yaml:
 155         * test262/latest-changes-summary.txt:
 156         * test262/test/:
 157         * test262/test262-Revision.txt:
 158
 159 2019-10-07  Saam Barati  <sbarati@apple.com>
 160
 161         Allow OSR exit to the LLInt
 162         https://bugs.webkit.org/show_bug.cgi?id=197993
 163
 164         Reviewed by Tadeu Zagallo.
 165
 166         * stress/exit-from-getter-by-val.js: Added.
 167         * stress/exit-from-setter-by-val.js: Added.
 168
 169 2019-10-07  Matt Lewis  <jlewis3@apple.com>
 170
 171         Unreviewed, rolling out r250750.
 172
 173         Reverting change as this broke interal test over the weekend.
 174
 175         Reverted changeset:
 176
 177         "Allow OSR exit to the LLInt"
 178         https://bugs.webkit.org/show_bug.cgi?id=197993
 179         https://trac.webkit.org/changeset/250750
 180
 181 2019-10-04  Saam Barati  <sbarati@apple.com>
 182
 183         Allow OSR exit to the LLInt
 184         https://bugs.webkit.org/show_bug.cgi?id=197993
 185
 186         Reviewed by Tadeu Zagallo.
 187
 188         * stress/exit-from-getter-by-val.js: Added.
 189         * stress/exit-from-setter-by-val.js: Added.
 190
 191 2019-10-04  Paulo Matos  <pmatos@igalia.com>
 192
 193         Revert regexp test skip on armv7l and mips
 194         https://bugs.webkit.org/show_bug.cgi?id=202310
 195
 196         Reviewed by Žan Doberšek.
 197
 198         Test was skipped in bug 202113 on armv7l and mips due to bug 202041.
 199         Bug 202041 is fixed and change of bug 202113 can be reverted.
 200
 201         * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js:
 202
 203 2019-10-02  Mark Lam  <mark.lam@apple.com>
 204
 205         DoubleToStringConverter::ToExponential() should null terminate its string.
 206         https://bugs.webkit.org/show_bug.cgi?id=202492
 207         <rdar://problem/55907708>
 208
 209         Reviewed by Filip Pizlo.
 210
 211         * stress/dtoa-AddSubstring-should-uses-strnlen-in-assertion.js: Added.
 212
 213 2019-10-02  Yusuke Suzuki  <ysuzuki@apple.com>
 214
 215         [JSC] AsyncGenerator should have internal fields
 216         https://bugs.webkit.org/show_bug.cgi?id=201498
 217
 218         Reviewed by Saam Barati.
 219
 220         * stress/async-generator-construct-failure.js: Added.
 221         (shouldThrow):
 222         (async.gen):
 223         (TypeError):
 224         * stress/async-generator-prototype-change.js: Added.
 225         (shouldBe):
 226         (async.gen):
 227         * stress/async-generator-prototype-closure.js: Added.
 228         (shouldBe):
 229         (test.async.gen):
 230         (test):
 231         * stress/create-async-generator.js: Added.
 232         (shouldBe):
 233         (test.async.generator):
 234         (test):
 235
 236 2019-10-01  Saam Barati  <sbarati@apple.com>
 237
 238         ObjectAllocationSinkingPhase shouldn't insert hints for allocations which are no longer valid
 239         https://bugs.webkit.org/show_bug.cgi?id=199361
 240         <rdar://problem/52454940>
 241
 242         Reviewed by Yusuke Suzuki.
 243
 244         * stress/allocation-sinking-hints-are-valid-ssa-2.js: Added.
 245         (main.fn):
 246         (main.executor):
 247         (main):
 248         * stress/allocation-sinking-hints-are-valid-ssa.js: Added.
 249         (main.fn):
 250         (main.executor):
 251         (main):
 252
 253 2019-10-01  Keith Miller  <keith_miller@apple.com>
 254
 255         skip test until we figure out why it's timing out
 256         https://bugs.webkit.org/show_bug.cgi?id=202423
 257
 258         Reviewed by Mark Lam.
 259
 260         new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js consistently times out on the bots.
 261         Let's skip it until we figure out what's going on.
 262
 263         * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js:
 264
 265 2019-10-01  Keith Miller  <keith_miller@apple.com>
 266
 267         Mark toctou test as skipped on debug builds
 268         https://bugs.webkit.org/show_bug.cgi?id=202420
 269
 270         Reviewed by Saam Barati.
 271
 272         Keeps timing out... Let's just skip it.
 273
 274         * stress/toctou-having-a-bad-time-new-array.js:
 275
 276 2019-10-01  Keith Miller  <keith_miller@apple.com>
 277
 278         Test262 update
 279
 280         Rubber-stamped by Michael Saboff.
 281
 282         Note, this was too big to effectivetly put on bugzilla as it's a 10MB patch...
 283
 284         * test262/*:
 285
 286 2019-10-01  Michael Saboff  <msaboff@apple.com> and Paulo Matos  <pmatos@igalia.com>
 287
 288         [YARR] Properly handle surrogates when matching back references
 289         https://bugs.webkit.org/show_bug.cgi?id=202041
 290
 291         Reviewed by Keith Miller.
 292
 293         Unchanged from the workin progress patch posted by Paulo Matos <pmatos@igalia.com>.
 294
 295         Updated test.
 296
 297         * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js:
 298         (testRegExpNotMatch):
 299
 300 2019-10-01  Keith Miller  <keith_miller@apple.com>
 301
 302         Add support for the Wasm multi-value proposal
 303         https://bugs.webkit.org/show_bug.cgi?id=202250
 304
 305         Reviewed by Saam Barati.
 306
 307         This patch adds a new way to run stress tests via the .wat text
 308         format. By attaching an asm.js compiled version of the wabt tool
 309         we can easily create wat files programatically and convert them
 310         into a wasm blob to compile. To make this easy there is a
 311         wabt-wrapper.js module file that exports two useful functions that
 312         correspond to WebAssembly.compile and WebAssembly.instantiate.
 313
 314         * wasm.yaml:
 315         * wasm/function-tests/if-no-else-non-void.js:
 316         * wasm/js-api/web-assembly-instantiate.js:
 317         (assert.asyncTest.async.test):
 318         (assert.asyncTest):
 319         * wasm/libwabt.js: Added.
 320         (WabtModule):
 321         (set get if):
 322         * wasm/references/func_ref.js:
 323         * wasm/references/validation.js:
 324         (assert.throws):
 325         * wasm/spec-harness/index.js:
 326         * wasm/spec-tests/block.wast.js:
 327         * wasm/spec-tests/br.wast.js:
 328         * wasm/spec-tests/br_if.wast.js:
 329         * wasm/spec-tests/call.wast.js:
 330         * wasm/spec-tests/call_indirect.wast.js:
 331         * wasm/spec-tests/func.wast.js:
 332         * wasm/spec-tests/if.wast.js:
 333         * wasm/spec-tests/loop.wast.js:
 334         * wasm/spec-tests/type.wast.js:
 335         * wasm/stress/js-wasm-call-many-return-types-on-stack-no-args.js: Added.
 336         (buildWat):
 337         * wasm/stress/js-wasm-js-varying-arities.js: Added.
 338         (paramForwarder):
 339         * wasm/stress/wasm-js-call-many-return-types-on-stack-no-args.js: Added.
 340         (buildWat):
 341         * wasm/stress/wasm-js-multi-value-exception-in-iterator.js: Added.
 342         (buildWat.throwError):
 343         (buildWat.throwErrorInIterator):
 344         (buildWat.tooManyValues):
 345         (buildWat.tooFewValues):
 346         (buildWat):
 347         * wasm/stress/wasm-wasm-call-indirect-many-return-types-on-stack.js: Added.
 348         (buildWat):
 349         * wasm/stress/wasm-wasm-call-many-return-types-on-stack-no-args.js: Added.
 350         (buildWat):
 351         * wasm/wabt-wrapper.js: Added.
 352         (export.compile):
 353         * wasm/wast-tests/br-if-at-end-of-block.wasm: Added.
 354         * wasm/wast-tests/br-if-at-end-of-block.wast: Added.
 355         * wasm/wast-tests/harness.js:
 356         (async.runWasmFile):
 357         * wasm/wast-tests/single-param-loop-signature.wasm: Added.
 358         * wasm/wast-tests/single-param-loop-signature.wast: Added.
 359
 360 2019-09-30  Tadeu Zagallo  <tzagallo@apple.com>
 361
 362         Make assertion in JSObject::putOwnDataProperty more precise
 363         https://bugs.webkit.org/show_bug.cgi?id=202379
 364         <rdar://problem/49515980>
 365
 366         Reviewed by Yusuke Suzuki.
 367
 368         * stress/object-assign-target-proto-setter.js: Added.
 369         (get Object):
 370
 371 2019-09-30  Yusuke Suzuki  <ysuzuki@apple.com>
 372
 373         [JSC] HeapSnapshotBuilder m_rootData should be protected with a lock too
 374         https://bugs.webkit.org/show_bug.cgi?id=202389
 375         <rdar://problem/50717564>
 376
 377         Reviewed by Mark Lam.
 378
 379         * stress/heap-analyzer-taking-lock.js: Added.
 380
 381 2019-09-30  Saam Barati  <sbarati@apple.com>
 382
 383         Inline caching is wrong for custom accessors and custom values
 384         https://bugs.webkit.org/show_bug.cgi?id=201994
 385         <rdar://problem/50850326>
 386
 387         Reviewed by Yusuke Suzuki.
 388
 389         * microbenchmarks/custom-accessor-materialized.js: Added.
 390         (assert):
 391         (test4.get const):
 392         * microbenchmarks/custom-accessor-thin-air.js: Added.
 393         (assert):
 394         (test5.get const):
 395         (test5.get proto):
 396         * microbenchmarks/custom-accessor.js: Added.
 397         (assert):
 398         (test3.get const):
 399         * microbenchmarks/custom-value-2.js: Added.
 400         (assert):
 401         (test1.getMultiline):
 402         (test1):
 403         * microbenchmarks/custom-value.js: Added.
 404         (assert):
 405         (test1.getMultiline):
 406         (test1):
 407         * stress/custom-accessor-delete-1.js: Added.
 408         (assert):
 409         (test3.get const):
 410         * stress/custom-accessor-delete-2.js: Added.
 411         (assert):
 412         (test4.get const):
 413         * stress/custom-accessor-delete-3.js: Added.
 414         (assert):
 415         (test5.get const):
 416         (test5.get proto):
 417         * stress/custom-value-delete-property-1.js: Added.
 418         (assert):
 419         (test1.getMultiline):
 420         (test1):
 421         * stress/custom-value-delete-property-2.js: Added.
 422         (test2.foo):
 423         (test2):
 424         * stress/custom-value-delete-property-3.js: Added.
 425         (test6.foo):
 426         (test6):
 427
 428 2019-09-30  Yusuke Suzuki  <ysuzuki@apple.com>
 429
 430         [JSC] AI folds CompareEq wrongly when it sees proven Boolean and Number
 431         https://bugs.webkit.org/show_bug.cgi?id=202382
 432         <rdar://problem/52669112>
 433
 434         Reviewed by Saam Barati.
 435
 436         * stress/compare-eq-bool-number-folding.js: Added.
 437         (test):
 438
 439 2019-09-27  Yusuke Suzuki  <ysuzuki@apple.com>
 440
 441         [JSC] Keep JSString::value(ExecState*)'s result as String instead of `const String&`
 442         https://bugs.webkit.org/show_bug.cgi?id=202330
 443
 444         Reviewed by Saam Barati.
 445
 446         * stress/to-lower-case-gc-stress.js: Added.
 447
 448 2019-09-27  Alexey Shvayka  <shvaikalesh@gmail.com>
 449
 450         Non-standard Error properties should not be enumerable
 451         https://bugs.webkit.org/show_bug.cgi?id=198975
 452
 453         Reviewed by Ross Kirsling.
 454
 455         * ChakraCore/test/Error/NativeErrors_v4.baseline-jsc: Adjust expectations.
 456         * microbenchmarks/let-for-in.js: Adjust test.
 457         * test262/expectations.yaml: Mark 6 test cases as passing.
 458
 459 2019-09-26  Yusuke Suzuki  <ysuzuki@apple.com>
 460
 461         [JSC] DFG recursive-tail-call optimization should not emit jump to call-frame with varargs
 462         https://bugs.webkit.org/show_bug.cgi?id=202299
 463         <rdar://problem/52669116>
 464
 465         Reviewed by Saam Barati.
 466
 467         * stress/recursive-tail-call-optimization-should-not-jump-into-call-frame-with-varargs-simple.js: Added.
 468         (foo):
 469         (test):
 470         * stress/recursive-tail-call-optimization-should-not-jump-into-call-frame-with-varargs.js: Added.
 471         (foo):
 472         (C1.prototype.baz):
 473         (C1):
 474         (bar):
 475         (noInline.bar.goo):
 476         (C2.prototype.baz):
 477         (C2):
 478         (test):
 479
 480 2019-09-26  Alexey Shvayka  <shvaikalesh@gmail.com>
 481
 482         toExponential, toFixed, and toPrecision should allow arguments up to 100
 483         https://bugs.webkit.org/show_bug.cgi?id=199163
 484
 485         Reviewed by Ross Kirsling.
 486
 487         * ChakraCore/test/Number/toString_3.baseline-jsc:
 488         * ChakraCore/test/es5/exceptions3.baseline-jsc:
 489         * test262/expectations.yaml: Mark 6 test cases as passing.
 490
 491 2019-09-24  Alexey Shvayka  <shvaikalesh@gmail.com>
 492
 493         [ES6] Come up with a test for Proxy.[[GetOwnProperty]] that tests the isExtensible error when the  result of the trap is undefined
 494         https://bugs.webkit.org/show_bug.cgi?id=154376
 495
 496         Reviewed by Ross Kirsling.
 497
 498         Adds 2 test cases:
 499         1. If [[GetOwnProperty]] trap result is `undefined` and Proxy's target is non-extensible, TypeError is thrown.
 500         2. If [[GetOwnProperty]] trap result is `undefined` and Proxy's target is another Proxy, its "isExtensible" trap is called.
 501
 502         * stress/proxy-get-own-property.js:
 503
 504 2019-09-24  Caio Lima  <ticaiolima@gmail.com>
 505
 506         [BigInt] Add ValueBitRShift into DFG
 507         https://bugs.webkit.org/show_bug.cgi?id=192663
 508
 509         Reviewed by Robin Morisset.
 510
 511         * stress/big-int-right-shift-jit-osr.js: Added.
 512         * stress/big-int-right-shift-jit-untyped.js: Added.
 513         * stress/big-int-right-shift-jit.js: Added.
 514         * stress/value-rshift-ai-rule.js: Added.
 515
 516 2019-09-23  Ross Kirsling  <ross.kirsling@sony.com>
 517
 518         Array methods should throw TypeError upon attempting to modify a string
 519         https://bugs.webkit.org/show_bug.cgi?id=201910
 520
 521         Reviewed by Keith Miller.
 522
 523         * stress/array-methods-should-not-modify-string.js: Added.
 524
 525         * mozilla/js1_6/Array/regress-304828.js:
 526         Fix test. Original copy was changed similarly seven years ago:
 527         https://searchfox.org/mozilla-central/source/js/src/tests/non262/Array/regress-304828.js
 528
 529         * stress/phantom-insertion-live-range-should-agree-with-arguments-forwarding.js:
 530         Fix test. `Object.__proto__ = []; Object.shift();` shouldn't be valid JS.
 531
 532 2019-09-23  Mark Lam  <mark.lam@apple.com>
 533
 534         Lazy JSGlobalObject property materialization should not use putDirectWithoutTransition.
 535         https://bugs.webkit.org/show_bug.cgi?id=202122
 536         <rdar://problem/55535249>
 537
 538         Reviewed by Yusuke Suzuki.
 539
 540         * stress/lazy-global-object-property-materialization-should-not-putDirectWithoutTransition.js: Added.
 541
 542 2019-09-23  Caio Lima  <ticaiolima@gmail.com>
 543
 544         Skip stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js into ARMv7 and MIPS
 545         https://bugs.webkit.org/show_bug.cgi?id=202113
 546
 547         Unreviewed test gardening, skipped test in ARMv7 and MIPS.
 548
 549         It is going to be fixed in
 550         https://bugs.webkit.org/show_bug.cgi?id=202041
 551
 552         * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js:
 553
 554 2019-09-22  Yusuke Suzuki  <ysuzuki@apple.com>
 555
 556         [JSC] Int52Rep(DoubleRepAnyIntUse) should not call operation function
 557         https://bugs.webkit.org/show_bug.cgi?id=202072
 558
 559         Reviewed by Mark Lam.
 560
 561         * stress/int52rep-with-double-checks-int52-range.js: Added.
 562         (shouldBe):
 563         (test):
 564
 565 2019-09-21  Caio Lima  <ticaiolima@gmail.com>
 566
 567         stress/test-out-of-memory.js is not throwing OOM into ARMv7 and MIPS
 568         https://bugs.webkit.org/show_bug.cgi?id=202011
 569
 570         Reviewed by Mark Lam.
 571
 572         We are skipping this test into MIPS and ARMv7 because some of its assumptions
 573         are not valid for them. The current behavior of the test in those architectures
 574         is that it does not throw during `new ArrayBuffer(1000)` allocation site,
 575         because eden collection keeps happening between iterations. The collection
 576         is triggered on those architectures because the amount of stress
 577         `new Promise` generates into GC limits is not enough to avoid them
 578         while loop is executing.
 579
 580         Changing the size of `UInt8Array` from `80000000` to `160000000` can
 581         be an alternative fix to avoid collection happening during `ArrayBuffer`
 582         allocation loop, but we can't guarantee this test is always going to execute
 583         without error when Gigacage is disabled, given we can reach an OOM state in
 584         some allocations that need to succeed, making this test flaky for those
 585         architectures.
 586
 587         * stress/test-out-of-memory.js:
 588
 589 2019-09-21  Tadeu Zagallo  <tzagallo@apple.com>
 590
 591         AccessCase should strongly visit its dependencies while on stack
 592         https://bugs.webkit.org/show_bug.cgi?id=201986
 593         <rdar://problem/55521953>
 594
 595         Reviewed by Saam Barati and Yusuke Suzuki.
 596
 597         * stress/ftl-put-by-id-setter-exception-interesting-live-state-2.js: Added.
 598         (foo):
 599         (warmup):
 600
 601 2019-09-20  Saam Barati  <sbarati@apple.com>
 602
 603         Unreviewed. Make toctou-having-a-bad-time-new-array.js run for less time because it's timing out on the debug bots.
 604
 605         * stress/toctou-having-a-bad-time-new-array.js:
 606
 607 2019-09-19  Yusuke Suzuki  <ysuzuki@apple.com>
 608
 609         [JSC] DFG op_call_varargs should not assume that one-previous-local of freeReg is usable
 610         https://bugs.webkit.org/show_bug.cgi?id=202014
 611
 612         Reviewed by Saam Barati.
 613
 614         * stress/call-varargs-inlining-should-not-clobber-previous-to-free-register.js: Added.
 615         (__v0):
 616
 617 2019-09-19  Tadeu Zagallo  <tzagallo@apple.com>
 618
 619         Syntax checker should report duplicate __proto__ properties
 620         https://bugs.webkit.org/show_bug.cgi?id=201897
 621         <rdar://problem/53201788>
 622
 623         Reviewed by Mark Lam.
 624
 625         * stress/syntax-checker-duplicate-underscore-proto.js: Added.
 626         (catch):
 627
 628 2019-09-18  Saam Barati  <sbarati@apple.com>
 629
 630         TOCTOU bug in havingABadTime related assertion in DFGSpeculativeJIT
 631         https://bugs.webkit.org/show_bug.cgi?id=201953
 632         <rdar://problem/53803524>
 633
 634         Reviewed by Yusuke Suzuki.
 635
 636         * stress/toctou-having-a-bad-time-new-array.js: Added.
 637         (let.code):
 638
 639 2019-09-18  Saam Barati  <sbarati@apple.com>
 640
 641         Phantom insertion phase may disagree with arguments forwarding about live ranges
 642         https://bugs.webkit.org/show_bug.cgi?id=200715
 643         <rdar://problem/54301717>
 644
 645         Reviewed by Yusuke Suzuki.
 646
 647         * stress/phantom-insertion-live-range-should-agree-with-arguments-forwarding.js: Added.
 648         (main.v23):
 649         (main.try.v43):
 650         (main.):
 651         (main):
 652
 653 2019-09-17  Yusuke Suzuki  <ysuzuki@apple.com>
 654
 655         [JSC] Generator should have internal fields
 656         https://bugs.webkit.org/show_bug.cgi?id=201159
 657
 658         Reviewed by Keith Miller.
 659
 660         * stress/create-generator.js: Added.
 661         (shouldBe):
 662         (test.generator):
 663         (test):
 664         * stress/generator-construct-failure.js: Added.
 665         (shouldThrow):
 666         (TypeError):
 667         * stress/generator-prototype-change.js: Added.
 668         (shouldBe):
 669         (gen):
 670         * stress/generator-prototype-closure.js: Added.
 671         (shouldBe):
 672         (test.gen):
 673         (test):
 674         * stress/object-assign-fast-path.js:
 675
 676 2019-09-17  Yusuke Suzuki  <ysuzuki@apple.com>
 677
 678         Follow-up after String.codePointAt optimization
 679         https://bugs.webkit.org/show_bug.cgi?id=201889
 680
 681         Reviewed by Saam Barati.
 682
 683         * stress/string-char-at-bad-type.js: Added.
 684         (shouldBe):
 685         (object.toString):
 686         (test):
 687         * stress/string-char-code-at-bad-type.js: Added.
 688         (shouldBe):
 689         (object.toString):
 690         (test):
 691         * stress/string-code-point-at-bad-type.js: Added.
 692         (shouldBe):
 693         (object.toString):
 694         (test):
 695
 696 2019-09-17  Yusuke Suzuki  <ysuzuki@apple.com>
 697
 698         [JSC] CheckArray+NonArray is not filtering out Array in AI
 699         https://bugs.webkit.org/show_bug.cgi?id=201857
 700         <rdar://problem/54194820>
 701
 702         Reviewed by Keith Miller.
 703
 704         * stress/check-array-with-non-array-does-not-filter-arrays.js: Added.
 705         (foo):
 706
 707 2019-09-17  Saam Barati  <sbarati@apple.com>
 708
 709         CheckArray on DirectArguments/ScopedArguments does not filter out slow put array storage
 710         https://bugs.webkit.org/show_bug.cgi?id=201853
 711         <rdar://problem/53805461>
 712
 713         Reviewed by Yusuke Suzuki.
 714
 715         * stress/direct-arguments-check-array-filter-type.js: Added.
 716         (foo):
 717
 718 2019-09-16  Tadeu Zagallo  <tzagallo@apple.com>
 719
 720         Wasm StreamingParser should validate that number of functions matches number of declarations
 721         https://bugs.webkit.org/show_bug.cgi?id=201850
 722         <rdar://problem/55290186>
 723
 724         Reviewed by Yusuke Suzuki.
 725
 726         * wasm/regress/validate-number-of-functions-match-declarations.js: Added.
 727         (catch):
 728
 729 2019-09-16  Michael Saboff  <msaboff@apple.com>
 730
 731         [JSC] Perform check again when we found non-BMP characters
 732         https://bugs.webkit.org/show_bug.cgi?id=201647
 733
 734         Reviewed by Yusuke Suzuki.
 735
 736         * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js: Added.
 737         * stress/regexp-unicode-within-string.js: Updated test to eliminate the bogus print().
 738         (testRegExpInbounds):
 739
 740 2019-09-16  Ross Kirsling  <ross.kirsling@sony.com>
 741
 742         [JSC] Add missing syntax errors for await in function parameter default expressions
 743         https://bugs.webkit.org/show_bug.cgi?id=201615
 744
 745         Reviewed by Darin Adler.
 746
 747         * stress/async-await-reserved-word.js:
 748         * stress/async-await-syntax.js:
 749         Add test cases.
 750
 751         * test262/expectations.yaml:
 752         Mark newly-passing test cases.
 753
 754 2019-09-16  Saam Barati  <sbarati@apple.com>
 755
 756         JSObject::putInlineSlow should not ignore "__proto__" for Proxy
 757         https://bugs.webkit.org/show_bug.cgi?id=200386
 758         <rdar://problem/53854946>
 759
 760         Reviewed by Yusuke Suzuki.
 761
 762         * stress/proxy-__proto__-in-prototype-chain.js: Added.
 763         * stress/proxy-property-replace-structure-transition.js: Added.
 764
 765 2019-09-13  Alexey Shvayka  <shvaikalesh@gmail.com>
 766
 767         Date.prototype.toJSON does not execute steps 1-2
 768         https://bugs.webkit.org/show_bug.cgi?id=105282
 769
 770         Reviewed by Ross Kirsling.
 771
 772         * test262/expectations.yaml: Mark 2 test cases as passing.
 773
 774 2019-09-12  Mark Lam  <mark.lam@apple.com>
 775
 776         Harden JSC against the abuse of runtime options.
 777         https://bugs.webkit.org/show_bug.cgi?id=201597
 778         <rdar://problem/55167068>
 779
 780         Reviewed by Filip Pizlo.
 781
 782         Remove the call to forceGCSlowPaths().  This utility function will be removed.
 783         The modern way to set the required option is to use //@ requireOptions.
 784
 785         * stress/ftl-try-catch-oom-error-lazy-slow-path.js:
 786
 787 2019-09-11  Yusuke Suzuki  <ysuzuki@apple.com>
 788
 789         [JSC] Add StringCodePointAt intrinsic
 790         https://bugs.webkit.org/show_bug.cgi?id=201673
 791
 792         Reviewed by Michael Saboff.
 793
 794         * stress/string-char-at-constant-index-out-of-range.js: Added.
 795         (shouldBe):
 796         (test):
 797         * stress/string-char-code-at-constant-index-out-of-range.js: Added.
 798         (shouldBe):
 799         (test):
 800         * stress/string-code-point-at--out-of-range.js: Added.
 801         (shouldBe):
 802         (test):
 803         * stress/string-code-point-at-basic.js: Added.
 804         (test):
 805         * stress/string-code-point-at-constant-index-out-of-range.js: Added.
 806         (shouldBe):
 807         (test):
 808         * stress/string-code-point-at-constant-int32-max-index-out-of-range.js: Added.
 809         (shouldBe):
 810         (test):
 811         * stress/string-code-point-at-constant-surrogate-pair.js: Added.
 812         (shouldBe):
 813         (test):
 814         (breaking):
 815         * stress/string-code-point-at-surrogate-pair.js: Added.
 816         (shouldBe):
 817         * stress/string-code-point-at.js: Added.
 818         (shouldBe):
 819
 820 2019-09-10  Michael Saboff  <msaboff@apple.com>
 821
 822         JSC crashes due to stack overflow while building RegExp
 823         https://bugs.webkit.org/show_bug.cgi?id=201649
 824
 825         Reviewed by Yusuke Suzuki.
 826
 827         New regression test.
 828
 829         * stress/regexp-bol-optimize-out-of-stack.js: Added.
 830         (test):
 831         (catch):
 832
 833 2019-09-10  Yusuke Suzuki  <ysuzuki@apple.com>
 834
 835         [WebAssembly] Use StreamingParser in existing Wasm::BBQPlan
 836         https://bugs.webkit.org/show_bug.cgi?id=189043
 837
 838         Reviewed by Keith Miller.
 839
 840         The offset performing the validation becomes a bit different.
 841         The offset 0 is nice since it is the starting offset of the Module header signature compared to the offset 8.
 842
 843         * wasm/js-api/version.js:
 844
 845 2019-09-07  Keith Miller  <keith_miller@apple.com>
 846
 847         OSR entry into wasm misses some contexts
 848         https://bugs.webkit.org/show_bug.cgi?id=201569
 849
 850         Reviewed by Yusuke Suzuki.
 851
 852         Add a new harness and wast and the generated wasm file for
 853         testing. The idea long term is to make it easy to test by creating
 854         a C file and converting it to a wast then modify that to produce a
 855         test.
 856
 857         * wasm.yaml:
 858         * wasm/wast-tests/harness.js: Added.
 859         (async.runWasmFile):
 860         * wasm/wast-tests/osr-entry-inner-loop-branch-above-no-consts.wasm: Added.
 861         * wasm/wast-tests/osr-entry-inner-loop-branch-above-no-consts.wast: Added.
 862         * wasm/wast-tests/osr-entry-inner-loop-branch-above.wasm: Added.
 863         * wasm/wast-tests/osr-entry-inner-loop-branch-above.wast: Added.
 864         * wasm/wast-tests/osr-entry-inner-loop.wasm: Added.
 865         * wasm/wast-tests/osr-entry-inner-loop.wast: Added.
 866         * wasm/wast-tests/osr-entry-multiple-enclosed-contexts.wasm: Added.
 867         * wasm/wast-tests/osr-entry-multiple-enclosed-contexts.wast: Added.
 868
 869 2019-09-09  Yusuke Suzuki  <ysuzuki@apple.com>
 870
 871         [JSC] Promise resolve/reject functions should be created more efficiently
 872         https://bugs.webkit.org/show_bug.cgi?id=201488
 873
 874         Reviewed by Mark Lam.
 875
 876         * microbenchmarks/promise-creation-many.js: Added.
 877         (executor):
 878
 879 2019-09-09  Zan Dobersek  <zdobersek@igalia.com>
 880
 881         Unreviewed JSC test gardening.
 882
 883         * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js:
 884         This test allocates a 2GB string before it goes out and tests
 885         out-of-memory exception when appending other strings to it. As such,
 886         skip the test on memory-limited platforms.
 887
 888 2019-09-07  Mark Lam  <mark.lam@apple.com>
 889
 890         The jsc shell should allow disabling of the Gigacage for testing purposes.
 891         https://bugs.webkit.org/show_bug.cgi?id=201579
 892
 893         Reviewed by Michael Saboff.
 894
 895         Unskip the tests now.
 896
 897         * stress/disable-gigacage-arrays.js:
 898         * stress/disable-gigacage-strings.js:
 899         * stress/disable-gigacage-typed-arrays.js:
 900
 901 2019-09-07  Mark Lam  <mark.lam@apple.com>
 902
 903         Gardening: temporarily skipping these tests until the fix can be reviewed and landed.
 904
 905         Not reviewed.
 906
 907         See https://bugs.webkit.org/show_bug.cgi?id=201579 for the fix.
 908
 909         * stress/disable-gigacage-arrays.js:
 910         * stress/disable-gigacage-strings.js:
 911         * stress/disable-gigacage-typed-arrays.js:
 912
 913 2019-09-07  Mark Lam  <mark.lam@apple.com>
 914
 915         Gardening: speculative test fix to green bots [attempt #2].
 916         https://bugs.webkit.org/show_bug.cgi?id=201529
 917         <rdar://problem/53935772>
 918
 919         Not reviewed.
 920
 921         * stress/test-out-of-memory.js:
 922
 923 2019-09-06  Mark Lam  <mark.lam@apple.com>
 924
 925         Gardening: speculative test fix to green bots.
 926         https://bugs.webkit.org/show_bug.cgi?id=201529
 927         <rdar://problem/53935772>
 928
 929         Not reviewed.
 930
 931         * stress/test-out-of-memory.js:
 932
 933 2019-09-06  Ross Kirsling  <ross.kirsling@sony.com>
 934
 935         Math.round() produces wrong result for value prior to 0.5
 936         https://bugs.webkit.org/show_bug.cgi?id=185115
 937
 938         Reviewed by Saam Barati.
 939
 940         * stress/math-round-basics.js:
 941         Add positive/negative test cases.
 942
 943         * test262/expectations.yaml:
 944         Mark test passing.
 945
 946 2019-09-06  Mark Lam  <mark.lam@apple.com>
 947
 948         Move web-assembly-constructors-should-not-override-global-object-property.js below JSTests/wasm/stress.
 949         https://bugs.webkit.org/show_bug.cgi?id=201551
 950
 951         Reviewed by Tadeu Zagallo.
 952
 953         Ports that don't support WASM will always fail this test if it stays in JSTests/stress.
 954
 955         * stress/web-assembly-constructors-should-not-override-global-object-property.js: Removed.
 956         * wasm/stress/web-assembly-constructors-should-not-override-global-object-property.js: Copied from JSTests/stress/web-assembly-constructors-should-not-override-global-object-property.js.
 957
 958 2019-09-06  Mark Lam  <mark.lam@apple.com>
 959
 960         Fix bmalloc::Allocator:tryAllocate() to return null on failure to allocate.
 961         https://bugs.webkit.org/show_bug.cgi?id=201529
 962         <rdar://problem/53935772>
 963
 964         Reviewed by Yusuke Suzuki.
 965
 966         * stress/test-out-of-memory.js: Added.
 967
 968 2019-09-05  Tadeu Zagallo  <tzagallo@apple.com>
 969
 970         LazyClassStructure::setConstructor should not store the constructor to the global object
 971         https://bugs.webkit.org/show_bug.cgi?id=201484
 972         <rdar://problem/50400451>
 973
 974         Reviewed by Yusuke Suzuki.
 975
 976         * stress/web-assembly-constructors-should-not-override-global-object-property.js: Added.
 977
 978 2019-09-05  Yusuke Suzuki  <ysuzuki@apple.com>
 979
 980         [JSC] Do not use FTLOutput::weakPointer directly
 981         https://bugs.webkit.org/show_bug.cgi?id=201495
 982
 983         Reviewed by Filip Pizlo.
 984
 985         * stress/create-promise-weak-pointer.js: Added.
 986         (foo):
 987
 988 2019-09-04  Yusuke Suzuki  <ysuzuki@apple.com>
 989
 990         [JSC] Make Promise implementation faster
 991         https://bugs.webkit.org/show_bug.cgi?id=200898
 992
 993         Reviewed by Saam Barati.
 994
 995         * ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
 996         (assert.assert.return.throws):
 997         * modules/breaking-builtin-promise-then-does-not-break-internal-promise.js: Added.
 998         * modules/breaking-builtin-promise-then-does-not-break-internal-promise/test.js: Added.
 999         * stress/constructor-kind-naked-should-not-be-applied-to-inner-functions.js: Added.
1000         (shouldThrow):
1001         (new.Promise):
1002         (shouldThrow.Promise):
1003         * stress/create-promise-should-respect-promise-realm.js: Added.
1004         (shouldBe):
1005         (other.new.OtherPromise):
1006         (DerivedOtherPromise):
1007         (i.promise.new.DerivedOtherPromise):
1008         (createPromise):
1009         * stress/derived-promise-constructor-class-syntax-prototype-replace-attempt.js: Added.
1010         (shouldBe):
1011         (DerivedPromise):
1012         (i.array.push.new.DerivedPromise):
1013         (promise.new.DerivedPromise):
1014         * stress/derived-promise-constructor-inlined.js: Added.
1015         (shouldBe):
1016         (DerivedPromise):
1017         (i.array.push.new.DerivedPromise):
1018         (DerivedPromise.all.array.then):
1019         * stress/derived-promise-prototype-replaced.js: Added.
1020         (shouldBe):
1021         (DerivedPromise):
1022         (i.array.push.new.DerivedPromise):
1023         (promise.new.DerivedPromise):
1024         * stress/internal-promise-constructor-not-confusing.js: Added.
1025         (shouldBe):
1026         (InternalPromise.vm.createBuiltin):
1027         (DerivedPromise):
1028         * stress/internal-promise-is-not-exposed.js: Added.
1029         (shouldBe):
1030         * stress/new-promise-should-respect-promise-realm.js: Added.
1031         (shouldBe):
1032         (other.new.OtherPromise):
1033         (createPromise):
1034         * stress/promise-cannot-be-called.js:
1035         (shouldThrow):
1036         * stress/promise-capability-fast-path.js: Added.
1037         (shouldBe):
1038         (i.array.push.new.Promise):
1039         (i.array.i.then):
1040         * stress/promise-capability-slow-path.js: Added.
1041         (shouldBe):
1042         (Promise.prototype.then):
1043         (i.array.push.new.Promise):
1044         (i.array.i.then):
1045         * stress/promise-capability-then-slow-path.js: Added.
1046         (shouldBe):
1047         (DerivedPromise):
1048         (DerivedPromise.prototype.then):
1049         (i.array.push.new.DerivedPromise):
1050         (i.array.i.then):
1051         * stress/promise-constructor-inlined.js: Added.
1052         (shouldBe):
1053         (i.array.push.new.Promise):
1054         (Promise.all.array.then):
1055         * stress/promise-constructor-transition-from-new-promise-to-create-promise.js: Added.
1056         (shouldBe):
1057         (DerivedPromise):
1058         (DerivedPromise2):
1059         (i.array.push.new.DerivedPromise):
1060         (i.array2.push.new.DerivedPromise2):
1061         * stress/without-promise-functions.js: Added.
1062         (shouldBe):
1063         (async):
1064
1065 2019-09-03  Mark Lam  <mark.lam@apple.com>
1066
1067         Assertions in JSArrayBufferView::byteOffset() are only valid for the mutator thread.
1068         https://bugs.webkit.org/show_bug.cgi?id=201309
1069         <rdar://problem/54832121>
1070
1071         Reviewed by Yusuke Suzuki.
1072
1073         * stress/JSArrayBufferView-byteOffset-is-racy-from-compiler-thread.js: Added.
1074
1075 2019-08-30  Yusuke Suzuki  <ysuzuki@apple.com>
1076
1077         [JSC] Generate new.target register only when it is used
1078         https://bugs.webkit.org/show_bug.cgi?id=201335
1079
1080         Reviewed by Mark Lam.
1081
1082         * stress/ensure-new-register-allocated.js: Added.
1083         (shouldBe):
1084         (basic):
1085         (arrow):
1086         (Base):
1087         (Derived):
1088         (evaluate):
1089
1090 2019-08-30  Yusuke Suzuki  <ysuzuki@apple.com>
1091
1092         [JSC] DFG ByteCodeParser should not copy JIT-related part of SimpleJumpTable
1093         https://bugs.webkit.org/show_bug.cgi?id=201331
1094
1095         Reviewed by Mark Lam.
1096
1097         * stress/simple-jump-table-copy.js: Added.
1098         (let.code):
1099         (g2):
1100
1101 2019-08-30  Yusuke Suzuki  <ysuzuki@apple.com>
1102
1103         [JSC] DFG inlining CheckBadCell slow path does not assume result VirtualRegister can be invalid
1104         https://bugs.webkit.org/show_bug.cgi?id=201332
1105
1106         Reviewed by Mark Lam.
1107
1108         This test is very flaky, it is hard to reproduce.
1109
1110         * stress/setter-inlining-resulting-bad-cell-result-virtual-register-should-be-invalid.js: Added.
1111         (code):
1112
1113 2019-08-29  Yusuke Suzuki  <ysuzuki@apple.com>
1114
1115         [JSC] Repatch should construct CallCases and CasesValue at the same time
1116         https://bugs.webkit.org/show_bug.cgi?id=201325
1117
1118         Reviewed by Saam Barati.
1119
1120         * stress/repatch-switch.js: Added.
1121         (main.f2.f0):
1122         (main.f2.f3):
1123         (main.f2.f1):
1124         (main.f2):
1125         (main):
1126
1127 2019-08-29  Yusuke Suzuki  <ysuzuki@apple.com>
1128
1129         [JSC] ObjectAllocationSinkingPhase wrongly deals with always-taken branches during interpretation
1130         https://bugs.webkit.org/show_bug.cgi?id=198650
1131
1132         Reviewed by Saam Barati.
1133
1134         * stress/object-allocation-sinking-interpretation-can-interpret-edges-that-can-be-proven-unreachable-in-ai.js:
1135         (main.v0):
1136         (main):
1137
1138 2019-08-28  Mark Lam  <mark.lam@apple.com>
1139
1140         DFG/FTL: We should prefetch structures and do a loadLoadFence before doing PrototypeChainIsSane checks.
1141         https://bugs.webkit.org/show_bug.cgi?id=201281
1142         <rdar://problem/54028228>
1143
1144         Reviewed by Yusuke Suzuki and Saam Barati.
1145
1146         * stress/structure-storedPrototype-should-only-assert-on-the-mutator-thread.js: Added.
1147
1148 2019-08-28  Mark Lam  <mark.lam@apple.com>
1149
1150         Placate exception check validation in DFG's operationHasGenericProperty().
1151         https://bugs.webkit.org/show_bug.cgi?id=201245
1152         <rdar://problem/54777512>
1153
1154         Reviewed by Robin Morisset.
1155
1156         * stress/missing-exception-check-in-operationHasGenericProperty.js: Added.
1157
1158 2019-08-27  Mark Lam  <mark.lam@apple.com>
1159
1160         constructFunctionSkippingEvalEnabledCheck() should use tryMakeString() and check for OOM.
1161         https://bugs.webkit.org/show_bug.cgi?id=201196
1162         <rdar://problem/54703775>
1163
1164         Reviewed by Yusuke Suzuki.
1165
1166         * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: Added.
1167
1168 2019-08-26  Ross Kirsling  <ross.kirsling@sony.com>
1169
1170         [JSC] Ensure x?.y ?? z is fast
1171         https://bugs.webkit.org/show_bug.cgi?id=200875
1172
1173         Reviewed by Yusuke Suzuki.
1174
1175         * stress/nullish-coalescing.js:
1176
1177 2019-08-23  Tadeu Zagallo  <tzagallo@apple.com>
1178
1179         Remove MaximalFlushInsertionPhase
1180         https://bugs.webkit.org/show_bug.cgi?id=201036
1181
1182         Reviewed by Saam Barati.
1183
1184         Remove all the references to maximal flush
1185
1186         * stress/arith-ceil-on-various-types.js:
1187         (checkCompileCountForUselessNegativeZero):
1188         * stress/arith-floor-on-various-types.js:
1189         (checkCompileCountForUselessNegativeZero):
1190         * stress/arith-negate-on-various-types.js:
1191         (checkCompileCountForUselessNegativeZero):
1192         * stress/arith-round-on-various-types.js:
1193         (checkCompileCountForUselessNegativeZero):
1194         * stress/arith-trunc-on-various-types.js:
1195         (checkCompileCountForUselessNegativeZero):
1196         * stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js:
1197         * stress/has-indexed-property-should-accept-non-int32.js:
1198         * stress/has-indexed-property-with-worsening-array-mode.js:
1199         * stress/known-int32-cant-be-used-across-bytecode-boundary.js:
1200         * stress/read-dead-bytecode-locals-in-must-handle-values1.js:
1201         * stress/read-dead-bytecode-locals-in-must-handle-values2.js:
1202         * stress/rest-parameter-many-arguments.js:
1203         * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness-2.js:
1204         * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness.js:
1205         * stress/to-index-string-should-not-assume-incoming-value-is-uint32.js:
1206
1207 2019-08-23  Justin Michaud  <justin_michaud@apple.com>
1208
1209         [WASM-References] Do not overwrite argument registers in jsCallEntrypoint
1210         https://bugs.webkit.org/show_bug.cgi?id=200952
1211
1212         Reviewed by Saam Barati.
1213
1214         * wasm/references/func_ref.js:
1215         (assert.throws):
1216
1217 2019-08-22  Justin Michaud  <justin_michaud@apple.com>
1218
1219         Add missing exception check in canonicalizeLocaleList
1220         https://bugs.webkit.org/show_bug.cgi?id=201021
1221
1222         Reviewed by Mark Lam.
1223
1224         * stress/missing-exception-check-in-canonicalizeLocaleList.js: Added.
1225         (catch):
1226
1227 2019-08-21  Mark Lam  <mark.lam@apple.com>
1228
1229         Wasm::FunctionParser is failing to enforce maxFunctionLocals.
1230         https://bugs.webkit.org/show_bug.cgi?id=201016
1231         <rdar://problem/54579911>
1232
1233         Reviewed by Yusuke Suzuki.
1234
1235         * wasm/stress/too-many-locals.js: Added.
1236         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.catch):
1237
1238 2019-08-21  Ross Kirsling  <ross.kirsling@sony.com>
1239
1240         JSTests/stress/optional-chaining should not call shouldThrowTypeError in a loop
1241         https://bugs.webkit.org/show_bug.cgi?id=200965
1242
1243         Reviewed by Saam Barati.
1244
1245         This has nothing to do with ?. in particular, but throwing >1M type errors takes 100s in Debug on my machine.
1246         The main idea here was to JITify the simple success cases, so let's not run the simple failures so many times.
1247
1248         * stress/optional-chaining.js:
1249
1250 2019-08-21  Michael Saboff  <msaboff@apple.com>
1251
1252         [JSC] incorrent JIT lead to StackOverflow
1253         https://bugs.webkit.org/show_bug.cgi?id=197823
1254
1255         Reviewed by Tadeu Zagallo.
1256
1257         New test.
1258
1259         * stress/bound-function-stack-overflow.js: Added.
1260         (foo):
1261         (catch):
1262
1263 2019-08-20  Justin Michaud  <justin_michaud@apple.com>
1264
1265         Identify memcpy loops in b3
1266         https://bugs.webkit.org/show_bug.cgi?id=200181
1267
1268         Reviewed by Saam Barati.
1269
1270         * microbenchmarks/memcpy-loop.js: Added.
1271         (doTest):
1272         (let.arr1):
1273         * microbenchmarks/memcpy-typed-loop-large.js: Added.
1274         (doTest):
1275         (let.arr1.new.Int32Array.1000000.let.arr2.new.Int32Array.1000000):
1276         (arr2):
1277         * microbenchmarks/memcpy-typed-loop-small.js: Added.
1278         (doTest):
1279         (16.let.arr1.new.Int32Array.size.let.arr2.new.Int32Array.size):
1280         (16.arr2):
1281         * microbenchmarks/memcpy-typed-loop-speculative.js: Added.
1282         (doTest):
1283         (let.arr1.new.Int32Array.10.let.arr2.new.Int32Array.10):
1284         (arr2):
1285         * microbenchmarks/memcpy-wasm-large.js: Added.
1286         (typeof.WebAssembly.string_appeared_here.eq):
1287         (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
1288         * microbenchmarks/memcpy-wasm-medium.js: Added.
1289         (typeof.WebAssembly.string_appeared_here.eq):
1290         (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
1291         * microbenchmarks/memcpy-wasm-small.js: Added.
1292         (typeof.WebAssembly.string_appeared_here.eq):
1293         (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
1294         * microbenchmarks/memcpy-wasm.js: Added.
1295         (typeof.WebAssembly.string_appeared_here.eq):
1296         (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
1297         * stress/memcpy-typed-loops.js: Added.
1298         (noLoop):
1299         (invalidStart):
1300         (const.size.10.let.arr1.new.Int32Array.size.let.arr2.new.Int32Array.size):
1301         (arr2):
1302         * wasm/function-tests/memcpy-wasm-loop.js: Added.
1303         (0.GetLocal.3.I32Const.1.I32Add.SetLocal.3.Br.1.End.End.End.WebAssembly):
1304         (string_appeared_here):
1305
1306 2019-08-20  Yusuke Suzuki  <ysuzuki@apple.com>
1307
1308         [JSC] Array.prototype.toString should not get "join" function each time
1309         https://bugs.webkit.org/show_bug.cgi?id=200905
1310
1311         Reviewed by Mark Lam.
1312
1313         * stress/array-prototype-join-change.js: Added.
1314         (shouldBe):
1315         (array2.join):
1316         (DerivedArray):
1317         (DerivedArray.prototype.join):
1318         (array3.__proto__.join):
1319         (Array.prototype.join):
1320
1321 2019-08-20  Justin Michaud  <justin_michaud@apple.com>
1322
1323         Fix InBounds speculation of typed array PutByVal and add extra step to integer range optimization to search for equality relationships on the RHS value
1324         https://bugs.webkit.org/show_bug.cgi?id=200782
1325
1326         Reviewed by Saam Barati.
1327
1328         Skip long memcpy test on debug, and try to fix flakiness for recompilation count tests by disabling cjit.
1329
1330         * microbenchmarks/memcpy-typed-loop.js:
1331         * stress/int8-repeat-in-then-out-of-bounds.js:
1332
1333 2019-08-19  Alexey Shvayka  <shvaikalesh@gmail.com>
1334
1335         Proxy constructor should throw if handler is revoked Proxy
1336         https://bugs.webkit.org/show_bug.cgi?id=198755
1337
1338         Reviewed by Saam Barati.
1339
1340         * stress/proxy-revoke.js: Adjust error message.
1341         * test262/expectations.yaml: Mark 2 test cases as passing.
1342
1343 2019-08-19  Yusuke Suzuki  <ysuzuki@apple.com>
1344
1345         [JSC] OSR entry to Wasm OMG
1346         https://bugs.webkit.org/show_bug.cgi?id=200362
1347
1348         Reviewed by Michael Saboff.
1349
1350         * wasm/stress/osr-entry-basic.js: Added.
1351         (instance.exports.loop):
1352         * wasm/stress/osr-entry-many-locals-f32.js: Added.
1353         * wasm/stress/osr-entry-many-locals-f64.js: Added.
1354         * wasm/stress/osr-entry-many-locals-i32.js: Added.
1355         * wasm/stress/osr-entry-many-locals-i64.js: Added.
1356         * wasm/stress/osr-entry-many-stacks-f32.js: Added.
1357         * wasm/stress/osr-entry-many-stacks-f64.js: Added.
1358         * wasm/stress/osr-entry-many-stacks-i32.js: Added.
1359         * wasm/stress/osr-entry-many-stacks-i64.js: Added.
1360
1361 2019-08-19  Alexey Shvayka  <shvaikalesh@gmail.com>
1362
1363         Date.prototype.toJSON throws if toISOString returns an object
1364         https://bugs.webkit.org/show_bug.cgi?id=198495
1365
1366         Reviewed by Ross Kirsling.
1367
1368         * test262/expectations.yaml: Mark 6 test cases as passing.
1369
1370 2019-08-19  Yusuke Suzuki  <ysuzuki@apple.com>
1371
1372         [JSC] DFG DataView get/set optimization should take care of the case little-endian flag is JSEmpty
1373         https://bugs.webkit.org/show_bug.cgi?id=200899
1374         <rdar://problem/54073341>
1375
1376         Reviewed by Mark Lam.
1377
1378         * stress/data-view-get-dfg-should-handle-empty-constant.js: Added.
1379         (i.new.Promise):
1380         * stress/data-view-set-dfg-should-handle-empty-constant.js: Added.
1381         (i.new.Promise):
1382
1383 2019-08-19  Michael Saboff  <msaboff@apple.com>
1384
1385         Webkit jsc Crash in RegExp::matchInline (this=<optimized out>
1386         https://bugs.webkit.org/show_bug.cgi?id=197090
1387
1388         Reviewed by Yusuke Suzuki.
1389
1390         New test.
1391
1392         * stress/regexp-nonconsuming-counted-parens.js: Added.
1393
1394 2019-08-18  Ross Kirsling  <ross.kirsling@sony.com>
1395
1396         [JSC] Correct a->an in error messages and API docblocks
1397         https://bugs.webkit.org/show_bug.cgi?id=200833
1398
1399         Reviewed by Don Olmstead.
1400
1401         * ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
1402         (assert.assert.return.throws):
1403         * stress/promise-finally-should-accept-non-promise-objects.js:
1404         * wasm/js-api/table.js:
1405         (assert.throws):
1406
1407 2019-08-17  Ross Kirsling  <ross.kirsling@sony.com>
1408
1409         [ESNext] Implement optional chaining
1410         https://bugs.webkit.org/show_bug.cgi?id=200199
1411
1412         Reviewed by Yusuke Suzuki.
1413
1414         * stress/nullish-coalescing.js:
1415         * stress/optional-chaining.js: Added.
1416         * stress/tail-call-recognize.js:
1417
1418 2019-08-17  Ross Kirsling  <ross.kirsling@sony.com>
1419
1420         [ESNext] Support hashbang.
1421         https://bugs.webkit.org/show_bug.cgi?id=200865
1422
1423         Reviewed by Mark Lam.
1424
1425         * stress/hashbang.js: Added.
1426         * test262/expectations.yaml: Mark 6 cases as passing.
1427
1428 2019-08-17  Yusuke Suzuki  <ysuzuki@apple.com>
1429
1430         [JSC] DFG ToNumber should support Boolean in fixup
1431         https://bugs.webkit.org/show_bug.cgi?id=200864
1432
1433         Reviewed by Mark Lam.
1434
1435         * microbenchmarks/to-number-boolean.js: Added.
1436         (test):
1437         * stress/to-number-boolean-int32.js: Added.
1438         (shouldBe):
1439         (test):
1440         (check):
1441         * stress/to-number-boolean.js: Added.
1442         (shouldBe):
1443         (test):
1444         (check):
1445         * stress/to-number-int32.js: Added.
1446         (shouldBe):
1447         (test):
1448         (check):
1449
1450 2019-08-16  Mark Lam  <mark.lam@apple.com>
1451
1452         More missing exception checks in string comparison operators.
1453         https://bugs.webkit.org/show_bug.cgi?id=200844
1454         <rdar://problem/54378684>
1455
1456         Reviewed by Saam Barati.
1457
1458         * stress/missing-exception-check-in-string-greater-than-compare.js: Added.
1459         * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: Added.
1460         * stress/missing-exception-check-in-string-less-than-compare.js: Added.
1461         * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: Added.
1462
1463 2019-08-16  Mark Lam  <mark.lam@apple.com>
1464
1465         CodeBlock destructor should clear all of its watchpoints.
1466         https://bugs.webkit.org/show_bug.cgi?id=200792
1467         <rdar://problem/53947800>
1468
1469         Reviewed by Yusuke Suzuki.
1470
1471         * stress/codeblock-should-clear-watchpoints-on-destruction.js: Added.
1472
1473 2019-08-16  Justin Michaud  <justin_michaud@apple.com>
1474
1475         Fix InBounds speculation of typed array PutByVal and add extra step to integer range optimization to search for equality relationships on the RHS value
1476         https://bugs.webkit.org/show_bug.cgi?id=200782
1477
1478         Reviewed by Saam Barati.
1479
1480         * microbenchmarks/int8-out-of-bounds.js: Added.
1481         (foo):
1482         * microbenchmarks/memcpy-typed-loop.js: Added.
1483         (doTest):
1484         (let.arr1.new.Int32Array.1000.let.arr2.new.Int32Array.1000):
1485         (arr2):
1486         * stress/int8-repeat-in-then-out-of-bounds.js: Added.
1487         (foo):
1488
1489 2019-08-16  Mark Lam  <mark.lam@apple.com>
1490
1491         [Re-land] ProxyObject should not be allow to access its target's private properties.
1492         https://bugs.webkit.org/show_bug.cgi?id=200739
1493         <rdar://problem/53972768>
1494
1495         Reviewed by Yusuke Suzuki.
1496
1497         * stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js: Copied from JSTests/stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js.
1498         * stress/proxy-with-private-symbols.js:
1499
1500 2019-08-16  Yusuke Suzuki  <ysuzuki@apple.com>
1501
1502         [JSC] Promise.prototype.finally should accept non-promise objects
1503         https://bugs.webkit.org/show_bug.cgi?id=200829
1504
1505         Reviewed by Mark Lam.
1506
1507         * stress/promise-finally-should-accept-non-promise-objects.js: Added.
1508         (shouldBe):
1509         (Thenable):
1510         (Thenable.prototype.then):
1511
1512 2019-08-16  Alexey Shvayka  <shvaikalesh@gmail.com>
1513
1514         Promise constructor should check argument before [[Construct]]
1515         https://bugs.webkit.org/show_bug.cgi?id=198976
1516
1517         Reviewed by Ross Kirsling.
1518
1519         * stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js: Fix test.
1520         * stress/create-subclass-structure-might-throw.js: Fix test.
1521         * test262/expectations.yaml: Mark 2 test cases as passing.
1522
1523 2019-08-16  Ryan Haddad  <ryanhaddad@apple.com>
1524
1525         Unreviewed, rolling out r248709.
1526
1527         Caused test/built-ins/Promise/prototype/finally/this-value-
1528         non-promise.js to fail on test262 bot
1529
1530         Reverted changeset:
1531
1532         "ProxyObject should not be allow to access its target's
1533         private properties."
1534         https://bugs.webkit.org/show_bug.cgi?id=200739
1535         https://trac.webkit.org/changeset/248709
1536
1537 2019-08-15  Alexey Shvayka  <shvaikalesh@gmail.com>
1538
1539         DateConversion::formatDateTime incorrectly formats negative years
1540         https://bugs.webkit.org/show_bug.cgi?id=199964
1541
1542         Reviewed by Ross Kirsling.
1543
1544         * test262/expectations.yaml: Mark 6 test cases as passing.
1545
1546 2019-08-15  Mark Lam  <mark.lam@apple.com>
1547
1548         More missing exception checks in String.prototype.
1549         https://bugs.webkit.org/show_bug.cgi?id=200762
1550         <rdar://problem/54333896>
1551
1552         Reviewed by Michael Saboff.
1553
1554         * stress/missing-exception-check-in-string-lastIndexOf.js: Added.
1555         * stress/missing-exception-check-in-string-toLower.js: Added.
1556         * stress/missing-exception-check-in-string-toUpper.js: Added.
1557
1558 2019-08-14  Mark Lam  <mark.lam@apple.com>
1559
1560         ProxyObject should not be allow to access its target's private properties.
1561         https://bugs.webkit.org/show_bug.cgi?id=200739
1562         <rdar://problem/53972768>
1563
1564         Reviewed by Yusuke Suzuki.
1565
1566         * stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js: Added.
1567         * stress/proxy-with-private-symbols.js: Rebased.
1568
1569 2019-08-14  Mark Lam  <mark.lam@apple.com>
1570
1571         Missing exception check in string compare.
1572         https://bugs.webkit.org/show_bug.cgi?id=200743
1573         <rdar://problem/53975356>
1574
1575         Reviewed by Michael Saboff.
1576
1577         * stress/missing-exception-check-in-string-compare.js: Added.
1578
1579 2019-08-08  Ross Kirsling  <ross.kirsling@sony.com>
1580
1581         [JSC] Add "jump if (not) undefined or null" bytecode ops
1582         https://bugs.webkit.org/show_bug.cgi?id=200480
1583
1584         Reviewed by Saam Barati.
1585
1586         * stress/destructuring-assignment-require-object-coercible.js:
1587         * stress/nullish-coalescing.js:
1588
1589 2019-08-05  Michael Saboff  <msaboff@apple.com>
1590
1591         JSC: assertion failure in SpeculativeJIT::compileGetByValOnIntTypedArray
1592         https://bugs.webkit.org/show_bug.cgi?id=199997
1593
1594         Reviewed by Saam Barati.
1595
1596         New test.
1597
1598         * stress/typedarray-no-alreadyChecked-assert.js: Added.
1599         (checkIntArray):
1600         (checkFloatArray):
1601
1602 2019-08-02  Yusuke Suzuki  <ysuzuki@apple.com>
1603
1604         [JSC] Support WebAssembly in SamplingProfiler
1605         https://bugs.webkit.org/show_bug.cgi?id=200329
1606
1607         Reviewed by Saam Barati.
1608
1609         * stress/sampling-profiler-wasm-name-section.js: Added.
1610         (const.compile):
1611         (platformSupportsSamplingProfiler.vm.isWasmSupported.wasmEntry):
1612         (platformSupportsSamplingProfiler.vm.isWasmSupported):
1613         * stress/sampling-profiler-wasm.js: Added.
1614         (platformSupportsSamplingProfiler.vm.isWasmSupported.wasmEntry):
1615         (platformSupportsSamplingProfiler.vm.isWasmSupported):
1616         * stress/sampling-profiler/loop.wasm: Added.
1617         * stress/sampling-profiler/loop.wast: Added.
1618         * stress/sampling-profiler/nameSection.wasm: Added.
1619
1620 2019-08-02  Yusuke Suzuki  <ysuzuki@apple.com>
1621
1622         [JSC] LazyJSValue should be robust for empty JSValue
1623         https://bugs.webkit.org/show_bug.cgi?id=200388
1624
1625         Reviewed by Saam Barati.
1626
1627         * stress/switch-constant-child-becomes-empty.js: Added.
1628         (foo):
1629
1630 2019-08-01  Yusuke Suzuki  <ysuzuki@apple.com>
1631
1632         GetterSetter type confusion during DFG compilation
1633         https://bugs.webkit.org/show_bug.cgi?id=199903
1634
1635         Reviewed by Mark Lam.
1636
1637         * stress/cse-propagated-constant-may-not-follow-structure-restrictions.js: Added.
1638
1639 2019-08-01  Ross Kirsling  <ross.kirsling@sony.com>
1640
1641         Update Test262 (2019.08.01)
1642         https://bugs.webkit.org/show_bug.cgi?id=200351
1643
1644         Reviewed by Keith Miller.
1645
1646         * test262/expectations.yaml:
1647         * test262/harness/testIntl.js:
1648         * test262/latest-changes-summary.txt:
1649         * test262/test/:
1650         * test262/test262-Revision.txt:
1651
1652 2019-07-30  Yusuke Suzuki  <ysuzuki@apple.com>
1653
1654         [JSC] Make StructureChain less-tricky by using Auxiliary Buffer
1655         https://bugs.webkit.org/show_bug.cgi?id=200192
1656
1657         Reviewed by Saam Barati.
1658
1659         * stress/structure-chain-stress.js: Added.
1660         (keys):
1661
1662 2019-07-29  Yusuke Suzuki  <ysuzuki@apple.com>
1663
1664         [JSC] Increment bytecode age only when SlotVisitor is first-visit
1665         https://bugs.webkit.org/show_bug.cgi?id=200196
1666
1667         Reviewed by Robin Morisset.
1668
1669         * stress/reparsing-unlinked-codeblock.js:
1670
1671 2019-07-29  Justin Michaud  <justin_michaud@apple.com>
1672
1673         [X86] Emit BT instruction for shift + mask in B3
1674         https://bugs.webkit.org/show_bug.cgi?id=199891
1675
1676         Reviewed by Robin Morisset.
1677
1678         Lower the number of iterations to fix debug timeouts.
1679
1680         * microbenchmarks/bit-test-load.js:
1681         (i):
1682
1683 2019-07-27  Justin Michaud  <justin_michaud@apple.com>
1684
1685         [X86] Emit BT instruction for shift + mask in B3
1686         https://bugs.webkit.org/show_bug.cgi?id=199891
1687
1688         Reviewed by Keith Miller.
1689
1690         * microbenchmarks/bit-test-constant.js: Added.
1691         (let.glob.0.doTest):
1692         * microbenchmarks/bit-test-load.js: Added.
1693         (let.glob.0.let.arr.new.Int32Array.8.doTest):
1694         (i):
1695         * microbenchmarks/bit-test-nonconstant.js: Added.
1696         (let.glob.0.doTest):
1697
1698 2019-07-26  Yusuke Suzuki  <ysuzuki@apple.com>
1699
1700         [JSC] Potential GC fix for JSPropertyNameEnumerator
1701         https://bugs.webkit.org/show_bug.cgi?id=200151
1702
1703         Reviewed by Mark Lam.
1704
1705         * stress/for-in-stress.js: Added.
1706         (keys):
1707
1708 2019-07-25  Ross Kirsling  <ross.kirsling@sony.com>
1709
1710         Legacy numeric literals should not permit separators or BigInt
1711         https://bugs.webkit.org/show_bug.cgi?id=199984
1712
1713         Reviewed by Keith Miller.
1714
1715         * stress/big-int-literals.js:
1716         * stress/numeric-literal-separators.js:
1717
1718 2019-07-25  Ross Kirsling  <ross.kirsling@sony.com>
1719
1720         [ESNext] Implement nullish coalescing
1721         https://bugs.webkit.org/show_bug.cgi?id=200072
1722
1723         Reviewed by Darin Adler.
1724
1725         * stress/nullish-coalescing.js: Added.
1726
1727 2019-07-24  Alexey Shvayka  <shvaikalesh@gmail.com>
1728
1729         Three checks are missing in Proxy internal methods
1730         https://bugs.webkit.org/show_bug.cgi?id=198630
1731
1732         Reviewed by Darin Adler.
1733
1734         * stress/proxy-delete.js: Assert isExtensible is called in correct order.
1735         * test262/expectations.yaml: Mark 6 test cases as passing.
1736
1737 2019-07-23  Justin Michaud  <justin_michaud@apple.com>
1738
1739         Sometimes we miss removable CheckInBounds
1740         https://bugs.webkit.org/show_bug.cgi?id=200018
1741
1742         Reviewed by Saam Barati.
1743
1744         * microbenchmarks/typed-array-sum.js: Added.
1745         (doTest):
1746
1747 2019-07-16  Mark Lam  <mark.lam@apple.com>
1748
1749         ArgumentsEliminationPhase should insert KillStack nodes before PutStack nodes that it adds.
1750         https://bugs.webkit.org/show_bug.cgi?id=199821
1751         <rdar://problem/52452328>
1752
1753         Reviewed by Filip Pizlo.
1754
1755         * stress/arguments-elimination-should-insert-KillStacks-before-added-PutStacks.js: Added.
1756
1757 2019-07-16  Keith Miller  <keith_miller@apple.com>
1758
1759         Unreviewed, test262 gardening.
1760
1761         * test262/expectations.yaml:
1762
1763 2019-07-15  Keith Miller  <keith_miller@apple.com>
1764
1765         A Possible Issue of Object.create method
1766         https://bugs.webkit.org/show_bug.cgi?id=199744
1767
1768         Reviewed by Yusuke Suzuki.
1769
1770         * stress/object-create-non-object-properties-parameter.js: Added.
1771         (catch):
1772
1773 2019-07-15  Keith Miller  <keith_miller@apple.com>
1774
1775         Update test262
1776         https://bugs.webkit.org/show_bug.cgi?id=199801
1777
1778         Rubber-stamped by Yusuke Suzuki.
1779
1780         * test262/expectations.yaml:
1781         * test262/latest-changes-summary.txt:
1782         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/Symbol.toStringTag.js: Added.
1783         (fg.new.FinalizationGroup):
1784         (callback):
1785         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-job-not-active-throws.js: Added.
1786         (fg.new.FinalizationGroup):
1787         (callback):
1788         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-length.js: Added.
1789         (fg.new.FinalizationGroup):
1790         (callback):
1791         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-missing-internal-throws.js: Added.
1792         (fg.new.FinalizationGroup):
1793         (callback):
1794         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-name.js: Added.
1795         (fg.new.FinalizationGroup):
1796         (callback):
1797         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-not-object-throws.js: Added.
1798         (fg.new.FinalizationGroup):
1799         (callback):
1800         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-prop-desc.js: Added.
1801         (fg.new.FinalizationGroup):
1802         (callback):
1803         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/proto.js: Added.
1804         (callback):
1805         (fg.new.FinalizationGroup):
1806         * test262/test/built-ins/FinalizationGroup/constructor.js: Added.
1807         * test262/test/built-ins/FinalizationGroup/gc-has-one-chance-to-call-cleanupCallback.js: Added.
1808         (cb):
1809         (fg.new.FinalizationGroup):
1810         (emptyCells):
1811         (async.fn):
1812         (fn.then.async):
1813         * test262/test/built-ins/FinalizationGroup/instance-extensible.js: Added.
1814         (fg.new.FinalizationGroup):
1815         * test262/test/built-ins/FinalizationGroup/length.js: Added.
1816         * test262/test/built-ins/FinalizationGroup/name.js: Added.
1817         * test262/test/built-ins/FinalizationGroup/newtarget-prototype-is-not-object.js: Added.
1818         (newTarget):
1819         (fn):
1820         * test262/test/built-ins/FinalizationGroup/prop-desc.js: Added.
1821         * test262/test/built-ins/FinalizationGroup/proto-from-ctor-realm.js: Added.
1822         (fn):
1823         * test262/test/built-ins/FinalizationGroup/proto.js: Added.
1824         * test262/test/built-ins/FinalizationGroup/prototype-from-newtarget-abrupt.js: Added.
1825         (newTarget):
1826         * test262/test/built-ins/FinalizationGroup/prototype-from-newtarget-custom.js: Added.
1827         (newTarget):
1828         * test262/test/built-ins/FinalizationGroup/prototype-from-newtarget.js: Added.
1829         (fg.new.FinalizationGroup):
1830         * test262/test/built-ins/FinalizationGroup/prototype/Symbol.toStringTag.js: Added.
1831         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/callback-iterator-proto.js: Added.
1832         (callback):
1833         (fg.new.FinalizationGroup):
1834         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/callback-not-callable-throws.js: Added.
1835         (fg.new.FinalizationGroup):
1836         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-prevented-with-reference.js: Added.
1837         (cb):
1838         (fg.new.FinalizationGroup):
1839         (emptyCells):
1840         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-prevented-with-unregister.js: Added.
1841         (fg.new.FinalizationGroup):
1842         (fg.cleanupSome.cb):
1843         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanupcallback-iterator-proto.js: Added.
1844         (callback):
1845         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/custom-this.js: Added.
1846         (fn):
1847         (cb):
1848         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/gc-cleanup-not-prevented-with-wr-deref.js: Added.
1849         (cb):
1850         (fg.new.FinalizationGroup):
1851         (emptyCells):
1852         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/iterator-dynamic.js: Added.
1853         (fg.new.FinalizationGroup):
1854         (callback):
1855         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/iterator-holdings-multiple-values.js: Added.
1856         (fg.new.FinalizationGroup):
1857         (callback):
1858         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/length.js: Added.
1859         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/name.js: Added.
1860         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/poisoned-callback-throws.js: Added.
1861         (poisoned):
1862         (fg.new.FinalizationGroup):
1863         (emptyCells):
1864         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/poisoned-cleanup-callback-throws.js: Added.
1865         (poisoned):
1866         (emptyCells):
1867         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/prop-desc.js: Added.
1868         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/return-undefined-with-gc.js: Added.
1869         (fn):
1870         (cb):
1871         (emptyCells):
1872         (prototype.assert.sameValue.fg.cleanupSome):
1873         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/return-undefined.js: Added.
1874         (fn):
1875         (cb):
1876         (poisoned):
1877         (assert.sameValue.fg.cleanupSome):
1878         (prototype.assert.sameValue.fg.cleanupSome):
1879         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/this-does-not-have-internal-cells-throws.js: Added.
1880         (cb):
1881         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/this-not-object-throws.js: Added.
1882         (cb):
1883         * test262/test/built-ins/FinalizationGroup/prototype/constructor.js: Added.
1884         * test262/test/built-ins/FinalizationGroup/prototype/prop-desc.js: Added.
1885         * test262/test/built-ins/FinalizationGroup/prototype/proto.js: Added.
1886         * test262/test/built-ins/FinalizationGroup/prototype/register/custom-this.js: Added.
1887         (fn):
1888         * test262/test/built-ins/FinalizationGroup/prototype/register/holdings-any-value-type.js: Added.
1889         (fn):
1890         * test262/test/built-ins/FinalizationGroup/prototype/register/holdings-same-as-target.js: Added.
1891         (fg.new.FinalizationGroup):
1892         * test262/test/built-ins/FinalizationGroup/prototype/register/length.js: Added.
1893         * test262/test/built-ins/FinalizationGroup/prototype/register/name.js: Added.
1894         * test262/test/built-ins/FinalizationGroup/prototype/register/prop-desc.js: Added.
1895         * test262/test/built-ins/FinalizationGroup/prototype/register/return-undefined-register-itself.js: Added.
1896         (fn):
1897         * test262/test/built-ins/FinalizationGroup/prototype/register/return-undefined.js: Added.
1898         (fn):
1899         * test262/test/built-ins/FinalizationGroup/prototype/register/target-not-object-throws.js: Added.
1900         (fg.new.FinalizationGroup):
1901         * test262/test/built-ins/FinalizationGroup/prototype/register/this-does-not-have-internal-target-throws.js: Added.
1902         * test262/test/built-ins/FinalizationGroup/prototype/register/this-not-object-throws.js: Added.
1903         * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-not-object-or-undefined-throws.js: Added.
1904         (fg.new.FinalizationGroup):
1905         * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-holdings-and-target.js: Added.
1906         (fg.new.FinalizationGroup):
1907         * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-holdings.js: Added.
1908         (fg.new.FinalizationGroup):
1909         * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-target.js: Added.
1910         (fg.new.FinalizationGroup):
1911         * test262/test/built-ins/FinalizationGroup/prototype/unregister/custom-this.js: Added.
1912         (fn):
1913         * test262/test/built-ins/FinalizationGroup/prototype/unregister/length.js: Added.
1914         * test262/test/built-ins/FinalizationGroup/prototype/unregister/name.js: Added.
1915         * test262/test/built-ins/FinalizationGroup/prototype/unregister/prop-desc.js: Added.
1916         * test262/test/built-ins/FinalizationGroup/prototype/unregister/this-does-not-have-internal-cells-throws.js: Added.
1917         * test262/test/built-ins/FinalizationGroup/prototype/unregister/this-not-object-throws.js: Added.
1918         * test262/test/built-ins/FinalizationGroup/prototype/unregister/unregister.js: Added.
1919         (fn):
1920         * test262/test/built-ins/FinalizationGroup/prototype/unregister/unregisterToken-not-object-throws.js: Added.
1921         (fg.new.FinalizationGroup):
1922         * test262/test/built-ins/FinalizationGroup/returns-new-object-from-constructor.js: Added.
1923         (cleanupCallback):
1924         (let.key.of.Object.getOwnPropertyNames):
1925         (set for):
1926         * test262/test/built-ins/FinalizationGroup/target-not-callable-throws.js: Added.
1927         * test262/test/built-ins/FinalizationGroup/undefined-newtarget-throws.js: Added.
1928         (FinalizationGroup):
1929         * test262/test/built-ins/FinalizationGroup/unnaffected-by-poisoned-cleanupCallback.js: Added.
1930         (cleanupCallback):
1931         (let.key.of.Object.getOwnPropertyNames):
1932         (set for):
1933         * test262/test/built-ins/Function/StrictFunction_restricted-properties.js:
1934         * test262/test/built-ins/Function/prototype/bind/BoundFunction_restricted-properties.js:
1935         * test262/test/built-ins/Function/prototype/restricted-property-arguments.js:
1936         * test262/test/built-ins/Function/prototype/restricted-property-caller.js:
1937         * test262/test/built-ins/Object/prototype/toString/proxy-function-async.js: Added.
1938         (asyncProxy.new.Proxy.async):
1939         * test262/test/built-ins/Object/prototype/toString/proxy-function.js:
1940         (asyncProxy.new.Proxy.async):
1941         * test262/test/built-ins/Object/prototype/toString/symbol-tag-non-str-builtin.js: Added.
1942         (setIter.set Symbol):
1943         (set defaultTag):
1944         (gen):
1945         (get return):
1946         (set new):
1947         * test262/test/built-ins/Object/prototype/toString/symbol-tag-non-str-proxy-function.js: Added.
1948         (generatorProxy.new.Proxy):
1949         (asyncProxy.new.Proxy.async):
1950         * test262/test/built-ins/Object/subclass-object-arg.js:
1951         * test262/test/built-ins/Promise/all/invoke-resolve-get-error-close.js:
1952         * test262/test/built-ins/Promise/all/resolve-element-function-name.js:
1953         * test262/test/built-ins/Promise/allSettled/invoke-resolve-get-error-close.js:
1954         * test262/test/built-ins/Promise/allSettled/reject-element-function-name.js:
1955         * test262/test/built-ins/Promise/allSettled/resolve-element-function-name.js:
1956         * test262/test/built-ins/Promise/executor-function-name.js:
1957         * test262/test/built-ins/Promise/race/invoke-resolve-get-error-close.js:
1958         * test262/test/built-ins/Promise/reject-function-name.js:
1959         * test262/test/built-ins/Promise/resolve-function-name.js:
1960         * test262/test/built-ins/Set/prototype/values/does-not-have-setdata-internal-slot-weakset.js:
1961         * test262/test/built-ins/WeakRef/constructor.js: Added.
1962         * test262/test/built-ins/WeakRef/instance-extensible.js: Added.
1963         * test262/test/built-ins/WeakRef/length.js: Added.
1964         * test262/test/built-ins/WeakRef/name.js: Added.
1965         * test262/test/built-ins/WeakRef/newtarget-prototype-is-not-object.js: Added.
1966         (newTarget):
1967         * test262/test/built-ins/WeakRef/prop-desc.js: Added.
1968         * test262/test/built-ins/WeakRef/proto-from-ctor-realm.js: Added.
1969         * test262/test/built-ins/WeakRef/proto.js: Added.
1970         * test262/test/built-ins/WeakRef/prototype-from-newtarget-abrupt.js: Added.
1971         (newTarget):
1972         * test262/test/built-ins/WeakRef/prototype-from-newtarget-custom.js: Added.
1973         (newTarget):
1974         * test262/test/built-ins/WeakRef/prototype-from-newtarget.js: Added.
1975         * test262/test/built-ins/WeakRef/prototype/Symbol.toStringTag.js: Added.
1976         * test262/test/built-ins/WeakRef/prototype/constructor.js: Added.
1977         * test262/test/built-ins/WeakRef/prototype/deref/custom-this.js: Added.
1978         * test262/test/built-ins/WeakRef/prototype/deref/gc-cleanup-not-prevented-with-wr-deref.js: Added.
1979         (emptyCells):
1980         * test262/test/built-ins/WeakRef/prototype/deref/length.js: Added.
1981         * test262/test/built-ins/WeakRef/prototype/deref/name.js: Added.
1982         * test262/test/built-ins/WeakRef/prototype/deref/prop-desc.js: Added.
1983         * test262/test/built-ins/WeakRef/prototype/deref/return-target.js: Added.
1984         * test262/test/built-ins/WeakRef/prototype/deref/this-does-not-have-internal-target-throws.js: Added.
1985         (fg.new.FinalizationGroup):
1986         * test262/test/built-ins/WeakRef/prototype/deref/this-not-object-throws.js: Added.
1987         * test262/test/built-ins/WeakRef/prototype/prop-desc.js: Added.
1988         * test262/test/built-ins/WeakRef/prototype/proto.js: Added.
1989         * test262/test/built-ins/WeakRef/returns-new-object-from-constructor.js: Added.
1990         (let.key.of.Object.getOwnPropertyNames):
1991         (set for):
1992         * test262/test/built-ins/WeakRef/target-not-object-throws.js: Added.
1993         * test262/test/built-ins/WeakRef/undefined-newtarget-throws.js: Added.
1994         * test262/test/intl402/BigInt/prototype/toLocaleString/builtin.js:
1995         * test262/test/intl402/BigInt/prototype/toLocaleString/default-options-object-prototype.js:
1996         * test262/test/intl402/BigInt/prototype/toLocaleString/length.js:
1997         * test262/test/intl402/BigInt/prototype/toLocaleString/returns-same-results-as-NumberFormat.js:
1998         * test262/test/intl402/BigInt/prototype/toLocaleString/taint-Intl-NumberFormat.js:
1999         * test262/test/intl402/BigInt/prototype/toLocaleString/this-value-invalid.js:
2000         * test262/test/intl402/BigInt/prototype/toLocaleString/throws-same-exceptions-as-NumberFormat.js:
2001         * test262/test/intl402/DateTimeFormat/constructor-options-order-quarter.js: Removed.
2002         * test262/test/intl402/DateTimeFormat/constructor-options-quarter-invalid.js: Removed.
2003         * test262/test/intl402/DateTimeFormat/constructor-options-quarter-valid.js: Removed.
2004         * test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-long-en.js: Added.
2005         * test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-narrow-en.js: Added.
2006         * test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-short-en.js: Added.
2007         * test262/test/intl402/DateTimeFormat/prototype/format/fractionalSecondDigits.js: Added.
2008         * test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-date-string.js:
2009         * test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-near-time-boundaries.js:
2010         * test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-to-integer.js:
2011         * test262/test/intl402/DateTimeFormat/prototype/formatRange/builtin.js:
2012         * test262/test/intl402/DateTimeFormat/prototype/formatRange/prop-desc.js:
2013         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-date-string.js:
2014         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-near-time-boundaries.js:
2015         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-to-integer.js:
2016         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/builtin.js:
2017         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/prop-desc.js:
2018         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-long-en.js: Added.
2019         (assertParts):
2020         (assertPartsNumeric):
2021         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-narrow-en.js: Added.
2022         (assertParts):
2023         (assertPartsNumeric):
2024         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-short-en.js: Added.
2025         (assertParts):
2026         (assertPartsNumeric):
2027         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/fractionalSecondDigits.js: Added.
2028         (assertParts):
2029         * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/order-quarter.js: Removed.
2030         * test262/test/intl402/DateTimeFormat/taint-Object-prototype-quarter.js: Removed.
2031         * test262/test/intl402/RelativeTimeFormat/prototype/format/en-us-numeric-auto.js:
2032         * test262/test/intl402/RelativeTimeFormat/prototype/formatToParts/en-us-numeric-auto.js:
2033         * test262/test/language/expressions/arrow-function/ArrowFunction_restricted-properties.js:
2034         * test262/test/language/expressions/class/elements/private-field-access-on-inner-arrow-function.js: Added.
2035         (C.prototype.method):
2036         * test262/test/language/expressions/class/elements/private-field-access-on-inner-function.js: Added.
2037         (C.prototype.method.innerFunction):
2038         (C.prototype.method):
2039         * test262/test/language/expressions/class/elements/private-getter-access-on-inner-arrow-function.js: Added.
2040         (C):
2041         (C.method):
2042         * test262/test/language/expressions/class/elements/private-getter-access-on-inner-function.js: Added.
2043         (C):
2044         (C.method.innerFunction):
2045         (C.method):
2046         * test262/test/language/expressions/class/elements/private-getter-is-not-a-own-property.js: Added.
2047         (C):
2048         (C.checkPrivateGetter):
2049         * test262/test/language/expressions/class/elements/private-method-access-on-inner-arrow-function.js: Added.
2050         (C):
2051         (C.method):
2052         * test262/test/language/expressions/class/elements/private-method-access-on-inner-function.js: Added.
2053         (C):
2054         (C.method.innerFunction):
2055         (C.method):
2056         * test262/test/language/expressions/class/elements/private-method-is-not-a-own-property.js: Added.
2057         (C):
2058         (C.checkPrivateMethod):
2059         * test262/test/language/expressions/class/elements/private-setter-access-on-inner-arrow-function.js: Added.
2060         (C):
2061         (C.method):
2062         * test262/test/language/expressions/class/elements/private-setter-access-on-inner-function.js: Added.
2063         (C):
2064         (C.method.innerFunction):
2065         (C.method):
2066         * test262/test/language/expressions/class/elements/private-setter-is-not-a-own-property.js: Added.
2067         (C):
2068         (C.checkPrivateSetter):
2069         * test262/test/language/expressions/class/elements/prod-private-getter-before-super-return-in-field-initializer.js:
2070         * test262/test/language/expressions/class/elements/prod-private-method-before-super-return-in-field-initializer.js:
2071         * test262/test/language/expressions/class/elements/prod-private-setter-before-super-return-in-field-initializer.js:
2072         * test262/test/language/expressions/class/poisoned-underscore-proto.js: Added.
2073         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2074         (let.classStringExpression):
2075         (let.classStringExpression.access):
2076         (let.createAndInstantiateClass):
2077         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2078         (let.classStringExpression):
2079         (let.classStringExpression.access):
2080         (let.createAndInstantiateClass):
2081         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2082         (const.C):
2083         (let.createAndInstantiateClass):
2084         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2085         (let.classStringExpression.return.prototype.m):
2086         (let.classStringExpression.return.prototype.access):
2087         (let.createAndInstantiateClass):
2088         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2089         (let.classStringExpression.return.prototype.m):
2090         (let.classStringExpression.return.prototype.access):
2091         (let.createAndInstantiateClass):
2092         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2093         (let.classStringExpression):
2094         (let.classStringExpression.access):
2095         (let.createAndInstantiateClass):
2096         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2097         (let.classStringExpression.prototype.m):
2098         (let.classStringExpression.prototype.access):
2099         (let.classStringExpression):
2100         (let.createAndInstantiateClass):
2101         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2102         (let.classStringExpression.prototype.m):
2103         (let.classStringExpression.prototype.access):
2104         (let.classStringExpression):
2105         (let.createAndInstantiateClass):
2106         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2107         (const.C):
2108         (let.createAndInstantiateClass):
2109         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2110         (let.classStringExpression.return.C.prototype.m):
2111         (let.classStringExpression.return.C.prototype.access):
2112         (let.classStringExpression.return.C):
2113         (let.createAndInstantiateClass):
2114         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2115         (let.classStringExpression.return.C.prototype.m):
2116         (let.classStringExpression.return.C.prototype.access):
2117         (let.classStringExpression.return.C):
2118         (let.createAndInstantiateClass):
2119         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2120         (let.classStringExpression):
2121         (let.classStringExpression.access):
2122         (let.createAndInstantiateClass):
2123         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2124         (let.classStringExpression):
2125         (let.classStringExpression.access):
2126         (let.createAndInstantiateClass):
2127         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2128         (let.classStringExpression):
2129         (let.classStringExpression.access):
2130         (let.createAndInstantiateClass):
2131         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2132         (const.C):
2133         (let.createAndInstantiateClass):
2134         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2135         (let.classStringExpression.return.prototype.m):
2136         (let.classStringExpression.return.prototype.access):
2137         (let.createAndInstantiateClass):
2138         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2139         (let.classStringExpression.return.prototype.m):
2140         (let.classStringExpression.return.prototype.access):
2141         (let.createAndInstantiateClass):
2142         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2143         (let.classStringExpression):
2144         (let.classStringExpression.access):
2145         (let.createAndInstantiateClass):
2146         * test262/test/language/expressions/new.target/unary-expr.js: Added.
2147         (new):
2148         (async):
2149         * test262/test/language/expressions/super/call-poisoned-underscore-proto.js: Added.
2150         (A):
2151         * test262/test/language/expressions/super/prop-poisoned-underscore-proto.js: Added.
2152         * test262/test/language/identifiers/vals-cjk-escaped.js: Added.
2153         * test262/test/language/identifiers/vals-cjk.js: Added.
2154         * test262/test/language/statements/class/elements/private-class-field-on-frozen-objects.js:
2155         * test262/test/language/statements/class/elements/private-field-access-on-inner-arrow-function.js: Added.
2156         (C.prototype.method):
2157         (C):
2158         * test262/test/language/statements/class/elements/private-field-access-on-inner-function.js: Added.
2159         (C.prototype.method.innerFunction):
2160         (C.prototype.method):
2161         (C):
2162         * test262/test/language/statements/class/elements/private-field-is-not-clobbered-by-computed-property.js: Added.
2163         (C.prototype.checkPrivateField):
2164         (C):
2165         * test262/test/language/statements/class/elements/private-field-visible-to-direct-eval-on-initializer.js: Added.
2166         (C):
2167         * test262/test/language/statements/class/elements/private-field-visible-to-direct-eval.js: Added.
2168         (C.prototype.getWithEval):
2169         (C):
2170         (D):
2171         * test262/test/language/statements/class/elements/private-getter-access-on-inner-arrow-function.js: Added.
2172         (C.prototype.get m):
2173         (C.prototype.method):
2174         (C):
2175         * test262/test/language/statements/class/elements/private-getter-access-on-inner-function.js: Added.
2176         (C.prototype.get m):
2177         (C.prototype.method.innerFunction):
2178         (C.prototype.method):
2179         (C):
2180         * test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js:
2181         (let.createAndInstantiateClass):
2182         * test262/test/language/statements/class/elements/private-getter-is-not-a-own-property.js: Added.
2183         (C.prototype.get m):
2184         (C.prototype.checkPrivateGetter):
2185         (C):
2186         * test262/test/language/statements/class/elements/private-getter-is-not-clobbered-by-computed-property.js: Added.
2187         (C.prototype.get m):
2188         (C.prototype.checkPrivateGetter):
2189         (C):
2190         * test262/test/language/statements/class/elements/private-getter-visible-to-direct-eval-on-initializer.js: Added.
2191         (C.prototype.get m):
2192         (C):
2193         * test262/test/language/statements/class/elements/private-getter-visible-to-direct-eval.js: Added.
2194         (C.prototype.get m):
2195         (C.prototype.getWithEval):
2196         (C):
2197         (D.prototype.get m):
2198         (D):
2199         * test262/test/language/statements/class/elements/private-method-access-on-inner-arrow-function.js: Added.
2200         (C.prototype.m):
2201         (C.prototype.method):
2202         (C):
2203         * test262/test/language/statements/class/elements/private-method-access-on-inner-function.js: Added.
2204         (C.prototype.m):
2205         (C.prototype.method.innerFunction):
2206         (C.prototype.method):
2207         (C):
2208         * test262/test/language/statements/class/elements/private-method-is-not-a-own-property.js: Added.
2209         (C.prototype.m):
2210         (C.prototype.checkPrivateMethod):
2211         (C):
2212         * test262/test/language/statements/class/elements/private-method-is-not-clobbered-by-computed-property.js: Added.
2213         (C.prototype.m):
2214         (C.prototype.checkPrivateMethod):
2215         (C):
2216         * test262/test/language/statements/class/elements/private-method-visible-to-direct-eval-on-initializer.js: Added.
2217         (C.prototype.m):
2218         (C):
2219         * test262/test/language/statements/class/elements/private-method-visible-to-direct-eval.js: Added.
2220         (C.prototype.m):
2221         (C.prototype.getWithEval):
2222         (C):
2223         (D.prototype.m):
2224         (D):
2225         * test262/test/language/statements/class/elements/private-setter-access-on-inner-arrow-function.js: Added.
2226         (C.prototype.set m):
2227         (C.prototype.method):
2228         (C):
2229         * test262/test/language/statements/class/elements/private-setter-access-on-inner-function.js: Added.
2230         (C.prototype.set m):
2231         (C.prototype.method.innerFunction):
2232         (C.prototype.method):
2233         (C):
2234         * test262/test/language/statements/class/elements/private-setter-is-not-a-own-property.js: Added.
2235         (C.prototype.set m):
2236         (C.prototype.checkPrivateSetter):
2237         (C):
2238         * test262/test/language/statements/class/elements/private-setter-is-not-clobbered-by-computed-property.js: Added.
2239         (C.prototype.set m):
2240         (C.prototype.checkPrivateSetter):
2241         (C):
2242         * test262/test/language/statements/class/elements/private-setter-visible-to-direct-eval-on-initializer.js: Added.
2243         (C.prototype.set m):
2244         (C):
2245         * test262/test/language/statements/class/elements/private-setter-visible-to-direct-eval.js: Added.
2246         (C.prototype.set m):
2247         (C.prototype.setWithEval):
2248         (C):
2249         (D.prototype.set m):
2250         (D):
2251         * test262/test/language/statements/class/elements/prod-private-getter-before-super-return-in-field-initializer.js:
2252         * test262/test/language/statements/class/elements/prod-private-method-before-super-return-in-field-initializer.js:
2253         * test262/test/language/statements/class/elements/prod-private-setter-before-super-return-in-field-initializer.js:
2254         * test262/test/language/statements/class/elements/super-access-inside-a-private-getter.js: Added.
2255         (A.prototype.method):
2256         (A):
2257         (C.prototype.get m):
2258         (C.prototype.access):
2259         (C):
2260         * test262/test/language/statements/class/elements/super-access-inside-a-private-method.js: Added.
2261         (A.prototype.method):
2262         (A):
2263         (C.prototype.m):
2264         (C.prototype.access):
2265         (C):
2266         * test262/test/language/statements/class/elements/super-access-inside-a-private-setter.js: Added.
2267         (A.prototype.method):
2268         (A):
2269         (C.prototype.set m):
2270         (C.prototype.access):
2271         (C):
2272         * test262/test/language/statements/class/poisoned-underscore-proto.js: Added.
2273         (A):
2274         * test262/test/language/statements/function/13.2-30-s.js:
2275         * test262/test262-Revision.txt:
2276
2277 2019-07-15  Yusuke Suzuki  <ysuzuki@apple.com>
2278
2279         [JSC] Improve wasm wpt test results by fixing miscellaneous issues
2280         https://bugs.webkit.org/show_bug.cgi?id=199783
2281
2282         Reviewed by Mark Lam.
2283
2284         Fix our spec tests.
2285
2286         * wasm/js-api/Module-compile.js:
2287         * wasm/js-api/test_basic_api.js:
2288         (const.c.in.constructorProperties.switch):
2289         * wasm/js-api/validate.js:
2290         * wasm/js-api/web-assembly-instantiate.js:
2291         * wasm/spec-tests/jsapi.js:
2292         (testJSAPI.get test):
2293         (testJSAPI.set test):
2294
2295 2019-07-15  Michael Catanzaro  <mcatanzaro@igalia.com>
2296
2297         Unreviewed, rolling out r247440.
2298
2299         Broke builds
2300
2301         Reverted changeset:
2302
2303         "[JSC] Improve wasm wpt test results by fixing miscellaneous
2304         issues"
2305         https://bugs.webkit.org/show_bug.cgi?id=199783
2306         https://trac.webkit.org/changeset/247440
2307
2308 2019-07-15  Yusuke Suzuki  <ysuzuki@apple.com>
2309
2310         [JSC] Improve wasm wpt test results by fixing miscellaneous issues
2311         https://bugs.webkit.org/show_bug.cgi?id=199783
2312
2313         Reviewed by Mark Lam.
2314
2315         Fix our spec tests.
2316
2317         * wasm/js-api/Module-compile.js:
2318         * wasm/js-api/test_basic_api.js:
2319         (const.c.in.constructorProperties.switch):
2320         * wasm/js-api/validate.js:
2321         * wasm/js-api/web-assembly-instantiate.js:
2322         * wasm/spec-tests/jsapi.js:
2323         (testJSAPI.get test):
2324         (testJSAPI.set test):
2325
2326 2019-07-12  Justin Michaud  <justin_michaud@apple.com>
2327
2328         B3 should reduce (integer) Sub(Neg(x), y) to Neg(Add(x, y))
2329         https://bugs.webkit.org/show_bug.cgi?id=196371
2330
2331         Reviewed by Keith Miller.
2332
2333         * microbenchmarks/mul-immediate-sub.js: Added.
2334         (doTest):
2335
2336 2019-07-12  Caio Lima  <ticaiolima@gmail.com>
2337
2338         [BigInt] Add ValueBitLShift into DFG
2339         https://bugs.webkit.org/show_bug.cgi?id=192664
2340
2341         Reviewed by Saam Barati.
2342
2343         We are adding tests to cover ValueBitwise operations AI changes.
2344
2345         * stress/big-int-left-shift-untyped.js: Added.
2346         * stress/bit-op-with-object-returning-int32.js:
2347         * stress/value-bit-and-ai-rule.js: Added.
2348         * stress/value-bit-lshift-ai-rule.js: Added.
2349         * stress/value-bit-or-ai-rule.js: Added.
2350         * stress/value-bit-xor-ai-rule.js: Added.
2351
2352 2019-07-11  Justin Michaud  <justin_michaud@apple.com>
2353
2354         Add b3 macro lowering for CheckMul on arm64
2355         https://bugs.webkit.org/show_bug.cgi?id=199251
2356
2357         Reviewed by Robin Morisset.
2358
2359         * microbenchmarks/check-mul-constant.js: Added.
2360         (doTest):
2361         * microbenchmarks/check-mul-no-constant.js: Added.
2362         (doTest):
2363         * microbenchmarks/check-mul-power-of-two.js: Added.
2364         (doTest):
2365
2366 2019-07-10  Tadeu Zagallo  <tzagallo@apple.com>
2367
2368         Optimize join of large empty arrays
2369         https://bugs.webkit.org/show_bug.cgi?id=199636
2370
2371         Reviewed by Mark Lam.
2372
2373         * microbenchmarks/large-empty-array-join.js: Added.
2374         * microbenchmarks/large-empty-array-join-resolve-rope.js: Added.
2375
2376 2019-07-06  Michael Saboff  <msaboff@apple.com>
2377
2378         switch(String) needs to check for exceptions when resolving the string
2379         https://bugs.webkit.org/show_bug.cgi?id=199541
2380
2381         Reviewed by Mark Lam.
2382
2383         New tests.
2384
2385         * stress/switch-string-oom.js: Added.
2386         (test):
2387         (testLowerTiers):
2388         (testFTL):
2389
2390 2019-07-05  Mark Lam  <mark.lam@apple.com>
2391
2392         ArgumentsEliminationPhase::eliminateCandidatesThatInterfere() should not decrement nodeIndex pass zero.
2393         https://bugs.webkit.org/show_bug.cgi?id=199533
2394         <rdar://problem/52669111>
2395
2396         Reviewed by Filip Pizlo.
2397
2398         * stress/ArgumentsEliminationPhase-eliminateCandidatesThatEscape-should-not-decrement-nodeIndex-pass-zero.js: Added.
2399
2400 2019-07-05  Alexey Shvayka  <shvaikalesh@gmail.com>
2401
2402         [JSC] Clean up ArraySpeciesCreate
2403         https://bugs.webkit.org/show_bug.cgi?id=182434
2404
2405         Reviewed by Yusuke Suzuki.
2406
2407         Adjusts error message expectations in stress tests.
2408
2409         * stress/array-flatmap.js:
2410         * stress/array-flatten.js:
2411         * stress/array-species-create-should-handle-masquerader.js:
2412         * test262/expectations.yaml: Mark 4 test cases as passing.
2413
2414 2019-07-02  Michael Saboff  <msaboff@apple.com>
2415
2416         Exception from For..of loop assignment eliminates TDZ checks in subsequent code
2417         https://bugs.webkit.org/show_bug.cgi?id=199395
2418
2419         Reviewed by Filip Pizlo.
2420
2421         New regession test.
2422
2423         * stress/for-of-tdz-with-try-catch.js: Added.
2424         (test):
2425         (i.catch):
2426
2427 2019-07-02  Keith Miller  <keith_miller@apple.com>
2428
2429         Frozen Arrays length assignment should throw in strict mode
2430         https://bugs.webkit.org/show_bug.cgi?id=199365
2431
2432         Reviewed by Yusuke Suzuki.
2433
2434         * stress/frozen-array-length-should-throw-strict.js: Added.
2435         (test):
2436
2437 2019-07-01  Justin Michaud  <justin_michaud@apple.com>
2438
2439         [Wasm-References] Disable references by default
2440         https://bugs.webkit.org/show_bug.cgi?id=199390
2441
2442         Reviewed by Saam Barati.
2443
2444         * wasm/references-spec-tests/ref_is_null.js:
2445         * wasm/references-spec-tests/ref_null.js:
2446         * wasm/references/anyref_globals.js:
2447         * wasm/references/anyref_modules.js:
2448         * wasm/references/anyref_table.js:
2449         * wasm/references/anyref_table_import.js:
2450         * wasm/references/element_parsing.js:
2451         * wasm/references/func_ref.js:
2452         * wasm/references/is_null.js:
2453         * wasm/references/multitable.js:
2454         * wasm/references/table_misc.js:
2455         * wasm/references/validation.js:
2456
2457 2019-07-01  Ryan Haddad  <ryanhaddad@apple.com>
2458
2459         Unreviewed, rolling out r246946.
2460
2461         Caused JSC test crashes on arm64
2462
2463         Reverted changeset:
2464
2465         "Add b3 macro lowering for CheckMul on arm64"
2466         https://bugs.webkit.org/show_bug.cgi?id=199251
2467         https://trac.webkit.org/changeset/246946
2468
2469 2019-06-28  Justin Michaud  <justin_michaud@apple.com>
2470
2471         Add b3 macro lowering for CheckMul on arm64
2472         https://bugs.webkit.org/show_bug.cgi?id=199251
2473
2474         Reviewed by Robin Morisset.
2475
2476         * microbenchmarks/check-mul-constant.js: Added.
2477         (doTest):
2478         * microbenchmarks/check-mul-no-constant.js: Added.
2479         (doTest):
2480         * microbenchmarks/check-mul-power-of-two.js: Added.
2481         (doTest):
2482
2483 2019-06-26  Keith Miller  <keith_miller@apple.com>
2484
2485         speciesConstruct needs to throw if the result is a DataView
2486         https://bugs.webkit.org/show_bug.cgi?id=199231
2487
2488         Reviewed by Mark Lam.
2489
2490         * stress/typedarray-filter.js:
2491         (subclasses.forEach):
2492         * stress/typedarray-map.js:
2493         (subclasses.forEach):
2494         * stress/typedarray-slice.js:
2495         (typedArrays.forEach):
2496         * stress/typedarray-subarray.js:
2497         (subclasses.forEach):
2498
2499 2019-06-24  Commit Queue  <commit-queue@webkit.org>
2500
2501         Unreviewed, rolling out r246714.
2502         https://bugs.webkit.org/show_bug.cgi?id=199179
2503
2504         revert to do patch in a different way. (Requested by keith_mi_
2505         on #webkit).
2506
2507         Reverted changeset:
2508
2509         "All prototypes should call didBecomePrototype()"
2510         https://bugs.webkit.org/show_bug.cgi?id=196315
2511         https://trac.webkit.org/changeset/246714
2512
2513 2019-06-24  Alexey Shvayka  <shvaikalesh@gmail.com>
2514
2515         Add Array.prototype.{flat,flatMap} to unscopables
2516         https://bugs.webkit.org/show_bug.cgi?id=194322
2517
2518         Reviewed by Keith Miller.
2519
2520         * stress/unscopables.js: Fix test.
2521         * test262/expectations.yaml: Mark 2 test cases as passing.
2522
2523 2019-06-21  Mark Lam  <mark.lam@apple.com>
2524
2525         ArraySlice needs to keep the source array alive.
2526         https://bugs.webkit.org/show_bug.cgi?id=197374
2527         <rdar://problem/50304429>
2528
2529         Reviewed by Michael Saboff and Filip Pizlo.
2530
2531         * stress/array-slice-must-keep-source-array-alive.js: Added.
2532
2533 2019-06-22  Robin Morisset  <rmorisset@apple.com> and Yusuke Suzuki  <ysuzuki@apple.com>
2534
2535         All prototypes should call didBecomePrototype()
2536         https://bugs.webkit.org/show_bug.cgi?id=196315
2537
2538         Reviewed by Saam Barati.
2539
2540         * stress/function-prototype-indexed-accessor.js: Added.
2541
2542 2019-06-22  Yusuke Suzuki  <ysuzuki@apple.com>
2543
2544         [JSC] Strict, Sloppy and Arrow functions should have different classInfo
2545         https://bugs.webkit.org/show_bug.cgi?id=197631
2546
2547         Reviewed by Saam Barati.
2548
2549         * stress/has-own-property-arguments.js: Added.
2550         (shouldBe):
2551         (A):
2552
2553 2019-06-22  Yusuke Suzuki  <ysuzuki@apple.com>
2554
2555         [JSC] ClassExpr should not store result in the middle of evaluation
2556         https://bugs.webkit.org/show_bug.cgi?id=199106
2557
2558         Reviewed by Tadeu Zagallo.
2559
2560         * stress/class-expression-should-store-result-at-last.js: Added.
2561         (shouldThrow):
2562         (shouldThrow.let.a):
2563
2564 2019-06-20  Justin Michaud  <justin_michaud@apple.com>
2565
2566         [WASM-References] Add extra tests for Wasm references + fix element parsing and subtyping bugs
2567         https://bugs.webkit.org/show_bug.cgi?id=199044
2568
2569         Reviewed by Saam Barati.
2570
2571         Add wasm references spec tests as well as a worker test.
2572
2573         * wasm.yaml:
2574         * wasm/Builder_WebAssemblyBinary.js:
2575         (const.emitters.Element):
2576         * wasm/js-api/element.js:
2577         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
2578         * wasm/references-spec-tests/ref_is_null.js: Added.
2579         (hostref):
2580         (is_hostref):
2581         (is_funcref):
2582         (eq_ref):
2583         (let.handler.get target):
2584         (register):
2585         (module):
2586         (instance):
2587         (call):
2588         (get instance):
2589         (exports):
2590         (run):
2591         (assert_malformed):
2592         (assert_invalid):
2593         (assert_unlinkable):
2594         (assert_uninstantiable):
2595         (assert_trap):
2596         (try.f):
2597         (catch):
2598         (assert_exhaustion):
2599         (assert_return):
2600         (assert_return_canonical_nan):
2601         (assert_return_arithmetic_nan):
2602         (assert_return_ref):
2603         (assert_return_func):
2604         * wasm/references-spec-tests/ref_null.js: Added.
2605         (hostref):
2606         (is_hostref):
2607         (is_funcref):
2608         (eq_ref):
2609         (let.handler.get target):
2610         (register):
2611         (module):
2612         (instance):
2613         (call):
2614         (get instance):
2615         (exports):
2616         (run):
2617         (assert_malformed):
2618         (assert_invalid):
2619         (assert_unlinkable):
2620         (assert_uninstantiable):
2621         (assert_trap):
2622         (try.f):
2623         (catch):
2624         (assert_exhaustion):
2625         (assert_return):
2626         (assert_return_canonical_nan):
2627         (assert_return_arithmetic_nan):
2628         (assert_return_ref):
2629         (assert_return_func):
2630         * wasm/references/element_parsing.js: Added.
2631         (module):
2632         * wasm/references/func_ref.js:
2633         * wasm/references/multitable.js:
2634         * wasm/references/table_misc.js:
2635         (TableSize.0.End.End.WebAssembly):
2636         * wasm/references/validation.js:
2637         (assert.throws):
2638
2639 2019-06-19  Alexey Shvayka  <shvaikalesh@gmail.com>
2640
2641         Optimize `resolve` method lookup in Promise static methods
2642         https://bugs.webkit.org/show_bug.cgi?id=198864
2643
2644         Reviewed by Yusuke Suzuki.
2645
2646         * test262/expectations.yaml: Mark 18 test cases as passing.
2647
2648 2019-06-19  Justin Michaud  <justin_michaud@apple.com>
2649
2650         [WASM-References] Rename anyfunc to funcref
2651         https://bugs.webkit.org/show_bug.cgi?id=198983
2652
2653         Reviewed by Yusuke Suzuki.
2654
2655         * wasm/function-tests/basic-element.js:
2656         * wasm/function-tests/context-switch.js:
2657         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2658         (makeInstance):
2659         (assert.eq.makeInstance):
2660         * wasm/function-tests/exceptions.js:
2661         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2662         * wasm/function-tests/grow-memory-2.js:
2663         (assert.eq.instance.exports.foo):
2664         * wasm/function-tests/nameSection.js:
2665         (const.compile):
2666         * wasm/function-tests/stack-overflow.js:
2667         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2668         (assertOverflows.makeInstance):
2669         * wasm/function-tests/table-basic-2.js:
2670         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2671         * wasm/function-tests/table-basic.js:
2672         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2673         * wasm/function-tests/trap-from-start-async.js:
2674         * wasm/function-tests/trap-from-start.js:
2675         * wasm/js-api/Module.exports.js:
2676         (assert.truthy):
2677         * wasm/js-api/Module.imports.js:
2678         (assert.truthy):
2679         * wasm/js-api/call-indirect.js:
2680         (const.oneTable):
2681         (const.multiTable):
2682         (multiTable.const.makeTable):
2683         (multiTable):
2684         (multiTable.Polyphic2Import):
2685         (multiTable.VirtualImport):
2686         * wasm/js-api/element-data.js:
2687         * wasm/js-api/element.js:
2688         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
2689         (assert.throws):
2690         (badInstantiation.makeModule):
2691         (badInstantiation.test):
2692         (badInstantiation):
2693         * wasm/js-api/extension-MemoryMode.js:
2694         * wasm/js-api/table.js:
2695         (new.WebAssembly.Module):
2696         (assert.throws):
2697         (assertBadTableImport):
2698         (assert.throws.WebAssembly.Table.prototype.grow):
2699         (new.WebAssembly.Table):
2700         (assertBadTable):
2701         (assert.truthy):
2702         * wasm/js-api/test_basic_api.js:
2703         (const.c.in.constructorProperties.switch):
2704         * wasm/js-api/unique-signature.js:
2705         (CallIndirectWithDuplicateSignatures):
2706         * wasm/js-api/wrapper-function.js:
2707         * wasm/modules/table.wat:
2708         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat:
2709         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat:
2710         * wasm/modules/wasm-imports-wasm-exports/imports.wat:
2711         * wasm/modules/wasm-imports-wasm-exports/sum.wat:
2712         * wasm/references/anyref_table.js:
2713         * wasm/references/anyref_table_import.js:
2714         (doSet):
2715         (assert.throws):
2716         * wasm/references/func_ref.js:
2717         (makeFuncrefIdent):
2718         (assert.eq.instance.exports.fix):
2719         (GetLocal.0.I32Const.0.TableSet.0.End.End.WebAssembly.assert.throws):
2720         (GetLocal.0.I32Const.0.TableSet.0.End.End.WebAssembly):
2721         (let.importedFun.of):
2722         (makeAnyfuncIdent): Deleted.
2723         (makeAnyfuncIdent.fun): Deleted.
2724         * wasm/references/multitable.js:
2725         (assert.eq):
2726         (assert.throws):
2727         * wasm/references/table_misc.js:
2728         (GetLocal.0.TableFill.0.End.End.WebAssembly):
2729         * wasm/references/validation.js:
2730         (assert.throws.new.WebAssembly.Module.bin):
2731         (assert.throws):
2732         * wasm/spec-harness/index.js:
2733         * wasm/spec-harness/wasm-constants.js:
2734         * wasm/spec-harness/wasm-module-builder.js:
2735         (WasmModuleBuilder.prototype.toArray):
2736         * wasm/spec-harness/wast.js:
2737         (elem_type):
2738         (string_of_elem_type):
2739         (string_of_table_type):
2740         * wasm/spec-tests/jsapi.js:
2741         * wasm/stress/wasm-table-grow-initialize.js:
2742         * wasm/wasm.json:
2743
2744 2019-06-18  Justin Michaud  <justin_michaud@apple.com>
2745
2746         [WASM-References] Add support for Table.size, grow and fill instructions
2747         https://bugs.webkit.org/show_bug.cgi?id=198761
2748
2749         Reviewed by Yusuke Suzuki.
2750
2751         * wasm/Builder_WebAssemblyBinary.js:
2752         (const.putOp):
2753         * wasm/references/table_misc.js: Added.
2754         (TableSize.End.End.WebAssembly):
2755         (GetLocal.0.GetLocal.1.TableGrow.End.End.WebAssembly):
2756         * wasm/wasm.json:
2757
2758 2019-06-18  Justin Michaud  <justin_michaud@apple.com>
2759
2760         [WASM-References] Add support for multiple tables
2761         https://bugs.webkit.org/show_bug.cgi?id=198760
2762
2763         Reviewed by Saam Barati.
2764
2765         * wasm/Builder.js:
2766         * wasm/js-api/call-indirect.js:
2767         (const.oneTable):
2768         (const.multiTable):
2769         (multiTable):
2770         (multiTable.Polyphic2Import):
2771         (multiTable.VirtualImport):
2772         (const.wasmModuleWhichImportJS): Deleted.
2773         (const.makeTable): Deleted.
2774         (): Deleted.
2775         (Polyphic2Import): Deleted.
2776         (VirtualImport): Deleted.
2777         * wasm/js-api/table.js:
2778         (new.WebAssembly.Module):
2779         (assert.throws):
2780         (assertBadTableImport):
2781         (assert.truthy):
2782         (assert.throws.new.WebAssembly.Module.builder.WebAssembly): Deleted.
2783         * wasm/references/anyref_table.js:
2784         * wasm/references/anyref_table_import.js:
2785         (makeImport):
2786         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport):
2787         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl):
2788         * wasm/references/multitable.js: Added.
2789         (assert.throws.1.exports.set_tbl0):
2790         (assert.throws):
2791         (assert.eq):
2792         * wasm/references/validation.js:
2793         (assert.throws.new.WebAssembly.Module.bin):
2794         (assert.throws):
2795         * wasm/spec-tests/imports.wast.js:
2796         * wasm/wasm.json:
2797
2798         * wasm/Builder.js:
2799         * wasm/js-api/call-indirect.js:
2800         (const.oneTable):
2801         (const.multiTable):
2802         (multiTable):
2803         (multiTable.Polyphic2Import):
2804         (multiTable.VirtualImport):
2805         (const.wasmModuleWhichImportJS): Deleted.
2806         (const.makeTable): Deleted.
2807         (): Deleted.
2808         (Polyphic2Import): Deleted.
2809         (VirtualImport): Deleted.
2810         * wasm/js-api/table.js:
2811         (new.WebAssembly.Module):
2812         (assert.throws):
2813         (assertBadTableImport):
2814         (assert.truthy):
2815         (assert.throws.new.WebAssembly.Module.builder.WebAssembly): Deleted.
2816         * wasm/references/anyref_table.js:
2817         * wasm/references/anyref_table_import.js:
2818         (makeImport):
2819         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport):
2820         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl):
2821         * wasm/references/func_ref.js:
2822         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.fun): Deleted.
2823         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.assert.throws): Deleted.
2824         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly): Deleted.
2825         * wasm/references/multitable.js: Added.
2826         (assert.throws.1.exports.set_tbl0):
2827         (assert.throws):
2828         (assert.eq):
2829         (string_appeared_here.tableInsanity):
2830         (I32Const.0.GetLocal.0.TableSet.1.End.End.WebAssembly.):
2831         (I32Const.0.GetLocal.0.TableSet.1.End.End.WebAssembly):
2832         * wasm/references/validation.js:
2833         (assert.throws.new.WebAssembly.Module.bin):
2834         (assert.throws):
2835         * wasm/spec-tests/imports.wast.js:
2836         * wasm/wasm.json:
2837
2838 2019-06-18  Alexey Shvayka  <shvaikalesh@gmail.com>
2839
2840         [ESNExt] String.prototype.matchAll
2841         https://bugs.webkit.org/show_bug.cgi?id=186694
2842
2843         Reviewed by Yusuke Suzuki.
2844
2845         Implement String.prototype.matchAll.
2846         (https://tc39.es/ecma262/#sec-string.prototype.matchall)
2847
2848         * test262/config.yaml:
2849
2850 2019-06-18  Tadeu Zagallo  <tzagallo@apple.com>
2851
2852         DFG code should not reify the names of builtin functions with private names
2853         https://bugs.webkit.org/show_bug.cgi?id=198849
2854         <rdar://problem/51733890>
2855
2856         Reviewed by Filip Pizlo.
2857
2858         * stress/builtin-private-function-name.js: Added.
2859         (then):
2860         (PromiseLike):
2861
2862 2019-06-18  Keith Miller  <keith_miller@apple.com>
2863
2864         MaybeParseAsGeneratorForScope sometimes loses track of its scope ref
2865         https://bugs.webkit.org/show_bug.cgi?id=198969
2866         <rdar://problem/51620714>
2867
2868         Reviewed by Tadeu Zagallo.
2869
2870         * stress/nested-yield-in-arrow-function-should-be-a-syntax-error.js: Added.
2871         (catch):
2872
2873 2019-06-17  Justin Michaud  <justin_michaud@apple.com>
2874
2875         Validate that table element type is funcref if using an element section
2876         https://bugs.webkit.org/show_bug.cgi?id=198910
2877
2878         Reviewed by Yusuke Suzuki.
2879
2880         * wasm/references/anyref_table.js:
2881
2882 2019-06-17  Yusuke Suzuki  <ysuzuki@apple.com>
2883
2884         [JSC] Introduce DisposableCallSiteIndex to enforce type-safety
2885         https://bugs.webkit.org/show_bug.cgi?id=197378
2886
2887         Reviewed by Saam Barati.
2888
2889         * stress/disposable-call-site-index-with-call-and-this.js: Added.
2890         (foo):
2891         (bar):
2892         * stress/disposable-call-site-index.js: Added.
2893         (foo):
2894         (bar):
2895
2896 2019-06-17  Justin Michaud  <justin_michaud@apple.com>
2897
2898         [WASM-References] Add support for Funcref in parameters and return types
2899         https://bugs.webkit.org/show_bug.cgi?id=198157
2900
2901         Reviewed by Yusuke Suzuki.
2902
2903         * wasm/Builder.js:
2904         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
2905         * wasm/references/anyref_globals.js:
2906         * wasm/references/func_ref.js: Added.
2907         (fullGC.gc.makeExportedFunction):
2908         (makeExportedIdent):
2909         (makeAnyfuncIdent):
2910         (fun):
2911         (assert.eq.instance.exports.fix.fun):
2912         (assert.eq.instance.exports.fix):
2913         (string_appeared_here.End.End.Function.End.Code.End.WebAssembly.imp.ref):
2914         (string_appeared_here.End.End.Function.End.Code.End.WebAssembly):
2915         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.fun):
2916         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.assert.throws):
2917         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly):
2918         (assert.throws):
2919         (assert.throws.doTest):
2920         (let.importedFun.of):
2921         (makeAnyfuncIdent.fun):
2922         * wasm/references/validation.js:
2923         (assert.throws):
2924         * wasm/wasm.json:
2925
2926 2019-06-17  Ross Kirsling  <ross.kirsling@sony.com>
2927
2928         Update test262 tests (2019.06.13)
2929         https://bugs.webkit.org/show_bug.cgi?id=198821
2930
2931         Reviewed by Konstantin Tokarev.
2932
2933         * test262/expectations.yaml:
2934         * test262/harness/:
2935         * test262/latest-changes-summary.txt:
2936         * test262/test/:
2937         * test262/test262-Revision.txt:
2938
2939 2019-06-16  Yusuke Suzuki  <ysuzuki@apple.com>
2940
2941         [JSC] Grown region of WasmTable should be initialized with null
2942         https://bugs.webkit.org/show_bug.cgi?id=198903
2943
2944         Reviewed by Saam Barati.
2945
2946         * wasm/stress/wasm-table-grow-initialize.js: Added.
2947         (shouldBe):
2948
2949 2019-06-13  Yusuke Suzuki  <ysuzuki@apple.com>
2950
2951         Yarr bytecode compilation failure should be gracefully handled
2952         https://bugs.webkit.org/show_bug.cgi?id=198700
2953
2954         Reviewed by Michael Saboff.
2955
2956         * stress/regexp-bytecode-compilation-fail.js: Added.
2957         (shouldThrow):
2958
2959 2019-06-12  Yusuke Suzuki  <ysuzuki@apple.com>
2960
2961         [JSC] Polymorphic call stub's slow path should restore callee saves before performing tail call
2962         https://bugs.webkit.org/show_bug.cgi?id=198770
2963
2964         Reviewed by Saam Barati.
2965
2966         * stress/poly-call-stub-slow-path-should-restore-callee-saves-when-doing-tail-call.js: Added.
2967         (test):
2968
2969 2019-06-11  Alexey Shvayka  <shvaikalesh@gmail.com>
2970
2971         JSC should throw if proxy set returns falsish in strict mode context
2972         https://bugs.webkit.org/show_bug.cgi?id=177398
2973
2974         Reviewed by Yusuke Suzuki.
2975
2976         1. Add coverage for Proxy `set` trap returning falsy value in strict mode.
2977         2. RegExp methods throw unless [[Set]] succeeds. Return `true` from Proxy `set` traps to fix the tests.
2978
2979         * stress/proxy-set.js: Add 2 test cases.
2980         * stress/regexp-match-proxy.js: Fix test.
2981         * stress/regexp-replace-proxy.js: Fix test.
2982
2983 2019-06-11  Alexey Shvayka  <shvaikalesh@gmail.com>
2984
2985         Error message for non-callable Proxy `construct` trap is misleading
2986         https://bugs.webkit.org/show_bug.cgi?id=198637
2987
2988         Reviewed by Saam Barati.
2989
2990         * stress/proxy-construct.js:
2991
2992 2019-06-10  Tadeu Zagallo  <tzagallo@apple.com>
2993
2994         AI BitURShift's result should not be unsigned
2995         https://bugs.webkit.org/show_bug.cgi?id=198689
2996         <rdar://problem/51550063>
2997
2998         Reviewed by Saam Barati.
2999
3000         * stress/urshift-int32-overflow.js: Added.
3001         (foo.):
3002         (foo):
3003
3004 2019-06-11  Guillaume Emont  <guijemont@igalia.com>
3005
3006         Skip stress/ftl-gettypedarrayoffset-wasteful.js on Arm/Linux
3007
3008         Unreviewed gardening.
3009
3010         * stress/ftl-gettypedarrayoffset-wasteful.js:
3011         Skipped on arm/linux as it always times out on the bot since a change
3012         between r246270 and r246278 inclusive.
3013
3014 2019-06-10  Yusuke Suzuki  <ysuzuki@apple.com>
3015
3016         [JSC] UnlinkedCodeBlock should be eventually jettisoned in VM mini mode
3017         https://bugs.webkit.org/show_bug.cgi?id=198023
3018
3019         Reviewed by Saam Barati.
3020
3021         * stress/reparsing-unlinked-codeblock.js: Added.
3022         (shouldBe):
3023         (hello):
3024
3025 2019-06-09  Yusuke Suzuki  <ysuzuki@apple.com>
3026
3027         [JSC] Use mergePrediction in ValuePow prediction propagation
3028         https://bugs.webkit.org/show_bug.cgi?id=198648
3029
3030         Reviewed by Saam Barati.
3031
3032         * stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js: Added.
3033
3034 2019-06-07  Tadeu Zagallo  <tzagallo@apple.com>
3035
3036         AI should get GetterSetter structure from the base's GlobalObject for GetGetterSetterByOffset
3037         https://bugs.webkit.org/show_bug.cgi?id=198581
3038         <rdar://problem/51099753>
3039
3040         Reviewed by Saam Barati.
3041
3042         * stress/global-object-proto-getter.js: Added.
3043         (f):
3044         (test):
3045
3046 2019-06-05  Justin Michaud  <justin_michaud@apple.com>
3047
3048         [WASM-References] Add support for Anyref tables, Table.get and Table.set (for Anyref only).
3049         https://bugs.webkit.org/show_bug.cgi?id=198398
3050
3051         Reviewed by Saam Barati.
3052
3053         * wasm/references/anyref_table.js: Added.
3054         (string_appeared_here.doGCSet):
3055         (doGCTest):
3056         (doGCSet.doGCTest.let.count.0.doBarrierSet):
3057         * wasm/references/anyref_table_import.js: Added.
3058         (makeImport):
3059         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport):
3060         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl):
3061         * wasm/references/is_null_error.js: Removed.
3062         * wasm/references/validation.js: Added.
3063         (assert.throws.new.WebAssembly.Module.bin):
3064         (assert.throws):
3065         * wasm/wasm.json:
3066
3067 2019-06-05  Justin Michaud  <justin_michaud@apple.com>
3068
3069         WebAssembly: pow functions returns 0 when exponent 1.0 or -1.0
3070         https://bugs.webkit.org/show_bug.cgi?id=198106
3071
3072         Reviewed by Saam Barati.
3073
3074         * wasm/regress/selectf64.js: Added.
3075         * wasm/regress/selectf64.wasm: Added.
3076         * wasm/regress/selectf64.wat: Added.
3077
3078 2019-06-04  Tadeu Zagallo  <tzagallo@apple.com>
3079
3080         Argument elimination should check transitive dependents for interference
3081         https://bugs.webkit.org/show_bug.cgi?id=198520
3082         <rdar://problem/50863343>
3083
3084         Reviewed by Filip Pizlo.
3085
3086         * stress/argument-elimination-inline-rest-past-kill.js: Added.
3087         (f2):
3088         (f3):
3089
3090 2019-06-04  Tadeu Zagallo  <tzagallo@apple.com>
3091
3092         Argument elimination should check for negative indices in GetByVal
3093         https://bugs.webkit.org/show_bug.cgi?id=198302
3094         <rdar://problem/51188095>
3095
3096         Reviewed by Filip Pizlo.
3097
3098         * stress/eliminate-arguments-negative-rest-access.js: Added.
3099         (inlinee):
3100         (opt):
3101
3102 2019-06-03  Caio Lima  <ticaiolima@gmail.com>
3103
3104         [ESNext][BigInt] Implement support for "**"
3105         https://bugs.webkit.org/show_bug.cgi?id=190799
3106
3107         Reviewed by Saam Barati.
3108
3109         * stress/big-int-exp-basic.js: Added.
3110         * stress/big-int-exp-jit-osr.js: Added.
3111         * stress/big-int-exp-jit-untyped.js: Added.
3112         * stress/big-int-exp-jit.js: Added.
3113         * stress/big-int-exp-negative-exponent.js: Added.
3114         * stress/big-int-exp-to-primitive.js: Added.
3115         * stress/big-int-exp-type-error.js: Added.
3116         * stress/big-int-exp-wrapped-value.js: Added.
3117         * stress/value-pow-ai-rule.js: Added.
3118
3119 2019-05-30  Tadeu Zagallo  <tzagallo@apple.com> and Yusuke Suzuki  <ysuzuki@apple.com>
3120
3121         [JSC] Implement op_wide16 / op_wide32 and introduce 16bit version bytecode
3122         https://bugs.webkit.org/show_bug.cgi?id=197979
3123
3124         Reviewed by Filip Pizlo.
3125
3126         * stress/16bit-code.js: Added.
3127         (shouldBe):
3128         * stress/32bit-code.js: Added.
3129         (shouldBe):
3130
3131 2019-05-30  Justin Michaud  <justin_michaud@apple.com>
3132
3133         oss-fuzz: jsc: Issue 15016: jsc: Abrt in JSC::Wasm::AirIRGenerator::addLocal (15016)
3134         https://bugs.webkit.org/show_bug.cgi?id=198355
3135
3136         Reviewed by Saam Barati.
3137
3138         * wasm/references/is_null.js:
3139
3140 2019-05-30  Stephan Szabo  <stephan.szabo@sony.com>
3141
3142         [PlayStation] Skip additional tests on PlayStation
3143         https://bugs.webkit.org/show_bug.cgi?id=198352
3144
3145         Reviewed by Don Olmstead.
3146
3147         Skip pow test on PlayStation due to behavior difference in standard library.
3148         Skip incremental marking test due to OOM on PlayStation systems.
3149
3150         * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js:
3151         * stress/math-pow-with-constants.js:
3152         * stress/pow-with-constants.js:
3153
3154 2019-05-28  Dean Jackson  <dino@apple.com>
3155
3156         Implement Promise.allSettled
3157         https://bugs.webkit.org/show_bug.cgi?id=197600
3158         <rdar://problem/50483885>
3159
3160         Reviewed by Keith Miller.
3161
3162         Start testing Promise.allSettled. We pass most of the tests.
3163         The ones that fail are similar to the Promise.all tests we already fail.
3164
3165         * test262/config.yaml: Remove Promise.allSettled from skipped tests.
3166         * test262/expectations.yaml: Add new expectations for allSettled tests.
3167
3168 2019-05-28  Michael Saboff  <msaboff@apple.com>
3169
3170         [YARR] Properly handle RegExp's that require large ParenContext space
3171         https://bugs.webkit.org/show_bug.cgi?id=198065
3172
3173         Reviewed by Keith Miller.
3174
3175         New test.
3176
3177         * stress/regexp-large-paren-context.js: Added.
3178         (testLargeRegExp):
3179
3180 2019-05-28  Tadeu Zagallo  <tzagallo@apple.com>
3181
3182         JITOperations putByVal should mark negative array indices as out-of-bounds
3183         https://bugs.webkit.org/show_bug.cgi?id=198271
3184
3185         Reviewed by Saam Barati.
3186
3187         * microbenchmarks/get-by-val-negative-array-index.js:
3188         (foo):
3189         Update the getByVal microbenchmark added in r245769. This now shows that r245769
3190         is 4.2x faster than the previous commit.
3191
3192         * microbenchmarks/put-by-val-negative-array-index.js: Added.
3193         (foo):
3194
3195 2019-05-25  Tadeu Zagallo  <tzagallo@apple.com>
3196
3197         JITOperations getByVal should mark negative array indices as out-of-bounds
3198         https://bugs.webkit.org/show_bug.cgi?id=198229
3199
3200         Reviewed by Saam Barati.
3201
3202         * microbenchmarks/get-by-val-negative-array-index.js: Added.
3203         (foo):
3204
3205 2019-05-24  Justin Michaud  <justin_michaud@apple.com>
3206
3207         [WASM-References] Support Anyref in globals
3208         https://bugs.webkit.org/show_bug.cgi?id=198102
3209
3210         Reviewed by Saam Barati.
3211
3212         Add test for anyrefs in globals, as well as adding a new RefNull initExpr for Builder.
3213
3214         * wasm/Builder.js:
3215         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
3216         * wasm/Builder_WebAssemblyBinary.js:
3217         (const.putInitExpr):
3218         * wasm/references/anyref_globals.js: Added.
3219         (GetGlobal.0.End.End.WebAssembly):
3220         (5.doGCSet):
3221         (doGCTest):
3222         (doGCSet.doGCTest.let.count.0.doBarrierSet):
3223
3224 2019-05-23  Tadeu Zagallo  <tzagallo@apple.com>
3225
3226         DFG::OSREntry should not perform arity check
3227         https://bugs.webkit.org/show_bug.cgi?id=198189
3228
3229         Reviewed by Saam Barati.
3230
3231         * microbenchmarks/loop-osr-with-arity-mismatch.js: Added.
3232         (foo):
3233
3234 2019-05-23  Stephan Szabo  <stephan.szabo@sony.com>
3235
3236         [PlayStation] Skip additional tests on PlayStation
3237         https://bugs.webkit.org/show_bug.cgi?id=198145
3238
3239         Reviewed by Ross Kirsling.
3240
3241         * exceptionFuzz.yaml:
3242         Add skip on hostOS playstation
3243         * executableAllocationFuzz.yaml:
3244         Add skip on hostOS playstation
3245
3246 2019-05-23  Tadeu Zagallo  <tzagallo@apple.com>
3247
3248         createListFromArrayLike should throw if value is not an object
3249         https://bugs.webkit.org/show_bug.cgi?id=198138
3250
3251         Reviewed by Yusuke Suzuki.
3252
3253         * stress/create-list-from-array-like-not-object.js: Added.
3254         (testValid):
3255         (testInvalid):
3256         * stress/proxy-get-own-property-names-should-not-clear-previous-results.js:
3257         (opt):
3258         * stress/proxy-proto-enumerator.js: Added.
3259         (main):
3260         * stress/proxy-proto-own-keys.js: Added.
3261         (assert):
3262         (ownKeys):
3263
3264 2019-05-22  Yusuke Suzuki  <ysuzuki@apple.com>
3265
3266         [JSC] ArrayAllocationProfile should not access to butterfly in concurrent compiler
3267         https://bugs.webkit.org/show_bug.cgi?id=197809
3268
3269         Reviewed by Michael Saboff.
3270
3271         * stress/array-allocation-profile-should-not-update-itself-in-concurrent-compiler.js: Added.
3272         (foo):
3273
3274 2019-05-22  Ross Kirsling  <ross.kirsling@sony.com>
3275
3276         [ESNext] Implement support for Numeric Separators
3277         https://bugs.webkit.org/show_bug.cgi?id=196351
3278
3279         Reviewed by Keith Miller.
3280
3281         * stress/numeric-literal-separators.js: Added.
3282         Add tests for feature.
3283
3284         * test262/expectations.yaml:
3285         Mark 60 test cases as passing.
3286
3287 2019-05-22  Tadeu Zagallo  <tzagallo@apple.com>
3288
3289         llint_slow_path_get_by_id needs to hold the CodeBlock's to update the metadata's mode
3290         https://bugs.webkit.org/show_bug.cgi?id=198120
3291         <rdar://problem/49668795>
3292
3293         Reviewed by Michael Saboff.
3294
3295         * stress/get-array-length-concurrently-change-mode.js: Added.
3296         (main):
3297
3298 2019-05-22  Commit Queue  <commit-queue@webkit.org>
3299
3300         Unreviewed, rolling out r245634.
3301         https://bugs.webkit.org/show_bug.cgi?id=198140
3302
3303         'This patch makes JSC crash on launch in debug builds'
3304         (Requested by tadeuzagallo on #webkit).
3305
3306         Reverted changeset:
3307
3308         "[ESNext] Implement support for Numeric Separators"
3309         https://bugs.webkit.org/show_bug.cgi?id=196351
3310         https://trac.webkit.org/changeset/245634
3311
3312 2019-05-22  Tadeu Zagallo  <tzagallo@apple.com>
3313
3314         Stack-buffer-overflow in decodeURIComponent
3315         https://bugs.webkit.org/show_bug.cgi?id=198109
3316         <rdar://problem/50397550>
3317
3318         Reviewed by Michael Saboff.
3319
3320         * stress/decode-uri-icu-count-trail-bytes.js: Added.
3321         (i.j.try.i.toString):
3322         (i.j.catch):
3323
3324 2019-05-22  Yusuke Suzuki  <ysuzuki@apple.com>
3325
3326         Don't clear PropertyNameArray in Proxy code
3327         https://bugs.webkit.org/show_bug.cgi?id=197691
3328
3329         Reviewed by Saam Barati.
3330
3331         * stress/proxy-get-own-property-names-should-not-clear-previous-results.js: Added.
3332         (shouldBe):
3333         (opt):
3334
3335 2019-05-22  Ross Kirsling  <ross.kirsling@sony.com>
3336
3337         [ESNext] Implement support for Numeric Separators
3338         https://bugs.webkit.org/show_bug.cgi?id=196351
3339
3340         Reviewed by Keith Miller.
3341
3342         * stress/numeric-literal-separators.js: Added.
3343         Add tests for feature.
3344
3345         * test262/expectations.yaml:
3346         Mark 60 test cases as passing.
3347
3348 2019-05-22  Yusuke Suzuki  <ysuzuki@apple.com>
3349
3350         [JSC] ArrayBufferContents::tryAllocate signs the pointer with allocation size and authenticates it with sizeInBytes
3351         https://bugs.webkit.org/show_bug.cgi?id=198101
3352
3353         Reviewed by Michael Saboff.
3354
3355         * stress/zero-sized-array-buffer-pointer-should-be-signed-with-zero.js: Added.
3356         (shouldBe):
3357
3358 2019-05-20  Keith Miller  <keith_miller@apple.com>
3359
3360         Cleanup Yarr regexp code around paren contexts.
3361         https://bugs.webkit.org/show_bug.cgi?id=198063
3362
3363         Reviewed by Yusuke Suzuki.
3364
3365         * stress/regexp-many-named-sequential-capture-groups.js: Added.
3366         (i.s):
3367         * stress/regexp-many-unnamed-sequential-capture-groups.js: Added.
3368
3369 2019-05-17  Justin Michaud  <justin_michaud@apple.com>
3370
3371         [WASM-References] Add support for Anyref in parameters and return types, Ref.null and Ref.is_null for Anyref values.
3372         https://bugs.webkit.org/show_bug.cgi?id=197969
3373
3374         Reviewed by Keith Miller.
3375
3376         Support the anyref type in Builder.js, plus add some extra error logging.
3377         Add new folder for wasm references tests.
3378
3379         * wasm.yaml:
3380         * wasm/Builder.js:
3381         (const._isValidValue):
3382         * wasm/references/anyref_modules.js: Added.
3383         (Call.3.RefIsNull.End.End.WebAssembly.js.ident):
3384         (Call.3.RefIsNull.End.End.WebAssembly.js.make_null):
3385         (Call.3.RefIsNull.End.End.WebAssembly):
3386         (undefined):
3387         * wasm/references/is_null.js: Added.
3388         * wasm/references/is_null_error.js: Added.
3389         * wasm/spec-harness/index.js:
3390         * wasm/wasm.json:
3391
3392 2019-05-16  Ross Kirsling  <ross.kirsling@sony.com>
3393
3394         [JSC] Invalid AssignmentTargetType should be an early error.
3395         https://bugs.webkit.org/show_bug.cgi?id=197603
3396
3397         Reviewed by Keith Miller.
3398
3399         * test262/expectations.yaml:
3400         Update expectations to reflect new SyntaxErrors.
3401         (Ideally, these should all be viewed as passing in the near future.)
3402
3403         * stress/async-await-basic.js:
3404         * stress/big-int-literals.js:
3405         Update tests to reflect new SyntaxErrors.
3406
3407         * ChakraCore.yaml:
3408         * ChakraCore/test/EH/try6.baseline-jsc:
3409         * ChakraCore/test/Error/variousErrors3.baseline-jsc: Added.
3410         Update baselines to reflect new SyntaxErrors.
3411
3412 2019-05-15  Saam Barati  <sbarati@apple.com>
3413
3414         Bound liveness of SetArgumentMaybe nodes when maximal flush insertion phase is enabled
3415         https://bugs.webkit.org/show_bug.cgi?id=197855
3416         <rdar://problem/50236506>
3417
3418         Reviewed by Michael Saboff.
3419
3420         * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness-2.js: Added.
3421         (f0):
3422         (bar):
3423         (foo):
3424         * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness.js: Added.
3425         (f1):
3426         (f2):
3427         (foo):
3428
3429 2019-05-14  Keith Miller  <keith_miller@apple.com>
3430
3431         Fix issue with byteOffset on ARM64E
3432         https://bugs.webkit.org/show_bug.cgi?id=197884
3433
3434         Reviewed by Saam Barati.
3435
3436         We didn't have any tests that run with non-byte/non-zero offset
3437         typed arrays.
3438
3439         * stress/ftl-gettypedarrayoffset-wasteful.js:
3440
3441 2019-05-14  Yusuke Suzuki  <ysuzuki@apple.com>
3442
3443         [JSC] Shrink sizeof(UnlinkedFunctionExecutable) more
3444         https://bugs.webkit.org/show_bug.cgi?id=197833
3445
3446         Reviewed by Darin Adler.
3447
3448         * stress/generator-name.js: Added.
3449         (shouldBe):
3450         (gen):
3451         (catch):
3452
3453 2019-05-13  Tadeu Zagallo  <tzagallo@apple.com>
3454
3455         JSObject::getOwnPropertyDescriptor is missing an exception check
3456         https://bugs.webkit.org/show_bug.cgi?id=197693
3457         <rdar://problem/50441784>
3458
3459         Reviewed by Saam Barati.
3460
3461         * stress/proxy-spread.js: Added.
3462         (foo):
3463
3464 2019-05-10  Saam barati  <sbarati@apple.com>
3465
3466         Call to JSToWasmICCallee::createStructure passes in wrong prototype value
3467         https://bugs.webkit.org/show_bug.cgi?id=197807
3468         <rdar://problem/50530400>
3469
3470         Reviewed by Yusuke Suzuki.
3471
3472         * stress/js-to-wasm-callee-has-correct-prototype.js: Added.
3473         (test.getInstance):
3474         (test):
3475
3476 2019-05-10  Ross Kirsling  <ross.kirsling@sony.com>
3477
3478         [Test262] Unreviewed expectations update following r245188.
3479
3480         * test262/config.yaml:
3481         * test262/expectations.yaml:
3482
3483         * test262/test/intl402/DateTimeFormat/prototype/formatRange/date-is-infinity-throws.js:
3484         * test262/test/intl402/DateTimeFormat/prototype/formatRange/date-is-nan-throws.js:
3485         * test262/test/intl402/DateTimeFormat/prototype/formatRange/date-undefined-throws.js:
3486         * test262/test/intl402/DateTimeFormat/prototype/formatRange/date-x-greater-than-y-throws.js:
3487         * test262/test/intl402/DateTimeFormat/prototype/formatRange/this-is-not-object-throws.js:
3488         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-is-infinity-throws.js:
3489         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-is-nan-throws.js:
3490         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-undefined-throws.js:
3491         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-x-greater-than-y-throws.js:
3492         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/this-is-not-object-throws.js:
3493         These files have invalid YAML comments. Will also submit corrections back to Test262.
3494
3495 2019-05-10  Keith Miller  <keith_miller@apple.com>
3496
3497         Update test262 tests.
3498
3499         Rubber-stamped by Yusuke Suzuki.
3500
3501         * test262/*: mega-patch too many things to list individually.
3502
3503 2019-05-09  Keith Miller  <keith_miller@apple.com>
3504
3505         Unreview, fix test to have a try-catch.
3506
3507         * stress/many-nested-functions-parser-stack-overflow.js:
3508         (catch):
3509
3510 2019-05-09  Keith Miller  <keith_miller@apple.com>
3511
3512         parseStatementListItem needs a stack overflow check
3513         https://bugs.webkit.org/show_bug.cgi?id=197749
3514
3515         Reviewed by Saam Barati.
3516
3517         * stress/many-nested-functions-parser-stack-overflow.js: Added.
3518
3519 2019-05-08  Saam barati  <sbarati@apple.com>
3520
3521         AccessGenerationState::emitExplicitExceptionHandler can clobber an in use register
3522         https://bugs.webkit.org/show_bug.cgi?id=197715
3523         <rdar://problem/50399252>
3524
3525         Reviewed by Filip Pizlo.
3526
3527         * stress/polymorphic-access-exception-handler-should-not-clobber-used-register.js: Added.
3528         (foo):
3529         (bar):
3530
3531 2019-05-08  Ryan Haddad  <ryanhaddad@apple.com>
3532
3533         Unreviewed, rolling out r245068.
3534
3535         Caused debug layout tests to exit early due to an assertion
3536         failure.
3537
3538         Reverted changeset:
3539
3540         "All prototypes should call didBecomePrototype()"
3541         https://bugs.webkit.org/show_bug.cgi?id=196315
3542         https://trac.webkit.org/changeset/245068
3543
3544 2019-05-08  Yusuke Suzuki  <ysuzuki@apple.com>
3545
3546         Invalid DFG JIT genereation in high CPU usage state
3547         https://bugs.webkit.org/show_bug.cgi?id=197453
3548
3549         Reviewed by Saam Barati.
3550
3551         * stress/string-ident-use-clears-abstract-value-if-rope-string-constant-is-held.js: Added.
3552         (trigger):
3553         (main):
3554
3555 2019-05-08  Robin Morisset  <rmorisset@apple.com>
3556
3557         All prototypes should call didBecomePrototype()
3558         https://bugs.webkit.org/show_bug.cgi?id=196315
3559
3560         Reviewed by Saam Barati.
3561
3562         This changelog already landed, but the commit was missing the actual changes.
3563
3564         * stress/function-prototype-indexed-accessor.js: Added.
3565
3566 2019-05-08  Caio Lima  <ticaiolima@gmail.com>
3567
3568         [BigInt] Add ValueMod into DFG
3569         https://bugs.webkit.org/show_bug.cgi?id=186174
3570
3571         Reviewed by Saam Barati.
3572
3573         * microbenchmarks/mod-untyped.js: Added.
3574         * stress/big-int-mod-osr.js: Added.
3575         * stress/value-div-ai-rule.js: Added.
3576         * stress/value-mod-ai-rule.js: Added.
3577
3578 2019-05-07  Yusuke Suzuki  <ysuzuki@apple.com>
3579
3580         [JSC] DFG_ASSERT failed in lowInt52
3581         https://bugs.webkit.org/show_bug.cgi?id=197569
3582
3583         Reviewed by Saam Barati.
3584
3585         * stress/getstack-int52.js: Added.
3586         (opt):
3587         (main):
3588
3589 2019-05-07  Yusuke Suzuki  <ysuzuki@apple.com>
3590
3591         JSC: A bug in BytecodeGenerator::emitEqualityOpImpl
3592         https://bugs.webkit.org/show_bug.cgi?id=197479
3593
3594         Reviewed by Saam Barati.
3595
3596         * stress/do-not-perform-bytecode-peephole-optimization-in-jump-target.js: Added.
3597         (shouldBe):
3598
3599 2019-05-07  Yusuke Suzuki  <ysuzuki@apple.com>
3600
3601         TemplateObject passed to template literal tags are not always identical for the same source location.
3602         https://bugs.webkit.org/show_bug.cgi?id=190756
3603
3604         Reviewed by Saam Barati.
3605
3606         * complex.yaml:
3607         * complex/tagged-template-regeneration-after.js: Added.
3608         (shouldBe):
3609         * complex/tagged-template-regeneration.js: Added.
3610         (call):
3611         (test):
3612         * modules/tagged-template-inside-module.js: Added.
3613         (from.string_appeared_here.call):
3614         * modules/tagged-template-inside-module/other-tagged-templates.js: Added.
3615         (call):
3616         (export.otherTaggedTemplates):
3617         * stress/call-and-construct-should-return-same-tagged-templates.js: Added.
3618         (shouldBe):
3619         (call):
3620         (poly):
3621         * stress/tagged-templates-in-direct-eval-should-not-produce-same-site-object.js: Added.
3622         (shouldBe):
3623         (call):
3624         * stress/tagged-templates-in-function-in-direct-eval.js: Added.
3625         (shouldBe):
3626         (call):
3627         (test):
3628         * stress/tagged-templates-in-global-function-should-not-produce-same-site-object.js: Added.
3629         (shouldBe):
3630         (call):
3631         * stress/tagged-templates-in-indirect-eval-should-not-produce-same-site-object.js: Added.
3632         (shouldBe):
3633         (call):
3634         * stress/tagged-templates-in-multiple-functions.js: Added.
3635         (shouldBe):
3636         (call):
3637         (a):
3638         (b):
3639         (c):
3640         * stress/tagged-templates-with-same-start-offset.js: Added.
3641         (shouldBe):
3642
3643 2019-05-07  Robin Morisset  <rmorisset@apple.com>
3644
3645         All prototypes should call didBecomePrototype()
3646         https://bugs.webkit.org/show_bug.cgi?id=196315
3647
3648         Reviewed by Saam Barati.
3649
3650         * stress/function-prototype-indexed-accessor.js: Added.
3651
3652 2019-05-07  Commit Queue  <commit-queue@webkit.org>
3653
3654         Unreviewed, rolling out r244978.
3655         https://bugs.webkit.org/show_bug.cgi?id=197671
3656
3657         TemplateObject map should use start/end offsets (Requested by
3658         yusukesuzuki on #webkit).
3659
3660         Reverted changeset:
3661
3662         "TemplateObject passed to template literal tags are not always
3663         identical for the same source location."
3664         https://bugs.webkit.org/show_bug.cgi?id=190756
3665         https://trac.webkit.org/changeset/244978
3666
3667 2019-05-07  Tadeu Zagallo  <tzagallo@apple.com>
3668
3669         tryCachePutByID should not crash if target offset changes
3670         https://bugs.webkit.org/show_bug.cgi?id=197311
3671         <rdar://problem/48033612>
3672
3673         Reviewed by Filip Pizlo.
3674
3675         Add a series of tests related tryCachePutByID. Two of these tests used to crash and were fixed
3676         by this patch: `cache-put-by-id-different-attributes.js` and `cache-put-by-id-different-offset.js`
3677
3678         * stress/cache-put-by-id-delete-prototype.js: Added.
3679         (A.prototype.set y):
3680         (A):
3681         (B.prototype.set y):
3682         (B):
3683         (C):
3684         * stress/cache-put-by-id-different-__proto__.js: Added.
3685         (A.prototype.set y):
3686         (A):
3687         (B1):
3688         (B2.prototype.set y):
3689         (B2):
3690         (C):
3691         (D):
3692         * stress/cache-put-by-id-different-attributes.js: Added.
3693         (Foo):
3694         (set x):
3695         * stress/cache-put-by-id-different-offset.js: Added.
3696         (Foo):
3697         (set x):
3698         * stress/cache-put-by-id-insert-prototype.js: Added.
3699         (A.prototype.set y):
3700         (A):
3701         (C):
3702         * stress/cache-put-by-id-poly-proto.js: Added.
3703         (Foo):
3704         (set _):
3705         (createBar.Bar):
3706         (createBar):
3707
3708 2019-05-07  Saam Barati  <sbarati@apple.com>
3709
3710         Don't OSR enter into an FTL CodeBlock that has been jettisoned
3711         https://bugs.webkit.org/show_bug.cgi?id=197531
3712         <rdar://problem/50162379>
3713
3714         Reviewed by Yusuke Suzuki.
3715
3716         * stress/dont-osr-enter-into-jettisoned-ftl-code-block.js: Added.
3717
3718 2019-05-06  Dean Jackson  <dino@apple.com>
3719
3720         Update test262 expectations for Proxy passes
3721         https://bugs.webkit.org/show_bug.cgi?id=197628
3722
3723         Reviewed by Yusuke Suzuki.
3724
3725         There are two consistent passes in Proxy.ownKeys.
3726
3727         * test262/expectations.yaml:
3728
3729 2019-05-06  Yusuke Suzuki  <ysuzuki@apple.com>
3730
3731         [JSC] We should check OOM for description string of Symbol
3732         https://bugs.webkit.org/show_bug.cgi?id=197634
3733
3734         Reviewed by Keith Miller.
3735
3736         * stress/check-symbol-description-oom.js: Added.
3737         (shouldThrow):
3738
3739 2019-05-06  Yusuke Suzuki  <ysuzuki@apple.com>
3740
3741         Unreviewed, land one more test
3742         https://bugs.webkit.org/show_bug.cgi?id=197587
3743
3744         * stress/setter-frame-flush.js: Added.
3745         (setter):
3746         (foo):
3747         (bar):
3748
3749 2019-05-06  Yusuke Suzuki  <ysuzuki@apple.com>
3750
3751         TemplateObject passed to template literal tags are not always identical for the same source location.
3752         https://bugs.webkit.org/show_bug.cgi?id=190756
3753
3754         Reviewed by Saam Barati.
3755
3756         * complex.yaml:
3757         * complex/tagged-template-regeneration-after.js: Added.
3758         (shouldBe):
3759         * complex/tagged-template-regeneration.js: Added.
3760         (call):
3761         (test):
3762         * modules/tagged-template-inside-module.js: Added.
3763         (from.string_appeared_here.call):
3764         * modules/tagged-template-inside-module/other-tagged-templates.js: Added.
3765         (call):
3766         (export.otherTaggedTemplates):
3767         * stress/call-and-construct-should-return-same-tagged-templates.js: Added.
3768         (shouldBe):
3769         (call):
3770         (poly):
3771         * stress/tagged-templates-in-direct-eval-should-not-produce-same-site-object.js: Added.
3772         (shouldBe):
3773         (call):
3774         * stress/tagged-templates-in-global-function-should-not-produce-same-site-object.js: Added.
3775         (shouldBe):
3776         (call):
3777         * stress/tagged-templates-in-indirect-eval-should-not-produce-same-site-object.js: Added.
3778         (shouldBe):
3779         (call):
3780         * stress/tagged-templates-in-multiple-functions.js: Added.
3781         (shouldBe):
3782         (call):
3783         (a):
3784         (b):
3785         (c):
3786
3787 2019-05-06  Stephan Szabo  <stephan.szabo@sony.com>
3788
3789         [PlayStation] JSC Stress tests failing due to timezone printing
3790         https://bugs.webkit.org/show_bug.cgi?id=197615
3791
3792         PlayStation's strftime does not give timezone strings, which
3793         results in time strings like "Wed Oct 23 1974 11:45:01 GMT-0700"
3794         rather than "Wed Oct 23 1974 11:45:01 GMT-0700 (Pacific Daylight Time)"
3795         which causes diff failures with the expectations. Add expectations
3796         without the timezone string and use those on playstation.
3797
3798         Reviewed by Ross Kirsling.
3799
3800         * ChakraCore.yaml: Update these tests to use alternate expectation file on PlayStation
3801         * ChakraCore/test/GlobalFunctions/InternalToString.baseline-jsc-playstation: Added.
3802         * ChakraCore/test/Operators/equals.baseline-jsc-playstation: Added.
3803         * ChakraCore/test/fieldopts/objtypespec-newobj.2.baseline-jsc-playstation: Added.
3804
3805 2019-05-06  Yusuke Suzuki  <ysuzuki@apple.com>
3806
3807         [JSC] Add more tests for DFG SetLocal emission for adhoc SetterCall frame
3808         https://bugs.webkit.org/show_bug.cgi?id=197587
3809
3810         Reviewed by Sam Weinig.
3811
3812         This patch adds more tests to r244939. It also inlines setter calls, and eventually see that no PutStack is emitted because MovHint's KillStack kills it.
3813
3814         * stress/adhoc-setter-frame-should-not-be-killed.js: Added.
3815
3816 2019-05-04  Tadeu Zagallo  <tzagallo@apple.com>
3817
3818         TypedArrays should not store properties that are canonical numeric indices
3819         https://bugs.webkit.org/show_bug.cgi?id=197228
3820         <rdar://problem/49557381>
3821
3822         Reviewed by Saam Barati.
3823
3824         * stress/array-species-config-array-constructor.js:
3825         (test):
3826         * stress/put-direct-index-broken-2.js:
3827         * stress/typed-array-canonical-numeric-index-string.js: Added.
3828         (makeTest.assert):
3829         (makeTest):
3830         (const.testInvalidIndices.makeTest.set assert):
3831         (const.testInvalidIndices.makeTest):
3832         (const.makeTestValidIndex.configurable.set assert):
3833         (const.makeTestValidIndex.configurable):
3834         * stress/typedarray-access-monomorphic-neutered.js:
3835         (checkNoException):
3836         (testNoException):
3837         (testFTLNoException):
3838         * stress/typedarray-access-neutered.js:
3839         (testNoException):
3840         * stress/typedarray-getownproperty-not-configurable.js:
3841         (foo):
3842         * test262/expectations.yaml:
3843
3844 2019-05-03  Yusuke Suzuki  <ysuzuki@apple.com>
3845
3846         [JSC] Need to emit SetLocal if we emit MovHint in DFGByteCodeParser
3847         https://bugs.webkit.org/show_bug.cgi?id=197584
3848
3849         Reviewed by Saam Barati.
3850
3851         * stress/adhoc-setter-frame-should-emit-setlocal-again.js: Added.
3852         (X):
3853         (foo):
3854
3855 2019-05-03  Michael Saboff  <msaboff@apple.com>
3856
3857         iOS JSC tests frequently exiting with execption after stress/json-stringify-string-builder-overflow.js.no-cjit-validate-phases
3858         https://bugs.webkit.org/show_bug.cgi?id=197586
3859
3860         Reviewed by Keith Miller.
3861
3862         We should only run one config of this test and only when we think we'll have the memory.
3863
3864         * stress/json-stringify-string-builder-overflow.js:
3865
3866 2019-05-03  Yusuke Suzuki  <ysuzuki@apple.com>
3867
3868         [JSC] Generator CodeBlock generation should be idempotent
3869         https://bugs.webkit.org/show_bug.cgi?id=197552
3870
3871         Reviewed by Keith Miller.
3872
3873         Add complex.yaml, which controls how to run JSC shell more.
3874         We split test files into two to run macro task between them which allows debugger to be attached to VM.
3875
3876         * complex.yaml: Added.
3877         * complex/generator-regeneration-after.js: Added.
3878         * complex/generator-regeneration.js: Added.
3879         (gen):
3880
3881 2019-05-02  Michael Saboff  <msaboff@apple.com>
3882
3883         Unreviewed rollout of r244862.
3884
3885         * stress/proxy-getOwnPropertySlots-exceptionChecks.js:
3886
3887 2019-05-01  Saam barati  <sbarati@apple.com>
3888
3889         Baseline JIT should do argument value profiling after checking for stack overflow
3890         https://bugs.webkit.org/show_bug.cgi?id=197052
3891         <rdar://problem/50009602>
3892
3893         Reviewed by Yusuke Suzuki.
3894
3895         * stress/check-stack-overflow-before-value-profiling-arguments.js: Added.
3896
3897 2019-05-01  Yusuke Suzuki  <ysuzuki@apple.com>
3898
3899         [JSC] Inlining Getter/Setter should care availability of ad-hocly constructed frame
3900         https://bugs.webkit.org/show_bug.cgi?id=197405
3901
3902         Reviewed by Saam Barati.
3903
3904         * stress/getter-setter-inlining-should-emit-movhint.js: Added.
3905         (foo):
3906         (test):
3907         (i.o.get f):
3908         (i.o.set f):
3909
3910 2019-05-01  Michael Saboff  <msaboff@apple.com>
3911
3912         ASSERTION FAILED: !m_needExceptionCheck with --validateExceptionChecks=1; ProxyObject.getOwnPropertySlotCommon/JSFunction.callerGetter
3913         https://bugs.webkit.org/show_bug.cgi?id=197485
3914
3915         Reviewed by Saam Barati.
3916
3917         New test.
3918
3919         * stress/proxy-getOwnPropertySlots-exceptionChecks.js: Added.
3920         (foo):
3921
3922 2019-05-01  Ross Kirsling  <ross.kirsling@sony.com>
3923
3924         Unreviewed correction to Test262 expectations following r244828.
3925
3926         * test262/expectations.yaml:
3927
3928 2019-05-01  Stephan Szabo  <stephan.szabo@sony.com>
3929
3930         Add memory-limited skipping to some tests generating very large strings
3931         https://bugs.webkit.org/show_bug.cgi?id=197437
3932
3933         Reviewed by Ross Kirsling.
3934
3935         * stress/StringObject-define-length-getter-rope-string-oom.js:
3936         * stress/create-error-out-of-memory-rope-string.js:
3937         * stress/string-16bit-repeat-overflow.js:
3938
3939 2019-04-30  Commit Queue  <commit-queue@webkit.org>
3940
3941         Unreviewed, rolling out r244806.
3942         https://bugs.webkit.org/show_bug.cgi?id=197446
3943
3944         Causing Test262 and JSC test failures on multiple builds
3945         (Requested by ShawnRoberts on #webkit).
3946
3947         Reverted changeset:
3948
3949         "TypeArrays should not store properties that are canonical
3950         numeric indices"
3951         https://bugs.webkit.org/show_bug.cgi?id=197228
3952         https://trac.webkit.org/changeset/244806
3953
3954 2019-04-30  Tadeu Zagallo  <tzagallo@apple.com>
3955
3956         TypeArrays should not store properties that are canonical numeric indices
3957         https://bugs.webkit.org/show_bug.cgi?id=197228
3958         <rdar://problem/49557381>
3959
3960         Reviewed by Darin Adler.
3961
3962         * stress/typed-array-canonical-numeric-index-string.js: Added.
3963         (makeTest.assert):
3964         (makeTest):
3965         (const.testInvalidIndices.makeTest.set assert):
3966         (const.testInvalidIndices.makeTest):
3967         (const.testValidIndices.makeTest.set assert):
3968         (const.testValidIndices.makeTest):
3969
3970 2019-04-29  Yusuke Suzuki  <ysuzuki@apple.com>
3971
3972         normalizeMapKey should normalize NaN to one PureNaN bit pattern to make MapHash same
3973         https://bugs.webkit.org/show_bug.cgi?id=197362
3974
3975         Reviewed by Saam Barati.
3976
3977         * stress/map-with-nan.js: Added.
3978         (shouldBe):
3979         (div):
3980         (NaN1):
3981         (NaN2):
3982         (NaN3):
3983         (NaN4):
3984         (NaN1NoInline):
3985         (NaN2NoInline):
3986         (NaN3NoInline):
3987         (NaN4NoInline):
3988         (test1):
3989         (test2):
3990         (test3):
3991         (test4):
3992         * stress/set-with-nan.js: Added.
3993         (shouldBe):
3994         (div):
3995         (NaN1):
3996         (NaN2):
3997         (NaN3):
3998         (NaN4):
3999         (NaN1NoInline):
4000         (NaN2NoInline):
4001         (NaN3NoInline):
4002         (NaN4NoInline):
4003         (test2):
4004         (test4):
4005
4006 2019-04-26  Commit Queue  <commit-queue@webkit.org>
4007
4008         Unreviewed, rolling out r244708.
4009         https://bugs.webkit.org/show_bug.cgi?id=197334
4010
4011         "Broke the debug build" (Requested by rmorisset on #webkit).
4012
4013         Reverted changeset:
4014
4015         "All prototypes should call didBecomePrototype()"
4016         https://bugs.webkit.org/show_bug.cgi?id=196315
4017         https://trac.webkit.org/changeset/244708
4018
4019 2019-04-25  Yusuke Suzuki  <ysuzuki@apple.com>
4020
4021         [JSC] linkPolymorphicCall now does GC
4022         https://bugs.webkit.org/show_bug.cgi?id=197306
4023
4024         Reviewed by Saam Barati.
4025
4026         * stress/link-polymorphic-call-can-gc.js: Added.
4027         (module):
4028         (instance):
4029
4030 2019-04-26  Robin Morisset  <rmorisset@apple.com>
4031
4032         All prototypes should call didBecomePrototype()
4033         https://bugs.webkit.org/show_bug.cgi?id=196315
4034
4035         Reviewed by Saam Barati.
4036
4037         * stress/function-prototype-indexed-accessor.js: Added.
4038
4039 2019-04-23  Saam Barati  <sbarati@apple.com>
4040
4041         LICM incorrectly assumes it'll never insert a node which provably OSR exits
4042         https://bugs.webkit.org/show_bug.cgi?id=196721
4043         <rdar://problem/49556479>
4044
4045         Reviewed by Filip Pizlo.
4046
4047         * stress/licm-should-handle-if-a-hoist-causes-a-provable-osr-exit.js: Added.
4048         (foo):
4049
4050 2019-04-19  Saam Barati  <sbarati@apple.com>
4051
4052         AbstractValue can represent more than int52
4053         https://bugs.webkit.org/show_bug.cgi?id=197118
4054         <rdar://problem/49969960>
4055
4056         Reviewed by Michael Saboff.
4057
4058         * stress/abstract-value-can-include-int52.js: Added.
4059         (foo):
4060         (index.index.8.index.60.index.65.index.1234.index.1234.parseInt.string_appeared_here.String.fromCharCode):
4061
4062 2019-04-18  Yusuke Suzuki  <ysuzuki@apple.com>
4063
4064         [WTF] StringBuilder should set correct m_is8Bit flag when merging
4065         https://bugs.webkit.org/show_bug.cgi?id=197053
4066
4067         Reviewed by Saam Barati.
4068
4069         * stress/merge-string-builder-in-dfg.js: Added.
4070         (foo):
4071
4072 2019-04-16  Caitlin Potter  <caitp@igalia.com>
4073
4074         [JSC] Filter DontEnum properties in ProxyObject::getOwnPropertyNames()
4075         https://bugs.webkit.org/show_bug.cgi?id=176810
4076
4077         Reviewed by Saam Barati.
4078
4079         Add tests for the DontEnum filtering, and variations of other tests
4080         take the DontEnum-filtering path.
4081
4082         * stress/proxy-own-keys.js:
4083         (i.catch):
4084         (set assert):
4085         (set add):
4086         (let.set new):
4087         (get let):
4088
4089 2019-04-15  Saam barati  <sbarati@apple.com>
4090
4091         Modify how we do SetArgument when we inline varargs calls
4092         https://bugs.webkit.org/show_bug.cgi?id=196712
4093         <rdar://problem/49605012>
4094
4095         Reviewed by Michael Saboff.
4096
4097         * stress/get-stack-wrong-type-when-inline-varargs.js: Added.
4098         (foo):
4099
4100 2019-04-15  Saam barati  <sbarati@apple.com>
4101
4102         SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
4103         https://bugs.webkit.org/show_bug.cgi?id=196945
4104         <rdar://problem/49802750>
4105
4106         Reviewed by Filip Pizlo.
4107
4108         * stress/get-by-offset-should-use-correct-child.js: Added.
4109         (foo.bar):
4110         (foo):
4111
4112 2019-04-15  Robin Morisset  <rmorisset@apple.com>
4113
4114         DFG should be able to constant fold Object.create() with a constant prototype operand
4115         https://bugs.webkit.org/show_bug.cgi?id=196886
4116
4117         Reviewed by Yusuke Suzuki.
4118
4119         Note that this new benchmark does not currently see a speedup with inlining removed.
4120         The reason is that we do not yet have inline caching for Object.create(), we only optimize it when the DFG can see statically the prototype being passed.
4121
4122         * microbenchmarks/object-create-constant-prototype.js: Added.
4123         (test):
4124
4125 2019-04-15  Tadeu Zagallo  <tzagallo@apple.com>
4126
4127         Incremental bytecode cache should not append function updates when loaded from memory
4128         https://bugs.webkit.org/show_bug.cgi?id=196865
4129
4130         Reviewed by Filip Pizlo.
4131
4132         * stress/bytecode-cache-shared-code-block.js: Added.
4133         (b):
4134         (program):
4135
4136 2019-04-13  Tadeu Zagallo  <tzagallo@apple.com>
4137
4138         CodeCache should check that the UnlinkedCodeBlock was successfully created before caching it
4139         https://bugs.webkit.org/show_bug.cgi?id=196880
4140
4141         Reviewed by Yusuke Suzuki.
4142
4143         * stress/bytecode-cache-syntax-error.js: Added.
4144         (catch):
4145
4146 2019-04-12  Saam barati  <sbarati@apple.com>
4147
4148         r244079 logically broke shouldSpeculateInt52
4149         https://bugs.webkit.org/show_bug.cgi?id=196884
4150
4151         Reviewed by Yusuke Suzuki.
4152
4153         * microbenchmarks/int52-rand-function.js: Added.
4154         (Math.random):
4155
4156 2019-04-11  Yusuke Suzuki  <ysuzuki@apple.com>
4157
4158         [JSC] op_has_indexed_property should not assume subscript part is Uint32
4159         https://bugs.webkit.org/show_bug.cgi?id=196850
4160
4161         Reviewed by Saam Barati.
4162
4163         * stress/has-indexed-property-should-accept-non-int32.js: Added.
4164         (foo):
4165
4166 2019-04-11  Saam barati  <sbarati@apple.com>
4167
4168         Remove invalid assertion in operationInstanceOfCustom
4169         https://bugs.webkit.org/show_bug.cgi?id=196842
4170         <rdar://problem/49725493>
4171
4172         Reviewed by Michael Saboff.
4173
4174         * stress/operationInstanceOfCustom-bad-assertion.js: Added.
4175
4176 2019-04-10  Saam Barati  <sbarati@apple.com>
4177
4178         AbstractValue::validateOSREntryValue is wrong for Int52 constants
4179         https://bugs.webkit.org/show_bug.cgi?id=196801
4180         <rdar://problem/49771122>
4181
4182         Reviewed by Yusuke Suzuki.
4183
4184         * stress/abstract-value-int52-constant-validation-should-not-care-about-representation.js: Added.
4185
4186 2019-04-10  Robin Morisset  <rmorisset@apple.com>
4187
4188         We should clear m_needsOverflowCheck when hitting an exception in defineProperties in ObjectConstructor.cpp
4189         https://bugs.webkit.org/show_bug.cgi?id=196746
4190
4191         Reviewed by Yusuke Suzuki.
4192
4193         * stress/cyclic-define-properties.js: Added.
4194         (foo):
4195
4196 2019-04-09  Saam barati  <sbarati@apple.com>
4197
4198         Clean up Int52 code and some bugs in it
4199         https://bugs.webkit.org/show_bug.cgi?id=196639
4200         <rdar://problem/49515757>
4201
4202         Reviewed by Yusuke Suzuki.
4203
4204         * stress/spec-any-int-as-double-produces-any-int52-from-int52-rep.js: Added.
4205
4206 2019-04-09  Tadeu Zagallo  <tzagallo@apple.com>
4207
4208         ASSERTION FAILED: !scope.exception() || !hasProperty in JSObject::get
4209         https://bugs.webkit.org/show_bug.cgi?id=196708
4210         <rdar://problem/49556803>
4211
4212         Reviewed by Yusuke Suzuki.
4213
4214         * stress/proxy-getter-stack-overflow.js: Added.
4215         (const.handler.get target):
4216         (const.handler.has):
4217         (try.with):
4218         (catch):
4219
4220 2019-04-08  Yusuke Suzuki  <ysuzuki@apple.com>
4221
4222         [JSC] DFG should respect node's strict flag
4223         https://bugs.webkit.org/show_bug.cgi?id=196617
4224
4225         Reviewed by Saam Barati.
4226
4227         * stress/put-by-val-direct-should-respect-strict-mode-of-inlining-codeblock.js: Added.
4228         (shouldEqual):
4229         (makeUnwriteableUnconfigurableObject):
4230         (runTest):
4231         * stress/put-dynamic-var-strict-and-sloppy.js: Added.
4232         (shouldBe):
4233         (shouldThrow):
4234         (with.result):
4235         (with.putValueStrict):
4236         (with.putValueSloppy):
4237
4238 2019-04-08  Yusuke Suzuki  <ysuzuki@apple.com>
4239
4240         [JSC] isRope jump in StringSlice should not jump over register allocations
4241         https://bugs.webkit.org/show_bug.cgi?id=196716
4242
4243         Reviewed by Saam Barati.
4244
4245         * stress/is-rope-check-in-string-slice-should-not-jump-over-register-allocations.js: Added.
4246         (foo.bar):
4247         (foo):
4248
4249 2019-04-08  Yusuke Suzuki  <ysuzuki@apple.com>
4250
4251         [JSC] to_index_string should not assume incoming value is Uint32
4252         https://bugs.webkit.org/show_bug.cgi?id=196713
4253
4254         Reviewed by Saam Barati.
4255
4256         * stress/to-index-string-should-not-assume-incoming-value-is-uint32.js: Added.
4257         (foo):
4258
4259 2019-04-08  Yusuke Suzuki  <ysuzuki@apple.com>
4260
4261         [JSC] Add more tests for r243966
4262         https://bugs.webkit.org/show_bug.cgi?id=196711
4263
4264         Reviewed by Saam Barati.
4265
4266         Adding one more test for r243966 fix. The added test will not crash after r243966.
4267
4268         * stress/stress-cleared-calllinkinfo.js: Added.
4269         (runNearStackLimit.t):
4270         (runNearStackLimit):
4271         (repeat):
4272         (cls):
4273         (let.item.of.array.runNearStackLimit):
4274
4275 2019-04-08  Saam Barati  <sbarati@apple.com>
4276
4277         WebAssembly.RuntimeError missing exception check
4278         https://bugs.webkit.org/show_bug.cgi?id=196700
4279         <rdar://problem/49693932>
4280
4281         Reviewed by Yusuke Suzuki.
4282
4283         * wasm/js-api/runtime-error-should-exception-check.js: Added.
4284
4285 2019-04-08  Yusuke Suzuki  <ysuzuki@apple.com>
4286
4287         Unreviewed, rolling in r243948 with test fix
4288         https://bugs.webkit.org/show_bug.cgi?id=196486
4289
4290         * stress/arrow-function-and-use-strict-directive.js: Added.
4291         * stress/arrow-function-syntax.js: Added.
4292         (checkSyntax):
4293         (checkSyntaxError):
4294
4295 2019-04-08  Ryan Haddad  <ryanhaddad@apple.com>
4296
4297         Unreviewed, rolling out r243948.
4298
4299         Caused inspector/runtime/parse.html to fail
4300
4301         Reverted changeset:
4302
4303         "SIGSEGV in JSC::BytecodeGenerator::addStringConstant"
4304         https://bugs.webkit.org/show_bug.cgi?id=196486
4305         https://trac.webkit.org/changeset/243948
4306
4307 2019-04-08  Ryan Haddad  <ryanhaddad@apple.com>
4308
4309         Unreviewed, rolling out r243943.
4310
4311         Caused test262 failures.
4312
4313         Reverted changeset:
4314
4315         "[JSC] Filter DontEnum properties in
4316         ProxyObject::getOwnPropertyNames()"
4317         https://bugs.webkit.org/show_bug.cgi?id=176810
4318         https://trac.webkit.org/changeset/243943
4319
4320 2019-04-07  Michael Saboff  <msaboff@apple.com>
4321
4322         REGRESSION (r243642): Crash in reddit.com page
4323         https://bugs.webkit.org/show_bug.cgi?id=196684
4324
4325         Reviewed by Geoffrey Garen.
4326
4327         New regression test.
4328
4329         * stress/regexp-nongreedy-charclass-backtracks.js: Added.
4330
4331 2019-04-07  Yusuke Suzuki  <ysuzuki@apple.com>
4332
4333         [JSC] CallLinkInfo should clear Callee or CodeBlock even if it is unlinked by jettison
4334         https://bugs.webkit.org/show_bug.cgi?id=196683
4335
4336         Reviewed by Saam Barati.
4337
4338         * stress/clear-callee-or-codeblock-in-calllinkinfo-even-cleared-by-jettison.js: Added.
4339         (foo):
4340
4341 2019-04-05  Yusuke Suzuki  <ysuzuki@apple.com>
4342
4343         [JSC] OSRExit recovery for SpeculativeAdd does not consier "A = A + A" pattern
4344         https://bugs.webkit.org/show_bug.cgi?id=196582
4345
4346         Reviewed by Saam Barati.
4347
4348         * stress/add-overflow-check-with-three-same-registers.js: Added.
4349         (foo):
4350         (Number.prototype.valueOf):
4351         (runWithNumber):
4352
4353 2019-04-05  Ryan Haddad  <ryanhaddad@apple.com>
4354
4355         Unreviewed, rolling out r243665.
4356
4357         Caused iOS JSC tests to exit with an exception.
4358
4359         Reverted changeset:
4360
4361         "Assertion failed in JSC::createError"
4362         https://bugs.webkit.org/show_bug.cgi?id=196305
4363         https://trac.webkit.org/changeset/243665
4364
4365 2019-04-05  Yusuke Suzuki  <ysuzuki@apple.com>
4366
4367         SIGSEGV in JSC::BytecodeGenerator::addStringConstant
4368         https://bugs.webkit.org/show_bug.cgi?id=196486
4369
4370         Reviewed by Saam Barati.
4371
4372         * stress/arrow-function-and-use-strict-directive.js: Added.
4373         * stress/arrow-function-syntax.js: Added. Checking EOF token handling.
4374         (checkSyntax):
4375         (checkSyntaxError): Currently not using it. But it is useful for testing more things related to arrow function syntax.
4376
4377 2019-04-05  Caitlin Potter  <caitp@igalia.com>
4378
4379         [JSC] Filter DontEnum properties in ProxyObject::getOwnPropertyNames()
4380         https://bugs.webkit.org/show_bug.cgi?id=176810
4381
4382         Reviewed by Saam Barati.
4383
4384         Add tests for the DontEnum filtering, and variations of other tests
4385         take the DontEnum-filtering path.
4386
4387         * stress/proxy-own-keys.js:
4388         (i.catch):
4389         (set assert):
4390         (set add):
4391         (let.set new):
4392         (get let):
4393
4394 2019-04-05  Caitlin Potter  <caitp@igalia.com>
4395
4396         [JSC] throw if 'ownKeys' Proxy trap result contains duplicate keys
4397         https://bugs.webkit.org/show_bug.cgi?id=185211
4398
4399         Reviewed by Saam Barati.
4400
4401         This is for the normative spec change in https://github.com/tc39/ecma262/pull/833
4402
4403         This changes several assertions to expect a TypeError to be thrown (in some cases,
4404         changing thee expected message).
4405
4406         * es6/Proxy_ownKeys_duplicates.js:
4407         (handler):
4408         (shouldThrow):
4409         (test):
4410         * stress/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js:
4411         (shouldThrow):
4412         * stress/proxy-own-keys.js:
4413         (i.catch):
4414         (assert):
4415
4416 2019-04-04  Yusuke Suzuki  <ysuzuki@apple.com>
4417
4418         [JSC] makeBoundFunction should not assume incoming "length" value is Int32 because it performs some calculation in bytecode
4419         https://bugs.webkit.org/show_bug.cgi?id=196631
4420
4421         Reviewed by Saam Barati.
4422
4423         * stress/make-bound-function-should-not-assume-int32-length.js: Added.
4424         (assert):
4425         (test):
4426         (foo):
4427
4428 2019-04-04  Saam Barati  <sbarati@apple.com>
4429
4430         Unreviewed. Make the test from r243906 catch the thrown exceptions.
4431
4432         * stress/inferred-types-regex-matches-array.js:
4433
4434 2019-04-04  Saam Barati  <sbarati@apple.com>
4435
4436         createRegExpMatchesArray does not respect inferred types
4437         https://bugs.webkit.org/show_bug.cgi?id=193287
4438
4439         Reviewed by Yusuke Suzuki.
4440
4441         This checks in the test case for 193287. This issue was discovered by
4442         Samuel Groß of Google Project Zero.
4443
4444         * stress/inferred-types-regex-matches-array.js: Added.
4445
4446 2019-04-04  Saam barati  <sbarati@apple.com>
4447
4448         Teach Call ICs how to call Wasm
4449         https://bugs.webkit.org/show_bug.cgi?id=196387
4450
4451         Reviewed by Filip Pizlo.
4452
4453         * wasm/function-tests/stack-trace.js:
4454
4455 2019-04-04  Caio Lima  <ticaiolima@gmail.com>
4456
4457         [JSC] We should consider moving UnlinkedFunctionExecutable::m_parentScopeTDZVariables to RareData
4458         https://bugs.webkit.org/show_bug.cgi?id=194944
4459
4460         Reviewed by Keith Miller.
4461
4462         * stress/verify-bytecode-generator-cached-variables-under-tdz.js: Added.
4463
4464 2019-04-04  Tadeu Zagallo  <tzagallo@apple.com>
4465
4466         Cache bytecode for jsc.cpp helpers and fix CachedStringImpl
4467         https://bugs.webkit.org/show_bug.cgi?id=196409
4468
4469         Reviewed by Saam Barati.
4470
4471         * stress/bytecode-cache-cached-string-impl.js: Added.
4472         (f):
4473         (g):
4474         * stress/bytecode-cache-run-string.js: Added.
4475
4476 2019-04-03  Robin Morisset  <rmorisset@apple.com>
4477
4478         B3 should use associativity to optimize expression trees
4479         https://bugs.webkit.org/show_bug.cgi?id=194081
4480
4481         Reviewed by Filip Pizlo.
4482
4483         Added three microbenchmarks:
4484         - add-tree should be the ideal case, but there is no speedup because we are currently unable to prove that the CheckAdd won't overflow
4485         - bit-xor-tree most closely matches the situation where the optimization triggers on the JetStream2 subtests where it triggers:
4486           an unbalanced expression tree of size 8 that can be balanced, with no other optimizations being unlocked. 16% speedup
4487         - bit-or-tree is an ideal case, where the reassociation also enables a ton of further simplifications. 42% speedup
4488
4489         * microbenchmarks/add-tree.js: Added.
4490         * microbenchmarks/bit-or-tree.js: Added.
4491         * microbenchmarks/bit-xor-tree.js: Added.
4492
4493 2019-04-03  Yusuke Suzuki  <ysuzuki@apple.com>
4494
4495         [JSC] Exception verification crash on operationArrayIndexOfValueInt32OrContiguous
4496         https://bugs.webkit.org/show_bug.cgi?id=196574
4497
4498         Reviewed by Saam Barati.
4499
4500         * stress/string-index-of-exception-check.js: Added.
4501         (blurType):
4502         (1.forEach):
4503
4504 2019-03-29  Tadeu Zagallo  <tzagallo@apple.com>
4505
4506         Assertion failed in JSC::createError
4507         https://bugs.webkit.org/show_bug.cgi?id=196305
4508         <rdar://problem/49387382>
4509
4510         Reviewed by Saam Barati.
4511
4512         * stress/create-error-out-of-memory-rope-string-2.js: Added.
4513         (assert):
4514         (catch):
4515
4516 2019-03-28  Saam Barati  <sbarati@apple.com>
4517
4518         BackwardsGraph needs to consider back edges as the backward's root successor
4519         https://bugs.webkit.org/show_bug.cgi?id=195991
4520
4521         Reviewed by Filip Pizlo.
4522
4523         * stress/map-b3-licm-infinite-loop.js: Added.
4524
4525 2019-03-28  Tadeu Zagallo  <tzagallo@apple.com>
4526
4527         CodeBlock::jettison() should disallow repatching its own calls
4528         https://bugs.webkit.org/show_bug.cgi?id=196359
4529         <rdar://problem/48973663>
4530
4531         Reviewed by Saam Barati.
4532
4533         * stress/call-link-info-osrexit-repatch.js: Added.
4534         (foo):
4535
4536 2019-03-28  Yusuke Suzuki  <ysuzuki@apple.com>
4537
4538         [JSC] imports-oom.js intermittently fails
4539         https://bugs.webkit.org/show_bug.cgi?id=196373
4540
4541         Reviewed by Saam Barati.
4542
4543         imports-oom.js ensures that a wasm module compilation / instantiation throws an OOM error instead of crashing when compiling / instantiating their entry points
4544         with extremely low executable memory amount. And this test expects we at least once successfully compile, instantiate, and execute a wasm module to test that
4545         wasm implementation is always throwing an OOM error. However, maybe due to wasm changes, the amount of executable memory consumed by wasm compilation is changed,
4546         and now we may encounter an OOM error at the first compilation. Since imports-oom.js randomize the amount of executable memory used by the generated wasm module,
4547         imports-oom.js intermittently fails when it first generates large wasm module which cannot be compiled.
4548
4549         This patch reduces the maxParams from 32 to 8 to reduce the size of randomly generated wasm module. Since we repeatedly generate wasm modules, this test soon encounter
4550         an expected OOM error. But this avoids the situation that we get an OOM error when we compile a first wasm module.
4551
4552         * wasm/lowExecutableMemory/imports-oom.js:
4553
4554 2019-03-27  Saam Barati  <sbarati@apple.com>
4555
4556         validateOSREntryValue with Int52 should box the value being checked into double format
4557         https://bugs.webkit.org/show_bug.cgi?id=196313
4558         <rdar://problem/49306703>
4559
4560         Reviewed by Yusuke Suzuki.
4561
4562         * stress/validate-int-52-ai-state.js: Added.
4563
4564 2019-03-27  Yusuke Suzuki  <ysuzuki@apple.com>
4565
4566         [JSC] Owner of watchpoints should validate at GC finalizing phase
4567         https://bugs.webkit.org/show_bug.cgi?id=195827
4568
4569         Reviewed by Filip Pizlo.
4570
4571         * stress/gc-should-reap-dead-watchpoints.js: Added.
4572         (foo):
4573         (A.prototype.y):
4574         (A):
4575
4576 2019-03-26  Dominik Infuehr  <dinfuehr@igalia.com>
4577
4578         Skip WebAssembly test on 32-bit systems
4579         https://bugs.webkit.org/show_bug.cgi?id=196206
4580
4581         Reviewed by Saam Barati.
4582
4583         Invoking runDefault executes test immediately even though
4584         that test should be skipped due to missing WASM support.
4585         Therefore remove runDefault.
4586
4587         * wasm/regress/web-assembly-link-error-exception-check.js:
4588
4589 2019-03-26  Tadeu Zagallo  <tzagallo@apple.com>
4590
4591         WebAssembly: Fix f32.min, f64.min and f64.max operations on NaN
4592         https://bugs.webkit.org/show_bug.cgi?id=196217
4593
4594         Reviewed by Saam Barati.
4595
4596         Re-enable all NaN tests for f32.min, f64.min and f64.max.
4597
4598         * wasm/spec-tests/f32.wast.js:
4599         * wasm/spec-tests/f64.wast.js:
4600         * wasm/wasm.json:
4601
4602 2019-03-25  Keith Miller  <keith_miller@apple.com>
4603
4604         ASSERTION FAILED: m_op == CompareStrictEq in JSC::DFG::Node::convertToCompareEqPtr(JSC::DFG::FrozenValue *, JSC::DFG::Edge)
4605         https://bugs.webkit.org/show_bug.cgi?id=196176
4606
4607         Reviewed by Saam Barati.
4608
4609         * stress/object-is-fold-to-compare-eq-ptr.js: Added.
4610         (main.v10):
4611         (main):
4612
4613 2019-03-25  Tadeu Zagallo  <tzagallo@apple.com>
4614
4615         WebAssembly: f32.max with NaN generates incorrect result
4616         https://bugs.webkit.org/show_bug.cgi?id=175691
4617         <rdar://problem/33952228>
4618
4619         Reviewed by Saam Barati.
4620
4621         Enable all f32.max NaN tests
4622
4623         * wasm/spec-tests/f32.wast.js:
4624         * wasm/wasm.json:
4625
4626 2019-03-24  Dominik Infuehr  <dinfuehr@igalia.com>
4627
4628         [JSC] Move test into directory for WASM tests
4629         https://bugs.webkit.org/show_bug.cgi?id=196187
4630
4631         Reviewed by Mark Lam.
4632
4633         Move Test into wasm-directory. Otherwise this test
4634         is also executed on systems without WASM support.
4635
4636         * wasm/regress/web-assembly-link-error-exception-check.js: Renamed from JSTests/stress/web-assembly-link-error-exception-check.js.
4637
4638 2019-03-23  Mark Lam  <mark.lam@apple.com>
4639
4640         Rolling out r243032 and r243071 because the fix is incorrect.
4641         https://bugs.webkit.org/show_bug.cgi?id=195892
4642         <rdar://problem/48981239>
4643
4644         Not reviewed.
4645
4646         * stress/check-object-property-condition-liveness-before-accessing-it-when-watchpoints-fire.js: Removed.
4647
4648 2019-03-22  Mark Lam  <mark.lam@apple.com>
4649
4650         Placate exception check validation in genericTypedArrayViewProtoFuncLastIndexOf().
4651         https://bugs.webkit.org/show_bug.cgi?id=196154
4652         <rdar://problem/49145307>
4653
4654         Reviewed by Filip Pizlo.
4655
4656         Also added //@ runDefault constraint to web-assembly-link-error-exception-check.js.
4657         There's no need to run this test on more than 1 test configuration.
4658
4659         * stress/typed-array-lastIndexOf-exception-check.js: Added.
4660         * stress/web-assembly-link-error-exception-check.js:
4661
4662 2019-03-22  Mark Lam  <mark.lam@apple.com>
4663
4664         Placate exception check validation in constructJSWebAssemblyLinkError().
4665         https://bugs.webkit.org/show_bug.cgi?id=196152
4666         <rdar://problem/49145257>
4667
4668         Reviewed by Michael Saboff.
4669
4670         * stress/web-assembly-link-error-exception-check.js: Added.
4671
4672 2019-03-22  Dominik Infuehr  <dinfuehr@igalia.com>
4673
4674         Skip tests running out of memory on ARM/MIPS
4675         https://bugs.webkit.org/show_bug.cgi?id=196131
4676
4677         Unreviewed. Skip test if memory is limited.
4678
4679         * microbenchmarks/put-by-val-direct-large-index.js:
4680
4681 2019-03-21  Mark Lam  <mark.lam@apple.com>
4682
4683         Remove an invalid assertion in DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined().
4684         https://bugs.webkit.org/show_bug.cgi?id=196116
4685         <rdar://problem/48976951>
4686
4687         Reviewed by Filip Pizlo.
4688
4689         * stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js: Added.
4690
4691 2019-03-21  Tadeu Zagallo  <tzagallo@apple.com>
4692
4693         JSObject::putDirectIndexSlowOrBeyondVectorLength should check if indexIsSufficientlyBeyondLengthForSparseMap
4694         https://bugs.webkit.org/show_bug.cgi?id=196078
4695         <rdar://problem/35925380>
4696
4697         Reviewed by Mark Lam.
4698
4699         Add a new benchmark that allocates several objects and invokes put_by_val_direct
4700         with a large index. run-jsc-benchmarks says "definitely 1.6178x faster".
4701
4702         * microbenchmarks/put-by-val-direct-large-index.js: Added.
4703
4704 2019-03-21  Mark Lam  <mark.lam@apple.com>
4705
4706         Placate exception check validation in operationArrayIndexOfString().
4707         https://bugs.webkit.org/show_bug.cgi?id=196067
4708         <rdar://problem/49056572>
4709
4710         Reviewed by Michael Saboff.
4711
4712         * stress/string-equal-exception-check.js: Added.
4713
4714 2019-03-21  Mark Lam  <mark.lam@apple.com>
4715
4716         Cap length of an array with spread to MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.
4717         https://bugs.webkit.org/show_bug.cgi?id=196055
4718         <rdar://problem/49067448>
4719
4720         Reviewed by Yusuke Suzuki.
4721
4722         * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: Added.
4723
4724 2019-03-20  Saam Barati  <sbarati@apple.com>
4725
4726         typeOfDoubleSum is wrong for when NaN can be produced
4727         https://bugs.webkit.org/show_bug.cgi?id=196030
4728
4729         Reviewed by Filip Pizlo.
4730
4731         * stress/double-add-sub-mul-can-produce-nan.js: Added.
4732         (assert):
4733         (noInline.sub):
4734         (noInline):
4735         (assert.mul):
4736         (assert.add):
4737
4738 2019-03-20  Yusuke Suzuki  <ysuzuki@apple.com>
4739
4740         Update the test to ensure OutOfMemoryError is thrown as intended
4741         https://bugs.webkit.org/show_bug.cgi?id=196032
4742         <rdar://problem/46842740>
4743
4744         Rubber stamped by Saam Barati.
4745
4746         * stress/create-error-out-of-memory-rope-string.js:
4747         (assert):
4748         (catch):
4749
4750 2019-03-20  Tadeu Zagallo  <tzagallo@apple.com>
4751
4752         JSC::createError needs to check for OOM in errorDescriptionForValue
4753         https://bugs.webkit.org/show_bug.cgi?id=196032
4754         <rdar://problem/46842740>
4755
4756         Reviewed by Mark Lam.
4757
4758         * stress/create-error-out-of-memory-rope-string.js: Added.
4759
4760 2019-03-19  Yusuke Suzuki  <ysuzuki@apple.com>
4761
4762         Unreviewed, reduce # of iterations to avoid timing out after r242991
4763         https://bugs.webkit.org/show_bug.cgi?id=195791
4764
4765         To avoid timing out, this patch reduces it from 3e7 to 1e7. 1e7 iteration counts still reproduce the issue at 60%.
4766
4767         * stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js:
4768
4769 2019-03-19  Caio Lima  <ticaiolima@gmail.com>
4770
4771         [JSC] microbenchmarks/generate-multiple-llint-entrypoints.js is running out of executable memory on ARMv7
4772         https://bugs.webkit.org/show_bug.cgi?id=195950
4773
4774         Unreviewed, reducing the amount of memory used on this test to avoid
4775         OOM on devices with memory restrictions.
4776
4777         * microbenchmarks/generate-multiple-llint-entrypoints.js:
4778
4779 2019-03-19  Caio Lima  <ticaiolima@gmail.com>
4780
4781         [JSC] LLIntEntryPoint creates same DirectJITCode for all functions
4782         https://bugs.webkit.org/show_bug.cgi?id=194648
4783
4784         Reviewed by Keith Miller.
4785
4786         * microbenchmarks/generate-multiple-llint-entrypoints.js: Added.
4787
4788 2019-03-18  Mark Lam  <mark.lam@apple.com>
4789
4790         Missing a ThrowScope release in JSObject::toString().
4791         https://bugs.webkit.org/show_bug.cgi?id=195893
4792         <rdar://problem/48970986>
4793
4794         Reviewed by Michael Saboff.
4795
4796         * stress/to-string-exception-check-release.js: Added.
4797
4798 2019-03-18  Mark Lam  <mark.lam@apple.com>
4799
4800         Structure::flattenDictionary() should clear unused property slots.
4801         https://bugs.webkit.org/show_bug.cgi?id=195871
4802         <rdar://problem/48959497>
4803
4804         Reviewed by Michael Saboff.
4805
4806         * stress/structure-flattenDictionary-should-clear-unused-property-slots.js: Added.
4807
4808 2019-03-15  Mark Lam  <mark.lam@apple.com>
4809
4810         Need to check ObjectPropertyCondition liveness before accessing it when firing watchpoints.
4811         https://bugs.webkit.org/show_bug.cgi?id=195827
4812         <rdar://problem/48845513>
4813
4814         Reviewed by Filip Pizlo.
4815
4816         * stress/check-object-property-condition-liveness-before-accessing-it-when-watchpoints-fire.js: Added.
4817
4818 2019-03-15  Dominik Infuehr  <dinfuehr@igalia.com>
4819
4820         [ARM,MIPS] Skip slow tests
4821         https://bugs.webkit.org/show_bug.cgi?id=195799
4822
4823         Unreviewed, test does not finish on ARM and MIPS within the
4824         timeout limit.
4825
4826         * stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js:
4827
4828 2019-03-14  Yusuke Suzuki  <ysuzuki@apple.com>
4829
4830         [JSC] Retain PrivateName of Symbol before passing it to operations potentially incurring GC
4831         https://bugs.webkit.org/show_bug.cgi?id=195791
4832         <rdar://problem/48806130>
4833
4834         Reviewed by Mark Lam.
4835
4836         * stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js: Added.
4837         (foo):
4838
4839 2019-03-14  Saam barati  <sbarati@apple.com>
4840
4841         We can't remove code after ForceOSRExit until after FixupPhase
4842         https://bugs.webkit.org/show_bug.cgi?id=186916
4843         <rdar://problem/41396612>
4844
4845         Reviewed by Yusuke Suzuki.
4846
4847         * stress/movhint-backwards-propagation-must-merge-use-as-value-add.js: Added.
4848         (foo):
4849         * stress/movhint-backwards-propagation-must-merge-use-as-value.js: Added.
4850         (foo):
4851
4852 2019-03-13  Michael Saboff  <msaboff@apple.com>
4853
4854         ASSERTION FAILED: regexp->isValid() or ASSERTION FAILED: !isCompilationThread()
4855         https://bugs.webkit.org/show_bug.cgi?id=195735
4856
4857         Reviewed by Mark Lam.
4858
4859         New regression test.
4860
4861         * stress/dont-strength-reduce-regexp-with-compile-error.js: Added.
4862         (foo):
4863         (bar):
4864
4865 2019-03-14  Saam barati  <sbarati@apple.com>
4866
4867         Fixup uses KnownInt32 incorrectly in some nodes
4868         https://bugs.webkit.org/show_bug.cgi?id=195279
4869         <rdar://problem/47915654>
4870
4871         Reviewed by Yusuke Suzuki.
4872
4873         * stress/known-int32-cant-be-used-across-bytecode-boundary.js: Added.
4874         (foo):
4875
4876 2019-03-14  Keith Miller  <keith_miller@apple.com>
4877
4878         DFG liveness can't skip tail caller inline frames
4879         https://bugs.webkit.org/show_bug.cgi?id=195715
4880
4881         Reviewed by Saam Barati.
4882
4883         * stress/dfg-scan-inlined-tail-caller-frames-liveness.js:
4884         (i.foo):
4885
4886 2019-03-13  Mark Lam  <mark.lam@apple.com>
4887
4888         Gardening: reducing the variants on 2 tests to avoid timing out on JSC Debug queue.
4889         https://bugs.webkit.org/show_bug.cgi?id=195415
4890
4891         Not reviewed.
4892
4893         Changed these tests to only run the default configuration.
4894         The ftl-no-cjit-validate-sampling-profiler variant was timing out.
4895         There's no strong need to run this test on that variant.
4896
4897         * stress/dfg-to-string-on-int-does-gc.js:
4898         * stress/dfg-to-string-on-string-or-string-object-does-not-gc.js:
4899
4900 2019-03-13  Dominik Infuehr  <dinfuehr@igalia.com>
4901
4902         String overflow when using StringBuilder in JSC::createError
4903         https://bugs.webkit.org/show_bug.cgi?id=194957
4904
4905         Reviewed by Mark Lam.
4906
4907         Add test string-overflow-createError-bulder.js that overflows
4908         StringBuilder in notAFunctionSourceAppender. The second new test
4909         string-overflow-createError-fit.js has an error message that doesn't
4910         overflow, it still failed since the String's capacity can't be doubled.
4911         Run test string-overflow-createError.js only in the default
4912         configuration to reduce memory consumption when running the test
4913         in all configurations on multiple CPUs in parallel.
4914
4915         * stress/string-overflow-createError-builder.js: Copied from JSTests/stress/string-overflow-createError.js.
4916         (catch):
4917         * stress/string-overflow-createError-fit.js: Copied from JSTests/stress/string-overflow-createError.js.
4918         (catch):
4919         * stress/string-overflow-createError.js:
4920
4921 2019-03-12  Yusuke Suzuki  <ysuzuki@apple.com>
4922
4923         [JSC] OSR entry should respect abstract values in addition to flush formats
4924         https://bugs.webkit.org/show_bug.cgi?id=195653
4925
4926         Reviewed by Mark Lam.
4927
4928         * stress/osr-entry-locals-none.js: Added.
4929
4930 2019-03-12  Michael Saboff  <msaboff@apple.com>
4931
4932         REGRESSION (iOS 12.2): Webpage using CoffeeScript crashes
4933         https://bugs.webkit.org/show_bug.cgi?id=195613
4934
4935         Reviewed by Mark Lam.
4936
4937         New regression test.
4938
4939         * stress/regexp-backref-inbounds.js: Added.
4940         (testRegExp):
4941
4942 2019-03-12  Mark Lam  <mark.lam@apple.com>
4943
4944         The HasIndexedProperty node does GC.
4945         https://bugs.webkit.org/show_bug.cgi?id=195559
4946         <rdar://problem/48767923>
4947
4948         Reviewed by Yusuke Suzuki.
4949
4950         * stress/HasIndexedProperty-does-gc.js: Added.
4951
4952 2019-03-11  Caio Lima  <ticaiolima@gmail.com>
4953
4954         [ESNext][BigInt] Implement "~" unary operation
4955         https://bugs.webkit.org/show_bug.cgi?id=182216
4956
4957         Reviewed by Keith Miller.
4958
4959         * stress/big-int-bit-not-general.js: Added.
4960         * stress/big-int-bitwise-not-jit.js: Added.
4961         * stress/big-int-bitwise-not-wrapped-value.js: Added.
4962         * stress/bit-op-with-object-returning-int32.js:
4963         * stress/bitwise-not-fixup-rules.js: Added.
4964         * stress/value-bit-not-ai-rule.js: Added.
4965
4966 2019-03-10  Ross Kirsling  <ross.kirsling@sony.com>
4967
4968         Invalid flags in a RegExp literal should be an early SyntaxError
4969         https://bugs.webkit.org/show_bug.cgi?id=195514
4970
4971         Reviewed by Darin Adler.
4972
4973         * test262/expectations.yaml:
4974         Mark 4 test cases as passing.
4975
4976         * stress/regexp-syntax-error-invalid-flags.js:
4977         * stress/regress-161995.js: Removed.
4978         Update existing test, merging in an older test for the same behavior.
4979
4980 2019-03-08  Mark Lam  <mark.lam@apple.com>
4981
4982         Stack overflow crash in JSC::JSObject::hasInstance.
4983         https://bugs.webkit.org/show_bug.cgi?id=195458
4984         <rdar://problem/48710195>
4985
4986         Reviewed by Yusuke Suzuki.
4987
4988         * stress/stack-overflow-in-custom-hasInstance.js: Added.
4989
4990 2019-03-08  Tadeu Zagallo  <tzagallo@apple.com>
4991
4992         op_check_tdz does not def its argument
4993         https://bugs.webkit.org/show_bug.cgi?id=192880
4994         <rdar://problem/46221598>
4995
4996         Reviewed by Saam Barati.
4997
4998         * microbenchmarks/let-for-in.js: Added.
4999         (foo):
5000
5001 2019-03-07  Yusuke Suzuki  <ysuzuki@apple.com>
5002
5003         [JSC] StringFromCharCode fast path should accept 0xff in DFG and FTL
5004         https://bugs.webkit.org/show_bug.cgi?id=195429
5005
5006         Reviewed by Saam Barati.
5007
5008         * stress/must-handled-values-should-not-be-used-as-proven-constants-in-cfa.js: Added.
5009         (foo):
5010         * stress/string-from-char-code-255.js: Added.
5011
5012 2019-03-06  Mark Lam  <mark.lam@apple.com>
5013
5014         Fix incorrect handling of try-finally completion values.
5015         https://bugs.webkit.org/show_bug.cgi?id=195131
5016         <rdar://problem/46222079>
5017
5018         Reviewed by Saam Barati and Yusuke Suzuki.
5019
5020         Added many permutations of new test case to test-finally.js.  test-finally.js has
5021         been run on Chrome and Firefox as a sanity check, and we confirmed that all the
5022         tests passes there as well.
5023
5024         * stress/test-finally.js:
5025
5026 2019-03-06  Saam Barati  <sbarati@apple.com>
5027
5028         Air::reportUsedRegisters must padInterference
5029         https://bugs.webkit.org/show_bug.cgi?id=195303
5030         <rdar://problem/48270343>
5031
5032         Reviewed by Keith Miller.
5033
5034         * stress/optional-def-arg-width-should-be-both-early-and-late-use.js: Added.
5035
5036 2019-03-06  Yusuke Suzuki  <ysuzuki@apple.com>
5037
5038         [JSC] AI should not propagate AbstractValue relying on constant folding phase
5039         https://bugs.webkit.org/show_bug.cgi?id=195375
5040
5041         Reviewed by Saam Barati.
5042
5043         * stress/make-rope-should-not-propagate-constant-folded-value-in-ai.js: Added.
5044         (let.array):
5045
5046 2019-03-05  Saam barati  <sbarati@apple.com>
5047
5048         op_switch_char broken for rope strings after JSRopeString layout rewrite
5049         https://bugs.webkit.org/show_bug.cgi?id=195339
5050         <rdar://problem/48592545>
5051
5052         Reviewed by Yusuke Suzuki.
5053
5054         * stress/switch-on-char-llint-rope.js: Added.
5055
5056 2019-03-04  Yusuke Suzuki  <ysuzuki@apple.com>
5057
5058         [JSC] Store bits for JSRopeString in 3 stores
5059         https://bugs.webkit.org/show_bug.cgi?id=195234
5060
5061         Reviewed by Saam Barati.
5062
5063         * stress/null-rope-and-collectors.js: Added.
5064
5065 2019-03-01  Dominik Infuehr  <dinfuehr@igalia.com>
5066
5067         Unskip test read-dead-bytecode-locals-in-must-have-handle-values2.js on ARM/MIPS
5068         https://bugs.webkit.org/show_bug.cgi?id=195207
5069
5070         Unreviewed. After test runtime was reduced in r242213, test can be
5071         run again on ARM/MIPS.
5072
5073         * stress/read-dead-bytecode-locals-in-must-handle-values2.js:
5074
5075 2019-02-28  Yusuke Suzuki  <ysuzuki@apple.com>
5076
5077         [JSC] sizeof(JSString) should be 16
5078         https://bugs.webkit.org/show_bug.cgi?id=194375
5079
5080         Reviewed by Saam Barati.
5081
5082         * microbenchmarks/make-rope.js: Added.
5083         (makeRope):
5084         * stress/to-lower-case-intrinsic-on-empty-rope.js: We no longer allow 0 length JSString except for jsEmptyString singleton per VM.
5085         (returnRope.helper): Deleted.
5086         (returnRope): Deleted.
5087
5088 2019-02-28  Yusuke Suzuki  <ysuzuki@apple.com>
5089
5090         Unreviewed, reduce the count in the stress/read-dead-bytecode-locals-in-must-handle-values2.js
5091         https://bugs.webkit.org/show_bug.cgi?id=195144
5092
5093         1e8 takes too much time in the Debug build. I tried 1e5 with the old Debug build and it successfully reproduced the issue.
5094         Change the number from 1e8 to 1e5.
5095
5096         * stress/read-dead-bytecode-locals-in-must-handle-values2.js:
5097         (foo):
5098
5099 2019-02-28  Dominik Infuehr  <dinfuehr@igalia.com>
5100
5101         Test times out on ARM/MIPS
5102         https://bugs.webkit.org/show_bug.cgi?id=195168
5103
5104         Unreviewed. Skip test on ARM/MIPS.
5105
5106         * stress/read-dead-bytecode-locals-in-must-handle-values2.js:
5107
5108 2019-02-27  Mark Lam  <mark.lam@apple.com>
5109
5110         The parser is failing to record the token location of new in new.target.
5111         https://bugs.webkit.org/show_bug.cgi?id=195127
5112         <rdar://problem/39645578>
5113
5114         Reviewed by Yusuke Suzuki.
5115
5116         * stress/parser-should-record-token-location-of-new-dot-target.js: Added.
5117
5118 2019-02-27  Yusuke Suzuki  <ysuzuki@apple.com>
5119
5120         [JSC] mustHandleValues for dead bytecode locals should be ignored in DFG phases
5121         https://bugs.webkit.org/show_bug.cgi?id=195144
5122         <rdar://problem/47595961>
5123
5124         Reviewed by Mark Lam.
5125
5126         * stress/read-dead-bytecode-locals-in-must-handle-values1.js: Added.
5127         (bar):
5128         (foo):
5129         * stress/read-dead-bytecode-locals-in-must-handle-values2.js: Added.
5130         (bar):
5131         (foo):
5132
5133 2019-02-27  Robin Morisset  <rmorisset@apple.com>
5134
5135         DFG: Loop-invariant code motion (LICM) should not hoist dead code
5136         https://bugs.webkit.org/show_bug.cgi?id=194945
5137         <rdar://problem/48311657>
5138
5139         Reviewed by Mark Lam.
5140
5141         * stress/licm-dead-code.js: Added.
5142
5143 2019-02-26  Yusuke Suzuki  <ysuzuki@apple.com>
5144
5145         REGRESSION: stress/regress-178386.js is timing out on JSC debug bot
5146         https://bugs.webkit.org/show_bug.cgi?id=194677
5147         <rdar://problem/48112492>
5148
5149         Reviewed by Mark Lam.
5150
5151         Before r241233, String.fromCharCode (except for an empty string) always returns 16bit string.
5152         This makes the rope generated by padEnd 16bit. When we resolve the rope inside JSON.stringify,
5153         it immediately fails due the large size.
5154
5155         After r241233, String.fromCharCode starts returning 8bit string if possible. So the rope becomes
5156         8bit, and we successfully resolve the rope in this case. Resolving such a large rope takes long
5157         time and that is why stress/regress-178386.js starts timing out. Note that, the test fails with
5158         OOM error anyway because JSON.stringify's builder overflows with such a large string input.
5159
5160         This patch changes the test to produce 16bit string from String.fromCharCode.
5161
5162         * stress/regress-178386.js:
5163
5164 2019-02-26  Mark Lam  <mark.lam@apple.com>
5165
5166         wasmToJS() should purify incoming NaNs.
5167         https://bugs.webkit.org/show_bug.cgi?id=194807
5168         <rdar://problem/48189132>
5169
5170         Reviewed by Saam Barati.
5171
5172         * wasm/regress/wasmToJS-should-purify-NaNs.js: Added.
5173
5174 2019-02-26  Guillaume Emont  <guijemont@igalia.com>
5175
5176         [JSC] Repeat string created from Array.prototype.join() take too much memory
5177         https://bugs.webkit.org/show_bug.cgi?id=193912
5178
5179         Reviewed by Saam Barati.
5180
5181         Added a test and a microbenchmark for corner cases of
5182         Array.prototype.join() with an uninitialized array.
5183
5184         * microbenchmarks/array-prototype-join-uninitialized.js: Added.
5185         * stress/array-prototype-join-uninitialized.js: Added.
5186         (testArray):
5187         (testABC):
5188         (B):
5189         (C):
5190
5191 2019-02-22  Robin Morisset  <rmorisset@apple.com>
5192
5193         DFGBytecodeParser should not declare that a node won't clobberExit if DFGFixupPhase can later declare it does clobberExit
5194         https://bugs.webkit.org/show_bug.cgi?id=194953
5195         <rdar://problem/47595253>
5196
5197         Reviewed by Saam Barati.
5198
5199         I could not make this work without the infinite loop, so I am using a watchdog to be able to use it as a regression test.
5200
5201         * stress/has-indexed-property-with-worsening-array-mode.js: Added.
5202
5203 2019-02-19  Joseph Pecoraro  <pecoraro@apple.com>
5204
5205         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
5206         https://bugs.webkit.org/show_bug.cgi?id=172848
5207         <rdar://problem/25709212>
5208
5209         Reviewed by Mark Lam.
5210
5211         * typeProfiler/inheritance.js:
5212         Rewrite the test slightly for clarity. The hoisting was confusing.
5213
5214         * heapProfiler/class-names.js: Added.
5215         (MyES5Class):
5216         (MyES6Class):
5217         (MyES6Subclass):
5218         Test object types and improved class names.
5219
5220         * heapProfiler/driver/driver.js:
5221         (CheapHeapSnapshotNode):
5222         (CheapHeapSnapshot):
5223         (createCheapHeapSnapshot):
5224         (HeapSnapshot):
5225         (createHeapSnapshot):
5226         Update snapshot parsing from version 1 to version 2.
5227
5228 2019-02-19  Truitt Savell  <tsavell@apple.com>
5229
5230         Unreviewed, rolling out r241784.
5231
5232         Broke all OpenSource builds.
5233
5234         Reverted changeset:
5235
5236         "Web Inspector: Improve ES6 Class instances in Heap Snapshot
5237         instances view"
5238         https://bugs.webkit.org/show_bug.cgi?id=172848
5239         https://trac.webkit.org/changeset/241784
5240
5241 2019-02-19  Joseph Pecoraro  <pecoraro@apple.com>
5242
5243         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
5244         https://bugs.webkit.org/show_bug.cgi?id=172848
5245         <rdar://problem/25709212>
5246
5247         Reviewed by Mark Lam.
5248
5249         * typeProfiler/inheritance.js:
5250         Rewrite the test slightly for clarity. The hoisting was confusing.
5251
5252         * heapProfiler/class-names.js: Added.
5253         (MyES5Class):
5254         (MyES6Class):
5255         (MyES6Subclass):
5256         Test object types and improved class names.
5257
5258         * heapProfiler/driver/driver.js:
5259         (CheapHeapSnapshotNode):
5260         (CheapHeapSnapshot):
5261         (createCheapHeapSnapshot):
5262         (HeapSnapshot):
5263         (createHeapSnapshot):
5264         Update snapshot parsing from version 1 to version 2.
5265
5266 2019-02-18  Dominik Infuehr  <dinfuehr@igalia.com>
5267
5268         [ARM] Fix crash with sampling profiler
5269         https://bugs.webkit.org/show_bug.cgi?id=194772
5270
5271         Reviewed by Mark Lam.
5272
5273         Do not skip test since crash with sampling profiler is now fixed.
5274
5275         * stress/sampling-profiler-richards.js:
5276
5277 2019-02-18  Yusuke Suzuki  <ysuzuki@apple.com>
5278
5279         [JSC] Add LazyClassStructure::getInitializedOnMainThread
5280         https://bugs.webkit.org/show_bug.cgi?id=194784
5281         <rdar://problem/48154820>
5282
5283         Reviewed by Mark Lam.
5284
5285         * stress/lazy-initialization-done-a-priori-if-jit-enabled.js: Added.
5286         (getProperties):
5287         (getRandomProperty):
5288         (i.catch):
5289
5290 2019-02-18  Dominik Infuehr  <dinfuehr@igalia.com>
5291
5292         [ARM] Test gardening: Test running out of executable memory
5293         https://bugs.webkit.org/show_bug.cgi?id=194771
5294
5295         Unreviewed. Do not run test without LLInt, test is running out of executable
5296         memory on ARM otherwise.
5297
5298         * stress/tagged-template-object-collect.js:
5299
5300 2019-02-18  Tomas Popela  <tpopela@redhat.com>
5301
5302         Unreviewed, skip the test on platforms without sampling profiler
5303
5304         * stress/sampling-profiler-stack-trace-with-double-quote-in-function-name.js:
5305         (platformSupportsSamplingProfiler.foo):
5306         (platformSupportsSamplingProfiler.test):
5307         (platformSupportsSamplingProfiler):
5308         (foo): Deleted.
5309         (test): Deleted.
5310
5311 2019-02-17  Saam Barati  <sbarati@apple.com>
5312
5313         Deadlock when adding a Structure property transition and then doing incremental marking
5314         https://bugs.webkit.org/show_bug.cgi?id=194767
5315
5316         Reviewed by Mark Lam.
5317
5318         * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js: Added.
5319
5320 2019-02-15  Michael Saboff  <msaboff@apple.com>
5321
5322         RELEASE_ASSERT at com.apple.JavaScriptCore: JSC::jsSubstringOfResolved
5323         https://bugs.webkit.org/show_bug.cgi?id=194558
5324
5325         Reviewed by Saam Barati.
5326
5327         New regression test.
5328
5329         * stress/regexp-unicode-within-string.js: Added.
5330
5331 2019-02-15  Mark Lam  <mark.lam@apple.com>
5332
5333         SamplingProfiler::stackTracesAsJSON() should escape strings.
5334         https://bugs.webkit.org/show_bug.cgi?id=194649
5335         <rdar://problem/48072386>
5336
5337         Reviewed by Saam Barati.
5338
5339         * stress/sampling-profiler-stack-trace-with-double-quote-in-function-name.js: Added.
5340         * stress/type-profiler-with-double-quote-in-constructor-name.js: Added.
5341         * stress/type-profiler-with-double-quote-in-field-name.js: Added.
5342         * stress/type-profiler-with-double-quote-in-optional-field-name.js: Added.
5343
5344 2019-02-15  Robin Morisset  <rmorisset@apple.com>
5345         CodeBlock::jettison should clear related watchpoints
5346         https://bugs.webkit.org/show_bug.cgi?id=194544
5347
5348         Reviewed by Mark Lam.
5349
5350         * stress/regexp-replace-double-watchpoint.js: Added.
5351         (foo):
5352
5353 2019-02-15  Saam barati  <sbarati@apple.com>
5354
5355         [WebAssembly] Write a new register allocator for Air O0 and make BBQ use it
5356         https://bugs.webkit.org/show_bug.cgi?id=194036
5357
5358         Reviewed by Yusuke Suzuki.
5359
5360         * stress/tail-call-many-arguments.js: Added.
5361         (foo):
5362         (bar):
5363
5364 2019-02-14  Saam Barati  <sbarati@apple.com>
5365
5366         Cache the results of BytecodeGenerator::getVariablesUnderTDZ
5367         https://bugs.webkit.org/show_bug.cgi?id=194583
5368         <rdar://problem/48028140>
5369
5370         Reviewed by Yusuke Suzuki.
5371
5372         * microbenchmarks/cache-get-variables-under-tdz-in-bytecode-generator.js: Added.
5373
5374 2019-02-08  Yusuke Suzuki  <ysuzuki@apple.com>
5375
5376         [JSC] String.fromCharCode's slow path always generates 16bit string
5377         https://bugs.webkit.org/show_bug.cgi?id=194466
5378
5379         Reviewed by Keith Miller.
5380
5381         * stress/string-from-char-code-slow-path.js: Added.
5382         (shouldBe):
5383         (testWithLength):
5384
5385 2019-02-08  Saam barati  <sbarati@apple.com>
5386
5387         Nodes that rely on being dominated by CheckInBounds should have a child edge to it
5388         https://bugs.webkit.org/show_bug.cgi?id=194334
5389         <rdar://problem/47844327>
5390
5391         Reviewed by Mark Lam.
5392
5393         * stress/check-in-bounds-should-be-a-child-use.js: Added.
5394         (func):
5395
5396 2019-02-06  Yusuke Suzuki  <ysuzuki@apple.com>
5397
5398         [JSC] InitializeEntrypointArguments should produce SpecCellCheck if FlushFormat is FlushedCell
5399         https://bugs.webkit.org/show_bug.cgi?id=194369
5400         <rdar://problem/47813087>
5401
5402         Reviewed by Saam Barati.
5403
5404         * stress/initialize-entrypoint-arguments-with-tdz.js: Added.
5405         (A):
5406
5407 2019-02-06  Yusuke Suzuki  <ysuzuki@apple.com>
5408
5409         [JSC] PrivateName to PublicName hash table is wasteful
5410         https://bugs.webkit.org/show_bug.cgi?id=194277
5411
5412         Reviewed by Michael Saboff.
5413
5414         This test depends on the order of JSSegmentedVariableObjects' variables, which is not guaranteed in JSC. Skipped.
5415
5416         * ChakraCore.yaml:
5417
5418 2019-02-05  Dominik Infuehr  <dinfuehr@igalia.com>
5419
5420         [ARM] Test running out of executable memory
5421         https://bugs.webkit.org/show_bug.cgi?id=194285
5422
5423         Unreviewed. Do no execute test with LLInt disabled, test runs out of
5424         executable memory otherwise.
5425
5426         * stress/class-subclassing-function.js:
5427
5428 2019-02-04  Robin Morisset  <rmorisset@apple.com>
5429
5430         when lowering AssertNotEmpty, create the value before creating the patchpoint
5431         https://bugs.webkit.org/show_bug.cgi?id=194231
5432
5433         Reviewed by Saam Barati.
5434
5435         This test is painfully fragile: it tries to test that AssertNotEmpty on a constant produces valid B3 IR.
5436         The problem is that AssertNotEmpty is only created by DFGConstantFolding when it can simplify a CheckStructure, and constant folding is a bit capricious (https://bugs.webkit.org/show_bug.cgi?id=133947)
5437         So even tiny changes to this test can change the path code taken.
5438
5439         * stress/assert-not-empty.js: Added.
5440         (foo):
5441
5442 2019-02-01  Mark Lam  <mark.lam@apple.com>
5443
5444         Remove invalid assertion in DFG's compileDoubleRep().
5445         https://bugs.webkit.org/show_bug.cgi?id=194130
5446         <rdar://problem/47699474>
5447
5448         Reviewed by Saam Barati.
5449
5450         * stress/constant-fold-double-rep-into-double-constant.js: Added.
5451
5452 2019-01-30  Ross Kirsling  <ross.kirsling@sony.com>
5453
5454         Import latest Test262 updates.
5455
5456         Rubber-stamped by Keith Miller.
5457
5458         * test262.yaml: Deleted.
5459         * test262/config.yaml:
5460         * test262/expectations.yaml:
5461         * test262/latest-changes-summary.txt:
5462         * test262/test/:
5463         * test262/test262-Revision.txt:
5464
5465 2019-01-30  Robin Morisset  <rmorisset@apple.com>
5466
5467         Object.keys can now lead to a PhantomNewArrayBuffer, OSR exit from the FTL should know how to materialize a NewArrayBuffer in that case
5468         https://bugs.webkit.org/show_bug.cgi?id=194050
5469         <rdar://problem/47595592>
5470
5471         Reviewed by Yusuke Suzuki.
5472
5473         * stress/object-keys-osr-exit.js: Added.
5474         (foo):
5475         (catch):
5476
5477 2019-01-29  Mark Lam  <mark.lam@apple.com>
5478
5479         ValueRecovery::recover() should purify NaN values it recovers.
5480         https://bugs.webkit.org/show_bug.cgi?id=193978
5481         <rdar://problem/47625488>
5482
5483         Reviewed by Saam Barati.
5484
5485         * stress/value-recovery-of-double-displaced-in-jsstack-should-be-purified.js: Added.
5486
5487 2019-01-28  Yusuke Suzuki  <ysuzuki@apple.com>
5488
5489         Unreviewed, fix the test after r240543 not to use @Error / Error in builtins
5490         https://bugs.webkit.org/show_bug.cgi?id=193713
5491
5492         * stress/try-get-by-id-should-spill-registers-dfg.js:
5493         (let.f.createBuiltin):
5494
5495 2019-01-28  Mark Lam  <mark.lam@apple.com>
5496
5497         ToString node actually does GC.
5498         https://bugs.webkit.org/show_bug.cgi?id=193920
5499         <rdar://problem/46695900>
5500
5501         Reviewed by Yusuke Suzuki.
5502
5503         * stress/dfg-to-string-on-int-does-gc.js: Added.
5504         * stress/dfg-to-string-on-string-object-does-not-gc.js: Added.
5505         * stress/dfg-to-string-on-string-or-string-object-does-not-gc.js: Added.
5506
5507 2019-01-25  Yusuke Suzuki  <ysuzuki@apple.com>
5508
5509         [JSC] NativeErrorConstructor should not have own IsoSubspace
5510         https://bugs.webkit.org/show_bug.cgi?id=193713
5511
5512         Reviewed by Saam Barati.
5513
5514         Remove @Error use.
5515
5516         * stress/try-get-by-id-should-spill-registers-dfg.js:
5517         (let.f.createBuiltin):
5518
5519 2019-01-24  Yusuke Suzuki  <ysuzuki@apple.com>
5520
5521         stress/const-semantics.js fails a dfg-eager / ftl-eager run with an ASAN release build.
5522         https://bugs.webkit.org/show_bug.cgi?id=190693
5523
5524         Reviewed by Michael Saboff.
5525
5526         * stress/regress-190693.js: Added.
5527         (truth):
5528         (assert):
5529         (shouldThrowInvalidConstAssignment):
5530         (taz):
5531
5532 2019-01-24  Saam Barati  <sbarati@apple.com>
5533
5534         Object Allocation Sinking phase can move a node that walks the stack into a place where the InlineCallFrame is no longer valid
5535         https://bugs.webkit.org/show_bug.cgi?id=193751
5536         <rdar://problem/47280215>
5537
5538         Reviewed by Michael Saboff.
5539
5540         * stress/object-allocation-sinking-phase-must-only-move-allocations-if-stack-trace-is-still-valid.js: Added.
5541         (let.thing):
5542         (foo.let.hello):
5543         (foo):
5544
5545 2019-01-24  Guillaume Emont  <guijemont@igalia.com>
5546
5547         [JSC] Reenable baseline JIT on mips
5548         https://bugs.webkit.org/show_bug.cgi?id=192983
5549
5550         Reviewed by Mark Lam.
5551
5552         Added a new test for a case that was triggering a RELEASE_ASSERT when
5553         testing.
5554         Disable some slow tests that were already disabled for arm and x86.
5555
5556         * stress/json-parse-big-object.js: Added.
5557         * stress/new-largeish-contiguous-array-with-size.js:
5558         * stress/op_add.js:
5559         * stress/op_bitand.js:
5560         * stress/op_bitor.js:
5561         * stress/op_bitxor.js:
5562         * stress/op_lshift-ConstVar.js:
5563         * stress/op_lshift-VarConst.js:
5564         * stress/op_lshift-VarVar.js:
5565         * stress/op_mod-ConstVar.js:
5566         * stress/op_mod-VarConst.js:
5567         * stress/op_mod-VarVar.js:
5568         * stress/op_mul-ConstVar.js:
5569         * stress/op_mul-VarConst.js:
5570         * stress/op_mul-VarVar.js:
5571         * stress/op_rshift-ConstVar.js:
5572         * stress/op_rshift-VarConst.js:
5573         * stress/op_rshift-VarVar.js:
5574         * stress/op_sub-ConstVar.js:
5575         * stress/op_sub-VarConst.js:
5576         * stress/op_sub-VarVar.js:
5577         * stress/op_urshift-ConstVar.js:
5578         * stress/op_urshift-VarConst.js:
5579         * stress/op_urshift-VarVar.js:
5580         * stress/sampling-profiler-richards.js:
5581         * stress/spread-forward-call-varargs-stack-overflow.js:
5582
5583 2019-01-23  Yusuke Suzuki  <ysuzuki@apple.com>
5584
5585         [DFG] AvailabilityMap::pruneByLiveness should make non-live operands Availability::unavailable instead of Availability()
5586         https://bugs.webkit.org/show_bug.cgi?id=193711
5587         <rdar://problem/47250262>
5588
5589         Reviewed by Saam Barati.
5590
5591         * stress/availability-was-cleared-when-locals-are-not-live.js: Added.
5592         (shouldBe):
5593         (foo):
5594         (bar):
5595         (baz):
5596
5597 2019-01-22  Yusuke Suzuki  <ysuzuki@apple.com>
5598
5599         Unreviewed, fix initial global lexical binding epoch
5600         https://bugs.webkit.org/show_bug.cgi?id=193603
5601         <rdar://problem/47380869>
5602
5603         * stress/global-lexical-binding-epoch-should-be-correct-one.js: Added.
5604         (f1.f2.f3.f4):
5605         (f1.f2.f3):
5606         (f1.f2):
5607         (f1):
5608
5609 2019-01-22  Yusuke Suzuki  <ysuzuki@apple.com>
5610
5611         REGRESSION(r239612) Crash at runtime due to broken DFG assumption
5612         https://bugs.webkit.org/show_bug.cgi?id=193709
5613         <rdar://problem/47363838>
5614
5615         Unreviewed, rollout to watch the tests.
5616
5617         * stress/object-tostring-changed-proto.js: Removed.
5618         * stress/object-tostring-changed.js: Removed.
5619         * stress/object-tostring-misc.js: Removed.
5620         * stress/object-tostring-other.js: Removed.
5621         * stress/object-tostring-untyped.js: Removed.
5622
5623 2019-01-22  Saam Barati  <sbarati@apple.com>
5624
5625         Unreviewed. Rollout r240223. It regressed JetStream2 by 1%.
5626
5627         * stress/arith-abs-to-arith-negate-range-optimizaton.js:
5628         (testUncheckedBetweenIntMinInclusiveAndZeroExclusive):
5629         (testUncheckedLessThanZero):
5630         (testUncheckedLessThanOrEqualZero):
5631         * stress/movhint-backwards-propagation-must-merge-use-as-value-add.js: Removed.
5632         * stress/movhint-backwards-propagation-must-merge-use-as-value.js: Removed.
5633
5634 2019-01-22  Yusuke Suzuki  <ysuzuki@apple.com>
5635
5636         [JSC] Invalidate old scope operations using global lexical binding epoch
5637         https://bugs.webkit.org/show_bug.cgi?id=193603
5638         <rdar://problem/47380869>
5639
5640         Reviewed by Saam Barati.
5641
5642         * stress/let-lexical-binding-shadow-existing-global-property-ftl.js:
5643         * stress/scope-operation-cache-global-property-before-deleting.js: Added.
5644         (shouldThrow):
5645         (bar):
5646         * stress/scope-operation-cache-global-property-bump-counter.js: Added.
5647         (shouldBe):
5648         (get1):
5649         (get2):
5650         (get1If):
5651         (get2If):
5652         * stress/scope-operation-cache-global-property-even-if-it-fails.js: Added.
5653         (shouldThrow):
5654         (foo):
5655
5656 2019-01-21  Yusuke Suzuki  <ysuzuki@apple.com>
5657
5658         Unreviewed, roll out r240220 due to date-format-xparb regression
5659         https://bugs.webkit.org/show_bug.cgi?id=193603
5660
5661         * stress/let-lexical-binding-shadow-existing-global-property-ftl.js:
5662         * stress/scope-operation-cache-global-property-before-deleting.js: Removed.
5663         * stress/scope-operation-cache-global-property-bump-counter.js: Removed.
5664         * stress/scope-operation-cache-global-property-even-if-it-fails.js: Removed.
5665
5666 2019-01-21  Caio Lima  <ticaiolima@gmail.com>
5667
5668         DoesGC rule is wrong for nodes with BigIntUse
5669         https://bugs.webkit.org/show_bug.cgi?id=193652
5670
5671         Reviewed by Saam Barati.
5672
5673         * stress/big-int-value-op-update-gc-rules.js: Added.
5674         (assert):
5675         (doesGCAdd):
5676         (doesGCSub):
5677         (doesGCDiv):
5678         (doesGCMul):
5679         (doesGCBitAnd):
5680         (doesGCBitOr):
5681         (doesGCBitXor):
5682
5683 2019-01-20  Saam Barati  <sbarati@apple.com>
5684
5685         DFG: When inlining DataView set* intrinsics we need to set undefined as our result
5686         https://bugs.webkit.org/show_bug.cgi?id=193644
5687         <rdar://problem/46209745>
5688
5689         Reviewed by Yusuke Suzuki.
5690
5691         * stress/data-view-set-intrinsic-undefined-result-2.js: Added.
5692         (foo):
5693         * stress/data-view-set-intrinsic-undefined-result.js: Added.
5694         (foo):
5695         (bar):
5696
5697 2019-01-20  Saam Barati  <sbarati@apple.com>
5698
5699         MovHint must merge NodeBytecodeUsesAsValue for its child
5700         https://bugs.webkit.org/show_bug.cgi?id=186916
5701         <rdar://problem/41396612>
5702
5703         Reviewed by Yusuke Suzuki.
5704
5705         * stress/arith-abs-to-arith-negate-range-optimizaton.js:
5706         * stress/movhint-backwards-propagation-must-merge-use-as-value.js: Added.
5707
5708 2019-01-20  Yusuke Suzuki  <ysuzuki@apple.com>
5709
5710         [JSC] Invalidate old scope operations using global lexical binding epoch
5711         https://bugs.webkit.org/show_bug.cgi?id=193603
5712         <rdar://problem/47380869>
5713
5714         Reviewed by Saam Barati.
5715
5716         * stress/let-lexical-binding-shadow-existing-global-property-ftl.js:
5717         * stress/scope-operation-cache-global-property-before-deleting.js: Added.
5718         (shouldThrow):
5719         (bar):
5720         * stress/scope-operation-cache-global-property-bump-counter.js: Added.
5721         (shouldBe):
5722         (get1):
5723         (get2):
5724         (get1If):
5725         (get2If):
5726         * stress/scope-operation-cache-global-property-even-if-it-fails.js: Added.
5727         (shouldThrow):
5728         (foo):
5729
5730 2019-01-17  Saam barati  <sbarati@apple.com>
5731
5732         StringObjectUse should not be a structure check for the original string object structure
5733         https://bugs.webkit.org/show_bug.cgi?id=193483
5734         <rdar://problem/47280522>
5735
5736         Reviewed by Yusuke Suzuki.
5737
5738         * stress/cant-eliminate-string-object-structure-check-when-string-object-is-proven.js: Added.
5739         (foo):
5740         (a.valueOf.0):
5741
5742 2019-01-17  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
5743
5744         [JSC] ToThis omission in DFGByteCodeParser is wrong
5745         https://bugs.webkit.org/show_bug.cgi?id=193513
5746         <rdar://problem/45842236>
5747
5748         Reviewed by Saam Barati.
5749
5750         * stress/to-this-omission-with-different-strict-modes.js: Added.
5751         (thisA):
5752         (thisAStrictWrapper):
5753
5754 2019-01-15  Mark Lam  <mark.lam@apple.com>
5755
5756         JSFunction::canUseAllocationProfile() should account for builtin functions with no own prototypes.
5757         https://bugs.webkit.org/show_bug.cgi?id=193423
5758         <rdar://problem/46209355>
5759
5760         Reviewed by Saam Barati.
5761
5762         * microbenchmarks/sinkable-new-object-with-builtin-constructor.js: Added.
5763         * stress/constructing-builtin-functions-with-getter-prototype-should-only-call-getter-once-per-new-1.js: Added.
5764         * stress/constructing-builtin-functions-with-getter-prototype-should-only-call-getter-once-per-new-2.js: Added.
5765         * stress/jsfunction-cannot-use-allocation-profile-with-builtin-functions-with-no-prototype.js: Added.
5766
5767 2019-01-15  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
5768
5769         [JSC] Use KnownStringUse for GetByVal(Array::String) since AI would offer wider type information and offer non-string type after removing Check(String)
5770         https://bugs.webkit.org/show_bug.cgi?id=193438
5771         <rdar://problem/45581249>
5772
5773         Reviewed by Saam Barati and Keith Miller.
5774
5775         Under the heavy load (like, compiling WebKit), AI in this code can broaden type information after the 1st run.
5776         Then, GetByVal(String) crashed.
5777
5778         * stress/string-get-by-val-lowering.js: Added.
5779         (shouldBe):
5780         (test):
5781         * stress/type-for-get-by-val-can-be-widen-after-ai.js: Added.
5782         (Hello):
5783         (foo):
5784
5785 2019-01-15  Tomas Popela  <tpopela@redhat.com>
5786
5787         Unreviewed, skip JIT tests if it's not enabled
5788
5789         * stress/bit-op-with-object-returning-int32.js:
5790
5791 2019-01-15  Caio Lima  <ticaiolima@gmail.com>
5792
5793         DFGByteCodeParser rules for bitwise operations should consider type of their operands
5794         https://bugs.webkit.org/show_bug.cgi?id=192966
5795
5796         Reviewed by Yusuke Suzuki.
5797
5798         * stress/bit-op-with-object-returning-int32.js: Added.
5799
5800 2019-01-15  Guillaume Emont  <guijemont@igalia.com>
5801
5802         Skip a slow test and a flakey test on arm
5803
5804         Unreviewed gardening.
5805
5806         * typeProfiler/getter-richards.js:
5807         this test always times out, it used to be always skipped on arm and
5808         mips, but got accidentally enabled by r237919 now that we have DFG on
5809         arm. Also skipping on mips as we plan to soon enable DFG for it too.
5810
5811 2019-01-14  Keith Miller  <keith_miller@apple.com>
5812
5813         Skip type-check-hoisting-phase-hoist... with no jit
5814         https://bugs.webkit.org/show_bug.cgi?id=193421
5815
5816         Reviewed by Mark Lam.
5817
5818         It's timing out the 32-bit bots and takes 330 seconds
5819         on my machine when run by itself.
5820
5821         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js:
5822
5823 2019-01-14  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
5824
5825         [JSC] AI should check the given constant's array type when folding GetByVal into constant
5826         https://bugs.webkit.org/show_bug.cgi?id=193413
5827         <rdar://problem/46092389>
5828
5829         Reviewed by Keith Miller.
5830
5831         This test is super flaky. It causes crash in r238109, but it does not crash with `--useConcurrentJIT=false`.
5832         It does not cause any crashes on the latest revision too. Basically, it highly depends on the timing, and
5833         without this patch, the root cause is not fixed yet. If GetLocal is turned into JSConstant in AI,
5834         but GetByVal does not have appropriate ArrayModes, JSC crashes.
5835
5836         * stress/ai-should-perform-array-check-on-get-by-val-constant-folding.js: Added.
5837         (compareArray):
5838
5839 2019-01-14  Caio Lima  <ticaiolima@gmail.com>
5840
5841         [BigInt] Literal parsing is crashing when used inside a Object Literal
5842         https://bugs.webkit.org/show_bug.cgi?id=193404
5843
5844         Reviewed by Yusuke Suzuki.
5845
5846         * stress/big-int-literal-inside-literal-object.js: Added.
5847
5848 2019-01-14  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
5849
5850         [JSC] Do not use asArrayModes() with Structures because it discards TypedArray information
5851         https://bugs.webkit.org/show_bug.cgi?id=193372
5852
5853         Reviewed by Saam Barati.
5854
5855         * stress/typed-array-array-modes-profile.js: Added.
5856         (foo):
5857
5858 2019-01-14  Mark Lam  <mark.lam@apple.com>
5859
5860         Fix all CLoop JSC test failures (including some LLInt bugs due to recent bytecode format change).
5861         https://bugs.webkit.org/show_bug.cgi?id=193402
5862         <rdar://problem/46012309>
5863
5864         Reviewed by Keith Miller.
5865
5866         * stress/regexp-compile-oom.js:
5867         - Skip this test for !$jitTests because it is tuned for stack usage when the JIT
5868           is enabled.  As a result, it will fail on cloop builds though there is no bug.
5869
5870 2019-01-11  Saam barati  <sbarati@apple.com>
5871
5872         DFG combined liveness can be wrong for terminal basic blocks
5873         https://bugs.webkit.org/show_bug.cgi?id=193304
5874         <rdar://problem/45268632>
5875
5876         Reviewed by Yusuke Suzuki.
5877
5878         * stress/dfg-combined-liveness-consider-terminal-blocks-bytecode-liveness.js: Added.
5879
5880 2019-01-11  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
5881
5882         [JSC] Global lexical bindings can shadow global variables if it is `configurable = true`
5883         https://bugs.webkit.org/show_bug.cgi?id=193308
5884         <rdar://problem/45546542>
5885
5886         Reviewed by Saam Barati.
5887
5888         * stress/const-lexical-binding-shadow-existing-global-property-ftl.js: Added.
5889         (shouldThrow):
5890         (shouldBe):
5891         (foo):
5892         (get shouldThrow):
5893         * stress/const-lexical-binding-shadow-existing-global-property-tdz-ftl.js: Added.
5894         (shouldThrow):
5895         (shouldBe):
5896         (foo):
5897         (get shouldBe):
5898         (get shouldThrow):
5899         (get return):
5900         * stress/const-lexical-binding-shadow-existing-global-property-tdz.js: Added.
5901         (shouldThrow):
5902         (shouldBe):
5903         (foo):
5904         (get shouldBe):
5905         (get shouldThrow):
5906         * stress/const-lexical-binding-shadow-existing-global-property.js: Added.
5907         (shouldThrow):
5908         (shouldBe):
5909         (foo):
5910         * stress/const-lexical-binding-shadowing-global-properties-and-eval-injection.js: Added.
5911         (shouldThrow):
5912         (shouldBe):
5913         (foo):
5914         * stress/global-add-function-should-not-be-shadowed-by-lexical-bindings.js: Added.
5915         (shouldThrow):
5916         * stress/global-static-variables-should-not-be-shadowed-by-lexical-bindings.js: Added.
5917         (shouldThrow):
5918         * stress/let-lexical-binding-shadow-existing-global-property-ftl.js: Added.
5919         (shouldThrow):
5920         (shouldBe):
5921         (foo):
5922         * stress/let-lexical-binding-shadow-existing-global-property-tdz-ftl.js: Added.
5923         (shouldThrow):
5924         (shouldBe):
5925         (foo):
5926         (get shouldBe):
5927         (get shouldThrow):
5928         (get return):
5929         * stress/let-lexical-binding-shadow-existing-global-property-tdz.js: Added.
5930         (shouldThrow):
5931         (shouldBe):
5932         (foo):
5933         (get shouldBe):
5934         (get shouldThrow):
5935         * stress/let-lexical-binding-shadow-existing-global-property.js: Added.
5936         (shouldThrow):
5937         (shouldBe):
5938         (foo):
5939         * stress/let-lexical-binding-shadowing-global-properties-and-eval-injection.js: Added.
5940         (shouldThrow):
5941         (shouldBe):
5942         (foo):
5943
5944 2019-01-11  Dominik Infuehr  <dinfuehr@igalia.com>
5945
5946         Enable DFG on ARM/Linux again
5947         https://bugs.webkit.org/show_bug.cgi?id=192496
5948
5949         Reviewed by Yusuke Suzuki.
5950
5951         Test wasn't really skipped before moving the line with skip
5952         to the top.
5953
5954         * stress/regress-192717.js:
5955
5956 2019-01-10  Commit Queue  <commit-queue@webkit.org>
5957
5958         Unreviewed, rolling out r239825.
5959         https://bugs.webkit.org/show_bug.cgi?id=193330
5960
5961         Broke tests on armv7/linux bots (Requested by guijemont on
5962         #webkit).
5963
5964         Reverted changeset:
5965
5966         "Enable DFG on ARM/Linux again"
5967         https://bugs.webkit.org/show_bug.cgi?id=192496
5968         https://trac.webkit.org/changeset/239825
5969
5970 2019-01-10  Dominik Infuehr  <dinfuehr@igalia.com>
5971
5972         Enable DFG on ARM/Linux again
5973         https://bugs.webkit.org/show_bug.cgi?id=192496
5974
5975         Reviewed by Yusuke Suzuki.
5976
5977         Test wasn't really skipped before moving the line with skip
5978         to the top.
5979
5980         * stress/regress-192717.js:
5981
5982 2019-01-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
5983
5984         Array.prototype.flat/flatMap have a minor bug in ArraySpeciesCreate
5985         https://bugs.webkit.org/show_bug.cgi?id=193127
5986
5987         Reviewed by Saam Barati.
5988
5989         * stress/array-species-create-should-handle-masquerader.js: Added.
5990         (shouldThrow):
5991         * stress/is-undefined-or-null-builtin.js: Added.
5992         (shouldBe):
5993         (isUndefinedOrNull.vm.createBuiltin):
5994
5995 2019-01-08  Tadeu Zagallo  <tzagallo@apple.com>
5996
5997         LLInt put_by_id uses the wrong load instruction for loading flags from the metadata
5998         https://bugs.webkit.org/show_bug.cgi?id=193221
5999
6000         Reviewed by Mark Lam.
6001
6002         * stress/put-by-id-flags.js: Added.
6003         (f):
6004         (g):
6005         (numberOfDFGCompiles):
6006
6007 2019-01-04  Tadeu Zagallo  <tzagallo@apple.com>
6008
6009         Baseline version of get_by_id may corrupt metadata
6010         https://bugs.webkit.org/show_bug.cgi?id=193085
6011         <rdar://problem/23453006>
6012
6013         Reviewed by Saam Barati.
6014
6015         * stress/get-by-id-change-mode.js: Added.
6016         (forEach):
6017
6018 2019-01-02  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
6019
6020         [JSC] Optimize Object.prototype.toString
6021         https://bugs.webkit.org/show_bug.cgi?id=193031
6022
6023         Reviewed by Saam Barati.
6024
6025         * stress/object-tostring-changed-proto.js: Added.
6026         (shouldBe):
6027         (test):
6028         * stress/object-tostring-changed.js: Added.
6029         (shouldBe):
6030         (test):
6031         * stress/object-tostring-misc.js: Added.
6032         (shouldBe):
6033         (test):
6034         (i.switch):
6035         * stress/object-tostring-other.js: Added.
6036         (shouldBe):
6037         (test):
6038         * stress/object-tostring-untyped.js: Added.
6039         (shouldBe):
6040         (test):
6041         (i.switch):
6042
6043 2019-01-03  Ross Kirsling  <ross.kirsling@sony.com>
6044
6045         test262-runner misbehaves when test file YAML has a trailing space
6046         https://bugs.webkit.org/show_bug.cgi?id=193053
6047
6048         Reviewed by Yusuke Suzuki.
6049
6050         * test262/expectations.yaml:
6051         Mark two dozen tests as passing (and correct the output of another).
6052
6053 2018-12-30  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
6054
6055         Unreviewed, JSTests gardening with memoryLimited
6056
6057         * stress/string-overflow-createError.js:
6058
6059 2018-12-30  Ross Kirsling  <ross.kirsling@sony.com>
6060
6061         [JSC] Identifier validity should be based on ID_Start / ID_Continue properties
6062         https://bugs.webkit.org/show_bug.cgi?id=193050
6063
6064         Reviewed by Yusuke Suzuki.
6065
6066         * test262.yaml:
6067         * test262/expectations.yaml:
6068         Mark 16 tests as passing.
6069
6070 2018-12-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
6071
6072         [BigInt] Support BigInt in JSON.stringify
6073         https://bugs.webkit.org/show_bug.cgi?id=192624
6074
6075         Reviewed by Saam Barati.
6076
6077         * stress/big-int-json-stringify-to-json.js: Added.
6078         (shouldBe):
6079         (shouldThrow):
6080         (BigInt.prototype.toJSON):
6081         (shouldBe.JSON.stringify):
6082         * stress/big-int-json-stringify.js: Added.
6083         (shouldBe):
6084         (shouldThrow):
6085
6086 2018-12-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
6087
6088         [JSC] Implement "well-formed JSON.stringify" proposal
6089         https://bugs.webkit.org/show_bug.cgi?id=191677
6090
6091         Reviewed by Darin Adler.
6092
6093         * stress/json-surrogate-pair.js: Added.
6094         (shouldBe):
6095         * test262/expectations.yaml:
6096
6097 2018-12-20  Keith Miller  <keith_miller@apple.com>
6098
6099         Add support for globalThis
6100         https://bugs.webkit.org/show_bug.cgi?id=165171
6101
6102         Reviewed by Mark Lam.
6103
6104         * test262/config.yaml:
6105
6106 2018-12-19  Keith Miller  <keith_miller@apple.com>
6107
6108         Update test262 configuration to not run tests dependent on ICU version.
6109         https://bugs.webkit.org/show_bug.cgi?id=192920
6110
6111         Reviewed by Saam Barati.
6112
6113         * test262/expectations.yaml:
6114
6115 2018-12-20  Mark Lam  <mark.lam@apple.com>
6116
6117         Fix a typo in slow_path_construct_arityCheck and operationConstructArityCheck.
6118         https://bugs.webkit.org/show_bug.cgi?id=192939
6119         <rdar://problem/46869516>
6120
6121         Reviewed by Keith Miller.
6122
6123         * stress/stack-overflow-frame-for-construct-arityCheck-should-use-construct-codeBlock.js: Added.
6124
6125 2018-12-20  Tadeu Zagallo  <tzagallo@apple.com>
6126
6127         WTF::String and StringImpl overflow MaxLength
6128         https://bugs.webkit.org/show_bug.cgi?id=192853
6129         <rdar://problem/45726906>
6130
6131         Reviewed by Mark Lam.
6132
6133         * stress/string-16bit-repeat-overflow.js: Added.
6134         (catch):
6135
6136 2018-12-19  Ross Kirsling  <ross.kirsling@sony.com>
6137
6138         Unreviewed follow-up to r192914.
6139
6140         * test262/expectations.yaml:
6141         Add the last 20 missing expectations.
6142
6143 2018-12-19  Keith Miller  <keith_miller@apple.com>
6144
6145         Fix test262 expectations
6146         https://bugs.webkit.org/show_bug.cgi?id=192914
6147
6148         Unreviewed, when I imported the latest round of test262 tests I must have failed to update the test expectations.
6149
6150         * test262/expectations.yaml:
6151
6152 2018-12-19  Keith Miller  <keith_miller@apple.com>
6153
6154         Update test262 tests.
6155         https://bugs.webkit.org/show_bug.cgi?id=192907
6156
6157         Rubber stamped by Mark Lam.
6158
6159         * test262/*: Omitted because prepare-changelog crashes.
6160
6161 2018-12-19  Mark Lam  <mark.lam@apple.com>
6162
6163         JSPropertyNameEnumerator should cache the iterated object's structure only after getting its property names.
6164         https://bugs.webkit.org/show_bug.cgi?id=192464
6165         <rdar://problem/46519455>
6166
6167         Reviewed by Saam Barati.
6168
6169         This patch is about a 10% speed up on the new for-in-on-object-with-lazily-materialized-properties.js
6170         microbenchmark.
6171
6172         * microbenchmarks/for-in-on-object-with-lazily-materialized-properties.js: Added.
6173         * stress/property-name-enumerator-should-cache-structure-after-getting-property-names.js: Added.
6174
6175 2018-12-19  Tadeu Zagallo  <tzagallo@apple.com>
6176
6177         String overflow in JSC::createError results in ASSERT in WTF::makeString
6178         https://bugs.webkit.org/show_bug.cgi?id=192833
6179         <rdar://problem/45706868>
6180
6181         Reviewed by Mark Lam.
6182
6183         * stress/string-overflow-createError.js: Added.
6184
6185 2018-12-18  Ross Kirsling  <ross.kirsling@sony.com>
6186
6187         Error message for `-x ** y` contains a typo.
6188         https://bugs.webkit.org/show_bug.cgi?id=192832
6189
6190         Reviewed by Saam Barati.
6191
6192         * ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
6193         (assert.assert.return.throws):
6194         * stress/pow-expects-update-expression-on-lhs.js:
6195         (throw.new.Error):
6196         Update test expectations which match against the exact error message.
6197
6198 2018-12-18  Mark Lam  <mark.lam@apple.com>
6199
6200         Gardening: test options fix.
6201         https://bugs.webkit.org/show_bug.cgi?id=192822
6202
6203         Unreviewed.
6204
6205         * stress/json-stringify-string-builder-overflow.js:
6206
6207 2018-12-18  Mark Lam  <mark.lam@apple.com>
6208
6209         JSON.stringify() should throw OOM on StringBuilder overflows.
6210         https://bugs.webkit.org/show_bug.cgi?id=192822
6211         <rdar://problem/46670577>
6212
6213         Reviewed by Saam Barati.
6214
6215         * stress/json-stringify-string-builder-overflow.js: Added.
6216
6217 2018-12-18  Ross Kirsling  <ross.kirsling@sony.com>
6218
6219         Redeclaration of var over let/const/class should be a syntax error.
6220         https://bugs.webkit.org/show_bug.cgi?id=192298
6221
6222         Reviewed by Keith Miller.
6223
6224         * test262.yaml:
6225         * test262/expectations.yaml:
6226         Mark 46 tests as passing.
6227
6228         * stress/block-scope-redeclarations.js:
6229         Add some new tests.
6230
6231         * stress/for-in-invalidate-context-weird-assignments.js:
6232         * stress/for-in-tests.js:
6233         Replace tests for outdated behavior with tests for SyntaxError.
6234
6235         * ChakraCore/test/LetConst/defer3.baseline-jsc:
6236         * ChakraCore/test/LetConst/letvar.baseline-jsc:
6237         Update expectations.
6238
6239 2018-12-18  Mark Lam  <mark.lam@apple.com>
6240
6241         Skip the stress/elidable-new-object-roflcopter-then-exit.js test on 32-bit.
6242         https://bugs.webkit.org/show_bug.cgi?id=191374
6243         <rdar://problem/46525447>
6244
6245         Reviewed by Yusuke Suzuki.
6246
6247         This test runs too slow on 32-bit, and is not relevant for non-JIT builds.
6248
6249         * stress/elidable-new-object-roflcopter-then-exit.js:
6250
6251 2018-12-17  Mark Lam  <mark.lam@apple.com>
6252
6253         Skip the stress/materialized-regexp-has-correct-last-index-set-by-match.js test on 32-bit.
6254         https://bugs.webkit.org/show_bug.cgi?id=192019
6255         <rdar://problem/46525456>
6256
6257         Reviewed by Yusuke Suzuki.
6258
6259         The test runs too slow on 32-bit.
6260
6261         * stress/materialized-regexp-has-correct-last-index-set-by-match.js:
6262
6263 2018-12-17  Mark Lam  <mark.lam@apple.com>
6264
6265         Skip the stress/materialize-regexp-cyclic-regexp.js test on 32-bit.
6266         https://bugs.webkit.org/show_bug.cgi?id=191373
6267         <rdar://problem/46525458>
6268
6269         Reviewed by Yusuke Suzuki.
6270
6271         The test is already slow running with a JIT on 64-bit.  It will always timeout
6272         on 32-bit without a JIT.
6273
6274         * stress/materialize-regexp-cyclic-regexp.js:
6275
6276 2018-12-17  Mark Lam  <mark.lam@apple.com>
6277
6278         Array unshift/shift should not race against the AI in the compiler thread.
6279         https://bugs.webkit.org/show_bug.cgi?id=192795
6280         <rdar://problem/46724263>
6281
6282         Reviewed by Saam Barati.
6283
6284         * stress/array-unshift-should-not-race-against-compiler-thread.js: Added.
6285
6286 2018-12-16  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
6287
6288         [JSC] Optimize Object.keys by caching own keys results in StructureRareData
6289         https://bugs.webkit.org/show_bug.cgi?id=190047
6290
6291         Reviewed by Saam Barati.
6292
6293         * stress/object-keys-cached-zero.js: Added.
6294         (shouldBe):
6295         (test):
6296         * stress/object-keys-changed-attribute.js: Added.
6297         (shouldBe):
6298         (test):
6299         * stress/object-keys-changed-index.js: Added.
6300         (shouldBe):
6301         (test):
6302         * stress/object-keys-changed.js: Added.
6303         (shouldBe):
6304         (test):
6305         * stress/object-keys-indexed-non-cache.js: Added.
6306         (shouldBe):
6307         (test):
6308         * stress/object-keys-overrides-get-property-names.js: Added.
6309         (shouldBe):
6310         (test):
6311         (noInline):
6312
6313 2018-12-17  Mark Lam  <mark.lam@apple.com>
6314
6315         SamplingProfiler's isValidFramePointer() should reject address at stack origin.
6316         https://bugs.webkit.org/show_bug.cgi?id=192779
6317         <rdar://problem/46775869>
6318
6319         Reviewed by Saam Barati.
6320
6321         * stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js: Added.
6322
6323 2018-12-17  Ryan Haddad  <ryanhaddad@apple.com>
6324
6325         Unreviewed test gardening, address a syntax error in a new test.
6326
6327         * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js:
6328
6329 2018-12-17  Mark Lam  <mark.lam@apple.com>
6330
6331         Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit().
6332         https://bugs.webkit.org/show_bug.cgi?id=192776
6333         <rdar://problem/46772368>
6334
6335         Reviewed by Keith Miller.
6336
6337         * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js: Added.
6338
6339 2018-12-17  Mark Lam  <mark.lam@apple.com>
6340
6341         Fix stale assertion in attemptToForceStringArrayModeByToStringConversion().
6342         https://bugs.webkit.org/show_bug.cgi?id=192770
6343         <rdar://problem/46449037>
6344
6345         Reviewed by Keith Miller.
6346
6347         * stress/force-string-arrayMode-on-originalNonArray-array-class.js: Added.
6348
6349 2018-12-14  Mark Lam  <mark.lam@apple.com>
6350
6351         CallFrame::convertToStackOverflowFrame() needs to keep the top CodeBlock alive.
6352         https://bugs.webkit.org/show_bug.cgi?id=192717
6353         <rdar://problem/46660677>
6354
6355         Reviewed by Saam Barati.
6356
6357         * stress/regress-192717.js: Added.
6358
6359 2018-12-14  Commit Queue  <commit-queue@webkit.org>
6360
6361         Unreviewed, rolling out r239153, r239154, and r239155.
6362         https://bugs.webkit.org/show_bug.cgi?id=192715
6363
6364         Caused flaky GC-related crashes seen with layout tests
6365         (Requested by ryanhaddad on #webkit).
6366
6367         Reverted changesets:
6368
6369         "[JSC] Optimize Object.keys by caching own keys results in
6370         StructureRareData"
6371         https://bugs.webkit.org/show_bug.cgi?id=190047
6372         https://trac.webkit.org/changeset/239153
6373
6374         "Unreviewed, build fix after r239153"
6375         https://bugs.webkit.org/show_bug.cgi?id=190047
6376         https://trac.webkit.org/changeset/239154
6377
6378         "Unreviewed, build fix after r239153, part 2"
6379         https://bugs.webkit.org/show_bug.cgi?id=190047
6380         https://trac.webkit.org/changeset/239155
6381
6382 2018-12-14  Keith Miller  <keith_miller@apple.com>
6383
6384         Callers of JSString::getIndex should check for OOM exceptions
6385         https://bugs.webkit.org/show_bug.cgi?id=192709
6386
6387         Reviewed by Mark Lam.
6388
6389         * stress/StringObject-define-length-getter-rope-string-oom.js: Added.
6390
6391 2018-12-13  Mark Lam  <mark.lam@apple.com>
6392
6393         Add a missing exception check.
6394         https://bugs.webkit.org/show_bug.cgi?id=192626
6395         <rdar://problem/46662163>
6396
6397         Reviewed by Keith Miller.
6398
6399         * stress/regress-192626.js: Added.
6400
6401 2018-12-13  Caio Lima  <ticaiolima@gmail.com>
6402
6403         [BigInt] Add ValueDiv into DFG
6404         https://bugs.webkit.org/show_bug.cgi?id=186178
6405
6406         Reviewed by Yusuke Suzuki.
6407
6408         * stress/big-int-div-jit-osr.js: Added.
6409         * stress/big-int-div-jit-untyped.js: Added.
6410         * stress/value-div-fixup-int32-big-int.js: Added.
6411
6412 2018-12-10  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
6413
6414         [JSC] Optimize Object.keys by caching own keys results in StructureRareData
6415         https://bugs.webkit.org/show_bug.cgi?id=190047
6416
6417         Reviewed by Keith Miller.
6418
6419         * stress/object-keys-cached-zero.js: Added.
6420         (shouldBe):
6421         (test):
6422         * stress/object-keys-changed-attribute.js: Added.
6423         (shouldBe):
6424         (test):
6425         * stress/object-keys-changed-index.js: Added.
6426         (shouldBe):
6427         (test):
6428         * stress/object-keys-changed.js: Added.
6429         (shouldBe):
6430         (test):
6431         * stress/object-keys-indexed-non-cache.js: Added.
6432         (shouldBe):
6433         (test):
6434         * stress/object-keys-overrides-get-property-names.js: Added.
6435         (shouldBe):
6436         (test):
6437         (noInline):
6438
6439 2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
6440
6441         [DFG][FTL] Add NewSymbol
6442         https://bugs.webkit.org/show_bug.cgi?id=192620
6443
6444         Reviewed by Saam Barati.
6445
6446         * microbenchmarks/symbol-creation.js: Added.
6447         (test):
6448         * stress/symbol-description-identity.js: Added.
6449         (shouldBe):
6450         (test):
6451         * stress/symbol-identity.js: Added.
6452         (shouldBe):
6453         (test):
6454         * stress/symbol-with-description-throw-error.js: Added.
6455         (shouldBe):
6456         (shouldThrow):
6457         (test):
6458         (object.toString):
6459
6460 2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
6461
6462         [BigInt] Implement DFG/FTL typeof for BigInt
6463         https://bugs.webkit.org/show_bug.cgi?id=192619
6464
6465         Reviewed by Keith Miller.
6466
6467         * stress/big-int-boolean-proven-type.js: Added.
6468         (assert):
6469         (bool):
6470         * stress/big-int-type-of-proven-type-non-constant-including-symbol.js: Added.
6471         (assert):
6472         (typeOf):
6473         (i.switch):
6474         * stress/big-int-type-of-proven-type-non-constant.js: Added.
6475         (assert):
6476         (typeOf):
6477         * stress/big-int-type-of.js:
6478         (typeOf):
6479         (func):
6480
6481 2018-12-10  Mark Lam  <mark.lam@apple.com>
6482
6483         PropertyAttribute needs a CustomValue bit.
6484         https://bugs.webkit.org/show_bug.cgi?id=191993
6485         <rdar://problem/46264467>
6486
6487         Reviewed by Saam Barati.
6488
6489         * stress/regress-191993.js: Added.
6490
6491 2018-12-10  Caio Lima  <ticaiolima@gmail.com>
6492
6493         [BigInt] Add ValueMul into DFG
6494         https://bugs.webkit.org/show_bug.cgi?id=186175
6495
6496         Reviewed by Yusuke Suzuki.
6497
6498         * stress/big-int-mul-jit-osr.js: Added.
6499         * stress/big-int-mul-jit-untyped.js: Added.
6500         * stress/value-mul-fixup-int32-big-int.js: Added.
6501
6502 2018-12-06  Keith Miller  <keith_miller@apple.com>
6503
6504         stress/big-wasm-memory tests failing on 32-bit JSC bot
6505         https://bugs.webkit.org/show_bug.cgi?id=192020
6506
6507         Reviewed by Saam Barati.
6508
6509         Not every platform has WebAssembly, e.g. 32-bit, so we should exit
6510         the wasm stress tests if the WebAssembly object does not exist.
6511
6512         * stress/big-wasm-memory-grow-no-max.js:
6513         (test.foo):
6514         (test):
6515         (foo): Deleted.
6516         (catch): Deleted.
6517         * stress/big-wasm-memory-grow.js:
6518         (test.foo):
6519         (test):
6520         (foo): Deleted.
6521         (catch): Deleted.
6522         * stress/big-wasm-memory.js:
6523         (test.foo):
6524         (test):
6525         (foo): Deleted.
6526         (catch): Deleted.
6527
6528 2018-12-05  Mark Lam  <mark.lam@apple.com>
6529
6530         speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
6531         https://bugs.webkit.org/show_bug.cgi?id=192441
6532         <rdar://problem/46480355>
6533
6534         Reviewed by Saam Barati.
6535
6536         * stress/regress-192441.js: Added.
6537
6538 2018-12-04  Mark Lam  <mark.lam@apple.com>
6539
6540         DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility.
6541         https://bugs.webkit.org/show_bug.cgi?id=192386
6542         <rdar://problem/46445516>
6543
6544         Reviewed by Saam Barati.
6545
6546         * stress/regress-192386.js: Added.
6547
6548 2018-12-04  Caio Lima  <ticaiolima@gmail.com>
6549
6550         [ESNext][BigInt] Support logic operations
6551         https://bugs.webkit.org/show_bug.cgi?id=179903
6552
6553         Reviewed by Yusuke Suzuki.
6554
6555         * stress/big-int-branch-usage.js: Added.
6556         * stress/big-int-logical-and.js: Added.
6557         * stress/big-int-logical-not.js: Added.
6558         * stress/big-int-logical-or.js: Added.
6559
6560 2018-12-03  Ryan Haddad  <ryanhaddad@apple.com>
6561
6562         Unreviewed, rolling out r238833.
6563
6564         Breaks macOS and iOS debug builds.
6565
6566         Reverted changeset:
6567
6568         "[ESNext][BigInt] Support logic operations"
6569         https://bugs.webkit.org/show_bug.cgi?id=179903
6570         https://trac.webkit.org/changeset/238833
6571
6572 2018-12-03  Caio Lima  <ticaiolima@gmail.com>
6573
6574         [ESNext][BigInt] Support logic operations
6575         https://bugs.webkit.org/show_bug.cgi?id=179903
6576
6577         Reviewed by Yusuke Suzuki.
6578
6579         * stress/big-int-branch-usage.js: Added.
6580         * stress/big-int-logical-and.js: Added.
6581         * stress/big-int-logical-not.js: Added.
6582         * stress/big-int-logical-or.js: Added.
6583
6584 2018-12-02  Caio Lima  <ticaiolima@gmail.com>
6585
6586         [ESNext][BigInt] Implement support for "<<" and ">>"
6587         https://bugs.webkit.org/show_bug.cgi?id=186233
6588
6589         Reviewed by Yusuke Suzuki.
6590
6591         * stress/big-int-left-shift-general.js: Added.
6592         * stress/big-int-left-shift-range-error.js: Added.
6593         * stress/big-int-left-shift-type-error.js: Added.
6594         * stress/big-int-left-shift-wrapped-value.js: Added.
6595         * stress/big-int-right-shift-general.js: Added.
6596         * stress/big-int-right-shift-type-error.js: Added.
6597         * stress/big-int-right-shift-wrapped-value.js: Added.
6598         * stress/left-shift-to-primitive-precedence.js: Added.
6599         * stress/right-shift-to-primitive-precedence.js: Added.
6600
6601 2018-11-30  Dean Jackson  <dino@apple.com>
6602
6603         Add first-class support for .mjs files in jsc binary
6604         https://bugs.webkit.org/show_bug.cgi?id=192190
6605         <rdar://problem/46375715>
6606
6607         Reviewed by Keith Miller.
6608
6609         * stress/simple-module.mjs: Added.
6610         * stress/simple-script.js: Added.
6611
6612 2018-11-30  Caio Lima  <ticaiolima@gmail.com>
6613
6614         [BigInt] Implement ValueBitXor into DFG
6615         https://bugs.webkit.org/show_bug.cgi?id=190264
6616
6617         Reviewed by Yusuke Suzuki.
6618
6619         * stress/big-int-bitwise-xor-jit.js: Added.
6620         * stress/big-int-bitwise-xor-memory-stress.js: Added.
6621         * stress/big-int-bitwise-xor-untyped.js: Added.
6622
6623 2018-11-27  Saam barati  <sbarati@apple.com>
6624
6625         r238510 broke scopes of size zero
6626         https://bugs.webkit.org/show_bug.cgi?id=192033
6627         <rdar://problem/46281734>
6628
6629         Reviewed by Keith Miller.
6630
6631         * stress/r238510-bad-loop.js: Added.
6632         (foo):
6633
6634 2018-11-27  Mark Lam  <mark.lam@apple.com>
6635
6636         [Re-landing] NaNs read from Wasm code needs to be be purified.
6637         https://bugs.webkit.org/show_bug.cgi?id=191056
6638         <rdar://problem/45660341>
6639
6640         Reviewed by Filip Pizlo.
6641
6642         * wasm/regress/regress-191056.js: Added.
6643
6644 2018-11-27  Ryan Haddad  <ryanhaddad@apple.com>
6645
6646         Unreviewed, rolling out r238509.
6647
6648         Causes JSC tests to fail on iOS.
6649
6650         Reverted changeset:
6651
6652         "NaNs read from Wasm code needs to be be purified."
6653         https://bugs.webkit.org/show_bug.cgi?id=191056
6654         https://trac.webkit.org/changeset/238509
6655
6656 2018-11-26  Caio Lima  <ticaiolima@gmail.com>
6657
6658         Re-introduce op_bitnot
6659         https://bugs.webkit.org/show_bug.cgi?id=190923
6660
6661         Reviewed by Yusuke Suzuki.
6662
6663         * stress/bit-not-must-generate.js: Added.
6664         * stress/bitwise-not-no-int32.js: Added.
6665
6666 2018-11-26  Saam barati  <sbarati@apple.com>
6667
6668         InPlaceAbstractState::endBasicBlock rule for SetLocal should filter the value based on the flush format
6669         https://bugs.webkit.org/show_bug.cgi?id=191956
6670         <rdar://problem/45665806>
6671
6672         Reviewed by Yusuke Suzuki.
6673
6674         * stress/end-basic-block-set-local-should-filter-type.js: Added.
6675         (bar):
6676         (foo):
6677
6678 2018-11-26  Saam barati  <sbarati@apple.com>
6679
6680         Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation
6681         https://bugs.webkit.org/show_bug.cgi?id=191958
6682         <rdar://problem/46221877>
6683
6684         Reviewed by Yusuke Suzuki.
6685
6686         * stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added.
6687         (x):
6688         (foo):
6689
6690 2018-11-26  Mark Lam  <mark.lam@apple.com>
6691
6692         NaNs read from Wasm code needs to be be purified.
6693         https://bugs.webkit.org/show_bug.cgi?id=191056
6694         <rdar://problem/45660341>
6695
6696         Reviewed by Filip Pizlo.
6697
6698         * wasm/regress/regress-191056.js: Added.
6699
6700 2018-11-26  Michael Saboff  <msaboff@apple.com>
6701
6702         32-bit JSC test failure: stress/regexp-compile-oom.js
6703         https://bugs.webkit.org/show_bug.cgi?id=191375
6704
6705         Reviewed by Mark Lam.
6706
6707         Disabled the test for 32 bit platforms.
6708
6709         * stress/regexp-compile-oom.js:
6710
6711 2018-11-26  Tadeu Zagallo  <tzagallo@apple.com>
6712
6713         ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
6714         https://bugs.webkit.org/show_bug.cgi?id=191716
6715         <rdar://problem/45723878>
6716
6717         Reviewed by Saam Barati.
6718
6719         * stress/regress-187373.js: Added.
6720         (async.fn):
6721
6722 2018-11-21  Saam barati  <sbarati@apple.com>
6723
6724         DFGSpeculativeJIT should not &= exitOK with mayExit(node)
6725         https://bugs.webkit.org/show_bug.cgi?id=191897
6726         <rdar://problem/45871998>
6727
6728         Reviewed by Mark Lam.
6729
6730         * stress/exitok-is-not-the-same-as-mayExit.js: Added.
6731         (bar):
6732         (foo):
6733
6734 2018-11-21  Saam barati  <sbarati@apple.com>
6735
6736         Fix assertion in KnownCellUse inside SpeculativeJIT::speculate
6737         https://bugs.webkit.org/show_bug.cgi?id=191895
6738         <rdar://problem/46167406>
6739
6740         Reviewed by Mark Lam.
6741
6742         * stress/known-cell-use-needs-type-check-assertion.js: Added.
6743         (foo):
6744         (bar):
6745
6746 2018-11-21  Mark Lam  <mark.lam@apple.com>
6747
6748         Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError.
6749         https://bugs.webkit.org/show_bug.cgi?id=191776
6750         <rdar://problem/46152851>
6751
6752         Reviewed by Saam Barati.
6753
6754         * stress/big-wasm-memory-grow-no-max.js:
6755         * stress/big-wasm-memory-grow.js:
6756         * stress/big-wasm-memory.js:
6757         - updated these to expect an OutOfMemoryError.
6758
6759         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: Added.
6760         (Binary.prototype.emit_u8):
6761         (Binary.prototype.emit_u32v):
6762         (Binary.prototype.emit_header):
6763         (Binary.prototype.emit_section):
6764         (Binary):
6765         (WasmModuleBuilder):
6766         (WasmModuleBuilder.prototype.addMemory):
6767         (WasmModuleBuilder.prototype.toArray):
6768         (WasmModuleBuilder.prototype.toBuffer):
6769         (WasmModuleBuilder.prototype.instantiate):
6770         (catch):
6771         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Added.
6772         (catch):
6773
6774 2018-11-21  Caio Lima  <ticaiolima@gmail.com>
6775
6776         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
6777         https://bugs.webkit.org/show_bug.cgi?id=190836
6778
6779         Reviewed by Saam Barati and Yusuke Suzuki.
6780
6781         * stress/big-int-out-of-memory-tests.js: Added.
6782
6783 2018-11-20  Mark Lam  <mark.lam@apple.com>
6784
6785         Remove invalid assertion in VMTraps::SignalSender's SignalAction.
6786         https://bugs.webkit.org/show_bug.cgi?id=191856
6787         <rdar://problem/46089992>
6788
6789         Reviewed by Yusuke Suzuki.
6790
6791         * stress/regress-191856.js: Added.
6792         - this test is skipped for now until we have a fix for webkit.org/b/191855.
6793
6794 2018-11-21  Dominik Infuehr  <dinfuehr@igalia.com>
6795
6796         Enable JIT on ARM/Linux
6797         https://bugs.webkit.org/show_bug.cgi?id=191548
6798
6799         Reviewed by Yusuke Suzuki.
6800
6801         Disable test on system with limited memory. Program was killed by
6802         the OS before the exception was thrown.
6803
6804         * slowMicrobenchmarks/function-constructor-with-huge-strings.js:
6805
6806 2018-11-20  Saam barati  <sbarati@apple.com>
6807
6808         Merging an IC variant may lead to the IC status containing overlapping structure sets
6809         https://bugs.webkit.org/show_bug.cgi?id=191869
6810         <rdar://problem/45403453>
6811
6812         Reviewed by Mark Lam.
6813
6814         * stress/merging-ic-variants-should-bail-if-structures-overlap.js: Added.
6815
6816 2018-11-19  Mark Lam  <mark.lam@apple.com>
6817
6818         globalFuncImportModule() should return a promise when it clears exceptions.
6819         https://bugs.webkit.org/show_bug.cgi?id=191792
6820         <rdar://problem/46090763>
6821
6822         Reviewed by Michael Saboff.
6823
6824         * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: Added.
6825
6826 2018-11-19  Guillaume Emont  <guijemont@igalia.com>
6827
6828         Skip new memory-hungry tests on memory limited devices
6829
6830         Unreviewed gardening.
6831
6832         * stress/big-wasm-memory-grow-no-max.js:
6833         * stress/big-wasm-memory-grow.js:
6834         * stress/big-wasm-memory.js:
6835
6836 2018-11-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
6837
6838         Unreviewed, rolling in the rest of r237254
6839         https://bugs.webkit.org/show_bug.cgi?id=190340
6840
6841         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
6842         * stress/function-cache-with-parameters-end-position.js: Added.
6843         (shouldBe):
6844         (shouldThrow):
6845         (i.anonymous):
6846         * stress/function-constructor-name.js: Added.
6847         (shouldBe):
6848         (GeneratorFunction):
6849         (AsyncFunction.async):
6850         (AsyncGeneratorFunction.async):
6851         (anonymous):
6852         (async.anonymous):
6853         * test262/expectations.yaml:
6854
6855 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
6856
6857         All users of ArrayBuffer should agree on the same max size
6858         https://bugs.webkit.org/show_bug.cgi?id=191771
6859
6860         Reviewed by Mark Lam.
6861
6862         * stress/big-wasm-memory-grow-no-max.js: Added.
6863         (foo):
6864         (catch):
6865         * stress/big-wasm-memory-grow.js: Added.
6866         (foo):
6867         (catch):
6868         * stress/big-wasm-memory.js: Added.
6869         (foo):
6870         (catch):
6871
6872 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
6873
6874         Unreviewed, make some more tests not crash my computer by only running on instance of it. These tests do not need to
6875         run for each JSC config since they're regression tests for runtime bugs.
6876
6877         * stress/json-stringified-overflow-2.js:
6878         * stress/json-stringified-overflow.js:
6879
6880 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
6881
6882         Unreviewed, make some tests not crash my computer by only running on instance of it. These tests do not need to run for each JSC
6883         config since they're regression tests for runtime bugs.
6884
6885         * stress/large-unshift-splice.js:
6886         * stress/regress-185888.js:
6887
6888 2018-11-16  Saam Barati  <sbarati@apple.com>
6889
6890         KnownCellUse should also have SpecCellCheck as its type filter
6891         https://bugs.webkit.org/show_bug.cgi?id=191729
6892         <rdar://problem/45872852>
6893
6894         Reviewed by Filip Pizlo.
6895
6896         * stress/known-cell-type-check-should-allow-empty-value-to-flow-through.js: Added.
6897         (C):
6898
6899 2018-11-16  Tadeu Zagallo  <tzagallo@apple.com>
6900
6901         Fix assertion failure on BytecodeGenerator::recordOpcode
6902         https://bugs.webkit.org/show_bug.cgi?id=191724
6903         <rdar://problem/45724395>
6904
6905         Reviewed by Saam Barati.
6906
6907         * stress/regress-187373-2.js: Added.
6908         (foo):
6909
6910 2018-11-15  Mark Lam  <mark.lam@apple.com>
6911
6912         RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
6913         https://bugs.webkit.org/show_bug.cgi?id=191730
6914         <rdar://problem/46048517>
6915
6916         Reviewed by Saam Barati.
6917
6918         * stress/regress-187006.js: Removed.
6919           - this test is invalid because its sole purpose is to test for the non-spec
6920             compliant behavior that we just fixed.
6921
6922         * stress/regress-191730.js: Added.
6923
6924 2018-11-15  Mark Lam  <mark.lam@apple.com>
6925
6926         RegExp operations should not take fast patch if lastIndex is not numeric.
6927         https://bugs.webkit.org/show_bug.cgi?id=191731
6928         <rdar://problem/46017305>
6929
6930         Reviewed by Saam Barati.
6931
6932         * stress/regress-191731.js: Added.
6933
6934 2018-11-13  Saam Barati  <sbarati@apple.com>
6935
6936         TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM
6937         https://bugs.webkit.org/show_bug.cgi?id=191600
6938
6939         Reviewed by Mark Lam.
6940
6941         * stress/type-profiler-log-should-defer-pending-exceptions.js: Added.
6942         (foo):
6943         (test):
6944         (bar):
6945
6946 2018-11-13  Ryan Haddad  <ryanhaddad@apple.com>
6947
6948         Unreviewed, rolling out r238132.
6949
6950         The test added with this change is timing out on Debug JSC
6951         bots.
6952
6953         Reverted changeset:
6954
6955         "[BigInt] JSBigInt::createWithLength should throw when length
6956         is greater than JSBigInt::maxLength"
6957         https://bugs.webkit.org/show_bug.cgi?id=190836
6958         https://trac.webkit.org/changeset/238132
6959
6960 2018-11-13  Mark Lam  <mark.lam@apple.com>
6961
6962         Add OOM detection to StringPrototype's substituteBackreferences().
6963         https://bugs.webkit.org/show_bug.cgi?id=191563
6964         <rdar://problem/45720428>
6965
6966         Reviewed by Saam Barati.
6967
6968         * stress/regress-191563.js: Added.
6969
6970 2018-11-13  Mark Lam  <mark.lam@apple.com>
6971
6972         LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame.
6973         https://bugs.webkit.org/show_bug.cgi?id=191579
6974         <rdar://problem/45942472>
6975
6976         Reviewed by Saam Barati.
6977
6978         * stress/regress-191579.js: Added.
6979
6980 2018-11-13  Caio Lima  <ticaiolima@gmail.com>
6981
6982         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
6983         https://bugs.webkit.org/show_bug.cgi?id=190836
6984
6985         Reviewed by Saam Barati.
6986
6987         * stress/big-int-out-of-memory-tests.js: Added.
6988
6989 2018-11-08  Ross Kirsling  <ross.kirsling@sony.com>
6990
6991         U+180E is no longer a whitespace character
6992         https://bugs.webkit.org/show_bug.cgi?id=191415
6993
6994         Reviewed by Saam Barati.
6995
6996         * ChakraCore/test/es5/regexSpace.baseline:
6997         * ChakraCore/test/es6/unicode_whitespace.js:
6998         Update tests to latest version.
6999         (See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.)
7000
7001         * test262.yaml:
7002         * test262/config.yaml:
7003         * test262/expectations.yaml:
7004         Update expectations.
7005
7006 2018-11-07  Caio Lima  <ticaiolima@gmail.com>
7007
7008         [BigInt] Add support to BigInt into ValueAdd
7009         https://bugs.webkit.org/show_bug.cgi?id=186177
7010
7011         Reviewed by Keith Miller.
7012
7013         * stress/big-int-negate-jit.js:
7014         * stress/value-add-big-int-and-string.js: Added.
7015         * stress/value-add-big-int-prediction-propagation.js: Added.
7016         * stress/value-add-big-int-untyped.js: Added.
7017
7018 2018-11-07  Tadeu Zagallo  <tzagallo@apple.com>
7019
7020         REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled
7021         https://bugs.webkit.org/show_bug.cgi?id=191184
7022
7023         Reviewed by Saam Barati.
7024
7025         Most tests were failing due to timeouts, since they are too slow to
7026         run on CLoop. The exceptions are:
7027
7028         proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop
7029         dont-crash-on-stack-overflow-when-parsing-builtin.js and
7030         dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had
7031         to change the stack size since CLoop requires it to be page aligned.
7032
7033         * microbenchmarks/array-push-1.js:
7034         * microbenchmarks/array-push-2.js:
7035         * microbenchmarks/elidable-new-object-dag.js:
7036         * microbenchmarks/elidable-new-object-roflcopter.js:
7037         * microbenchmarks/elidable-new-object-tree.js:
7038         * microbenchmarks/getter-richards.js:
7039         * microbenchmarks/sinkable-new-object-dag.js:
7040         * microbenchmarks/string-concat-long-convert.js:
7041         * microbenchmarks/typed-array-get-set-by-val-profiling.js:
7042         * slowMicrobenchmarks/array-push-3.js:
7043         * slowMicrobenchmarks/large-map-iteration-with-additions.js:
7044         * slowMicrobenchmarks/spread-small-array.js:
7045         * slowMicrobenchmarks/undefined-property-access.js:
7046         * stress/activation-sink-default-value-tdz-error.js:
7047         * stress/activation-sink-default-value.js:
7048         * stress/activation-sink-osrexit-default-value-tdz-error.js:
7049         * stress/activation-sink-osrexit-default-value.js:
7050         * stress/activation-sink-osrexit.js:
7051         * stress/activation-sink.js:
7052         * stress/allow-math-ic-b3-code-duplication.js:
7053         * stress/array-push-multiple-int32.js:
7054         * stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js:
7055         * stress/arrowfunction-lexical-this-activation-sink-osrexit.js:
7056         * stress/arrowfunction-lexical-this-activation-sink.js:
7057         * stress/dont-crash-on-stack-overflow-when-parsing-builtin.js:
7058         * stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js:
7059         * stress/elide-new-object-dag-then-exit.js:
7060         * stress/materialize-regexp-cyclic.js:
7061         * stress/new-regex-inline.js:
7062         * stress/op_add.js:
7063         * stress/op_bitand.js:
7064         * stress/op_bitor.js:
7065         * stress/op_bitxor.js:
7066         * stress/op_div-ConstVar.js:
7067         * stress/op_div-VarConst.js:
7068         * stress/op_div-VarVar.js:
7069         * stress/op_lshift-ConstVar.js:
7070         * stress/op_lshift-VarConst.js:
7071         * stress/op_lshift-VarVar.js:
7072         * stress/op_mod-ConstVar.js:
7073         * stress/op_mod-VarConst.js:
7074         * stress/op_mod-VarVar.js:
7075         * stress/op_mul-ConstVar.js:
7076         * stress/op_mul-VarConst.js:
7077         * stress/op_mul-VarVar.js:
7078         * stress/op_rshift-ConstVar.js:
7079         * stress/op_rshift-VarConst.js:
7080         * stress/op_rshift-VarVar.js:
7081         * stress/op_sub-ConstVar.js:
7082         * stress/op_sub-VarConst.js:
7083         * stress/op_sub-VarVar.js:
7084         * stress/op_urshift-ConstVar.js:
7085         * stress/op_urshift-VarConst.js:
7086         * stress/op_urshift-VarVar.js:
7087         * stress/proxy-get-set-correct-receiver.js:
7088         * stress/regress-179562.js:
7089         * stress/rest-parameter-many-arguments.js:
7090         * stress/sampling-profiler-richards.js:
7091         * stress/splay-flash-access-1ms.js:
7092         * stress/tailCallForwardArguments.js:
7093         * stress/typed-array-get-by-val-profiling.js:
7094         * typeProfiler/getter-richards.js:
7095
7096 2018-11-06  Michael Saboff  <msaboff@apple.com>
7097
7098         Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.
7099         https://bugs.webkit.org/show_bug.cgi?id=191271
7100
7101         Reviewed by Saam Barati.
7102
7103         Added more test cases and made all test cases run with the same deeply recursive stack
7104         instead of finding that same point for each test case.
7105
7106         * stress/regexp-compile-oom.js:
7107         (prototype.runTest):
7108         (recurseAndTest):
7109         (testList.push.new.TestAndExpectedException):
7110
7111 2018-11-05  Michael Saboff  <msaboff@apple.com>
7112
7113         Unreviewed build fix for linux.
7114
7115         * stress/regexp-compile-oom.js: Disabled for non-darwin OSes.
7116
7117 2018-11-02  Michael Saboff  <msaboff@apple.com>
7118
7119         Rolling in r237753 with unreviewed build fix.
7120
7121         Fixed issues with DECLARE_THROW_SCOPE placement.
7122
7123 2018-11-02  Ryan Haddad  <ryanhaddad@apple.com>
7124
7125         Unreviewed, rolling out r237753.
7126
7127         Introduced JSC test failures
7128
7129         Reverted changeset:
7130
7131         "Running out of stack space not properly handled in
7132         RegExp::compile() and its callers"
7133         https://bugs.webkit.org/show_bug.cgi?id=191206
7134         https://trac.webkit.org/changeset/237753
7135
7136 2018-11-02  Michael Saboff  <msaboff@apple.com>
7137
7138         Running out of stack space not properly handled in RegExp::compile() and its callers
7139         https://bugs.webkit.org/show_bug.cgi?id=191206
7140
7141         Reviewed by Filip Pizlo.
7142
7143         New regression test.
7144
7145         * stress/regexp-compile-oom.js: Added.
7146         (recurseAndTest):
7147
7148 2018-11-01  Guillaume Emont  <guijemont@igalia.com>
7149
7150         Skip tests on arm/mips that time out now we're running on CLoop
7151
7152         Unreviewed gardening.
7153
7154         Since the JIT is temporarily disabled on 32-bit platforms, these tests
7155         time out on the bots and need to be disabled. There's more tests
7156         disabled on arm because the timeout is longer on the mips bot (as the
7157         device is slower to start with), so many of the tests don't time out
7158         there.
7159
7160         * microbenchmarks/getter-richards.js: disable on arm and mips.
7161         * stress/op_add.js: disable on arm.
7162         * stress/op_bitand.js: disable on arm.
7163         * stress/op_bitor.js: disable on arm.
7164         * stress/op_bitxor.js: disable on arm.
7165         * stress/op_lshift-ConstVar.js: disable on arm.
7166         * stress/op_lshift-VarConst.js: disable on arm.
7167         * stress/op_lshift-VarVar.js: disable on arm.
7168         * stress/op_mod-ConstVar.js: disable on arm.
7169         * stress/op_mod-VarConst.js: disable on arm.
7170         * stress/op_mod-VarVar.js: disable on arm.
7171         * stress/op_mul-ConstVar.js: disable on arm.
7172         * stress/op_mul-VarConst.js: disable on arm.
7173         * stress/op_mul-VarVar.js: disable on arm.
7174         * stress/op_rshift-ConstVar.js: disable on arm.
7175         * stress/op_rshift-VarConst.js: disable on arm.
7176         * stress/op_rshift-VarVar.js: disable on arm.
7177         * stress/op_sub-ConstVar.js: disable on arm.
7178         * stress/op_sub-VarConst.js: disable on arm.
7179         * stress/op_sub-VarVar.js: disable on arm.
7180         * stress/op_urshift-ConstVar.js: disable on arm.
7181         * stress/op_urshift-VarConst.js: disable on arm.
7182         * stress/op_urshift-VarVar.js: disable on arm.
7183         * stress/spread-forward-call-varargs-stack-overflow.js: disable on arm.
7184         * stress/value-to-boolean.js: disable on arm and mips.
7185
7186 2018-10-31  Tadeu Zagallo  <tzagallo@apple.com>
7187
7188         REGRESSION(r237547): Exception handlers should be aware of wide opcodes
7189         https://bugs.webkit.org/show_bug.cgi?id=191108
7190         <rdar://problem/45690700>
7191
7192         Reviewed by Saam Barati.
7193
7194         * stress/wide-op_catch.js: Added.
7195         (catch):
7196
7197 2018-10-29  Mark Lam  <mark.lam@apple.com>
7198
7199         Correctly detect string overflow when using the 'Function' constructor.
7200         https://bugs.webkit.org/show_bug.cgi?id=184883
7201         <rdar://problem/36320331>
7202
7203         Reviewed by Saam Barati.
7204
7205         I've verified that this passes on 32-bit as well.
7206
7207         * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
7208
7209 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
7210
7211         Add support for GetStack FlushedDouble
7212         https://bugs.webkit.org/show_bug.cgi?id=191012
7213         <rdar://problem/45265141>
7214
7215         Reviewed by Saam Barati.
7216
7217         * stress/get-stack-double.js: Added.
7218         (bar):
7219         (noInline):
7220
7221 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
7222
7223         New bytecode format for JSC
7224         https://bugs.webkit.org/show_bug.cgi?id=187373
7225         <rdar://problem/44186758>
7226
7227         Reviewed by Filip Pizlo.
7228
7229         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
7230
7231         * stress/maximum-inline-capacity.js: Added.
7232         (test1):
7233         (test3.Foo):
7234         (test3):
7235
7236 2018-10-26  Commit Queue  <commit-queue@webkit.org>
7237
7238         Unreviewed, rolling out r237479 and r237484.
7239         https://bugs.webkit.org/show_bug.cgi?id=190978
7240
7241         broke JSC on iOS (Requested by tadeuzagallo on #webkit).
7242
7243         Reverted changesets:
7244
7245         "New bytecode format for JSC"
7246         https://bugs.webkit.org/show_bug.cgi?id=187373
7247         https://trac.webkit.org/changeset/237479
7248
7249         "Gardening: Build fix after r237479."
7250         https://bugs.webkit.org/show_bug.cgi?id=187373
7251         https://trac.webkit.org/changeset/237484
7252
7253 2018-10-26  Tadeu Zagallo  <tzagallo@apple.com>
7254
7255         New bytecode format for JSC
7256         https://bugs.webkit.org/show_bug.cgi?id=187373
7257         <rdar://problem/44186758>
7258
7259         Reviewed by Filip Pizlo.
7260
7261         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
7262
7263         * stress/maximum-inline-capacity.js: Added.
7264         (test1):
7265         (test3.Foo):
7266         (test3):
7267
7268 2018-10-26  Mark Lam  <mark.lam@apple.com>
7269
7270         Fix missing edge cases with JSGlobalObjects having a bad time.
7271         https://bugs.webkit.org/show_bug.cgi?id=189028
7272         <rdar://problem/45204939>
7273
7274         Reviewed by Saam Barati.
7275
7276         * stress/regress-189028.js: Added.
7277
7278 2018-10-22  Mark Lam  <mark.lam@apple.com>
7279
7280         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
7281         https://bugs.webkit.org/show_bug.cgi?id=190515
7282         <rdar://problem/45222379>
7283
7284         Rubber-stamped by Saam Barati.
7285
7286         Adding another test.
7287
7288         * stress/regress-190515-2.js: Added.
7289
7290 2018-10-22  Mark Lam  <mark.lam@apple.com>
7291
7292         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
7293         https://bugs.webkit.org/show_bug.cgi?id=190515
7294         <rdar://problem/45222379>
7295
7296         Reviewed by Saam Barati.
7297
7298         * stress/regress-190515.js: Added.
7299
7300 2018-10-19  Commit Queue  <commit-queue@webkit.org>
7301
7302         Unreviewed, rolling out r237254.
7303         https://bugs.webkit.org/show_bug.cgi?id=190760
7304
7305         "It regresses JetStream 2 by 5% on some iOS devices"
7306         (Requested by saamyjoon on #webkit).
7307
7308         Reverted changeset:
7309
7310         "[JSC] JSC should have "parseFunction" to optimize Function
7311         constructor"
7312         https://bugs.webkit.org/show_bug.cgi?id=190340
7313         https://trac.webkit.org/changeset/237254
7314
7315 2018-10-19  Saam Barati  <sbarati@apple.com>
7316
7317         vmCall should check if we exit before emitting an OSR exit due to exceptions
7318         https://bugs.webkit.org/show_bug.cgi?id=190740
7319         <rdar://problem/45220139>
7320
7321         Reviewed by Mark Lam.
7322
7323         * stress/dont-emit-osr-exits-for-every-call-ftl.js: Added.
7324         (foo):
7325
7326 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
7327
7328         [ESNext][BigInt] Implement support for "^"
7329         https://bugs.webkit.org/show_bug.cgi?id=186235
7330
7331         Reviewed by Yusuke Suzuki.
7332
7333         * stress/big-int-bitwise-xor-general.js: Added.
7334         * stress/big-int-bitwise-xor-to-primitive-precedence.js: Added.
7335         * stress/big-int-bitwise-xor-type-error.js: Added.
7336         * stress/big-int-bitwise-xor-wrapped-value.js: Added.
7337
7338 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
7339
7340         [BigInt] Add ValueSub into DFG
7341         https://bugs.webkit.org/show_bug.cgi?id=186176
7342
7343         Reviewed by Yusuke Suzuki.
7344
7345         * stress/big-int-subtraction-jit.js:
7346         * stress/value-sub-big-int-prediction-propagation.js: Added.
7347         * stress/value-sub-big-int-untyped.js: Added.
7348         * stress/value-sub-spec-none-case.js: Added.
7349
7350 2018-10-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
7351
7352         [JSC] JSC should have "parseFunction" to optimize Function constructor
7353         https://bugs.webkit.org/show_bug.cgi?id=190340
7354
7355         Reviewed by Mark Lam.
7356
7357         This patch fixes the line number of syntax errors raised by the Function constructor,
7358         since we now parse the final code only once. And we no longer use block statement
7359         for Function constructor's parsing.
7360
7361         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
7362         * stress/function-cache-with-parameters-end-position.js: Added.
7363         (shouldBe):
7364         (shouldThrow):
7365         (i.anonymous):
7366         * stress/function-constructor-name.js: Added.
7367         (shouldBe):
7368         (GeneratorFunction):
7369         (AsyncFunction.async):
7370         (AsyncGeneratorFunction.async):
7371         (anonymous):
7372         (async.anonymous):
7373         * test262/expectations.yaml:
7374
7375 2018-10-18  Commit Queue  <commit-queue@webkit.org>
7376
7377         Unreviewed, rolling out r237242.
7378         https://bugs.webkit.org/show_bug.cgi?id=190701
7379
7380         it breaks "stress/sampling-profiler-basic.js" (Requested by
7381         caiolima on #webkit).
7382
7383         Reverted changeset:
7384
7385         "[BigInt] Add ValueSub into DFG"
7386         https://bugs.webkit.org/show_bug.cgi?id=186176
7387         https://trac.webkit.org/changeset/237242
7388
7389 2018-10-17  Keith Miller  <keith_miller@apple.com>
7390
7391         AI does not clear Phantom allocation nodes.
7392         https://bugs.webkit.org/show_bug.cgi?id=190694
7393
7394         Reviewed by Saam Barati.
7395
7396         * stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added.
7397         (Day):
7398         (DaysInYear):
7399         (TimeInYear):
7400         (TimeFromYear):
7401         (DayFromYear):
7402         (InLeapYear):
7403         (YearFromTime):
7404         (WeekDay):
7405         (DaylightSavingTA):
7406         (GetSecondSundayInMarch):
7407         (TimeInMonth):
7408
7409 2018-10-17  Caio Lima  <ticaiolima@gmail.com>
7410
7411         [BigInt] Add ValueSub into DFG
7412         https://bugs.webkit.org/show_bug.cgi?id=186176
7413
7414         Reviewed by Yusuke Suzuki.
7415
7416         * stress/big-int-subtraction-jit.js:
7417         * stress/value-sub-big-int-prediction-propagation.js: Added.
7418         * stress/value-sub-big-int-untyped.js: Added.
7419
7420 2018-10-16  Dominik Infuehr  <dinfuehr@igalia.com>
7421
7422         [JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips
7423         https://bugs.webkit.org/show_bug.cgi?id=190611
7424
7425         Reviewed by Saam Barati.
7426
7427         Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js
7428         to improve test runtime. On ARM/MIPS this test even timed out when running all
7429         tests.
7430
7431         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
7432         (test):
7433
7434 2018-10-15  Guillaume Emont  <guijemont@igalia.com>
7435
7436         Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux
7437
7438         Unreviewed gardening.
7439
7440         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
7441
7442 2018-10-15  Saam barati  <sbarati@apple.com>
7443
7444         Emit fjcvtzs on ARM64E on Darwin
7445         https://bugs.webkit.org/show_bug.cgi?id=184023
7446
7447         Reviewed by Yusuke Suzuki and Filip Pizlo.
7448
7449         * stress/double-to-int32-NaN.js: Added.
7450         (assert):
7451         (foo):
7452
7453 2018-10-15  Saam Barati  <sbarati@apple.com>
7454
7455         JSArray::shiftCountWithArrayStorage is wrong when an array has holes
7456         https://bugs.webkit.org/show_bug.cgi?id=190262
7457         <rdar://problem/44986241>
7458
7459         Reviewed by Mark Lam.
7460
7461         * stress/array-prototype-concat-of-long-spliced-arrays.js:
7462         (test):
7463         * stress/slice-array-storage-with-holes.js: Added.
7464         (main):
7465
7466 2018-10-15  Commit Queue  <commit-queue@webkit.org>
7467
7468         Unreviewed, rolling out r237054.
7469         https://bugs.webkit.org/show_bug.cgi?id=190593
7470
7471         "this regressed JetStream 2 by 6% on iOS" (Requested by
7472         saamyjoon on #webkit).
7473
7474         Reverted changeset:
7475
7476         "[JSC] JSC should have "parseFunction" to optimize Function
7477         constructor"
7478         https://bugs.webkit.org/show_bug.cgi?id=190340
7479         https://trac.webkit.org/changeset/237054
7480
7481 2018-10-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
7482
7483         [JSC] JSON.stringify can accept call-with-no-arguments
7484         https://bugs.webkit.org/show_bug.cgi?id=190343
7485
7486         Reviewed by Mark Lam.
7487
7488         * stress/json-stringify-no-arguments.js: Added.
7489         (shouldBe):
7490
7491 2018-10-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
7492
7493         [JSC] JSC should have "parseFunction" to optimize Function constructor
7494         https://bugs.webkit.org/show_bug.cgi?id=190340
7495
7496         Reviewed by Mark Lam.
7497
7498         This patch fixes the line number of syntax errors raised by the Function constructor,
7499         since we now parse the final code only once. And we no longer use block statement
7500         for Function constructor's parsing.
7501
7502         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
7503         * stress/function-cache-with-parameters-end-position.js: Added.
7504         (shouldBe):
7505         (shouldThrow):
7506         (i.anonymous):
7507         * stress/function-constructor-name.js: Added.
7508         (shouldBe):
7509         (GeneratorFunction):
7510         (AsyncFunction.async):
7511         (AsyncGeneratorFunction.async):
7512         (anonymous):
7513         (async.anonymous):
7514         * test262/expectations.yaml:
7515
7516 2018-10-10  Guillaume Emont  <guijemont@igalia.com>
7517
7518         Skip JSC test stress/sampling-profiler-richards.js on armv7/linux
7519         https://bugs.webkit.org/show_bug.cgi?id=190426
7520
7521         Unreviewed gardening.
7522
7523         * stress/sampling-profiler-richards.js:
7524
7525 2018-10-06  Caio Lima  <ticaiolima@gmail.com>
7526
7527         [ESNext][BigInt] Implement support for "|"
7528         https://bugs.webkit.org/show_bug.cgi?id=186229
7529
7530         Reviewed by Yusuke Suzuki.
7531
7532         * stress/big-int-bitwise-and-jit.js:
7533         * stress/big-int-bitwise-or-general.js: Added.
7534         * stress/big-int-bitwise-or-jit-untyped.js: Added.
7535         * stress/big-int-bitwise-or-jit.js: Added.
7536         * stress/big-int-bitwise-or-memory-stress.js: Added.
7537         * stress/big-int-bitwise-or-to-primitive-precedence.js: Added.
7538         * stress/big-int-bitwise-or-type-error.js: Added.
7539         * stress/big-int-bitwise-or-wrapped-value.js: Added.
7540
7541 2018-10-05  Dominik Infuehr  <dominik.infuehr@gmail.com>
7542
7543         Skip test on systems with limited memory
7544         https://bugs.webkit.org/show_bug.cgi?id=190310
7545
7546         Invoking runDefault adds test to runlist, skipping the test in the next
7547         line does not prevent the test from executing. Change order of lines such
7548         that runDefault is only executed if test is not executed.
7549
7550         Reviewed by Mark Lam.
7551
7552         * stress/regress-190187.js:
7553
7554 2018-10-03  Saam barati  <sbarati@apple.com>
7555
7556         lowXYZ in FTLLower should always filter the type of the incoming edge
7557         https://bugs.webkit.org/show_bug.cgi?id=189939
7558         <rdar://problem/44407030>
7559
7560         Reviewed by Michael Saboff.
7561
7562         * stress/ftl-should-always-filter-for-low-type-check-functions.js: Added.
7563         (foo):
7564         (test):
7565
7566 2018-10-03  Mark Lam  <mark.lam@apple.com>
7567
7568         Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX.
7569         https://bugs.webkit.org/show_bug.cgi?id=190187
7570         <rdar://problem/42512909>
7571
7572         Reviewed by Michael Saboff.
7573
7574         * stress/regress-190187.js: Added.
7575
7576 2018-10-02  Caio Lima  <ticaiolima@gmail.com>
7577
7578         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
7579         https://bugs.webkit.org/show_bug.cgi?id=190033
7580
7581         Reviewed by Yusuke Suzuki.
7582
7583         * stress/big-int-to-string.js:
7584
7585 2018-10-01  Mark Lam  <mark.lam@apple.com>
7586
7587         Function.toString() should also copy the source code Functions that are class definitions.
7588         https://bugs.webkit.org/show_bug.cgi?id=190186
7589         <rdar://problem/44733360>
7590
7591         Reviewed by Saam Barati.
7592
7593         * stress/regress-190186.js: Added.
7594
7595 2018-10-01  Dominik Infuehr  <dinfuehr@igalia.com>
7596
7597         Split NaN-check into separate test
7598         https://bugs.webkit.org/show_bug.cgi?id=190010
7599
7600         Reviewed by Saam Barati.
7601
7602         DataView exposes NaN-representation, which is not necessarily the same on each
7603         architecture. Therefore move the check of the NaN-representation into its own
7604         file such that we can disable this test on MIPS where NaN-representation can be
7605         different on older CPUs.
7606
7607         * stress/dataview-jit-set-nan.js: Added.
7608         (assert):
7609         (test.storeLittleEndian):
7610         (test.storeBigEndian):
7611         (test.store):
7612         (test):
7613         * stress/dataview-jit-set.js:
7614         (test5):
7615
7616 2018-10-01  Commit Queue  <commit-queue@webkit.org>
7617
7618         Unreviewed, rolling out r236647.
7619         https://bugs.webkit.org/show_bug.cgi?id=190124
7620
7621         Breaking test stress/big-int-to-string.js (Requested by
7622         caiolima_ on #webkit).
7623
7624         Reverted changeset:
7625
7626         "[BigInt] BigInt.proptotype.toString is broken when radix is
7627         power of 2"
7628         https://bugs.webkit.org/show_bug.cgi?id=190033
7629         https://trac.webkit.org/changeset/236647
7630
7631 2018-09-30  Caio Lima  <ticaiolima@gmail.com>
7632
7633         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
7634         https://bugs.webkit.org/show_bug.cgi?id=190033
7635
7636         Reviewed by Yusuke Suzuki.
7637
7638         * stress/big-int-to-string.js:
7639
7640 2018-09-28  Caio Lima  <ticaiolima@gmail.com>
7641
7642         [ESNext][BigInt] Implement support for "&"
7643         https://bugs.webkit.org/show_bug.cgi?id=186228
7644
7645         Reviewed by Yusuke Suzuki.
7646
7647         * stress/big-int-bitwise-and-general.js: Added.
7648         (assert):
7649         (assert.sameValue):
7650         * stress/big-int-bitwise-and-jit.js: Added.
7651         (let.assert.sameValue):
7652         (bigIntBitAnd):
7653         * stress/big-int-bitwise-and-memory-stress.js: Added.
7654         (assert):
7655         * stress/big-int-bitwise-and-to-primitive-precedence.js: Added.
7656         (assert.sameValue):
7657         (let.o.Symbol.toPrimitive):
7658         (catch):
7659         * stress/big-int-bitwise-and-type-error.js: Added.
7660         (assert):
7661         (assertThrowTypeError):
7662         (let.o.valueOf):
7663         (o.valueOf):
7664         (o.toString):
7665         (o.Symbol.toPrimitive):
7666         * stress/big-int-bitwise-and-wrapped-value.js: Added.
7667         (assert.sameValue):
7668         (testBitAnd):
7669         (let.o.Symbol.toPrimitive):
7670         (o.valueOf):
7671         (o.toString):
7672
7673 2018-09-28  Ross Kirsling  <ross.kirsling@sony.com>
7674
7675         JSC test stress/jsc-read.js doesn't support CRLF
7676         https://bugs.webkit.org/show_bug.cgi?id=190063
7677
7678         Reviewed by Yusuke Suzuki.
7679
7680         In order to run this test via Windows command prompt, we can't assume that the final newline will be LF.
7681
7682         * stress/jsc-read.js:
7683         (test):
7684
7685 2018-09-27  Saam barati  <sbarati@apple.com>
7686
7687         Verify the contents of AssemblerBuffer on arm64e
7688         https://bugs.webkit.org/show_bug.cgi?id=190057
7689         <rdar://problem/38916630>
7690
7691         Reviewed by Mark Lam.
7692
7693         * stress/regress-189132.js:
7694
7695 2018-09-27  Dominik Infuehr  <dinfuehr@igalia.com>
7696
7697         Disable test without LLInt on ARMv7
7698         https://bugs.webkit.org/show_bug.cgi?id=190037
7699
7700         Reviewed by Mark Lam.
7701
7702         Test runs out of executable memory on ARMv7, do not run
7703         this test without LLInt enabled.
7704
7705         * stress/regress-169445.js:
7706
7707 2018-09-26  Keith Miller  <keith_miller@apple.com>
7708
7709         We should zero unused property storage when rebalancing array storage.
7710         https://bugs.webkit.org/show_bug.cgi?id=188151
7711
7712         Reviewed by Michael Saboff.
7713
7714         * stress/splice-should-zero-property-storage-when-rebalancing.js: Added.
7715
7716 2018-09-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
7717
7718         [JSC] Optimize Array#lastIndexOf
7719         https://bugs.webkit.org/show_bug.cgi?id=189780
7720
7721         Reviewed by Saam Barati.
7722
7723         * stress/array-lastindexof-array-prototype-trap.js: Added.
7724         (shouldBe):
7725         (AncestorArray.prototype.get 2):
7726         (AncestorArray):
7727         * stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added.
7728         (shouldBe):
7729         * stress/array-lastindexof-hole-nan.js: Added.
7730         (shouldBe):
7731         (throw.new.Error):
7732         * stress/array-lastindexof-infinity.js: Added.
7733         (shouldBe):
7734         (throw.new.Error):
7735         * stress/array-lastindexof-negative-zero.js: Added.
7736         (shouldBe):
7737         (throw.new.Error):
7738         * stress/array-lastindexof-own-getter.js: Added.
7739         (shouldBe):
7740         (throw.new.Error.get array):
7741         (get array):
7742         * stress/array-lastindexof-prototype-trap.js: Added.
7743         (shouldBe):
7744         (DerivedArray.prototype.get 2):
7745         (DerivedArray):
7746
7747 2018-09-25  Saam Barati  <sbarati@apple.com>
7748
7749         Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
7750         https://bugs.webkit.org/show_bug.cgi?id=189940
7751         <rdar://problem/43640987>
7752
7753         Reviewed by Mark Lam.
7754
7755         * stress/use-baseline-codeblock-materialize-osr-exit.js: Added.
7756
7757 2018-09-24  Saam Barati  <sbarati@apple.com>
7758
7759         Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects
7760         https://bugs.webkit.org/show_bug.cgi?id=189922
7761         <rdar://problem/44651275>
7762
7763         Reviewed by Mark Lam.
7764
7765         * stress/array-indexof-fast-path-effects.js: Added.
7766         * stress/array-indexof-cached-length.js: Added.
7767
7768 2018-09-24  Saam barati  <sbarati@apple.com>
7769
7770         ArgumentsEliminationPhase should snip basic blocks after proven OSR exits
7771         https://bugs.webkit.org/show_bug.cgi?id=189682
7772         <rdar://problem/43557315>
7773
7774         Reviewed by Mark Lam.
7775
7776         * stress/arguments-elimination-will-generate-edge-without-result.js: Added.
7777         (foo):
7778
7779 2018-09-22  Saam barati  <sbarati@apple.com>
7780
7781         The sampling should not use Strong<CodeBlock> in its machineLocation field
7782         https://bugs.webkit.org/show_bug.cgi?id=189319
7783
7784         Reviewed by Filip Pizlo.
7785
7786         * stress/sampling-profiler-richards.js: Added.
7787
7788 2018-09-19  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
7789
7790         [JSC] Optimize Array#indexOf in C++ runtime
7791         https://bugs.webkit.org/show_bug.cgi?id=189507
7792
7793         Reviewed by Saam Barati.
7794
7795         * stress/array-indexof-array-prototype-trap.js: Added.
7796         (shouldBe):
7797         (AncestorArray.prototype.get 2):
7798         (AncestorArray):
7799         * stress/array-indexof-have-a-bad-time-c-runtime.js: Added.
7800         (shouldBe):
7801         * stress/array-indexof-hole-nan.js: Added.
7802         (shouldBe):
7803         (throw.new.Error):
7804         * stress/array-indexof-infinity.js: Added.
7805         (shouldBe):
7806         (throw.new.Error):
7807         * stress/array-indexof-negative-zero.js: Added.
7808         (shouldBe):
7809         (throw.new.Error):
7810         * stress/array-indexof-own-getter.js: Added.
7811         (shouldBe):
7812         (throw.new.Error.get array):
7813         (get array):
7814         * stress/array-indexof-prototype-trap.js: Added.
7815         (shouldBe):
7816         (DerivedArray.prototype.get 2):
7817         (DerivedArray):
7818
7819 2018-09-19  Saam barati  <sbarati@apple.com>
7820
7821         AI rule for MultiPutByOffset executes its effects in the wrong order
7822         https://bugs.webkit.org/show_bug.cgi?id=189757
7823         <rdar://problem/43535257>
7824
7825         Reviewed by Michael Saboff.
7826
7827         * stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
7828         (foo):
7829         (Foo):
7830         (g):
7831
7832 2018-09-17  Mark Lam  <mark.lam@apple.com>
7833
7834         Ensure that ForInContexts are invalidated if their loop local is over-written.
7835         https://bugs.webkit.org/show_bug.cgi?id=189571
7836         <rdar://problem/44402277>
7837
7838         Reviewed by Saam Barati.
7839
7840         * stress/regress-189571.js: Added.
7841
7842 2018-09-17  Saam barati  <sbarati@apple.com>
7843
7844         We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
7845         https://bugs.webkit.org/show_bug.cgi?id=189676
7846         <rdar://problem/39682897>
7847
7848         Reviewed by Michael Saboff.
7849
7850         * typeProfiler/check-structure-or-empty-in-fixup.js: Added.
7851         (A):
7852         (K):
7853         (i.catch):
7854
7855 2018-09-14  Saam barati  <sbarati@apple.com>
7856
7857         Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
7858         https://bugs.webkit.org/show_bug.cgi?id=189628
7859         <rdar://problem/39481690>
7860
7861         Reviewed by Mark Lam.
7862
7863         * stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
7864         (foo):
7865
7866 2018-09-11  Mark Lam  <mark.lam@apple.com>
7867
7868         Test for array initialization in arrayProtoFuncSplice.
7869         https://bugs.webkit.org/show_bug.cgi?id=170253
7870         <rdar://problem/31328773>
7871
7872         Rubber-stamped by Saam Barati.
7873
7874         * stress/regress-170253.js: Added.
7875
7876 2018-09-11  Mark Lam  <mark.lam@apple.com>
7877
7878         Test for IntlObject initialization.
7879         https://bugs.webkit.org/show_bug.cgi?id=170251
7880         <rdar://problem/31328419>
7881
7882         Rubber-stamped by Saam Barati.
7883
7884         * stress/regress-170251.js: Added.
7885
7886 2018-09-11  Mark Lam  <mark.lam@apple.com>
7887
7888         Test for array memcpy'ing when JSGlobalObject::haveABadTime.
7889         https://bugs.webkit.org/show_bug.cgi?id=169889
7890         <rdar://problem/31155607>
7891
7892         Reviewed by Saam Barati.
7893
7894         * stress/regress-169889-array-concat.js: Added.
7895         * stress/regress-169889-array-concat1.js: Added.
7896         * stress/regress-169889-array-slice.js: Added.
7897
7898 2018-09-11  Mark Lam  <mark.lam@apple.com>
7899
7900         Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope.
7901         https://bugs.webkit.org/show_bug.cgi?id=169445
7902         <rdar://problem/30957435>
7903
7904         Reviewed by Saam Barati.
7905
7906         * stress/regress-169445.js: Added.
7907         (let.gun.eval.A):
7908         (let.gun.eval.B.C):
7909         (let.gun.eval.B.C.prototype.trigger):
7910         (let.gun.eval.B.C.prototype.triggerWithRestParameters):
7911         (let.gun.eval.B):
7912         (let.gun.eval):
7913
7914 == Rolled over to ChangeLog-2018-09-11 ==