JSTests/ChangeLog-2018-09-11

   1 2018-09-10  Michael Saboff  <msaboff@apple.com>
   2
   3         Test262 failure with Named Capture Groups - using a reference before the group is defined
   4         https://bugs.webkit.org/show_bug.cgi?id=189407
   5
   6         Reviewed by Alex Christensen.
   7
   8         Re-enabled previously failing test.
   9
  10         * test262.yaml:
  11         * test262/expectations.yaml:
  12
  13 2018-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
  14
  15         [JSC] Remove loadModule function in jsc.cpp
  16         https://bugs.webkit.org/show_bug.cgi?id=184808
  17
  18         Reviewed by Darin Adler.
  19
  20         Use `import` expression instead.
  21
  22         * modules/different-view.js:
  23         (from.string_appeared_here.shouldThrow): Deleted.
  24         * modules/fallback-ambiguous.js:
  25         (from.string_appeared_here.shouldThrow): Deleted.
  26         * modules/import-error.js:
  27         (from.string_appeared_here.shouldThrow): Deleted.
  28         (shouldThrow): Deleted.
  29         * modules/indirect-export-error.js:
  30         (from.string_appeared_here.shouldThrow): Deleted.
  31         (shouldThrow): Deleted.
  32         * modules/namespace-error.js:
  33         (from.string_appeared_here.shouldThrow): Deleted.
  34
  35 2018-09-07  Mark Lam  <mark.lam@apple.com>
  36
  37         Ensure that handleIntrinsicCall() is only applied on op_call shaped instructions.
  38         https://bugs.webkit.org/show_bug.cgi?id=189317
  39         <rdar://problem/44152198>
  40
  41         Reviewed by Filip Pizlo.
  42
  43         * stress/regress-189317.js: Added.
  44         (testGetter):
  45         (testSetter):
  46
  47 2018-09-06  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
  48
  49         [DFG] DFG should handle String#toString
  50         https://bugs.webkit.org/show_bug.cgi?id=189151
  51
  52         Reviewed by Saam Barati.
  53
  54         The error message in String#toString and String#valueOf is poor, which will be
  55         handled in a separate bug[1].
  56
  57         [1]: https://bugs.webkit.org/show_bug.cgi?id=189357
  58
  59         * microbenchmarks/string-object-to-string.js: Added.
  60         (test):
  61         * microbenchmarks/string-object-value-of.js: Added.
  62         (test):
  63         * stress/string-to-string-error.js: Added.
  64         (shouldThrow):
  65         (test):
  66         * stress/string-to-string.js: Added.
  67         (shouldBe):
  68         (test1):
  69         (test2):
  70         (test3):
  71         * stress/string-value-of-error.js: Added.
  72         (shouldThrow):
  73         (test):
  74         * stress/string-value-of.js: Added.
  75         (shouldBe):
  76         (test1):
  77         (test2):
  78         (test3):
  79
  80 2018-09-06  Michael Saboff  <msaboff@apple.com>
  81
  82         Improper speculation type for Math.pow(NaN, 0) in Abstract Interpreter
  83         https://bugs.webkit.org/show_bug.cgi?id=189380
  84
  85         Reviewed by Saam Barati.
  86
  87         New test.
  88
  89         * stress/math-pow-nan-to-zero-spec-type.js: Added.
  90         (func):
  91         (test):
  92
  93 2018-09-06  Mark Lam  <mark.lam@apple.com>
  94
  95         Gardening: Move regress-189185.js under JSTests/wasm.
  96         https://bugs.webkit.org/show_bug.cgi?id=189347
  97
  98         Unreviewed.
  99
 100         * stress/regress-189185.js: Removed.
 101         * wasm/regress/regress-189185.js: Copied from JSTests/stress/regress-189185.js.
 102
 103 2018-09-05  Mark Lam  <mark.lam@apple.com>
 104
 105         JSPropertyNameEnumerator::visitChildren() needs to visit its m_cachedStructureID.
 106         https://bugs.webkit.org/show_bug.cgi?id=189124
 107         <rdar://problem/43863605>
 108
 109         Reviewed by Filip Pizlo.
 110
 111         * stress/regress-189124.js: Added.
 112
 113 2018-09-05  Ross Kirsling  <ross.kirsling@sony.com>
 114
 115         [ESNext] Symbol.prototype.description
 116         https://bugs.webkit.org/show_bug.cgi?id=186686
 117
 118         Reviewed by Keith Miller.
 119
 120         * stress/symbol-description.js:
 121         Add tests for empty and null symbol cases.
 122
 123         * test262/config.yaml:
 124         Enable Symbol.prototype.description tests.
 125
 126 2018-09-05  David Fenton  <david_fenton@apple.com>
 127
 128         [32-bit JSC tests] Exception: ReferenceError: Can't find variable: WebAssembly.
 129         https://bugs.webkit.org/show_bug.cgi?id=189312.
 130
 131         Unreviewed test gardening.
 132
 133         * stress/regress-189185.js:
 134
 135 2018-09-05  Mark Lam  <mark.lam@apple.com>
 136
 137         isAsyncGeneratorMethodParseMode() should check for SourceParseMode::AsyncGeneratorWrapperMethodMode.
 138         https://bugs.webkit.org/show_bug.cgi?id=189292
 139         <rdar://problem/38907433>
 140
 141         Reviewed by Saam Barati.
 142
 143         * stress/regress-189292.js: Added.
 144
 145 2018-09-04  David Fenton  <david_fenton@apple.com>
 146
 147         Skip Test on 32-bit platforms.
 148         https://bugs.webkit.org/show_bug.cgi?id=189185.
 149
 150         Unreviewed test gardening.
 151
 152         * stress/regress-189185.js:
 153
 154 2018-09-03  Mark Lam  <mark.lam@apple.com>
 155
 156         The watchdog sometimes fails to terminate a script.
 157         https://bugs.webkit.org/show_bug.cgi?id=189227
 158         <rdar://problem/39932857>
 159
 160         Reviewed by Saam Barati.
 161
 162         * stress/regress-189227-watchdog-on-infinite-loop.js: Added.
 163
 164 2018-09-02  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 165
 166         Implement Object.fromEntries
 167         https://bugs.webkit.org/show_bug.cgi?id=188481
 168
 169         Reviewed by Darin Adler.
 170
 171         * stress/object-from-entries.js: Added.
 172         (shouldBe):
 173         (shouldThrow):
 174         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
 175         (shouldBe.set get shouldThrow):
 176
 177 2018-08-24  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 178
 179         Function object should convert params to string before throw a parsing error
 180         https://bugs.webkit.org/show_bug.cgi?id=188874
 181
 182         Reviewed by Darin Adler.
 183
 184         * stress/function-body-to-string-before-parameter-syntax-check.js: Added.
 185         (shouldThrow):
 186
 187 2018-08-31  Mark Lam  <mark.lam@apple.com>
 188
 189         Fix exception check accounting in constructJSWebAssemblyCompileError().
 190         https://bugs.webkit.org/show_bug.cgi?id=189185
 191         <rdar://problem/39786007>
 192
 193         Reviewed by Michael Saboff.
 194
 195         * stress/regress-189185.js: Added.
 196         (new.WebAssembly.CompileError.valueOf):
 197
 198 2018-08-31  Mark Lam  <mark.lam@apple.com>
 199
 200         Fix exception check accounting in JSDataView::defineOwnProperty().
 201         https://bugs.webkit.org/show_bug.cgi?id=189186
 202         <rdar://problem/39786049>
 203
 204         Reviewed by Michael Saboff.
 205
 206         * stress/regress-189186.js: Added.
 207
 208 2018-08-31  Mark Lam  <mark.lam@apple.com>
 209
 210         Add missing exception check in arrayProtoFuncLastIndexOf().
 211         https://bugs.webkit.org/show_bug.cgi?id=189184
 212         <rdar://problem/39785959>
 213
 214         Reviewed by Yusuke Suzuki.
 215
 216         * stress/regress-189184.js: Added.
 217
 218 2018-08-31  Saam barati  <sbarati@apple.com>
 219
 220         convertToRegExpMatchFastGlobal must use KnownString as the child use kind
 221         https://bugs.webkit.org/show_bug.cgi?id=189173
 222         <rdar://problem/43501645>
 223
 224         Reviewed by Michael Saboff.
 225
 226         * stress/may-exit-should-be-false-regexp-constant-folding.js: Added.
 227         (foo):
 228         (bar):
 229
 230 2018-08-30  Saam barati  <sbarati@apple.com>
 231
 232         CSE DataViewGet* DFG nodes
 233         https://bugs.webkit.org/show_bug.cgi?id=188768
 234
 235         Reviewed by Yusuke Suzuki.
 236
 237         * microbenchmarks/dataview-cse.js: Added.
 238         (assert):
 239         (test):
 240         * stress/dataview-get-cse.js: Added.
 241         (assert):
 242         (test1.foo):
 243         (test1):
 244         (test2.foo):
 245         (test2):
 246         (test3.foo):
 247         (test3):
 248         (test4.foo):
 249         (test4):
 250         (test5.foo):
 251         (test5):
 252         (test6.foo):
 253         (test6):
 254
 255 2018-08-30  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 256
 257         output of toString() of Generator is wrong
 258         https://bugs.webkit.org/show_bug.cgi?id=188952
 259
 260         Reviewed by Saam Barati.
 261
 262         * stress/function-to-string.js: Added.
 263         (shouldBe):
 264         (shouldBe.test):
 265         (test):
 266         (shouldBe.async.test):
 267         (async.test):
 268         (shouldBe.async):
 269         (async):
 270         * test262/expectations.yaml:
 271
 272 2018-08-29  Mark Lam  <mark.lam@apple.com>
 273
 274         Add some missing exception checks in JSRopeString::resolveRopeToAtomicString().
 275         https://bugs.webkit.org/show_bug.cgi?id=189132
 276         <rdar://problem/42513068>
 277
 278         Reviewed by Saam Barati.
 279
 280         * stress/regress-189132.js: Added.
 281
 282 2018-08-27  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 283
 284         [WebAssembly] Parse wasm modules in a streaming fashion
 285         https://bugs.webkit.org/show_bug.cgi?id=188943
 286
 287         Reviewed by Mark Lam.
 288
 289         Wasm parsing error should not report the total byte size since streaming parsing does not
 290         want to load all the bytes.
 291         Add a simple test wasm/stress/streaming-basic.js for initial streaming parsing implementation.
 292
 293         * wasm/function-tests/invalid-duplicate-export.js:
 294         * wasm/function-tests/memory-alignment.js:
 295         (const.op.of.WASM.opcodes):
 296         * wasm/function-tests/memory-section-and-import.js:
 297         * wasm/function-tests/void-argument-type-should-be-a-validation-error.js:
 298         * wasm/js-api/Module-compile.js:
 299         (async.testPromiseAPI):
 300         * wasm/js-api/element.js:
 301         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
 302         (assert.throws):
 303         * wasm/js-api/global-error.js:
 304         (assert.throws.new.WebAssembly.Module.bin):
 305         (assert.throws):
 306         * wasm/js-api/table.js:
 307         (new.WebAssembly.Module):
 308         (assert.throws):
 309         (assertBadTableImport):
 310         * wasm/js-api/test_Data.js:
 311         (DataSectionWithoutMemory):
 312         * wasm/js-api/test_Start.js:
 313         (InvalidStartFunctionIndex):
 314         * wasm/js-api/test_basic_api.js:
 315         (const.c.in.constructorProperties.switch):
 316         * wasm/js-api/version.js:
 317         * wasm/stress/nameSection.wasm: Added.
 318         * wasm/stress/streaming-basic.js: Added.
 319         (check):
 320
 321 2018-08-27  Mark Lam  <mark.lam@apple.com>
 322
 323         Fix exception throwing code so that topCallFrame and topEntryFrame stay true to their names.
 324         https://bugs.webkit.org/show_bug.cgi?id=188577
 325         <rdar://problem/42985684>
 326
 327         Reviewed by Saam Barati.
 328
 329         * stress/regress-188577.js: Added.
 330
 331 2018-08-24  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 332
 333         [JSC] Array.prototype.reverse modifies JSImmutableButterfly
 334         https://bugs.webkit.org/show_bug.cgi?id=188794
 335
 336         Reviewed by Saam Barati.
 337
 338         * stress/reverse-with-immutable-butterfly.js: Added.
 339         (shouldBe):
 340         (reverseInt):
 341         (reverseDouble):
 342         (reverseContiguous):
 343
 344 2018-08-22  Saam barati  <sbarati@apple.com>
 345
 346         Make data-view-access.js run less time to prevent timeouts on 32-bit
 347
 348         * microbenchmarks/data-view-accesses.js:
 349
 350 2018-08-22  Mark Lam  <mark.lam@apple.com>
 351
 352         The DFG CFGSimplification phase shouldn’t jettison a block when it’s the target of both branch directions.
 353         https://bugs.webkit.org/show_bug.cgi?id=188298
 354         <rdar://problem/42888427>
 355
 356         Reviewed by Saam Barati.
 357
 358         * stress/bug-188298.js: Added.
 359
 360 2018-08-20  Saam barati  <sbarati@apple.com>
 361
 362         Inline DataView accesses into DFG/FTL
 363         https://bugs.webkit.org/show_bug.cgi?id=188573
 364         <rdar://problem/43286746>
 365
 366         Reviewed by Michael Saboff.
 367
 368         * microbenchmarks/data-view-accesses-2.js: Added.
 369         (assert):
 370         (let.p.of.Object.keys.let.str):
 371         (let.p.of.Object.keys):
 372         (test):
 373         * microbenchmarks/data-view-accesses.js: Added.
 374         (assert):
 375         (let.p.of.Object.keys.let.str):
 376         (let.p.of.Object.keys):
 377         * stress/dataview-jit-bounds-checks.js: Added.
 378         (assert):
 379         (let.p.of.Object.keys.let.str):
 380         (let.p.of.Object.keys):
 381         * stress/dataview-jit-get.js: Added.
 382         (assert):
 383         (test1.bigEndian):
 384         (test1.littleEndian):
 385         (test1.biEndian):
 386         (test1):
 387         (test2.bigEndian):
 388         (test2.littleEndian):
 389         (test2.biEndian):
 390         (test2):
 391         (test3.bigEndian):
 392         (test3.littleEndian):
 393         (test3.biEndian):
 394         (test3):
 395         (test4.bigEndian):
 396         (test4.littleEndian):
 397         (test4.biEndian):
 398         (test4):
 399         (test5.bigEndian):
 400         (test5.littleEndian):
 401         (test5.biEndian):
 402         (test5):
 403         (test6.bigEndian):
 404         (test6.littleEndian):
 405         (test6.biEndian):
 406         (test6):
 407         (test7.load):
 408         (test7):
 409         (test8.load):
 410         (test8):
 411         * stress/dataview-jit-neuter.js: Added.
 412         (assert):
 413         (test.load):
 414         (test):
 415         (test2.load):
 416         (test2):
 417         * stress/dataview-jit-set.js: Added.
 418         (assert):
 419         (isLittleEndian):
 420         (readByte):
 421         (readHex):
 422         (test.storeLittleEndian):
 423         (test.storeBigEndian):
 424         (test.store):
 425         (test):
 426         (test2.storeLittleEndian):
 427         (test2.storeBigEndian):
 428         (test2.store):
 429         (test2):
 430         (test3.storeLittleEndian):
 431         (test3.storeBigEndian):
 432         (test3.store):
 433         (test3):
 434         (test4.storeLittleEndian):
 435         (test4.storeBigEndian):
 436         (test4.store):
 437         (test4):
 438         (test5.storeLittleEndian):
 439         (test5.storeBigEndian):
 440         (test5.store):
 441         (test5):
 442         (test6.storeLittleEndian):
 443         (test6.storeBigEndian):
 444         (test6.store):
 445         (test6):
 446         (test7.store):
 447         (test7):
 448         (test8.store):
 449         (test8):
 450         * stress/dataview-jit-unaligned-accesses.js: Added.
 451         (assert):
 452         (let.p.of.Object.keys.let.str):
 453         (let.p.of.Object.keys):
 454
 455 2018-08-20  Yusuke Suzuki  <utatane.tea@gmail.com>
 456
 457         [YARR] Extend size of fixed characters bulk matching in 64bit platform
 458         https://bugs.webkit.org/show_bug.cgi?id=181989
 459
 460         Reviewed by Michael Saboff.
 461
 462         * stress/characters-regexp-ignore-case.js: Added.
 463         (shouldBe):
 464         (testH):
 465         (testHe):
 466         (testHel):
 467         (testHell):
 468         (testHello):
 469         (testHelloW):
 470         (testHelloWo):
 471         (testHelloWor):
 472         (testHelloWorl):
 473         (testHelloWorld):
 474         * stress/characters-regexp.js: Added.
 475         (shouldBe):
 476         (testH):
 477         (testHe):
 478         (testHel):
 479         (testHell):
 480         (testHello):
 481         (testHelloW):
 482         (testHelloWo):
 483         (testHelloWor):
 484         (testHelloWorl):
 485         (testHelloWorld):
 486
 487 2018-08-17  Saam barati  <sbarati@apple.com>
 488
 489         intersectionOfPastValuesAtHead must filter values after they've observed an invalidation point
 490         https://bugs.webkit.org/show_bug.cgi?id=188707
 491         <rdar://problem/43015442>
 492
 493         Reviewed by Mark Lam.
 494
 495         * stress/cfa-expected-values-must-set-clobbered-to-false.js: Added.
 496         (foo):
 497         (let.comp.valueOf):
 498         (result):
 499
 500 2018-08-10  Keith Miller  <keith_miller@apple.com>
 501
 502         Slicing an ArrayBuffer with a long number returns an ArrayBuffer with byteLength zero
 503         https://bugs.webkit.org/show_bug.cgi?id=185127
 504
 505         Reviewed by Saam Barati.
 506
 507         Rebaseline the expectations.
 508
 509         * test262/expectations.yaml:
 510
 511 2018-08-10  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 512
 513         Date.UTC should not return NaN with only Year param
 514         https://bugs.webkit.org/show_bug.cgi?id=188378
 515
 516         Reviewed by Keith Miller.
 517
 518         * ChakraCore.yaml:
 519         * ChakraCore/test/Date/dateutc.baseline-jsc: Added.
 520         * stress/date-utc-optional.js: Added.
 521         (shouldBe):
 522         * test262/expectations.yaml:
 523
 524 2018-08-08  Keith Miller  <keith_miller@apple.com>
 525
 526         Array.prototype.sort should call @toLength instead of ">>> 0"
 527         https://bugs.webkit.org/show_bug.cgi?id=188430
 528
 529         Reviewed by Saam Barati.
 530
 531         * test262/expectations.yaml:
 532
 533 2018-08-08  Keith Miller  <keith_miller@apple.com>
 534
 535         Array.prototype.sort should throw TypeError if param is a not callable object
 536         https://bugs.webkit.org/show_bug.cgi?id=188382
 537
 538         Reviewed by Saam Barati.
 539
 540         * test262/expectations.yaml:
 541
 542 2018-08-01  Andy VanWagoner  <andy@vanwagoner.family>
 543
 544         [INTL] Implement hourCycle in DateTimeFormat
 545         https://bugs.webkit.org/show_bug.cgi?id=188006
 546
 547         Reviewed by Darin Adler.
 548
 549         Removed fixed hourCycle expectations.
 550
 551         * test262/expectations.yaml:
 552
 553 2018-07-25  Yusuke Suzuki  <utatane.tea@gmail.com>
 554
 555         [JSC] Record CoW status in ArrayProfile correctly
 556         https://bugs.webkit.org/show_bug.cgi?id=187949
 557
 558         Reviewed by Saam Barati.
 559
 560         * stress/array-profile-should-record-copy-on-write.js: Added.
 561         (shouldBe):
 562         (test1):
 563         (test2):
 564         (test3):
 565
 566 2018-07-26  Mark Lam  <mark.lam@apple.com>
 567
 568         arrayProtoPrivateFuncConcatMemcpy() should handle copying from an Undecided type array.
 569         https://bugs.webkit.org/show_bug.cgi?id=188065
 570         <rdar://problem/42515726>
 571
 572         Reviewed by Saam Barati.
 573
 574         * stress/regress-188065.js: Added.
 575
 576 2018-07-25  Andy VanWagoner  <andy@vanwagoner.family>
 577
 578         [INTL] Call Typed Array elements toLocaleString with locale and options
 579         https://bugs.webkit.org/show_bug.cgi?id=185796
 580
 581         Reviewed by Keith Miller.
 582
 583         Remove now passing TypedArray toLocaleString expectation.
 584
 585         * test262/expectations.yaml:
 586
 587 2018-07-25  Andy VanWagoner  <andy@vanwagoner.family>
 588
 589         [INTL] Intl constructor lengths should be configurable
 590         https://bugs.webkit.org/show_bug.cgi?id=187960
 591
 592         Reviewed by Saam Barati.
 593
 594         Removed fixed length expectations, and updated Intl.Locale expectations
 595         that error differently since r234127.
 596
 597         * test262/expectations.yaml:
 598
 599 2018-07-24  Commit Queue  <commit-queue@webkit.org>
 600
 601         Unreviewed, rolling out r234183.
 602         https://bugs.webkit.org/show_bug.cgi?id=187983
 603
 604         cause regression in Kraken gaussian blur and desaturate
 605         (Requested by yusukesuzuki on #webkit).
 606
 607         Reverted changeset:
 608
 609         "[JSC] Record CoW status in ArrayProfile"
 610         https://bugs.webkit.org/show_bug.cgi?id=187949
 611         https://trac.webkit.org/changeset/234183
 612
 613 2018-07-24  Yusuke Suzuki  <utatane.tea@gmail.com>
 614
 615         [JSC] Record CoW status in ArrayProfile
 616         https://bugs.webkit.org/show_bug.cgi?id=187949
 617
 618         Reviewed by Saam Barati.
 619
 620         * stress/array-profile-should-record-copy-on-write.js: Added.
 621         (shouldBe):
 622         (test1):
 623         (test2):
 624         (test3):
 625
 626 2018-07-23  Saam Barati  <sbarati@apple.com>
 627
 628         need to didFoldClobberWorld when we constant fold GetByVal
 629         https://bugs.webkit.org/show_bug.cgi?id=187917
 630         <rdar://problem/42505095>
 631
 632         Reviewed by Yusuke Suzuki.
 633
 634         * stress/get-by-val-fold-did-clobber-world.js: Added.
 635         (__f_443):
 636
 637 2018-07-23  Andy VanWagoner  <andy@vanwagoner.family>
 638
 639         [INTL] Language tags are not canonicalized
 640         https://bugs.webkit.org/show_bug.cgi?id=185836
 641
 642         Reviewed by Keith Miller.
 643
 644         Remove expected failures that have been fixed.
 645
 646         * test262/expectations.yaml:
 647
 648 2018-07-22  Yusuke Suzuki  <utatane.tea@gmail.com>
 649
 650         [JSC] GetByIdVariant and InByIdVariant do not need slot base if they are not "hit" variants
 651         https://bugs.webkit.org/show_bug.cgi?id=187891
 652
 653         Reviewed by Saam Barati.
 654
 655         * stress/in-miss-variant-merge.js: Added.
 656         (shouldBe):
 657         (test):
 658         * stress/miss-variant-merge.js: Added.
 659         (shouldBe):
 660         (test):
 661
 662 2018-07-22  Yusuke Suzuki  <utatane.tea@gmail.com>
 663
 664         [DFG] Fold GetByVal if the indexed value is non configurable and non writable
 665         https://bugs.webkit.org/show_bug.cgi?id=186462
 666
 667         Reviewed by Saam Barati.
 668
 669         * stress/folding-get-by-val-with-read-only-dont-delete-object.js: Added.
 670         (shouldBe):
 671         (test1):
 672         (test2):
 673         (test3):
 674         (test4):
 675         (test5):
 676         * stress/folding-get-by-val-with-read-only-dont-delete-runtime-array.js: Added.
 677         (shouldBe):
 678         (test1):
 679         (test2):
 680         (test5):
 681         * stress/folding-get-by-val-with-read-only-dont-delete.js: Added.
 682         (shouldBe):
 683         (test1):
 684         (test2):
 685         (test3):
 686         (test4):
 687         (test5):
 688
 689 2018-06-02  Filip Pizlo  <fpizlo@apple.com>
 690
 691         We should support CreateThis in the FTL
 692         https://bugs.webkit.org/show_bug.cgi?id=164904
 693
 694         Reviewed by Yusuke Suzuki.
 695
 696         * microbenchmarks/polyvariant-get-by-id-shorter-tower.js: Added.
 697         (polyvariant):
 698         (Foo.prototype.func):
 699         (Foo):
 700         (foo):
 701         (Bar.prototype.func):
 702         (Bar):
 703         (bar):
 704         * microbenchmarks/polyvariant-get-by-id-tower.js: Added.
 705         (polyvariant):
 706         (Foo.prototype.func):
 707         (Foo):
 708         (foo):
 709         (Bar.prototype.func):
 710         (Bar):
 711         (bar):
 712         (Baz.prototype.func):
 713         (Baz):
 714         (baz):
 715
 716 2018-07-20  Michael Saboff  <msaboff@apple.com>
 717
 718         DFG AbstractInterpreter: CheckArray filters array modes for DirectArguments/ScopedArguments using only NonArray
 719         https://bugs.webkit.org/show_bug.cgi?id=187827
 720         rdar://problem/42146858
 721
 722         Reviewed by Saam Barati.
 723
 724         New regression tests.
 725
 726         * stress/direct-arguments-check-array.js: Added.
 727         (setup.f2):
 728         (setup):
 729         (forOfArray):
 730         (forOfArgs):
 731         (callEveryOnArgs):
 732         * stress/scoped-arguments-check-array.js: Added.
 733         (setup.foo):
 734         (setup.f2):
 735         (setup):
 736         (forOfArray):
 737         (forOfArgs):
 738         (callEveryOnArgs):
 739
 740 2018-07-20  Yusuke Suzuki  <utatane.tea@gmail.com>
 741
 742         [DFG] Fold GetByVal if Array is CoW
 743         https://bugs.webkit.org/show_bug.cgi?id=186459
 744
 745         Reviewed by Saam Barati.
 746
 747         * stress/folding-get-by-val-with-immutable-butterfly-out-of-bounds-foldable.js: Added.
 748         (shouldBe):
 749         (test0):
 750         (test1):
 751         (test2):
 752         (test3):
 753         (test4):
 754         (test5):
 755         * stress/folding-get-by-val-with-immutable-butterfly-out-of-bounds.js: Added.
 756         (shouldBe):
 757         (test0):
 758         (test1):
 759         (test2):
 760         (test3):
 761         (test4):
 762         (test5):
 763         * stress/folding-get-by-val-with-immutable-butterfly-with-types.js: Added.
 764         (shouldBe):
 765         (test0):
 766         (test1):
 767         (test2):
 768         (test3):
 769         (test4):
 770         (test5):
 771         * stress/folding-get-by-val-with-immutable-butterfly.js: Added.
 772         (shouldBe):
 773         (checking):
 774         (test):
 775
 776 2018-07-20  Saam Barati  <sbarati@apple.com>
 777
 778         CompareEq should be using KnownOtherUse instead of OtherUse
 779         https://bugs.webkit.org/show_bug.cgi?id=186814
 780         <rdar://problem/39720030>
 781
 782         Reviewed by Filip Pizlo.
 783
 784         * stress/compare-eq-should-use-known-other-use.js: Added.
 785         (bar):
 786         (i.func):
 787
 788 2018-07-20  David Fenton  <david_fenton@apple.com>
 789
 790         stress/spread-forward-varargs-stack-overflow.js is timing out in 32 bit JSC tests.
 791         https://bugs.webkit.org/show_bug.cgi?id=187698
 792
 793         Unreviewed test gardening, skipped test in 32 Bit JSC.
 794
 795         * stress/spread-forward-varargs-stack-overflow.js:
 796
 797 2018-07-18  Yusuke Suzuki  <utatane.tea@gmail.com>
 798
 799         JSON.stringify should emit non own properties if second array argument includes
 800         https://bugs.webkit.org/show_bug.cgi?id=187724
 801
 802         Reviewed by Mark Lam.
 803
 804         * stress/json-stringify-getter-call.js: Added.
 805         (shouldBe):
 806         (A.prototype.get cocoa):
 807         (A.prototype.get cappuccino):
 808         (A):
 809         (shouldBe.JSON.stringify):
 810
 811 2018-07-18  Yusuke Suzuki  <utatane.tea@gmail.com>
 812
 813         [JSC] JSON.stringify's replacer should use `isArray` instead of JSArray checks
 814         https://bugs.webkit.org/show_bug.cgi?id=187755
 815
 816         Reviewed by Mark Lam.
 817
 818         * stress/json-stringify-gap-calculation-should-be-after-replacer-check.js: Added.
 819         (shouldThrow):
 820         (shouldThrow.string.toString):
 821         * test262/expectations.yaml:
 822
 823 2018-07-12  Yusuke Suzuki  <utatane.tea@gmail.com>
 824
 825         [JSC] Generator and AsyncGeneratorMethod's prototype is incorrect
 826         https://bugs.webkit.org/show_bug.cgi?id=187585
 827
 828         Reviewed by Darin Adler.
 829
 830         * stress/default-proto-for-async-generator.js: Added.
 831         (shouldBe):
 832         (async.asyncGenerator):
 833         * stress/default-proto-for-generator.js: Added.
 834         (shouldBe):
 835         (generator):
 836         * stress/prototype-for-async-generator.js: Added.
 837         (shouldBe):
 838         (async.asyncGenerator):
 839         (A.prototype.async.asyncGenerator):
 840         (A):
 841         * test262/expectations.yaml:
 842
 843 2018-07-11  Ryan Haddad  <ryanhaddad@apple.com>
 844
 845         Skip JSC test stress/keep-checks-when-converting-to-lazy-js-constant-in-strength-reduction.js
 846         https://bugs.webkit.org/show_bug.cgi?id=187559
 847
 848         Unreviewed test gardening.
 849
 850         * stress/keep-checks-when-converting-to-lazy-js-constant-in-strength-reduction.js:
 851
 852 2018-07-11  Yusuke Suzuki  <utatane.tea@gmail.com>
 853
 854         Iterator of Array.keys() returns object in wrong order
 855         https://bugs.webkit.org/show_bug.cgi?id=185197
 856
 857         Reviewed by Keith Miller.
 858
 859         We align the shape of our iterator result to the spec: {value,done} instead of {done,value}.
 860
 861         * stress/iterator-field-order.js: Added.
 862         (shouldBe):
 863         (shouldBe.JSON.stringify.array.values.next):
 864         (shouldBe.JSON.stringify.array.keys.next):
 865         (shouldBe.JSON.stringify.array.entries.next):
 866         (async.asyncIterator):
 867         (iterator.next.then):
 868         (generator):
 869         (shouldBe.JSON.stringify.generator.next):
 870         (shouldBe.JSON.stringify.map.keys.next):
 871         (shouldBe.JSON.stringify.map.values.next):
 872         (shouldBe.JSON.stringify.map.entries.next):
 873         (set new):
 874
 875 2018-07-11  Yusuke Suzuki  <utatane.tea@gmail.com>
 876
 877         Unreviewed, clean up test262 expectations
 878
 879         * test262/expectations.yaml:
 880
 881 2018-07-10  Mark Lam  <mark.lam@apple.com>
 882
 883         constructArray() should always allocate the requested length.
 884         https://bugs.webkit.org/show_bug.cgi?id=187543
 885         <rdar://problem/41947884>
 886
 887         Reviewed by Saam Barati.
 888
 889         * stress/regress-187543-2.js: Added.
 890         * stress/regress-187543-3.js: Added.
 891         * stress/regress-187543.js: Added.
 892
 893 2018-07-10  Keith Miller  <keith_miller@apple.com>
 894
 895         hasOwnProperty returns true for out of bounds property index on TypedArray
 896         https://bugs.webkit.org/show_bug.cgi?id=187520
 897
 898         Reviewed by Saam Barati.
 899
 900         getOwnPropertySlot returns true on out of bounds indicies for
 901         TypedArrays, which is incorrect.
 902
 903         * stress/typedarray-hasOwnProperty-out-of-bounds.js: Added.
 904         (test):
 905
 906 2018-07-10  Michael Saboff  <msaboff@apple.com>
 907
 908         DFG JIT: compileMathIC produces incorrect machine code
 909         https://bugs.webkit.org/show_bug.cgi?id=187537
 910
 911         Reviewed by Saam Barati.
 912
 913         Added new test case.
 914
 915         * stress/arith-mul-with-constants.js:
 916         (testArithMulWithTypeConfusedConstant.testMult):
 917         (testArithMulWithTypeConfusedConstant):
 918
 919 2018-07-10  Michael Saboff  <msaboff@apple.com>
 920
 921         YARR: . doesn't match non-BMP Unicode characters in some cases
 922         https://bugs.webkit.org/show_bug.cgi?id=187248
 923
 924         Reviewed by Geoffrey Garen.
 925
 926         New regression test.
 927
 928         * stress/regexp-with-nonBMP-any.js: Added.
 929
 930 2018-07-09  Michael Saboff  <msaboff@apple.com>
 931
 932         REGRESSION (ICU-62100.0.1): JSC test mozilla-tests.yaml/ecma/String/15.5.4.12-3.js is failing
 933         https://bugs.webkit.org/show_bug.cgi?id=187495
 934
 935         Reviewed by Saam Barati.
 936
 937         Commented out the Georgian section of this toUpper() test since Unicode 11 added new upper case characters for
 938         most of this range.
 939
 940         * mozilla/ecma/String/15.5.4.12-3.js:
 941         (getTestCases):
 942         (DecimalToHexString):
 943
 944 2018-07-02  Sukolsak Sakshuwong  <sukolsak@gmail.com>
 945
 946         RegExp.exec returns wrong value with a long integer quantifier
 947         https://bugs.webkit.org/show_bug.cgi?id=187042
 948
 949         Reviewed by Saam Barati.
 950
 951         * stress/regexp-large-quantifier.js: Added.
 952         (testRegExp):
 953         * stress/regress-159744.js:
 954
 955 2018-07-02  Ryosuke Niwa  <rniwa@webkit.org>
 956
 957         Repository fix after r233427 and r233443.
 958         Added back the test which got erroneously deleted in r233443.
 959
 960         * stress/instanceof-non-object-prototype.js:
 961
 962 2018-07-02  Keith Miller  <keith_miller@apple.com>
 963
 964         InstanceOf IC should do generic if the prototype is not an object.
 965         https://bugs.webkit.org/show_bug.cgi?id=187250
 966
 967         Reviewed by Mark Lam.
 968
 969         * stress/instanceof-non-object-prototype.js: Added.
 970         (let):
 971         (test):
 972         (i.catch):
 973
 974 2018-06-30  Mark Lam  <mark.lam@apple.com>
 975
 976         Builtins and host functions should get their own structures.
 977         https://bugs.webkit.org/show_bug.cgi?id=187211
 978         <rdar://problem/41646336>
 979
 980         Reviewed by Saam Barati.
 981
 982         * stress/regress-187211.js: Added.
 983
 984 2018-06-29  Saam Barati  <sbarati@apple.com>
 985
 986         We shouldn't recurse into the parser when gathering metadata about various function offsets
 987         https://bugs.webkit.org/show_bug.cgi?id=184074
 988         <rdar://problem/37165897>
 989
 990         Reviewed by Mark Lam.
 991
 992         * microbenchmarks/try-get-by-id-basic.js:
 993         (const.bench.f.const.fooPlusBar.createBuiltin):
 994         * microbenchmarks/try-get-by-id-polymorphic.js:
 995         (fooPlusBar.createBuiltin):
 996         * stress/array-push-with-force-exit.js:
 997         * stress/dont-crash-on-stack-overflow-when-parsing-builtin.js: Added.
 998         (f):
 999         * stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js: Added.
1000         (foo):
1001         (prototype.runNearStackLimit):
1002         * stress/is-constructor.js:
1003         * stress/tailCallForwardArguments.js:
1004         (putFuncToPrivateName.createBuiltin):
1005
1006 2018-06-27  Mark Lam  <mark.lam@apple.com>
1007
1008         DFG's compileReallocatePropertyStorage() and compileAllocatePropertyStorage() slow paths should also clear unused properties.
1009         https://bugs.webkit.org/show_bug.cgi?id=187091
1010         <rdar://problem/41395624>
1011
1012         Reviewed by Yusuke Suzuki.
1013
1014         * stress/regress-187091.js: Added.
1015
1016 2018-06-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1017
1018         [JSC] ArrayPatternNode::emitDirectBinding does not return assignment target value if dst is nullptr
1019         https://bugs.webkit.org/show_bug.cgi?id=185943
1020
1021         Reviewed by Mark Lam.
1022
1023         * stress/direct-binding-return-result.js: Added.
1024         (shouldBe):
1025         (test):
1026
1027 2018-06-26  Mark Lam  <mark.lam@apple.com>
1028
1029         eval() is wrong about the LiteralParser never throwing any exceptions.
1030         https://bugs.webkit.org/show_bug.cgi?id=187074
1031         <rdar://problem/41461099>
1032
1033         Reviewed by Saam Barati.
1034
1035         * stress/regress-187074.js: Added.
1036
1037 2018-06-26  Mark Lam  <mark.lam@apple.com>
1038
1039         ASSERTION FAILED: length > butterfly->vectorLength() in JSObject::ensureLengthSlow().
1040         https://bugs.webkit.org/show_bug.cgi?id=187060
1041         <rdar://problem/41452767>
1042
1043         Reviewed by Keith Miller.
1044
1045         * stress/regress-187060.js: Added.
1046
1047 2018-06-25  Mark Lam  <mark.lam@apple.com>
1048
1049         constructArray() should set m_numValuesInVector to the specified length.
1050         https://bugs.webkit.org/show_bug.cgi?id=187010
1051         <rdar://problem/41392167>
1052
1053         Reviewed by Filip Pizlo.
1054
1055         * stress/regress-187010.js: Added.
1056
1057 2018-06-25  Mark Lam  <mark.lam@apple.com>
1058
1059         Add missing exception check in RegExpObjectInlines.h's collectMatches.
1060         https://bugs.webkit.org/show_bug.cgi?id=187006
1061         <rdar://problem/41418412>
1062
1063         Reviewed by Keith Miller.
1064
1065         * stress/regress-187006.js: Added.
1066
1067 2018-06-22  Keith Miller  <keith_miller@apple.com>
1068
1069         unshift should zero unused property storage
1070         https://bugs.webkit.org/show_bug.cgi?id=186960
1071
1072         Reviewed by Saam Barati.
1073
1074         * stress/array-unshift-zero-property-storage.js: Added.
1075         (run):
1076         (test):
1077
1078 2018-06-22  Mark Lam  <mark.lam@apple.com>
1079
1080         PropertyCondition::isValidValueForAttributes() should also consider deleted values.
1081         https://bugs.webkit.org/show_bug.cgi?id=186943
1082         <rdar://problem/41370337>
1083
1084         Reviewed by Saam Barati.
1085
1086         * stress/regress-186943.js: Added.
1087
1088 2018-06-22  Keith Miller  <keith_miller@apple.com>
1089
1090         performProxyCall should toThis the value passed to its handler
1091         https://bugs.webkit.org/show_bug.cgi?id=186951
1092
1093         Reviewed by Mark Lam.
1094
1095         * stress/proxy-call-apply-handler-to-this.js: Added.
1096         (applyHandler):
1097         (let.f.new.Proxy):
1098         (withScope):
1099         (lexicalScope):
1100         (strictEvalScope):
1101         (BigInt):
1102
1103 2018-06-20  Keith Miller  <keith_miller@apple.com>
1104
1105         flattenDictionaryStruture needs to zero inline storage.
1106         https://bugs.webkit.org/show_bug.cgi?id=186869
1107
1108         Reviewed by Saam Barati.
1109
1110         * stress/flatten-object-zero-unused-inline-properties.js: Added.
1111
1112 2018-06-19  Saam Barati  <sbarati@apple.com>
1113
1114         DirectArguments::create needs to initialize to undefined instead of the empty value
1115         https://bugs.webkit.org/show_bug.cgi?id=186818
1116         <rdar://problem/38415177>
1117
1118         Reviewed by Filip Pizlo.
1119
1120         * stress/create-direct-arguments-in-osr-should-initialize-to-undefined.js: Added.
1121         (foo):
1122         (bar):
1123
1124 2018-06-19  Tadeu Zagallo  <tzagallo@apple.com>
1125
1126         ShadowChicken crashes with stack overflow in the LLInt
1127         https://bugs.webkit.org/show_bug.cgi?id=186540
1128         <rdar://problem/39682133>
1129
1130         Reviewed by Saam Barati.
1131
1132         Add test that stack overflows and crashes on ShadowChicken when JIT is
1133         disabled and forceDebuggerBytecodeGeneration is enabled.
1134
1135         * stress/llint-stack-overflow-debugging-opcodes.js: Added.
1136         (foo):
1137         (catch):
1138
1139 2018-06-19  Leo Balter  <leonardo.balter@gmail.com>
1140
1141         [test262-runner] More updates to the skip list
1142         https://bugs.webkit.org/show_bug.cgi?id=186786
1143
1144         Reviewed by Michael Saboff.
1145
1146         * test262/config.yaml:
1147         * test262/expectations.yaml:
1148
1149 2018-06-19  Saam Barati  <sbarati@apple.com>
1150
1151         Wasm: Any function argument of type Void should be a validation error
1152         https://bugs.webkit.org/show_bug.cgi?id=186794
1153         <rdar://problem/41140257>
1154
1155         Reviewed by Keith Miller.
1156
1157         * wasm/Builder.js:
1158         (const._normalizeFunctionSignature):
1159         * wasm/function-tests/void-argument-type-should-be-a-validation-error.js: Added.
1160         (getBinary):
1161         * wasm/self-test/test_BuilderJSON.js:
1162
1163 2018-06-18  Keith Miller  <keith_miller@apple.com>
1164
1165         Properly zero unused property storage offsets
1166         https://bugs.webkit.org/show_bug.cgi?id=186692
1167
1168         Reviewed by Filip Pizlo.
1169
1170         * stress/butterfly-zero-unused-butterfly-properties.js: Added.
1171
1172 2018-06-18  Michael Saboff  <msaboff@apple.com>
1173
1174         Support Unicode 11 in RegExp
1175         https://bugs.webkit.org/show_bug.cgi?id=186685
1176
1177         Reviewed by Mark Lam.
1178
1179         * test262/config.yaml: Removed from skip list Unicode 11 property tests as they
1180         are now supported.  Added new bug reference for still failing
1181         test/built-ins/RegExp/property-escapes/character-class.js test.
1182
1183         * test262/test/built-ins/RegExp/property-escapes/unsupported-binary-properties.js:
1184         Removed "Extended_Pictographic" from unsupported properties since Unicode 11 now supports them.
1185
1186 2018-06-16  Leo Balter  <leonardo.balter@gmail.com>
1187
1188         Update Test262 2018-06-15
1189         https://bugs.webkit.org/show_bug.cgi?id=186695
1190
1191         Reviewed by Michael Saboff.
1192
1193         Also update the skip list - in the config file - with new failures
1194         * test262/config.yaml:
1195         * test262/expectations.yaml:
1196         * test262/harness/testIntl.js:
1197         (getInvalidLanguageTags):
1198         * test262/latest-changes-summary.txt:
1199         * test262/test/built-ins/Date/parse/time-value-maximum-range.js: Added.
1200         * test262/test/built-ins/Date/parse/zero.js: Added.
1201         * test262/test/built-ins/JSON/stringify/bigint-cross-realm.js: Added.
1202         (other.BigInt.prototype.toJSON):
1203         * test262/test/built-ins/Object/prototype/toString/symbol-tag-non-str-bigint.js: Added.
1204         * test262/test/built-ins/Object/prototype/toString/symbol-tag-override-bigint.js: Added.
1205         * test262/test/built-ins/Reflect/ownKeys/return-on-corresponding-order-large-index.js: Added.
1206         * test262/test/built-ins/RegExp/property-escapes/character-class.js:
1207         * test262/test/built-ins/RegExp/property-escapes/generated/ASCII.js:
1208         * test262/test/built-ins/RegExp/property-escapes/generated/ASCII_Hex_Digit.js:
1209         * test262/test/built-ins/RegExp/property-escapes/generated/Alphabetic.js:
1210         * test262/test/built-ins/RegExp/property-escapes/generated/Any.js:
1211         * test262/test/built-ins/RegExp/property-escapes/generated/Assigned.js:
1212         * test262/test/built-ins/RegExp/property-escapes/generated/Bidi_Control.js:
1213         * test262/test/built-ins/RegExp/property-escapes/generated/Bidi_Mirrored.js:
1214         * test262/test/built-ins/RegExp/property-escapes/generated/Case_Ignorable.js:
1215         * test262/test/built-ins/RegExp/property-escapes/generated/Cased.js:
1216         * test262/test/built-ins/RegExp/property-escapes/generated/Changes_When_Casefolded.js:
1217         * test262/test/built-ins/RegExp/property-escapes/generated/Changes_When_Casemapped.js:
1218         * test262/test/built-ins/RegExp/property-escapes/generated/Changes_When_Lowercased.js:
1219         * test262/test/built-ins/RegExp/property-escapes/generated/Changes_When_NFKC_Casefolded.js:
1220         * test262/test/built-ins/RegExp/property-escapes/generated/Changes_When_Titlecased.js:
1221         * test262/test/built-ins/RegExp/property-escapes/generated/Changes_When_Uppercased.js:
1222         * test262/test/built-ins/RegExp/property-escapes/generated/Dash.js:
1223         * test262/test/built-ins/RegExp/property-escapes/generated/Default_Ignorable_Code_Point.js:
1224         * test262/test/built-ins/RegExp/property-escapes/generated/Deprecated.js:
1225         * test262/test/built-ins/RegExp/property-escapes/generated/Diacritic.js:
1226         * test262/test/built-ins/RegExp/property-escapes/generated/Emoji.js:
1227         * test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js:
1228         * test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Modifier.js:
1229         * test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Modifier_Base.js:
1230         * test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Presentation.js:
1231         * test262/test/built-ins/RegExp/property-escapes/generated/Extended_Pictographic.js: Added.
1232         * test262/test/built-ins/RegExp/property-escapes/generated/Extender.js:
1233         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Cased_Letter.js:
1234         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Close_Punctuation.js:
1235         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Connector_Punctuation.js:
1236         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Control.js:
1237         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Currency_Symbol.js:
1238         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Dash_Punctuation.js:
1239         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Decimal_Number.js:
1240         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Enclosing_Mark.js:
1241         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Final_Punctuation.js:
1242         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Format.js:
1243         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Initial_Punctuation.js:
1244         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Letter.js:
1245         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Letter_Number.js:
1246         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Line_Separator.js:
1247         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Lowercase_Letter.js:
1248         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Mark.js:
1249         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Math_Symbol.js:
1250         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Modifier_Letter.js:
1251         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Modifier_Symbol.js:
1252         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Nonspacing_Mark.js:
1253         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Number.js:
1254         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Open_Punctuation.js:
1255         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Other.js:
1256         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Other_Letter.js:
1257         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Other_Number.js:
1258         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Other_Punctuation.js:
1259         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Other_Symbol.js:
1260         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Paragraph_Separator.js:
1261         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Private_Use.js:
1262         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Punctuation.js:
1263         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Separator.js:
1264         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Space_Separator.js:
1265         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Spacing_Mark.js:
1266         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Surrogate.js:
1267         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Symbol.js:
1268         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Titlecase_Letter.js:
1269         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Unassigned.js:
1270         * test262/test/built-ins/RegExp/property-escapes/generated/General_Category_-_Uppercase_Letter.js:
1271         * test262/test/built-ins/RegExp/property-escapes/generated/Grapheme_Base.js:
1272         * test262/test/built-ins/RegExp/property-escapes/generated/Grapheme_Extend.js:
1273         * test262/test/built-ins/RegExp/property-escapes/generated/Hex_Digit.js:
1274         * test262/test/built-ins/RegExp/property-escapes/generated/IDS_Binary_Operator.js:
1275         * test262/test/built-ins/RegExp/property-escapes/generated/IDS_Trinary_Operator.js:
1276         * test262/test/built-ins/RegExp/property-escapes/generated/ID_Continue.js:
1277         * test262/test/built-ins/RegExp/property-escapes/generated/ID_Start.js:
1278         * test262/test/built-ins/RegExp/property-escapes/generated/Ideographic.js:
1279         * test262/test/built-ins/RegExp/property-escapes/generated/Join_Control.js:
1280         * test262/test/built-ins/RegExp/property-escapes/generated/Logical_Order_Exception.js:
1281         * test262/test/built-ins/RegExp/property-escapes/generated/Lowercase.js:
1282         * test262/test/built-ins/RegExp/property-escapes/generated/Math.js:
1283         * test262/test/built-ins/RegExp/property-escapes/generated/Noncharacter_Code_Point.js:
1284         * test262/test/built-ins/RegExp/property-escapes/generated/Pattern_Syntax.js:
1285         * test262/test/built-ins/RegExp/property-escapes/generated/Pattern_White_Space.js:
1286         * test262/test/built-ins/RegExp/property-escapes/generated/Quotation_Mark.js:
1287         * test262/test/built-ins/RegExp/property-escapes/generated/Radical.js:
1288         * test262/test/built-ins/RegExp/property-escapes/generated/Regional_Indicator.js:
1289         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Adlam.js:
1290         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Ahom.js:
1291         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Anatolian_Hieroglyphs.js:
1292         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Arabic.js:
1293         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Armenian.js:
1294         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Avestan.js:
1295         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Balinese.js:
1296         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Bamum.js:
1297         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Bassa_Vah.js:
1298         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Batak.js:
1299         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Bengali.js:
1300         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Bhaiksuki.js:
1301         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Bopomofo.js:
1302         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Brahmi.js:
1303         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Braille.js:
1304         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Buginese.js:
1305         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Buhid.js:
1306         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Canadian_Aboriginal.js:
1307         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Carian.js:
1308         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Caucasian_Albanian.js:
1309         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Chakma.js:
1310         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Cham.js:
1311         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Cherokee.js:
1312         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Common.js:
1313         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Coptic.js:
1314         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Cuneiform.js:
1315         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Cypriot.js:
1316         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Cyrillic.js:
1317         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Deseret.js:
1318         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Devanagari.js:
1319         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Dogra.js: Copied from JSTests/test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Kaithi.js.
1320         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Duployan.js:
1321         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Egyptian_Hieroglyphs.js:
1322         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Elbasan.js:
1323         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Ethiopic.js:
1324         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Georgian.js:
1325         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Glagolitic.js:
1326         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Gothic.js:
1327         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Grantha.js:
1328         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Greek.js:
1329         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Gujarati.js:
1330         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Gunjala_Gondi.js: Copied from JSTests/test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Chakma.js.
1331         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Gurmukhi.js:
1332         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Han.js:
1333         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Hangul.js:
1334         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Hanifi_Rohingya.js: Copied from JSTests/test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Ahom.js.
1335         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Hanunoo.js:
1336         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Hatran.js:
1337         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Hebrew.js:
1338         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Hiragana.js:
1339         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Imperial_Aramaic.js:
1340         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Inherited.js:
1341         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Inscriptional_Pahlavi.js:
1342         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Inscriptional_Parthian.js:
1343         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Javanese.js:
1344         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Kaithi.js:
1345         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Kannada.js:
1346         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Katakana.js:
1347         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Kayah_Li.js:
1348         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Kharoshthi.js:
1349         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Khmer.js:
1350         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Khojki.js:
1351         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Khudawadi.js:
1352         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Lao.js:
1353         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Latin.js:
1354         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Lepcha.js:
1355         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Limbu.js:
1356         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Linear_A.js:
1357         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Linear_B.js:
1358         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Lisu.js:
1359         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Lycian.js:
1360         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Lydian.js:
1361         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Mahajani.js:
1362         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Makasar.js: Copied from JSTests/test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Lycian.js.
1363         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Malayalam.js:
1364         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Mandaic.js:
1365         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Manichaean.js:
1366         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Marchen.js:
1367         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Masaram_Gondi.js:
1368         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Medefaidrin.js: Copied from JSTests/test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Carian.js.
1369         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Meetei_Mayek.js:
1370         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Mende_Kikakui.js:
1371         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Meroitic_Cursive.js:
1372         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Meroitic_Hieroglyphs.js:
1373         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Miao.js:
1374         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Modi.js:
1375         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Mongolian.js:
1376         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Mro.js:
1377         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Multani.js:
1378         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Myanmar.js:
1379         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Nabataean.js:
1380         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_New_Tai_Lue.js:
1381         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Newa.js:
1382         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Nko.js:
1383         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Nushu.js:
1384         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Ogham.js:
1385         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Ol_Chiki.js:
1386         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Old_Hungarian.js:
1387         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Old_Italic.js:
1388         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Old_North_Arabian.js:
1389         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Old_Permic.js:
1390         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Old_Persian.js:
1391         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Old_Sogdian.js: Copied from JSTests/test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Gothic.js.
1392         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Old_South_Arabian.js:
1393         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Old_Turkic.js:
1394         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Oriya.js:
1395         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Osage.js:
1396         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Osmanya.js:
1397         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Pahawh_Hmong.js:
1398         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Palmyrene.js:
1399         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Pau_Cin_Hau.js:
1400         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Phags_Pa.js:
1401         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Phoenician.js:
1402         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Psalter_Pahlavi.js:
1403         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Rejang.js:
1404         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Runic.js:
1405         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Samaritan.js:
1406         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Saurashtra.js:
1407         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Sharada.js:
1408         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Shavian.js:
1409         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Siddham.js:
1410         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_SignWriting.js:
1411         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Sinhala.js:
1412         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Sogdian.js: Copied from JSTests/test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Lycian.js.
1413         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Sora_Sompeng.js:
1414         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Soyombo.js:
1415         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Sundanese.js:
1416         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Syloti_Nagri.js:
1417         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Syriac.js:
1418         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Tagalog.js:
1419         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Tagbanwa.js:
1420         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Tai_Le.js:
1421         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Tai_Tham.js:
1422         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Tai_Viet.js:
1423         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Takri.js:
1424         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Tamil.js:
1425         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Tangut.js:
1426         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Telugu.js:
1427         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Thaana.js:
1428         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Thai.js:
1429         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Tibetan.js:
1430         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Tifinagh.js:
1431         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Tirhuta.js:
1432         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Ugaritic.js:
1433         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Vai.js:
1434         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Warang_Citi.js:
1435         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Yi.js:
1436         * test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Zanabazar_Square.js:
1437         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Adlam.js:
1438         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Ahom.js:
1439         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Anatolian_Hieroglyphs.js:
1440         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Arabic.js:
1441         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Armenian.js:
1442         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Avestan.js:
1443         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Balinese.js:
1444         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Bamum.js:
1445         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Bassa_Vah.js:
1446         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Batak.js:
1447         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Bengali.js:
1448         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Bhaiksuki.js:
1449         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Bopomofo.js:
1450         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Brahmi.js:
1451         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Braille.js:
1452         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Buginese.js:
1453         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Buhid.js:
1454         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Canadian_Aboriginal.js:
1455         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Carian.js:
1456         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Caucasian_Albanian.js:
1457         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Chakma.js:
1458         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Cham.js:
1459         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Cherokee.js:
1460         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Common.js:
1461         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Coptic.js:
1462         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Cuneiform.js:
1463         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Cypriot.js:
1464         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Cyrillic.js:
1465         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Deseret.js:
1466         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Devanagari.js:
1467         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Dogra.js: Copied from JSTests/test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Mahajani.js.
1468         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Duployan.js:
1469         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Egyptian_Hieroglyphs.js:
1470         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Elbasan.js:
1471         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Ethiopic.js:
1472         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Georgian.js:
1473         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Glagolitic.js:
1474         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Gothic.js:
1475         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Grantha.js:
1476         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Greek.js:
1477         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Gujarati.js:
1478         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Gunjala_Gondi.js: Added.
1479         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Gurmukhi.js:
1480         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Han.js:
1481         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Hangul.js:
1482         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Hanifi_Rohingya.js: Added.
1483         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Hanunoo.js:
1484         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Hatran.js:
1485         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Hebrew.js:
1486         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Hiragana.js:
1487         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Imperial_Aramaic.js:
1488         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Inherited.js:
1489         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Inscriptional_Pahlavi.js:
1490         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Inscriptional_Parthian.js:
1491         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Javanese.js:
1492         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Kaithi.js:
1493         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Kannada.js:
1494         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Katakana.js:
1495         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Kayah_Li.js:
1496         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Kharoshthi.js:
1497         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Khmer.js:
1498         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Khojki.js:
1499         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Khudawadi.js:
1500         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Lao.js:
1501         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Latin.js:
1502         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Lepcha.js:
1503         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Limbu.js:
1504         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Linear_A.js:
1505         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Linear_B.js:
1506         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Lisu.js:
1507         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Lycian.js:
1508         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Lydian.js:
1509         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Mahajani.js:
1510         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Makasar.js: Copied from JSTests/test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Adlam.js.
1511         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Malayalam.js:
1512         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Mandaic.js:
1513         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Manichaean.js:
1514         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Marchen.js:
1515         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Masaram_Gondi.js:
1516         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Medefaidrin.js: Copied from JSTests/test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Avestan.js.
1517         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Meetei_Mayek.js:
1518         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Mende_Kikakui.js:
1519         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Meroitic_Cursive.js:
1520         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Meroitic_Hieroglyphs.js:
1521         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Miao.js:
1522         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Modi.js:
1523         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Mongolian.js:
1524         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Mro.js:
1525         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Multani.js:
1526         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Myanmar.js:
1527         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Nabataean.js:
1528         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_New_Tai_Lue.js:
1529         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Newa.js:
1530         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Nko.js:
1531         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Nushu.js:
1532         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Ogham.js:
1533         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Ol_Chiki.js:
1534         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Old_Hungarian.js:
1535         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Old_Italic.js:
1536         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Old_North_Arabian.js:
1537         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Old_Permic.js:
1538         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Old_Persian.js:
1539         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Old_Sogdian.js: Copied from JSTests/test262/test/built-ins/RegExp/property-escapes/generated/Script_-_Khojki.js.
1540         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Old_South_Arabian.js:
1541         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Old_Turkic.js:
1542         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Oriya.js:
1543         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Osage.js:
1544         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Osmanya.js:
1545         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Pahawh_Hmong.js:
1546         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Palmyrene.js:
1547         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Pau_Cin_Hau.js:
1548         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Phags_Pa.js:
1549         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Phoenician.js:
1550         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Psalter_Pahlavi.js:
1551         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Rejang.js:
1552         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Runic.js:
1553         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Samaritan.js:
1554         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Saurashtra.js:
1555         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Sharada.js:
1556         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Shavian.js:
1557         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Siddham.js:
1558         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_SignWriting.js:
1559         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Sinhala.js:
1560         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Sogdian.js: Copied from JSTests/test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Manichaean.js.
1561         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Sora_Sompeng.js:
1562         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Soyombo.js:
1563         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Sundanese.js:
1564         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Syloti_Nagri.js:
1565         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Syriac.js:
1566         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tagalog.js:
1567         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tagbanwa.js:
1568         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tai_Le.js:
1569         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tai_Tham.js:
1570         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tai_Viet.js:
1571         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Takri.js:
1572         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tamil.js:
1573         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tangut.js:
1574         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Telugu.js:
1575         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Thaana.js:
1576         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Thai.js:
1577         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tibetan.js:
1578         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tifinagh.js:
1579         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tirhuta.js:
1580         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Ugaritic.js:
1581         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Vai.js:
1582         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Warang_Citi.js:
1583         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Yi.js:
1584         * test262/test/built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Zanabazar_Square.js:
1585         * test262/test/built-ins/RegExp/property-escapes/generated/Sentence_Terminal.js:
1586         * test262/test/built-ins/RegExp/property-escapes/generated/Soft_Dotted.js:
1587         * test262/test/built-ins/RegExp/property-escapes/generated/Terminal_Punctuation.js:
1588         * test262/test/built-ins/RegExp/property-escapes/generated/Unified_Ideograph.js:
1589         * test262/test/built-ins/RegExp/property-escapes/generated/Uppercase.js:
1590         * test262/test/built-ins/RegExp/property-escapes/generated/Variation_Selector.js:
1591         * test262/test/built-ins/RegExp/property-escapes/generated/White_Space.js:
1592         * test262/test/built-ins/RegExp/property-escapes/generated/XID_Continue.js:
1593         * test262/test/built-ins/RegExp/property-escapes/generated/XID_Start.js:
1594         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/internal-regexp-lastindex-not-zero.js: Removed.
1595         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/isregexp-called-once.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/Symbol.matchAll/isregexp-internal-regexp-is-false.js.
1596         (o.get Symbol):
1597         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/isregexp-internal-regexp-throws.js: Removed.
1598         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/regexpcreate-this-throws.js:
1599         * test262/test/built-ins/Symbol/matchAll/prop-desc.js:
1600         * test262/test/built-ins/Symbol/prototype/description/description-symboldescriptivestring.js: Added.
1601         * test262/test/built-ins/Symbol/prototype/description/descriptor.js: Added.
1602         * test262/test/built-ins/Symbol/prototype/description/get.js: Added.
1603         * test262/test/built-ins/Symbol/prototype/description/is-not-own-property.js: Added.
1604         * test262/test/built-ins/Symbol/prototype/description/this-val-non-symbol.js: Added.
1605         * test262/test/built-ins/Symbol/prototype/description/this-val-symbol.js: Added.
1606         * test262/test/built-ins/Symbol/prototype/description/wrapper.js: Added.
1607         * test262/test/intl402/Intl/getCanonicalLocales/Locale-object.js: Added.
1608         * test262/test/intl402/Locale/constructor-options-collation-invalid.js:
1609         * test262/test/intl402/Locale/constructor-options-collation-valid.js:
1610         * test262/test/intl402/Locale/constructor-options-hourcycle-valid.js:
1611         * test262/test/intl402/Locale/constructor-options-language-invalid.js:
1612         * test262/test/intl402/Locale/constructor-options-numberingsystem-invalid.js:
1613         * test262/test/intl402/Locale/constructor-options-numberingsystem-valid.js:
1614         * test262/test/intl402/Locale/constructor-tag.js: Added.
1615         (canonical.of.Object.entries):
1616         * test262/test/intl402/Locale/likely-subtags.js: Added.
1617         (maximal.of.Object.entries):
1618         (minimal.of.Object.entries):
1619         * test262/test/intl402/Locale/prototype/baseName/branding.js: Added.
1620         * test262/test/intl402/Locale/prototype/baseName/name.js: Added.
1621         * test262/test/intl402/Locale/prototype/baseName/prop-desc.js:
1622         * test262/test/intl402/Locale/prototype/calendar/branding.js: Added.
1623         * test262/test/intl402/Locale/prototype/calendar/name.js: Added.
1624         * test262/test/intl402/Locale/prototype/calendar/prop-desc.js:
1625         * test262/test/intl402/Locale/prototype/caseFirst/branding.js: Added.
1626         * test262/test/intl402/Locale/prototype/caseFirst/name.js: Added.
1627         * test262/test/intl402/Locale/prototype/caseFirst/prop-desc.js:
1628         * test262/test/intl402/Locale/prototype/collation/branding.js: Added.
1629         * test262/test/intl402/Locale/prototype/collation/name.js: Added.
1630         * test262/test/intl402/Locale/prototype/collation/prop-desc.js:
1631         * test262/test/intl402/Locale/prototype/hourCycle/branding.js: Added.
1632         * test262/test/intl402/Locale/prototype/hourCycle/name.js: Added.
1633         * test262/test/intl402/Locale/prototype/hourCycle/prop-desc.js:
1634         * test262/test/intl402/Locale/prototype/language/branding.js: Added.
1635         * test262/test/intl402/Locale/prototype/language/name.js: Added.
1636         * test262/test/intl402/Locale/prototype/language/prop-desc.js:
1637         * test262/test/intl402/Locale/prototype/maximize/branding.js: Added.
1638         * test262/test/intl402/Locale/prototype/minimize/branding.js: Added.
1639         * test262/test/intl402/Locale/prototype/numberingSystem/branding.js: Added.
1640         * test262/test/intl402/Locale/prototype/numberingSystem/name.js: Added.
1641         * test262/test/intl402/Locale/prototype/numberingSystem/prop-desc.js:
1642         * test262/test/intl402/Locale/prototype/numeric/branding.js: Added.
1643         * test262/test/intl402/Locale/prototype/numeric/name.js: Added.
1644         * test262/test/intl402/Locale/prototype/numeric/prop-desc.js:
1645         * test262/test/intl402/Locale/prototype/region/branding.js: Added.
1646         * test262/test/intl402/Locale/prototype/region/name.js: Added.
1647         * test262/test/intl402/Locale/prototype/region/prop-desc.js:
1648         * test262/test/intl402/Locale/prototype/script/branding.js: Added.
1649         * test262/test/intl402/Locale/prototype/script/name.js: Added.
1650         * test262/test/intl402/Locale/prototype/script/prop-desc.js:
1651         * test262/test/intl402/Locale/prototype/toString/branding.js: Added.
1652         * test262/test/intl402/NumberFormat/length.js:
1653         * test262/test/intl402/PluralRules/prototype/resolvedOptions/pluralCategories.js: Added.
1654         * test262/test/language/expressions/tagged-template/template-object-template-map.js: Added.
1655         (tag):
1656         * test262/test/language/expressions/tagged-template/template-object.js:
1657         (templateObject.tag):
1658         * test262/test/language/literals/numeric/numeric-separator-literal-bil-bd-nsl-bd-err.js:
1659         * test262/test/language/literals/numeric/numeric-separator-literal-bil-nsl-bd-dunder-err.js:
1660         * test262/test/language/literals/numeric/numeric-separator-literal-bil-nsl-bd-err.js:
1661         * test262/test/language/literals/numeric/numeric-separator-literal-dd-nsl-dds-dunder-err.js:
1662         * test262/test/language/literals/numeric/numeric-separator-literal-dd-nsl-err.js:
1663         * test262/test/language/literals/numeric/numeric-separator-literal-dds-nsl-dds-dunder-err.js:
1664         * test262/test/language/literals/numeric/numeric-separator-literal-dds-nsl-err.js:
1665         * test262/test/language/literals/numeric/numeric-separator-literal-dil-dot-dds-nsl-ep-dd-err.js:
1666         * test262/test/language/literals/numeric/numeric-separator-literal-dil-dot-nsl-ep-err.js:
1667         * test262/test/language/literals/numeric/numeric-separator-literal-dil-dot-nsl-err.js:
1668         * test262/test/language/literals/numeric/numeric-separator-literal-dot-dds-nsl-ep-err.js:
1669         * test262/test/language/literals/numeric/numeric-separator-literal-dot-nsl-ep-err.js:
1670         * test262/test/language/literals/numeric/numeric-separator-literal-dot-nsl-err.js:
1671         * test262/test/language/literals/numeric/numeric-separator-literal-hil-hd-nsl-hd-err.js:
1672         * test262/test/language/literals/numeric/numeric-separator-literal-hil-nsl-hd-dunder-err.js:
1673         * test262/test/language/literals/numeric/numeric-separator-literal-hil-nsl-hd-err.js:
1674         * test262/test/language/literals/numeric/numeric-separator-literal-nzd-nsl-dds-dunder-err.js:
1675         * test262/test/language/literals/numeric/numeric-separator-literal-nzd-nsl-dds-leading-zero-err.js:
1676         * test262/test/language/literals/numeric/numeric-separator-literal-oil-nsl-od-dunder-err.js:
1677         * test262/test/language/literals/numeric/numeric-separator-literal-oil-nsl-od-err.js:
1678         * test262/test/language/literals/numeric/numeric-separator-literal-oil-od-nsl-od-err.js:
1679         * test262/test/language/literals/numeric/numeric-separator-literal-unicode-err.js:
1680         * test262/test262-Revision.txt:
1681
1682 2018-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1683
1684         [DFG] Reduce OSRExit for Kraken/crypto-aes due to CoW array
1685         https://bugs.webkit.org/show_bug.cgi?id=186721
1686
1687         Reviewed by Keith Miller.
1688
1689         * stress/array-slice-cow.js: Added.
1690         (shouldBe):
1691         (testInt32):
1692         (testDouble):
1693         (testContiguous):
1694
1695 2018-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1696
1697         [DFG][FTL] Spread onto PhantomNewArrayBuffer assumes JSFixedArray, but JSImmutableButterfly is returned
1698         https://bugs.webkit.org/show_bug.cgi?id=186460
1699
1700         Reviewed by Saam Barati.
1701
1702         * stress/spread-escapes-but-new-array-buffer-does-not-double.js: Added.
1703         (assert):
1704         (getProperties):
1705         (theFunc):
1706         (let.obj.valueOf):
1707
1708 2018-06-14  Leo Balter  <leonardo.balter@gmail.com>
1709
1710         Test262-Runner: Update config list with some failing tests
1711         https://bugs.webkit.org/show_bug.cgi?id=185628
1712
1713         Reviewed by Michael Saboff.
1714
1715         The config list is updated to match some slow / hanging tests that are currenctly failing
1716         due to the length used in Array or Array like objects.
1717
1718         This also adds matching bugs for known features that are still in progress and not enabled
1719         yet.
1720         * test262/config.yaml:
1721
1722 2018-06-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1723
1724         Update test262 for Array#sort
1725         https://bugs.webkit.org/show_bug.cgi?id=186458
1726
1727         * test262/expectations.yaml:
1728
1729 2018-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1730
1731         [JSC] Array.prototype.sort should rejects null comparator
1732         https://bugs.webkit.org/show_bug.cgi?id=186458
1733
1734         Reviewed by Keith Miller.
1735
1736         * ChakraCore/test/Array/array_sort.baseline-jsc:
1737         * stress/array-sort-bad-comparator.js:
1738         (test):
1739         * stress/sort-null-comparator.js: Removed.
1740         * test262/expectations.yaml:
1741
1742 2018-06-07  Saam Barati  <sbarati@apple.com>
1743
1744         Make DFG to FTL OSR entry code more sane by removing bad RELEASE_ASSERTS and making it trigger compiles in outer loops before inner ones
1745         https://bugs.webkit.org/show_bug.cgi?id=186218
1746         <rdar://problem/38449540>
1747
1748         Reviewed by Filip Pizlo.
1749
1750         * stress/dont-crash-ftl-osr-entry.js: Added.
1751
1752 2018-06-06  Yusuke Suzuki  <utatane.tea@gmail.com>
1753
1754         [DFG] Compare operations do not respect negative zeros
1755         https://bugs.webkit.org/show_bug.cgi?id=183729
1756
1757         Reviewed by Saam Barati.
1758
1759         * stress/comparison-ignore-negative-zero.js: Added.
1760         (shouldBe):
1761         (zero):
1762         (negativeZero):
1763         (object.valueOf):
1764         (test):
1765
1766 2018-06-06  Saam Barati  <sbarati@apple.com>
1767
1768         generateConditionsForInstanceOf needs to see if the object has a poly proto structure before assuming it has a constant prototype
1769         https://bugs.webkit.org/show_bug.cgi?id=186363
1770
1771         Rubber-stamped by Filip Pizlo.
1772
1773         * stress/instance-of-on-poly-proto-opc-should-not-crash.js: Added.
1774
1775 2018-06-05  David Fenton  <david_fenton@apple.com>
1776
1777         Temporarily Skip JSC stress test failures that are consistently occurring.
1778         https://bugs.webkit.org/show_bug.cgi?id=186283
1779
1780         Unreviewed test gardening.
1781
1782         * executableAllocationFuzz.yaml:
1783         * slowMicrobenchmarks/default-derived-constructor.js:
1784         * stress/put-direct-index-broken-2.js:
1785         * stress/splay-flash-access.js:
1786         * stress/spread-forward-call-varargs-stack-overflow.js:
1787
1788 2018-06-04  Keith Miller  <keith_miller@apple.com>
1789
1790         Add test for CoW conversions in the DFG/FTL
1791         https://bugs.webkit.org/show_bug.cgi?id=186295
1792
1793         Reviewed by Saam Barati.
1794
1795         * stress/arrayprofile-should-not-convert-get-by-val-cow.js: Added.
1796         (assertEq):
1797         (withArrayArgInt32):
1798         (withArrayLiteralInt32):
1799         (withArrayArgDouble):
1800         (withArrayLiteralDouble):
1801         (withArrayArgContiguous):
1802         (withArrayLiteralContiguous):
1803         (test):
1804
1805 2018-06-02  Caio Lima  <ticaiolima@gmail.com>
1806
1807         [ESNext][BigInt] Implement support for addition operations
1808         https://bugs.webkit.org/show_bug.cgi?id=179002
1809
1810         Reviewed by Yusuke Suzuki.
1811
1812         * bigIntTests.yaml:
1813         * stress/addition-order-evaluation.js: Added.
1814         * stress/big-int-add-wrapped-value.js: Added.
1815         * stress/big-int-addition-basic.js: Added.
1816         * stress/big-int-addition-jit.js: Added.
1817         * stress/big-int-addition-memory-stress.js: Added.
1818         * stress/big-int-addition-string-coercion.js: Added.
1819         * stress/big-int-addition-to-primitive-precedence.js: Added.
1820         * stress/big-int-addition-to-primitive.js: Added.
1821         * stress/big-int-addition-type-error.js: Added.
1822         * stress/big-int-no-conversion-to-number.js:
1823         * stress/big-int-sub-wrapped-value.js: Added.
1824         * stress/big-int-subtraction-basic.js: Added.
1825         * stress/big-int-subtraction-jit.js: Added.
1826         * stress/big-int-subtraction-type-error.js: Added.
1827         * stress/sub-order-evaluation.js: Added.
1828
1829 2018-06-02  Commit Queue  <commit-queue@webkit.org>
1830
1831         Unreviewed, rolling out r232439.
1832         https://bugs.webkit.org/show_bug.cgi?id=186238
1833
1834         It breaks gtk-linux-32-release (Requested by caiolima on
1835         #webkit).
1836
1837         Reverted changeset:
1838
1839         "[ESNext][BigInt] Implement support for addition operations"
1840         https://bugs.webkit.org/show_bug.cgi?id=179002
1841         https://trac.webkit.org/changeset/232439
1842
1843 2018-06-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1844
1845         Baseline op_jtrue emits an insane amount of code
1846         https://bugs.webkit.org/show_bug.cgi?id=185708
1847
1848         Reviewed by Filip Pizlo.
1849
1850         * stress/logical-not-masquerades-as-undefined.js: Added.
1851         (shouldBe):
1852         (test):
1853         * stress/logical-not.js: Added.
1854         (shouldBe):
1855         (test):
1856
1857 2018-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
1858
1859         [JSC] Remove WeakReferenceHarvester
1860         https://bugs.webkit.org/show_bug.cgi?id=186102
1861
1862         Reviewed by Filip Pizlo.
1863
1864         * microbenchmarks/create-many-weak-map.js: Added.
1865
1866 2018-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
1867
1868         [JSC] Object.create should have intrinsic
1869         https://bugs.webkit.org/show_bug.cgi?id=186200
1870
1871         Reviewed by Filip Pizlo.
1872
1873         * microbenchmarks/object-create-null.js: Added.
1874         (test):
1875         * microbenchmarks/object-create-unknown-object-prototype.js: Added.
1876         (test):
1877         * microbenchmarks/object-create-untyped-prototype.js: Added.
1878         (test):
1879         * stress/get-by-pname-only-prototype-properties.js: Added.
1880         (foo):
1881         * stress/object-create-define.js: Added.
1882         (shouldBe):
1883         (test):
1884         * stress/object-create-null-external.js: Added.
1885         (shouldBe):
1886         (test):
1887         * stress/object-create-null.js: Added.
1888         (shouldBe):
1889         (test):
1890         * stress/object-create-prototype.js: Added.
1891         (shouldBe):
1892         (test):
1893         * stress/object-create-undefined.js: Added.
1894         (shouldThrow):
1895         (i.shouldThrow):
1896
1897 2018-06-02  Caio Lima  <ticaiolima@gmail.com>
1898
1899         [ESNext][BigInt] Implement support for addition operations
1900         https://bugs.webkit.org/show_bug.cgi?id=179002
1901
1902         Reviewed by Yusuke Suzuki.
1903
1904         * bigIntTests.yaml:
1905         * stress/addition-order-evaluation.js: Added.
1906         * stress/big-int-add-wrapped-value.js: Added.
1907         * stress/big-int-addition-basic.js: Added.
1908         * stress/big-int-addition-jit.js: Added.
1909         * stress/big-int-addition-memory-stress.js: Added.
1910         * stress/big-int-addition-string-coercion.js: Added.
1911         * stress/big-int-addition-to-primitive-precedence.js: Added.
1912         * stress/big-int-addition-to-primitive.js: Added.
1913         * stress/big-int-addition-type-error.js: Added.
1914         * stress/big-int-no-conversion-to-number.js:
1915         * stress/big-int-sub-wrapped-value.js: Added.
1916         * stress/big-int-subtraction-basic.js: Added.
1917         * stress/big-int-subtraction-jit.js: Added.
1918         * stress/big-int-subtraction-type-error.js: Added.
1919         * stress/sub-order-evaluation.js: Added.
1920
1921 2018-05-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1922
1923         [JSC] Add Symbol.prototype.description getter
1924         https://bugs.webkit.org/show_bug.cgi?id=186053
1925
1926         Reviewed by Keith Miller.
1927
1928         * stress/symbol-description.js: Added.
1929         (shouldBe):
1930         (shouldThrow):
1931
1932 2018-05-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1933
1934         [DFG] InById should be converted to MatchStructure
1935         https://bugs.webkit.org/show_bug.cgi?id=185803
1936
1937         Reviewed by Keith Miller.
1938
1939         * microbenchmarks/in-by-id-match.js: Added.
1940         (test):
1941         * microbenchmarks/in-by-id-removed.js: Added.
1942         (test):
1943         * stress/in-by-id-constant.js: Added.
1944         (shouldBe):
1945         (test1):
1946         * stress/in-by-id-match-invalid.js: Added.
1947         (shouldBe):
1948         (test1):
1949         * stress/in-by-id-match.js: Added.
1950         (shouldBe):
1951         (test1):
1952
1953 2018-05-31  Caio Lima  <ticaiolima@gmail.com>
1954
1955         [ESNext][BigInt] Implement support for "=<" and ">=" relational operation
1956         https://bugs.webkit.org/show_bug.cgi?id=185929
1957
1958         Reviewed by Yusuke Suzuki.
1959
1960         * bigIntTests.yaml:
1961         * stress/big-int-greater-than-or-equal-jit.js: Added.
1962         * stress/big-int-greater-than-or-equal-order-of-evaluation.js: Added.
1963         * stress/big-int-greater-than-or-equal-wrapped-values.js: Added.
1964         * stress/big-int-greater-than-or-equal.js: Added.
1965         * stress/big-int-less-than-or-equal-general.js: Added.
1966         * stress/big-int-less-than-or-equal-jit.js: Added.
1967         * stress/big-int-less-than-or-equal-order-of-evaluation.js: Added.
1968         * stress/big-int-less-than-or-equal-wrapped-values.js: Added.
1969
1970 2018-05-31  Saam Barati  <sbarati@apple.com>
1971
1972         Cache toString results for CoW arrays
1973         https://bugs.webkit.org/show_bug.cgi?id=186160
1974
1975         Reviewed by Keith Miller.
1976
1977         * microbenchmarks/to-string-on-cow-array.js: Added.
1978         (foo):
1979
1980 2018-05-31  Keith Miller  <keith_miller@apple.com>
1981
1982         Rebaseline test for change in Error.stack behavior.
1983
1984         * stress/error-stack-trace-limit.js:
1985         (numberOfFrames):
1986
1987 2018-05-30  Saam Barati  <sbarati@apple.com>
1988
1989         DFG combined liveness needs to say that the machine CodeBlock's arguments are live
1990         https://bugs.webkit.org/show_bug.cgi?id=186121
1991         <rdar://problem/39377796>
1992
1993         Reviewed by Keith Miller.
1994
1995         * stress/combined-liveness-needs-to-say-arguments-are-live.js: Added.
1996         (baz):
1997         (foo):
1998
1999 2018-05-30  Keith Miller  <keith_miller@apple.com>
2000
2001         Unreviewed, uncomment erroneously commented test code.
2002
2003         * stress/error-stack-trace-limit.js:
2004
2005 2018-05-30  Keith Miller  <keith_miller@apple.com>
2006
2007         LLInt get_by_id prototype caching doesn't properly handle changes
2008         https://bugs.webkit.org/show_bug.cgi?id=186112
2009
2010         Reviewed by Filip Pizlo.
2011
2012         * stress/llint-proto-get-by-id-cache-change-prototype.js: Added.
2013         (foo):
2014         * stress/llint-proto-get-by-id-cache-intercept-value.js: Added.
2015         (foo):
2016
2017 2018-05-30  Caio Lima  <ticaiolima@gmail.com>
2018
2019         [ESNext][BigInt] Implement support for "%" operation
2020         https://bugs.webkit.org/show_bug.cgi?id=184327
2021
2022         Reviewed by Yusuke Suzuki.
2023
2024         * bigIntTests.yaml:
2025         * stress/big-int-mod-memory-stress.js: Added.
2026         * stress/big-int-mod-to-primitive-precedence.js: Added.
2027         * stress/big-int-mod-to-primitive.js: Added.
2028         * stress/big-int-mod-type-error.js: Added.
2029         * stress/big-int-mod-wrapped-value.js: Added.
2030         * stress/big-int-mod.js: Added.
2031
2032 2018-05-29  Caitlin Potter  <caitp@igalia.com>
2033
2034         [JSTests] update test262 expectations after r232261
2035         https://bugs.webkit.org/show_bug.cgi?id=184267
2036
2037         Reviewed by Saam Barati.
2038
2039         * test262/expectations.yaml:
2040
2041 2018-05-29  Caio Lima  <ticaiolima@gmail.com>
2042
2043         [ESNext][BigInt] Implement support for "<" and ">" relational operation
2044         https://bugs.webkit.org/show_bug.cgi?id=185379
2045
2046         Reviewed by Yusuke Suzuki.
2047
2048         * stress/big-int-greater-than-general.js: Added.
2049         * stress/big-int-greater-than-jit.js: Added.
2050         * stress/big-int-greater-than-order-of-evaluation.js: Added.
2051         * stress/big-int-greater-than-wrapped-values.js: Added.
2052         * stress/big-int-less-than-general.js: Added.
2053         * stress/big-int-less-than-jit.js: Added.
2054         * stress/big-int-less-than-order-of-evaluation.js: Added.
2055         * stress/big-int-less-than-wrapped-values.js: Added.
2056
2057 2018-05-29  Caitlin Potter  <caitp@igalia.com>
2058
2059         [JSC] Fix Array.prototype.concat fast case when single argument is Proxy
2060         https://bugs.webkit.org/show_bug.cgi?id=184267
2061
2062         Reviewed by Saam Barati.
2063
2064         * stress/array-concat-fast-spread-proxy.js: Copied from JSTests/stress/array-concat-spread-proxy.js.
2065         (arrayEq):
2066         (catch):
2067         * stress/array-concat-spread-proxy.js:
2068
2069 2018-05-27  Caio Lima  <ticaiolima@gmail.com>
2070
2071         [ESNext][BigInt] Implement "+" and "-" unary operation
2072         https://bugs.webkit.org/show_bug.cgi?id=182214
2073
2074         Reviewed by Yusuke Suzuki.
2075
2076         * stress/big-int-negate-basic.js: Added.
2077         * stress/big-int-negate-jit.js: Added.
2078         * stress/big-int-unary-plus.js: Added.
2079
2080 2018-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2081
2082         [JSC] Rename Array#flatten to flat
2083         https://bugs.webkit.org/show_bug.cgi?id=186012
2084
2085         Reviewed by Saam Barati.
2086
2087         * stress/array-flatten.js:
2088         (shouldThrow):
2089         * test262/expectations.yaml:
2090
2091 2018-05-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2092
2093         Upgrade test262 to May 24 version
2094         https://bugs.webkit.org/show_bug.cgi?id=185937
2095
2096         Reviewed by Darin Adler.
2097
2098         * test262/expectations.yaml:
2099         * test262/harness/doneprintHandle.js:
2100         (DONE):
2101         * test262/latest-changes-summary.txt:
2102         * test262/test/annexB/language/eval-code/direct/global-block-decl-eval-global-existing-global-init.js:
2103         * test262/test/annexB/language/eval-code/direct/global-block-decl-eval-global-existing-non-enumerable-global-init.js: Added.
2104         * test262/test/annexB/language/eval-code/direct/global-if-decl-else-decl-a-eval-global-existing-global-init.js:
2105         * test262/test/annexB/language/eval-code/direct/global-if-decl-else-decl-a-eval-global-existing-non-enumerable-global-init.js: Copied from JSTests/test262/test/annexB/language/eval-code/direct/global-if-decl-else-decl-a-eval-global-existing-global-init.js.
2106         * test262/test/annexB/language/eval-code/direct/global-if-decl-else-decl-b-eval-global-existing-global-init.js:
2107         * test262/test/annexB/language/eval-code/direct/global-if-decl-else-decl-b-eval-global-existing-non-enumerable-global-init.js: Copied from JSTests/test262/test/annexB/language/eval-code/direct/global-if-decl-else-decl-b-eval-global-existing-global-init.js.
2108         * test262/test/annexB/language/eval-code/direct/global-if-decl-else-stmt-eval-global-existing-global-init.js:
2109         * test262/test/annexB/language/eval-code/direct/global-if-decl-else-stmt-eval-global-existing-non-enumerable-global-init.js: Copied from JSTests/test262/test/annexB/language/eval-code/direct/global-if-decl-else-stmt-eval-global-existing-global-init.js.
2110         * test262/test/annexB/language/eval-code/direct/global-if-decl-no-else-eval-global-existing-global-init.js:
2111         * test262/test/annexB/language/eval-code/direct/global-if-decl-no-else-eval-global-existing-non-enumerable-global-init.js: Copied from JSTests/test262/test/annexB/language/eval-code/direct/global-if-decl-no-else-eval-global-existing-global-init.js.
2112         * test262/test/annexB/language/eval-code/direct/global-if-stmt-else-decl-eval-global-existing-global-init.js:
2113         * test262/test/annexB/language/eval-code/direct/global-if-stmt-else-decl-eval-global-existing-non-enumerable-global-init.js: Copied from JSTests/test262/test/annexB/language/eval-code/direct/global-if-stmt-else-decl-eval-global-existing-global-init.js.
2114         * test262/test/annexB/language/eval-code/direct/global-switch-case-eval-global-existing-global-init.js:
2115         * test262/test/annexB/language/eval-code/direct/global-switch-case-eval-global-existing-non-enumerable-global-init.js: Added.
2116         * test262/test/annexB/language/eval-code/direct/global-switch-dflt-eval-global-existing-global-init.js:
2117         * test262/test/annexB/language/eval-code/direct/global-switch-dflt-eval-global-existing-non-enumerable-global-init.js: Added.
2118         * test262/test/annexB/language/eval-code/indirect/global-block-decl-eval-global-existing-global-init.js:
2119         * test262/test/annexB/language/eval-code/indirect/global-block-decl-eval-global-existing-non-enumerable-global-init.js: Added.
2120         * test262/test/annexB/language/eval-code/indirect/global-if-decl-else-decl-a-eval-global-existing-global-init.js:
2121         * test262/test/annexB/language/eval-code/indirect/global-if-decl-else-decl-a-eval-global-existing-non-enumerable-global-init.js: Copied from JSTests/test262/test/annexB/language/eval-code/indirect/global-if-decl-else-decl-a-eval-global-existing-global-init.js.
2122         * test262/test/annexB/language/eval-code/indirect/global-if-decl-else-decl-b-eval-global-existing-global-init.js:
2123         * test262/test/annexB/language/eval-code/indirect/global-if-decl-else-decl-b-eval-global-existing-non-enumerable-global-init.js: Copied from JSTests/test262/test/annexB/language/eval-code/indirect/global-if-decl-else-decl-b-eval-global-existing-global-init.js.
2124         * test262/test/annexB/language/eval-code/indirect/global-if-decl-else-stmt-eval-global-existing-global-init.js:
2125         * test262/test/annexB/language/eval-code/indirect/global-if-decl-else-stmt-eval-global-existing-non-enumerable-global-init.js: Copied from JSTests/test262/test/annexB/language/eval-code/indirect/global-if-decl-else-stmt-eval-global-existing-global-init.js.
2126         * test262/test/annexB/language/eval-code/indirect/global-if-decl-no-else-eval-global-existing-global-init.js:
2127         * test262/test/annexB/language/eval-code/indirect/global-if-decl-no-else-eval-global-existing-non-enumerable-global-init.js: Copied from JSTests/test262/test/annexB/language/eval-code/indirect/global-if-decl-no-else-eval-global-existing-global-init.js.
2128         * test262/test/annexB/language/eval-code/indirect/global-if-stmt-else-decl-eval-global-existing-global-init.js:
2129         * test262/test/annexB/language/eval-code/indirect/global-if-stmt-else-decl-eval-global-existing-non-enumerable-global-init.js: Copied from JSTests/test262/test/annexB/language/eval-code/indirect/global-if-stmt-else-decl-eval-global-existing-global-init.js.
2130         * test262/test/annexB/language/eval-code/indirect/global-switch-case-eval-global-existing-global-init.js:
2131         * test262/test/annexB/language/eval-code/indirect/global-switch-case-eval-global-existing-non-enumerable-global-init.js: Added.
2132         * test262/test/annexB/language/eval-code/indirect/global-switch-dflt-eval-global-existing-global-init.js:
2133         * test262/test/annexB/language/eval-code/indirect/global-switch-dflt-eval-global-existing-non-enumerable-global-init.js: Added.
2134         * test262/test/annexB/language/global-code/block-decl-global-existing-global-init.js: Added.
2135         (262.evalScript.f):
2136         * test262/test/annexB/language/global-code/block-decl-global-existing-non-enumerable-global-init.js: Added.
2137         (262.evalScript.f):
2138         * test262/test/annexB/language/global-code/if-decl-else-decl-a-global-existing-global-init.js: Added.
2139         (262.evalScript.true.f):
2140         (else._f):
2141         * test262/test/annexB/language/global-code/if-decl-else-decl-a-global-existing-non-enumerable-global-init.js: Added.
2142         (262.evalScript.true.f):
2143         (else._f):
2144         * test262/test/annexB/language/global-code/if-decl-else-decl-b-global-existing-global-init.js: Added.
2145         (262.evalScript.false._f):
2146         (else.f):
2147         * test262/test/annexB/language/global-code/if-decl-else-decl-b-global-existing-non-enumerable-global-init.js: Added.
2148         (262.evalScript.false._f):
2149         (else.f):
2150         * test262/test/annexB/language/global-code/if-decl-else-stmt-global-existing-global-init.js: Added.
2151         (262.evalScript.true.f):
2152         * test262/test/annexB/language/global-code/if-decl-else-stmt-global-existing-non-enumerable-global-init.js: Added.
2153         (262.evalScript.true.f):
2154         * test262/test/annexB/language/global-code/if-decl-no-else-global-existing-global-init.js: Added.
2155         (262.evalScript.true.f):
2156         * test262/test/annexB/language/global-code/if-decl-no-else-global-existing-non-enumerable-global-init.js: Added.
2157         (262.evalScript.true.f):
2158         * test262/test/annexB/language/global-code/if-stmt-else-decl-global-existing-global-init.js: Added.
2159         (else.f):
2160         * test262/test/annexB/language/global-code/if-stmt-else-decl-global-existing-non-enumerable-global-init.js: Added.
2161         (else.f):
2162         * test262/test/annexB/language/global-code/switch-case-global-existing-global-init.js: Added.
2163         (262.evalScript.switch.case.1):
2164         (262.evalScript.switch):
2165         * test262/test/annexB/language/global-code/switch-case-global-existing-non-enumerable-global-init.js: Added.
2166         (262.evalScript.switch.case.1):
2167         (262.evalScript.switch):
2168         * test262/test/annexB/language/global-code/switch-dflt-global-existing-global-init.js: Added.
2169         (262.evalScript.switch.default):
2170         (262.evalScript.switch):
2171         * test262/test/annexB/language/global-code/switch-dflt-global-existing-non-enumerable-global-init.js: Added.
2172         (262.evalScript.switch.default):
2173         (262.evalScript.switch):
2174         * test262/test/built-ins/Array/prototype/flat/array-like-objects.js: Renamed from JSTests/test262/test/built-ins/Array/prototype/flatten/array-like-objects.js.
2175         * test262/test/built-ins/Array/prototype/flat/bound-function-call.js: Renamed from JSTests/test262/test/built-ins/Array/prototype/flatten/bound-function-call.js.
2176         * test262/test/built-ins/Array/prototype/flat/empty-array-elements.js: Renamed from JSTests/test262/test/built-ins/Array/prototype/flatten/empty-array-elements.js.
2177         * test262/test/built-ins/Array/prototype/flat/empty-object-elements.js: Renamed from JSTests/test262/test/built-ins/Array/prototype/flatten/empty-object-elements.js.
2178         * test262/test/built-ins/Array/prototype/flat/length.js: Added.
2179         * test262/test/built-ins/Array/prototype/flat/name.js: Added.
2180         * test262/test/built-ins/Array/prototype/flat/non-numeric-depth-should-not-throw.js: Renamed from JSTests/test262/test/built-ins/Array/prototype/flatten/non-numeric-depth-should-not-throw.js.
2181         * test262/test/built-ins/Array/prototype/flat/non-object-ctor-throws.js: Renamed from JSTests/test262/test/built-ins/Array/prototype/flatten/non-object-ctor-throws.js.
2182         * test262/test/built-ins/Array/prototype/flat/null-undefined-elements.js: Added.
2183         * test262/test/built-ins/Array/prototype/flat/null-undefined-input-throws.js: Renamed from JSTests/test262/test/built-ins/Array/prototype/flatten/null-undefined-input-throws.js.
2184         * test262/test/built-ins/Array/prototype/flat/positive-infinity.js: Renamed from JSTests/test262/test/built-ins/Array/prototype/flatten/positive-infinity.js.
2185         * test262/test/built-ins/Array/prototype/flat/prop-desc.js: Renamed from JSTests/test262/test/built-ins/Array/prototype/flatten/prop-desc.js.
2186         * test262/test/built-ins/Array/prototype/flat/symbol-object-create-null-depth-throws.js: Renamed from JSTests/test262/test/built-ins/Array/prototype/flatten/symbol-object-create-null-depth-throws.js.
2187         * test262/test/built-ins/Array/prototype/flatten/length.js: Removed.
2188         * test262/test/built-ins/Array/prototype/flatten/name.js: Removed.
2189         * test262/test/built-ins/Array/prototype/flatten/null-undefined-elements.js: Removed.
2190         * test262/test/built-ins/AsyncGeneratorPrototype/next/name.js:
2191         * test262/test/built-ins/AsyncGeneratorPrototype/return/name.js:
2192         * test262/test/built-ins/AsyncGeneratorPrototype/throw/name.js:
2193         * test262/test/built-ins/Math/acosh/nan-returns.js:
2194         * test262/test/built-ins/Math/asinh/asinh-specialVals.js:
2195         * test262/test/built-ins/Math/atanh/atanh-specialVals.js:
2196         * test262/test/built-ins/Math/cbrt/cbrt-specialValues.js:
2197         * test262/test/built-ins/Math/cbrt/prop-desc.js:
2198         * test262/test/built-ins/Math/cosh/cosh-specialVals.js:
2199         * test262/test/built-ins/Math/expm1/expm1-specialVals.js:
2200         * test262/test/built-ins/Math/log10/Log10-specialVals.js:
2201         * test262/test/built-ins/Math/log2/log2-basicTests.js:
2202         * test262/test/built-ins/Math/sign/sign-specialVals.js:
2203         * test262/test/built-ins/Math/sinh/sinh-specialVals.js:
2204         * test262/test/built-ins/Math/tanh/tanh-specialVals.js:
2205         * test262/test/built-ins/Math/trunc/trunc-sampleTests.js:
2206         * test262/test/built-ins/Math/trunc/trunc-specialVals.js:
2207         * test262/test/built-ins/Object/internals/DefineOwnProperty/consistent-value-regexp-dollar1.js: Added.
2208         * test262/test/built-ins/Object/internals/DefineOwnProperty/consistent-writable-regexp-dollar1.js: Added.
2209         * test262/test/intl402/Intl/getCanonicalLocales/descriptor.js:
2210         * test262/test/intl402/Intl/getCanonicalLocales/duplicates.js:
2211         * test262/test/intl402/Locale/constructor-getter-order.js: Added.
2212         (new.Intl.Locale.toString):
2213         (get language):
2214         (get script):
2215         (get region):
2216         (get calendar):
2217         (get collation):
2218         (get hourCycle):
2219         (get caseFirst):
2220         (get numeric):
2221         (get numberingSystem):
2222         * test262/test/intl402/Locale/constructor-locale-object.js: Added.
2223         * test262/test/intl402/Locale/constructor-non-iana-canon.js: Added.
2224         * test262/test/intl402/Locale/constructor-options-casefirst-invalid.js: Added.
2225         (valueOf):
2226         (const.invalidCaseFirstOption.of.invalidCaseFirstOptions.new.Intl.Locale):
2227         * test262/test/intl402/Locale/constructor-options-casefirst-valid.js: Added.
2228         (toString):
2229         * test262/test/intl402/Locale/constructor-options-collation-invalid.js: Added.
2230         (const.invalidCollationOption.of.invalidCollationOptions.new.Intl.Locale):
2231         * test262/test/intl402/Locale/constructor-options-collation-valid.js: Added.
2232         * test262/test/intl402/Locale/constructor-options-hourcycle-invalid.js: Added.
2233         (const.invalidHourCycleOption.of.invalidHourCycleOptions.new.Intl.Locale):
2234         * test262/test/intl402/Locale/constructor-options-hourcycle-valid.js: Added.
2235         (toString):
2236         * test262/test/intl402/Locale/constructor-options-language-grandfathered.js: Added.
2237         * test262/test/intl402/Locale/constructor-options-language-valid.js:
2238         (toString):
2239         * test262/test/intl402/Locale/constructor-options-numberingsystem-invalid.js: Added.
2240         (const.invalidNumberingSystemOption.of.invalidNumberingSystemOptions.new.Intl.Locale):
2241         * test262/test/intl402/Locale/constructor-options-numberingsystem-valid.js: Added.
2242         * test262/test/intl402/Locale/constructor-options-numeric-valid.js: Added.
2243         (valueOf):
2244         * test262/test/intl402/Locale/constructor-options-region-valid.js:
2245         * test262/test/intl402/Locale/constructor-options-script-valid.js:
2246         (toString):
2247         * test262/test/intl402/Locale/constructor-parse-twice.js: Added.
2248         * test262/test/intl402/Locale/constructor-tag-tostring.js: Added.
2249         (CustomError):
2250         (WrongCustomError):
2251         (const.errors.get Symbol):
2252         (throw.new.CustomError):
2253         (throw.new.CustomError.get toString):
2254         (throw.new.CustomError.get valueOf):
2255         (throw.new.WrongCustomError.get valueOf):
2256         (throw.new.WrongCustomError):
2257         * test262/test/intl402/Locale/constructor-unicode-ext-invalid.js: Added.
2258         * test262/test/intl402/Locale/constructor-unicode-ext-valid.js: Added.
2259         (canonical.of.Object.entries):
2260         * test262/test/intl402/Locale/extensions-grandfathered.js: Added.
2261         (of.testData.value.of.Object.entries):
2262         * test262/test/intl402/Locale/extensions-private.js: Added.
2263         * test262/test/intl402/Locale/getters-grandfathered.js: Added.
2264         * test262/test/intl402/Locale/getters-missing.js: Added.
2265         * test262/test/intl402/Locale/getters-privateuse.js: Added.
2266         * test262/test/intl402/Locale/getters.js: Added.
2267         * test262/test/intl402/Locale/invalid-tag-throws-symbol.js:
2268         * test262/test/intl402/Locale/likely-subtags-grandfathered.js: Added.
2269         * test262/test/intl402/Locale/prop-desc.js:
2270         * test262/test/intl402/Locale/prototype/baseName/prop-desc.js: Added.
2271         * test262/test/intl402/Locale/prototype/calendar/prop-desc.js: Added.
2272         * test262/test/intl402/Locale/prototype/caseFirst/prop-desc.js: Added.
2273         * test262/test/intl402/Locale/prototype/collation/prop-desc.js: Added.
2274         * test262/test/intl402/Locale/prototype/constructor/prop-desc.js: Copied from JSTests/test262/test/intl402/Locale/prototype/constructor.js.
2275         * test262/test/intl402/Locale/prototype/hourCycle/prop-desc.js: Added.
2276         * test262/test/intl402/Locale/prototype/language/prop-desc.js: Added.
2277         * test262/test/intl402/Locale/prototype/maximize/length.js:
2278         * test262/test/intl402/Locale/prototype/maximize/prop-desc.js:
2279         * test262/test/intl402/Locale/prototype/minimize/length.js: Copied from JSTests/test262/test/intl402/Locale/prototype/maximize/length.js.
2280         * test262/test/intl402/Locale/prototype/minimize/name.js: Added.
2281         * test262/test/intl402/Locale/prototype/minimize/prop-desc.js: Copied from JSTests/test262/test/intl402/Locale/prototype/constructor.js.
2282         * test262/test/intl402/Locale/prototype/numberingSystem/prop-desc.js: Added.
2283         * test262/test/intl402/Locale/prototype/numeric/prop-desc.js: Added.
2284         * test262/test/intl402/Locale/prototype/region/prop-desc.js: Added.
2285         * test262/test/intl402/Locale/prototype/script/prop-desc.js: Added.
2286         * test262/test/intl402/Locale/prototype/toString/prop-desc.js: Renamed from JSTests/test262/test/intl402/Locale/prototype/constructor.js.
2287         * test262/test/intl402/Locale/prototype/toStringTag/toStringTag.js: Renamed from JSTests/test262/test/intl402/Locale/prototype/toStringTag.js.
2288         * test262/test/intl402/Number/prototype/toLocaleString/length.js:
2289         * test262/test/intl402/NumberFormat/length.js:
2290         * test262/test/intl402/NumberFormat/name.js:
2291         * test262/test/intl402/NumberFormat/prop-desc.js:
2292         * test262/test/intl402/PluralRules/length.js:
2293         * test262/test/intl402/PluralRules/name.js:
2294         * test262/test/intl402/PluralRules/prop-desc.js: Copied from JSTests/test262/test/intl402/NumberFormat/prop-desc.js.
2295         * test262/test/language/expressions/addition/bigint-and-number.js:
2296         * test262/test/language/expressions/addition/bigint-arithmetic.js:
2297         (testAdd): Deleted.
2298         * test262/test/language/expressions/addition/bigint-errors.js:
2299         (Symbol.toPrimitive):
2300         (0n.Symbol.toPrimitive):
2301         (valueOf):
2302         (0n.valueOf):
2303         (toString):
2304         (0n.toString):
2305         * test262/test/language/expressions/addition/bigint-toprimitive.js:
2306         * test262/test/language/expressions/addition/bigint-wrapped-values.js:
2307         * test262/test/language/expressions/bitwise-and/bigint-and-number.js:
2308         * test262/test/language/expressions/bitwise-and/bigint-errors.js:
2309         (Symbol.toPrimitive):
2310         (0n.Symbol.toPrimitive):
2311         (valueOf):
2312         (0n.valueOf):
2313         (toString):
2314         (0n.toString):
2315         * test262/test/language/expressions/bitwise-and/bigint-non-primitive.js:
2316         (assert.sameValue.Symbol.toPrimitive):
2317         (assert.sameValue.0b011n.Symbol.toPrimitive):
2318         (assert.sameValue.valueOf):
2319         (assert.sameValue.0b011n.valueOf):
2320         (assert.sameValue.toString):
2321         (assert.sameValue.0b011n.toString):
2322         * test262/test/language/expressions/bitwise-and/bigint-toprimitive.js:
2323         * test262/test/language/expressions/bitwise-and/bigint-wrapped-values.js:
2324         * test262/test/language/expressions/bitwise-not/bigint-non-primitive.js:
2325         (assert.sameValue.Symbol.toPrimitive):
2326         (assert.sameValue.valueOf):
2327         (assert.sameValue.toString):
2328         * test262/test/language/expressions/bitwise-or/bigint-and-number.js:
2329         * test262/test/language/expressions/bitwise-or/bigint-errors.js:
2330         (Symbol.toPrimitive):
2331         (0n.Symbol.toPrimitive):
2332         (valueOf):
2333         (0n.valueOf):
2334         (toString):
2335         (0n.toString):
2336         * test262/test/language/expressions/bitwise-or/bigint-non-primitive.js:
2337         (assert.sameValue.Symbol.toPrimitive):
2338         (assert.sameValue.0b011n.Symbol.toPrimitive):
2339         (assert.sameValue.valueOf):
2340         (assert.sameValue.0b011n.valueOf):
2341         (assert.sameValue.toString):
2342         (assert.sameValue.0b011n.toString):
2343         * test262/test/language/expressions/bitwise-or/bigint-toprimitive.js:
2344         * test262/test/language/expressions/bitwise-or/bigint-wrapped-values.js:
2345         * test262/test/language/expressions/bitwise-xor/bigint-and-number.js:
2346         * test262/test/language/expressions/bitwise-xor/bigint-errors.js:
2347         (Symbol.toPrimitive):
2348         (0n.Symbol.toPrimitive):
2349         (valueOf):
2350         (0n.valueOf):
2351         (toString):
2352         (0n.toString):
2353         * test262/test/language/expressions/bitwise-xor/bigint-non-primitive.js:
2354         (assert.sameValue.Symbol.toPrimitive):
2355         (assert.sameValue.0b011n.Symbol.toPrimitive):
2356         (assert.sameValue.valueOf):
2357         (assert.sameValue.0b011n.valueOf):
2358         (assert.sameValue.toString):
2359         (assert.sameValue.0b011n.toString):
2360         * test262/test/language/expressions/bitwise-xor/bigint-toprimitive.js:
2361         * test262/test/language/expressions/bitwise-xor/bigint-wrapped-values.js:
2362         * test262/test/language/expressions/division/bigint-and-number.js:
2363         * test262/test/language/expressions/division/bigint-arithmetic.js:
2364         (testDiv): Deleted.
2365         * test262/test/language/expressions/division/bigint-complex-infinity.js:
2366         * test262/test/language/expressions/division/bigint-errors.js:
2367         (Symbol.toPrimitive):
2368         (0n.Symbol.toPrimitive):
2369         (valueOf):
2370         (0n.valueOf):
2371         (toString):
2372         (0n.toString):
2373         * test262/test/language/expressions/division/bigint-toprimitive.js:
2374         * test262/test/language/expressions/division/bigint-wrapped-values.js:
2375         * test262/test/language/expressions/does-not-equals/bigint-and-bigint.js:
2376         * test262/test/language/expressions/does-not-equals/bigint-and-boolean.js:
2377         * test262/test/language/expressions/does-not-equals/bigint-and-incomparable-primitive.js:
2378         * test262/test/language/expressions/does-not-equals/bigint-and-non-finite.js:
2379         * test262/test/language/expressions/does-not-equals/bigint-and-number-extremes.js:
2380         * test262/test/language/expressions/does-not-equals/bigint-and-number.js:
2381         * test262/test/language/expressions/does-not-equals/bigint-and-object.js:
2382         (assert.sameValue.0n.valueOf):
2383         (assert.sameValue.valueOf):
2384         (assert.sameValue.0n.toString):
2385         (assert.sameValue.toString):
2386         (assert.sameValue.900719925474099101n.valueOf):
2387         (assert.sameValue.900719925474099101n.toString):
2388         * test262/test/language/expressions/does-not-equals/bigint-and-string.js:
2389         * test262/test/language/expressions/equals/bigint-and-bigint.js:
2390         * test262/test/language/expressions/equals/bigint-and-boolean.js:
2391         * test262/test/language/expressions/equals/bigint-and-incomparable-primitive.js:
2392         * test262/test/language/expressions/equals/bigint-and-non-finite.js:
2393         * test262/test/language/expressions/equals/bigint-and-number-extremes.js:
2394         * test262/test/language/expressions/equals/bigint-and-number.js:
2395         * test262/test/language/expressions/equals/bigint-and-object.js:
2396         (assert.sameValue.0n.valueOf):
2397         (assert.sameValue.valueOf):
2398         (assert.sameValue.0n.toString):
2399         (assert.sameValue.toString):
2400         (assert.sameValue.900719925474099101n.valueOf):
2401         (assert.sameValue.900719925474099101n.toString):
2402         * test262/test/language/expressions/equals/bigint-and-string.js:
2403         * test262/test/language/expressions/exponentiation/bigint-and-number.js:
2404         * test262/test/language/expressions/exponentiation/bigint-arithmetic.js:
2405         (testExpt): Deleted.
2406         * test262/test/language/expressions/exponentiation/bigint-errors.js:
2407         (Symbol.toPrimitive):
2408         (0n.Symbol.toPrimitive):
2409         (valueOf):
2410         (0n.valueOf):
2411         (toString):
2412         (0n.toString):
2413         * test262/test/language/expressions/exponentiation/bigint-negative-exponent-throws.js: Renamed from JSTests/test262/test/language/expressions/exponentiation/bigint-exp-operator-negative-throws.js.
2414         * test262/test/language/expressions/exponentiation/bigint-toprimitive.js:
2415         * test262/test/language/expressions/exponentiation/bigint-wrapped-values.js:
2416         * test262/test/language/expressions/exponentiation/bigint-zero-base-zero-exponent.js:
2417         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js:
2418         * test262/test/language/expressions/greater-than-or-equal/bigint-and-incomparable-string.js:
2419         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js:
2420         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js:
2421         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2422         * test262/test/language/expressions/greater-than-or-equal/bigint-and-string.js:
2423         * test262/test/language/expressions/greater-than/11.8.2-1.js:
2424         (obj1.valueOf):
2425         (obj2.valueOf):
2426         * test262/test/language/expressions/greater-than/11.8.2-2.js:
2427         (obj1.valueOf):
2428         (obj2.toString):
2429         * test262/test/language/expressions/greater-than/11.8.2-3.js:
2430         (obj1.toString):
2431         (obj2.valueOf):
2432         * test262/test/language/expressions/greater-than/11.8.2-4.js:
2433         (obj1.toString):
2434         (obj2.toString):
2435         * test262/test/language/expressions/greater-than/bigint-and-bigint.js:
2436         * test262/test/language/expressions/greater-than/bigint-and-boolean.js:
2437         * test262/test/language/expressions/greater-than/bigint-and-incomparable-string.js:
2438         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js:
2439         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js:
2440         * test262/test/language/expressions/greater-than/bigint-and-number.js:
2441         * test262/test/language/expressions/greater-than/bigint-and-string.js:
2442         * test262/test/language/expressions/greater-than/bigint-and-symbol.js: Added.
2443         * test262/test/language/expressions/left-shift/bigint-and-number.js:
2444         * test262/test/language/expressions/left-shift/bigint-errors.js:
2445         (Symbol.toPrimitive):
2446         (0n.Symbol.toPrimitive):
2447         (valueOf):
2448         (0n.valueOf):
2449         (toString):
2450         (0n.toString):
2451         * test262/test/language/expressions/left-shift/bigint-non-primitive.js:
2452         (assert.sameValue.Symbol.toPrimitive):
2453         (assert.sameValue.valueOf):
2454         (assert.sameValue.toString):
2455         (assert.sameValue.0b101n.Symbol.toPrimitive):
2456         (assert.sameValue.0b101n.valueOf):
2457         (assert.sameValue.0b101n.toString):
2458         (valueOf):
2459         * test262/test/language/expressions/left-shift/bigint-toprimitive.js:
2460         * test262/test/language/expressions/left-shift/bigint-wrapped-values.js:
2461         * test262/test/language/expressions/less-than-or-equal/11.8.3-1.js:
2462         (obj1.valueOf):
2463         (obj2.valueOf):
2464         * test262/test/language/expressions/less-than-or-equal/11.8.3-2.js:
2465         (obj1.valueOf):
2466         (obj2.toString):
2467         * test262/test/language/expressions/less-than-or-equal/11.8.3-3.js:
2468         (obj1.toString):
2469         (obj2.valueOf):
2470         * test262/test/language/expressions/less-than-or-equal/11.8.3-4.js:
2471         (obj1.toString):
2472         (obj2.toString):
2473         * test262/test/language/expressions/less-than-or-equal/11.8.3-5.js: Removed.
2474         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js:
2475         * test262/test/language/expressions/less-than-or-equal/bigint-and-incomparable-string.js:
2476         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js:
2477         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js:
2478         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2479         * test262/test/language/expressions/less-than-or-equal/bigint-and-string.js:
2480         * test262/test/language/expressions/less-than/bigint-and-bigint.js:
2481         * test262/test/language/expressions/less-than/bigint-and-boolean.js:
2482         * test262/test/language/expressions/less-than/bigint-and-incomparable-string.js:
2483         * test262/test/language/expressions/less-than/bigint-and-non-finite.js:
2484         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js:
2485         * test262/test/language/expressions/less-than/bigint-and-number.js:
2486         * test262/test/language/expressions/less-than/bigint-and-string.js:
2487         * test262/test/language/expressions/less-than/bigint-and-symbol.js: Added.
2488         * test262/test/language/expressions/modulus/bigint-and-number.js:
2489         * test262/test/language/expressions/modulus/bigint-arithmetic.js:
2490         (testMod): Deleted.
2491         * test262/test/language/expressions/modulus/bigint-errors.js:
2492         (Symbol.toPrimitive):
2493         (0n.Symbol.toPrimitive):
2494         (valueOf):
2495         (0n.valueOf):
2496         (toString):
2497         (0n.toString):
2498         * test262/test/language/expressions/modulus/bigint-modulo-zero.js:
2499         * test262/test/language/expressions/modulus/bigint-toprimitive.js:
2500         * test262/test/language/expressions/modulus/bigint-wrapped-values.js:
2501         * test262/test/language/expressions/multiplication/bigint-and-number.js:
2502         * test262/test/language/expressions/multiplication/bigint-arithmetic.js:
2503         (testMul): Deleted.
2504         * test262/test/language/expressions/multiplication/bigint-errors.js:
2505         (Symbol.toPrimitive):
2506         (0n.Symbol.toPrimitive):
2507         (valueOf):
2508         (0n.valueOf):
2509         (toString):
2510         (0n.toString):
2511         * test262/test/language/expressions/multiplication/bigint-toprimitive.js:
2512         * test262/test/language/expressions/multiplication/bigint-wrapped-values.js:
2513         * test262/test/language/expressions/right-shift/bigint-and-number.js:
2514         * test262/test/language/expressions/right-shift/bigint-errors.js:
2515         (Symbol.toPrimitive):
2516         (0n.Symbol.toPrimitive):
2517         (valueOf):
2518         (0n.valueOf):
2519         (toString):
2520         (0n.toString):
2521         * test262/test/language/expressions/right-shift/bigint-non-primitive.js:
2522         (assert.sameValue.Symbol.toPrimitive):
2523         (assert.sameValue.valueOf):
2524         (assert.sameValue.toString):
2525         (assert.sameValue.0b101n.Symbol.toPrimitive):
2526         (assert.sameValue.0b101n.valueOf):
2527         (assert.sameValue.0b101n.toString):
2528         (valueOf):
2529         * test262/test/language/expressions/right-shift/bigint-toprimitive.js:
2530         * test262/test/language/expressions/right-shift/bigint-wrapped-values.js:
2531         * test262/test/language/expressions/strict-does-not-equals/bigint-and-bigint.js:
2532         * test262/test/language/expressions/strict-does-not-equals/bigint-and-boolean.js:
2533         * test262/test/language/expressions/strict-does-not-equals/bigint-and-incomparable-primitive.js:
2534         * test262/test/language/expressions/strict-does-not-equals/bigint-and-non-finite.js:
2535         * test262/test/language/expressions/strict-does-not-equals/bigint-and-number-extremes.js:
2536         * test262/test/language/expressions/strict-does-not-equals/bigint-and-number.js:
2537         * test262/test/language/expressions/strict-does-not-equals/bigint-and-object.js:
2538         (assert.sameValue.0n.valueOf):
2539         (assert.sameValue.valueOf):
2540         (assert.sameValue.0n.toString):
2541         (assert.sameValue.toString):
2542         (assert.sameValue.900719925474099101n.valueOf):
2543         (assert.sameValue.900719925474099101n.toString):
2544         * test262/test/language/expressions/strict-does-not-equals/bigint-and-string.js:
2545         * test262/test/language/expressions/strict-equals/bigint-and-bigint.js:
2546         * test262/test/language/expressions/strict-equals/bigint-and-boolean.js:
2547         * test262/test/language/expressions/strict-equals/bigint-and-incomparable-primitive.js:
2548         * test262/test/language/expressions/strict-equals/bigint-and-non-finite.js:
2549         * test262/test/language/expressions/strict-equals/bigint-and-number-extremes.js:
2550         * test262/test/language/expressions/strict-equals/bigint-and-number.js:
2551         * test262/test/language/expressions/strict-equals/bigint-and-object.js:
2552         (assert.sameValue.0n.valueOf):
2553         (assert.sameValue.valueOf):
2554         (assert.sameValue.0n.toString):
2555         (assert.sameValue.toString):
2556         (assert.sameValue.900719925474099101n.valueOf):
2557         (assert.sameValue.900719925474099101n.toString):
2558         * test262/test/language/expressions/strict-equals/bigint-and-string.js:
2559         * test262/test/language/expressions/subtraction/bigint-and-number.js:
2560         * test262/test/language/expressions/subtraction/bigint-arithmetic.js:
2561         (testSub): Deleted.
2562         * test262/test/language/expressions/subtraction/bigint-errors.js:
2563         (Symbol.toPrimitive):
2564         (0n.Symbol.toPrimitive):
2565         (valueOf):
2566         (0n.valueOf):
2567         (toString):
2568         (0n.toString):
2569         * test262/test/language/expressions/subtraction/bigint-toprimitive.js:
2570         * test262/test/language/expressions/subtraction/bigint-wrapped-values.js:
2571         * test262/test/language/expressions/unary-minus/bigint-non-primitive.js:
2572         (assert.sameValue.Symbol.toPrimitive):
2573         (assert.sameValue.valueOf):
2574         (assert.sameValue.toString):
2575         * test262/test/language/expressions/unary-plus/bigint-throws.js:
2576         * test262/test/language/expressions/unsigned-right-shift/bigint-and-number.js:
2577         * test262/test/language/expressions/unsigned-right-shift/bigint-errors.js:
2578         (Symbol.toPrimitive):
2579         (0n.Symbol.toPrimitive):
2580         (valueOf):
2581         (0n.valueOf):
2582         (toString):
2583         (0n.toString):
2584         * test262/test/language/expressions/unsigned-right-shift/bigint-non-primitive.js:
2585         (Symbol.toPrimitive):
2586         (valueOf):
2587         (toString):
2588         (0b101n.Symbol.toPrimitive):
2589         (0b101n.valueOf):
2590         (0b101n.toString):
2591         (valueOf.valueOf):
2592         * test262/test/language/expressions/unsigned-right-shift/bigint-toprimitive.js:
2593         * test262/test/language/expressions/unsigned-right-shift/bigint-wrapped-values.js:
2594         * test262/test/language/literals/numeric/numeric-followed-by-ident.js: Added.
2595         * test262/test/language/literals/string/line-continuation-double.js: Added.
2596         * test262/test/language/literals/string/line-continuation-single.js: Added.
2597         * test262/test262-Revision.txt:
2598
2599 2018-05-25  Mark Lam  <mark.lam@apple.com>
2600
2601         for-in loops should preserve and restore the TDZ stack for each of its internal loops.
2602         https://bugs.webkit.org/show_bug.cgi?id=185995
2603         <rdar://problem/40173142>
2604
2605         Reviewed by Saam Barati.
2606
2607         * stress/regress-185995.js: Added.
2608
2609 2018-05-23  Keith Miller  <keith_miller@apple.com>
2610
2611         Define length on CoW array should properly convert to writable
2612         https://bugs.webkit.org/show_bug.cgi?id=185927
2613
2614         Reviewed by Yusuke Suzuki.
2615
2616         * stress/cow-define-length-as-value.js: Added.
2617         (test):
2618
2619 2018-05-23  Michael Saboff  <msaboff@apple.com>
2620
2621         Date.parse() doesn't properly handle input outside of ES Spec limits
2622         https://bugs.webkit.org/show_bug.cgi?id=185868
2623
2624         Reviewed by Mark Lam.
2625
2626         New test.
2627
2628         * stress/date-parse-ranges.js: Added.
2629         (shouldBe):
2630         (throw.new.Error):
2631         (shouldBeNaN):
2632
2633 2018-05-23  Rick Waldron  <waldron.rick@gmail.com>
2634
2635         Conversion misspelled "Convertion" in error message string
2636         https://bugs.webkit.org/show_bug.cgi?id=185436
2637
2638         Reviewed by Saam Barati, Michael Saboff.
2639
2640         * bigIntTests.yaml:
2641
2642 2018-05-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2643
2644         Unreviewed, skip test if memoryLimited is specified
2645         https://bugs.webkit.org/show_bug.cgi?id=185888
2646
2647         * stress/regress-185888.js:
2648
2649 2018-05-22  Mark Lam  <mark.lam@apple.com>
2650
2651         BytecodeGeneratorification shouldn't add a ValueProfile if the JIT is disabled.
2652         https://bugs.webkit.org/show_bug.cgi?id=185896
2653         <rdar://problem/40471403>
2654
2655         Reviewed by Saam Barati.
2656
2657         * stress/regress-185896.js: Added.
2658
2659 2018-05-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2660
2661         [JSC] Fix CachedCall's argument count if RegExp has named captures
2662         https://bugs.webkit.org/show_bug.cgi?id=185587
2663
2664         Reviewed by Mark Lam.
2665
2666         * test262/expectations.yaml:
2667
2668 2018-05-22  Mark Lam  <mark.lam@apple.com>
2669
2670         StringImpl utf8 conversion should not fail silently.
2671         https://bugs.webkit.org/show_bug.cgi?id=185888
2672         <rdar://problem/40464506>
2673
2674         Reviewed by Filip Pizlo.
2675
2676         * stress/regress-185888.js: Added.
2677
2678 2018-05-22  Keith Miller  <keith_miller@apple.com>
2679
2680         We should have a CoW storage for NewArrayBuffer arrays.
2681         https://bugs.webkit.org/show_bug.cgi?id=185003
2682
2683         Reviewed by Filip Pizlo.
2684
2685         * stress/cow-convert-contiguous-to-array-storage.js: Added.
2686         (createBuffer):
2687         (shouldBe):
2688         (test):
2689         * stress/cow-convert-double-to-array-storage.js: Added.
2690         (createBuffer):
2691         (shouldBe):
2692         (test):
2693         * stress/cow-convert-double-to-contiguous.js: Added.
2694         (createBuffer):
2695         (shouldBe):
2696         (test):
2697         * stress/cow-convert-int32-to-array-storage.js: Added.
2698         (createBuffer):
2699         (shouldBe):
2700         (test):
2701         * stress/cow-convert-int32-to-contiguous.js: Added.
2702         (createBuffer):
2703         (shouldBe):
2704         (test):
2705         * stress/cow-convert-int32-to-double.js: Added.
2706         (createBuffer):
2707         (shouldBe):
2708         (test):
2709         * stress/put-on-cow-prototype.js: Added.
2710         (putByVal):
2711         (putById):
2712
2713 2018-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2714
2715         Unreviewed, reland InById cache
2716         https://bugs.webkit.org/show_bug.cgi?id=185682
2717
2718         * stress/in-by-id-accessors.js: Added.
2719         (shouldBe):
2720         (test):
2721         (protoGetter.__proto__.get hello):
2722         (protoSetter.__proto__.set hello):
2723         (i.shouldBe.test.get hello):
2724         (i.shouldBe.test.set hello):
2725         * stress/in-by-id-ai.js: Added.
2726         (shouldBe):
2727         (test):
2728         * stress/in-by-id-custom-accessors.js: Added.
2729         (shouldBe):
2730         (test1):
2731         (test2):
2732         * stress/in-by-id-custom-values.js: Added.
2733         (shouldBe):
2734         (test):
2735         * stress/in-by-id-operation.js: Added.
2736         (shouldBe):
2737         (test):
2738         (selfCache):
2739         * stress/in-by-id-proxy.js: Added.
2740         (shouldBe):
2741         (test):
2742         (handler.has):
2743
2744 2018-05-21  Commit Queue  <commit-queue@webkit.org>
2745
2746         Unreviewed, rolling out r231998 and r232017.
2747         https://bugs.webkit.org/show_bug.cgi?id=185842
2748
2749         causes crashes on 32 JSC bot (Requested by realdawei on
2750         #webkit).
2751
2752         Reverted changesets:
2753
2754         "[JSC] JSC should have consistent InById IC"
2755         https://bugs.webkit.org/show_bug.cgi?id=185682
2756         https://trac.webkit.org/changeset/231998
2757
2758         "Unreviewed, fix 32bit and scope release"
2759         https://bugs.webkit.org/show_bug.cgi?id=185682
2760         https://trac.webkit.org/changeset/232017
2761
2762 2018-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2763
2764         [JSC] JSC should have consistent InById IC
2765         https://bugs.webkit.org/show_bug.cgi?id=185682
2766
2767         Reviewed by Filip Pizlo.
2768
2769         * stress/in-by-id-accessors.js: Added.
2770         (shouldBe):
2771         (test):
2772         (protoGetter.__proto__.get hello):
2773         (protoSetter.__proto__.set hello):
2774         (i.shouldBe.test.get hello):
2775         (i.shouldBe.test.set hello):
2776         * stress/in-by-id-ai.js: Added.
2777         (shouldBe):
2778         (test):
2779         * stress/in-by-id-custom-accessors.js: Added.
2780         (shouldBe):
2781         (test1):
2782         (test2):
2783         * stress/in-by-id-custom-values.js: Added.
2784         (shouldBe):
2785         (test):
2786         * stress/in-by-id-operation.js: Added.
2787         (shouldBe):
2788         (test):
2789         (selfCache):
2790         * stress/in-by-id-proxy.js: Added.
2791         (shouldBe):
2792         (test):
2793         (handler.has):
2794
2795 2018-05-18  Keith Miller  <keith_miller@apple.com>
2796
2797         op_in should mark if it sees out of bounds accesses
2798         https://bugs.webkit.org/show_bug.cgi?id=185792
2799
2800         Reviewed by Filip Pizlo.
2801
2802         * stress/has-indexed-property-array-storage-ftl.js:
2803         (test2):
2804         * stress/has-indexed-property-slow-put-array-storage-ftl.js:
2805         (test2):
2806
2807 2018-05-18  Mark Lam  <mark.lam@apple.com>
2808
2809         Add missing exception check.
2810         https://bugs.webkit.org/show_bug.cgi?id=185786
2811         <rdar://problem/35686560>
2812
2813         Reviewed by Michael Saboff.
2814
2815         * stress/regress-185786.js: Added.
2816
2817 2018-05-16  Filip Pizlo  <fpizlo@apple.com>
2818
2819         JSC should have InstanceOf inline caching
2820         https://bugs.webkit.org/show_bug.cgi?id=185652
2821
2822         Reviewed by Saam Barati.
2823
2824         * microbenchmarks/instanceof-always-hit-one.js: Added.
2825         * microbenchmarks/instanceof-always-hit-two.js: Added.
2826         * microbenchmarks/instanceof-dynamic.js: Added.
2827         * microbenchmarks/instanceof-sometimes-hit.js: Added.
2828         * stress/instanceof-dynamic-proxy-check-structure.js: Added.
2829         * stress/instanceof-dynamic-proxy-loop.js: Added.
2830         * stress/instanceof-dynamic-proxy.js: Added.
2831         * stress/instanceof-hit-one-object-then-another.js: Added.
2832         * stress/instanceof-hit-two-objects-then-another.js: Added.
2833         * stress/instanceof-prototype-change.js: Added.
2834         * stress/instanceof-prototype-change-to-hit.js: Added.
2835         * stress/instanceof-prototype-change-to-null.js: Added.
2836         * stress/instanceof-prototype-change-watchpointable.js: Added.
2837
2838 2018-05-17  Michael Saboff  <msaboff@apple.com>
2839
2840         We don't throw SyntaxErrors for runtime generated regular expressions with errors
2841         https://bugs.webkit.org/show_bug.cgi?id=185755
2842
2843         Reviewed by Keith Miller.
2844
2845         New regression test.
2846
2847         * stress/regexp-with-runtime-syntax-errors.js: Added.
2848         (testThrowsSyntaxtError):
2849         (fromExecWithBadUnicodeEscape):
2850         (fromTestWithBadUnicodeProperty):
2851         (fromSplitWithBadUnicodeIdentity):
2852         (fromMatchWithBadUnicodeBackReference):
2853         (fromReplaceWithBadUnicodeEscape):
2854         (fromSearchWithBadUnicodeEscape):
2855
2856 2018-05-16  Caio Lima  <ticaiolima@gmail.com>
2857
2858         [ESNext][BigInt] Implement support for "/" operation
2859         https://bugs.webkit.org/show_bug.cgi?id=183996
2860
2861         Reviewed by Yusuke Suzuki.
2862
2863         * bigIntTests.yaml:
2864         * stress/big-int-div-jit.js: Added.
2865         * stress/big-int-div-memory-stress.js: Added.
2866         * stress/big-int-div-to-primitive-precedence.js: Added.
2867         * stress/big-int-div-to-primitive.js: Added.
2868         * stress/big-int-div-type-error.js: Added.
2869         * stress/big-int-div-wrapped-value.js: Added.
2870         * stress/big-int-division.js: Added.
2871
2872 2018-05-16  Saam Barati  <sbarati@apple.com>
2873
2874         Constant fold CheckTypeInfoFlags on ImplementsDefaultHasInstance
2875         https://bugs.webkit.org/show_bug.cgi?id=185670
2876
2877         Reviewed by Yusuke Suzuki.
2878
2879         * microbenchmarks/constant-fold-check-type-info-flags.js: Added.
2880         * stress/dont-constant-fold-check-type-info-on-bound-function.js: Added.
2881
2882 2018-05-16  Commit Queue  <commit-queue@webkit.org>
2883
2884         Unreviewed, rolling out r231845.
2885         https://bugs.webkit.org/show_bug.cgi?id=185702
2886
2887         it is breaking Apple High Sierra 32-bit JSC bot (Requested by
2888         caiolima on #webkit).
2889
2890         Reverted changeset:
2891
2892         "[ESNext][BigInt] Implement support for "/" operation"
2893         https://bugs.webkit.org/show_bug.cgi?id=183996
2894         https://trac.webkit.org/changeset/231845
2895
2896 2018-05-16  Filip Pizlo  <fpizlo@apple.com>
2897
2898         DFG models InstanceOf incorrectly
2899         https://bugs.webkit.org/show_bug.cgi?id=185694
2900
2901         Reviewed by Keith Miller.
2902
2903         * stress/instanceof-proxy-check-structure.js: Added.
2904         (Foo):
2905         (Bar):
2906         (doBadThings):
2907         (getPrototypeOf):
2908         (foo):
2909         (i.new.Bar):
2910         (new.Bar):
2911         * stress/instanceof-proxy-loop.js: Added.
2912         (Foo):
2913         (Bar):
2914         (doBadThings):
2915         (getPrototypeOf):
2916         (foo):
2917         * stress/instanceof-proxy.js: Added.
2918         (Foo):
2919         (Bar):
2920         (doBadThings):
2921         (getPrototypeOf):
2922         (foo):
2923
2924 2018-05-16  Caio Lima  <ticaiolima@gmail.com>
2925
2926         [ESNext][BigInt] Implement support for "/" operation
2927         https://bugs.webkit.org/show_bug.cgi?id=183996
2928
2929         Reviewed by Yusuke Suzuki.
2930
2931         * bigIntTests.yaml:
2932         * stress/big-int-div-jit.js: Added.
2933         * stress/big-int-div-memory-stress.js: Added.
2934         * stress/big-int-div-to-primitive-precedence.js: Added.
2935         * stress/big-int-div-to-primitive.js: Added.
2936         * stress/big-int-div-type-error.js: Added.
2937         * stress/big-int-div-wrapped-value.js: Added.
2938         * stress/big-int-division.js: Added.
2939
2940 2018-05-14  Leo Balter  <leonardo.balter@gmail.com>
2941
2942         Fix a legacy CRLF eol from Test262
2943         https://bugs.webkit.org/show_bug.cgi?id=185565
2944
2945         Reviewed by Yusuke Suzuki.
2946
2947         * test262/config.yaml:
2948         * test262/test/built-ins/Math/cbrt/prop-desc.js:
2949
2950 2018-05-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2951
2952         [JSC] timeClip(-0) should produce +0
2953         https://bugs.webkit.org/show_bug.cgi?id=185589
2954
2955         Reviewed by Saam Barati.
2956
2957         Fix several test262 failures.
2958
2959         * stress/date-negative-zero.js: Added.
2960         (shouldBe):
2961         * test262/expectations.yaml:
2962
2963 2018-05-13  Caio Lima  <ticaiolima@gmail.com>
2964
2965         [BigInt] stress/big-int-spec-to-primitive.js test is failing
2966         https://bugs.webkit.org/show_bug.cgi?id=185582
2967
2968         Reviewed by Yusuke Suzuki.
2969
2970         This patch is removing the use of ```numberOfDFGCompiles``` from
2971         stress/big-int-spec-to-primitive.js because it makes this est fail
2972         sometimes.
2973
2974         * stress/big-int-spec-to-primitive.js:
2975
2976 2018-05-13  Andy VanWagoner  <andy@vanwagoner.family>
2977
2978         [INTL] Improve spec & test262 compliance for Intl APIs
2979         https://bugs.webkit.org/show_bug.cgi?id=185578
2980
2981         Reviewed by Yusuke Suzuki.
2982
2983         Remove intl402 failures that have been fixed.
2984
2985         * test262/expectations.yaml:
2986         * stress/regress-178385.js: toStringTag is configurable, but not writable.
2987
2988 2018-05-11  Caio Lima  <ticaiolima@gmail.com>
2989
2990         [ESNext][BigInt] Implement support for "*" operation
2991         https://bugs.webkit.org/show_bug.cgi?id=183721
2992
2993         Reviewed by Yusuke Suzuki.
2994
2995         * bigIntTests.yaml:
2996         * stress/big-int-mul-jit.js: Added.
2997         * stress/big-int-mul-to-primitive-precedence.js: Added.
2998         * stress/big-int-mul-to-primitive.js: Added.
2999         * stress/big-int-mul-type-error.js: Added.
3000         * stress/big-int-mul-wrapped-value.js: Added.
3001         * stress/big-int-multiplication.js: Added.
3002         * stress/big-int-multiply-memory-stress.js: Added.
3003
3004 2018-05-11  Michael Saboff  <msaboff@apple.com>
3005
3006         [DFG] Compiler uses incorrect output register for NumberIsInteger operation
3007         https://bugs.webkit.org/show_bug.cgi?id=185328
3008
3009         Reviewed by Keith Miller.
3010
3011         New regression test.
3012
3013         * stress/isInteger-doesnt-overwrite-argument.js: Added.
3014         (testIsInteger):
3015
3016 2018-05-09  Yusuke Suzuki  <utatane.tea@gmail.com>
3017
3018         [JSC] Object.assign for final objects should be faster
3019         https://bugs.webkit.org/show_bug.cgi?id=185348
3020
3021         Reviewed by Saam Barati.
3022
3023         * stress/object-assign-fast-path.js: Added.
3024         (shouldBe):
3025         (checkProperty):
3026
3027 2018-05-10  Leo Balter  <leonardo.balter@gmail.com>
3028
3029         Update Test262 tests through the new import script - 20180509
3030         https://bugs.webkit.org/show_bug.cgi?id=185482
3031
3032         Reviewed by Michael Saboff.
3033
3034         Also update the test262/expecatations.yaml with the recent imported files.
3035
3036         * test262/expectations.yaml:
3037         * test262/harness/compareIterator.js: Added.
3038         (assert.compareIterator):
3039         * test262/harness/nativeFunctionMatcher.js:
3040         (const.assertToStringOrNativeFunction):
3041         (const.assertNativeFunction):
3042         * test262/harness/regExpUtils.js:
3043         * test262/harness/testIntl.js:
3044         (getInvalidLanguageTags):
3045         * test262/harness/testTypedArray.js:
3046         * test262/harness/wellKnownIntrinsicObjects.js: Added.
3047         (WellKnownIntrinsicObjects.forEach.wkio.catch):
3048         * test262/latest-changes-summary.txt: Added.
3049         * test262/test/annexB/language/eval-code/direct/block-decl-nostrict.js: Copied from JSTests/test262/test/language/eval-code/direct/block-decl-strict-caller.js.
3050         (catch):
3051         * test262/test/annexB/language/eval-code/direct/switch-case-decl-nostrict.js: Copied from JSTests/test262/test/language/eval-code/direct/switch-case-decl-strict-source.js.
3052         (catch):
3053         * test262/test/annexB/language/eval-code/direct/switch-dflt-decl-nostrict.js: Copied from JSTests/test262/test/language/eval-code/direct/switch-dflt-decl-strict-caller.js.
3054         (catch):
3055         * test262/test/annexB/language/function-code/block-decl-nested-blocks-with-fun-decl.js: Added.
3056         (g.f):
3057         (g):
3058         * test262/test/annexB/language/function-code/block-decl-nostrict.js: Copied from JSTests/test262/test/language/function-code/block-decl-strict.js.
3059         (catch):
3060         (f):
3061         * test262/test/annexB/language/function-code/switch-case-decl-nostrict.js: Copied from JSTests/test262/test/language/function-code/switch-case-decl-strict.js.
3062         (catch):
3063         (switch.case.1):
3064         (switch):
3065         * test262/test/annexB/language/function-code/switch-dflt-decl-nostrict.js: Copied from JSTests/test262/test/language/function-code/switch-dflt-decl-strict.js.
3066         (catch):
3067         (switch.default):
3068         (switch):
3069         * test262/test/built-ins/Array/prototype/filter/target-array-with-non-writable-property.js: Added.
3070         (a.Symbol.species):
3071         (r.a.filter):
3072         * test262/test/built-ins/Array/prototype/indexOf/calls-only-has-on-prototype-after-length-zeroed.js: Added.
3073         (allowProxyTraps.has):
3074         (fromIndex.valueOf):
3075         * test262/test/built-ins/Array/prototype/lastIndexOf/calls-only-has-on-prototype-after-length-zeroed.js: Added.
3076         (allowProxyTraps.has):
3077         (fromIndex.valueOf):
3078         * test262/test/built-ins/Array/prototype/map/target-array-with-non-writable-property.js: Added.
3079         (a.Symbol.species):
3080         (r.a.map):
3081         * test262/test/built-ins/Array/prototype/slice/target-array-with-non-writable-property.js: Added.
3082         (a.Symbol.species):
3083         * test262/test/built-ins/Array/prototype/splice/property-traps-order-with-species.js: Added.
3084         (a.Symbol.species):
3085         * test262/test/built-ins/Array/prototype/splice/target-array-with-non-writable-property.js: Added.
3086         (a.Symbol.species):
3087         * test262/test/built-ins/Atomics/Symbol.toStringTag.js:
3088         * test262/test/built-ins/Atomics/add/bad-range.js:
3089         (testWithTypedArrayConstructors):
3090         * test262/test/built-ins/Atomics/add/good-views.js:
3091         (testWithTypedArrayConstructors):
3092         * test262/test/built-ins/Atomics/add/non-views.js:
3093         * test262/test/built-ins/Atomics/add/nonshared-int-views.js:
3094         (testWithTypedArrayConstructors):
3095         * test262/test/built-ins/Atomics/add/shared-nonint-views.js:
3096         (testWithTypedArrayConstructors):
3097         * test262/test/built-ins/Atomics/and/bad-range.js:
3098         (testWithTypedArrayConstructors):
3099         * test262/test/built-ins/Atomics/and/good-views.js:
3100         (testWithTypedArrayConstructors):
3101         * test262/test/built-ins/Atomics/and/non-views.js:
3102         * test262/test/built-ins/Atomics/and/nonshared-int-views.js:
3103         (testWithTypedArrayConstructors):
3104         * test262/test/built-ins/Atomics/and/shared-nonint-views.js:
3105         (testWithTypedArrayConstructors):
3106         * test262/test/built-ins/Atomics/compareExchange/bad-range.js:
3107         (testWithTypedArrayConstructors):
3108         * test262/test/built-ins/Atomics/compareExchange/good-views.js:
3109         (testWithTypedArrayConstructors):
3110         (view): Deleted.
3111         * test262/test/built-ins/Atomics/compareExchange/non-views.js:
3112         * test262/test/built-ins/Atomics/compareExchange/nonshared-int-views.js:
3113         (testWithTypedArrayConstructors):
3114         * test262/test/built-ins/Atomics/compareExchange/shared-nonint-views.js:
3115         (testWithTypedArrayConstructors):
3116         * test262/test/built-ins/Atomics/exchange/bad-range.js:
3117         (testWithTypedArrayConstructors):
3118         * test262/test/built-ins/Atomics/exchange/good-views.js:
3119         (testWithTypedArrayConstructors):
3120         * test262/test/built-ins/Atomics/exchange/non-views.js:
3121         * test262/test/built-ins/Atomics/exchange/nonshared-int-views.js:
3122         (testWithTypedArrayConstructors):
3123         * test262/test/built-ins/Atomics/exchange/shared-nonint-views.js:
3124         (testWithTypedArrayConstructors):
3125         * test262/test/built-ins/Atomics/isLockFree/corner-cases.js:
3126         (hide):
3127         * test262/test/built-ins/Atomics/isLockFree/value.js:
3128         (testIsLockFree): Deleted.
3129         * test262/test/built-ins/Atomics/load/bad-range.js:
3130         (testWithTypedArrayConstructors):
3131         * test262/test/built-ins/Atomics/load/good-views.js:
3132         (testWithTypedArrayConstructors):
3133         * test262/test/built-ins/Atomics/load/non-views.js:
3134         * test262/test/built-ins/Atomics/load/nonshared-int-views.js:
3135         (testWithTypedArrayConstructors):
3136         * test262/test/built-ins/Atomics/load/shared-nonint-views.js:
3137         (testWithTypedArrayConstructors):
3138         * test262/test/built-ins/Atomics/or/bad-range.js:
3139         (testWithTypedArrayConstructors):
3140         * test262/test/built-ins/Atomics/or/good-views.js:
3141         (testWithTypedArrayConstructors):
3142         * test262/test/built-ins/Atomics/or/non-views.js:
3143         * test262/test/built-ins/Atomics/or/nonshared-int-views.js:
3144         (testWithTypedArrayConstructors):
3145         * test262/test/built-ins/Atomics/or/shared-nonint-views.js:
3146         (testWithTypedArrayConstructors):
3147         * test262/test/built-ins/Atomics/prop-desc.js:
3148         * test262/test/built-ins/Atomics/proto.js:
3149         * test262/test/built-ins/Atomics/store/bad-range.js:
3150         (testWithTypedArrayConstructors):
3151         * test262/test/built-ins/Atomics/store/good-views.js:
3152         (testWithTypedArrayConstructors):
3153         (ToInteger):
3154         * test262/test/built-ins/Atomics/store/non-views.js:
3155         * test262/test/built-ins/Atomics/store/nonshared-int-views.js:
3156         (testWithTypedArrayConstructors):
3157         * test262/test/built-ins/Atomics/store/shared-nonint-views.js:
3158         (testWithTypedArrayConstructors):
3159         * test262/test/built-ins/Atomics/sub/bad-range.js:
3160         (testWithTypedArrayConstructors):
3161         * test262/test/built-ins/Atomics/sub/good-views.js:
3162         (testWithTypedArrayConstructors):
3163         * test262/test/built-ins/Atomics/sub/non-views.js:
3164         * test262/test/built-ins/Atomics/sub/nonshared-int-views.js:
3165         (testWithTypedArrayConstructors):
3166         * test262/test/built-ins/Atomics/sub/shared-nonint-views.js:
3167         (testWithTypedArrayConstructors):
3168         * test262/test/built-ins/Atomics/wait/bad-range.js: Copied from JSTests/test262/test/built-ins/Atomics/wake/bad-range.js.
3169         (testWithTypedArrayConstructors):
3170         * test262/test/built-ins/Atomics/wait/cannot-suspend-throws.js:
3171         * test262/test/built-ins/Atomics/wait/did-timeout.js:
3172         (getReport):
3173         * test262/test/built-ins/Atomics/wait/false-for-timeout-agent.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/false-for-timeout.js.
3174         (getReport):
3175         (262.agent.start.valueOf.valueOf):
3176         (toPrimitive.Symbol.toPrimitive):
3177         (262.agent.receiveBroadcast):
3178         * test262/test/built-ins/Atomics/wait/false-for-timeout.js:
3179         (valueOf.valueOf):
3180         (toPrimitive.Symbol.toPrimitive):
3181         (getReport): Deleted.
3182         (262.agent.start.262.agent.receiveBroadcast): Deleted.
3183         * test262/test/built-ins/Atomics/wait/good-views.js:
3184         (r.getReport):
3185         (getReport):
3186         * test262/test/built-ins/Atomics/wait/nan-for-timeout.js:
3187         (getReport):
3188         * test262/test/built-ins/Atomics/wait/negative-index-throws.js:
3189         * test262/test/built-ins/Atomics/wait/negative-timeout-agent.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/negative-timeout.js.
3190         (getReport):
3191         (262.agent.start.262.agent.receiveBroadcast):
3192         * test262/test/built-ins/Atomics/wait/negative-timeout.js:
3193         (262.agent.start.262.agent.receiveBroadcast): Deleted.
3194         (getReport): Deleted.
3195         * test262/test/built-ins/Atomics/wait/no-spurious-wakeup.js:
3196         (getReport):
3197         * test262/test/built-ins/Atomics/wait/non-int32-typedarray-throws.js:
3198         * test262/test/built-ins/Atomics/wait/non-shared-bufferdata-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/nonshared-bufferdata-throws.js.
3199         * test262/test/built-ins/Atomics/wait/not-a-typedarray-throws.js:
3200         * test262/test/built-ins/Atomics/wait/not-an-object-throws.js:
3201         * test262/test/built-ins/Atomics/wait/null-bufferdata-throws.js:
3202         * test262/test/built-ins/Atomics/wait/null-for-timeout-agent.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/false-for-timeout.js.
3203         (getReport):
3204         (262.agent.start.valueOf.valueOf):
3205         (toPrimitive.Symbol.toPrimitive):
3206         (262.agent.receiveBroadcast):
3207         * test262/test/built-ins/Atomics/wait/null-for-timeout.js:
3208         (valueOf.valueOf):
3209         (toPrimitive.Symbol.toPrimitive):
3210         (getReport): Deleted.
3211         (262.agent.start.262.agent.receiveBroadcast): Deleted.
3212         * test262/test/built-ins/Atomics/wait/object-for-timeout-agent.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/false-for-timeout.js.
3213         (getReport):
3214         (262.agent.start.valueOf.valueOf):
3215         (toString.toString):
3216         (toPrimitive.Symbol.toPrimitive):
3217         (262.agent.receiveBroadcast):
3218         * test262/test/built-ins/Atomics/wait/object-for-timeout.js:
3219         (valueOf.valueOf):
3220         (toString.toString):
3221         (toPrimitive.Symbol.toPrimitive):
3222         (getReport): Deleted.
3223         (262.agent.start.262.agent.receiveBroadcast): Deleted.
3224         * test262/test/built-ins/Atomics/wait/out-of-range-index-throws.js:
3225         * test262/test/built-ins/Atomics/wait/poisoned-object-for-timeout-throws-agent.js: Added.
3226         (getReport):
3227         (262.agent.start.poisonedValueOf.valueOf):
3228         (poisonedToPrimitive.Symbol.toPrimitive):
3229         (262.agent.receiveBroadcast):
3230         * test262/test/built-ins/Atomics/wait/poisoned-object-for-timeout-throws.js:
3231         (poisonedValueOf.valueOf):
3232         (poisonedToPrimitive.Symbol.toPrimitive):
3233         (getReport): Deleted.
3234         (262.agent.start.262.agent.receiveBroadcast): Deleted.
3235         * test262/test/built-ins/Atomics/wait/symbol-for-index-throws-agent.js: Added.
3236         (getReport):
3237         (262.agent.start.poisonedValueOf.valueOf):
3238         (poisonedToPrimitive.Symbol.toPrimitive):
3239         (262.agent.receiveBroadcast):
3240         * test262/test/built-ins/Atomics/wait/symbol-for-index-throws.js:
3241         (poisonedToPrimitive.Symbol.toPrimitive):
3242         (poisoned.valueOf): Deleted.
3243         (poisonedWithString.get valueOf): Deleted.
3244         (poisonedToPrimitive.get Symbol): Deleted.
3245         * test262/test/built-ins/Atomics/wait/symbol-for-timeout-throws-agent.js: Added.
3246         (getReport):
3247         (262.agent.start.262.agent.receiveBroadcast):
3248         * test262/test/built-ins/Atomics/wait/symbol-for-timeout-throws.js:
3249         (poisonedValueOf.valueOf):
3250         (poisonedToPrimitive.Symbol.toPrimitive):
3251         (getReport): Deleted.
3252         (262.agent.start.262.agent.receiveBroadcast): Deleted.
3253         * test262/test/built-ins/Atomics/wait/symbol-for-value-throws-agent.js: Added.
3254         (getReport):
3255         (262.agent.start.poisonedValueOf.valueOf):
3256         (poisonedToPrimitive.Symbol.toPrimitive):
3257         (262.agent.receiveBroadcast):
3258         * test262/test/built-ins/Atomics/wait/symbol-for-value-throws.js: Added.
3259         (poisonedValueOf.valueOf):
3260         (poisonedToPrimitive.Symbol.toPrimitive):
3261         * test262/test/built-ins/Atomics/wait/true-for-timeout-agent.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/null-for-timeout.js.
3262         (getReport):
3263         (262.agent.start.valueOf.valueOf):
3264         (toPrimitive.Symbol.toPrimitive):
3265         (262.agent.receiveBroadcast):
3266         * test262/test/built-ins/Atomics/wait/true-for-timeout.js:
3267         (valueOf.valueOf):
3268         (toPrimitive.Symbol.toPrimitive):
3269         (getReport): Deleted.
3270         (262.agent.start.262.agent.receiveBroadcast): Deleted.
3271         * test262/test/built-ins/Atomics/wait/undefined-for-timeout.js:
3272         (getReport):
3273         * test262/test/built-ins/Atomics/wait/undefined-index-defaults-to-zero.js:
3274         (262.agent.start.262.agent.receiveBroadcast):
3275         (getReport):
3276         * test262/test/built-ins/Atomics/wait/value-not-equal.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/wait-index-value-not-equal.js.
3277         (getReport):
3278         (262.agent.start.262.agent.receiveBroadcast):
3279         * test262/test/built-ins/Atomics/wait/wait-index-value-not-equal.js:
3280         (262.agent.start.262.agent.receiveBroadcast):
3281         * test262/test/built-ins/Atomics/wait/waiterlist-block-indexedposition-wake.js: Added.
3282         (getReport):
3283         (262.agent.start.262.agent.receiveBroadcast):
3284         * test262/test/built-ins/Atomics/wait/waiterlist-order-of-operations-is-fifo.js: Added.
3285         (getReport):
3286         (262.agent.start.262.agent.receiveBroadcast):
3287         * test262/test/built-ins/Atomics/wait/was-woken-before-timeout.js:
3288         (getReport):
3289         (262.agent.start.262.agent.receiveBroadcast):
3290         * test262/test/built-ins/Atomics/wait/was-woken.js:
3291         (getReport):
3292         (262.agent.start.262.agent.receiveBroadcast):
3293         * test262/test/built-ins/Atomics/wake/bad-range.js:
3294         (testWithTypedArrayConstructors):
3295         * test262/test/built-ins/Atomics/wake/count-boundary-cases.js: Renamed from JSTests/test262/test/built-ins/Atomics/wake/counts.js.
3296         * test262/test/built-ins/Atomics/wake/count-defaults-to-infinity-missing.js: Added.
3297         (getReport):
3298         (262.agent.start.262.agent.receiveBroadcast):
3299         * test262/test/built-ins/Atomics/wake/count-defaults-to-infinity-undefined.js: Added.
3300         (getReport):
3301         (262.agent.start.262.agent.receiveBroadcast):
3302         * test262/test/built-ins/Atomics/wake/count-from-nans.js: Added.
3303         * test262/test/built-ins/Atomics/wake/count-symbol-throws.js: Added.
3304         * test262/test/built-ins/Atomics/wake/count-tointeger-throws-then-wake-throws.js: Added.
3305         (poisoned.valueOf):
3306         * test262/test/built-ins/Atomics/wake/good-views.js:
3307         * test262/test/built-ins/Atomics/wake/negative-count.js: Renamed from JSTests/test262/test/built-ins/Atomics/wake/wake-negative.js.
3308         * test262/test/built-ins/Atomics/wake/negative-index-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/negative-index-throws.js.
3309         (poisoned.valueOf):
3310         * test262/test/built-ins/Atomics/wake/non-int32-typedarray-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/non-int32-typedarray-throws.js.
3311         (poisoned.valueOf):
3312         * test262/test/built-ins/Atomics/wake/non-shared-bufferdata-throws.js: Renamed from JSTests/test262/test/built-ins/Atomics/wait/nonshared-bufferdata-throws.js.
3313         (poisoned.valueOf):
3314         * test262/test/built-ins/Atomics/wake/non-views.js:
3315         * test262/test/built-ins/Atomics/wake/nonshared-int-views.js:
3316         (testWithTypedArrayConstructors):
3317         * test262/test/built-ins/Atomics/wake/not-a-typedarray-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/not-a-typedarray-throws.js.
3318         (poisoned.valueOf):
3319         * test262/test/built-ins/Atomics/wake/not-an-object-throws.js: Added.
3320         (poisoned.valueOf):
3321         * test262/test/built-ins/Atomics/wake/null-bufferdata-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/null-bufferdata-throws.js.
3322         (poisoned.valueOf):
3323         * test262/test/built-ins/Atomics/wake/out-of-range-index-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/out-of-range-index-throws.js.
3324         (poisoned.valueOf):
3325         * test262/test/built-ins/Atomics/wake/shared-nonint-views.js:
3326         (testWithTypedArrayConstructors):
3327         * test262/test/built-ins/Atomics/wake/symbol-for-index-throws.js: Added.
3328         (poisonedValueOf.valueOf):
3329         (poisonedToPrimitive.Symbol.toPrimitive):
3330         * test262/test/built-ins/Atomics/wake/undefined-index-defaults-to-zero.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/undefined-index-defaults-to-zero.js.
3331         (262.agent.start.262.agent.receiveBroadcast):
3332         (getReport):
3333         * test262/test/built-ins/Atomics/wake/wake-all-on-loc.js:
3334         (262.agent.start.262.agent.receiveBroadcast):
3335         (getReport):
3336         (waitUntil):
3337         * test262/test/built-ins/Atomics/wake/wake-all.js:
3338         (262.agent.start.262.agent.receiveBroadcast):
3339         (getReport):
3340         (waitUntil):
3341         * test262/test/built-ins/Atomics/wake/wake-in-order.js:
3342         (getReport):
3343         (waitUntil):
3344         * test262/test/built-ins/Atomics/wake/wake-nan.js:
3345         (getReport):
3346         * test262/test/built-ins/Atomics/wake/wake-one.js:
3347         (getReport):
3348         (waitUntil):
3349         * test262/test/built-ins/Atomics/wake/wake-rewake-noop.js: Added.
3350         (getReport):
3351         (waitUntil):
3352         (262.agent.start.262.agent.receiveBroadcast):
3353         * test262/test/built-ins/Atomics/wake/wake-two.js:
3354         (getReport):
3355         * test262/test/built-ins/Atomics/wake/wake-with-no-agents-waiting.js: Added.
3356         (262.agent.start.262.agent.receiveBroadcast):
3357         (waitUntil):
3358         * test262/test/built-ins/Atomics/wake/wake-with-no-matching-agents-waiting.js: Added.
3359         (262.agent.start.262.agent.receiveBroadcast):
3360         (waitUntil):
3361         * test262/test/built-ins/Atomics/wake/wake-zero.js:
3362         (i.262.agent.start.262.agent.receiveBroadcast):
3363         (getReport):
3364         (waitUntil):
3365         * test262/test/built-ins/Atomics/xor/bad-range.js:
3366         (testWithTypedArrayConstructors):
3367         * test262/test/built-ins/Atomics/xor/good-views.js:
3368         (testWithTypedArrayConstructors):
3369         * test262/test/built-ins/Atomics/xor/non-views.js:
3370         * test262/test/built-ins/Atomics/xor/nonshared-int-views.js:
3371         (testWithTypedArrayConstructors):
3372         * test262/test/built-ins/Atomics/xor/shared-nonint-views.js:
3373         (testWithTypedArrayConstructors):
3374         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint-errors.js:
3375         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint-toprimitive.js:
3376         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint-wrapped-values.js:
3377         * test262/test/built-ins/BigInt/asIntN/bits-toindex-errors.js:
3378         * test262/test/built-ins/BigInt/asIntN/bits-toindex-toprimitive.js:
3379         * test262/test/built-ins/BigInt/asIntN/bits-toindex-wrapped-values.js:
3380         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint-errors.js:
3381         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint-toprimitive.js:
3382         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint-wrapped-values.js:
3383         * test262/test/built-ins/BigInt/asUintN/bits-toindex-errors.js:
3384         * test262/test/built-ins/BigInt/asUintN/bits-toindex-toprimitive.js:
3385         * test262/test/built-ins/BigInt/asUintN/bits-toindex-wrapped-values.js:
3386         * test262/test/built-ins/BigInt/constructor-empty-string.js:
3387         * test262/test/built-ins/BigInt/constructor-from-binary-string.js:
3388         * test262/test/built-ins/BigInt/constructor-from-decimal-string.js:
3389         * test262/test/built-ins/BigInt/constructor-from-hex-string.js:
3390         * test262/test/built-ins/BigInt/constructor-from-octal-string.js:
3391         * test262/test/built-ins/BigInt/constructor-from-string-syntax-errors.js:
3392         * test262/test/built-ins/BigInt/constructor-integer.js: Added.
3393         * test262/test/built-ins/BigInt/constructor-trailing-leading-spaces.js:
3394         * test262/test/built-ins/BigInt/issafeinteger-true.js: Removed.
3395         * test262/test/built-ins/BigInt/out-of-bounds-integer-rangeerror.js: Removed.
3396         * test262/test/built-ins/BigInt/prototype/Symbol.toStringTag.js:
3397         * test262/test/built-ins/BigInt/prototype/toString/default-radix.js: Added.
3398         * test262/test/built-ins/BigInt/prototype/toString/thisbigintvalue-not-valid-throws.js:
3399         * test262/test/built-ins/BigInt/prototype/valueOf/cross-realm.js: Added.
3400         * test262/test/built-ins/BigInt/tostring-throws.js: Copied from JSTests/test262/test/built-ins/BigInt/value-of-throws.js.
3401         * test262/test/built-ins/BigInt/valueof-throws.js: Renamed from JSTests/test262/test/built-ins/BigInt/value-of-throws.js.
3402         (BigInt.valueOf):
3403         * test262/test/built-ins/DataView/prototype/setBigInt64/set-values-return-undefined.js:
3404         (values.forEach):
3405         * test262/test/built-ins/Function/prototype/bind/length-exceeds-int32.js: Added.
3406         (f):
3407         * test262/test/built-ins/Function/prototype/toString/anonymous-intrinsics.js: Removed.
3408         * test262/test/built-ins/Function/prototype/toString/bound-function.js:
3409         (assertNativeFunction):
3410         (let.f): Deleted.
3411         * test262/test/built-ins/Function/prototype/toString/built-in-function-object.js: Added.
3412         * test262/test/built-ins/Function/prototype/toString/intrinsics.js: Removed.
3413         * test262/test/built-ins/Function/prototype/toString/proxy-arrow-function.js: Added.
3414         (assertNativeFunction.new.Proxy):
3415         * test262/test/built-ins/Function/prototype/toString/proxy-async-function.js: Added.
3416         (assertNativeFunction.new.Proxy.async):
3417         * test262/test/built-ins/Function/prototype/toString/proxy-async-generator-function.js: Added.
3418         (assertNativeFunction.new.Proxy.async):
3419         * test262/test/built-ins/Function/prototype/toString/proxy-async-generator-method-definition.js: Added.
3420         (assertNativeFunction.new.Proxy.async.method):
3421         (apply):
3422         * test262/test/built-ins/Function/prototype/toString/proxy-async-method-definition.js: Added.
3423         (assertNativeFunction.new.Proxy.async.method):
3424         (apply):
3425         * test262/test/built-ins/Function/prototype/toString/proxy-bound-function.js: Added.
3426         (assertNativeFunction.new.Proxy):
3427         (bind):
3428         * test262/test/built-ins/Function/prototype/toString/proxy-class.js: Added.
3429         (assertNativeFunction):
3430         * test262/test/built-ins/Function/prototype/toString/proxy-function-expression.js: Added.
3431         (assertNativeFunction.new.Proxy):
3432         * test262/test/built-ins/Function/prototype/toString/proxy-generator-function.js: Added.
3433         (assertNativeFunction.new.Proxy):
3434         * test262/test/built-ins/Function/prototype/toString/proxy-method-definition.js: Added.
3435         (assertNativeFunction.new.Proxy.method):
3436         (apply):
3437         * test262/test/built-ins/Function/prototype/toString/proxy-non-callable-throws.js: Added.
3438         * test262/test/built-ins/Function/prototype/toString/proxy.js: Removed.
3439         * test262/test/built-ins/Function/prototype/toString/well-known-intrinsic-object-functions.js: Added.
3440         (WellKnownIntrinsicObjects.forEach):
3441         * test262/test/built-ins/JSON/prop-desc.js: Added.
3442         * test262/test/built-ins/Math/acosh/nan-returns.js:
3443         * test262/test/built-ins/Math/asinh/asinh-specialVals.js:
3444         * test262/test/built-ins/Math/atanh/atanh-specialVals.js:
3445         * test262/test/built-ins/Math/cbrt/cbrt-specialValues.js:
3446         * test262/test/built-ins/Math/cbrt/prop-desc.js:
3447         * test262/test/built-ins/Math/cosh/cosh-specialVals.js:
3448         * test262/test/built-ins/Math/expm1/expm1-specialVals.js:
3449         * test262/test/built-ins/Math/log10/Log10-specialVals.js:
3450         * test262/test/built-ins/Math/log2/log2-basicTests.js:
3451         * test262/test/built-ins/Math/prop-desc.js:
3452         * test262/test/built-ins/Math/sign/sign-specialVals.js:
3453         * test262/test/built-ins/Math/sinh/sinh-specialVals.js:
3454         * test262/test/built-ins/Math/tanh/tanh-specialVals.js:
3455         * test262/test/built-ins/Math/trunc/trunc-sampleTests.js:
3456         * test262/test/built-ins/Math/trunc/trunc-specialVals.js:
3457         * test262/test/built-ins/Object/assign/strings-and-symbol-order.js: Added.
3458         * test262/test/built-ins/Object/keys/property-traps-order-with-proxied-array.js: Added.
3459         (get t):
3460         * test262/test/built-ins/Reflect/Reflect.js: Removed.
3461         * test262/test/built-ins/Reflect/prop-desc.js: Added.
3462         * test262/test/built-ins/Reflect/properties.js: Removed.
3463         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/internal-regexp-lastindex-not-zero.js: Added.
3464         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/isregexp-internal-regexp-is-false.js: Added.
3465         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/isregexp-internal-regexp-throws.js: Added.
3466         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/isregexp-this-throws.js: Added.
3467         (obj.get Symbol):
3468         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/length.js: Added.
3469         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/name.js: Added.
3470         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/prop-desc.js: Added.
3471         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/regexpcreate-this-throws.js: Added.
3472         (obj.toString):
3473         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-get-constructor-throws.js: Added.
3474         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-get-species-throws.js: Added.
3475         (regexp.get Symbol):
3476         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-is-not-object-throws.js: Added.
3477         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-is-undefined.js: Added.
3478         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-species-is-not-constructor.js: Added.
3479         (callMatchAll):
3480         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-species-is-null-or-undefined.js: Added.
3481         (TestWithConstructor):
3482         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-species-throws.js: Added.
3483         (regexp.Symbol.species):
3484         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor.js: Added.
3485         (regexp.Symbol.species):
3486         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-regexp-get-global-throws.js: Added.
3487         (regexp.Symbol.species):
3488         (get assert):
3489         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-regexp-get-unicode-throws.js: Added.
3490         (regexp.Symbol.species):
3491         (get assert):
3492         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/string-tostring-throws.js: Added.
3493         (obj.valueOf):
3494         (obj.toString):
3495         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/string-tostring.js: Added.
3496         (obj.toString):
3497         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-get-flags-throws.js: Added.
3498         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-get-flags.js: Added.
3499         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-lastindex-cached.js: Added.
3500         (regexp.lastIndex.valueOf):
3501         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-not-object-throws.js: Added.
3502         (callMatchAll):
3503         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-tolength-lastindex-throws.js: Added.
3504         (regexp.lastIndex.valueOf):
3505         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-tostring-flags-throws.js: Added.
3506         (value.valueOf):
3507         (value.toString):
3508         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-tostring-flags.js: Added.
3509         (value.toString):
3510         * test262/test/built-ins/RegExpStringIteratorPrototype/Symbol.toStringTag.js: Added.
3511         * test262/test/built-ins/RegExpStringIteratorPrototype/ancestry.js: Added.
3512         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-call-throws.js: Added.
3513         (RegExp.prototype.exec):
3514         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-get-throws.js: Added.
3515         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-match-get-0-throws.js: Added.
3516         (return.get string_appeared_here):
3517         (RegExp.prototype.exec):
3518         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-match-get-0-tostring-throws.js: Added.
3519         (return.toString):
3520         (RegExp.prototype.exec):
3521         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-match-get-0-tostring.js: Added.
3522         (execResult.get string_appeared_here):
3523         (RegExp.prototype.exec):
3524         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-not-callable.js: Added.
3525         (TestWithRegExpExec):
3526         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec.js: Added.
3527         (callNextWithExecReturnValue.RegExp.prototype.exec):
3528         (callNextWithExecReturnValue):
3529         * test262/test/built-ins/RegExpStringIteratorPrototype/next/length.js: Added.
3530         * test262/test/built-ins/RegExpStringIteratorPrototype/next/name.js: Added.
3531         * test262/test/built-ins/RegExpStringIteratorPrototype/next/next-iteration-global.js: Added.
3532         * test262/test/built-ins/RegExpStringIteratorPrototype/next/next-iteration.js: Added.
3533         * test262/test/built-ins/RegExpStringIteratorPrototype/next/next-missing-internal-slots.js: Added.
3534         * test262/test/built-ins/RegExpStringIteratorPrototype/next/prop-desc.js: Added.
3535         * test262/test/built-ins/RegExpStringIteratorPrototype/next/regexp-tolength-lastindex-throws.js: Added.
3536         (RegExp.prototype.exec):
3537         * test262/test/built-ins/RegExpStringIteratorPrototype/next/this-is-not-object-throws.js: Added.
3538         (callNext):
3539         * test262/test/built-ins/String/prototype/matchAll/length.js: Added.
3540         * test262/test/built-ins/String/prototype/matchAll/name.js: Added.
3541         * test262/test/built-ins/String/prototype/matchAll/prop-desc.js: Added.
3542         * test262/test/built-ins/String/prototype/matchAll/regexp-get-matchAll-throws.js: Added.
3543         * test262/test/built-ins/String/prototype/matchAll/regexp-is-null.js: Added.
3544         * test262/test/built-ins/String/prototype/matchAll/regexp-is-undefined.js: Added.
3545         * test262/test/built-ins/String/prototype/matchAll/regexp-matchAll-invocation.js: Added.
3546         (obj.Symbol.matchAll):
3547         * test262/test/built-ins/String/prototype/matchAll/regexp-matchAll-throws.js: Added.
3548         (regexp.Symbol.matchAll):
3549         * test262/test/built-ins/String/prototype/matchAll/regexp-prototype-get-matchAll-throws.js: Added.
3550         * test262/test/built-ins/String/prototype/matchAll/regexp-prototype-has-no-matchAll.js: Added.
3551         * test262/test/built-ins/String/prototype/matchAll/regexp-prototype-matchAll-invocation.js: Added.
3552         (RegExp.prototype.Symbol.matchAll):
3553         * test262/test/built-ins/String/prototype/matchAll/regexp-prototype-matchAll-throws.js: Added.
3554         (RegExp.prototype.Symbol.matchAll):
3555         * test262/test/built-ins/String/prototype/matchAll/this-val-non-obj-coercible.js: Added.
3556         * test262/test/built-ins/Symbol/matchAll/cross-realm.js: Added.
3557         * test262/test/built-ins/Symbol/matchAll/prop-desc.js: Added.
3558         * test262/test/harness/testTypedArray.js:
3559         * test262/test/intl402/Array/prototype/toLocaleString/calls-toLocaleString-number-elements.js: Added.
3560         * test262/test/intl402/Intl/getCanonicalLocales/invalid-tags.js:
3561         * test262/test/intl402/Locale/constructor-newtarget-undefined.js: Added.
3562         * test262/test/intl402/Locale/constructor-options-calendar-invalid.js: Added.
3563         (const.invalidCalendarOption.of.invalidCalendarOptions.new.Intl.Locale):
3564         * test262/test/intl402/Locale/constructor-options-calendar-valid.js: Added.
3565         * test262/test/intl402/Locale/constructor-options-language-invalid.js: Added.
3566         (const.invalidLanguageOption.of.invalidLanguageOptions.new.Intl.Locale):
3567         * test262/test/intl402/Locale/constructor-options-language-valid.js: Added.
3568         (toString):
3569         * test262/test/intl402/Locale/constructor-options-region-invalid.js: Added.
3570         (const.invalidRegionOption.of.invalidRegionOptions.new.Intl.Locale):
3571         * test262/test/intl402/Locale/constructor-options-region-valid.js: Added.
3572         * test262/test/intl402/Locale/constructor-options-script-invalid.js: Added.
3573         (const.invalidScriptOption.of.invalidScriptOptions.new.Intl.Locale):
3574         * test262/test/intl402/Locale/constructor-options-script-valid.js: Added.
3575         (toString):
3576         * test262/test/intl402/Locale/function-prototype.js: Added.
3577         * test262/test/intl402/Locale/instance-extensibility.js: Added.
3578         * test262/test/intl402/Locale/instance.js: Added.
3579         * test262/test/intl402/Locale/invalid-tag-throws-boolean.js: Added.
3580         * test262/test/intl402/Locale/invalid-tag-throws-null.js: Added.
3581         * test262/test/intl402/Locale/invalid-tag-throws-number.js: Added.
3582         * test262/test/intl402/Locale/invalid-tag-throws-symbol.js: Added.
3583         * test262/test/intl402/Locale/invalid-tag-throws-undefined.js: Added.
3584         * test262/test/intl402/Locale/invalid-tag-throws.js: Added.
3585         (const.invalidTag.of.getInvalidLanguageTags):
3586         * test262/test/intl402/Locale/length.js: Added.
3587         * test262/test/intl402/Locale/name.js: Added.
3588         * test262/test/intl402/Locale/prop-desc.js: Added.
3589         * test262/test/intl402/Locale/prototype/constructor.js: Added.
3590         * test262/test/intl402/Locale/prototype/maximize/length.js: Added.
3591         * test262/test/intl402/Locale/prototype/maximize/name.js: Added.
3592         * test262/test/intl402/Locale/prototype/maximize/prop-desc.js: Added.
3593         * test262/test/intl402/Locale/prototype/prop-desc.js: Added.
3594         * test262/test/intl402/Locale/prototype/toStringTag.js: Added.
3595         * test262/test/intl402/TypedArray/prototype/toLocaleString/calls-toLocaleString-number-elements.js: Added.
3596         (testWithTypedArrayConstructors):
3597         * test262/test/language/asi/S7.9_A11_T8.js:
3598         (else.x.1): Deleted.
3599         * test262/test/language/asi/S7.9_A4.js:
3600         (catch):
3601         * test262/test/language/asi/S7.9_A5.1_T1.js:
3602         * test262/test/language/asi/S7.9_A5.3_T1.js:
3603         * test262/test/language/block-scope/syntax/redeclaration/function-declaration-attempt-to-redeclare-with-var-declaration-nested-in-function.js: Added.
3604         (g.f):
3605         (g):
3606         * test262/test/language/destructuring/binding/initialization-requires-object-coercible-null.js:
3607         * test262/test/language/destructuring/binding/initialization-requires-object-coercible-undefined.js:
3608         * test262/test/language/destructuring/binding/initialization-returns-normal-completion-for-empty-objects.js:
3609         * test262/test/language/destructuring/binding/syntax/array-elements-with-initializer.js:
3610         * test262/test/language/destructuring/binding/syntax/array-elements-with-object-patterns.js:
3611         * test262/test/language/destructuring/binding/syntax/array-elements-without-initializer.js:
3612         * test262/test/language/destructuring/binding/syntax/array-pattern-with-elisions.js:
3613         * test262/test/language/destructuring/binding/syntax/array-pattern-with-no-elements.js:
3614         * test262/test/language/destructuring/binding/syntax/array-rest-elements.js:
3615         * test262/test/language/destructuring/binding/syntax/object-pattern-with-no-property-list.js:
3616         * test262/test/language/destructuring/binding/syntax/property-list-bindings-elements.js:
3617         * test262/test/language/destructuring/binding/syntax/property-list-followed-by-a-single-comma.js:
3618         * test262/test/language/destructuring/binding/syntax/property-list-single-name-bindings.js:
3619         * test262/test/language/destructuring/binding/syntax/property-list-with-property-list.js:
3620         * test262/test/language/destructuring/binding/syntax/recursive-array-and-object-patterns.js:
3621         * test262/test/language/eval-code/direct/block-decl-eval-source-is-strict-nostrict.js: Copied from JSTests/test262/test/language/eval-code/direct/block-decl-strict-source.js.
3622         * test262/test/language/eval-code/direct/block-decl-eval-source-is-strict-onlystrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/block-decl-strict-source.js.
3623         (catch):
3624         * test262/test/language/eval-code/direct/block-decl-onlystrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/block-decl-strict-caller.js.
3625         * test262/test/language/eval-code/direct/switch-case-decl-eval-source-is-strict-nostrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/switch-case-decl-strict-source.js.
3626         * test262/test/language/eval-code/direct/switch-case-decl-eval-source-is-strict-onlystrict.js: Copied from JSTests/test262/test/language/eval-code/direct/switch-case-decl-strict-caller.js.
3627         (catch):
3628         * test262/test/language/eval-code/direct/switch-case-decl-onlystrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/switch-case-decl-strict-caller.js.
3629         * test262/test/language/eval-code/direct/switch-dflt-decl-eval-source-is-strict-nostrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/switch-dflt-decl-strict-source.js.
3630         * test262/test/language/eval-code/direct/switch-dflt-decl-eval-source-is-strict-onlystrict.js: Copied from JSTests/test262/test/language/eval-code/direct/switch-dflt-decl-strict-caller.js.
3631         (catch):
3632         * test262/test/language/eval-code/direct/switch-dflt-decl-onlystrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/switch-dflt-decl-strict-caller.js.
3633         * test262/test/language/expressions/async-arrow-function/await-as-param-ident-nested-arrow-parameter-position.js: Added.
3634         (async):
3635         * test262/test/language/expressions/async-arrow-function/await-as-param-nested-arrow-body-position.js: Added.
3636         (async):
3637         * test262/test/language/expressions/async-arrow-function/await-as-param-nested-arrow-parameter-position.js: Added.
3638         (async.a):
3639         * test262/test/language/expressions/async-arrow-function/await-as-param-rest-nested-arrow-parameter-position.js: Added.
3640         (async.a):
3641         * test262/test/language/expressions/async-arrow-function/escaped-async-line-terminator.js: Added.
3642         * test262/test/language/expressions/async-generator/generator-created-after-decl-inst.js: Added.
3643         (g.async.a):
3644         * test262/test/language/expressions/class/class-name-ident-await-escaped-module.js: Added.
3645         (C):
3646         * test262/test/language/expressions/class/class-name-ident-await-escaped.js: Added.
3647         (C):
3648         * test262/test/language/expressions/class/class-name-ident-await-module.js: Added.
3649         (C):
3650         * test262/test/language/expressions/class/class-name-ident-await.js: Added.
3651         (C):
3652         * test262/test/language/expressions/class/class-name-ident-let-escaped.js: Added.
3653         (C):
3654         * test262/test/language/expressions/class/class-name-ident-let.js: Added.
3655         (C):
3656         * test262/test/language/expressions/class/class-name-ident-static-escaped.js: Added.
3657         (C):
3658         * test262/test/language/expressions/class/class-name-ident-static.js: Added.
3659         * test262/test/language/expressions/class/class-name-ident-yield-escaped.js: Added.
3660         (C):
3661         * test262/test/language/expressions/class/class-name-ident-yield.js: Added.
3662         (C):
3663         * test262/test/language/expressions/class/constructor-this-tdz-during-initializers.js: Added.
3664         (Base):
3665         (C):
3666         * test262/test/language/expressions/class/fields-run-once-on-double-super.js: Added.
3667         (Base):
3668         (C):
3669         * test262/test/language/expressions/generators/generator-created-after-decl-inst.js: Added.
3670         (g):
3671         * test262/test/language/expressions/greater-than-or-equal/bigint-and-incomparable-string.js: Added.
3672         * test262/test/language/expressions/greater-than-or-equal/bigint-and-string.js: Added.
3673         * test262/test/language/expressions/greater-than/bigint-and-boolean.js: Added.
3674         * test262/test/language/expressions/greater-than/bigint-and-incomparable-string.js: Added.
3675         * test262/test/language/expressions/greater-than/bigint-and-string.js: Added.
3676         * test262/test/language/expressions/less-than-or-equal/bigint-and-incomparable-string.js: Added.
3677         * test262/test/language/expressions/less-than-or-equal/bigint-and-string.js: Added.
3678         * test262/test/language/expressions/less-than/bigint-and-boolean.js: Added.
3679         * test262/test/language/expressions/less-than/bigint-and-incomparable-string.js: Added.
3680         * test262/test/language/expressions/less-than/bigint-and-string.js: Added.
3681         * test262/test/language/expressions/object/method-definition/generator-super-prop-param.js:
3682         * test262/test/language/function-code/block-decl-onlystrict.js: Renamed from JSTests/test262/test/language/function-code/block-decl-strict.js.
3683         * test262/test/language/function-code/switch-case-decl-onlystrict.js: Renamed from JSTests/test262/test/language/function-code/switch-case-decl-strict.js.
3684         * test262/test/language/function-code/switch-dflt-decl-onlystrict.js: Renamed from JSTests/test262/test/language/function-code/switch-dflt-decl-strict.js.
3685         * test262/test/language/line-terminators/S7.3_A2.3.js: Removed.
3686         * test262/test/language/line-terminators/S7.3_A2.4.js: Removed.
3687         * test262/test/language/literals/regexp/invalid-optional-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
3688         * test262/test/language/literals/regexp/invalid-optional-negative-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
3689         * test262/test/language/literals/regexp/invalid-range-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
3690         * test262/test/language/literals/regexp/invalid-range-negative-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
3691         * test262/test/language/literals/regexp/u-invalid-optional-lookahead.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
3692         * test262/test/language/literals/regexp/u-invalid-optional-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
3693         * test262/test/language/literals/regexp/u-invalid-optional-negative-lookahead.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
3694         * test262/test/language/literals/regexp/u-invalid-optional-negative-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
3695         * test262/test/language/literals/regexp/u-invalid-range-lookahead.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
3696         * test262/test/language/literals/regexp/u-invalid-range-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
3697         * test262/test/language/literals/regexp/u-invalid-range-negative-lookahead.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
3698         * test262/test/language/literals/regexp/u-invalid-range-negative-lookbehind.js: Renamed from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
3699         * test262/test/language/literals/string/line-separator-eval.js: Added.
3700         * test262/test/language/literals/string/line-separator.js: Added.
3701         * test262/test/language/literals/string/paragraph-separator-eval.js: Added.
3702         * test262/test/language/literals/string/paragraph-separator.js: Added.
3703         * test262/test/language/module-code/early-strict-mode.js:
3704         * test262/test/language/statements/async-generator/generator-created-after-decl-inst.js: Added.
3705         (async.g):
3706         * test262/test/language/statements/break/S12.8_A8_T1.js:
3707         (catch):
3708         * test262/test/language/statements/break/S12.8_A8_T2.js:
3709         (catch):
3710         * test262/test/language/statements/class/class-name-ident-await-escaped-module.js: Added.
3711         (aw):
3712         * test262/test/language/statements/class/class-name-ident-await-escaped.js: Added.
3713         (aw):
3714         * test262/test/language/statements/class/class-name-ident-await-module.js: Added.
3715         (await):
3716         * test262/test/language/statements/class/class-name-ident-await.js: Added.
3717         (await):
3718         * test262/test/language/statements/class/class-name-ident-let-escaped.js: Added.
3719         (l):
3720         * test262/test/language/statements/class/class-name-ident-let.js: Added.
3721         (let):
3722         * test262/test/language/statements/class/class-name-ident-static-escaped.js: Added.
3723         (st):
3724         * test262/test/language/statements/class/class-name-ident-static.js: Added.
3725         * test262/test/language/statements/class/class-name-ident-yield-escaped.js: Added.
3726         (yi):
3727         * test262/test/language/statements/class/class-name-ident-yield.js: Added.
3728         (yield):
3729         * test262/test/language/statements/continue/S12.7_A8_T1.js:
3730         (catch):
3731         * test262/test/language/statements/continue/S12.7_A8_T2.js:
3732         (catch):
3733         * test262/test/language/statements/generators/generator-created-after-decl-inst.js: Added.
3734         (g):
3735         * test262/test/language/statements/try/early-catch-duplicates.js:
3736         * test262/test/language/statements/try/early-catch-function.js: Added.
3737         (f.catch.e):
3738         (f):
3739         * test262/test/language/statements/try/early-catch-lex.js:
3740         * test262/test/language/statements/try/early-catch-var.js:
3741         * test262/test262-Revision.txt:
3742
3743 2018-05-09  Caio Lima  <ticaiolima@gmail.com>
3744
3745         [ESNext][BigInt] Implement support for "==" operation
3746         https://bugs.webkit.org/show_bug.cgi?id=184474
3747
3748         Reviewed by Yusuke Suzuki.
3749
3750         * stress/big-int-equals-basic.js: Added.
3751         * stress/big-int-equals-to-primitive-precedence.js: Added.
3752         * stress/big-int-equals-wrapped-value.js: Added.
3753
3754 2018-05-08  Valerie R Young  <valerie@bocoup.com>
3755
3756         test262/Runner.pm: move input files to JSTests/test262
3757         https://bugs.webkit.org/show_bug.cgi?id=185389
3758
3759         Reviewed by Michael Saboff.
3760
3761         * test262/config.yaml: Renamed from Tools/Scripts/test262/config.yaml.
3762         * test262/expectations.yaml: Renamed from Tools/Scripts/test262/expectations.yaml.
3763
3764 2018-05-05  Filip Pizlo  <fpizlo@apple.com>
3765
3766         DFG AI should have O(1) clobbering
3767         https://bugs.webkit.org/show_bug.cgi?id=185287
3768
3769         Reviewed by Saam Barati.
3770
3771         * stress/simple-ai-effect.js: Added.
3772         (bar):
3773         (foo):
3774
3775 2018-05-04  Keith Miller  <keith_miller@apple.com>
3776
3777         isCacheableArrayLength should return true for undecided arrays
3778         https://bugs.webkit.org/show_bug.cgi?id=185309
3779
3780         Reviewed by Michael Saboff.
3781
3782         * stress/get-array-length-undecided.js: Added.
3783         (test):
3784
3785 2018-05-04  Dominik Infuehr  <dinfuehr@igalia.com>
3786
3787         Disable tests on systems with limited memory
3788         https://bugs.webkit.org/show_bug.cgi?id=185296
3789
3790         Reviewed by Saam Barati.
3791
3792         Test doesn't work with a limited amount of memory. I tried to reduce memory usage
3793         but then it was hard to reproduce the failure the test was originally made to test.
3794
3795         * stress/array-reverse-doesnt-clobber.js:
3796
3797 2018-05-03  Saam Barati  <sbarati@apple.com>
3798
3799         Don't prevent CreateThis being folded to NewObject when the structure is poly proto
3800         https://bugs.webkit.org/show_bug.cgi?id=185177
3801
3802         Reviewed by Filip Pizlo.
3803
3804         * microbenchmarks/construct-poly-proto-object.js: Added.
3805         (foo.A):
3806         (foo):
3807         * stress/allocation-sinking-new-object-with-poly-proto.js: Added.
3808         (foo.A):
3809         (foo):
3810         (makePolyProto):
3811         (bar):
3812         (baz):
3813
3814 2018-05-03  Michael Saboff  <msaboff@apple.com>
3815
3816         OSR entry pruning of Program Bytecodes doesn't take into account try/catch
3817         https://bugs.webkit.org/show_bug.cgi?id=185281
3818
3819         Reviewed by Saam Barati.
3820
3821         New regression test.
3822
3823         * stress/baseline-osrentry-catch-is-reachable.js: Added.
3824         (i.j.catch):
3825
3826 2018-05-03  Ryan Haddad  <ryanhaddad@apple.com>
3827
3828         Unreviewed, rolling out r231197.
3829
3830         The test added with this change crashes on the 32-bit JSC bot.
3831
3832         Reverted changeset:
3833
3834         "Correctly detect string overflow when using the 'Function'
3835         constructor"
3836         https://bugs.webkit.org/show_bug.cgi?id=184883
3837         https://trac.webkit.org/changeset/231197
3838
3839 2018-05-02  Filip Pizlo  <fpizlo@apple.com>
3840
3841         JSC should know how to cache custom getter accesses on the prototype chain
3842         https://bugs.webkit.org/show_bug.cgi?id=185213
3843
3844         Reviewed by Keith Miller.
3845
3846         * microbenchmarks/get-custom-getter.js: Added.
3847         (test):
3848
3849 2018-05-02  Robin Morisset  <rmorisset@apple.com>
3850
3851         emitCodeToGetArgumentsArrayLength should not crash on PhantomNewArrayWithSpread
3852         https://bugs.webkit.org/show_bug.cgi?id=183172
3853
3854         Reviewed by Filip Pizlo.
3855
3856         * stress/length-of-new-array-with-spread.js: Added.
3857         (foo):
3858         (bar):
3859         (baz):
3860
3861 2018-05-01  Yusuke Suzuki  <utatane.tea@gmail.com>
3862
3863         [JSC] Add SameValue DFG node
3864         https://bugs.webkit.org/show_bug.cgi?id=185065
3865
3866         Reviewed by Saam Barati.
3867
3868         * microbenchmarks/object-is.js: Added.
3869         (incognito):
3870         (sameValue):
3871         (test1):
3872         (test2):
3873         (test3):
3874         (test4):
3875         (test5):
3876         (test6):
3877         * stress/object-is.js: Added.
3878         (shouldBe):
3879         (is1):
3880         (is2):
3881         (is3):
3882         (is4):
3883         (is5):
3884         (is6):
3885         (is7):
3886         (is8):
3887         (is9):
3888         (is10):
3889         (is11):
3890         (is12):
3891         (is13):
3892         (is14):
3893         (is15):
3894
3895 2018-05-01  Robin Morisset  <rmorisset@apple.com>
3896
3897         Correctly detect string overflow when using the 'Function' constructor
3898         https://bugs.webkit.org/show_bug.cgi?id=184883
3899         <rdar://problem/36320331>
3900
3901         Reviewed by Filip Pizlo.
3902
3903         I put this regression test in the 'slowMicrobenchmarks' directory because it takes nearly 30s to run, and I am not sure where else to put it.
3904
3905         * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
3906         (catch):
3907
3908 2018-05-01  Robin Morisset  <rmorisset@apple.com>
3909
3910         IntlObject.cpp::removeUnicodeLocaleExtension() should not touch locales that end in '-u'
3911         https://bugs.webkit.org/show_bug.cgi?id=185162
3912
3913         Reviewed by Filip Pizlo.
3914
3915         * stress/incomplete-unicode-locale.js: Added.
3916         (catch):
3917
3918 2018-05-01  Dominik Infuehr  <dinfuehr@igalia.com>
3919
3920         Add SetCallee as DFG-Operation
3921         https://bugs.webkit.org/show_bug.cgi?id=184582
3922
3923         Reviewed by Filip Pizlo.
3924
3925         Added test that runs into infinite loop without updating the callee and
3926         therefore emitting SetCallee in DFG for recursive tail calls.
3927
3928         * stress/closure-recursive-tail-call-infinite-loop.js: Added.
3929         (Foo):
3930         (second):
3931         (first):
3932         (return.closure):
3933         (createClosure):
3934
3935 2018-04-30  Saam Barati  <sbarati@apple.com>
3936
3937         ToString constant folds without preserving checks, causing us to break assumptions that the code would OSR exit
3938         https://bugs.webkit.org/show_bug.cgi?id=185149
3939         <rdar://problem/39455917>
3940
3941         Reviewed by Filip Pizlo.
3942
3943         * stress/keep-checks-when-converting-to-lazy-js-constant-in-strength-reduction.js: Added.
3944
3945 2018-04-29  Filip Pizlo  <fpizlo@apple.com>
3946
3947         LICM shouldn't hoist nodes if hoisted nodes exited in that code block
3948         https://bugs.webkit.org/show_bug.cgi?id=185126
3949
3950         Reviewed by Saam Barati.
3951
3952         I found this bug by accident when I was writing this test for something else.
3953
3954         This change also speeds up other benchmarks of this case that we already had. They are all called
3955         the licm-dragons tests.
3956
3957         * microbenchmarks/licm-dragons-two-structures.js: Added.
3958         (foo):
3959
3960 2018-04-29  Commit Queue  <commit-queue@webkit.org>
3961
3962         Unreviewed, rolling out r231137.
3963         https://bugs.webkit.org/show_bug.cgi?id=185118
3964
3965         It is breaking Test262 language/expressions/multiplication
3966         /order-of-evaluation.js (Requested by caiolima on #webkit).
3967
3968         Reverted changeset:
3969
3970         "[ESNext][BigInt] Implement support for "*" operation"
3971         https://bugs.webkit.org/show_bug.cgi?id=183721
3972         https://trac.webkit.org/changeset/231137
3973
3974 2018-04-28  Saam Barati  <sbarati@apple.com>
3975
3976         We don't model regexp effects properly
3977         https://bugs.webkit.org/show_bug.cgi?id=185059
3978         <rdar://problem/39736150>
3979
3980         Reviewed by Filip Pizlo.
3981
3982         * stress/regexp-exec-test-effectful-last-index.js: Added.
3983         (assert):
3984         (foo):
3985         (i.regexLastIndex.toString):
3986         (bar):
3987
3988 2018-04-28  Rick Waldron  <waldron.rick@gmail.com>
3989
3990         Token misspelled "tocken" in error message string
3991         https://bugs.webkit.org/show_bug.cgi?id=185030
3992
3993         Reviewed by Saam Barati.
3994
3995         * ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc: Fix typo "tocken" => "token"
3996         * stress/destructuring-assignment-syntax.js: Fix typo "tocken" => "token"
3997         * stress/error-messages-for-in-operator-should-not-crash.js: Fix typo "tocken" => "token"
3998         * stress/reserved-word-with-escape.js: Fix typo "tocken" => "token"
3999         (testSyntaxError.String.raw.v):
4000         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
4001         (testSyntaxError.String.raw.a):
4002
4003 2018-04-28  Caio Lima  <ticaiolima@gmail.com>
4004
4005         [ESNext][BigInt] Implement support for "*" operation
4006         https://bugs.webkit.org/show_bug.cgi?id=183721
4007
4008         Reviewed by Saam Barati.
4009
4010         * bigIntTests.yaml:
4011         * stress/big-int-mul-jit.js: Added.
4012         * stress/big-int-mul-to-primitive-precedence.js: Added.
4013         * stress/big-int-mul-to-primitive.js: Added.
4014         * stress/big-int-mul-type-error.js: Added.
4015         * stress/big-int-mul-wrapped-value.js: Added.
4016         * stress/big-int-multiplication.js: Added.
4017         * stress/big-int-multiply-memory-stress.js: Added.
4018
4019 2018-04-28  Commit Queue  <commit-queue@webkit.org>
4020
4021         Unreviewed, rolling out r231131.
4022         https://bugs.webkit.org/show_bug.cgi?id=185112
4023
4024         It is breaking Debug build due to unchecked exception
4025         (Requested by caiolima on #webkit).
4026
4027         Reverted changeset:
4028
4029         "[ESNext][BigInt] Implement support for "*" operation"
4030         https://bugs.webkit.org/show_bug.cgi?id=183721
4031         https://trac.webkit.org/changeset/231131
4032
4033 2018-04-27  Caio Lima  <ticaiolima@gmail.com>
4034
4035         [ESNext][BigInt] Implement support for "*" operation
4036         https://bugs.webkit.org/show_bug.cgi?id=183721
4037
4038         Reviewed by Saam Barati.
4039
4040         * bigIntTests.yaml:
4041         * stress/big-int-mul-jit.js: Added.
4042         * stress/big-int-mul-to-primitive-precedence.js: Added.
4043         * stress/big-int-mul-to-primitive.js: Added.
4044         * stress/big-int-mul-type-error.js: Added.
4045         * stress/big-int-mul-wrapped-value.js: Added.
4046         * stress/big-int-multiplication.js: Added.
4047         * stress/big-int-multiply-memory-stress.js: Added.
4048
4049 2018-04-27  Ryan Haddad  <ryanhaddad@apple.com>
4050
4051         Unreviewed, rolling out r231086.
4052
4053         Caused JSC test failures due to an unchecked exception.
4054
4055         Reverted changeset:
4056
4057         "[ESNext][BigInt] Implement support for "*" operation"
4058         https://bugs.webkit.org/show_bug.cgi?id=183721
4059         https://trac.webkit.org/changeset/231086
4060
4061 2018-04-27  Ryan Haddad  <ryanhaddad@apple.com>
4062
4063         Unreviewed test gardening, update expectations for test262/intl402/PluralRules tests after r231047.
4064
4065         * test262.yaml: Mark tests as passing.
4066
4067 2018-04-26  Caio Lima  <ticaiolima@gmail.com>
4068
4069         [ESNext][BigInt] Implement support for "*" operation
4070         https://bugs.webkit.org/show_bug.cgi?id=183721
4071
4072         Reviewed by Saam Barati.
4073
4074         * bigIntTests.yaml:
4075         * stress/big-int-mul-jit.js: Added.
4076         * stress/big-int-mul-to-primitive-precedence.js: Added.
4077         * stress/big-int-mul-to-primitive.js: Added.
4078         * stress/big-int-mul-type-error.js: Added.
4079         * stress/big-int-mul-wrapped-value.js: Added.
4080         * stress/big-int-multiplication.js: Added.
4081         * stress/big-int-multiply-memory-stress.js: Added.
4082
4083 2018-04-25  Robin Morisset  <rmorisset@apple.com>
4084
4085         In FTLLowerDFGToB3.cpp::compileCreateRest, always use a contiguous array as the indexing type when under isWatchingHavingABadTimeWatchpoint
4086         https://bugs.webkit.org/show_bug.cgi?id=184773
4087         <rdar://problem/37773612>
4088
4089         Reviewed by Filip Pizlo.
4090
4091         This bug requires a race between the thread doing FTL compilation and the main thread, but it triggers in 100% of cases (before the fix) on my machine
4092         so I decided to add it to the stress tests nonetheless.
4093
4094         * stress/create-rest-while-having-a-bad-time.js: Added.
4095         (f):
4096         (g):
4097         (h):
4098
4099 2018-04-25  Keith Miller  <keith_miller@apple.com>
4100
4101         Add missing scope release to functionProtoFuncToString
4102         https://bugs.webkit.org/show_bug.cgi?id=184995
4103
4104         Reviewed by Saam Barati.
4105
4106         * stress/function-toString-arrow.js: Added.
4107         (async):
4108
4109 2018-04-24  Keith Miller  <keith_miller@apple.com>
4110
4111         fromCharCode is missing some exception checks
4112         https://bugs.webkit.org/show_bug.cgi?id=184952
4113
4114         Reviewed by Saam Barati.
4115
4116         * stress/fromCharCode-exception-check.js: Added.
4117         (get catch):
4118
4119 2018-04-24  Mark Lam  <mark.lam@apple.com>
4120
4121         Gardening: test fix after r230863.
4122         https://bugs.webkit.org/show_bug.cgi?id=184846
4123         <rdar://problem/39390672>
4124
4125         Not reviewed.
4126
4127         * stress/json-stringified-overflow-2.js:
4128         (catch):
4129         * stress/json-stringified-overflow.js:
4130         (catch):
4131
4132 2018-04-20  JF Bastien  <jfbastien@apple.com>
4133
4134         Handle more JSON stringify OOM
4135         https://bugs.webkit.org/show_bug.cgi?id=184846
4136         <rdar://problem/39390672>
4137
4138         Reviewed by Mark Lam.
4139
4140         * stress/json-stringified-overflow-2.js: Added. Same as the one
4141         below, but with a bigger input which will trigger a different code
4142         path.
4143         (catch):
4144         * stress/json-stringified-overflow.js: Modify the test to only
4145         catch OOM on stringification. not on string creation.
4146
4147 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
4148
4149         [WebAssembly][Modules] Import tables in wasm modules
4150         https://bugs.webkit.org/show_bug.cgi?id=184738
4151
4152         Reviewed by JF Bastien.
4153
4154         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js:
4155         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm:
4156         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat:
4157         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js:
4158         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm:
4159         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat:
4160         * wasm/modules/wasm-imports-wasm-exports.js:
4161         * wasm/modules/wasm-imports-wasm-exports/imports.wasm:
4162         * wasm/modules/wasm-imports-wasm-exports/imports.wat:
4163         * wasm/modules/wasm-imports-wasm-exports/sum.wasm:
4164         * wasm/modules/wasm-imports-wasm-exports/sum.wat:
4165
4166 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
4167
4168         [WebAssembly][Modules] Import globals from wasm modules
4169         https://bugs.webkit.org/show_bug.cgi?id=184736
4170
4171         Reviewed by JF Bastien.
4172
4173         * wasm.yaml:
4174         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js:
4175         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm:
4176         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat:
4177         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js:
4178         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm:
4179         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat:
4180         * wasm/modules/wasm-imports-wasm-exports.js:
4181         * wasm/modules/wasm-imports-wasm-exports/imports.wasm:
4182         * wasm/modules/wasm-imports-wasm-exports/imports.wat:
4183         * wasm/modules/wasm-imports-wasm-exports/sum.wasm:
4184         * wasm/modules/wasm-imports-wasm-exports/sum.wat:
4185
4186 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
4187
4188         Unreviewed, reland r230697, r230720, and r230724.
4189         https://bugs.webkit.org/show_bug.cgi?id=184600
4190
4191         * wasm.yaml:
4192         * wasm/modules/constant.wasm: Added.
4193         * wasm/modules/constant.wat: Added.
4194         * wasm/modules/default-import-star-error.js: Added.
4195         (then):
4196         * wasm/modules/default-import-star-error/entry.wasm: Added.
4197         * wasm/modules/default-import-star-error/entry.wat: Added.
4198         * wasm/modules/default-import-star-error/t0.js: Added.
4199         * wasm/modules/default-import-star-error/t1.js: Added.
4200         * wasm/modules/default-import-star-error/t2.js: Added.
4201         (export.default.Cocoa):
4202         * wasm/modules/js-wasm-cycle.js: Added.
4203         * wasm/modules/js-wasm-cycle/entry.js: Added.
4204         (from.string_appeared_here.export.return42):
4205         * wasm/modules/js-wasm-cycle/sum.wasm: Added.
4206         * wasm/modules/js-wasm-cycle/sum.wat: Added.
4207         * wasm/modules/js-wasm-function-namespace.js: Added.
4208         (assert.throws):
4209         * wasm/modules/js-wasm-function.js: Added.
4210         (assert.throws):
4211         * wasm/modules/js-wasm-global-namespace.js: Added.
4212         (assert.throws):
4213         * wasm/modules/js-wasm-global.js: Added.
4214         (assert.throws):
4215         * wasm/modules/js-wasm-memory-namespace.js: Added.
4216         (assert.throws):
4217         * wasm/modules/js-wasm-memory.js: Added.
4218         (assert.throws):
4219         * wasm/modules/js-wasm-start.js: Added.
4220         (then):
4221         * wasm/modules/js-wasm-table-namespace.js: Added.
4222         (assert.throws):
4223         * wasm/modules/js-wasm-table.js: Added.
4224         (assert.throws):
4225         * wasm/modules/memory.wasm: Added.
4226         * wasm/modules/memory.wat: Added.
4227         * wasm/modules/run-from-wasm.wasm: Added.
4228         * wasm/modules/run-from-wasm.wat: Added.
4229         * wasm/modules/run-from-wasm/check.js: Added.
4230         (export.check):
4231         * wasm/modules/start.wasm: Added.
4232         * wasm/modules/start.wat: Added.
4233         * wasm/modules/sum.wasm: Added.
4234         * wasm/modules/sum.wat: Added.
4235         * wasm/modules/table.wasm: Added.
4236         * wasm/modules/table.wat: Added.
4237         * wasm/modules/wasm-imports-js-exports.js: Added.
4238         * wasm/modules/wasm-imports-js-exports/imports.wasm: Added.
4239         * wasm/modules/wasm-imports-js-exports/imports.wat: Added.
4240         * wasm/modules/wasm-imports-js-exports/sum.js: Added.
4241         (export.sum):
4242         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js: Added.
4243         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm: Added.
4244         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat: Added.
4245         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js: Added.
4246         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm: Added.
4247         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat: Added.
4248         * wasm/modules/wasm-imports-wasm-exports.js: Added.
4249         * wasm/modules/wasm-imports-wasm-exports/imports.wasm: Added.
4250         * wasm/modules/wasm-imports-wasm-exports/imports.wat: Added.
4251         * wasm/modules/wasm-imports-wasm-exports/sum.wasm: Added.
4252         * wasm/modules/wasm-imports-wasm-exports/sum.wat: Added.
4253         * wasm/modules/wasm-js-cycle.js: Added.
4254         * wasm/modules/wasm-js-cycle/entry.wasm: Added.
4255         * wasm/modules/wasm-js-cycle/entry.wat: Added.
4256         * wasm/modules/wasm-js-cycle/sum.js: Added.
4257         (from.string_appeared_here.export.sum):
4258         * wasm/modules/wasm-wasm-cycle.js: Added.
4259         * wasm/modules/wasm-wasm-cycle/entry.wasm: Added.
4260         * wasm/modules/wasm-wasm-cycle/entry.wat: Added.
4261         * wasm/modules/wasm-wasm-cycle/sum.wasm: Added.
4262         * wasm/modules/wasm-wasm-cycle/sum.wat: Added.
4263
4264 2018-04-17  Commit Queue  <commit-queue@webkit.org>
4265
4266         Unreviewed, rolling out r230697, r230720, and r230724.
4267         https://bugs.webkit.org/show_bug.cgi?id=184717
4268
4269         These caused multiple failures on the Test262 testers.
4270         (Requested by mlewis13 on #webkit).
4271
4272         Reverted changesets:
4273
4274         "[WebAssembly][Modules] Prototype wasm import"
4275         https://bugs.webkit.org/show_bug.cgi?id=184600
4276         https://trac.webkit.org/changeset/230697
4277
4278         "[WebAssembly][Modules] Implement function import from wasm
4279         modules"
4280         https://bugs.webkit.org/show_bug.cgi?id=184689
4281         https://trac.webkit.org/changeset/230720
4282
4283         "[JSC] Rename runWebAssembly to runWebAssemblySuite"
4284         https://bugs.webkit.org/show_bug.cgi?id=184703
4285         https://trac.webkit.org/changeset/230724
4286
4287 2018-04-17  JF Bastien  <jfbastien@apple.com>
4288
4289         A put is not an ExistingProperty put when we transition a structure because of an attributes change
4290         https://bugs.webkit.org/show_bug.cgi?id=184706
4291         <rdar://problem/38871451>
4292
4293         Reviewed by Saam Barati.
4294
4295         * stress/put-by-id-direct-strict-transition.js: Added.
4296         (const.foo):
4297         (j.const.obj.set hello):
4298         * stress/put-by-id-direct-transition.js: Added.
4299         (const.foo):
4300         (j.const.obj.set hello):
4301         * stress/put-getter-setter-by-id-strict-transition.js: Added.
4302         (const.foo):
4303         (j.const.obj.set hello):
4304         * stress/put-getter-setter-by-id-transition.js: Added.
4305         (const.foo):
4306         (j.const.obj.set hello):
4307
4308 2018-04-16  Filip Pizlo  <fpizlo@apple.com>
4309
4310         PutStackSinkingPhase should know that KillStack means ConflictingFlush
4311         https://bugs.webkit.org/show_bug.cgi?id=184672
4312
4313         Reviewed by Michael Saboff.
4314
4315         * stress/sink-put-stack-over-kill-stack.js: Added.
4316         (avocado_1):
4317         (apricot_0):
4318         (__c_0):
4319         (banana_2):
4320
4321 2018-04-17  Yusuke Suzuki  <utatane.tea@gmail.com>
4322
4323         [JSC] Rename runWebAssembly to runWebAssemblySuite
4324         https://bugs.webkit.org/show_bug.cgi?id=184703
4325
4326         Reviewed by JF Bastien.
4327
4328         And add runWebAssembly as a command to simplely run wasm modules.
4329
4330         * wasm.yaml:
4331
4332 2018-04-17  Yusuke Suzuki  <utatane.tea@gmail.com>
4333
4334         [WebAssembly][Modules] Implement function import from wasm modules
4335         https://bugs.webkit.org/show_bug.cgi?id=184689
4336
4337         Reviewed by JF Bastien.
4338
4339         * wasm.yaml:
4340         * wasm/modules/js-wasm-cycle.js: Added.
4341         * wasm/modules/js-wasm-cycle/entry.js: Added.
4342         (from.string_appeared_here.export.return42):
4343         * wasm/modules/js-wasm-cycle/sum.wasm: Added.
4344         * wasm/modules/js-wasm-cycle/sum.wat: Added.
4345         * wasm/modules/run-from-wasm.wasm: Added.
4346         * wasm/modules/run-from-wasm.wat: Added.
4347         * wasm/modules/run-from-wasm/check.js: Added.
4348         (export.check):
4349         * wasm/modules/wasm-imports-js-exports.js: Added.
4350         * wasm/modules/wasm-imports-js-exports/imports.wasm: Added.
4351         * wasm/modules/wasm-imports-js-exports/imports.wat: Added.
4352         * wasm/modules/wasm-imports-js-exports/sum.js: Added.
4353         (export.sum):
4354         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js: Added.
4355         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm: Added.
4356         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat: Added.
4357         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js: Added.
4358         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm: Added.
4359         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat: Added.
4360         * wasm/modules/wasm-imports-wasm-exports.js: Added.
4361         * wasm/modules/wasm-imports-wasm-exports/imports.wasm: Added.
4362         * wasm/modules/wasm-imports-wasm-exports/imports.wat: Added.
4363         * wasm/modules/wasm-imports-wasm-exports/sum.wasm: Added.
4364         * wasm/modules/wasm-imports-wasm-exports/sum.wat: Added.
4365         * wasm/modules/wasm-js-cycle.js: Added.
4366         * wasm/modules/wasm-js-cycle/entry.wasm: Added.
4367         * wasm/modules/wasm-js-cycle/entry.wat: Added.
4368         * wasm/modules/wasm-js-cycle/sum.js: Added.
4369         (from.string_appeared_here.export.sum):
4370         * wasm/modules/wasm-wasm-cycle.js: Added.
4371         * wasm/modules/wasm-wasm-cycle/entry.wasm: Added.
4372         * wasm/modules/wasm-wasm-cycle/entry.wat: Added.
4373         * wasm/modules/wasm-wasm-cycle/sum.wasm: Added.
4374         * wasm/modules/wasm-wasm-cycle/sum.wat: Added.
4375
4376 2018-04-16  Yusuke Suzuki  <utatane.tea@gmail.com>
4377
4378         [WebAssembly][Modules] Prototype wasm import
4379         https://bugs.webkit.org/show_bug.cgi?id=184600
4380
4381         Reviewed by JF Bastien.
4382
4383         Add wasm and wat files since module loader want to load wasm files from FS.
4384         Currently, importing the other modules from wasm is not supported.
4385
4386         * wasm.yaml:
4387         * wasm/modules/constant.wasm: Added.
4388         * wasm/modules/constant.wat: Added.
4389         * wasm/modules/js-wasm-function-namespace.js: Added.
4390         (assert.throws):
4391         * wasm/modules/js-wasm-function.js: Added.
4392         (assert.throws):
4393         * wasm/modules/js-wasm-global-namespace.js: Added.
4394         (assert.throws):
4395         * wasm/modules/js-wasm-global.js: Added.
4396         (assert.throws):
4397         * wasm/modules/js-wasm-memory-namespace.js: Added.
4398         (assert.throws):
4399         * wasm/modules/js-wasm-memory.js: Added.
4400         (assert.throws):
4401         * wasm/modules/js-wasm-start.js: Added.
4402         (then):
4403         * wasm/modules/js-wasm-table-namespace.js: Added.
4404         (assert.throws):
4405         * wasm/modules/js-wasm-table.js: Added.
4406         (assert.throws):
4407         * wasm/modules/memory.wasm: Added.
4408         * wasm/modules/memory.wat: Added.
4409         * wasm/modules/start.wasm: Added.
4410         * wasm/modules/start.wat: Added.
4411         * wasm/modules/sum.wasm: Added.
4412         * wasm/modules/sum.wat: Added.
4413         * wasm/modules/table.wasm: Added.
4414         * wasm/modules/table.wat: Added.
4415
4416 2018-04-14  Filip Pizlo  <fpizlo@apple.com>
4417
4418         Function.prototype.caller shouldn't return generator bodies
4419         https://bugs.webkit.org/show_bug.cgi?id=184630
4420
4421         Reviewed by Yusuke Suzuki.
4422
4423         * stress/function-caller-async-arrow-function-body.js: Added.
4424         * stress/function-caller-async-function-body.js: Added.
4425         * stress/function-caller-async-generator-body.js: Added.
4426         * stress/function-caller-generator-body.js: Added.
4427         * stress/function-caller-generator-method-body.js: Added.
4428
4429 2018-04-12  Tomas Popela  <tpopela@redhat.com>
4430
4431         Unreviewed, skip JIT tests if it isn't enabled
4432
4433         See https://bugs.webkit.org/show_bug.cgi?id=182730.
4434
4435         * stress/big-int-spec-to-primitive.js:
4436         * stress/big-int-spec-to-this.js:
4437
4438 2018-04-10  Caio Lima  <ticaiolima@gmail.com>
4439
4440         [ESNext][BigInt] Add support for BigInt in SpeculatedType
4441         https://bugs.webkit.org/show_bug.cgi?id=182470
4442
4443         Reviewed by Saam Barati.
4444
4445         * stress/big-int-spec-to-primitive.js: Added.
4446         * stress/big-int-spec-to-this.js: Added.
4447         * stress/big-int-strict-equals-jit.js: Added.
4448         * stress/big-int-strict-spec-to-this.js: Added.
4449         * stress/big-int-type-of-proven-type.js: Added.
4450
4451 2018-04-10  Filip Pizlo  <fpizlo@apple.com>
4452
4453         DFG AI and clobberize should agree with each other
4454         https://bugs.webkit.org/show_bug.cgi?id=184440
4455
4456         Reviewed by Saam Barati.
4457
4458         Add tests for all of the bugs I fixed.
4459
4460         * stress/direct-arguments-out-of-bounds-change-structure.js: Added.
4461         (foo):
4462         * stress/new-typed-array-cse-effects.js: Added.
4463         (foo):
4464         * stress/scoped-arguments-out-of-bounds-change-structure.js: Added.
4465         (foo.theO):
4466         (foo):
4467         * stress/string-from-char-code-change-structure-not-dead.js: Added.
4468         (foo):
4469         (i.valueOf):
4470         (weirdValue.valueOf):
4471         * stress/string-from-char-code-change-structure.js: Added.
4472         (foo):
4473         (i.valueOf):
4474         (weirdValue.valueOf):
4475
4476 2018-04-09  Leo Balter  <leonardo.balter@gmail.com>
4477
4478         Fix errant Test262 files CRLF to LF for consistency with the original source
4479         https://bugs.webkit.org/show_bug.cgi?id=184425
4480
4481         Reviewed by Yusuke Suzuki.
4482
4483         * test262/test/built-ins/Math/acosh/nan-returns.js:
4484         * test262/test/built-ins/Math/asinh/asinh-specialVals.js:
4485         * test262/test/built-ins/Math/atanh/atanh-specialVals.js:
4486         * test262/test/built-ins/Math/cbrt/cbrt-specialValues.js:
4487         * test262/test/built-ins/Math/cbrt/prop-desc.js:
4488         * test262/test/built-ins/Math/cosh/cosh-specialVals.js:
4489         * test262/test/built-ins/Math/expm1/expm1-specialVals.js:
4490         * test262/test/built-ins/Math/log10/Log10-specialVals.js:
4491         * test262/test/built-ins/Math/log2/log2-basicTests.js:
4492         * test262/test/built-ins/Math/sign/sign-specialVals.js:
4493         * test262/test/built-ins/Math/sinh/sinh-specialVals.js:
4494         * test262/test/built-ins/Math/tanh/tanh-specialVals.js:
4495         * test262/test/built-ins/Math/trunc/trunc-sampleTests.js:
4496         * test262/test/built-ins/Math/trunc/trunc-specialVals.js:
4497
4498 2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>
4499
4500         Unreviewed, remove incorrect entry in test262.yaml
4501         https://bugs.webkit.org/show_bug.cgi?id=184266
4502
4503         * test262.yaml:
4504
4505 2018-04-08  Valerie Young  <valerie@bocoup.com>
4506
4507         [JSC] Update Test262 to April 6 version
4508         https://bugs.webkit.org/show_bug.cgi?id=184266
4509
4510         Rubber stamped by Yusuke Suzuki.
4511
4512 2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>
4513
4514         [JSC] Introduce op_get_by_id_direct
4515         https://bugs.webkit.org/show_bug.cgi?id=183970
4516
4517         Reviewed by Filip Pizlo.
4518
4519         * stress/generator-prototype-copy.js: Added.
4520         (gen):
4521         (catch):
4522         Adopted JF's tests.
4523
4524         * stress/generator-type-check.js: Added.
4525         (shouldThrow):
4526         (foo2):
4527         (i.shouldThrow):
4528         * stress/get-by-id-direct-getter.js: Added.
4529         (shouldBe):
4530         (shouldThrow):
4531         (obj.get hello):
4532         (builtin.createBuiltin):
4533         (obj2.get length):
4534         * stress/get-by-id-direct.js: Added.
4535         (shouldBe):
4536         (shouldThrow):
4537         (builtin.createBuiltin):
4538         * test262.yaml:
4539         We fixed long-standing spec compatibility issue.
4540         As a result, this patch makes several test262 tests passed!
4541
4542
4543 2018-04-07  Yusuke Suzuki  <utatane.tea@gmail.com>
4544
4545         Unreviewed, annotate test with @skip if $memoryLimited
4546         https://bugs.webkit.org/show_bug.cgi?id=183894
4547
4548         * stress/json-stringified-overflow.js:
4549
4550 2018-04-06  Alexey Proskuryakov  <ap@apple.com>
4551
4552         Add svn:eol-style to line-terminator-normalisation-CR.js
4553         https://bugs.webkit.org/show_bug.cgi?id=184341
4554
4555         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js: Added property svn:eol-style.
4556
4557 2018-04-06  Ross Kirsling  <ross.kirsling@sony.com>
4558
4559         Unreviewed, remove errant LF from existing test262 test for CR line endings.
4560
4561         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
4562
4563 2018-04-05  Ross Kirsling  <ross.kirsling@sony.com>
4564
4565         Unreviewed, rolling out r230320.
4566
4567         Revert fix, as the root cause lies elsewhere.
4568
4569         Reverted changeset:
4570
4571         "[test262] Mark line-terminator-normalisation-CR.js as a
4572         binary file."
4573         https://bugs.webkit.org/show_bug.cgi?id=184341
4574         https://trac.webkit.org/changeset/230320
4575
4576 2018-04-05  Ross Kirsling  <ross.kirsling@sony.com>
4577
4578         [test262] Mark line-terminator-normalisation-CR.js as a binary file.
4579         https://bugs.webkit.org/show_bug.cgi?id=184341
4580
4581         Reviewed by Yusuke Suzuki.
4582
4583         This test is all about CR line endings, but `svn-apply` can't deal with them.
4584         Treating the file as binary ensures that its contents never are never shown in a diff.
4585
4586         * .gitattributes: Added.
4587
4588 2018-04-05  Robin Morisset  <rmorisset@apple.com>
4589
4590         Fix testcase (missing try/catch).
4591         https://bugs.webkit.org/show_bug.cgi?id=183657
4592
4593         Unreviewed.
4594
4595         * stress/large-unshift-splice.js
4596
4597 2018-04-04  Filip Pizlo  <fpizlo@apple.com>
4598
4599         REGRESSION(r222563): removed DoubleReal type check causes tons of crashes because CSE has never known how to handle SaneChain
4600         https://bugs.webkit.org/show_bug.cgi?id=184319
4601
4602         Reviewed by Saam Barati.
4603
4604         * stress/array-push-nan-to-double-array-cse-sane-and-insane-chain.js: Added.
4605         (foo):
4606         (bar):
4607         * stress/array-push-nan-to-double-array.js: Added.
4608         (foo):
4609         (bar):
4610
4611 2018-04-03  Mark Lam  <mark.lam@apple.com>
4612
4613         Test js-fixed-array-out-of-memory.js should be excluded for memory limited devices.
4614         https://bugs.webkit.org/show_bug.cgi?id=184284
4615
4616         Reviewed by Saam Barati.
4617
4618         * stress/js-fixed-array-out-of-memory.js:
4619
4620 2018-03-31  Filip Pizlo  <fpizlo@apple.com>
4621
4622         JSC crash in JIT code with for-of loop and Array/Set iterators
4623         https://bugs.webkit.org/show_bug.cgi?id=183174
4624
4625         Reviewed by Saam Barati.
4626
4627         * microbenchmarks/hoist-get-by-offset-tower-with-inferred-types.js: Added. This test shows that fixing the bug didn't break hoisting of GetByOffset with inferred types. I confirmed that if I did break it, this test slows down by >7x.
4628         (foo):
4629         * stress/hoist-get-by-offset-with-control-dependent-inferred-type.js: Added. This test shows that the bug is fixed.
4630         (f):
4631
4632 2018-03-30  JF Bastien  <jfbastien@apple.com>
4633
4634         WebAssembly: support DataView compilation
4635         https://bugs.webkit.org/show_bug.cgi?id=183342
4636
4637         Reviewed by Mark Lam.
4638
4639         Test WebAssembly compilation using a DataView with offset.
4640
4641         * wasm/regress/183342.js: Added.
4642         (attempt.catch):
4643
4644 2018-03-30  Filip Pizlo  <fpizlo@apple.com>
4645
4646         Bytecode generator should not get_from_scope something that may be a hole into a variable that is already live
4647         https://bugs.webkit.org/show_bug.cgi?id=184189
4648
4649         Reviewed by JF Bastien.
4650
4651         * stress/load-hole-from-scope-into-live-var.js: Added.
4652         (result.eval.try.switch):
4653         (catch):
4654
4655 2018-03-30  Ryan Haddad  <ryanhaddad@apple.com>
4656
4657         Unreviewed, rolling out r230102.
4658
4659         Caused assertion failures on JSC bots.
4660
4661         Reverted changeset:
4662
4663         "A stack overflow in the parsing of a builtin (called by
4664         createExecutable) cause a crash instead of a catchable js
4665         exception"
4666         https://bugs.webkit.org/show_bug.cgi?id=184074
4667         https://trac.webkit.org/changeset/230102
4668
4669 2018-03-30  Robin Morisset  <rmorisset@apple.com>
4670
4671         Inlining of a function that ends in op_unreachable in a non-tail position triggers an ASSERT
4672         https://bugs.webkit.org/show_bug.cgi?id=183812
4673
4674         Reviewed by Keith Miller.
4675
4676         * stress/inlining-unreachable-non-tail.js: Added.
4677         (foo.):
4678         (foo):
4679
4680 2018-03-30  Robin Morisset  <rmorisset@apple.com>
4681
4682         A stack overflow in the parsing of a builtin (called by createExecutable) cause a crash instead of a catchable js exception
4683         https://bugs.webkit.org/show_bug.cgi?id=184074
4684         <rdar://problem/37165897>
4685
4686         Reviewed by Keith Miller.
4687
4688         * stress/stack-overflow-while-parsing-builtin.js: Added.
4689         (f):
4690
4691 2018-03-30  Robin Morisset  <rmorisset@apple.com>
4692
4693         Out-of-bounds accesses due to a missing check for MAX_STORAGE_VECTOR_LENGTH in unshiftCountForAnyIndexingType
4694         https://bugs.webkit.org/show_bug.cgi?id=183657
4695
4696         Reviewed by Keith Miller.
4697
4698         * stress/large-unshift-splice.js: Added.
4699         (make_contig_arr):
4700
4701 2018-03-28  Robin Morisset  <rmorisset@apple.com>
4702
4703         appendQuotedJSONString stops on arithmetic overflow instead of propagating it upwards
4704         https://bugs.webkit.org/show_bug.cgi?id=183894
4705
4706         Reviewed by Saam Barati.
4707
4708         * stress/json-stringified-overflow.js: Added.
4709         (catch):
4710
4711 2018-03-26  Filip Pizlo  <fpizlo@apple.com>
4712
4713         DFG should know that CreateThis can be effectful
4714         https://bugs.webkit.org/show_bug.cgi?id=184013
4715
4716         Reviewed by Saam Barati.
4717
4718         * stress/create-this-property-change.js: Added.
4719         (Foo):
4720         (RealBar):
4721         (get if):
4722         * stress/create-this-structure-change-without-cse.js: Added.
4723         (Foo):
4724         (RealBar):
4725         (get if):
4726         * stress/create-this-structure-change.js: Added.
4727         (Foo):
4728         (RealBar):
4729         (get if):
4730
4731 2018-03-22  Yusuke Suzuki  <utatane.tea@gmail.com>
4732
4733         [DFG] Introduces fused compare and jump
4734         https://bugs.webkit.org/show_bug.cgi?id=177100
4735
4736         Reviewed by Mark Lam.
4737
4738         * stress/fused-jeq-slow.js: Added.
4739         (shouldBe):
4740         (testJEQ):
4741         (testJNEQB):
4742         (testJEQB):
4743         (testJNEQF):
4744         (testJEQF):
4745         * stress/fused-jeq.js: Added.
4746         (shouldBe):
4747         (testJEQ):
4748         (testJNEQB):
4749         (testJEQB):
4750         (testJNEQF):
4751         (testJEQF):
4752         * stress/fused-jstricteq-slow.js: Added.
4753         (shouldBe):
4754         (testJSTRICTEQ):
4755         (testJNSTRICTEQB):
4756         (testJSTRICTEQB):
4757         (testJNSTRICTEQF):
4758         (testJSTRICTEQF):
4759         * stress/fused-jstricteq.js: Added.
4760         (shouldBe):
4761         (testJSTRICTEQ):
4762         (testJNSTRICTEQB):
4763         (testJSTRICTEQB):
4764         (testJNSTRICTEQF):
4765         (testJSTRICTEQF):
4766
4767 2018-03-22  Yusuke Suzuki  <utatane.tea@gmail.com>
4768
4769         [JSC] Clear MustGenerate for ToString(Number) converted from NumberToStringWithRadix
4770         https://bugs.webkit.org/show_bug.cgi?id=183559
4771
4772         Reviewed by Mark Lam.
4773
4774         * stress/double-to-string-in-loop-removed.js: Added.
4775         (test):
4776         * stress/int32-to-string-in-loop-removed.js: Added.
4777         (test):
4778         * stress/int52-to-string-in-loop-removed.js: Added.
4779         (test):
4780
4781 2018-03-22  Michael Saboff  <msaboff@apple.com>
4782
4783         Race Condition in arrayProtoFuncReverse() causes wrong results or crash
4784         https://bugs.webkit.org/show_bug.cgi?id=183901
4785
4786         Reviewed by Keith Miller.
4787
4788         New test.
4789
4790         * stress/array-reverse-doesnt-clobber.js: Added.
4791         (testArrayReverse):
4792         (createArrayOfArrays):
4793         (createArrayStorage):
4794
4795 2018-03-21  Filip Pizlo  <fpizlo@apple.com>
4796
4797         ScopedArguments should do poisoning and index masking
4798         https://bugs.webkit.org/show_bug.cgi?id=183863
4799
4800         Reviewed by Mark Lam.
4801
4802         Adds another stress test of scoped arguments.
4803
4804         * stress/scoped-arguments-test.js: Added.
4805         (foo):
4806
4807 2018-03-20  Saam Barati  <sbarati@apple.com>
4808
4809         We need to do proper bookkeeping of exitOK when inserting constants when sinking NewArrayBuffer
4810         https://bugs.webkit.org/show_bug.cgi?id=183795
4811         <rdar://problem/38298694>
4812
4813         Reviewed by JF Bastien.
4814
4815         * stress/sink-phantom-new-array-buffer-exit-ok.js: Added.
4816         (foo):
4817         (bar):
4818
4819 2018-03-16  Yusuke Suzuki  <utatane.tea@gmail.com>
4820
4821         [DFG][FTL] Add vectorLengthHint for NewArray
4822         https://bugs.webkit.org/show_bug.cgi?id=183694
4823
4824         Reviewed by Saam Barati.
4825
4826         * stress/vector-length-hint-array-constructor.js: Added.
4827         (shouldBe):
4828         (test):
4829         * stress/vector-length-hint-new-array.js: Added.
4830         (shouldBe):
4831         (test):
4832
4833 2018-03-13  Yusuke Suzuki  <utatane.tea@gmail.com>
4834
4835         [DFG][FTL] Make ArraySlice(0) code tight
4836         https://bugs.webkit.org/show_bug.cgi?id=183590
4837
4838         Reviewed by Saam Barati.
4839
4840         * stress/array-slice-with-zero.js: Added.
4841         (shouldBe):
4842         (test):
4843         (test2):
4844         * stress/array-slice-zero-args.js: Added.
4845         (shouldBe):
4846         (test):
4847
4848 2018-03-14  Caitlin Potter  <caitp@igalia.com>
4849
4850         [JSC] fix order of evaluation for ClassDefinitionEvaluation
4851         https://bugs.webkit.org/show_bug.cgi?id=183523
4852
4853         Reviewed by Keith Miller.
4854
4855         Computed property names need to be evaluated in source order during class
4856         definition evaluation, as it's observable (and specified to work this way).
4857
4858         This change improves compatibility with Chromium.
4859
4860         * stress/class_elements.js: Added.
4861         (test):
4862         (test.C.prototype.effect):
4863         (test.C.effect):
4864         (test.C.prototype.get effect):
4865         (test.C.prototype.set effect):
4866         (test.C):
4867
4868 2018-03-11  Yusuke Suzuki  <utatane.tea@gmail.com>
4869
4870         [DFG] AI should convert CreateThis to NewObject if the prototype object is proved
4871         https://bugs.webkit.org/show_bug.cgi?id=183310
4872
4873         Reviewed by Filip Pizlo.
4874
4875         * stress/ai-create-this-to-new-object-fire.js: Added.
4876         (assert):
4877         (test):
4878         (func):
4879         (check):
4880         (test.body.A):
4881         (test.body.B):
4882         (test.body):
4883         * stress/ai-create-this-to-new-object.js: Added.
4884         (assert):
4885         (test):
4886         (func):
4887         (check):
4888         (test.body.A):
4889         (test.body.B):
4890         (test.body):
4891
4892 2018-03-10  Yusuke Suzuki  <utatane.tea@gmail.com>
4893
4894         [FTL] Drop NewRegexp for String.prototype.match with RegExp + global flag
4895         https://bugs.webkit.org/show_bug.cgi?id=181848
4896
4897         Reviewed by Sam Weinig.
4898
4899         * microbenchmarks/regexp-u-global-es5.js: Added.
4900         (fn):
4901         * microbenchmarks/regexp-u-global-es6.js: Added.
4902         (fn):
4903         * stress/materialized-regexp-has-correct-last-index-set-by-match-at-osr-exit.js: Added.
4904         (shouldBe):
4905         (test):
4906         (i.switch):
4907         * stress/materialized-regexp-has-correct-last-index-set-by-match.js: Added.
4908         (shouldBe):
4909         (test):
4910
4911 2018-03-07  Dominik Infuehr  <dinfuehr@igalia.com>
4912
4913         Disable test stress/var-injection-cache-invalidation.js on systems with limited memory
4914         https://bugs.webkit.org/show_bug.cgi?id=183334
4915
4916         Reviewed by Žan Doberšek.
4917
4918         * stress/var-injection-cache-invalidation.js:
4919
4920 2018-03-06  Dominik Infuehr  <dinfuehr@igalia.com>
4921
4922         [ARM] Disable tests that run out of memory
4923         https://bugs.webkit.org/show_bug.cgi?id=182699
4924
4925         Reviewed by Žan Doberšek.
4926
4927         Skip tests that run of of memory. Do not run
4928         modules/module-jit-reachability.js without LLInt to prevent
4929         running out of executable memory.
4930
4931         * modules.yaml:
4932         * modules/module-jit-reachability.js:
4933         * stress/has-own-property-name-cache-string-keys.js:
4934         * stress/has-own-property-name-cache-symbol-keys.js:
4935
4936 2018-03-01  Yusuke Suzuki  <utatane.tea@gmail.com>
4937
4938         ASSERTION FAILED: matchContextualKeyword(m_vm->propertyNames->async)
4939         https://bugs.webkit.org/show_bug.cgi?id=183173
4940
4941         Reviewed by Saam Barati.
4942
4943         * stress/async-arrow-function-in-class-heritage.js: Added.
4944         (testSyntax):
4945         (testSyntaxError):
4946         (SyntaxError):
4947
4948 2018-03-01  Saam Barati  <sbarati@apple.com>
4949
4950         We need to clear cached structures when having a bad time
4951         https://bugs.webkit.org/show_bug.cgi?id=183256
4952         <rdar://problem/36245022>
4953
4954         Reviewed by Mark Lam.
4955
4956         * stress/having-a-bad-time-with-derived-arrays.js: Added.
4957         (assert):
4958         (defineSetter):
4959         (iterate):
4960         (doSlice):
4961
4962 2018-02-28  Yusuke Suzuki  <utatane.tea@gmail.com>
4963
4964         JSC crash with `import("")`
4965         https://bugs.webkit.org/show_bug.cgi?id=183175
4966
4967         Reviewed by Saam Barati.
4968
4969         * stress/import-with-empty-string.js: Added.
4970
4971 2018-02-27  Yusuke Suzuki  <utatane.tea@gmail.com>
4972
4973         Unreviewed, skip FTL tests if FTL is disabled
4974         https://bugs.webkit.org/show_bug.cgi?id=183071
4975
4976         * stress/has-indexed-property-array-storage-ftl.js:
4977         * stress/has-indexed-property-slow-put-array-storage-ftl.js:
4978
4979 2018-02-25  Yusuke Suzuki  <utatane.tea@gmail.com>
4980
4981         [FTL] Support PutByVal(ArrayStorage/SlowPutArrayStorage)
4982         https://bugs.webkit.org/show_bug.cgi?id=182965
4983
4984         Reviewed by Saam Barati.
4985
4986         * stress/put-by-val-array-storage.js: Added.
4987         (shouldBe):
4988         (testArrayStorageInBounds):
4989         * stress/put-by-val-direct-out-of-bounds-setter.js: Added.
4990         (shouldBe):
4991         (testInt32.createBuiltin):
4992         (set for):
4993         * stress/put-by-val-slow-put-array-storage.js: Added.
4994         (shouldBe):
4995         (testArrayStorageInBounds):
4996
4997 2018-02-26  Saam Barati  <sbarati@apple.com>
4998
4999         validateStackAccess should not validate if the offset is within the stack bounds
5000         https://bugs.webkit.org/show_bug.cgi?id=183067
5001         <rdar://problem/37749988>
5002
5003         Reviewed by Mark Lam.
5004
5005         * stress/dont-validate-stack-offset-in-b3-because-it-might-be-guarded-by-control-flow.js: Added.
5006         (assert):
5007         (test.a):
5008         (test.b):
5009         (test):
5010
5011 2018-02-26  Yusuke Suzuki  <utatane.tea@gmail.com>
5012
5013         Unreviewed, skip FTL tests if FTL is disabled
5014         https://bugs.webkit.org/show_bug.cgi?id=183071
5015
5016         * stress/has-indexed-property-array-storage-ftl.js:
5017         * stress/has-indexed-property-slow-put-array-storage-ftl.js:
5018
5019 2018-02-23  Saam Barati  <sbarati@apple.com>
5020
5021         Make Number.isInteger an intrinsic
5022         https://bugs.webkit.org/show_bug.cgi?id=183088
5023
5024         Reviewed by JF Bastien.
5025
5026         * stress/number-is-integer-intrinsic.js: Added.
5027
5028 2018-02-23  Oleksandr Skachkov  <gskachkov@gmail.com>
5029
5030         WebAssembly: cache memory address / size on instance
5031         https://bugs.webkit.org/show_bug.cgi?id=177305
5032
5033         Reviewed by JF Bastien.
5034
5035         * wasm/function-tests/memory-reuse.js: Added.
5036         (createWasmInstance):
5037         (doCheckTrap):
5038         (doMemoryGrow):
5039         (doCheck):
5040         (checkWasmInstancesWithSharedMemory):
5041
5042 2018-02-23  Yusuke Suzuki  <utatane.tea@gmail.com>
5043
5044         [JSC] Implement $vm.ftlTrue function for FTL testing
5045         https://bugs.webkit.org/show_bug.cgi?id=183071
5046
5047         Reviewed by Mark Lam.
5048
5049         * stress/dead-fiat-value-to-int52-then-exit-not-double.js:
5050         (foo):
5051         * stress/dead-fiat-value-to-int52-then-exit-not-int52.js:
5052         (foo):
5053         * stress/dead-fiat-value-to-int52.js:
5054         (foo):
5055         * stress/dead-osr-entry-value.js:
5056         (foo):
5057         * stress/fiat-value-to-int52-then-exit-not-double.js:
5058         (foo):
5059         * stress/fiat-value-to-int52-then-exit-not-int52.js:
5060         (foo):
5061         * stress/fiat-value-to-int52-then-fail-to-fold.js:
5062         (foo):
5063         * stress/fiat-value-to-int52-then-fold.js:
5064         (foo):
5065         * stress/fiat-value-to-int52.js:
5066         (foo):
5067         * stress/fold-based-on-int32-proof-mul-branch.js:
5068         (foo):
5069         * stress/fold-profiled-call-to-call.js:
5070         (foo):
5071         * stress/fold-to-double-constant-then-exit.js:
5072         (foo):
5073         * stress/fold-to-int52-constant-then-exit.js:
5074         (foo):
5075         * stress/fold-to-primitive-in-cfa.js:
5076         (foo):
5077         * stress/fold-to-primitive-to-identity-in-cfa.js:
5078         (foo):
5079         * stress/has-indexed-property-array-storage-ftl.js: Added.
5080         (shouldBe):
5081         (test1):
5082         (test2):
5083         * stress/has-indexed-property-slow-put-array-storage-ftl.js: Added.
5084         (shouldBe):
5085         (test1):
5086         (test2):
5087         * stress/int52-ai-add-then-filter-int32.js:
5088         (foo):
5089         * stress/int52-ai-mul-and-clean-neg-zero-then-filter-int32.js:
5090         (foo):
5091         * stress/int52-ai-mul-then-filter-int32.js:
5092         (foo):
5093         * stress/int52-ai-neg-then-filter-int32.js:
5094         (foo):
5095         * stress/int52-ai-sub-then-filter-int32.js:
5096         (foo):
5097         * stress/licm-pre-header-cannot-exit-nested.js:
5098         (foo):
5099         * stress/licm-pre-header-cannot-exit.js:
5100         (foo):
5101         * stress/sparse-array-entry-update-144067.js:
5102         (useMemoryToTriggerGCs):
5103         * stress/test-spec-misc.js:
5104         (foo):
5105         * stress/tricky-array-bounds-checks.js:
5106         (foo):
5107
5108 2018-02-22  Yusuke Suzuki  <utatane.tea@gmail.com>
5109
5110         [FTL] Support HasIndexedProperty for ArrayStorage and SlowPutArrayStorage
5111         https://bugs.webkit.org/show_bug.cgi?id=182792
5112
5113         Reviewed by Mark Lam.
5114
5115         * stress/has-indexed-property-array-storage.js: Added.
5116         (shouldBe):
5117         (test1):
5118         (test2):
5119         * stress/has-indexed-property-slow-put-array-storage.js: Added.
5120         (shouldBe):
5121         (test1):
5122         (test2):
5123
5124 2018-02-20  Saam Barati  <sbarati@apple.com>
5125
5126         DFG::VarargsForwardingPhase should eliminate getting argument length
5127         https://bugs.webkit.org/show_bug.cgi?id=182959
5128
5129         Reviewed by Keith Miller.
5130
5131         * microbenchmarks/forward-arguments-dont-escape-on-arguments-length.js: Added.
5132
5133 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
5134
5135         [FTL] Support ArrayPush for ArrayStorage
5136         https://bugs.webkit.org/show_bug.cgi?id=182782
5137
5138         Reviewed by Saam Barati.
5139
5140         Existing array-push-multiple-storage.js covers ArrayPush(ArrayStorage) multiple arguments case.
5141
5142         * stress/array-push-array-storage-beyond-int32.js: Added.
5143         (shouldBe):
5144         (test):
5145         * stress/array-push-array-storage.js: Added.
5146         (shouldBe):
5147         (test):
5148         * stress/array-push-multiple-array-storage-beyond-int32.js: Added.
5149         (shouldBe):
5150         (test):
5151         * stress/array-push-multiple-storage-continuous.js: Added.
5152         (shouldBe):
5153         (test):
5154
5155 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
5156
5157         [FTL] Support ArrayPop for ArrayStorage
5158         https://bugs.webkit.org/show_bug.cgi?id=182783
5159
5160         Reviewed by Saam Barati.
5161
5162         * stress/array-pop-array-storage.js: Added.
5163         (shouldBe):
5164         (test):
5165
5166 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
5167
5168         [FTL] Add Arrayify for ArrayStorage and SlowPutArrayStorage
5169         https://bugs.webkit.org/show_bug.cgi?id=182731
5170
5171         Reviewed by Saam Barati.
5172
5173         * stress/arrayify-array-storage-array.js: Added.
5174         (shouldBe):
5175         (testArrayStorage):
5176         * stress/arrayify-array-storage-non-array.js: Added.
5177         (shouldBe):
5178         (testArrayStorage):
5179         * stress/arrayify-array-storage.js: Added.
5180         (shouldBe):
5181         (testArrayStorage):
5182         * stress/arrayify-slow-put-array-storage-pass-array-storage.js: Added.
5183         (shouldBe):
5184         (testArrayStorage):
5185         * stress/arrayify-slow-put-array-storage.js: Added.
5186         (shouldBe):
5187         (testArrayStorage):
5188
5189 2018-02-19  Saam Barati  <sbarati@apple.com>
5190
5191         Don't use JSFunction's allocation profile when getting the prototype can be effectful
5192         https://bugs.webkit.org/show_bug.cgi?id=182942
5193         <rdar://problem/37584764>
5194
5195         Reviewed by Mark Lam.
5196
5197         * stress/get-prototype-create-this-effectful.js: Added.
5198
5199 2018-02-16  Saam Barati  <sbarati@apple.com>
5200
5201         Fix bugs from r228411
5202         https://bugs.webkit.org/show_bug.cgi?id=182851
5203         <rdar://problem/37577732>
5204
5205         Reviewed by JF Bastien.
5206
5207         * stress/constant-folding-phase-insert-check-handle-varargs.js: Added.
5208
5209 2018-02-15  Filip Pizlo  <fpizlo@apple.com>
5210
5211         Unreviewed, roll out r228366 since it did not progress anything.
5212
5213         * stress/gc-error-stack.js: Removed.
5214         * stress/no-gc-error-stack.js: Removed.
5215
5216 2018-02-15  Tomas Popela  <tpopela@redhat.com>
5217
5218         Many stress tests fail with JIT disabled
5219         https://bugs.webkit.org/show_bug.cgi?id=182730
5220
5221         Reviewed by Saam Barati.
5222
5223         These tests are broken by design if the JIT is disabled - they test
5224         the return value of numberOfDFGCompiles(), which is always set to
5225         1000000.0 in TestRunnerUtils.cpp and makes the tests to fail.
5226
5227         * stress/arith-abs-on-various-types.js:
5228         * stress/arith-abs-to-arith-negate-range-optimizaton.js:
5229         * stress/arith-acos-on-various-types.js:
5230         * stress/arith-acosh-on-various-types.js:
5231         * stress/arith-asin-on-various-types.js:
5232         * stress/arith-asinh-on-various-types.js:
5233         * stress/arith-atan-on-various-types.js:
5234         * stress/arith-atanh-on-various-types.js:
5235         * stress/arith-cbrt-on-various-types.js:
5236         * stress/arith-ceil-on-various-types.js:
5237         * stress/arith-clz32-on-various-types.js:
5238         * stress/arith-cos-on-various-types.js:
5239         * stress/arith-cosh-on-various-types.js:
5240         * stress/arith-expm1-on-various-types.js:
5241         * stress/arith-floor-on-various-types.js:
5242         * stress/arith-fround-on-various-types.js:
5243         * stress/arith-log-on-various-types.js:
5244         * stress/arith-log10-on-various-types.js:
5245         * stress/arith-log2-on-various-types.js:
5246         * stress/arith-negate-on-various-types.js:
5247         * stress/arith-round-on-various-types.js:
5248         * stress/arith-sin-on-various-types.js:
5249         * stress/arith-sinh-on-various-types.js:
5250         * stress/arith-sqrt-on-various-types.js:
5251         * stress/arith-tan-on-various-types.js:
5252         * stress/arith-tanh-on-various-types.js:
5253         * stress/arith-trunc-on-various-types.js:
5254         * stress/compare-strict-eq-on-various-types.js:
5255
5256 2018-02-14  Ryan Haddad  <ryanhaddad@apple.com>
5257
5258         Skip stress/new-largeish-contiguous-array-with-size.js on arm.
5259
5260         Unreviewed test gardening.
5261
5262         * stress/new-largeish-contiguous-array-with-size.js:
5263
5264 2018-02-14  Saam Barati  <sbarati@apple.com>
5265
5266         Setting a VMTrap shouldn't look at topCallFrame since that may imply we're in C code and holding the malloc lock
5267         https://bugs.webkit.org/show_bug.cgi?id=182801
5268
5269         Reviewed by Keith Miller.
5270
5271         * stress/watchdog-dont-malloc-when-in-c-code.js: Added.
5272
5273 2018-02-14  Ryan Haddad  <ryanhaddad@apple.com>
5274
5275         Skip JSC test stress/activation-sink-default-value-tdz-error.js on debug.
5276         https://bugs.webkit.org/show_bug.cgi?id=182526
5277
5278         Unreviewed test gardening.
5279
5280         * stress/activation-sink-default-value-tdz-error.js:
5281
5282 2018-02-13  Saam Barati  <sbarati@apple.com>
5283
5284         putDirectIndexSlowOrBeyondVectorLength needs to convert to dictionary indexing mode always if attributes are present
5285         https://bugs.webkit.org/show_bug.cgi?id=182755
5286         <rdar://problem/37080864>
5287
5288         Reviewed by Keith Miller.
5289
5290         * stress/always-enter-dictionary-indexing-mode-with-getter.js: Added.
5291         (test1.o.get 10005):
5292         (test1):
5293         (test2.o.get 1000):
5294         (test2):
5295
5296 2018-02-13  Caitlin Potter  <caitp@igalia.com>
5297
5298         [JSC] cache TaggedTemplate arrays by callsite rather than by contents
5299         https://bugs.webkit.org/show_bug.cgi?id=182717
5300
5301         Reviewed by Yusuke Suzuki.
5302
5303         https://github.com/tc39/ecma262/pull/890 imposes a change to template
5304         literals, to allow template callsite arrays to be collected when the
5305         code containing the tagged template call is collected. This spec change
5306         has received concensus and been ratified.
5307
5308         This change eliminates the eternal map associating template contents
5309         with arrays.
5310
5311         * stress/tagged-template-object-collect.js: Renamed from JSTests/stress/tagged-template-registry-key-collect.js.
5312         * stress/tagged-template-object.js: Renamed from JSTests/stress/tagged-template-registry-key.js.
5313         * stress/tagged-templates-identity.js:
5314         * stress/template-string-tags-eval.js:
5315         * test262.yaml:
5316
5317 2018-02-13  Yusuke Suzuki  <utatane.tea@gmail.com>
5318
5319         Support GetArrayLength on ArrayStorage in the FTL
5320         https://bugs.webkit.org/show_bug.cgi?id=182625
5321
5322         Reviewed by Saam Barati.
5323
5324         * stress/array-storage-length.js: Added.
5325         (shouldBe):
5326         (testInBound):
5327         (testUncountable):
5328         (testSlowPutInBound):
5329         (testSlowPutUncountable):
5330         * stress/undecided-length.js: Added.
5331         (shouldBe):
5332         (test2):
5333
5334 2018-02-12  Saam Barati  <sbarati@apple.com>
5335
5336         DFG::emitCodeToGetArgumentsArrayLength needs to handle NewArrayBuffer/PhantomNewArrayBuffer
5337         https://bugs.webkit.org/show_bug.cgi?id=182706
5338         <rdar://problem/36833681>
5339
5340         Reviewed by Filip Pizlo.
5341
5342         * stress/get-array-length-phantom-new-array-buffer.js: Added.
5343         (effects):
5344         (foo):
5345
5346 2018-02-09  Filip Pizlo  <fpizlo@apple.com>
5347
5348         Don't waste memory for error.stack
5349         https://bugs.webkit.org/show_bug.cgi?id=182656
5350
5351         Reviewed by Saam Barati.
5352
5353         Tests the policy.
5354
5355         * stress/gc-error-stack.js: Added. Shows that the GC forgets frames now.
5356         * stress/no-gc-error-stack.js: Added. Shows that the GC won't forget things if you ask for the stack.
5357
5358 2018-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
5359
5360         [JSC] Update Test262 to Feb 9 version
5361         https://bugs.webkit.org/show_bug.cgi?id=182468
5362
5363         Reviewed by Saam Barati.
5364
5365 2018-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
5366
5367         Unreviewed, fix invalid line terminator in old test262 file part 2
5368         https://bugs.webkit.org/show_bug.cgi?id=182468
5369
5370         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
5371
5372 2018-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
5373
5374         Unreviewed, fix invalid line terminator in old test262 file
5375         https://bugs.webkit.org/show_bug.cgi?id=182468
5376
5377         * test262/test/language/literals/regexp/7.8.5-1.js:
5378
5379 2018-02-06  Yusuke Suzuki  <utatane.tea@gmail.com>
5380
5381         [JSC] Implement Array.prototype.flatMap and Array.prototype.flatten
5382         https://bugs.webkit.org/show_bug.cgi?id=182440
5383
5384         Reviewed by Darin Adler.
5385
5386         * stress/array-flatmap.js: Added.
5387         (shouldBe):
5388         (shouldBeArray):
5389         (shouldThrow):
5390         (var):
5391         * stress/array-flatten.js: Added.
5392         (shouldBe):
5393         (shouldBeArray):
5394         * test262.yaml:
5395         * test262/test/built-ins/Array/prototype/flatMap/depth-always-one.js:
5396         (3.flatMap):
5397         Pick test262 82c6148980332febe92a544a1fb653718e9fdb57 change.
5398
5399 2018-02-06  Keith Miller  <keith_miller@apple.com>
5400
5401         put_to_scope/get_from_scope should not cache lexical scopes when expecting a global object
5402         https://bugs.webkit.org/show_bug.cgi?id=182549
5403         <rdar://problem/36189995>
5404
5405         Reviewed by Saam Barati.
5406
5407         * stress/var-injection-cache-invalidation.js: Added.
5408         (allocateLotsOfThings):
5409         (test):
5410
5411 2018-02-03  Yusuke Suzuki  <utatane.tea@gmail.com>
5412
5413         Unreviewed, follow up for test262 update
5414         https://bugs.webkit.org/show_bug.cgi?id=182288
5415
5416         * test262.yaml:
5417
5418 2018-02-02  Ryan Haddad  <ryanhaddad@apple.com>
5419
5420         Update test262 to Jan 30 version
5421         https://bugs.webkit.org/show_bug.cgi?id=182288
5422
5423         Unreviewed test gardening.
5424
5425         * test262.yaml: Remove entry for missing test language/expressions/assignment/white-space.js
5426
5427 2018-02-02  Saam Barati  <sbarati@apple.com>
5428
5429         When BytecodeParser inserts Unreachable after ForceOSRExit it needs to update ArgumentPositions for Flushes it inserts
5430         https://bugs.webkit.org/show_bug.cgi?id=182368
5431         <rdar://problem/36932466>
5432
5433         Reviewed by Mark Lam.
5434
5435         * stress/flush-after-force-exit-in-bytecodeparser-needs-to-update-argument-positions.js: Added.
5436         (runNearStackLimit.t):
5437         (runNearStackLimit):
5438         (try.runNearStackLimit):
5439         (catch):
5440
5441 2018-02-02  Yusuke Suzuki  <utatane.tea@gmail.com>
5442
5443         Update test262 to Jan 30 version
5444         https://bugs.webkit.org/show_bug.cgi?id=182288
5445
5446         Rubber stamped by Saam Barati.
5447
5448         This patch updates test262 to the latest one, Jan 30 version.
5449         Since added and changed files are too many, we cannot create ChangeLog.
5450         The following files are changed.
5451
5452         Several files are intentionally omitted due to merge failures. We should investigate how to merge files
5453         including some special line terminators (like u2028, u2029).
5454
5455         * test262.yaml:
5456         * test262/test262-Revision.txt:
5457         * test262/*:
5458
5459 2018-02-02  Guillaume Emont  <guijemont@igalia.com>
5460
5461         JSTests: Skip mozilla/js1_5/Array/regress-157652.js on all memory limited platforms
5462         https://bugs.webkit.org/show_bug.cgi?id=182411
5463
5464         Reviewed by Carlos Alberto Lopez Perez.
5465
5466         This is skipped only on arm memory limited platforms. Until recently
5467         it was not a problem on MIPS as the butterfly was not initialized. But
5468         since r227435, the butterfly is initialized in that test and therefore
5469         memory is allocated, and the test typically takes around 512M, which
5470         means it generally gets OOM-killed on the MIPS buildbot.
5471
5472         * mozilla/mozilla-tests.yaml:
5473
5474 2018-02-01  Mark Lam  <mark.lam@apple.com>
5475
5476         Fix broken bounds check in FTL's compileGetMyArgumentByVal().
5477         https://bugs.webkit.org/show_bug.cgi?id=182419
5478         <rdar://problem/37044945>
5479
5480         Reviewed by Saam Barati.
5481
5482         * stress/regress-182419.js: Added.
5483
5484 2018-02-01  Keith Miller  <keith_miller@apple.com>
5485
5486         Fix crashes due to mishandling custom sections.
5487         https://bugs.webkit.org/show_bug.cgi?id=182404
5488         <rdar://problem/36935863>
5489
5490         Reviewed by Saam Barati.
5491
5492         * wasm/Builder.js:
5493         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
5494         * wasm/js-api/validate.js:
5495         (assert.truthy):
5496
5497 2018-01-31  Saam Barati  <sbarati@apple.com>
5498
5499         JSC incorrectly interpreting script, sets Global Property instead of Global Lexical variable (LiteralParser / JSONP path)
5500         https://bugs.webkit.org/show_bug.cgi?id=182074
5501         <rdar://problem/36846261>
5502
5503         Reviewed by Mark Lam.
5504
5505         * stress/jsonp-program-evaluate-path-must-consider-global-lexical-environment.js: Added.
5506         (assert):
5507         (let.func):
5508         (let.o.foo):
5509         (varFunc):
5510
5511 2018-01-30  Yusuke Suzuki  <utatane.tea@gmail.com>
5512
5513         Unreviewed, update test262 expects
5514         https://bugs.webkit.org/show_bug.cgi?id=182232
5515
5516         * test262.yaml:
5517
5518 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
5519
5520         [JSC] Implement trimStart and trimEnd
5521         https://bugs.webkit.org/show_bug.cgi?id=182233
5522
5523         Reviewed by Mark Lam.
5524
5525         * stress/trim.js: Added.
5526         (shouldBe):
5527         (startTest):
5528         (endTest):
5529         (trimTest):
5530
5531 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
5532
5533         [JSC] Relax line terminators in String to make JSON subset of JS
5534         https://bugs.webkit.org/show_bug.cgi?id=182232
5535
5536         Reviewed by Keith Miller.
5537
5538         * ChakraCore/test/es5/Lex_u3.baseline-jsc:
5539         * stress/relaxed-line-terminators-in-string.js: Added.
5540         (shouldBe):
5541
5542 2018-01-29  Michael Saboff  <msaboff@apple.com>
5543
5544         REGRESSION (r227341): DFG_ASSERT failure at JSC::DFG::AtTailAbstractState::forNode()
5545         https://bugs.webkit.org/show_bug.cgi?id=182249
5546
5547         Reviewed by Keith Miller.
5548
5549         New regression test.
5550
5551         * stress/compare-clobber-untypeduse.js: Added.
5552
5553 2018-01-29  Matt Lewis  <jlewis3@apple.com>
5554
5555         Unreviewed, rolling out r227725.
5556
5557         This caused internal failures.
5558
5559         Reverted changeset:
5560
5561         "JSC Sampling Profiler: Detect tester and testee when sampling
5562         in RegExp JIT"
5563         https://bugs.webkit.org/show_bug.cgi?id=152729
5564         https://trac.webkit.org/changeset/227725
5565
5566 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
5567
5568         JSC Sampling Profiler: Detect tester and testee when sampling in RegExp JIT
5569         https://bugs.webkit.org/show_bug.cgi?id=152729
5570
5571         Reviewed by Saam Barati.
5572
5573         * stress/sampling-profiler-regexp.js: Added.
5574         (platformSupportsSamplingProfiler.test):
5575         (platformSupportsSamplingProfiler.baz):
5576         (platformSupportsSamplingProfiler):
5577
5578 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
5579
5580         [DFG][FTL] WeakMap#set should have DFG node
5581         https://bugs.webkit.org/show_bug.cgi?id=180015
5582
5583         Reviewed by Saam Barati.
5584
5585         * stress/weakmap-set-change-get.js: Added.
5586         (shouldBe):
5587         (test):
5588         * stress/weakmap-set-cse.js: Added.
5589         (shouldBe):
5590         (test):
5591         * stress/weakset-add-change-get.js: Added.
5592         (shouldBe):
5593         * stress/weakset-add-cse.js: Added.
5594         (shouldBe):
5595
5596 2018-01-27  Yusuke Suzuki  <utatane.tea@gmail.com>
5597
5598         DFG strength reduction fails to convert NumberToStringWithValidRadixConstant for 0 to constant '0'
5599         https://bugs.webkit.org/show_bug.cgi?id=182213
5600
5601         Reviewed by Mark Lam.
5602
5603         * stress/int32-min-to-string.js: Added.
5604         (shouldBe):
5605         (test2):
5606         (test4):
5607         (test8):
5608         (test16):
5609         (test32):
5610         * stress/zero-to-string.js: Added.
5611         (shouldBe):
5612         (test2):
5613         (test4):
5614         (test8):
5615         (test16):
5616         (test32):
5617
5618 2018-01-23  Yusuke Suzuki  <utatane.tea@gmail.com>
5619
5620         Add more module scope related tests with code evaluation by string
5621         https://bugs.webkit.org/show_bug.cgi?id=181983
5622
5623         Reviewed by Sam Weinig.
5624
5625         Add more module scope related tests. When the original tests are landed,
5626         we do not have browser integration. This patch adds more module scope tests
5627         with dynamically created script evaluation. We add tests with Function
5628         constructor, direct eval, indirect eval, setTimeout, setInterval, and event handlers.
5629
5630         * modules/scopes-eval.js: Added.
5631         (shouldBe):
5632         * modules/scopes.js:
5633         (shouldBe):
5634
5635 2018-01-23  Filip Pizlo  <fpizlo@apple.com>
5636
5637         Unreviewed, retire some microbenchmarks that are proportionately very slow. Benchmark running time should be proportional to their value. Microbenchmarks have little value, so they should be very fast.
5638
5639         * microbenchmarks/array-push-3.js: Removed.
5640         * microbenchmarks/bigswitch-indirect-symbol-or-undefined.js: Removed.
5641         * microbenchmarks/double-to-int32.js: Removed.
5642         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Removed.
5643         * microbenchmarks/ftl-polymorphic-bitand.js: Removed.
5644         * microbenchmarks/ftl-polymorphic-bitor.js: Removed.
5645         * microbenchmarks/ftl-polymorphic-bitxor.js: Removed.
5646         * microbenchmarks/ftl-polymorphic-lshift.js: Removed.
5647         * microbenchmarks/ftl-polymorphic-rshift.js: Removed.
5648         * microbenchmarks/ftl-polymorphic-sub.js: Removed.
5649         * microbenchmarks/ftl-polymorphic-urshift.js: Removed.
5650         * microbenchmarks/map-constant-key.js: Removed.
5651         * microbenchmarks/nested-function-parsing.js: Removed.
5652         * microbenchmarks/rest-parameter-allocation-elimination.js: Removed.
5653         * microbenchmarks/spread-large-array.js: Removed.
5654         * microbenchmarks/string-add-constant-folding.js: Removed.
5655         * microbenchmarks/to-lower-case.js: Removed.
5656         * microbenchmarks/undefined-property-access.js: Removed.
5657         * slowMicrobenchmarks/array-push-3.js: Copied from JSTests/microbenchmarks/array-push-3.js.
5658         * slowMicrobenchmarks/bigswitch-indirect-symbol-or-undefined.js: Copied from JSTests/microbenchmarks/bigswitch-indirect-symbol-or-undefined.js.
5659         * slowMicrobenchmarks/double-to-int32.js: Copied from JSTests/microbenchmarks/double-to-int32.js.
5660         * slowMicrobenchmarks/fake-iterators-that-throw-when-finished.js: Copied from JSTests/microbenchmarks/fake-iterators-that-throw-when-finished.js.
5661         * slowMicrobenchmarks/ftl-polymorphic-bitand.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitand.js.
5662         * slowMicrobenchmarks/ftl-polymorphic-bitor.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitor.js.
5663         * slowMicrobenchmarks/ftl-polymorphic-bitxor.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitxor.js.
5664         * slowMicrobenchmarks/ftl-polymorphic-lshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-lshift.js.
5665         * slowMicrobenchmarks/ftl-polymorphic-rshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-rshift.js.
5666         * slowMicrobenchmarks/ftl-polymorphic-sub.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-sub.js.
5667         * slowMicrobenchmarks/ftl-polymorphic-urshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-urshift.js.
5668         * slowMicrobenchmarks/map-constant-key.js: Copied from JSTests/microbenchmarks/map-constant-key.js.
5669         * slowMicrobenchmarks/nested-function-parsing.js: Copied from JSTests/microbenchmarks/nested-function-parsing.js.
5670         * slowMicrobenchmarks/rest-parameter-allocation-elimination.js: Copied from JSTests/microbenchmarks/rest-parameter-allocation-elimination.js.
5671         * slowMicrobenchmarks/spread-large-array.js: Copied from JSTests/microbenchmarks/spread-large-array.js.
5672         * slowMicrobenchmarks/string-add-constant-folding.js: Copied from JSTests/microbenchmarks/string-add-constant-folding.js.
5673         * slowMicrobenchmarks/to-lower-case.js: Copied from JSTests/microbenchmarks/to-lower-case.js.
5674         * slowMicrobenchmarks/undefined-property-access.js: Copied from JSTests/microbenchmarks/undefined-property-access.js.
5675
5676 2018-01-23  Robin Morisset  <rmorisset@apple.com>
5677
5678         Update the argument count in DFGByteCodeParser::handleRecursiveCall
5679         https://bugs.webkit.org/show_bug.cgi?id=181739
5680         <rdar://problem/36627662>
5681
5682         Reviewed by Saam Barati.
5683
5684         * stress/recursive-tail-call-with-different-argument-count.js: Added.
5685         (foo):
5686         (bar):
5687
5688 2018-01-22  Michael Saboff  <msaboff@apple.com>
5689
5690         DFG abstract interpreter needs to properly model effects of some Math ops
5691         https://bugs.webkit.org/show_bug.cgi?id=181886
5692
5693         Reviewed by Saam Barati.
5694
5695         New regression test.
5696
5697         * stress/arith-nodes-abstract-interpreter-untypeduse.js: Added.
5698         (test):
5699
5700 2018-01-20  Caio Lima  <ticaiolima@gmail.com>
5701
5702         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
5703         https://bugs.webkit.org/show_bug.cgi?id=181182
5704
5705         Reviewed by Darin Adler.
5706
5707         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
5708         * stress/big-int-prototype-to-string-exception.js: Added.
5709         * stress/big-int-prototype-to-string-wrong-values.js: Added.
5710         * stress/number-prototype-to-string-cast-overflow.js: Added.
5711         * stress/number-prototype-to-string-exception.js: Added.
5712         * stress/number-prototype-to-string-wrong-values.js: Added.
5713
5714 2018-01-19  Ryan Haddad  <ryanhaddad@apple.com>
5715
5716         Disable Atomics when SharedArrayBuffer isn’t enabled
5717         https://bugs.webkit.org/show_bug.cgi?id=181572
5718
5719         Unreviewed test gardening.
5720
5721         * test262.yaml: Skip tests that fail after this change.
5722
5723 2018-01-19  Saam Barati  <sbarati@apple.com>
5724
5725         Kill ArithNegate's ArithProfile assert inside BytecodeParser
5726         https://bugs.webkit.org/show_bug.cgi?id=181877
5727         <rdar://problem/36630552>
5728
5729         Reviewed by Mark Lam.
5730
5731         * stress/arith-profile-for-negate-can-see-non-number-due-to-dfg-osr-exit-profiling.js: Added.
5732         (runNearStackLimit):
5733         (f1):
5734         (f2):
5735         (f3):
5736         (i.catch):
5737         (i.try.runNearStackLimit):
5738         (catch):
5739
5740 2018-01-19  Saam Barati  <sbarati@apple.com>
5741
5742         Spread's effects are modeled incorrectly both in AI and in Clobberize
5743         https://bugs.webkit.org/show_bug.cgi?id=181867
5744         <rdar://problem/36290415>
5745
5746         Reviewed by Michael Saboff.
5747
5748         * stress/ai-needs-to-model-spreads-effects.js: Added.
5749         (try.p.Symbol.iterator):
5750         (try.go):
5751         (catch):
5752         * stress/clobberize-needs-to-model-spread-effects.js: Added.
5753         (assert):
5754         (foo):
5755         (a.Symbol.iterator):
5756
5757 2018-01-19  Yusuke Suzuki  <utatane.tea@gmail.com>
5758
5759         Unreviewed, reduce count of iteration to fix timing out debug JSC test
5760         https://bugs.webkit.org/show_bug.cgi?id=181535
5761
5762         * stress/inserted-recovery-with-set-last-index.js:
5763
5764 2018-01-17  Yusuke Suzuki  <utatane.tea@gmail.com>
5765
5766         [DFG][FTL] Introduce PhantomNewRegexp and RegExpExecNonGlobalOrSticky
5767         https://bugs.webkit.org/show_bug.cgi?id=181535
5768
5769         Reviewed by Saam Barati.
5770
5771         * stress/inserted-recovery-with-set-last-index.js: Added.
5772         (shouldBe):
5773         (foo):
5774         * stress/materialize-regexp-at-osr-exit.js: Added.
5775         (shouldBe):
5776         (test):
5777         * stress/materialize-regexp-cyclic-regexp-at-osr-exit.js: Added.
5778         (shouldBe):
5779         (test):
5780         * stress/materialize-regexp-cyclic-regexp.js: Added.
5781         (shouldBe):
5782         (test):
5783         (i.switch):
5784         * stress/materialize-regexp-cyclic.js: Added.
5785         (shouldBe):
5786         (test):
5787         (i.switch):
5788         * stress/materialize-regexp-referenced-from-phantom-regexp-cyclic.js: Added.
5789         (bar):
5790         (foo):
5791         (test):
5792         * stress/materialize-regexp-referenced-from-phantom-regexp.js: Added.
5793         (bar):
5794         (foo):
5795         (test):
5796         * stress/materialize-regexp.js: Added.
5797         (shouldBe):
5798         (test):
5799         * stress/phantom-regexp-regexp-exec.js: Added.
5800         (shouldBe):
5801         (test):
5802         * stress/phantom-regexp-string-match.js: Added.
5803         (shouldBe):
5804         (test):
5805         * stress/regexp-last-index-sinking.js: Added.
5806         (shouldBe):
5807         (test):
5808
5809 2018-01-17  Saam Barati  <sbarati@apple.com>
5810
5811         Disable Atomics when SharedArrayBuffer isn’t enabled
5812         https://bugs.webkit.org/show_bug.cgi?id=181572
5813         <rdar://problem/36553206>
5814
5815         Reviewed by Michael Saboff.
5816
5817         * stress/isLockFree.js:
5818
5819 2018-01-17  Saam Barati  <sbarati@apple.com>
5820
5821         DFG::Node::convertToConstant needs to clear the varargs flags
5822         https://bugs.webkit.org/show_bug.cgi?id=181697
5823         <rdar://problem/36497332>
5824
5825         Reviewed by Yusuke Suzuki.
5826
5827         * stress/dfg-node-convert-to-constant-must-clear-varargs-flags.js: Added.
5828         (doIndexOf):
5829         (bar):
5830         (i.bar):
5831
5832 2018-01-16  Ryan Haddad  <ryanhaddad@apple.com>
5833
5834         Unreviewed, rolling out r226937.
5835
5836         Tests added with this change are failing due to a missing
5837         exception check.
5838
5839         Reverted changeset:
5840
5841         "[JSC] NumberPrototype::extractRadixFromArgs incorrectly cast
5842         double to int32_t"
5843         https://bugs.webkit.org/show_bug.cgi?id=181182
5844         https://trac.webkit.org/changeset/226937
5845
5846 2018-01-13  Caio Lima  <ticaiolima@gmail.com>
5847
5848         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
5849         https://bugs.webkit.org/show_bug.cgi?id=181182
5850
5851         Reviewed by Darin Adler.
5852
5853         * bigIntTests.yaml:
5854         * stress/big-int-constructor.js:
5855         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
5856         (assert):
5857         (assertThrowRangeError):
5858         * stress/number-prototype-to-string-cast-overflow.js: Added.
5859         (assert):
5860         (assertThrowRangeError):
5861
5862 2018-01-12  Saam Barati  <sbarati@apple.com>
5863
5864         CheckStructure can be incorrectly subsumed by CheckStructureOrEmpty
5865         https://bugs.webkit.org/show_bug.cgi?id=181177
5866         <rdar://problem/36205704>
5867
5868         Reviewed by Yusuke Suzuki.
5869
5870         * stress/check-structure-ir-ensures-empty-does-not-flow-through.js: Added.
5871         (runNearStackLimit.t):
5872         (runNearStackLimit):
5873         (test.f):
5874         (test):
5875
5876 2018-01-12  Saam Barati  <sbarati@apple.com>
5877
5878         Each variant of a polymorphic inlined call should be exitOK at the top of the block
5879         https://bugs.webkit.org/show_bug.cgi?id=181562
5880         <rdar://problem/36445624>
5881
5882         Reviewed by Yusuke Suzuki.
5883
5884         * stress/each-block-at-top-of-polymorphic-call-inlining-should-be-exitOK.js: Added.
5885         (f):
5886         (foo):
5887
5888 2018-01-11  Saam Barati  <sbarati@apple.com>
5889
5890         When inserting Unreachable in byte code parser we need to flush all the right things
5891         https://bugs.webkit.org/show_bug.cgi?id=181509
5892         <rdar://problem/36423110>
5893
5894         Reviewed by Mark Lam.
5895
5896         * stress/proper-flushing-when-we-insert-unreachable-after-force-exit-in-bytecode-parser.js: Added.
5897
5898 2018-01-11  Saam Barati  <sbarati@apple.com>
5899
5900         JITMathIC code in the FTL is wrong when code gets duplicated
5901         https://bugs.webkit.org/show_bug.cgi?id=181525
5902         <rdar://problem/36351993>
5903
5904         Reviewed by Michael Saboff and Keith Miller.
5905
5906         * stress/allow-math-ic-b3-code-duplication.js: Added.
5907
5908 2018-01-11  Saam Barati  <sbarati@apple.com>
5909
5910         Our for-in caching is wrong when we add indexed properties on things in the prototype chain
5911         https://bugs.webkit.org/show_bug.cgi?id=181508
5912
5913         Reviewed by Yusuke Suzuki.
5914
5915         * stress/for-in-prototype-with-indexed-properties-should-prevent-caching.js: Added.
5916         (assert):
5917         (test1.foo):
5918         (test1):
5919         (test2.foo):
5920         (test2):
5921
5922 2018-01-09  Mark Lam  <mark.lam@apple.com>
5923
5924         ASSERTION FAILED: pair.second->m_type & PropertyNode::Getter
5925         https://bugs.webkit.org/show_bug.cgi?id=181388
5926         <rdar://problem/36349351>
5927
5928         Reviewed by Saam Barati.
5929
5930         * stress/regress-181388.js: Added.
5931
5932 2018-01-08  JF Bastien  <jfbastien@apple.com>
5933
5934         WebAssembly: mask indexed accesses to Table
5935         https://bugs.webkit.org/show_bug.cgi?id=181412
5936         <rdar://problem/36363236>
5937
5938         Reviewed by Saam Barati.
5939
5940         Update error messages.
5941
5942         * wasm/js-api/table.js:
5943         (assert.throws.WebAssembly.Table.prototype.grow):
5944
5945 2018-01-08  Ryan Haddad  <ryanhaddad@apple.com>
5946
5947         Disable SharedArrayBuffer tests missed in r226386.
5948         https://bugs.webkit.org/show_bug.cgi?id=181266
5949
5950         Unreviewed test gardening.
5951
5952         * test262.yaml:
5953
5954 2018-01-06  Yusuke Suzuki  <utatane.tea@gmail.com>
5955
5956         Object.getOwnPropertyNames includes "arguments" and "caller" for bound functions
5957         https://bugs.webkit.org/show_bug.cgi?id=181321
5958
5959         Reviewed by Saam Barati.
5960
5961         * stress/bound-function-does-not-have-caller-and-arguments.js: Added.
5962         (shouldBe):
5963         (testFunction):
5964         * test262.yaml:
5965
5966 2018-01-05  Ryan Haddad  <ryanhaddad@apple.com>
5967
5968         Unreviewed, attempt to fix test262 after r226386.
5969
5970         * test262.yaml:
5971
5972 2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>
5973
5974         [DFG] Define defs for MapSet/SetAdd to participate in CSE
5975         https://bugs.webkit.org/show_bug.cgi?id=179911
5976
5977         Reviewed by Saam Barati.
5978
5979         In addition to these tests, map-set-cse.js and set-add-cse.js work.
5980
5981         * stress/map-set-change-get.js: Added.
5982         (shouldBe):
5983         (test):
5984         * stress/map-set-create-bucket.js: Added.
5985         (shouldBe):
5986         (test):
5987         * stress/set-add-create-bucket.js: Added.
5988         (shouldBe):
5989
5990 2018-01-03  Michael Saboff  <msaboff@apple.com>
5991
5992         Disable SharedArrayBuffers from Web API
5993         https://bugs.webkit.org/show_bug.cgi?id=181266
5994
5995         Reviewed by Saam Barati.
5996
5997         Disabled SharedArrayBuffer tests.
5998
5999         * stress/SharedArrayBuffer-opt.js:
6000         * stress/SharedArrayBuffer.js:
6001         * stress/array-buffer-byte-length.js:
6002         * stress/atomics-add-uint32.js:
6003         * stress/atomics-known-int-use.js:
6004         * stress/atomics-neg-zero.js:
6005         * stress/atomics-store-return.js:
6006         * stress/lars-sab-workers.js:
6007         * stress/regress-159779-1.js:
6008         * stress/regress-159779-2.js:
6009         * stress/regress-170473.js:
6010         * test262.yaml:
6011
6012 2018-01-03  Caio Lima  <ticaiolima@gmail.com>
6013
6014         [ESNext][BigInt] Failing test stress/big-int-constructor-oom.js into MIPS
6015         https://bugs.webkit.org/show_bug.cgi?id=181258
6016
6017         Reviewed by Antonio Gomes.
6018
6019         * stress/big-int-constructor-gc.js:
6020         * stress/big-int-constructor-oom.js:
6021
6022 2018-01-03  Robin Morisset  <rmorisset@apple.com>
6023
6024         Inlining of a function that ends in op_unreachable crashes
6025         https://bugs.webkit.org/show_bug.cgi?id=181027
6026
6027         Reviewed by Filip Pizlo.
6028
6029         * stress/inlining-unreachable.js: Added.
6030         (bar):
6031         (baz):
6032         (i.catch):
6033
6034 2018-01-02  Saam Barati  <sbarati@apple.com>
6035
6036         Incorrect assertion inside AccessCase
6037         https://bugs.webkit.org/show_bug.cgi?id=181200
6038         <rdar://problem/35494754>
6039
6040         Reviewed by Yusuke Suzuki.
6041
6042         * stress/setter-same-base-and-rhs-invalid-assertion-inside-access-case.js: Added.
6043         (ctor):
6044         (theFunc):
6045         (run):
6046
6047 2018-01-02  Caio Lima  <ticaiolima@gmail.com>
6048
6049         [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
6050         https://bugs.webkit.org/show_bug.cgi?id=175359
6051
6052         Reviewed by Yusuke Suzuki.
6053
6054         * bigIntTests.yaml:
6055         * stress/big-int-as-key.js: Added.
6056         * stress/big-int-constructor-gc.js: Added.
6057         * stress/big-int-constructor-oom.js: Added.
6058         * stress/big-int-constructor-properties.js: Added.
6059         * stress/big-int-constructor-prototype-prop-descriptor.js: Added.
6060         * stress/big-int-constructor-prototype.js: Added.
6061         * stress/big-int-constructor.js: Added.
6062         * stress/big-int-function-apply.js:
6063         * stress/big-int-length.js: Added.
6064         * stress/big-int-prop-descriptor.js: Added.
6065         * stress/big-int-proto-constructor.js: Added.
6066         * stress/big-int-proto-name.js: Added.
6067         * stress/big-int-prototype-properties.js: Added.
6068         * stress/big-int-prototype-proto.js: Added.
6069         * stress/big-int-prototype-value-of.js: Added.
6070         * stress/big-int-prototype-symbol-to-string-tag.js: Added.
6071         * stress/big-int-prototype-to-string-apply.js: Added.
6072         * stress/big-int-to-object.js: Added.
6073         * stress/big-int-to-string.js: Added.
6074
6075 2017-12-28  Saam Barati  <sbarati@apple.com>
6076
6077         Assertion used to determine if something is an async generator is wrong
6078         https://bugs.webkit.org/show_bug.cgi?id=181168
6079         <rdar://problem/35640560>
6080
6081         Reviewed by Yusuke Suzuki.
6082
6083         * stress/async-generator-assertion.js: Added.
6084
6085 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
6086
6087         Skip stress/splay-flash-access tests on memory limited platforms
6088         https://bugs.webkit.org/show_bug.cgi?id=181086
6089
6090         Reviewed by Carlos Alberto Lopez Perez.
6091
6092         These tests use about 185M of memory, and occasionally get OOM-killed
6093         on memory limited platforms.
6094
6095         * stress/splay-flash-access-1ms.js:
6096         * stress/splay-flash-access.js:
6097
6098 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
6099
6100         Skip slow jsc tests on embedded platforms
6101         https://bugs.webkit.org/show_bug.cgi?id=180937
6102
6103         Reviewed by Carlos Alberto Lopez Perez.
6104
6105         The tests typeProfiler/deltablue-for-of.js and
6106         typeProfiler/getter-richards.js take a very long time in the
6107         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
6108         thus always timeout. They should be skipped on these platforms.
6109
6110         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
6111         * typeProfiler/getter-richards.js: Skip on arm*/mips.
6112
6113 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
6114
6115         [JSC] Do not check isValid() in op_new_regexp
6116         https://bugs.webkit.org/show_bug.cgi?id=180970
6117
6118         Reviewed by Saam Barati.
6119
6120         * stress/regexp-syntax-error-invalid-flags.js: Added.
6121         (shouldThrow):
6122
6123 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
6124
6125         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
6126         https://bugs.webkit.org/show_bug.cgi?id=180712
6127
6128         Reviewed by Michael Catanzaro.
6129
6130         stress/call-apply-exponential-bytecode-size.js crashes if the
6131         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
6132         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
6133         should skip the test on other platforms.
6134
6135         * stress/call-apply-exponential-bytecode-size.js:
6136
6137 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
6138
6139         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
6140         https://bugs.webkit.org/show_bug.cgi?id=179762
6141
6142         Reviewed by Saam Barati.
6143
6144         * stress/call-varargs-double-new-array-buffer.js: Added.
6145         (assert):
6146         (bar):
6147         (foo):
6148         * stress/call-varargs-spread-new-array-buffer.js: Added.
6149         (assert):
6150         (bar):
6151         (foo):
6152         * stress/call-varargs-spread-new-array-buffer2.js: Added.
6153         (assert):
6154         (bar):
6155         (foo):
6156         * stress/forward-varargs-double-new-array-buffer.js: Added.
6157         (assert):
6158         (test.baz):
6159         (test.bar):
6160         (test.foo):
6161         (test):
6162         * stress/new-array-buffer-sinking-osrexit.js: Added.
6163         (target):
6164         (test):
6165         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
6166         (shouldBe):
6167         (test):
6168         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
6169         (shouldBe):
6170         (target):
6171         (test):
6172         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
6173         (assert):
6174         (test1.bar):
6175         (test1.foo):
6176         (test1):
6177         (test2.bar):
6178         (test2.foo):
6179         (test3.baz):
6180         (test3.bar):
6181         (test3.foo):
6182         (test4.baz):
6183         (test4.bar):
6184         (test4.foo):
6185         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
6186         (assert):
6187         (test.baz):
6188         (test.bar):
6189         (test.foo):
6190         (test):
6191         * stress/phantom-new-array-buffer-osr-exit.js: Added.
6192         (assert):
6193         (baz):
6194         (bar):
6195         (effects):
6196         (foo):
6197
6198 2017-12-14  Saam Barati  <sbarati@apple.com>
6199
6200         The CleanUp after LICM is erroneously removing a Check
6201         https://bugs.webkit.org/show_bug.cgi?id=180852
6202         <rdar://problem/36063494>
6203
6204         Reviewed by Filip Pizlo.
6205
6206         * stress/dont-run-cleanup-after-licm.js: Added.
6207
6208 2017-12-14  Michael Saboff  <msaboff@apple.com>
6209
6210         REGRESSION (r225695): Repro crash on yahoo login page
6211         https://bugs.webkit.org/show_bug.cgi?id=180761
6212
6213         Reviewed by JF Bastien.
6214
6215         New regression test.
6216
6217         * stress/regress-180761.js: Added.
6218
6219 2017-12-13  Keith Miller  <keith_miller@apple.com>
6220
6221         JSObjects should have a mask for loading indexed properties
6222         https://bugs.webkit.org/show_bug.cgi?id=180768
6223
6224         Reviewed by Mark Lam.
6225
6226         * stress/int16-put-by-val-in-and-out-of-bounds.js:
6227         (test):
6228
6229 2017-12-13  Saam Barati  <sbarati@apple.com>
6230
6231         Arrow functions need their own structure because they have different properties than sloppy functions
6232         https://bugs.webkit.org/show_bug.cgi?id=180779
6233         <rdar://problem/35814591>
6234
6235         Reviewed by Mark Lam.
6236
6237         * stress/arrow-function-needs-its-own-structure.js: Added.
6238         (assert):
6239         (readPrototype):
6240         (noInline.let.f1):
6241         (noInline):
6242
6243 2017-12-13  Saam Barati  <sbarati@apple.com>
6244
6245         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
6246         https://bugs.webkit.org/show_bug.cgi?id=163579
6247         <rdar://problem/35455798>
6248
6249         Reviewed by Mark Lam.
6250
6251         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
6252         (assert):
6253         (test1):
6254         (i.test1):
6255         (i.test1.C):
6256         (i.test1.async.foo):
6257         (i.test1.foo):
6258         (test2):
6259
6260 2017-12-13  Saam Barati  <sbarati@apple.com>
6261
6262         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
6263         https://bugs.webkit.org/show_bug.cgi?id=180734
6264         <rdar://problem/35640547>
6265
6266         Reviewed by Yusuke Suzuki.
6267
6268         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
6269         (__isPropertyOfType):
6270         (__getProperties):
6271         (__getObjects):
6272         (__getRandomObject):
6273         (theClass.):
6274         (theClass):
6275         (childClass):
6276         (counter.catch):
6277
6278 2017-12-12  Saam Barati  <sbarati@apple.com>
6279
6280         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
6281         https://bugs.webkit.org/show_bug.cgi?id=180725
6282         <rdar://problem/35970511>
6283
6284         Reviewed by Michael Saboff.
6285
6286         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
6287         (f1):
6288         (f2):
6289         (let.o2.valueOf):
6290
6291 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
6292
6293         [JSC] Implement optimized WeakMap and WeakSet
6294         https://bugs.webkit.org/show_bug.cgi?id=179929
6295
6296         Reviewed by Saam Barati.
6297
6298         * microbenchmarks/weak-map-key.js:
6299         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
6300         (assert):
6301         (objectKey):
6302         (let.start.Date.now):
6303         * stress/basic-weakmap.js: Added.
6304         (shouldBe):
6305         (test):
6306         * stress/basic-weakset.js: Added.
6307         (shouldBe):
6308         (test.set new):
6309         * stress/weakmap-cse-set-break.js: Added.
6310         (shouldBe):
6311         (test):
6312         * stress/weakmap-cse.js: Added.
6313         (shouldBe):
6314         (test):
6315         * stress/weakmap-gc.js: Added.
6316         (test):
6317         * stress/weakset-cse-add-break.js: Added.
6318         (shouldBe):
6319         (test.set new):
6320         * stress/weakset-cse.js: Added.
6321         (shouldBe):
6322         (test.set new):
6323         * stress/weakset-gc.js: Added.
6324         (test.set add):
6325         (test.set new):
6326         (test):
6327
6328 2017-12-12  Saam Barati  <sbarati@apple.com>
6329
6330         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
6331         https://bugs.webkit.org/show_bug.cgi?id=180723
6332         <rdar://problem/35859726>
6333
6334         Reviewed by JF Bastien.
6335
6336         * stress/get-my-argument-by-val-constant-folding.js: Added.
6337         (test):
6338         (catch):
6339
6340 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
6341
6342         [ESNext][BigInt] Implement BigInt literals and JSBigInt
6343         https://bugs.webkit.org/show_bug.cgi?id=179000
6344
6345         Reviewed by Darin Adler and Yusuke Suzuki.
6346
6347         * bigIntTests.yaml: Added.
6348         * stress/big-int-literal-line-terminator.js: Added.
6349         * stress/big-int-literals.js: Added.
6350         * stress/big-int-operations-error.js: Added.
6351         * stress/big-int-type-of.js: Added.
6352         * stress/big-int-white-space-trailing-leading.js: Added.
6353         * stress/big-int-function-apply.js: Added.
6354
6355 2017-12-11  Saam Barati  <sbarati@apple.com>
6356
6357         We need to disableCaching() in ErrorInstance when we materialize properties
6358         https://bugs.webkit.org/show_bug.cgi?id=180343
6359         <rdar://problem/35833002>
6360
6361         Reviewed by Mark Lam.
6362
6363         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
6364         (assert):
6365         (makeError):
6366         (storeToStack):
6367         (storeToStackAlreadyMaterialized):
6368
6369 2017-12-05  JF Bastien  <jfbastien@apple.com>
6370
6371         WebAssembly: don't eagerly checksum
6372         https://bugs.webkit.org/show_bug.cgi?id=180441
6373         <rdar://problem/35156628>
6374
6375         Reviewed by Saam Barati.
6376
6377         Checksum is now disabled, so tests only have <?> as the module
6378         name.
6379
6380         * wasm/function-tests/nameSection.js:
6381         * wasm/function-tests/stack-overflow.js:
6382         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
6383         (assertOverflows.assertThrows):
6384         (assertOverflows):
6385         * wasm/function-tests/stack-trace.js:
6386
6387 2017-12-04  JF Bastien  <jfbastien@apple.com>
6388
6389         Proxy all functions, except the $ objects
6390         https://bugs.webkit.org/show_bug.cgi?id=180375
6391
6392         Reviewed by Saam Barati.
6393
6394         It looks like this test may have broken some executions because I
6395         call some internal objects. Explicitly ignore objects whose name
6396         starts with "$" because it's a bad idea anyways.
6397
6398         * stress/proxy-all-the-parameters.js:
6399         (generateObjects):
6400         (get throw):
6401
6402 2017-12-04  Saam Barati  <sbarati@apple.com>
6403
6404         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
6405         https://bugs.webkit.org/show_bug.cgi?id=180366
6406         <rdar://problem/35685877>
6407
6408         Reviewed by Michael Saboff.
6409
6410         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
6411         (theParent):
6412         (test1.base.getParentStaticValue):
6413         (test1.base):
6414         (test1.__v_24888.prototype.set prop):
6415         (test1.__v_24888):
6416         (test2.base.getParentStaticValue):
6417         (test2.base):
6418         (test2.__v_24888.prototype.set prop):
6419         (test2.__v_24888):
6420         (test2):
6421
6422 2017-12-01  JF Bastien  <jfbastien@apple.com>
6423
6424         Try proxying all function arguments
6425         https://bugs.webkit.org/show_bug.cgi?id=180306
6426
6427         Reviewed by Saam Barati.
6428
6429         * stress/proxy-all-the-parameters.js: Added.
6430         (isPropertyOfType):
6431         (getProperties):
6432         (generateObjects):
6433         (getObjects):
6434         (getFunctions):
6435         (get throw):
6436         (let.o.of.getObjects.let.f.of.getFunctions.catch):
6437
6438 2017-12-01  JF Bastien  <jfbastien@apple.com>
6439
6440         JavaScriptCore: missing exception checks in Math functions that take more than one argument
6441         https://bugs.webkit.org/show_bug.cgi?id=180297
6442         <rdar://problem/35745556>
6443
6444         Reviewed by Mark Lam.
6445
6446         * stress/math-exceptions.js: Added.
6447         (get try):
6448         (catch):
6449
6450 2017-12-01  JF Bastien  <jfbastien@apple.com>
6451
6452         JavaScriptCore: add test for weird class static getters
6453         https://bugs.webkit.org/show_bug.cgi?id=180281
6454         <rdar://problem/35592139>
6455
6456         Reviewed by Mark Lam.
6457
6458         I fixed a bug for it in r224927 and didn't add a test. Do so.
6459
6460         * stress/class-static-get-weird.js: Added.
6461         (c.prototype.get name):
6462         (c):
6463         (c.prototype.get arguments):
6464         (c.prototype.get caller):
6465         (c.prototype.get length):
6466
6467 2017-12-01  Saam Barati  <sbarati@apple.com>
6468
6469         Having a bad time needs to handle ArrayClass indexing type as well
6470         https://bugs.webkit.org/show_bug.cgi?id=180274
6471         <rdar://problem/35667869>
6472
6473         Reviewed by Keith Miller and Mark Lam.
6474
6475         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
6476         (assert):
6477         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
6478         (assert):
6479
6480 2017-12-01  JF Bastien  <jfbastien@apple.com>
6481
6482         WebAssembly: restore cached stack limit after out-call
6483         https://bugs.webkit.org/show_bug.cgi?id=179106
6484         <rdar://problem/35337525>
6485
6486         Reviewed by Saam Barati.
6487
6488         * wasm/function-tests/double-instance.js: Added.
6489         (const.imp.boom):
6490         (const.imp.get callAnother):
6491
6492 2017-11-30  JF Bastien  <jfbastien@apple.com>
6493
6494         WebAssembly: improve stack trace
6495         https://bugs.webkit.org/show_bug.cgi?id=179343
6496
6497         Reviewed by Saam Barati.
6498
6499         Update the tests to follow the new format. Notably, SHA1 module
6500         hash is now included in traces, and stubs are properly identified.
6501
6502         * wasm/assert.js: Add an assertion which matches regular expressions.
6503         * wasm/function-tests/nameSection.js:
6504         * wasm/function-tests/stack-overflow.js:
6505         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
6506         (assertOverflows.assertThrows.wasm.1):
6507         (assertOverflows.assertThrows.wasm.0):
6508         (assertOverflows.assertThrows):
6509         (assertOverflows):
6510         * wasm/function-tests/stack-trace.js:
6511         (import.Builder.from.string_appeared_here.assert): Deleted.
6512         * wasm/function-tests/trap-after-cross-instance-call.js:
6513         (wasmFrameCountFromError):
6514         * wasm/function-tests/trap-load-2.js:
6515         (wasmFrameCountFromError):
6516         * wasm/function-tests/trap-load.js:
6517         (wasmFrameCountFromError):
6518
6519 2017-11-30  Mark Lam  <mark.lam@apple.com>
6520
6521         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
6522         https://bugs.webkit.org/show_bug.cgi?id=180219
6523         <rdar://problem/35696536>
6524
6525         Reviewed by Filip Pizlo.
6526
6527         * stress/regress-180219.js: Added.
6528
6529 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
6530
6531         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
6532         https://bugs.webkit.org/show_bug.cgi?id=180190
6533
6534         Reviewed by Mark Lam.
6535
6536         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
6537         (shouldBe):
6538         (test1):
6539         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
6540         (shouldBe):
6541         (test1):
6542         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
6543         (shouldBe):
6544         (test1):
6545         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
6546         (shouldBe):
6547         (test1):
6548         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
6549         (shouldBe):
6550         (test1):
6551         * stress/operation-in-may-have-negative-int32.js: Added.
6552         (shouldBe):
6553         (test2):
6554         * stress/operation-in-negative-int32-cast.js: Added.
6555         (shouldBe):
6556         (test1):
6557
6558 2017-11-28  JF Bastien  <jfbastien@apple.com>
6559
6560         Strict and sloppy functions shouldn't share structure
6561         https://bugs.webkit.org/show_bug.cgi?id=180103
6562         <rdar://problem/35667847>
6563
6564         Reviewed by Saam Barati.
6565
6566         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
6567         because the IC was wrong.
6568         (foo):
6569         (bar):
6570         (baz):
6571         (catch):
6572         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
6573         in this patch, but may as well test odd strict mode corner cases.
6574         (bar):
6575         (baz):
6576         (catch):
6577         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
6578         (foo):
6579         (bar):
6580         (baz):
6581         (catch):
6582         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
6583         next file, but with invalidation of the FunctionExecutable's
6584         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
6585         slower path.
6586         (foo):
6587         (bar.const.x):
6588         (bar.const.y):
6589         (bar):
6590         (catch):
6591         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
6592         strict nesting works correctly.
6593         (foo):
6594         (bar.baz):
6595         (bar):
6596         * stress/strict-function-structure.js: Added. The test used to
6597         assert in objectProtoFuncHasOwnProperty.
6598         (foo):
6599         (bar):
6600         (baz):
6601         * stress/strict-nested-function-structure.js: Added. Nesting.
6602         (foo):
6603         (bar):
6604         (baz.boo):
6605         (baz):
6606
6607 2017-11-29  Robin Morisset  <rmorisset@apple.com>
6608
6609         The recursive tail call optimisation is wrong on closures
6610         https://bugs.webkit.org/show_bug.cgi?id=179835
6611
6612         Reviewed by Saam Barati.
6613
6614         * stress/closure-recursive-tail-call.js: Added.
6615         (makeClosure):
6616
6617 2017-11-27  JF Bastien  <jfbastien@apple.com>
6618
6619         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
6620         https://bugs.webkit.org/show_bug.cgi?id=180051
6621         <rdar://problem/35614371>
6622
6623         Reviewed by Saam Barati.
6624
6625         * stress/rest-parameter-negative.js: Added.
6626         (__f_5484):
6627         (catch):
6628         (__f_5485):
6629         (__v_22598.catch):
6630
6631 2017-11-27  Saam Barati  <sbarati@apple.com>
6632
6633         Spread can escape when CreateRest does not
6634         https://bugs.webkit.org/show_bug.cgi?id=180057
6635         <rdar://problem/35676119>
6636
6637         Reviewed by JF Bastien.
6638
6639         * stress/spread-escapes-but-create-rest-does-not.js: Added.
6640         (assert):
6641         (getProperties):
6642         (theFunc):
6643         (let.obj.valueOf):
6644
6645 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
6646
6647         [DFG] Add NormalizeMapKey DFG IR
6648         https://bugs.webkit.org/show_bug.cgi?id=179912
6649
6650         Reviewed by Saam Barati.
6651
6652         * stress/map-untyped-normalize-cse.js: Added.
6653         (shouldBe):
6654         (test):
6655         * stress/map-untyped-normalize.js: Added.
6656         (shouldBe):
6657         (test):
6658         * stress/set-untyped-normalize-cse.js: Added.
6659         (shouldBe):
6660         (set return.set has.set has):
6661         * stress/set-untyped-normalize.js: Added.
6662         (shouldBe):
6663         (set return.set has):
6664
6665 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
6666
6667         [FTL] Support DeleteById and DeleteByVal
6668         https://bugs.webkit.org/show_bug.cgi?id=180022
6669
6670         Reviewed by Saam Barati.
6671
6672         * stress/delete-by-id.js: Added.
6673         (shouldBe):
6674         (test1):
6675         (test2):
6676         * stress/delete-by-val-ftl.js: Added.
6677         (shouldBe):
6678         (test1):
6679         (test2):
6680
6681 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
6682
6683         [DFG] Introduce {Set,Map,WeakMap}Fields
6684         https://bugs.webkit.org/show_bug.cgi?id=179925
6685
6686         Reviewed by Saam Barati.
6687
6688         * stress/map-set-clobber-map-get.js: Added.
6689         (shouldBe):
6690         (test):
6691         * stress/map-set-does-not-clobber-set-has.js: Added.
6692         (shouldBe):
6693         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
6694         (shouldBe):
6695         (test):
6696         * stress/set-add-clobber-set-has.js: Added.
6697         (shouldBe):
6698         * stress/set-add-does-not-clobber-map-get.js: Added.
6699         (shouldBe):
6700
6701 2017-11-24  Mark Lam  <mark.lam@apple.com>
6702
6703         Move unsafe jsc shell test functions to the $vm object.
6704         https://bugs.webkit.org/show_bug.cgi?id=179980
6705
6706         Reviewed by Yusuke Suzuki.
6707
6708         * controlFlowProfiler/driver/driver.js:
6709         * controlFlowProfiler/execution-count.js:
6710         * controlFlowProfiler/if-statement.js:
6711         * controlFlowProfiler/loop-statements.js:
6712         * controlFlowProfiler/switch-statements.js:
6713         * controlFlowProfiler/test-jit.js:
6714         * exceptionFuzz/3d-cube.js:
6715         * exceptionFuzz/date-format-xparb.js:
6716         * exceptionFuzz/earley-boyer.js:
6717         * heapProfiler/basic-edges.js:
6718         * heapProfiler/property-edge-types.js:
6719         * microbenchmarks/try-get-by-id-basic.js:
6720         * microbenchmarks/try-get-by-id-polymorphic.js:
6721         * modules/namespace-object-try-get.js:
6722         * stress/argument-count-bytecode.js:
6723         * stress/argument-intrinsic-basic.js:
6724         * stress/argument-intrinsic-inlining-use-caller-arg.js:
6725         * stress/argument-intrinsic-inlining-with-result-escape.js:
6726         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
6727         * stress/argument-intrinsic-inlining-with-vararg.js:
6728         * stress/argument-intrinsic-nested-inlining.js:
6729         * stress/argument-intrinsic-not-convert-to-get-argument.js:
6730         * stress/argument-intrinsic-with-stack-write.js:
6731         * stress/arity-mismatch-get-argument.js:
6732         * stress/array-message-passing.js:
6733         * stress/array-push-with-force-exit.js:
6734         * stress/check-dom-with-signature.js:
6735         * stress/check-sub-class.js:
6736         * stress/compare-eq-incomplete-profile.js:
6737         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
6738         * stress/do-eval-virtual-call-correctly.js:
6739         * stress/dom-jit-with-poly-proto.js:
6740         * stress/domjit-exception-ic.js:
6741         * stress/domjit-exception.js:
6742         * stress/domjit-getter-complex-with-incorrect-object.js:
6743         * stress/domjit-getter-complex.js:
6744         * stress/domjit-getter-poly.js:
6745         * stress/domjit-getter-proto.js:
6746         * stress/domjit-getter-super-poly.js:
6747         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
6748         * stress/domjit-getter-type-check.js:
6749         * stress/domjit-getter.js:
6750         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
6751         * stress/for-in-proxy-target-changed-structure.js:
6752         * stress/for-in-proxy.js:
6753         * stress/generational-opaque-roots.js:
6754         * stress/global-const-redeclaration-setting-2.js:
6755         * stress/global-const-redeclaration-setting-3.js:
6756         * stress/global-const-redeclaration-setting-4.js:
6757         * stress/global-const-redeclaration-setting-5.js:
6758         * stress/global-const-redeclaration-setting.js:
6759         * stress/import-basic.js:
6760         * stress/import-from-eval.js:
6761         * stress/import-reject-with-exception.js:
6762         * stress/import-syntax.js:
6763         * stress/impure-get-own-property-slot-inline-cache.js:
6764         * stress/is-constructor.js:
6765         * stress/istypedarrayview-intrinsic.js:
6766         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
6767         * stress/jsc-test-functions-should-be-more-robust.js:
6768         * stress/object-toString-with-proxy.js:
6769         * stress/poly-proto-custom-value-and-accessor.js:
6770         * stress/proxy-inline-cache.js:
6771         * stress/re-execute-error-module.js:
6772         * stress/regress-150532.js:
6773         * stress/regress-156992.js:
6774         * stress/regress-179619.js:
6775         * stress/resources/shadow-chicken-support.js:
6776         * stress/runtime-array.js:
6777         * stress/sampling-profiler-microtasks.js:
6778         * stress/shadow-chicken-enabled.js:
6779         * stress/spread-correct-global-object-on-exception.js:
6780         * stress/super-get-by-id.js:
6781         * stress/tailCallForwardArguments.js:
6782         * stress/to-object-intrinsic-boolean-edge.js:
6783         * stress/to-object-intrinsic-null-or-undefined-edge.js:
6784         * stress/to-object-intrinsic-number-edge.js:
6785         * stress/to-object-intrinsic-object-edge.js:
6786         * stress/to-object-intrinsic-string-edge.js:
6787         * stress/to-object-intrinsic-symbol-edge.js:
6788         * stress/to-object-intrinsic.js:
6789         * stress/try-catch-custom-getter-as-get-by-id.js:
6790         * stress/try-get-by-id-poly-proto.js:
6791         * stress/try-get-by-id-should-spill-registers-dfg.js:
6792         * stress/try-get-by-id.js:
6793         * typeProfiler/arrow-functions.js:
6794         * typeProfiler/basic.js:
6795         * typeProfiler/captured.js:
6796         * typeProfiler/classes.js:
6797         * typeProfiler/dfg-jit-optimizations.js:
6798         * typeProfiler/dictionary-mode.js:
6799         * typeProfiler/es6-block-scoping.js:
6800         * typeProfiler/es6-classes.js:
6801         * typeProfiler/inheritance.js:
6802         * typeProfiler/int52-dfg.js:
6803         * typeProfiler/loop.js:
6804         * typeProfiler/optional-fields.js:
6805         * typeProfiler/overflow.js:
6806         * typeProfiler/return.js:
6807         * typeProfiler/symbol.js:
6808         * typeProfiler/weird-prototype-chain.js:
6809
6810 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
6811
6812         [DFG][FTL] Support MapSet / SetAdd intrinsics
6813         https://bugs.webkit.org/show_bug.cgi?id=179858
6814
6815         Reviewed by Saam Barati.
6816
6817         * microbenchmarks/map-has-and-set.js: Added.
6818         (test):
6819         * stress/map-set-check-failure.js: Added.
6820         (shouldBe):
6821         (shouldThrow):
6822         (target):
6823         * stress/map-set-cse.js: Added.
6824         (shouldBe):
6825         (test):
6826         * stress/set-add-check-failure.js: Added.
6827         (shouldBe):
6828         (shouldThrow):
6829         (set shouldThrow):
6830         * stress/set-add-cse.js: Added.
6831         (shouldBe):
6832
6833 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
6834
6835         [JSC] Allow poly proto for intrinsic getters
6836         https://bugs.webkit.org/show_bug.cgi?id=179550
6837
6838         Reviewed by Saam Barati.
6839
6840         This change is also tested by existing tests.
6841
6842             1. stress/intrinsic-getter-with-poly-proto.js
6843             2. stress/poly-proto-intrinsic-getter-correctness.js
6844
6845         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
6846         (shouldBe):
6847         (makePolyProtoObject.foo.C):
6848         (makePolyProtoObject.foo):
6849         (makePolyProtoObject):
6850         (target):
6851         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
6852         (shouldBe):
6853         (makePolyProtoObject.foo.C):
6854         (makePolyProtoObject.foo):
6855         (makePolyProtoObject):
6856         (target):
6857
6858 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
6859
6860         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
6861         https://bugs.webkit.org/show_bug.cgi?id=179744
6862
6863         Reviewed by Michael Catanzaro.
6864
6865         This test uses too much memory for our buildbots on these platforms
6866         and gets OOM-killed.
6867
6868         * stress/unshiftCountSlowCase-correct-postCapacity.js:
6869         Skip if $memoryLimited and linux.
6870
6871 2017-11-17  JF Bastien  <jfbastien@apple.com>
6872
6873         WebAssembly JS API: throw when a promise can't be created
6874         https://bugs.webkit.org/show_bug.cgi?id=179826
6875         <rdar://problem/35455813>
6876
6877         Reviewed by Mark Lam.
6878
6879         Test WebAssembly.{compile,instantiate} where promise creation
6880         fails because of a stack overflow.
6881
6882         * wasm/js-api/promise-stack-overflow.js: Added.
6883         (const.runNearStackLimit.f.const.t):
6884         (async.testCompile):
6885         (async.testInstantiate):
6886
6887 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
6888
6889         Unreviewed, mark regress-178385.js as memory exhausting
6890
6891         * stress/regress-178385.js:
6892
6893 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
6894
6895         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
6896
6897         Unreviewed test gardening.
6898
6899         * test262.yaml:
6900
6901 2017-11-16  Robin Morisset  <rmorisset@apple.com>
6902
6903         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
6904         https://bugs.webkit.org/show_bug.cgi?id=179763
6905         <rdar://problem/35550513>
6906
6907         Reviewed by Keith Miller.
6908
6909         Just adding a slightly cleaned-up version of the original fuzzer-found test.
6910
6911         * stress/tdz-this-in-try-catch.js: Added.
6912         (__v_6388):
6913         (__v_6392):
6914
6915 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
6916
6917         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
6918         https://bugs.webkit.org/show_bug.cgi?id=179594
6919
6920         Reviewed by Saam Barati.
6921
6922         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
6923         (shouldBe):
6924         (args):
6925         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
6926         (shouldBe):
6927         (args):
6928
6929 2017-11-14  Saam Barati  <sbarati@apple.com>
6930
6931         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
6932         https://bugs.webkit.org/show_bug.cgi?id=179639
6933         <rdar://problem/35513018>
6934
6935         Reviewed by JF Bastien.
6936
6937         * wasm/function-tests/grow-memory-cause-gc.js: Added.
6938         (escape):
6939         (i.func):
6940
6941 2017-11-13  Mark Lam  <mark.lam@apple.com>
6942
6943         Add more overflow check book-keeping for MarkedArgumentBuffer.
6944         https://bugs.webkit.org/show_bug.cgi?id=179634
6945         <rdar://problem/35492517>
6946
6947         Reviewed by Saam Barati.
6948
6949         * stress/regress-179634.js: Added.
6950
6951 2017-11-13  Mark Lam  <mark.lam@apple.com>
6952
6953         Make the jsc shell loadGetterFromGetterSetter() function more robust.
6954         https://bugs.webkit.org/show_bug.cgi?id=179619
6955         <rdar://problem/35492518>
6956
6957         Reviewed by Saam Barati.
6958
6959         * stress/regress-179619.js: Added.
6960
6961 2017-11-12  Mark Lam  <mark.lam@apple.com>
6962
6963         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
6964         https://bugs.webkit.org/show_bug.cgi?id=179562
6965         <rdar://problem/35467022>
6966
6967         Reviewed by Saam Barati.
6968
6969         * regress-179562.js: Added.
6970
6971 2017-11-08  Saam Barati  <sbarati@apple.com>
6972
6973         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
6974         https://bugs.webkit.org/show_bug.cgi?id=177792
6975
6976         Reviewed by Yusuke Suzuki.
6977
6978         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
6979         (assert):
6980         (foo.Foo.prototype.ensureX):
6981         (foo.Foo):
6982         (foo):
6983         (access):
6984
6985 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
6986
6987         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
6988         https://bugs.webkit.org/show_bug.cgi?id=178592
6989
6990         Unreviewed test gardening.
6991
6992         * test262.yaml:
6993
6994 2017-11-08  Robin Morisset  <rmorisset@apple.com>
6995
6996         Turn recursive tail calls into loops
6997         https://bugs.webkit.org/show_bug.cgi?id=176601
6998
6999         Reviewed by Saam Barati.
7000
7001         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
7002
7003         Add some simple test that computes factorial in several ways, and other trivial computations.
7004         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
7005         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
7006         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
7007         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
7008
7009         * stress/inline-call-to-recursive-tail-call.js: Added.
7010         (factorial.aux):
7011         (factorial):
7012         (factorial2.aux2):
7013         (factorial2.id):
7014         (factorial2):
7015         (factorial3.aux3):
7016         (factorial3):
7017         (aux4):
7018         (factorial4):
7019         (foo):
7020         (auxBar):
7021         (bar):
7022         (test):
7023
7024 2017-11-07  Mark Lam  <mark.lam@apple.com>
7025
7026         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
7027         https://bugs.webkit.org/show_bug.cgi?id=179355
7028         <rdar://problem/35263053>
7029
7030         Reviewed by Saam Barati.
7031
7032         * stress/regress-179355.js: Added.
7033
7034 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
7035
7036         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
7037         https://bugs.webkit.org/show_bug.cgi?id=144458
7038
7039         Reviewed by Saam Barati.
7040
7041         * microbenchmarks/dfg-internal-function-call.js: Added.
7042         (target):
7043         * microbenchmarks/dfg-internal-function-construct.js: Added.
7044         (target):
7045         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
7046         (target):
7047         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
7048         (target):
7049         * stress/dfg-internal-function-call.js: Added.
7050         (shouldBe):
7051         (target):
7052         * stress/dfg-internal-function-construct.js: Added.
7053         (shouldBe):
7054         (target):
7055         * stress/internal-function-call.js: Added.
7056         (shouldBe):
7057         * stress/internal-function-construct.js: Added.
7058         (shouldBe):
7059
7060 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
7061
7062         [Win] Skip stress/regress-178385.js.
7063         https://bugs.webkit.org/show_bug.cgi?id=179298
7064
7065         Unreviewed test gardening.
7066
7067         * stress/regress-178385.js:
7068
7069 2017-11-03  Keith Miller  <keith_miller@apple.com>
7070
7071         Add test for ic with side effects
7072         https://bugs.webkit.org/show_bug.cgi?id=179268
7073
7074         Reviewed by Saam Barati.
7075
7076         * stress/put-inline-cache-side-effects.js: Added.
7077         (let.i.of.objs.keys):
7078         (f):
7079
7080 2017-11-03  Mark Lam  <mark.lam@apple.com>
7081
7082         CachedCall (and its clients) needs overflow checks.
7083         https://bugs.webkit.org/show_bug.cgi?id=179185
7084
7085         Reviewed by JF Bastien.
7086
7087         * stress/regress-179185.js: Added.
7088
7089 2017-11-02  Michael Saboff  <msaboff@apple.com>
7090
7091         DFG needs to handle code motion of code in for..in loop bodies
7092         https://bugs.webkit.org/show_bug.cgi?id=179212
7093
7094         Reviewed by Keith Miller.
7095
7096         New regression test.
7097
7098         * stress/for-in-side-effects.js: Added.
7099         (getPrototypeOf):
7100         (reset):
7101         (testWithoutFTL.f):
7102         (testWithoutFTL):
7103         (testWithFTL.f):
7104         (testWithFTL):
7105
7106 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
7107
7108         AI does not correctly model the clobber case of ArithClz32
7109         https://bugs.webkit.org/show_bug.cgi?id=179188
7110
7111         Reviewed by Michael Saboff.
7112
7113         * stress/arith-clz32-effects.js: Added.
7114         (foo):
7115         (valueOf):
7116
7117 2017-11-01  Michael Saboff  <msaboff@apple.com>
7118
7119         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
7120         https://bugs.webkit.org/show_bug.cgi?id=179140
7121
7122         Reviewed by Saam Barati.
7123
7124         New regression test.
7125
7126         * stress/regress-179140.js: Added.
7127         (testWithoutFTL):
7128         (testWithFTL):
7129
7130 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
7131
7132         [JSC] Introduce @toObject
7133         https://bugs.webkit.org/show_bug.cgi?id=178726
7134
7135         Reviewed by Saam Barati.
7136
7137         * stress/array-copywithin.js:
7138         (shouldThrow):
7139         * stress/object-constructor-boolean-edge.js: Added.
7140         (shouldBe):
7141         (test):
7142         * stress/object-constructor-global.js: Added.
7143         (shouldBe):
7144         * stress/object-constructor-null-edge.js: Added.
7145         (shouldBe):
7146         (test):
7147         * stress/object-constructor-number-edge.js: Added.
7148         (shouldBe):
7149         (test):
7150         * stress/object-constructor-object-edge.js: Added.
7151         (shouldBe):
7152         (test):
7153         (i.arg):
7154         * stress/object-constructor-string-edge.js: Added.
7155         (shouldBe):
7156         (test):
7157         * stress/object-constructor-symbol-edge.js: Added.
7158         (shouldBe):
7159         (test):
7160         * stress/object-constructor-undefined-edge.js: Added.
7161         (shouldBe):
7162         (test):
7163         * stress/symbol-array-from.js: Added.
7164         (shouldBe):
7165         * stress/to-object-intrinsic-boolean-edge.js: Added.
7166         (shouldBe):
7167         (builtin.createBuiltin):
7168         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
7169         (shouldThrow):
7170         * stress/to-object-intrinsic-number-edge.js: Added.
7171         (shouldBe):
7172         (builtin.createBuiltin):
7173         * stress/to-object-intrinsic-object-edge.js: Added.
7174         (shouldBe):
7175         (builtin.createBuiltin):
7176         (i.arg):
7177         * stress/to-object-intrinsic-string-edge.js: Added.
7178         (shouldBe):
7179         (builtin.createBuiltin):
7180         * stress/to-object-intrinsic-symbol-edge.js: Added.
7181         (shouldBe):
7182         (builtin.createBuiltin):
7183         * stress/to-object-intrinsic.js: Added.
7184         (shouldBe):
7185         (shouldThrow):
7186         (builtin.createBuiltin):
7187
7188 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
7189
7190         [DFG][FTL] Introduce StringSlice
7191         https://bugs.webkit.org/show_bug.cgi?id=178934
7192
7193         Reviewed by Saam Barati.
7194
7195         * microbenchmarks/string-slice-empty.js: Added.
7196         (slice):
7197         * microbenchmarks/string-slice-one-char.js: Added.
7198         (slice):
7199         * microbenchmarks/string-slice.js: Added.
7200         (slice):
7201
7202 2017-10-26  Michael Saboff  <msaboff@apple.com>
7203
7204         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
7205         https://bugs.webkit.org/show_bug.cgi?id=178890
7206
7207         Reviewed by Keith Miller.
7208
7209         New regression test.
7210
7211         * stress/regress-178890.js: Added.
7212
7213 2017-10-26  Mark Lam  <mark.lam@apple.com>
7214
7215         JSRopeString::RopeBuilder::append() should check for overflows.
7216         https://bugs.webkit.org/show_bug.cgi?id=178385
7217         <rdar://problem/35027468>
7218
7219         Reviewed by Saam Barati.
7220
7221         * stress/regress-178385.js: Added.
7222
7223 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
7224
7225         Unreviewed, rolling out r223961.
7226
7227         The change that required this has been rolled out.
7228
7229         Reverted changeset:
7230
7231         "Mark test262.yaml/test262/test/language/statements/try/tco-
7232         catch.js as passing."
7233         https://bugs.webkit.org/show_bug.cgi?id=178592
7234         https://trac.webkit.org/changeset/223961
7235
7236 2017-10-25  Commit Queue  <commit-queue@webkit.org>
7237
7238         Unreviewed, rolling out r223691 and r223729.
7239         https://bugs.webkit.org/show_bug.cgi?id=178834
7240
7241         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
7242         by rniwa on #webkit).
7243
7244         Reverted changesets:
7245
7246         "Turn recursive tail calls into loops"
7247         https://bugs.webkit.org/show_bug.cgi?id=176601
7248         https://trac.webkit.org/changeset/223691
7249
7250         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
7251         comparison is always false due to limited range of data type
7252         [-Wtype-limits]"
7253         https://bugs.webkit.org/show_bug.cgi?id=178543
7254         https://trac.webkit.org/changeset/223729
7255
7256 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
7257
7258         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
7259         https://bugs.webkit.org/show_bug.cgi?id=178592
7260
7261         Unreviewed test gardening.
7262
7263         * test262.yaml:
7264
7265 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
7266
7267         [FTL] Support NewStringObject
7268         https://bugs.webkit.org/show_bug.cgi?id=178737
7269
7270         Reviewed by Saam Barati.
7271
7272         * stress/new-string-object.js: Added.
7273         (shouldBe):
7274         (test):
7275
7276 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
7277
7278         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
7279         https://bugs.webkit.org/show_bug.cgi?id=178308
7280
7281         Reviewed by Mark Lam.
7282
7283         * test262.yaml:
7284
7285 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
7286
7287         [JSC] Use fastJoin in Array#toString
7288         https://bugs.webkit.org/show_bug.cgi?id=178062
7289
7290         Reviewed by Darin Adler.
7291
7292         * microbenchmarks/contiguous-array-to-string.js: Added.
7293         (target):
7294         * microbenchmarks/double-array-to-string.js: Added.
7295         (target):
7296         * microbenchmarks/int32-array-to-string.js: Added.
7297         (target):
7298
7299 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
7300
7301         stress/check-string-ident.js is improperly skipped
7302         https://bugs.webkit.org/show_bug.cgi?id=178642
7303
7304         Reviewed by Saam Barati.
7305
7306         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
7307         since it enforces the run-jsc-stress-tests script to still set up the
7308         test to run, despite the skip directive that's used before.
7309
7310 2017-10-20  Mark Lam  <mark.lam@apple.com>
7311
7312         Add a test case for r214334.
7313         https://bugs.webkit.org/show_bug.cgi?id=169941
7314         <rdar://problem/31221258>
7315
7316         Reviewed by JF Bastien.
7317
7318         * stress/regress-169941.js: Added.
7319
7320 2017-10-19  JF Bastien  <jfbastien@apple.com>
7321
7322         WebAssembly: no VM / JS version of everything but Instance
7323         https://bugs.webkit.org/show_bug.cgi?id=177473
7324
7325         Reviewed by Filip Pizlo, Saam Barati.
7326
7327         - Exceeding max on memory growth now returns a range error as per
7328         spec. This is a (very minor) breaking change: it used to throw OOM
7329         error. Update the corresponding test.
7330
7331         * wasm/js-api/memory-grow.js:
7332         (assertEq):
7333         * wasm/js-api/table.js:
7334         (assert.throws):
7335
7336 2017-10-19  Mark Lam  <mark.lam@apple.com>
7337
7338         Stringifier::appendStringifiedValue() is missing an exception check.
7339         https://bugs.webkit.org/show_bug.cgi?id=178386
7340         <rdar://problem/35027610>
7341
7342         Reviewed by Saam Barati.
7343
7344         * stress/regress-178386.js: Added.
7345
7346 2017-10-19  Michael Saboff  <msaboff@apple.com>
7347
7348         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
7349         https://bugs.webkit.org/show_bug.cgi?id=178521
7350
7351         Reviewed by JF Bastien.
7352
7353         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
7354         now passes with the current version (5.0) of the Emoji spec.
7355
7356 2017-10-19  Robin Morisset  <rmorisset@apple.com>
7357
7358         Turn recursive tail calls into loops
7359         https://bugs.webkit.org/show_bug.cgi?id=176601
7360
7361         Reviewed by Saam Barati.
7362
7363         Add some simple test that computes factorial in several ways, and other trivial computations.
7364         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
7365         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
7366         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
7367         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
7368
7369         * stress/inline-call-to-recursive-tail-call.js: Added.
7370         (factorial.aux):
7371         (factorial):
7372         (factorial2.aux):
7373         (factorial2.id):
7374         (factorial2):
7375         (factorial3.aux):
7376         (factorial3):
7377         (aux):
7378         (factorial4):
7379         (test):
7380
7381 2017-10-18  Mark Lam  <mark.lam@apple.com>
7382
7383         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
7384         https://bugs.webkit.org/show_bug.cgi?id=177600
7385         <rdar://problem/34710985>
7386
7387         Reviewed by Saam Barati.
7388
7389         * stress/regress-177600.js: Added.
7390
7391 2017-10-18  Mark Lam  <mark.lam@apple.com>
7392
7393         The compiler should always register a structure when it adds its transitionWatchPointSet.
7394         https://bugs.webkit.org/show_bug.cgi?id=178420
7395         <rdar://problem/34814024>
7396
7397         Reviewed by Saam Barati and Filip Pizlo.
7398
7399         * stress/regress-178420.js: Added.
7400         (new.Array.10000.map):
7401
7402 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
7403
7404         [JSC] __proto__ getter should be fast
7405         https://bugs.webkit.org/show_bug.cgi?id=178067
7406
7407         Reviewed by Saam Barati.
7408
7409         * stress/dfg-object-proto-accessor.js: Added.
7410         (shouldBe):
7411         (shouldThrow):
7412         (target):
7413         * stress/dfg-object-proto-getter.js: Added.
7414         (shouldBe):
7415         (shouldThrow):
7416         (target):
7417         * stress/dfg-object-prototype-of.js: Added.
7418         (shouldBe):
7419         (shouldThrow):
7420         (target):
7421         * stress/dfg-reflect-get-prototype-of.js: Added.
7422         (shouldBe):
7423         (shouldThrow):
7424         (target):
7425         * stress/intrinsic-getter-with-poly-proto.js: Added.
7426         (shouldBe):
7427         (makePolyProtoObject.foo.C):
7428         (makePolyProtoObject.foo):
7429         (makePolyProtoObject):
7430         (target):
7431         * stress/object-get-prototype-of-filtered.js: Added.
7432         (shouldBe):
7433         (shouldThrow):
7434         (target):
7435         (i.Cocoa):
7436         * stress/object-get-prototype-of-mono-proto.js: Added.
7437         (shouldBe):
7438         (makePolyProtoObject.foo.C):
7439         (makePolyProtoObject.foo):
7440         (makePolyProtoObject):
7441         (target):
7442         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
7443         (shouldBe):
7444         (makePolyProtoObject.foo.C):
7445         (makePolyProtoObject.foo):
7446         (makePolyProtoObject):
7447         (target):
7448         * stress/object-get-prototype-of-poly-proto.js: Added.
7449         (shouldBe):
7450         (makePolyProtoObject.foo.C):
7451         (makePolyProtoObject.foo):
7452         (makePolyProtoObject):
7453         (target):
7454         * stress/object-proto-getter-filtered.js: Added.
7455         (shouldBe):
7456         (shouldThrow):
7457         (target):
7458         (i.Cocoa):
7459         * stress/object-proto-getter-poly-mono-proto.js: Added.
7460         (shouldBe):
7461         (makePolyProtoObject.foo.C):
7462         (makePolyProtoObject.foo):
7463         (makePolyProtoObject):
7464         (target):
7465         * stress/object-proto-getter-poly-proto.js: Added.
7466         (shouldBe):
7467         (makePolyProtoObject.foo.C):
7468         (makePolyProtoObject.foo):
7469         (makePolyProtoObject):
7470         (target):
7471         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
7472         * stress/string-proto.js: Added.
7473         (shouldBe):
7474         (target):
7475
7476 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
7477
7478         Unreviewed, rolling out r223523.
7479
7480         A test for this change is failing on debug JSC bots.
7481
7482         Reverted changeset:
7483
7484         "[JSC] __proto__ getter should be fast"
7485         https://bugs.webkit.org/show_bug.cgi?id=178067
7486         https://trac.webkit.org/changeset/223523
7487
7488 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
7489
7490         [JSC] __proto__ getter should be fast
7491         https://bugs.webkit.org/show_bug.cgi?id=178067
7492
7493         Reviewed by Saam Barati.
7494
7495         * stress/dfg-object-proto-accessor.js: Added.
7496         (shouldBe):
7497         (shouldThrow):
7498         (target):
7499         * stress/dfg-object-proto-getter.js: Added.
7500         (shouldBe):
7501         (shouldThrow):
7502         (target):
7503         * stress/dfg-object-prototype-of.js: Added.
7504         (shouldBe):
7505         (shouldThrow):
7506         (target):
7507         * stress/dfg-reflect-get-prototype-of.js: Added.
7508         (shouldBe):
7509         (shouldThrow):
7510         (target):
7511         * stress/object-get-prototype-of-filtered.js: Added.
7512         (shouldBe):
7513         (shouldThrow):
7514         (target):
7515         (i.Cocoa):
7516         * stress/object-get-prototype-of-mono-proto.js: Added.
7517         (shouldBe):
7518         (makePolyProtoObject.foo.C):
7519         (makePolyProtoObject.foo):
7520         (makePolyProtoObject):
7521         (target):
7522         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
7523         (shouldBe):
7524         (makePolyProtoObject.foo.C):
7525         (makePolyProtoObject.foo):
7526         (makePolyProtoObject):
7527         (target):
7528         * stress/object-get-prototype-of-poly-proto.js: Added.
7529         (shouldBe):
7530         (makePolyProtoObject.foo.C):
7531         (makePolyProtoObject.foo):
7532         (makePolyProtoObject):
7533         (target):
7534         * stress/object-proto-getter-filtered.js: Added.
7535         (shouldBe):
7536         (shouldThrow):
7537         (target):
7538         (i.Cocoa):
7539         * stress/object-proto-getter-poly-mono-proto.js: Added.
7540         (shouldBe):
7541         (makePolyProtoObject.foo.C):
7542         (makePolyProtoObject.foo):
7543         (makePolyProtoObject):
7544         (target):
7545         * stress/object-proto-getter-poly-proto.js: Added.
7546         (shouldBe):
7547         (makePolyProtoObject.foo.C):
7548         (makePolyProtoObject.foo):
7549         (makePolyProtoObject):
7550         (target):
7551         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
7552         * stress/string-proto.js: Added.
7553         (shouldBe):
7554         (target):
7555
7556 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
7557
7558         Reland "Add Above/Below comparisons for UInt32 patterns"
7559         https://bugs.webkit.org/show_bug.cgi?id=177281
7560
7561         Reviewed by Saam Barati.
7562
7563         * stress/uint32-comparison-jump.js: Added.
7564         (shouldBe):
7565         (above):
7566         (aboveOrEqual):
7567         (below):
7568         (belowOrEqual):
7569         (notAbove):
7570         (notAboveOrEqual):
7571         (notBelow):
7572         (notBelowOrEqual):
7573         * stress/uint32-comparison.js: Added.
7574         (shouldBe):
7575         (above):
7576         (aboveOrEqual):
7577         (below):
7578         (belowOrEqual):
7579         (aboveTest):
7580         (aboveOrEqualTest):
7581         (belowTest):
7582         (belowOrEqualTest):
7583
7584 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
7585
7586         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
7587         https://bugs.webkit.org/show_bug.cgi?id=178210
7588
7589         Reviewed by Saam Barati.
7590
7591         * wasm/function-tests/trap-from-start-async.js:
7592         (async.StartTrapsAsync):
7593         * wasm/function-tests/trap-from-start.js:
7594         (StartTraps):
7595         * wasm/js-api/web-assembly-function.js:
7596         (assert.eq.Object.getPrototypeOf):
7597         * wasm/js-api/wrapper-function.js:
7598         (return.new.WebAssembly.Module):
7599         (assert.throws.makeInstance): Deleted.
7600         (assert.throws.Bar): Deleted.
7601         (assert.throws): Deleted.
7602
7603 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
7604
7605         Enable gigacage on iOS
7606         https://bugs.webkit.org/show_bug.cgi?id=177586
7607
7608         Reviewed by JF Bastien.
7609
7610         Add tests for when Gigacage gets runtime disabled.
7611
7612         * stress/disable-gigacage-arrays.js: Added.
7613         (foo):
7614         * stress/disable-gigacage-strings.js: Added.
7615         (foo):
7616         * stress/disable-gigacage-typed-arrays.js: Added.
7617         (foo):
7618
7619 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
7620
7621         import.meta should not be assignable
7622         https://bugs.webkit.org/show_bug.cgi?id=178202
7623
7624         Reviewed by Saam Barati.
7625
7626         * modules/import-meta-assignment.js: Added.
7627         (shouldThrow):
7628         (SyntaxError.import.meta.can.shouldThrow):
7629
7630 2017-10-11  Saam Barati  <sbarati@apple.com>
7631
7632         Unreviewed. Actually skip certain type profiler tests in debug.
7633
7634         * typeProfiler.yaml:
7635         * typeProfiler/deltablue-for-of.js:
7636         * typeProfiler/getter-richards.js:
7637
7638 2017-10-11  Commit Queue  <commit-queue@webkit.org>
7639
7640         Unreviewed, rolling out r223113 and r223121.
7641         https://bugs.webkit.org/show_bug.cgi?id=178182
7642
7643         Reintroduced 20% regression on Kraken (Requested by rniwa on
7644         #webkit).
7645
7646         Reverted changesets:
7647
7648         "Enable gigacage on iOS"
7649         https://bugs.webkit.org/show_bug.cgi?id=177586
7650         https://trac.webkit.org/changeset/223113
7651
7652         "Use one virtual allocation for all gigacages and their
7653         runways"
7654         https://bugs.webkit.org/show_bug.cgi?id=178050
7655         https://trac.webkit.org/changeset/223121
7656
7657 2017-10-11  Michael Saboff  <msaboff@apple.com>
7658
7659         Disable test262 named capture group tests with direct unicode names and with references before definitions
7660         https://bugs.webkit.org/show_bug.cgi?id=178177
7661
7662         Reviewed by Keith Miller.
7663
7664         Bugs to track fixing these test are:
7665         https://bugs.webkit.org/show_bug.cgi?id=178174 -
7666             "Add support in named capture group identifiers for direct surrogate pairs"
7667         https://bugs.webkit.org/show_bug.cgi?id=178175 -
7668             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
7669
7670         * test262.yaml:
7671
7672 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
7673
7674         Object properties are undefined in super.call() but not in this.call()
7675         https://bugs.webkit.org/show_bug.cgi?id=177230
7676
7677         Reviewed by Saam Barati.
7678
7679         * stress/super-call-function-subclass.js: Added.
7680         (assert):
7681         (A.prototype.t):
7682         (A):
7683         * stress/super-dot-call-and-apply.js: Added.
7684         (assert):
7685         (A):
7686         (A.prototype.call):
7687         (A.prototype.apply):
7688         (B.prototype.testSuper):
7689         (B):
7690         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
7691         (D.prototype.testSuper):
7692         (D):
7693
7694 2017-10-10  Saam Barati  <sbarati@apple.com>
7695
7696         The prototype cache should be aware of the Executable it generates a Structure for
7697         https://bugs.webkit.org/show_bug.cgi?id=177907
7698
7699         Reviewed by Filip Pizlo.
7700
7701         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
7702         (assert):
7703         (foo.C):
7704         (foo):
7705         (bar.C):
7706         (bar):
7707         (access):
7708         (makeLongChain):
7709         (accessY):
7710
7711 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
7712
7713         `async` should be able to be used as an imported binding name
7714         https://bugs.webkit.org/show_bug.cgi?id=176573
7715
7716         Reviewed by Saam Barati.
7717
7718         * modules/import-default-async.js: Added.
7719         * modules/import-named-async-as.js: Added.
7720         * modules/import-named-async.js: Added.
7721         * modules/import-named-async/target.js: Added.
7722         * modules/import-namespace-async.js: Added.
7723         * test262.yaml:
7724
7725 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
7726
7727         Enable gigacage on iOS
7728         https://bugs.webkit.org/show_bug.cgi?id=177586
7729
7730         Reviewed by JF Bastien.
7731
7732         Add tests for when Gigacage gets runtime disabled.
7733
7734         * stress/disable-gigacage-arrays.js: Added.
7735         (foo):
7736         * stress/disable-gigacage-strings.js: Added.
7737         (foo):
7738         * stress/disable-gigacage-typed-arrays.js: Added.
7739         (foo):
7740
7741 2017-10-09  Michael Saboff  <msaboff@apple.com>
7742
7743         Implement RegExp Unicode property escapes
7744         https://bugs.webkit.org/show_bug.cgi?id=172069
7745
7746         Reviewed by JF Bastien.
7747
7748         Enabled Unicode Property tests.
7749
7750         * test262.yaml:
7751
7752 2017-10-09  Commit Queue  <commit-queue@webkit.org>
7753
7754         Unreviewed, rolling out r223015 and r223025.
7755         https://bugs.webkit.org/show_bug.cgi?id=178093
7756
7757         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
7758         #webkit).
7759
7760         Reverted changesets:
7761
7762         "Enable gigacage on iOS"
7763         https://bugs.webkit.org/show_bug.cgi?id=177586
7764         http://trac.webkit.org/changeset/223015
7765
7766         "Unreviewed, disable Gigacage on ARM64 Linux"
7767         https://bugs.webkit.org/show_bug.cgi?id=177586
7768         http://trac.webkit.org/changeset/223025
7769
7770 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
7771
7772         Update expectations for test262 tests that pass after r223043.
7773         https://bugs.webkit.org/show_bug.cgi?id=176685
7774
7775         Unreviewed test gardening.
7776
7777         * test262.yaml:
7778
7779 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
7780
7781         Unreviewed, rolling out r223022.
7782
7783         This change introduced 18 test262 failures.
7784
7785         Reverted changeset:
7786
7787         "`async` should be able to be used as an imported binding
7788         name"
7789         https://bugs.webkit.org/show_bug.cgi?id=176573
7790         http://trac.webkit.org/changeset/223022
7791
7792 2017-10-09  Saam Barati  <sbarati@apple.com>
7793
7794         3 poly-proto JSC tests timing out on debug after r222827
7795         https://bugs.webkit.org/show_bug.cgi?id=177880
7796         <rdar://problem/34817122>
7797
7798         Unreviewed.
7799
7800         I'm skipping these type profiler tests on debug since they are long running.
7801
7802         * typeProfiler/deltablue-for-of.js:
7803         * typeProfiler/getter-richards.js:
7804
7805 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
7806
7807         Safari 10 /11 problem with if (!await get(something)).
7808         https://bugs.webkit.org/show_bug.cgi?id=176685
7809
7810         Reviewed by Saam Barati.
7811
7812         * stress/async-await-basic.js:
7813         (awaitEpression.async):
7814         * stress/async-await-syntax.js:
7815         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
7816         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
7817
7818 2017-10-08  Saam Barati  <sbarati@apple.com>
7819
7820         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
7821
7822         * typeProfiler/deltablue-for-of.js:
7823         * typeProfiler/getter-richards.js:
7824
7825 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
7826
7827         `async` should be able to be used as an imported binding name
7828         https://bugs.webkit.org/show_bug.cgi?id=176573
7829
7830         Reviewed by Darin Adler.
7831
7832         * modules/import-default-async.js: Added.
7833         * modules/import-named-async-as.js: Added.
7834         * modules/import-named-async.js: Added.
7835         * modules/import-named-async/target.js: Added.
7836         * modules/import-namespace-async.js: Added.
7837
7838 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
7839
7840         Enable gigacage on iOS
7841         https://bugs.webkit.org/show_bug.cgi?id=177586
7842
7843         Reviewed by JF Bastien.
7844
7845         Add tests for when Gigacage gets runtime disabled.
7846
7847         * stress/disable-gigacage-arrays.js: Added.
7848         (foo):
7849         * stress/disable-gigacage-strings.js: Added.
7850         (foo):
7851         * stress/disable-gigacage-typed-arrays.js: Added.
7852         (foo):
7853
7854 2017-10-06  Commit Queue  <commit-queue@webkit.org>
7855
7856         Unreviewed, rolling out r222791 and r222873.
7857         https://bugs.webkit.org/show_bug.cgi?id=178031
7858
7859         Caused crashes with workers/wasm LayoutTests (Requested by
7860         ryanhaddad on #webkit).
7861
7862         Reverted changesets:
7863
7864         "WebAssembly: no VM / JS version of everything but Instance"
7865         https://bugs.webkit.org/show_bug.cgi?id=177473
7866         http://trac.webkit.org/changeset/222791
7867
7868         "WebAssembly: address no VM / JS follow-ups"
7869         https://bugs.webkit.org/show_bug.cgi?id=177887
7870         http://trac.webkit.org/changeset/222873
7871
7872 2017-10-05  Saam Barati  <sbarati@apple.com>
7873
7874         Make sure all prototypes under poly proto get added into the VM's prototype map
7875         https://bugs.webkit.org/show_bug.cgi?id=177909
7876
7877         Reviewed by Keith Miller.
7878
7879         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
7880         (assert):
7881         (foo.C):
7882         (foo):
7883         (set x):
7884
7885 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
7886
7887         [JSC] Introduce import.meta
7888         https://bugs.webkit.org/show_bug.cgi?id=177703
7889
7890         Reviewed by Filip Pizlo.
7891
7892         * modules/import-meta-syntax.js: Added.
7893         (shouldThrow):
7894         (shouldNotThrow):
7895         * modules/import-meta.js: Added.
7896         * modules/import-meta/cocoa.js: Added.
7897         * modules/resources/assert.js:
7898         (export.shouldNotThrow):
7899         * stress/import-syntax.js:
7900
7901 2017-10-04  Saam Barati  <sbarati@apple.com>
7902
7903         Make pertinent AccessCases watch the poly proto watchpoint
7904         https://bugs.webkit.org/show_bug.cgi?id=177765
7905
7906         Reviewed by Keith Miller.
7907
7908         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
7909         (assert):
7910         (foo.C):
7911         (foo):
7912         (validate):
7913         * stress/poly-proto-clear-stub.js: Added.
7914         (assert):
7915         (foo.C):
7916         (foo):
7917
7918 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
7919
7920         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
7921
7922         Unreviewed test gardening.
7923
7924         * test262.yaml:
7925
7926 2017-10-04  Saam Barati  <sbarati@apple.com>
7927
7928         3 poly-proto JSC tests timing out on debug after r222827
7929         https://bugs.webkit.org/show_bug.cgi?id=177880
7930
7931         Rubber stamped by Mark Lam.
7932
7933         * microbenchmarks/poly-proto-access.js:
7934         * typeProfiler/deltablue-for-of.js:
7935         * typeProfiler/getter-richards.js:
7936
7937 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
7938
7939         Unreviewed, marking tco-catch.js as a failure after test262 update
7940         https://bugs.webkit.org/show_bug.cgi?id=177859
7941
7942         * test262.yaml:
7943
7944 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
7945
7946         Unreviewed, marking one async iterator test262 test failed
7947         https://bugs.webkit.org/show_bug.cgi?id=177859
7948
7949         * test262.yaml:
7950
7951 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
7952
7953         [Test262] Update Test262 to Oct 4 version
7954         https://bugs.webkit.org/show_bug.cgi?id=177859
7955
7956         Reviewed by Sam Weinig.
7957
7958         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
7959         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
7960
7961         * test262.yaml:
7962         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
7963         (checkSequence):
7964         * test262/harness/typeCoercion.js:
7965         (testCoercibleToIndexZero):
7966         (testCoercibleToIndexOne):
7967         (testCoercibleToIndexFromIndex):
7968         (testNotCoercibleToIndex.testPrimitiveValue):
7969         (testNotCoercibleToInteger):
7970         (testCoercibleToBigIntZero.testPrimitiveValue):
7971         (testCoercibleToBigIntZero):
7972         (testCoercibleToBigIntOne.testPrimitiveValue):
7973         (testCoercibleToBigIntOne):
7974         (testPrimitiveValue):
7975         (testCoercibleToBigIntFromBigInt):
7976         (testNotCoercibleToBigInt.testPrimitiveValue):
7977         (testNotCoercibleToBigInt.testStringValue):
7978         (testNotCoercibleToBigInt):
7979         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
7980         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
7981         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
7982         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
7983         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
7984         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
7985         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
7986         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
7987         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
7988         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
7989         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
7990         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
7991         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
7992         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
7993         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
7994         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
7995         (testCoercibleToBigIntZero):
7996         (testCoercibleToBigIntOne):
7997         (testNotCoercibleToBigInt):
7998         (MyError): Deleted.
7999         (valueOf): Deleted.
8000         (toString): Deleted.
8001         (Symbol.toPrimitive): Deleted.
8002         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
8003         (testCoercibleToIndexZero):
8004         (testCoercibleToIndexOne):
8005         (testNotCoercibleToIndex):
8006         (MyError): Deleted.
8007         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
8008         (assert.sameValue.BigInt.asIntN.toString): Deleted.
8009         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
8010         (BigInt.asIntN.valueOf): Deleted.
8011         (BigInt.asIntN.toString): Deleted.
8012         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
8013         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
8014         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
8015         (testCoercibleToBigIntZero):
8016         (testCoercibleToBigIntOne):
8017         (testNotCoercibleToBigInt):
8018         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
8019         (testCoercibleToIndexZero):
8020         (testCoercibleToIndexOne):
8021         (testNotCoercibleToIndex):
8022         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
8023         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
8024         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
8025         (bits.valueOf):
8026         (bigint.valueOf):
8027         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
8028         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
8029         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
8030         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
8031         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
8032         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
8033         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
8034         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
8035         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
8036         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
8037         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
8038         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
8039         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
8040         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
8041         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
8042         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
8043         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
8044         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
8045         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
8046         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
8047         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
8048         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
8049         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
8050         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
8051         (replacer):
8052         (BigInt.prototype.toJSON):
8053         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
8054         (replacer):
8055         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
8056         (BigInt.prototype.toJSON):
8057         * test262/test/built-ins/JSON/stringify/bigint.js:
8058         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
8059         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
8060         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
8061         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
8062         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
8063         * test262/test/built-ins/Object/proto-from-ctor.js:
8064         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
8065         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
8066         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
8067         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
8068         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
8069         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
8070         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
8071         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
8072         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
8073         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
8074         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
8075         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
8076         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
8077         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
8078         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
8079         * test262/test/built-ins/Proxy/get-fn-realm.js:
8080         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
8081         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
8082         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
8083         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
8084         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
8085         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
8086         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
8087         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
8088         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
8089         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
8090         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
8091         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
8092         (i6.replace):
8093         (i6b.replace):
8094         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
8095         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
8096         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
8097         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
8098         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
8099         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
8100         * test262/test/built-ins/RegExp/u180e.js: Added.
8101         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
8102         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
8103         * test262/test/built-ins/String/proto-from-ctor-realm.js:
8104         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
8105         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
8106         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
8107         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
8108         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
8109         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
8110         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
8111         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
8112         * test262/test/built-ins/String/prototype/endsWith/length.js:
8113         * test262/test/built-ins/String/prototype/endsWith/name.js:
8114         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
8115         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
8116         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
8117         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
8118         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
8119         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
8120         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
8121         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
8122         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
8123         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
8124         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
8125         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
8126         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
8127         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
8128         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
8129         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
8130         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
8131         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
8132         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
8133         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
8134         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
8135         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
8136         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
8137         * test262/test/built-ins/String/prototype/includes/includes.js:
8138         * test262/test/built-ins/String/prototype/includes/length.js:
8139         * test262/test/built-ins/String/prototype/includes/name.js:
8140         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
8141         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
8142         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
8143         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
8144         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
8145         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
8146         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
8147         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
8148         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
8149         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
8150         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
8151         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
8152         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
8153         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
8154         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
8155         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
8156         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
8157         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
8158         * test262/test/built-ins/String/prototype/trim/u180e.js:
8159         * test262/test/built-ins/Symbol/for/cross-realm.js:
8160         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
8161         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
8162         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
8163         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
8164         * test262/test/built-ins/Symbol/match/cross-realm.js:
8165         * test262/test/built-ins/Symbol/replace/cross-realm.js:
8166         * test262/test/built-ins/Symbol/search/cross-realm.js:
8167         * test262/test/built-ins/Symbol/species/cross-realm.js:
8168         * test262/test/built-ins/Symbol/split/cross-realm.js:
8169         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
8170         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
8171         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
8172         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
8173         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
8174         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
8175         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
8176         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
8177         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
8178         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
8179         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
8180         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
8181         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
8182         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
8183         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
8184         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
8185         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
8186         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
8187         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
8188         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
8189         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
8190         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
8191         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
8192         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
8193         * test262/test/language/comments/mongolian-vowel-separator-single.js:
8194         * test262/test/language/eval-code/indirect/realm.js:
8195         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
8196         (o.get z):
8197         (o.get a):
8198         * test262/test/language/expressions/call/eval-realm-indirect.js:
8199         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
8200         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
8201         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
8202         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
8203         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
8204         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
8205         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
8206         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
8207         * test262/test/language/expressions/greater-than/bigint-and-number.js:
8208         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
8209         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
8210         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
8211         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
8212         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
8213         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
8214         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
8215         * test262/test/language/expressions/less-than/bigint-and-number.js:
8216         * test262/test/language/expressions/new/non-ctor-err-realm.js:
8217         * test262/test/language/expressions/super/realm.js:
8218         * test262/test/language/expressions/tagged-template/cache-realm.js:
8219         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
8220         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
8221         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
8222         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
8223         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
8224         * test262/test/language/literals/string/mongolian-vowel-separator.js:
8225         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
8226         (o.get z):
8227         (o.get a):
8228         * test262/test/language/statements/for-of/iterator-next-reference.js:
8229         (next):
8230         (iterator.next): Deleted.
8231         (x.of.iterable.): Deleted.
8232         (x.of.iterable.get return): Deleted.
8233         (x.of.iterable.iterator.next): Deleted.
8234         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
8235         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
8236         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
8237         * test262/test/language/white-space/mongolian-vowel-separator.js:
8238         * test262/test262-Revision.txt:
8239
8240 2017-10-03  Saam Barati  <sbarati@apple.com>
8241
8242         Implement polymorphic prototypes
8243         https://bugs.webkit.org/show_bug.cgi?id=176391
8244
8245         Reviewed by Filip Pizlo.
8246
8247         * microbenchmarks/poly-proto-access.js: Added.
8248         (assert):
8249         (foo.C):
8250         (foo.C.prototype.get bar):
8251         (foo):
8252         (bar):
8253         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
8254         (assert):
8255         (makePolyProtoObject.foo.C):
8256         (makePolyProtoObject.foo):
8257         (makePolyProtoObject):
8258         (performSet):
8259         * microbenchmarks/poly-proto-setter-speed.js: Added.
8260         (assert):
8261         (makePolyProtoObject.foo.C):
8262         (makePolyProtoObject.foo.C.prototype.set p):
8263         (makePolyProtoObject.foo):
8264         (makePolyProtoObject):
8265         (performSet):
8266         * stress/constructor-with-return.js:
8267         (i.tests.forEach.Constructor):
8268         (i.tests.forEach):
8269         (tests.forEach.Constructor): Deleted.
8270         (tests.forEach): Deleted.
8271         * stress/dom-jit-with-poly-proto.js: Added.
8272         (assert):
8273         (makePolyProtoObject.foo.C):
8274         (makePolyProtoObject.foo):
8275         (makePolyProtoObject):
8276         (validate):
8277         * stress/poly-proto-custom-value-and-accessor.js: Added.
8278         (assert):
8279         (makePolyProtoObject.foo.C):
8280         (makePolyProtoObject.foo):
8281         (makePolyProtoObject):
8282         (items.forEach):
8283         (set get for):
8284         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
8285         (assert):
8286         (makePolyProtoObject.foo.C):
8287         (makePolyProtoObject.foo):
8288         (makePolyProtoObject):
8289         (foo):
8290         * stress/poly-proto-miss.js: Added.
8291         (makePolyProtoInstanceWithNullPrototype.foo.C):
8292         (makePolyProtoInstanceWithNullPrototype.foo):
8293         (makePolyProtoInstanceWithNullPrototype):
8294         (assert):
8295         (validate):
8296         * stress/poly-proto-op-in-caching.js: Added.
8297         (assert):
8298         (makePolyProtoObject.foo.C):
8299         (makePolyProtoObject.foo):
8300         (makePolyProtoObject):
8301         (validate):
8302         (validate2):
8303         * stress/poly-proto-put-transition.js: Added.
8304         (assert):
8305         (makePolyProtoObject.foo.C):
8306         (makePolyProtoObject.foo):
8307         (makePolyProtoObject):
8308         (performSet):
8309         (i.obj.__proto__.set p):
8310         * stress/poly-proto-set-prototype.js: Added.
8311         (assert):
8312         (let.alternateProto.get x):
8313         (let.alternateProto2.get y):
8314         (let.alternateProto2.get x):
8315         (foo.C):
8316         (foo):
8317         (validate):
8318         * stress/poly-proto-setter.js: Added.
8319         (assert):
8320         (makePolyProtoObject.foo.C):
8321         (makePolyProtoObject.foo.C.prototype.set p):
8322         (makePolyProtoObject.foo.C.prototype.get p):
8323         (makePolyProtoObject.foo):
8324         (makePolyProtoObject):
8325         (performSet):
8326         * stress/poly-proto-using-inheritance.js: Added.
8327         (assert):
8328         (foo.C):
8329         (foo.C.prototype.get baz):
8330         (foo):
8331         (bar.C):
8332         (bar):
8333         (validate):
8334         * stress/primitive-poly-proto.js: Added.
8335         (makePolyProtoInstance.foo.C):
8336         (makePolyProtoInstance.foo):
8337         (makePolyProtoInstance):
8338         (assert):
8339         (validate):
8340         * stress/prototype-is-not-js-object.js: Added.
8341         (foo.bar):
8342         (foo):
8343         (assert):
8344         (validate):
8345         * stress/try-get-by-id-poly-proto.js: Added.
8346         (assert):
8347         (makePolyProtoObject.foo.C):
8348         (makePolyProtoObject.foo):
8349         (makePolyProtoObject):
8350         (tryGetByIdText):
8351         (x.__proto__.get bar):
8352         (validate):
8353         * typeProfiler/overflow.js:
8354
8355 2017-10-03  JF Bastien  <jfbastien@apple.com>
8356
8357         WebAssembly: no VM / JS version of everything but Instance
8358         https://bugs.webkit.org/show_bug.cgi?id=177473
8359
8360         Reviewed by Filip Pizlo.
8361
8362         - Exceeding max on memory growth now returns a range error as per
8363         spec. This is a (very minor) breaking change: it used to throw OOM
8364         error. Update the corresponding test.
8365
8366         * wasm/js-api/memory-grow.js:
8367         (assertEq):
8368         * wasm/js-api/table.js:
8369         (assert.throws):
8370
8371 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
8372
8373         Skip JSC test stress/regress-159779-2.js on debug.
8374         https://bugs.webkit.org/show_bug.cgi?id=177204
8375
8376         Unreviewed test gardening.
8377
8378         * stress/regress-159779-2.js:
8379
8380 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
8381
8382         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
8383         https://bugs.webkit.org/show_bug.cgi?id=175642
8384
8385         Reviewed by Darin Adler.
8386
8387         * ChakraCore/test/Function/apply3.baseline-jsc:
8388
8389 2017-10-01  Commit Queue  <commit-queue@webkit.org>
8390
8391         Unreviewed, rolling out r222564.
8392         https://bugs.webkit.org/show_bug.cgi?id=177720
8393
8394         "It regressed JetStream by 2% on iOS caused by a 50%
8395         regression on the bigfib subtest" (Requested by saamyjoon on
8396         #webkit).
8397
8398         Reverted changeset:
8399
8400         "Add Above/Below comparisons for UInt32 patterns"
8401         https://bugs.webkit.org/show_bug.cgi?id=177281
8402         http://trac.webkit.org/changeset/222564
8403
8404 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
8405
8406         [DFG] Support ArrayPush with multiple args
8407         https://bugs.webkit.org/show_bug.cgi?id=175823
8408
8409         Reviewed by Saam Barati.
8410
8411         * microbenchmarks/array-push-0.js: Added.
8412         (arrayPush0):
8413         * microbenchmarks/array-push-1.js: Added.
8414         (arrayPush1):
8415         * microbenchmarks/array-push-2.js: Added.
8416         (arrayPush2):
8417         * microbenchmarks/array-push-3.js: Added.
8418         (arrayPush3):
8419         * stress/array-push-multiple-contiguous.js: Added.
8420         (shouldBe):
8421         (test):
8422         * stress/array-push-multiple-double-nan.js: Added.
8423         (shouldBe):
8424         (test):
8425         * stress/array-push-multiple-double.js: Added.
8426         (shouldBe):
8427         (test):
8428         * stress/array-push-multiple-int32.js: Added.
8429         (shouldBe):
8430         (test):
8431         * stress/array-push-multiple-many-contiguous.js: Added.
8432         (shouldBe):
8433         (test):
8434         * stress/array-push-multiple-many-double.js: Added.
8435         (shouldBe):
8436         (test):
8437         * stress/array-push-multiple-many-int32.js: Added.
8438         (shouldBe):
8439         (test):
8440         * stress/array-push-multiple-many-storage.js: Added.
8441         (shouldBe):
8442         (test):
8443         * stress/array-push-multiple-storage.js: Added.
8444         (shouldBe):
8445         (test):
8446         * stress/array-push-with-force-exit.js: Added.
8447         (target.createBuiltin):
8448
8449 2017-09-29  Saam Barati  <sbarati@apple.com>
8450
8451         Custom GetterSetterAccessCase does not use the correct slotBase when making call
8452         https://bugs.webkit.org/show_bug.cgi?id=177639
8453
8454         Reviewed by Geoffrey Garen.
8455
8456         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
8457         (assert):
8458         (Class):
8459         (items.forEach):
8460         (set get for):
8461
8462 2017-09-29  Commit Queue  <commit-queue@webkit.org>
8463
8464         Unreviewed, rolling out r222563, r222565, and r222581.
8465         https://bugs.webkit.org/show_bug.cgi?id=177675
8466
8467         "It causes a crash when playing youtube videos" (Requested by
8468         saamyjoon on #webkit).
8469
8470         Reverted changesets:
8471
8472         "[DFG] Support ArrayPush with multiple args"
8473         https://bugs.webkit.org/show_bug.cgi?id=175823
8474         http://trac.webkit.org/changeset/222563
8475
8476         "Unreviewed, build fix after r222563"
8477         https://bugs.webkit.org/show_bug.cgi?id=175823
8478         http://trac.webkit.org/changeset/222565
8479
8480         "Unreviewed, fix x86 breaking due to exhausted registers"
8481         https://bugs.webkit.org/show_bug.cgi?id=175823
8482         http://trac.webkit.org/changeset/222581
8483
8484 2017-09-28  Mark Lam  <mark.lam@apple.com>
8485
8486         test262: Unexpected passes after r222617 and r222618.
8487         https://bugs.webkit.org/show_bug.cgi?id=177622
8488         <rdar://problem/34725960>
8489
8490         Reviewed by Saam Barati.
8491
8492         Update test262.yaml for tests that are now passing.
8493
8494         * test262.yaml:
8495
8496 2017-09-27  Michael Saboff  <msaboff@apple.com>
8497
8498         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
8499         https://bugs.webkit.org/show_bug.cgi?id=177570
8500
8501         Reviewed by Filip Pizlo.
8502
8503         New regression test.
8504
8505         * stress/regress-177570.js: Added.
8506
8507 2017-09-28  Michael Saboff  <msaboff@apple.com>
8508
8509         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
8510         https://bugs.webkit.org/show_bug.cgi?id=177423
8511
8512         Reviewed by Mark Lam.
8513
8514         Updated regression test.
8515
8516         * stress/regress-177423.js:
8517         (catch):
8518
8519 2017-09-27  Mark Lam  <mark.lam@apple.com>
8520
8521         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
8522         https://bugs.webkit.org/show_bug.cgi?id=177584
8523         <rdar://problem/34463903>
8524
8525         Reviewed by Saam Barati.
8526
8527         * stress/regress-177584.js: Added.
8528         (assertEqual):
8529         (Array.prototype.Symbol.species):
8530
8531 2017-09-27  Saam Barati  <sbarati@apple.com>
8532
8533         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
8534         https://bugs.webkit.org/show_bug.cgi?id=177523
8535
8536         Reviewed by Mark Lam.
8537
8538         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
8539         (assert):
8540         (Test):
8541         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
8542         (addMethods):
8543         (i.Test.prototype.propName):
8544
8545 2017-09-27  Mark Lam  <mark.lam@apple.com>
8546
8547         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
8548         https://bugs.webkit.org/show_bug.cgi?id=177423
8549         <rdar://problem/34621320>
8550
8551         Reviewed by Keith Miller.
8552
8553         * stress/regress-177423.js: Added.
8554
8555 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
8556
8557         Add Above/Below comparisons for UInt32 patterns
8558         https://bugs.webkit.org/show_bug.cgi?id=177281
8559
8560         Reviewed by Saam Barati.
8561
8562         * stress/uint32-comparison-jump.js: Added.
8563         (shouldBe):
8564         (above):
8565         (aboveOrEqual):
8566         (below):
8567         (belowOrEqual):
8568         (notAbove):
8569         (notAboveOrEqual):
8570         (notBelow):
8571         (notBelowOrEqual):
8572         * stress/uint32-comparison.js: Added.
8573         (shouldBe):
8574         (above):
8575         (aboveOrEqual):
8576         (below):
8577         (belowOrEqual):
8578         (aboveTest):
8579         (aboveOrEqualTest):
8580         (belowTest):
8581         (belowOrEqualTest):
8582
8583 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
8584
8585         [DFG] Support ArrayPush with multiple args
8586         https://bugs.webkit.org/show_bug.cgi?id=175823
8587
8588         Reviewed by Saam Barati.
8589
8590         * microbenchmarks/array-push-0.js: Added.
8591         (arrayPush0):
8592         * microbenchmarks/array-push-1.js: Added.
8593         (arrayPush1):
8594         * microbenchmarks/array-push-2.js: Added.
8595         (arrayPush2):
8596         * microbenchmarks/array-push-3.js: Added.
8597         (arrayPush3):
8598         * stress/array-push-multiple-contiguous.js: Added.
8599         (shouldBe):
8600         (test):
8601         * stress/array-push-multiple-double-nan.js: Added.
8602         (shouldBe):
8603         (test):
8604         * stress/array-push-multiple-double.js: Added.
8605         (shouldBe):
8606         (test):
8607         * stress/array-push-multiple-int32.js: Added.
8608         (shouldBe):
8609         (test):
8610         * stress/array-push-multiple-many-contiguous.js: Added.
8611         (shouldBe):
8612         (test):
8613         * stress/array-push-multiple-many-double.js: Added.
8614         (shouldBe):
8615         (test):
8616         * stress/array-push-multiple-many-int32.js: Added.
8617         (shouldBe):
8618         (test):
8619         * stress/array-push-multiple-many-storage.js: Added.
8620         (shouldBe):
8621         (test):
8622         * stress/array-push-multiple-storage.js: Added.
8623         (shouldBe):
8624         (test):
8625
8626 2017-09-26  Commit Queue  <commit-queue@webkit.org>
8627
8628         Unreviewed, rolling out r222518.
8629         https://bugs.webkit.org/show_bug.cgi?id=177507
8630
8631         Break the High Sierra build (Requested by yusukesuzuki on
8632         #webkit).
8633
8634         Reverted changeset:
8635
8636         "Add Above/Below comparisons for UInt32 patterns"
8637         https://bugs.webkit.org/show_bug.cgi?id=177281
8638         http://trac.webkit.org/changeset/222518
8639
8640 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
8641
8642         Add Above/Below comparisons for UInt32 patterns
8643         https://bugs.webkit.org/show_bug.cgi?id=177281
8644
8645         Reviewed by Saam Barati.
8646
8647         * stress/uint32-comparison-jump.js: Added.
8648         (shouldBe):
8649         (above):
8650         (aboveOrEqual):
8651         (below):
8652         (belowOrEqual):
8653         (notAbove):
8654         (notAboveOrEqual):
8655         (notBelow):
8656         (notBelowOrEqual):
8657         * stress/uint32-comparison.js: Added.
8658         (shouldBe):
8659         (above):
8660         (aboveOrEqual):
8661         (below):
8662         (belowOrEqual):
8663         (aboveTest):
8664         (aboveOrEqualTest):
8665         (belowTest):
8666         (belowOrEqualTest):
8667
8668 2017-09-23  Keith Miller  <keith_miller@apple.com>
8669
8670         Fix infinite looping test262 test
8671         https://bugs.webkit.org/show_bug.cgi?id=177412
8672
8673         Reviewed by Yusuke Suzuki.
8674
8675         This test was poorly designed since failing it would cause the vm
8676         to inifinite loop. I've fixed it locally and will fix it on github pending
8677         the results of next weeks tc39 meeting.
8678
8679         * test262.yaml:
8680         * test262/test/language/statements/for-of/iterator-next-reference.js:
8681
8682 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
8683
8684         test262: $.agent became $262.agent in test262 update
8685         https://bugs.webkit.org/show_bug.cgi?id=177407
8686
8687         Reviewed by Yusuke Suzuki.
8688
8689         * test262.yaml:
8690         ~320 tests pass now that we correctly make $262 available.
8691
8692 2017-09-22  Keith Miller  <keith_miller@apple.com>
8693
8694         Speculatively change iteration protocall to use the same next function
8695         https://bugs.webkit.org/show_bug.cgi?id=175653
8696
8697         Reviewed by Saam Barati.
8698
8699         Change test to match the new iteration behavior.
8700
8701         * stress/spread-optimized-properly.js:
8702
8703 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
8704
8705         [DFG][FTL] Profile array vector length for array allocation
8706         https://bugs.webkit.org/show_bug.cgi?id=177051
8707
8708         Reviewed by Saam Barati.
8709
8710         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
8711         (target):
8712
8713 2017-09-22  Commit Queue  <commit-queue@webkit.org>
8714
8715         Unreviewed, rolling out r222380.
8716         https://bugs.webkit.org/show_bug.cgi?id=177352
8717
8718         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
8719         #webkit).
8720
8721         Reverted changeset:
8722
8723         "[DFG][FTL] Profile array vector length for array allocation"
8724         https://bugs.webkit.org/show_bug.cgi?id=177051
8725         http://trac.webkit.org/changeset/222380
8726
8727 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
8728
8729         [DFG][FTL] Profile array vector length for array allocation
8730         https://bugs.webkit.org/show_bug.cgi?id=177051
8731
8732         Reviewed by Saam Barati.
8733
8734         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
8735         (target):
8736
8737 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
8738
8739         Skip new hanging test262 tests.
8740         https://bugs.webkit.org/show_bug.cgi?id=177326
8741
8742         Unreviewed test gardening.
8743
8744         * test262.yaml:
8745
8746 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
8747
8748         Mark 6 test262 tests as passing.
8749         https://bugs.webkit.org/show_bug.cgi?id=177307
8750
8751         Unreviewed test gardening.
8752
8753         * test262.yaml:
8754
8755 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
8756
8757         Unreviewed follow-up to r222311.
8758
8759         * test262/harness/sta.js:
8760         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
8761         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
8762         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
8763         * test262/test/built-ins/Array/from/elements-added-after.js:
8764         * test262/test/built-ins/Array/from/elements-deleted-after.js:
8765         * test262/test/built-ins/Array/from/elements-updated-after.js:
8766         * test262/test/built-ins/Array/from/from-array.js:
8767         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
8768         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
8769         * test262/test/built-ins/Array/from/source-array-boundary.js:
8770         * test262/test/built-ins/Array/from/source-object-constructor.js:
8771         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
8772         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
8773         * test262/test/built-ins/Array/from/source-object-length.js:
8774         * test262/test/built-ins/Array/from/source-object-missing.js:
8775         * test262/test/built-ins/Array/from/source-object-without.js:
8776         * test262/test/built-ins/Array/from/this-null.js:
8777         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
8778         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
8779         * test262/test/language/literals/numeric/7.8.3-1gs.js:
8780         * test262/test/language/literals/numeric/7.8.3-2gs.js:
8781         * test262/test/language/literals/numeric/7.8.3-3gs.js:
8782         * test262/test/language/literals/regexp/7.8.5-1gs.js:
8783         * test262/test/language/literals/string/7.8.4-1gs.js:
8784         Fix some files that I failed to update when I applied my patch.
8785
8786 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
8787
8788         Update test262 tests
8789         https://bugs.webkit.org/show_bug.cgi?id=177220
8790
8791         Reviewed by Saam Barati and Yusuke Suzuki.
8792
8793         * test262.yaml:
8794         * test262/test262-Revision.txt:
8795         New rebaselined expectations for all tests.
8796
8797         * test262/*:
8798         Updated.
8799
8800 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
8801
8802         [DFG] Remove ToThis more aggressively
8803         https://bugs.webkit.org/show_bug.cgi?id=177056
8804
8805         Reviewed by Saam Barati.
8806
8807         * stress/generator-with-this-strict.js: Added.
8808         (shouldBe):
8809         (generator):
8810         (target):
8811         * stress/generator-with-this.js: Added.
8812         (shouldBe):
8813         (generator):
8814         (target):
8815
8816 2017-09-17  Michael Saboff  <msaboff@apple.com>
8817
8818         https://bugs.webkit.org/show_bug.cgi?id=177038
8819         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
8820
8821         Reviewed by JF Bastien.
8822
8823         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
8824         as it dies using too much memory.
8825
8826 2017-09-15  Saam Barati  <sbarati@apple.com>
8827
8828         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
8829         https://bugs.webkit.org/show_bug.cgi?id=176981
8830
8831         Reviewed by Yusuke Suzuki.
8832
8833         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
8834         (assert):
8835         (verify):
8836         (func):
8837         (const.bar.createBuiltin):
8838
8839 2017-09-14  Saam Barati  <sbarati@apple.com>
8840
8841         It should be valid to exit before each set when doing arity fixup when inlining
8842         https://bugs.webkit.org/show_bug.cgi?id=176948
8843
8844         Reviewed by Keith Miller.
8845
8846         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
8847         (baz):
8848         (bar):
8849         (foo):
8850
8851 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
8852
8853         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
8854         https://bugs.webkit.org/show_bug.cgi?id=176867
8855
8856         Reviewed by Sam Weinig.
8857
8858         * microbenchmarks/object-get-own-property-symbols.js: Added.
8859         (test):
8860
8861 2017-09-13  Mark Lam  <mark.lam@apple.com>
8862
8863         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
8864         https://bugs.webkit.org/show_bug.cgi?id=176888
8865         <rdar://problem/34381832>
8866
8867         Not reviewed.
8868
8869         * stress/op_mod-ConstVar.js:
8870         * stress/op_mod-VarConst.js:
8871         * stress/op_mod-VarVar.js:
8872
8873 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
8874
8875         Skip 3 op_mod tests on Debug JSC bots.
8876         https://bugs.webkit.org/show_bug.cgi?id=176630
8877
8878         Unreviewed test gardening.
8879
8880         * stress/op_mod-ConstVar.js:
8881         * stress/op_mod-VarConst.js:
8882         * stress/op_mod-VarVar.js:
8883
8884 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
8885
8886         [JSC] Fix Array allocation in Object.keys
8887         https://bugs.webkit.org/show_bug.cgi?id=176826
8888
8889         Reviewed by Saam Barati.
8890
8891         * stress/object-own-property-keys.js: Added.
8892         (shouldBe):
8893
8894 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
8895
8896         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
8897         https://bugs.webkit.org/show_bug.cgi?id=176010
8898
8899         Reviewed by Filip Pizlo.
8900
8901         * microbenchmarks/weak-map-key.js: Added.
8902         (assert):
8903         (objectKey):
8904         (let.start.Date.now):
8905
8906 2017-09-12  Mark Lam  <mark.lam@apple.com>
8907
8908         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
8909         https://bugs.webkit.org/show_bug.cgi?id=176630
8910
8911         Reviewed by JF Bastien.
8912
8913         Debug builds are just slow, and these tests do a lot.  They pass when I run them
8914         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
8915         a speculative fix for the bots that are seeing these fail.
8916
8917         I also undid the skipping of the op_mod tests for debug builds.
8918
8919         * stress/op_div-ConstVar.js:
8920         * stress/op_div-VarConst.js:
8921         * stress/op_div-VarVar.js:
8922         * stress/op_mod-ConstVar.js:
8923         * stress/op_mod-VarConst.js:
8924         * stress/op_mod-VarVar.js:
8925
8926 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
8927
8928         Skip stress/value-to-boolean.js on Debug bots.
8929         https://bugs.webkit.org/show_bug.cgi?id=176787
8930
8931         Unreviewed test gardening.
8932
8933         * stress/value-to-boolean.js:
8934
8935 2017-09-11  Mark Lam  <mark.lam@apple.com>
8936
8937         Change test expectation for test262/test/language/statements/try/tco-catch.js
8938         https://bugs.webkit.org/show_bug.cgi?id=176749
8939
8940         Rubber stamped by Keith Miller.
8941
8942         It's been failing since at least r221821.  I'm changing the test expectation to
8943         fail to green the bots while I investigate some more.
8944
8945         * test262.yaml:
8946
8947 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
8948
8949         Unreviewed, rolling out r221854.
8950
8951         The test added with this change fails on 32-bit JSC bots.
8952
8953         Reverted changeset:
8954
8955         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
8956         https://bugs.webkit.org/show_bug.cgi?id=176010
8957         http://trac.webkit.org/changeset/221854
8958
8959 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
8960
8961         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
8962         https://bugs.webkit.org/show_bug.cgi?id=176010
8963
8964         Reviewed by Filip Pizlo.
8965
8966         * microbenchmarks/weak-map-key.js: Added.
8967         (assert):
8968         (objectKey):
8969         (let.start.Date.now):
8970
8971 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
8972
8973         [JSC] Optimize Object.keys by using careful array allocation
8974         https://bugs.webkit.org/show_bug.cgi?id=176654
8975
8976         Reviewed by Darin Adler.
8977
8978         * microbenchmarks/object-keys.js: Added.
8979         (test):
8980
8981 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
8982
8983         Error should compute .stack and friends lazily
8984         https://bugs.webkit.org/show_bug.cgi?id=176645
8985
8986         Reviewed by Saam Barati.
8987
8988         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
8989         * microbenchmarks/new-error.js: Added.
8990         * microbenchmarks/throw.js: Added.
8991
8992 2017-09-09  Mark Lam  <mark.lam@apple.com>
8993
8994         [Re-landing] Use JIT probes for DFG OSR exit.
8995         https://bugs.webkit.org/show_bug.cgi?id=175144
8996         <rdar://problem/33437050>
8997
8998         Not reviewed.  Original patch reviewed by Saam Barati.
8999
9000         Disable these tests for debug builds because they run too slow with the new OSR exit.
9001
9002         * stress/op_mod-ConstVar.js:
9003         * stress/op_mod-VarConst.js:
9004         * stress/op_mod-VarVar.js:
9005
9006 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
9007
9008         [DFG] NewArrayWithSize(size)'s size does not care negative zero
9009         https://bugs.webkit.org/show_bug.cgi?id=176300
9010
9011         Reviewed by Saam Barati.
9012
9013         * stress/new-array-with-size-div.js: Added.
9014         (shouldBe):
9015         (test):
9016         (i.i):
9017
9018 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
9019
9020         [DFG] PutByVal with Array::Generic is too generic
9021         https://bugs.webkit.org/show_bug.cgi?id=176345
9022
9023         Reviewed by Filip Pizlo.
9024
9025         * stress/object-assign-symbols.js: Added.
9026         (shouldBe):
9027         (test):
9028         * stress/object-assign.js: Added.
9029         (shouldBe):
9030         (test):
9031         (i.shouldBe.JSON.stringify.test):
9032
9033 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
9034
9035         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
9036         https://bugs.webkit.org/show_bug.cgi?id=176590
9037
9038         Reviewed by Saam Barati.
9039
9040         * microbenchmarks/object-iterate-symbols.js: Added.
9041         (test):
9042         * microbenchmarks/object-iterate.js: Added.
9043         (test):
9044         * stress/object-iterate-symbols.js: Added.
9045         (shouldBe):
9046         (test):
9047         * stress/object-iterate.js: Added.
9048         (shouldBe):
9049         (test):
9050
9051 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
9052
9053         [Win32] 10 JSC stress tests are failing.
9054         https://bugs.webkit.org/show_bug.cgi?id=176538
9055
9056         Reviewed by Mark Lam.
9057
9058         Skip tests on Windows to make the bots green.
9059
9060         * ChakraCore.yaml:
9061         * stress/date-relaxed.js:
9062
9063 2017-09-06  Mark Lam  <mark.lam@apple.com>
9064
9065         constructGenericTypedArrayViewWithArguments() is missing an exception check.
9066         https://bugs.webkit.org/show_bug.cgi?id=176485
9067         <rdar://problem/33898874>
9068
9069         Reviewed by Keith Miller.
9070
9071         * stress/regress-176485.js: Added.
9072
9073 2017-09-05  Saam Barati  <sbarati@apple.com>
9074
9075         isNotCellSpeculation is wrong with respect to SpecEmpty
9076         https://bugs.webkit.org/show_bug.cgi?id=176429
9077
9078         Reviewed by Michael Saboff.
9079
9080         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
9081         (Foo):
9082
9083 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
9084
9085         test262: Completion values for control flow do not match the spec
9086         https://bugs.webkit.org/show_bug.cgi?id=171265
9087
9088         Reviewed by Saam Barati.
9089
9090         * stress/completion-value.js:
9091         Condensed test for completion values in top level statements.
9092
9093         * stress/super-get-by-id.js:
9094         ClassDeclaration when evaled no longer produce values. Convert
9095         these to ClassExpressions so they produce the class value.
9096
9097         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
9098         This is a progression for currect spec behavior.
9099
9100         * mozilla/mozilla-tests.yaml:
9101         This test is now outdated, so mark it as failing for that reason.
9102
9103         * test262.yaml:
9104         Passing all "cptn" completion value tests.
9105
9106 2017-09-04  Saam Barati  <sbarati@apple.com>
9107
9108         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
9109         https://bugs.webkit.org/show_bug.cgi?id=176317
9110
9111         Reviewed by Keith Miller.
9112
9113         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
9114         (Foo):
9115
9116 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
9117
9118         [DFG][FTL] Efficiently execute number#toString()
9119         https://bugs.webkit.org/show_bug.cgi?id=170007
9120
9121         Reviewed by Keith Miller.
9122
9123         * microbenchmarks/number-to-string-strength-reduction.js: Added.
9124         (test):
9125         * microbenchmarks/number-to-string-with-radix-10.js: Added.
9126         (test):
9127         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
9128         (test):
9129         * microbenchmarks/number-to-string-with-radix.js: Added.
9130         (test):
9131         * stress/number-to-string-strength-reduction.js: Added.
9132         (shouldBe):
9133         (test):
9134         * stress/number-to-string-with-radix-10.js: Added.
9135         (shouldBe):
9136         (test):
9137         * stress/number-to-string-with-radix-cse.js: Added.
9138         (shouldBe):
9139         (test):
9140         * stress/number-to-string-with-radix-invalid.js: Added.
9141         (shouldThrow):
9142         * stress/number-to-string-with-radix-watchpoint.js: Added.
9143         (shouldBe):
9144         (test):
9145         (i.i.1e3.Number.prototype.toString):
9146         * stress/number-to-string-with-radix.js: Added.
9147         (shouldBe):
9148         (test):
9149
9150 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
9151
9152         [DFG] Relax arity requirement
9153         https://bugs.webkit.org/show_bug.cgi?id=175523
9154
9155         Reviewed by Saam Barati.
9156
9157         * stress/arity-mismatch-arguments-length.js: Added.
9158         (shouldBe):
9159         (test1):
9160         (test):
9161         * stress/arity-mismatch-get-argument.js: Added.
9162         (shouldBe):
9163         (builtin.createBuiltin):
9164         (test):
9165         * stress/arity-mismatch-inlining-extra-slots.js: Added.
9166         (shouldBe):
9167         (inlineTarget):
9168         (test):
9169         * stress/arity-mismatch-inlining.js: Added.
9170         (shouldBe):
9171         (inlineTarget):
9172         (test):
9173         * stress/arity-mismatch-rest.js: Added.
9174         (shouldBe):
9175         (test2):
9176         (test1):
9177         (test):
9178
9179 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
9180
9181         [JSC] Fix "name" and "length" of Proxy revoke function
9182         https://bugs.webkit.org/show_bug.cgi?id=176155
9183
9184         Reviewed by Mark Lam.
9185
9186         * test262.yaml:
9187
9188 2017-08-31  Saam Barati  <sbarati@apple.com>
9189
9190         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
9191         https://bugs.webkit.org/show_bug.cgi?id=176206
9192
9193         Reviewed by Keith Miller.
9194
9195         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
9196         (a):
9197         (b):
9198         (foo):
9199
9200 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
9201
9202         Skip two slow JSC tests after r221422.
9203
9204         Unreviewed test gardening.
9205
9206         * stress/regexp-prototype-match-on-too-long-rope.js:
9207         * stress/regexp-prototype-test-on-too-long-rope.js:
9208
9209 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
9210
9211         Unreviewed, skipping slow tests.
9212
9213         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
9214         work differently now.
9215
9216         * stress/regexp-prototype-exec-on-too-long-rope.js:
9217         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
9218
9219 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
9220
9221         [JSC] Use reifying system for "name" property of builtin JSFunction
9222         https://bugs.webkit.org/show_bug.cgi?id=175260
9223
9224         Reviewed by Saam Barati.
9225
9226         * stress/accessors-get-set-prefix.js:
9227         * stress/builtin-function-name.js: Added.
9228         (shouldBe):
9229         (shouldThrow):
9230         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
9231         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
9232         * stress/private-name-as-anonymous-builtin.js: Added.
9233         (shouldBe):
9234         (NotPromise):
9235
9236 2017-08-30  Saam Barati  <sbarati@apple.com>
9237
9238         Unreviewed. Make test stop printing.
9239
9240         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
9241
9242 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
9243
9244         Unreviewed, rolling out r221327.
9245
9246         This change caused test262 failures.
9247
9248         Reverted changeset:
9249
9250         "[JSC] Use reifying system for "name" property of builtin
9251         JSFunction"
9252         https://bugs.webkit.org/show_bug.cgi?id=175260
9253         http://trac.webkit.org/changeset/221327
9254
9255 2017-08-30  Saam Barati  <sbarati@apple.com>
9256
9257         semicolon is being interpreted as an = in the LiteralParser
9258         https://bugs.webkit.org/show_bug.cgi?id=176114
9259
9260         Reviewed by Oliver Hunt.
9261
9262         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
9263         * stress/resources/literal-parser-test-case.js: Added.
9264
9265 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
9266
9267         [ESNext] Async iteration - Implement async iteration statement: for-await-of
9268         https://bugs.webkit.org/show_bug.cgi?id=166698
9269
9270         Reviewed by Yusuke Suzuki.
9271
9272         * stress/async-iteration-for-await-of-syntax.js: Added.
9273         (assert):
9274         (checkSyntax):
9275         (checkSyntaxError):
9276         (checkSimpleAsyncGeneratorSloppyMode):
9277         (checkSimpleAsyncGeneratorStrictMode):
9278         (checkNestedAsyncGenerators):
9279         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
9280         * stress/async-iteration-for-await-of.js: Added.
9281         (assert):
9282         (async.foo):
9283         (async.boo):
9284         (const.boo.async):
9285
9286 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
9287
9288         [JSC] Use reifying system for "name" property of builtin JSFunction
9289         https://bugs.webkit.org/show_bug.cgi?id=175260
9290
9291         Reviewed by Saam Barati.
9292
9293         * stress/accessors-get-set-prefix.js:
9294         * stress/builtin-function-name.js: Added.
9295         (shouldBe):
9296         (shouldThrow):
9297         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
9298         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
9299
9300 2017-08-25  Saam Barati  <sbarati@apple.com>
9301
9302         Support compiling catch in the DFG
9303         https://bugs.webkit.org/show_bug.cgi?id=174590
9304         <rdar://problem/34047845>
9305
9306         Reviewed by Filip Pizlo.
9307
9308         * microbenchmarks/delta-blue-try-catch.js: Added.
9309         (exception):
9310         (value):
9311         (OrderedCollection):
9312         (OrderedCollection.prototype.add):
9313         (OrderedCollection.prototype.at):
9314         (OrderedCollection.prototype.size):
9315         (OrderedCollection.prototype.removeFirst):
9316         (OrderedCollection.prototype.remove):
9317         (Strength):
9318         (Strength.stronger):
9319         (Strength.weaker):
9320         (Strength.weakestOf):
9321         (Strength.strongest):
9322         (Strength.prototype.nextWeaker):
9323         (Constraint):
9324         (Constraint.prototype.addConstraint):
9325         (Constraint.prototype.satisfy):
9326         (Constraint.prototype.destroyConstraint):
9327         (Constraint.prototype.isInput):
9328         (UnaryConstraint):
9329         (UnaryConstraint.prototype.addToGraph):
9330         (UnaryConstraint.prototype.chooseMethod):
9331         (UnaryConstraint.prototype.isSatisfied):
9332         (UnaryConstraint.prototype.markInputs):
9333         (UnaryConstraint.prototype.output):
9334         (UnaryConstraint.prototype.recalculate):
9335         (UnaryConstraint.prototype.markUnsatisfied):
9336         (UnaryConstraint.prototype.inputsKnown):
9337         (UnaryConstraint.prototype.removeFromGraph):
9338         (StayConstraint):
9339         (StayConstraint.prototype.execute):
9340         (EditConstraint.prototype.isInput):
9341         (EditConstraint.prototype.execute):
9342         (BinaryConstraint):
9343         (BinaryConstraint.prototype.chooseMethod):
9344         (BinaryConstraint.prototype.addToGraph):
9345         (BinaryConstraint.prototype.isSatisfied):
9346         (BinaryConstraint.prototype.markInputs):
9347         (BinaryConstraint.prototype.input):
9348         (BinaryConstraint.prototype.output):
9349         (BinaryConstraint.prototype.recalculate):
9350         (BinaryConstraint.prototype.markUnsatisfied):
9351         (BinaryConstraint.prototype.inputsKnown):
9352         (BinaryConstraint.prototype.removeFromGraph):
9353         (ScaleConstraint):
9354         (ScaleConstraint.prototype.addToGraph):
9355         (ScaleConstraint.prototype.removeFromGraph):
9356         (ScaleConstraint.prototype.markInputs):
9357         (ScaleConstraint.prototype.execute):
9358         (ScaleConstraint.prototype.recalculate):
9359         (EqualityConstraint):
9360         (EqualityConstraint.prototype.execute):
9361         (Variable):
9362         (Variable.prototype.addConstraint):
9363         (Variable.prototype.removeConstraint):
9364         (Planner):
9365         (Planner.prototype.incrementalAdd):
9366         (Planner.prototype.incrementalRemove):
9367         (Planner.prototype.newMark):
9368         (Planner.prototype.makePlan):
9369         (Planner.prototype.extractPlanFromConstraints):
9370         (Planner.prototype.addPropagate):
9371         (Planner.prototype.removePropagateFrom):
9372         (Planner.prototype.addConstraintsConsumingTo):
9373         (Plan):
9374         (Plan.prototype.addConstraint):
9375         (Plan.prototype.size):
9376         (Plan.prototype.constraintAt):
9377         (Plan.prototype.execute):
9378         (chainTest):
9379         (projectionTest):
9380         (change):
9381         (deltaBlue):
9382         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
9383         (assert):
9384         (Numbers):
9385         (Numbers.prototype.next):
9386         (return.Transpose):
9387         (return.Transpose.prototype.next):
9388         (transpose):
9389         (verifyEven):
9390         (verifyString):
9391         (foo):
9392         (runIterators):
9393         * microbenchmarks/try-catch-word-count.js: Added.
9394         (let.assert):
9395         (EOF):
9396         (let.texts):
9397         (let.o.apply):
9398         (foo):
9399         (bar):
9400         (f):
9401         (run):
9402         (test1):
9403         (test2):
9404         (test3):
9405         (fn):
9406         (A):
9407         (B):
9408         (A.prototype.getValue):
9409         (B.prototype.getParentValue):
9410         (strlen):
9411         (sum.0):
9412         (test):
9413         (result.test.o):
9414         (set add.set add):
9415         (set forEach):
9416         (stringHash):
9417         (set if):
9418         (testFunction):
9419         (set delete.set has.set add):
9420         * stress/catch-set-argument-speculation-failure.js: Added.
9421         (o):
9422         (e):
9423         (e2):
9424         (escape):
9425         (baz):
9426         (noInline.run):
9427         (noInline):
9428         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
9429         (foo):
9430         (e):
9431         (baz):
9432         (bar):
9433
9434 2017-08-24  Commit Queue  <commit-queue@webkit.org>
9435
9436         Unreviewed, rolling out r221119, r221124, and r221143.
9437         https://bugs.webkit.org/show_bug.cgi?id=175973
9438
9439         "I think it regressed JSBench by 20%" (Requested by saamyjoon
9440         on #webkit).
9441
9442         Reverted changesets:
9443
9444         "Support compiling catch in the DFG"
9445         https://bugs.webkit.org/show_bug.cgi?id=174590
9446         http://trac.webkit.org/changeset/221119
9447
9448         "Unreviewed, build fix in GTK port"
9449         https://bugs.webkit.org/show_bug.cgi?id=174590
9450         http://trac.webkit.org/changeset/221124
9451
9452         "DFG::JITCode::osrEntry should get sorted since we perform a
9453         binary search on it"
9454         https://bugs.webkit.org/show_bug.cgi?id=175893
9455         http://trac.webkit.org/changeset/221143
9456
9457 2017-08-24  Michael Saboff  <msaboff@apple.com>
9458
9459         Add support for RegExp "dotAll" flag
9460         https://bugs.webkit.org/show_bug.cgi?id=175924
9461
9462         Reviewed by Keith Miller.
9463
9464         Updated tests for new dotAll ('s' flag) changes.
9465
9466         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
9467         * stress/static-getter-in-names.js:
9468
9469 2017-08-24  Mark Lam  <mark.lam@apple.com>
9470
9471         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
9472         https://bugs.webkit.org/show_bug.cgi?id=175940
9473         <rdar://problem/29003921>
9474
9475         Reviewed by Saam Barati.
9476
9477         * stress/regress-164081.js: Added.
9478         (shouldEqual):
9479         (testcase):
9480
9481 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
9482
9483         Skip flaky JSC test stress/test-finally.js.
9484         https://bugs.webkit.org/show_bug.cgi?id=160283
9485
9486         Unreviewed test gardening.
9487
9488         * stress/test-finally.js:
9489
9490 2017-08-23  Saam Barati  <sbarati@apple.com>
9491
9492         Support compiling catch in the DFG
9493         https://bugs.webkit.org/show_bug.cgi?id=174590
9494
9495         Reviewed by Filip Pizlo.
9496
9497         * microbenchmarks/delta-blue-try-catch.js: Added.
9498         (exception):
9499         (value):
9500         (OrderedCollection):
9501         (OrderedCollection.prototype.add):
9502         (OrderedCollection.prototype.at):
9503         (OrderedCollection.prototype.size):
9504         (OrderedCollection.prototype.removeFirst):
9505         (OrderedCollection.prototype.remove):
9506         (Strength):
9507         (Strength.stronger):
9508         (Strength.weaker):
9509         (Strength.weakestOf):
9510         (Strength.strongest):
9511         (Strength.prototype.nextWeaker):
9512         (Constraint):
9513         (Constraint.prototype.addConstraint):
9514         (Constraint.prototype.satisfy):
9515         (Constraint.prototype.destroyConstraint):
9516         (Constraint.prototype.isInput):
9517         (UnaryConstraint):
9518         (UnaryConstraint.prototype.addToGraph):
9519         (UnaryConstraint.prototype.chooseMethod):
9520         (UnaryConstraint.prototype.isSatisfied):
9521         (UnaryConstraint.prototype.markInputs):
9522         (UnaryConstraint.prototype.output):
9523         (UnaryConstraint.prototype.recalculate):
9524         (UnaryConstraint.prototype.markUnsatisfied):
9525         (UnaryConstraint.prototype.inputsKnown):
9526         (UnaryConstraint.prototype.removeFromGraph):
9527         (StayConstraint):
9528         (StayConstraint.prototype.execute):
9529         (EditConstraint.prototype.isInput):
9530         (EditConstraint.prototype.execute):
9531         (BinaryConstraint):
9532         (BinaryConstraint.prototype.chooseMethod):
9533         (BinaryConstraint.prototype.addToGraph):
9534         (BinaryConstraint.prototype.isSatisfied):
9535         (BinaryConstraint.prototype.markInputs):
9536         (BinaryConstraint.prototype.input):
9537         (BinaryConstraint.prototype.output):
9538         (BinaryConstraint.prototype.recalculate):
9539         (BinaryConstraint.prototype.markUnsatisfied):
9540         (BinaryConstraint.prototype.inputsKnown):
9541         (BinaryConstraint.prototype.removeFromGraph):
9542         (ScaleConstraint):
9543         (ScaleConstraint.prototype.addToGraph):
9544         (ScaleConstraint.prototype.removeFromGraph):
9545         (ScaleConstraint.prototype.markInputs):
9546         (ScaleConstraint.prototype.execute):
9547         (ScaleConstraint.prototype.recalculate):
9548         (EqualityConstraint):
9549         (EqualityConstraint.prototype.execute):
9550         (Variable):
9551         (Variable.prototype.addConstraint):
9552         (Variable.prototype.removeConstraint):
9553         (Planner):
9554         (Planner.prototype.incrementalAdd):
9555         (Planner.prototype.incrementalRemove):
9556         (Planner.prototype.newMark):
9557         (Planner.prototype.makePlan):
9558         (Planner.prototype.extractPlanFromConstraints):
9559         (Planner.prototype.addPropagate):
9560         (Planner.prototype.removePropagateFrom):
9561         (Planner.prototype.addConstraintsConsumingTo):
9562         (Plan):
9563         (Plan.prototype.addConstraint):
9564         (Plan.prototype.size):
9565         (Plan.prototype.constraintAt):
9566         (Plan.prototype.execute):
9567         (chainTest):
9568         (projectionTest):
9569         (change):
9570         (deltaBlue):
9571         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
9572         (assert):
9573         (Numbers):
9574         (Numbers.prototype.next):
9575         (return.Transpose):
9576         (return.Transpose.prototype.next):
9577         (transpose):
9578         (verifyEven):
9579         (verifyString):
9580         (foo):
9581         (runIterators):
9582         * microbenchmarks/try-catch-word-count.js: Added.
9583         (let.assert):
9584         (EOF):
9585         (let.texts):
9586         (let.o.apply):
9587         (foo):
9588         (bar):
9589         (f):
9590         (run):
9591         (test1):
9592         (test2):
9593         (test3):
9594         (fn):
9595         (A):
9596         (B):
9597         (A.prototype.getValue):
9598         (B.prototype.getParentValue):
9599         (strlen):
9600         (sum.0):
9601         (test):
9602         (result.test.o):
9603         (set add.set add):
9604         (set forEach):
9605         (stringHash):
9606         (set if):
9607         (testFunction):
9608         (set delete.set has.set add):
9609         * stress/catch-set-argument-speculation-failure.js: Added.
9610         (o):
9611         (e):
9612         (e2):
9613         (escape):
9614         (baz):
9615         (noInline.run):
9616         (noInline):
9617         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
9618         (foo):
9619         (e):
9620         (baz):
9621         (bar):
9622
9623 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
9624
9625         [JSC] Optimize Map iteration with intrinsic
9626         https://bugs.webkit.org/show_bug.cgi?id=174355
9627
9628         Reviewed by Saam Barati.
9629
9630         * stress/map-iterator-result-should-have-expected-shape.js: Added.
9631         (shouldBe):
9632         (throw.new.Error):
9633         * stress/set-iterator-result-should-have-expected-shape.js: Added.
9634         (shouldBe):
9635         (throw.new.Error.let.iterator.set Symbol):
9636         (throw.new.Error.set add):
9637         (let.iterator.set Symbol):
9638
9639 2017-08-23  Robin Morisset  <rmorisset@apple.com>
9640
9641         Add a micro-benchmark for checking that accessing a variable within a 'with'
9642         block does not automatically prevent type prediction.
9643         https://bugs.webkit.org/show_bug.cgi?id=175738
9644
9645         Reviewed by Saam Barati.
9646
9647         * stress/with_and_arith.js: Added.
9648         (with):
9649
9650 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
9651
9652         [ESNext] Async iteration - Implement Async Generator - runtime
9653         https://bugs.webkit.org/show_bug.cgi?id=175240
9654
9655         Reviewed by Yusuke Suzuki.
9656
9657         * stress/async-iteration-async-from-sync.js: Added.
9658         (assert):
9659         (const.Logger):
9660         (this.fullfilled):
9661         (this.fullfilledDone):
9662         (this.rejected):
9663         (this.catched):
9664         (this.isFinal):
9665         (_assertLogger):
9666         (const.assertLogger):
9667         (const.getPromise.promiseHolder.return.new.Promise):
9668         (foo):
9669         (async.boo):
9670         (bar):
9671         (async.baz):
9672         (async.goo):
9673         * stress/async-iteration-basic.js: Added.
9674         (assert):
9675         (const.Logger):
9676         (this.fullfilled):
9677         (this.fullfilledDone):
9678         (this.rejected):
9679         (this.catched):
9680         (this.isFinal):
9681         (_assertLogger):
9682         (const.assertLogger):
9683         (const.getPromise.promiseHolder.return.new.Promise):
9684         (async.generator):
9685         (iterator.next.then):
9686         (async.baz):
9687         (async.boo):
9688         (async.foo):
9689         (async.goo):
9690         (A.prototype.async.foo):
9691         (A.prototype.async.boo):
9692         (A):
9693         (asyncGenExp.async):
9694         (async.joo):
9695         (j.next.then):
9696         (then):
9697         (async.koo):
9698         (async.loo):
9699         (async.moo):
9700         (async.noo):
9701         (async.ooo):
9702         (async.roo):
9703         (async.poo):
9704         (async.soo):
9705         (async.too):
9706         * stress/async-iteration-evaluation.js: Added.
9707         (assert):
9708         (async.foo):
9709         (catch):
9710         * stress/async-iteration-syntax.js:
9711         * stress/async-iteration-yield-promise.js: Added.
9712         (assert):
9713         (const.Logger):
9714         (this.fullfilled):
9715         (this.fullfilledDone):
9716         (this.rejected):
9717         (this.catched):
9718         (this.isFinal):
9719         (_assertLogger):
9720         (const.assertLogger):
9721         (const.getPromise.promiseHolder.return.new.Promise):
9722         (async.foo):
9723         (async.boo):
9724         (async.bar):
9725         * stress/async-iteration-yield-star-interface.js: Added.
9726         (assert):
9727         (const.getPromise.promiseHolder.return.new.Promise):
9728         (const.Logger):
9729         (this.fullfilled):
9730         (this.fullfilledDone):
9731         (this.rejected):
9732         (this.catched):
9733         (this.custom):
9734         (this.isFinal):
9735         (_assertLogger):
9736         (const.assertLogger):
9737         (let.asyncIter.Symbol.asyncIterator):
9738         (let.asyncIter.next):
9739         (let.asyncIter.throw):
9740         (let.asyncIter.return):
9741         (async.foo):
9742         (asyncIter.Symbol.asyncIterator):
9743         (asyncIter.next):
9744         (async.boo):
9745         (asyncIter.return):
9746         (async.bar):
9747         (async.baz):
9748         (async.foobar):
9749         * stress/async-iteration-yield-star.js: Added.
9750         (assert):
9751         (const.Logger):
9752         (this.fullfilled):
9753         (this.fullfilledDone):
9754         (this.rejected):
9755         (this.catched):
9756         (this.custom):
9757         (this.isFinal):
9758         (_assertLogger):
9759         (const.assertLogger):
9760         (const.getPromise.promiseHolder.return.new.Promise):
9761         (async.foo):
9762         (async.boo):
9763         (async.bar):
9764         (async.baz):
9765         (async.joo):
9766         (async.goo):
9767         (async.koo):
9768         (async.loo):
9769         (let.asyncIter.Symbol.asyncIterator):
9770         (let.asyncIter.next):
9771         (let.asyncIter.throw):
9772         (let.asyncIter.return):
9773         (async.moo):
9774         (async.noo):
9775         * test262.yaml:
9776
9777 2017-08-23  JF Bastien  <jfbastien@apple.com>
9778
9779         Fix printing in test
9780
9781         Unreviewed: fixing verbosity, shouldn't have been there.
9782
9783         * wasm/regress/175693.js:
9784         (else.else):
9785         (catch):
9786
9787 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
9788
9789         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
9790         https://bugs.webkit.org/show_bug.cgi?id=172543
9791
9792         Unreviewed test gardening.
9793
9794         * microbenchmarks/generator-with-several-types.js:
9795
9796 2017-08-17  JF Bastien  <jfbastien@apple.com>
9797
9798         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
9799         https://bugs.webkit.org/show_bug.cgi?id=175693
9800         <rdar://problem/33952443>
9801
9802         Reviewed by Saam Barati.
9803
9804         Add a regression directory for WebAssembly tests.
9805
9806         * wasm.yaml:
9807         * wasm/regress/175693.js: Added.
9808         (else.else):
9809         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
9810         (catch):
9811         * wasm/regress/175693.wasm: Added.
9812
9813 2017-08-15  Robin Morisset  <rmorisset@apple.com>
9814
9815         Support the 'with' keyword in FTL.
9816         https://bugs.webkit.org/show_bug.cgi?id=175585
9817
9818         Reviewed by Saam Barati.
9819
9820         Also improve the JSTest/stress/with.js file to test
9821         what happens when non-objects are passed to with.
9822
9823         * stress/with.js:
9824         (foo):
9825         (i.catch):
9826         (i.with): Deleted.
9827
9828 2017-08-14  Keith Miller  <keith_miller@apple.com>
9829
9830         Add testing tool to lie to the DFG about profiles
9831         https://bugs.webkit.org/show_bug.cgi?id=175487
9832
9833         Reviewed by Saam Barati.
9834
9835         * stress/compare-eq-incomplete-profile.js: Added.
9836         (const.test.createBuiltin):
9837
9838 2017-08-14  Robin Morisset  <rmorisset@apple.com>
9839
9840         Support the with keyword in DFG
9841         https://bugs.webkit.org/show_bug.cgi?id=175470
9842
9843         Reviewed by Saam Barati.
9844
9845         Added a new stress-test for the 'with' keyword, that caught a bug in a
9846         previous version of this code.
9847
9848         * stress/with.js: Added.
9849         (i.with):
9850
9851 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
9852
9853         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
9854         https://bugs.webkit.org/show_bug.cgi?id=175544
9855
9856         Unreviewed test gardening.
9857
9858         * ChakraCore.yaml:
9859
9860 2017-08-09  Caitlin Potter  <caitp@igalia.com>
9861
9862         Early error on ANY operator before new.target
9863         https://bugs.webkit.org/show_bug.cgi?id=157970
9864
9865         Reviewed by Saam Barati.
9866
9867         Instead of throwing if any unary operator precedes new.target, only
9868         throw if the unary operator updates the reference.
9869
9870         The following become legal in JSC:
9871
9872         ```
9873         !new.target
9874         ~new.target
9875         typeof new.target
9876         delete new.target
9877         void new.target
9878         ```
9879
9880         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
9881
9882         * stress/new-target-syntax-errors.js:
9883         * stress/new-target.js:
9884
9885 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
9886
9887         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
9888         https://bugs.webkit.org/show_bug.cgi?id=175255
9889
9890         Unreviewed test gardening.
9891
9892         * stress/regress-169783.js:
9893         * wasm/stress/oom.js:
9894
9895 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
9896
9897         REGRESSION: 2 test262/test/language/statements/async-function failures
9898         https://bugs.webkit.org/show_bug.cgi?id=175334
9899
9900         Reviewed by Yusuke Suzuki.
9901
9902         Add @skip parameters to tests, and remove test for async iterator from
9903         async await syntax test because it is already covered by async-iterator-syntax.js
9904
9905         * stress/async-await-syntax.js:
9906         * stress/async-iteration-syntax.js:
9907
9908 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
9909
9910         Unreviewed, gardening test262 for Promise resolve / reject function length
9911         https://bugs.webkit.org/show_bug.cgi?id=175333
9912
9913         * test262.yaml:
9914
9915 2017-08-07  Robin Morisset  <rmorisset@apple.com>
9916
9917         GetOwnProperty of TypedArray indexed fields is wrongly configurable
9918         https://bugs.webkit.org/show_bug.cgi?id=175307
9919
9920         Reviewed by Saam Barati.
9921
9922         * stress/typedarray-getownproperty-not-configurable.js: Added.
9923         (assert):
9924         (foo):
9925
9926 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
9927
9928         Promise resolve and reject function should have length = 1
9929         https://bugs.webkit.org/show_bug.cgi?id=175242
9930
9931         Reviewed by Saam Barati.
9932
9933         * stress/builtin-function-length.js: Added.
9934         (shouldBe):
9935         (shouldThrow):
9936         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
9937         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
9938
9939 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
9940
9941         [ESNext] Async iteration - Implement Async Generator - parser
9942         https://bugs.webkit.org/show_bug.cgi?id=175210
9943
9944         Reviewed by Yusuke Suzuki.
9945
9946         * stress/async-await-syntax.js:
9947         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
9948         * stress/async-iteration-syntax.js: Added.
9949         (assert):
9950         (checkSyntax):
9951         (checkSyntaxError):
9952         (checkSimpleAsyncGeneratorSloppyMode):
9953         (checkSimpleAsyncGeneratorStrictMode):
9954         (checkNestedAsyncGenerators):
9955         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
9956         * stress/generator-class-methods-syntax.js:
9957
9958 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
9959
9960         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
9961         https://bugs.webkit.org/show_bug.cgi?id=175150
9962
9963         Unreviewed test gardening.
9964
9965         * wasm/js-api/test_memory_constructor.js:
9966
9967 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
9968
9969         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
9970         https://bugs.webkit.org/show_bug.cgi?id=175100
9971
9972         Reviewed by Mark Lam.
9973
9974         The JSC test JSTests/wasm/stress/oom.js tries to use all the
9975         available memory until an out of memory exception happens.
9976
9977         The Linux kernel is more tuned for server workloads than for GUI
9978         responsiveness. When a process tries to use a lot of memory, Linux
9979         will do its best to serve the request. This usually translates to
9980         free physical RAM by writing to disk dirty pages and/or moving out
9981         less recently used pages to swap (disk storage).
9982         Meanwhile it does this, the system will become unresponsive and this
9983         leads to freezes that can last even some minutes on the worst cases.
9984
9985         Therefore, let's skip this test on Linux as it will cause more harm
9986         than good on the Linux bots or on the machines of Linux developers.
9987
9988         * wasm/stress/oom.js:
9989
9990 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
9991
9992         [JSC] Remove unnecessary print from stress\promise-finally.js test
9993         https://bugs.webkit.org/show_bug.cgi?id=175015
9994
9995         Reviewed by Yusuke Suzuki.
9996
9997         * stress/promise-finally.js:
9998         (p.finally):
9999         (then):
10000
10001 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
10002
10003         Unreviewed, update test262 results for optional catch binding
10004
10005         * test262.yaml:
10006
10007 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
10008
10009         [JSC] Support optional catch binding
10010         https://bugs.webkit.org/show_bug.cgi?id=174981
10011
10012         Reviewed by Saam Barati.
10013
10014         * stress/optional-catch-binding-syntax.js: Added.
10015         (testSyntax):
10016         (testSyntaxError):
10017         (catch.catch):
10018         * stress/optional-catch-binding.js: Added.
10019         (shouldBe):
10020         (throwException):
10021
10022 2017-07-28  Mark Lam  <mark.lam@apple.com>
10023
10024         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
10025         https://bugs.webkit.org/show_bug.cgi?id=174948
10026         <rdar://problem/33495680>
10027
10028         Reviewed by Filip Pizlo.
10029
10030         * stress/regress-174948.js: Added.
10031
10032 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
10033
10034         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
10035         https://bugs.webkit.org/show_bug.cgi?id=174900
10036
10037         Reviewed by Saam Barati.
10038
10039         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
10040         (sideEffect):
10041         (args):
10042         (test):
10043
10044 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
10045
10046         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
10047         https://bugs.webkit.org/show_bug.cgi?id=171637
10048
10049         Reviewed by Darin Adler.
10050
10051         * stress/domjit-getter-complex-with-incorrect-object.js:
10052         (i.shouldThrow):
10053         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
10054         (shouldBe):
10055         (i.shouldThrow):
10056
10057 2017-07-26  JF Bastien  <jfbastien@apple.com>
10058
10059         WebAssembly: test throwing out of the start function
10060         https://bugs.webkit.org/show_bug.cgi?id=165714
10061         <rdar://problem/29760251>
10062
10063         Reviewed by Keith Miller.
10064
10065         * wasm/assert.js:
10066         * wasm/function-tests/trap-from-start.js: Added.
10067         (StartTraps):
10068         * wasm/function-tests/trap-from-start-async.js: Added.
10069         (async.StartTrapsAsync):
10070
10071 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
10072
10073         [FTL] Arguments elimination is suppressed by unreachable blocks
10074         https://bugs.webkit.org/show_bug.cgi?id=174352
10075
10076         Reviewed by Filip Pizlo.
10077
10078         * stress/arguments-elimination-force-exit.js: Added.
10079         (shouldBe):
10080         (strict):
10081         (sloppy):
10082         * stress/arguments-elimination-throw.js: Added.
10083         (shouldBe):
10084         (shouldThrow):
10085         (sloppy):
10086         (isArguments):
10087
10088 2017-07-13  Mark Lam  <mark.lam@apple.com>
10089
10090         Add some additional test cases for bug 170896.
10091         https://bugs.webkit.org/show_bug.cgi?id=174491
10092
10093         Reviewed by Filip Pizlo.
10094
10095         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
10096         * stress/regress-170896-with-double-shape-profile.js: Added.
10097         (test):
10098         * stress/regress-170896-with-int32-shape-profile.js: Added.
10099         (test):
10100         * stress/regress-170896.js: Removed.
10101
10102 2017-07-13  Saam Barati  <sbarati@apple.com>
10103
10104         Missing exception check in JSObject::hasInstance
10105         https://bugs.webkit.org/show_bug.cgi?id=174455
10106         <rdar://problem/31384608>
10107
10108         Reviewed by Mark Lam.
10109
10110         * stress/has-instance-exception-check.js: Added.
10111         (assert):
10112         (let.getter.Object.getOwnPropertyDescriptor.get foo):
10113
10114 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
10115
10116         [ESnext] Implement Object Spread
10117         https://bugs.webkit.org/show_bug.cgi?id=167963
10118
10119         Reviewed by Saam Barati.
10120
10121         * stress/obj-rest-destructuring-order.js: Added.
10122         (assert):
10123         (o.get z):
10124         (o.get a):
10125         * stress/obj-spread-order.js: Added.
10126         (assert):
10127         (o.get z):
10128         (o.get a):
10129         * stress/object-spread.js: Added.
10130         (let.assert):
10131         (assert.sameValue):
10132         (let.o.get a):
10133         (let.obj.get c):
10134         (cthulhu.get x):
10135         (let.obj.set c):
10136         (calls.o.get z):
10137         (calls.o.get a):
10138         (try.let.obj.get foo):
10139         (get calls):
10140
10141 2017-07-12  Saam Barati  <sbarati@apple.com>
10142
10143         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
10144         https://bugs.webkit.org/show_bug.cgi?id=174411
10145         <rdar://problem/31696186>
10146
10147         Reviewed by Mark Lam.
10148
10149         * stress/generic-arguments-correct-delete-behavior.js: Added.
10150         (assert):
10151         (makeTest):
10152
10153 2017-07-07  Mark Lam  <mark.lam@apple.com>
10154
10155         \n\r is not the same as \r\n.
10156         https://bugs.webkit.org/show_bug.cgi?id=173053
10157
10158         Reviewed by Keith Miller.
10159
10160         * stress/regress-173053.js: Added.
10161         * stress/template-literal-line-terminators.js:
10162
10163 2017-07-06  Saam Barati  <sbarati@apple.com>
10164
10165         We are missing places where we invalidate the for-in context
10166         https://bugs.webkit.org/show_bug.cgi?id=174184
10167
10168         Reviewed by Geoffrey Garen.
10169
10170         * stress/for-in-invalidate-context-weird-assignments.js: Added.
10171         (assert):
10172         (test):
10173
10174 2017-07-05  Saam Barati  <sbarati@apple.com>
10175
10176         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
10177         https://bugs.webkit.org/show_bug.cgi?id=174188
10178         <rdar://problem/30581423>
10179
10180         Reviewed by Mark Lam.
10181
10182         * stress/new-array-having-a-bad-time-double.js: Added.
10183         (assert):
10184         (foo):
10185
10186 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
10187
10188         WTF::StringImpl::copyChars segfaults when built with GCC 7
10189         https://bugs.webkit.org/show_bug.cgi?id=173407
10190
10191         Reviewed by Andreas Kling.
10192
10193         * stress/string-repeat-copy-chars-crash.js: Added.
10194         (shouldBe):
10195
10196 2017-07-03  Saam Barati  <sbarati@apple.com>
10197
10198         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
10199
10200         * stress/unshiftCountSlowCase-correct-postCapacity.js:
10201
10202 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
10203
10204         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
10205
10206         It requires too much memory.
10207
10208         * stress/dont-reserve-huge-capacity-lexer.js:
10209
10210 2017-06-30  Michael Saboff  <msaboff@apple.com>
10211
10212         Skip a test on ARM64 platform since we run out of address space.
10213
10214         Rubber stamped by Saam Barati.
10215
10216         * stress/dont-reserve-huge-capacity-lexer.js:
10217
10218 2017-06-30  Michael Saboff  <msaboff@apple.com>
10219
10220         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
10221         https://bugs.webkit.org/show_bug.cgi?id=174044
10222
10223         Reviewed by Oliver Hunt.
10224
10225         New regression test.
10226
10227         * stress/regress-174044.js: Added.
10228         (test1):
10229         (test2):
10230
10231 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
10232
10233         RegExpCachedResult::setInput should reify left and right contexts
10234         https://bugs.webkit.org/show_bug.cgi?id=173818
10235
10236         Reviewed by Keith Miller.
10237
10238         * stress/right-left-context-invalidated-by-input.js: Added.
10239         (test.validateContexts):
10240         (test):
10241
10242 2017-06-29  Saam Barati  <sbarati@apple.com>
10243
10244         Calculating postCapacity in unshiftCountSlowCase is wrong
10245         https://bugs.webkit.org/show_bug.cgi?id=173992
10246         <rdar://problem/32283199>
10247
10248         Reviewed by Keith Miller.
10249
10250         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
10251         (temp):
10252
10253 2017-06-29  Commit Queue  <commit-queue@webkit.org>
10254
10255         Unreviewed, rolling out r218512.
10256         https://bugs.webkit.org/show_bug.cgi?id=173981
10257
10258         "It changes the behavior of the JS API's JSEvaluateScript
10259         which breaks TurboTax" (Requested by saamyjoon on #webkit).
10260
10261         Reverted changeset:
10262
10263         "test262: Completion values for control flow do not match the
10264         spec"
10265         https://bugs.webkit.org/show_bug.cgi?id=171265
10266         http://trac.webkit.org/changeset/218512
10267
10268 2017-06-27  JF Bastien  <jfbastien@apple.com>
10269
10270         WebAssembly: running out of executable memory should throw OoM
10271         https://bugs.webkit.org/show_bug.cgi?id=171537
10272         <rdar://problem/32963338>
10273
10274         Reviewed by Saam Barati.
10275
10276         * wasm.yaml:
10277         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
10278         (const.invoke):
10279         (failCount.0.catch):
10280         (failCount.0.module.undefined.catch):
10281         * wasm/lowExecutableMemory/exports-oom.js: Added.
10282         (const.type):
10283         (const.params):
10284         (const.randomProgram):
10285         (failCount.0.catch):
10286         (failCount.0.module.undefined.catch):
10287         * wasm/lowExecutableMemory/imports-oom.js: Added.
10288         (const.type):
10289         (const.params):
10290         (const.randomProgram):
10291         (f.imports.push):
10292         (failCount.0.catch):
10293         (failCount.0.module.undefined.catch):
10294
10295 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
10296
10297         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
10298         https://bugs.webkit.org/show_bug.cgi?id=167962
10299
10300         Reviewed by Saam Barati.
10301
10302         * stress/object-rest-deconstruct.js: Added.
10303         (let.assert):
10304         (let.assertPropDescriptor):
10305         (catch):
10306         (get 3):
10307         (foo):
10308         (let.src.get y):
10309         (let.src.set y):
10310         (let.gen):
10311
10312 2017-06-27  Saam Barati  <sbarati@apple.com>
10313
10314         Function constructor needs to follow the spec and validate parameters and body independently
10315         https://bugs.webkit.org/show_bug.cgi?id=173303
10316         <rdar://problem/32732526>
10317
10318         Reviewed by Keith Miller.
10319
10320         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
10321         * stress/function-constructor-semantics.js: Added.
10322         (assert):
10323         (hasSyntaxError):
10324         (foo):
10325         (async.foo):
10326         (testError):
10327         (testOK.toString):
10328         (toString):
10329
10330 2017-06-26  Saam Barati  <sbarati@apple.com>
10331
10332         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
10333         https://bugs.webkit.org/show_bug.cgi?id=173740
10334
10335         Reviewed by Mark Lam.
10336
10337         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
10338         (Array.prototype.Symbol.iterator):
10339
10340 2017-06-26  Saam Barati  <sbarati@apple.com>
10341
10342         Skip a test on 32-bit platforms since we run out of address space.
10343
10344         Rubber stamped by Mark Lam.
10345
10346         * stress/dont-reserve-huge-capacity-lexer.js:
10347
10348 2017-06-26  Saam Barati  <sbarati@apple.com>
10349
10350         Crash in JSC::Lexer<unsigned char>::setCode
10351         https://bugs.webkit.org/show_bug.cgi?id=172754
10352
10353         Reviewed by Mark Lam.
10354
10355         * stress/dont-reserve-huge-capacity-lexer.js: Added.
10356         (catch):
10357
10358 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
10359
10360         [JSC] Clean up Object.entries implementation
10361         https://bugs.webkit.org/show_bug.cgi?id=173759
10362
10363         Reviewed by Sam Weinig.
10364
10365         * microbenchmarks/object-entries.js: Added.
10366         (test):
10367
10368 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
10369
10370         Remove Reflect.enumerate
10371         https://bugs.webkit.org/show_bug.cgi?id=173806
10372
10373         Reviewed by Yusuke Suzuki.
10374
10375         * ChakraCore.yaml:
10376         * es6.yaml:
10377         These tests now fail because they use Reflect.enumerate.
10378
10379         * test262.yaml:
10380         This test now passes, it checked that Reflect.enumerate is undefined!
10381
10382         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
10383         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
10384
10385         * stress/reflect-enumerate.js: Removed.
10386         Remove a test solely for Reflect.enumerate.
10387
10388 2017-06-22  Saam Barati  <sbarati@apple.com>
10389
10390         ValueRep(DoubleRep(@v)) can not simply convert to @v
10391         https://bugs.webkit.org/show_bug.cgi?id=173687
10392         <rdar://problem/32855563>
10393
10394         Reviewed by Mark Lam.
10395
10396         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
10397         (i.catch):
10398
10399 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
10400
10401         [JSC] Object.values should be implemented in C++
10402         https://bugs.webkit.org/show_bug.cgi?id=173703
10403
10404         Reviewed by Sam Weinig.
10405
10406         * microbenchmarks/object-keys-map-values.js: Added.
10407         (test):
10408         * microbenchmarks/object-values.js: Added.
10409         (test):
10410         * stress/object-values-changing-properties.js: Added.
10411         (shouldBe):
10412         (throw.new.Error.let.source.get x):
10413         (throw.new.Error):
10414         (shouldBe.let.handler.get order):
10415         (get let):
10416         (shouldBe.let.handler.get return):
10417         (let.handler.get order):
10418
10419 2017-06-21  Saam Barati  <sbarati@apple.com>
10420
10421         eval virtual call is incorrect in the baseline JIT
10422         https://bugs.webkit.org/show_bug.cgi?id=173587
10423         <rdar://problem/32867897>
10424
10425         Reviewed by Michael Saboff.
10426
10427         * stress/do-eval-virtual-call-correctly.js: Added.
10428         (assert):
10429         (f):
10430         (i.test):
10431         (catch):
10432
10433 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
10434
10435         Update test262 test expectations after r218581.
10436
10437         Unreviewed test gardening.
10438
10439         * test262.yaml:
10440
10441 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
10442
10443         Revert changes in bug#160417 about extending `null` not being a derived class
10444         https://bugs.webkit.org/show_bug.cgi?id=169293
10445
10446         Reviewed by Saam Barati.
10447
10448         * stress/class-derived-from-null.js:
10449         (assertThrow):
10450         (test1):
10451         (test2):
10452         (test3):
10453         (test4):
10454         (test5):
10455         (test6):
10456
10457 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
10458
10459         [DFG] More ArrayIndexOf fixups for various types
10460         https://bugs.webkit.org/show_bug.cgi?id=173176
10461
10462         Reviewed by Saam Barati.
10463
10464         * stress/array-indexof-arraystorage.js: Added.
10465         (shouldBe):
10466         (indexOfInt32Other):
10467         (indexOfInt32Cell):
10468         (indexOfInt32Boolean):
10469         (indexOfDoubleOther):
10470         (indexOfDoubleCell):
10471         (indexOfDoubleBoolean):
10472         (indexOfInt32):
10473         (indexOfDouble):
10474         * stress/array-indexof-constant-folding.js: Added.
10475         (shouldBe):
10476         (indexOfInt32Other):
10477         (indexOfInt32Cell):
10478         (indexOfInt32Boolean):
10479         (indexOfDoubleOther):
10480         (indexOfDoubleCell):
10481         (indexOfDoubleBoolean):
10482         * stress/array-indexof-hole-and-other.js: Added.
10483         (shouldBe):
10484         (indexOf):
10485         * stress/array-indexof-other.js: Added.
10486         (shouldBe):
10487         (indexOfInt32):
10488         (indexOfDouble):
10489         (indexOfString):
10490         (indexOfObject):
10491         * stress/array-indexof-symbol.js: Added.
10492         (shouldBe):
10493         (indexOfInt32):
10494         (indexOfDouble):
10495         (indexOfString):
10496         (indexOfObject):
10497
10498 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
10499
10500         test262: Completion values for control flow do not match the spec
10501         https://bugs.webkit.org/show_bug.cgi?id=171265
10502
10503         Reviewed by Saam Barati.
10504
10505         * stress/completion-value.js:
10506         Condensed test for completion values in top level statements.
10507
10508         * stress/super-get-by-id.js:
10509         ClassDeclaration when evaled no longer produce values. Convert
10510         these to ClassExpressions so they produce the class value.
10511
10512         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
10513         This is a progression for currect spec behavior.
10514
10515         * mozilla/mozilla-tests.yaml:
10516         This test is now outdated, so mark it as failing for that reason.
10517
10518         * test262.yaml:
10519         Passing all "cptn" completion value tests.
10520
10521 2017-06-17  Keith Miller  <keith_miller@apple.com>
10522
10523         ArrayBuffer constructor needs to create subclass structures before its buffer
10524         https://bugs.webkit.org/show_bug.cgi?id=173510
10525
10526         Reviewed by Yusuke Suzuki.
10527
10528         * test262.yaml:
10529
10530 2017-06-17  Keith Miller  <keith_miller@apple.com>
10531
10532         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
10533         https://bugs.webkit.org/show_bug.cgi?id=173506
10534
10535         Reviewed by Ryosuke Niwa.
10536
10537         Re-baseline tests.
10538
10539         * ChakraCore/test/Function/apply3.baseline-jsc:
10540         * test262.yaml:
10541
10542 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
10543
10544         [JSC] Add fast path for Object.assign
10545         https://bugs.webkit.org/show_bug.cgi?id=173416
10546
10547         Reviewed by Mark Lam.
10548
10549         * stress/object-assign-changing-properties.js: Added.
10550         (shouldBe):
10551         (throw.new.Error.let.source.get x):
10552         (throw.new.Error):
10553         (shouldBe.let.source.get x):
10554         (shouldBe.let.target.set x):
10555         (shouldBe.let.target.get x):
10556         * stress/object-assign-proxy.js: Added.
10557         (shouldBe):
10558         (throw.new.Error.let.handler.get order):
10559
10560 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
10561
10562         [JSC] Implement Object.assign in C++
10563         https://bugs.webkit.org/show_bug.cgi?id=173414
10564
10565         Reviewed by Saam Barati.
10566
10567         * stress/object-assign-string-first.js: Added.
10568         (shouldBe):
10569         (source.get Symbol):
10570         (source.get 1):
10571         (source.get cocoa):
10572
10573 2017-06-14  JF Bastien  <jfbastien@apple.com>
10574
10575         WebAssembly: remove empty test files
10576         https://bugs.webkit.org/show_bug.cgi?id=173382
10577
10578         Reviewed by Saam Barati.
10579
10580         The following files:
10581                 JSTests/wasm/function-tests/call-indirect-params.js
10582                 JSTests/wasm/function-tests/call-indirect.js
10583                 JSTests/wasm/js-api/call-indirect-results.js
10584         Were changed to empty files in https://trac.webkit.org/changeset/209771
10585
10586         They were testing call_indirect with the wrong semantics, before
10587         we implemented tables. That change implemented tables and
10588         therefore removed the erroneous tests.
10589
10590         We have a few tests for call_indirect which already do the right thing:
10591                 JSTests/wasm/function-tests/context-switch.js
10592                 JSTests/wasm/function-tests/exceptions.js
10593                 JSTests/wasm/function-tests/grow-memory-2.js
10594                 JSTests/wasm/function-tests/stack-overflow.js
10595                 JSTests/wasm/function-tests/table-basic-2.js
10596                 JSTests/wasm/function-tests/table-basic.js
10597                 JSTests/wasm/js-api/call-indirect.js
10598                 JSTests/wasm/js-api/table.js
10599                 JSTests/wasm/js-api/unique-signature.js
10600                 JSTests/wasm/js-api/wrapper-function.js
10601
10602         I also just imported the updated spec tests which, among other
10603         things, test call_indirect:
10604                 core/br.wast
10605                 core/br_table.wast
10606                 core/call_indirect.wast
10607                 core/func.wast
10608                 core/func_ptrs.wast
10609                 core/imports.wast
10610                 core/left-to-right.wast
10611                 core/linking.wast
10612                 core/nop.wast
10613                 core/return.wast
10614                 core/typecheck.wast
10615                 core/unreachable.wast
10616
10617         So I think it's OK to just delete the tests which should just have
10618         been deleted back when tables were added.
10619
10620         * wasm/function-tests/call-indirect-params.js: Removed.
10621         * wasm/function-tests/call-indirect.js: Removed.
10622         * wasm/js-api/call-indirect-results.js: Removed.
10623
10624 2017-06-13  JF Bastien  <jfbastien@apple.com>
10625
10626         WebAssembly: import updated spec tests
10627         https://bugs.webkit.org/show_bug.cgi?id=173287
10628         <rdar://problem/32725975>
10629
10630         Reviewed by Saam Barati.
10631
10632         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
10633         with a few modifications so things work.
10634
10635         Fix a bunch of bugs found through this process, and punt a few tests (which I
10636         marked as blocked by this bug).
10637
10638         Fixes:
10639
10640         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
10641         instead of byte alignment. It was also missing memory-alignment.js despite it
10642         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
10643         pass.
10644
10645         Tables can be imported or in a section. There can be only one, but sections can
10646         be empty. An Elements section can exist if there's no Table, as long as it is
10647         also empty.
10648
10649         Memories can be imported or in a section. There can be only one, but sections
10650         can be empty. A Data section can exist if there's no Memory, as long as it is
10651         also empty.
10652
10653         Prototypes: stringify without .prototype. in the string.
10654
10655         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
10656         not a final size, and throws a RangeError on failure, not a TypeError.
10657
10658         Fix compile / instantiate so the reject the promise if given an argument of the
10659         wrong type (instead of failing instantly).
10660
10661         Fix async on neuter test.
10662
10663         Element section shouldn't affect any Table if any of the elements are out of
10664         bounds. We need to process it in two passes.
10665
10666         Segment section shouldn't affect any Data if any of the segments are out of
10667         bounds. We need to process it in two passes.
10668
10669         Empty data segments are valid, but only when there is no memory. Their index
10670         still gets validated, and has to be zero.
10671
10672         Punts:
10673
10674         Error messages with context, the test seems overly restrictive but this is
10675         minor.
10676
10677         compile/instantiate/validate property descriptors.
10678
10679         UTF-8 bugs.
10680
10681         Temporarily disable NaN tests. We need to go back and implement the following
10682         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
10683         much as getting all the other tests passing.
10684
10685         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
10686         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
10687         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
10688         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
10689         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
10690         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
10691         why they're not allowed.
10692
10693         * wasm.yaml:
10694         * wasm/function-tests/i32-load8-s.js:
10695         * wasm/function-tests/memory-access-past-4gib.js:
10696         (const.op.of.WASM.opcodes):
10697         * wasm/function-tests/memory-alignment.js: Added.
10698         (const.op.of.WASM.opcodes):
10699         * wasm/function-tests/memory-section-and-import.js:
10700         * wasm/js-api/Module-compile.js:
10701         (async.testPromiseAPI):
10702         * wasm/js-api/dont-mmap-zero-byte-memory.js:
10703         (testMems):
10704         * wasm/js-api/element.js:
10705         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
10706         * wasm/js-api/neutered-inputs.js:
10707         (const.testFunction): Deleted.
10708         (const.testConstructor): Deleted.
10709         * wasm/js-api/table.js:
10710         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
10711         (new.WebAssembly.Module):
10712         (assert.throws):
10713         (assertBadTableImport):
10714         (assert.throws.WebAssembly.Table.prototype.grow):
10715         (assertBadTableInstance): Deleted.
10716         * wasm/js-api/test_Data.js:
10717         (DataSectionWithoutMemory):
10718         * wasm/spec-harness/index.js:
10719         (module):
10720         (uniqueTest): Deleted.
10721         (assert_invalid): Deleted.
10722         (assert_soft_invalid): Deleted.
10723         (register): Deleted.
10724         (call): Deleted.
10725         (get instance): Deleted.
10726         (exports): Deleted.
10727         (run): Deleted.
10728         (assert_unlinkable): Deleted.
10729         (assert_uninstantiable): Deleted.
10730         (assert_trap): Deleted.
10731         (try.f): Deleted.
10732         (catch): Deleted.
10733         (assert_exhaustion): Deleted.
10734         (assert_return): Deleted.
10735         (assert_return_nan): Deleted.
10736         * wasm/spec-harness/testharness.css: Removed.
10737         * wasm/spec-harness/testharness.js: Removed.
10738         * wasm/spec-harness/testharnessreport.js: Removed.
10739         * wasm/spec-harness/wasm-constants.js:
10740         (assertTraps):
10741         (assertWasmThrows):
10742         * wasm/spec-harness/wasm-module-builder.js:
10743         (Binary.prototype.emit_section):
10744         (Binary):
10745         (WasmFunctionBuilder.prototype.addBody):
10746         (WasmFunctionBuilder.prototype.end):
10747         (WasmFunctionBuilder):
10748         (WasmModuleBuilder.prototype.stringToBytes):
10749         (WasmModuleBuilder.prototype.addCustomSection):
10750         (WasmModuleBuilder.prototype.addFunctionTableInit):
10751         (WasmModuleBuilder.prototype.appendToTable):
10752         (WasmModuleBuilder.prototype.toArray):
10753         (WasmModuleBuilder.prototype.toBuffer):
10754         (WasmModuleBuilder.prototype.instantiate):
10755         (WasmModuleBuilder):
10756         * wasm/spec-tests/address.wast.js:
10757         * wasm/spec-tests/align.wast.js: Added.
10758         * wasm/spec-tests/binary.wast.js:
10759         * wasm/spec-tests/block.wast.js:
10760         * wasm/spec-tests/br.wast.js:
10761         * wasm/spec-tests/br_if.wast.js:
10762         * wasm/spec-tests/br_table.wast.js:
10763         * wasm/spec-tests/call.wast.js:
10764         * wasm/spec-tests/call_indirect.wast.js:
10765         * wasm/spec-tests/comments.wast.js:
10766         * wasm/spec-tests/const.wast.js: Added.
10767         * wasm/spec-tests/conversions.wast.js: Added.
10768         * wasm/spec-tests/custom_section.wast.js:
10769         * wasm/spec-tests/exports.wast.js:
10770         * wasm/spec-tests/f32.wast.js: Added.
10771         * wasm/spec-tests/f64.wast.js: Added.
10772         * wasm/spec-tests/fac.wast.js:
10773         * wasm/spec-tests/float_exprs.wast.js: Added.
10774         * wasm/spec-tests/float_misc.wast.js: Added.
10775         * wasm/spec-tests/func.wast.js:
10776         * wasm/spec-tests/globals.wast.js:
10777         * wasm/spec-tests/if.wast.js:
10778         * wasm/spec-tests/imports.wast.js:
10779         * wasm/spec-tests/inline-module.wast.js: Added.
10780         * wasm/spec-tests/jsapi.js:
10781         (testJSAPI.test):
10782         (testJSAPI):
10783         * wasm/spec-tests/labels.wast.js:
10784         * wasm/spec-tests/loop.wast.js:
10785         * wasm/spec-tests/memory.wast.js:
10786         * wasm/spec-tests/memory_trap.wast.js: Added.
10787         * wasm/spec-tests/names.wast.js:
10788         * wasm/spec-tests/nop.wast.js:
10789         * wasm/spec-tests/return.wast.js:
10790         * wasm/spec-tests/stack.wast.js:
10791         * wasm/spec-tests/token.wast.js: Added.
10792         * wasm/spec-tests/type.wast.js: Added.
10793         * wasm/spec-tests/typecheck.wast.js:
10794         * wasm/spec-tests/unreachable.wast.js:
10795         * wasm/spec-tests/unreached-invalid.wast.js:
10796         * wasm/spec-tests/unwind.wast.js:
10797         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
10798         * wasm/spec-tests/utf8-import-field.wast.js: Added.
10799         * wasm/spec-tests/utf8-import-module.wast.js: Added.
10800
10801 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
10802
10803         Unreviewed JSC test gardening.
10804
10805         * stress/check-string-ident.js:
10806         * stress/new-largeish-contiguous-array-with-size.js:
10807
10808 2017-06-13  Michael Saboff  <msaboff@apple.com>
10809
10810         DFG doesn't properly handle a property that is change to read only in a prototype
10811         https://bugs.webkit.org/show_bug.cgi?id=173321
10812
10813         Reviewed by Filip Pizlo.
10814
10815         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
10816         * stress/regress-173321.js: Added new regression test.
10817         (shouldBe):
10818         (SimpleObject):
10819         (test):
10820
10821 2017-06-12  Saam Barati  <sbarati@apple.com>
10822
10823         Update test262 test expectation since r218082 makes new tests pass.
10824
10825         * test262.yaml:
10826
10827 2017-06-12  Saam Barati  <sbarati@apple.com>
10828
10829         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
10830         https://bugs.webkit.org/show_bug.cgi?id=172957
10831         <rdar://problem/32602704>
10832
10833         Reviewed by Filip Pizlo.
10834
10835         * stress/spec-empty-flows-through-cell-checks.js: Added.
10836         (A):
10837         (B):
10838         (i.catch):
10839
10840 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
10841
10842         We incorrectly allow escaped characters in keyword tokens
10843         https://bugs.webkit.org/show_bug.cgi?id=171310
10844
10845         Reviewed by Yusuke Suzuki.
10846
10847         * stress/destructuring-assignment-syntax.js:
10848         * stress/error-messages-for-in-operator-should-not-crash.js:
10849         (catch):
10850         * stress/reserved-word-with-escape.js:
10851         (testSyntaxError.String.raw.v):
10852         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
10853         (testSyntaxError.String.raw.a):
10854         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
10855
10856 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
10857
10858         [DFG] Add ArrayIndexOf intrinsic
10859         https://bugs.webkit.org/show_bug.cgi?id=172421
10860
10861         Reviewed by Saam Barati.
10862
10863         * stress/array-indexof-array-prototype-change.js: Added.
10864         (shouldBe):
10865         (indexOfInt32):
10866         * stress/array-indexof-have-a-bad-time-getter.js: Added.
10867         (shouldBe):
10868         (indexOfInt32):
10869         * stress/array-indexof-have-a-bad-time.js: Added.
10870         (shouldBe):
10871         (indexOfInt32):
10872         * stress/array-indexof-hole-with-prototype.js: Added.
10873         (shouldBe):
10874         (indexOf):
10875         * stress/array-indexof-hole.js: Added.
10876         (shouldBe):
10877         (indexOf):
10878         * stress/array-indexof-index.js: Added.
10879         (shouldBe):
10880         (indexOfInt32):
10881         (indexOfDouble):
10882         (indexOfString):
10883         (indexOfObject):
10884         (indexOfValue):
10885         * stress/array-indexof-negative-index.js: Added.
10886         (shouldBe):
10887         (indexOfInt32):
10888         (indexOfDouble):
10889         (indexOfString):
10890         (indexOfObject):
10891         (indexOfValue):
10892         * stress/array-indexof-non-int32-start-index.js: Added.
10893         (shouldBe):
10894         (indexOf):
10895         (object.valueOf):
10896         * stress/array-indexof-object-prototype-change.js: Added.
10897         (shouldBe):
10898         (indexOfInt32):
10899         * stress/array-indexof-object.js: Added.
10900         (shouldBe):
10901         (indexOf):
10902         * stress/array-indexof-original-array.js: Added.
10903         (shouldBe):
10904         (indexOfInt32):
10905         * stress/array-indexof-string.js: Added.
10906         (shouldBe):
10907         (indexOf):
10908         * stress/array-indexof-structure-change-convert.js: Added.
10909         (shouldBe):
10910         (indexOf):
10911         * stress/array-indexof-structure-change.js: Added.
10912         (shouldBe):
10913         (indexOf):
10914         * stress/array-indexof.js: Added.
10915         (shouldBe):
10916         (indexOf):
10917
10918 2017-06-11  Keith Miller  <keith_miller@apple.com>
10919
10920         TypedArray constructor with string shouldn't throw
10921         https://bugs.webkit.org/show_bug.cgi?id=173181
10922
10923         Reviewed by JF Bastien.
10924
10925         We should be coercing primitive arguments to numbers in the various
10926         TypedArray constructors.
10927
10928         * stress/typedarray-constructor.js:
10929
10930 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
10931
10932         Unreviewed, update test results part 3
10933         https://bugs.webkit.org/show_bug.cgi?id=173227
10934
10935         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
10936
10937 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
10938
10939         Unreviewed, update test results part 2
10940         https://bugs.webkit.org/show_bug.cgi?id=173227
10941
10942         * test262.yaml:
10943
10944 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
10945
10946         Unreviewed, update test results
10947         https://bugs.webkit.org/show_bug.cgi?id=173227
10948
10949         * microbenchmarks/string-prototype-search-observable-side-effects.js:
10950         * test262.yaml:
10951
10952 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
10953
10954         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
10955         https://bugs.webkit.org/show_bug.cgi?id=173227
10956
10957         Reviewed by Mark Lam.
10958
10959         Update the test.
10960
10961         * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
10962
10963 2017-06-08  Keith Miller  <keith_miller@apple.com>
10964
10965         WebAssembly: We should only create wrappers for functions that can be exported
10966         https://bugs.webkit.org/show_bug.cgi?id=173088
10967
10968         Reviewed by Saam Barati.
10969
10970         Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
10971         on the old testWasmModuleFunctions api, which has been removed.
10972
10973         * wasm/function-tests/copysign.js: Removed.
10974         * wasm/function-tests/ctz.js: Removed.
10975         * wasm/function-tests/drop.js: Removed.
10976         * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
10977         * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
10978         * wasm/function-tests/dumb-less-than-ite.js: Removed.
10979         * wasm/function-tests/eqz.js: Removed.
10980         * wasm/function-tests/i32-trunc-s-f32.js: Removed.
10981         * wasm/function-tests/i32-trunc-s-f64.js: Removed.
10982         * wasm/function-tests/i32-trunc-u-f32.js: Removed.
10983         * wasm/function-tests/i32-trunc-u-f64.js: Removed.
10984         * wasm/function-tests/i64-trunc-s-f32.js: Removed.
10985         * wasm/function-tests/i64-trunc-s-f64.js: Removed.
10986         * wasm/function-tests/i64-trunc-u-f32.js: Removed.
10987         * wasm/function-tests/i64-trunc-u-f64.js: Removed.
10988         * wasm/function-tests/if-then-else-fallthrough.js: Removed.
10989         * wasm/function-tests/if-then-fallthrough.js: Removed.
10990         * wasm/function-tests/int-to-floating-point.js: Removed.
10991         * wasm/function-tests/loop-mult.js:
10992         * wasm/function-tests/loop-sum.js:
10993         * wasm/function-tests/max.js: Removed.
10994         * wasm/function-tests/min.js: Removed.
10995         * wasm/function-tests/nearest.js: Removed.
10996         * wasm/function-tests/nop.js: Removed.
10997         * wasm/function-tests/popcnt.js: Removed.
10998         * wasm/function-tests/ret5.js:
10999         * wasm/function-tests/select.js: Removed.
11000         * wasm/function-tests/tee-local.js: Removed.
11001         * wasm/function-tests/trunc.js: Removed.
11002
11003 2017-06-07  JF Bastien  <jfbastien@apple.com>
11004
11005         WebAssembly: test imports and exports with 16-bit characters
11006         https://bugs.webkit.org/show_bug.cgi?id=165977
11007         <rdar://problem/29760130>
11008
11009         Reviewed by Saam Barati.
11010
11011         The output for import failure was improved, so many tests need to
11012         be updated here. Only one has new tests as noted below.
11013
11014         * wasm/function-tests/memory-import-and-grow.js:
11015         * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
11016         (idxModule):
11017         * wasm/js-api/global-error.js:
11018         (new.Number):
11019         (assert.throws):
11020         * wasm/js-api/table.js:
11021         (assert.throws):
11022         (new.WebAssembly.Table):
11023         * wasm/js-api/test_memory.js:
11024         (test):
11025         * wasm/js-api/wasm-to-wasm-bad-signature.js:
11026         (BadSignatureDropStartParams.):
11027         (BadSignatureDropStartParams):
11028         (BadSignatureDropEndParams.):
11029         (BadSignatureSwapParam.):
11030         (BadSignatureRet.):
11031         * wasm/js-api/web-assembly-instantiate.js:
11032         (assert.asyncTest.async.test):
11033         (assert.asyncTest):
11034         * wasm/js-api/wrapper-function.js:
11035         (return.new.WebAssembly.Module):
11036
11037 2017-06-07  Mark Lam  <mark.lam@apple.com>
11038
11039         Restrict the regress-173035.js test to only run on Darwin x86-64.
11040         https://bugs.webkit.org/show_bug.cgi?id=173075
11041
11042         Reviewed by Saam Barati.
11043
11044         This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
11045         this test will require to succeed.  Here's an example of this failure:
11046         https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
11047
11048         Since the issue is due to allocation of a very large amount of memory, the test
11049         will probably fail on iOS and other platforms as well.  Hence, we should just
11050         skip this test for any platforms that is not Darwin x86-64.
11051
11052         * stress/regress-173035.js:
11053
11054 2017-06-07  Mark Lam  <mark.lam@apple.com>
11055
11056         ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
11057         https://bugs.webkit.org/show_bug.cgi?id=168587
11058
11059         Not reviewed.
11060
11061         Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
11062
11063         * stress/test-finally.js:
11064
11065 2017-06-06  Mark Lam  <mark.lam@apple.com>
11066
11067         Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
11068         https://bugs.webkit.org/show_bug.cgi?id=173035
11069         <rdar://problem/32554593>
11070
11071         Reviewed by Geoffrey Garen and Filip Pizlo.
11072
11073         * stress/regress-173035.js: Added.
11074
11075 2017-06-06  Saam Barati  <sbarati@apple.com>
11076
11077         Make sure we restore SP when doing calls that could be to JS
11078         https://bugs.webkit.org/show_bug.cgi?id=172946
11079         <rdar://problem/32579026>
11080
11081         Reviewed by JF Bastien.
11082
11083         * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
11084         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
11085         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
11086         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
11087         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
11088
11089 2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
11090
11091         Unreviewed rollout r217807. Caused a test to crash.
11092
11093         * heapProfiler/class-names.js: Removed.
11094         * heapProfiler/driver/driver.js:
11095         (CheapHeapSnapshotNode):
11096         (CheapHeapSnapshot):
11097         (createCheapHeapSnapshot):
11098         (HeapSnapshot):
11099         (createHeapSnapshot):
11100         * typeProfiler/inheritance.js:
11101         (wrapper.A):
11102         (wrapper.B):
11103         (wrapper.C):
11104         (wrapper):
11105
11106 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
11107
11108         index out of bound in bytecodebasicblock
11109         https://bugs.webkit.org/show_bug.cgi?id=172963
11110
11111         Reviewed by Saam Barati and Mark Lam.
11112
11113         * stress/dfg-call-class-constructor.js: Added.
11114         (Foo):
11115         (i.catch):
11116
11117 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
11118
11119         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
11120         https://bugs.webkit.org/show_bug.cgi?id=172848
11121         <rdar://problem/25709212>
11122
11123         Reviewed by Saam Barati.
11124
11125         * typeProfiler/inheritance.js:
11126         Rewrite the test slightly for clarity. The hoisting was confusing.
11127
11128         * heapProfiler/class-names.js: Added.
11129         (MyES5Class):
11130         (MyES6Class):
11131         (MyES6Subclass):
11132         Test object types and improved class names.
11133
11134         * heapProfiler/driver/driver.js:
11135         (CheapHeapSnapshotNode):
11136         (CheapHeapSnapshot):
11137         (createCheapHeapSnapshot):
11138         (HeapSnapshot):
11139         (createHeapSnapshot):
11140         Update snapshot parsing from version 1 to version 2.
11141
11142 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
11143
11144         ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
11145         https://bugs.webkit.org/show_bug.cgi?id=168844
11146
11147         Reviewed by Saam Barati.
11148
11149         * modules/async-function-export.js: Added.
11150         (f):
11151         (export.async.f):
11152
11153 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
11154
11155         ES2015 modules - Export default function hoisting
11156         https://bugs.webkit.org/show_bug.cgi?id=170174
11157
11158         Reviewed by Saam Barati.
11159
11160         This issue itself is solved by fixing function declaration hoisting rules.
11161         This patch just adds the specific test to modules tests to ensure the bug
11162         is fixed.
11163
11164         * modules/export-default-function-hoisting.js: Added.
11165         * modules/export-default-function-hoisting/cappuccino.js: Added.
11166         (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
11167         * modules/export-default-function-hoisting/cocoa.js: Added.
11168         (export.default.drinkCocoa):
11169
11170 2017-06-01  Oleksandr Skachkov  <gskachkov@gmail.com>
11171
11172         Class Proxy can't be extended
11173         https://bugs.webkit.org/show_bug.cgi?id=169040
11174
11175         Reviewed by Saam Barati.
11176
11177         Adding tests that check correctness of Proxy to ES6 `class`
11178         Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
11179
11180         * stress/proxy-class.js: Added.
11181         (assert):
11182         (throw.new.Error.SuperClass):
11183         (throw.new.Error.A):
11184         (throw.new.Error):
11185
11186 2017-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
11187
11188         [JSC] Implement String.prototype.concat in JS builtins
11189         https://bugs.webkit.org/show_bug.cgi?id=172798
11190
11191         Reviewed by Sam Weinig.
11192
11193         * microbenchmarks/string-concat-convert.js: Added.
11194         (test):
11195         * microbenchmarks/string-concat-long-convert.js: Added.
11196         (test):
11197         * microbenchmarks/string-concat-long.js: Added.
11198         (test):
11199         * microbenchmarks/string-concat.js: Added.
11200         (test):
11201
11202 2017-05-31  Oleksandr Skachkov  <gskachkov@gmail.com>
11203
11204         Rolling out: Prevent async methods named 'function'
11205         https://bugs.webkit.org/show_bug.cgi?id=172776
11206
11207         Reviewed by Mark Lam.
11208
11209         * stress/async-await-syntax.js:
11210         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
11211         (testTopLevelAsyncAwaitSyntaxSloppyMode):
11212         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
11213         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
11214         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
11215
11216 2017-05-31  Ryan Haddad  <ryanhaddad@apple.com>
11217
11218         Skip flaky JSC test stress/test-finally.js
11219         https://bugs.webkit.org/show_bug.cgi?id=168587
11220
11221         Unreviewed test gardening.
11222
11223         * stress/test-finally.js:
11224
11225 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
11226
11227         Prevent async methods named 'function' in Object literal
11228         https://bugs.webkit.org/show_bug.cgi?id=172660
11229
11230         Reviewed by Saam Barati.
11231
11232         * stress/async-await-syntax.js:
11233         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
11234
11235 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
11236
11237         ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
11238         https://bugs.webkit.org/show_bug.cgi?id=171274
11239
11240         Reviewed by Saam Barati.
11241
11242         * stress/async-arrow-functions-lexical-binding-in-class.js:
11243         (shouldBeAsync):
11244         (shouldBeAsyncAndStoreBind):
11245         (promise.new.Promise):
11246         (ChildClass4):
11247         (ChildClass4.prototype.classValue):
11248         (ChildClass4.prototype.get classProperty):
11249         * stress/async-arrow-functions-lexical-super-binding.js:
11250         (A):
11251         (const.childA1.new.prototype.var.f.async):
11252         (const.childA1.new.var):
11253         (const.childA1.new):
11254         (const.childA2.new.prototype.var.f.async):
11255         (const.childA2.new.var):
11256         (const.childA2.new):
11257         (const.childA3.new.prototype.var.f.async):
11258         (const.childA3.new.var):
11259         (const.childA3.new):
11260         (try.childA4.new.prototype.var.f.async):
11261         (try.childA4.new.var):
11262         (try.childA4.new):
11263         (catch):
11264         (const.childA5.new.prototype.var.f.async):
11265         (const.childA5.new.var):
11266         (const.childA5.new):
11267         (checkClass):
11268         (checkClass.new.prototype.var.f.async):
11269         (checkClass.new.var):
11270         (checkClass.new):
11271         (checkClass.new.prototype.method):
11272         (checkClass.new.prototype.prop):
11273
11274 2017-05-27  Yusuke Suzuki  <utatane.tea@gmail.com>
11275
11276         [JSC] Map and Set constructors should have fast path for cloning
11277         https://bugs.webkit.org/show_bug.cgi?id=172413
11278
11279         Reviewed by Saam Barati.
11280
11281         * stress/map-clone-instance-iterator-change.js: Added.
11282         (shouldBe):
11283         (map.Symbol.iterator):
11284         * stress/map-clone-iterator-change.js: Added.
11285         (shouldBe):
11286         (Map.prototype.Symbol.iterator):
11287         * stress/map-clone-next-change.js: Added.
11288         (shouldBe):
11289         (map.Symbol.iterator.__proto__.next):
11290         * stress/map-clone.js: Added.
11291         (shouldBe):
11292         (Map.prototype):
11293         * stress/map-inherit-set.js: Added.
11294         (shouldBe):
11295         (DerivedMap):
11296         (set for):
11297         * stress/set-clone-instance-iterator-change.js: Added.
11298         (shouldBe):
11299         (set Symbol.iterator):
11300         * stress/set-clone-iterator-change.js: Added.
11301         (shouldBe):
11302         (set Set.prototype.Symbol.iterator):
11303         * stress/set-clone-next-change.js: Added.
11304         (shouldBe):
11305         (set Symbol.iterator.__proto__.next):
11306         * stress/set-clone.js: Added.
11307         (shouldBe):
11308         (set Set.prototype.add):
11309         * stress/set-inherit-add.js: Added.
11310         (shouldBe):
11311         (DerivedSet.set add):
11312
11313 2017-05-26  Ryan Haddad  <ryanhaddad@apple.com>
11314
11315         Unreviewed, rolling out r217458.
11316
11317         This change caused 55 JSC test failures.
11318
11319         Reverted changeset:
11320
11321         "Date should use historical data if it's available."
11322         https://bugs.webkit.org/show_bug.cgi?id=172592
11323         http://trac.webkit.org/changeset/217458
11324
11325 2017-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
11326
11327         Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
11328         https://bugs.webkit.org/show_bug.cgi?id=167805
11329
11330         Reviewed by Saam Barati.
11331
11332         * modules/module-jit-reachability.js: Added.
11333
11334 2017-05-26  Oleksandr Skachkov  <gskachkov@gmail.com>
11335
11336         Prevent async methods named 'function'
11337         https://bugs.webkit.org/show_bug.cgi?id=172598
11338
11339         Reviewed by Mark Lam.
11340
11341         * stress/async-await-syntax.js:
11342         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
11343         (testTopLevelAsyncAwaitSyntaxSloppyMode):
11344         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
11345         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
11346         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
11347
11348 2017-05-25  Keith Miller  <keith_miller@apple.com>
11349
11350         Date should use historical data if it's available.
11351         https://bugs.webkit.org/show_bug.cgi?id=172592
11352
11353         Reviewed by Mark Lam.
11354
11355         Remove parts of the date tests that rely on the absence of
11356         historical data in Date.
11357
11358         * mozilla/ecma/Date/15.9.5.31-1.js:
11359         (getTestCases):
11360         * mozilla/ecma/Date/15.9.5.35-1.js:
11361         (getTestCases):
11362
11363 2017-05-25  Saam Barati  <sbarati@apple.com>
11364
11365         Our for-in optimization in the bytecode generator does its static analysis incorrectly
11366         https://bugs.webkit.org/show_bug.cgi?id=172532
11367         <rdar://problem/32369452>
11368
11369         Reviewed by Mark Lam.
11370
11371         * stress/for-in-invalidation-for-any-write.js: Added.
11372         (assert):
11373         (test):
11374         (test.i):
11375
11376 2017-05-25  Mark Lam  <mark.lam@apple.com>
11377
11378         ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
11379         https://bugs.webkit.org/show_bug.cgi?id=172548
11380         <rdar://problem/31458393>
11381
11382         Reviewed by Filip Pizlo.
11383
11384         * stress/regress-172548.patch: Added.
11385
11386 2017-05-23  Saam Barati  <sbarati@apple.com>
11387
11388         We should not mmap zero bytes for a memory in Wasm
11389         https://bugs.webkit.org/show_bug.cgi?id=172528
11390         <rdar://problem/32257076>
11391
11392         Reviewed by Mark Lam.
11393
11394         * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
11395         (testMems):
11396
11397 2017-05-23  Saam Barati  <sbarati@apple.com>
11398
11399         CFGSimplificationPhase should not merge a block with itself
11400         https://bugs.webkit.org/show_bug.cgi?id=172508
11401         <rdar://problem/28424006>
11402
11403         Reviewed by Keith Miller.
11404
11405         * stress/dont-crash-in-cfg-simplification.js: Added.
11406         (bar):
11407         (baz):
11408         (foo):
11409
11410 2017-05-20  Yusuke Suzuki  <utatane.tea@gmail.com>
11411
11412         [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
11413         https://bugs.webkit.org/show_bug.cgi?id=172216
11414
11415         Reviewed by Saam Barati.
11416
11417         * stress/array-storage-get-by-val.js: Added.
11418         (shouldBe):
11419         (testOutOfBound):
11420         (testInBound):
11421         (testSlowPutOutOfBound):
11422         (testSlowPutInBound):
11423
11424 2017-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
11425
11426         Unreviewed, fix commented out tests
11427         https://bugs.webkit.org/show_bug.cgi?id=172225
11428
11429         * stress/get-by-val-string.js:
11430         (object.43):
11431         (Hello):
11432         (Hello.prototype.get 42):
11433         (Hello.prototype.43):
11434         (Derived):
11435         (shouldBe):
11436         (throw.new.Error): Deleted.
11437
11438 2017-05-21  Saam Barati  <sbarati@apple.com>
11439
11440         We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
11441         https://bugs.webkit.org/show_bug.cgi?id=171041
11442         <rdar://problem/32082516>
11443
11444         Reviewed by Yusuke Suzuki.
11445
11446         * stress/lexical-scoping-for-loop.js: Added.
11447         (assert):
11448         (test1):
11449         (test2):
11450         (test3):
11451         (test4):
11452         (test5):
11453         (test6):
11454         (let.test7):
11455         (let.test8):
11456         (let.test9):
11457         (let.test10):
11458         (let.test11):
11459         (let.test12):
11460
11461 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
11462
11463         [JSC] Make get_by_val & string "499" to number 499
11464         https://bugs.webkit.org/show_bug.cgi?id=172225
11465
11466         Reviewed by Saam Barati.
11467
11468         * stress/get-by-val-string.js: Added.
11469         (shouldBe):
11470         (shouldThrow):
11471         (object.43):
11472         (Hello):
11473         (Hello.prototype.get 42):
11474         (Hello.prototype.43):
11475         (Derived):
11476
11477 2017-05-19  Mark Lam  <mark.lam@apple.com>
11478
11479         [Re-landing] DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
11480         https://bugs.webkit.org/show_bug.cgi?id=172383
11481         <rdar://problem/31418651>
11482
11483         Reviewed by Filip Pizlo.
11484
11485         * stress/regress-172383.js: Added.
11486
11487 2017-05-19  Ryan Haddad  <ryanhaddad@apple.com>
11488
11489         Unreviewed, rolling out r217156.
11490
11491         This change broke the iOS build.
11492
11493         Reverted changeset:
11494
11495         "DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring
11496         result registers."
11497         https://bugs.webkit.org/show_bug.cgi?id=172383
11498         http://trac.webkit.org/changeset/217156
11499
11500 2017-05-19  Mark Lam  <mark.lam@apple.com>
11501
11502         Add missing exception check.
11503         https://bugs.webkit.org/show_bug.cgi?id=172346
11504         <rdar://problem/32289640>
11505
11506         Reviewed by Geoffrey Garen.
11507
11508         * stress/regress-172346.js: Added.
11509
11510 2017-05-19  Mark Lam  <mark.lam@apple.com>
11511
11512         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
11513         https://bugs.webkit.org/show_bug.cgi?id=172383
11514         <rdar://problem/31418651>
11515
11516         Reviewed by Filip Pizlo.
11517
11518         * stress/regress-172383.js: Added.
11519
11520 2017-05-19  Filip Pizlo  <fpizlo@apple.com>
11521
11522         arrayProtoPrivateFuncConcatMemcpy needs to be down with firstArray being undecided
11523         https://bugs.webkit.org/show_bug.cgi?id=172369
11524
11525         Reviewed by Mark Lam.
11526
11527         * stress/undecided-concat.js: Added.
11528
11529 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
11530
11531         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
11532         https://bugs.webkit.org/show_bug.cgi?id=172098
11533
11534         Reviewed by Saam Barati.
11535
11536         * stress/check-sub-class.js: Added.
11537         (shouldBe):
11538         (shouldThrow):
11539         (calling):
11540         (array.forEach):
11541         (i.array.forEach):
11542
11543 2017-05-18  JF Bastien  <jfbastien@apple.com>
11544
11545         WebAssembly: exports is a getter
11546         https://bugs.webkit.org/show_bug.cgi?id=172129
11547
11548         Reviewed by Saam Barati.
11549
11550         Update test to reflect new semantics.
11551
11552         * wasm/js-api/test_basic_api.js:
11553         (const.c.in.constructorProperties.switch):
11554
11555 2017-05-18  Saam Barati  <sbarati@apple.com>
11556
11557         Proxy's [[Get]] passes incorrect receiver
11558         https://bugs.webkit.org/show_bug.cgi?id=164849
11559         <rdar://problem/31767058>
11560
11561         Reviewed by Yusuke Suzuki.
11562
11563         * stress/proxy-get-set-correct-receiver.js: Added.
11564         (assert):
11565         (test):
11566         (test.let.target.set prop):
11567         (test.let.target.get prop):
11568         (test.get let):
11569         * stress/proxy-set.js:
11570         (let.target.get x):
11571         * stress/reflect-set-proxy-set.js:
11572         (let.target.get x):
11573         * stress/reflect-set-receiver-proxy-set.js:
11574         (let.target.get x):
11575
11576 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
11577
11578         Constructor calls set this too early
11579         https://bugs.webkit.org/show_bug.cgi?id=172302
11580
11581         Reviewed by Saam Barati.
11582
11583         This tests all three kinds of constructs in BytecodeGenerator. All three were previously
11584         wrong.
11585
11586         * stress/construct-overwritten-variable.js: Added.
11587         (new.x.x):
11588         * stress/construct-spread-overwritten-variable-2.js: Added.
11589         (new.x.x):
11590         * stress/construct-spread-overwritten-variable.js: Added.
11591         (new.x.x):
11592
11593 2017-05-18  Saam Barati  <sbarati@apple.com>
11594
11595         WebAssembly: perform stack checks
11596         https://bugs.webkit.org/show_bug.cgi?id=165546
11597         <rdar://problem/29760307>
11598
11599         Reviewed by Filip Pizlo.
11600
11601         * wasm.yaml:
11602         * wasm/function-tests/factorial.js:
11603         * wasm/function-tests/float-sub.js:
11604         * wasm/function-tests/stack-overflow.js: Added.
11605         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
11606         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
11607         (assertOverflows.makeInstance):
11608         (assertOverflows.makeInstance2):
11609         (assertOverflows.assertThrows):
11610         (assertOverflows):
11611         (assertThrows.test.makeSignature):
11612         (assertThrows.test.makeInstance):
11613         (assertThrows.test):
11614         (assertThrows):
11615
11616 2017-05-18  Keith Miller  <keith_miller@apple.com>
11617
11618         WebAssembly API: test with neutered inputs
11619         https://bugs.webkit.org/show_bug.cgi?id=163899
11620
11621         Reviewed by JF Bastien.
11622
11623         * wasm/js-api/neutered-inputs.js: Added.
11624         (const.testFunction):
11625         (const.testConstructor):
11626         * wasm/js-api/test_basic_api.js:
11627         (const.c.in.constructorProperties.switch):
11628
11629 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
11630
11631         DFG inlining should be hardened for the no-result case
11632         https://bugs.webkit.org/show_bug.cgi?id=172290
11633
11634         Reviewed by Saam Barati.
11635
11636         * stress/array-constructor-no-result.js: Added.
11637         (foo):
11638         * stress/pow-no-result.js: Added.
11639         (foo):
11640
11641 2017-05-18  Commit Queue  <commit-queue@webkit.org>
11642
11643         Unreviewed, rolling out r217031, r217032, and r217037.
11644         https://bugs.webkit.org/show_bug.cgi?id=172293
11645
11646         cause linking errors in Windows (Requested by yusukesuzuki on
11647         #webkit).
11648
11649         Reverted changesets:
11650
11651         "[JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass"
11652         https://bugs.webkit.org/show_bug.cgi?id=172098
11653         http://trac.webkit.org/changeset/217031
11654
11655         "Unreviewed, rebaseline for newly added ClassInfo"
11656         https://bugs.webkit.org/show_bug.cgi?id=172098
11657         http://trac.webkit.org/changeset/217032
11658
11659         "Unreviewed, fix debug and non-JIT build"
11660         https://bugs.webkit.org/show_bug.cgi?id=172098
11661         http://trac.webkit.org/changeset/217037
11662
11663 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
11664
11665         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
11666         https://bugs.webkit.org/show_bug.cgi?id=172098
11667
11668         Reviewed by Saam Barati.
11669
11670         * stress/check-sub-class.js: Added.
11671         (shouldBe):
11672         (shouldThrow):
11673         (calling):
11674         (array.forEach):
11675         (i.array.forEach):
11676
11677 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
11678
11679         Unreviewed, address mlam's review feedback.
11680
11681         * stress/arguments-elimination-varargs-too-many-args-arg-count.js:
11682
11683 2017-05-17  Saam Barati  <sbarati@apple.com>
11684
11685         We don't do context switches for Wasm->Wasm call indirect
11686         https://bugs.webkit.org/show_bug.cgi?id=172188
11687         <rdar://problem/32231828>
11688
11689         Reviewed by Keith Miller.
11690
11691         * wasm/function-tests/context-switch.js: Added.
11692         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
11693         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance2):
11694         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.i2.makeInstance2):
11695         (makeInstance):
11696         (makeInstance2):
11697         (assert.eq.makeInstance):
11698         (assert.eq.makeInstance2):
11699         (assert.eq):
11700
11701 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
11702
11703         JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform
11704         https://bugs.webkit.org/show_bug.cgi?id=172208
11705
11706         Reviewed by Saam Barati.
11707
11708         * stress/arguments-elimination-varargs-too-many-args-arg-count.js: Added.
11709         (foo):
11710         (bar):
11711         (baz):
11712
11713 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
11714
11715         [DFG] Constant Folding Phase should convert MakeRope("", String) => Identity(String)
11716         https://bugs.webkit.org/show_bug.cgi?id=172115
11717
11718         Reviewed by Saam Barati.
11719
11720         * stress/constant-folding-should-fold-make-rope-with-empty-strings.js: Added.
11721         (shouldBe):
11722         (unknown):
11723         (readWord1):
11724         (readWord2):
11725         (readWord3):
11726         (readWord4):
11727
11728 2017-05-16  JF Bastien  <jfbastien@apple.com>
11729
11730         WebAssembly: add memory fuzzer
11731         https://bugs.webkit.org/show_bug.cgi?id=169976
11732         <rdar://problem/31965328>
11733
11734         Reviewed by Keith Miller.
11735
11736         * wasm/fuzz/memory.js: Added.
11737         (const.insert):
11738         (const.action.string_appeared_here):
11739         (const.performAction):
11740         (catch):
11741
11742 2017-05-16  JF Bastien  <jfbastien@apple.com>
11743
11744         WebAssembly: validate load / store alignment
11745         https://bugs.webkit.org/show_bug.cgi?id=168836
11746         <rdar://problem/31965349>
11747
11748         Reviewed by Keith Miller.
11749
11750         * wasm/WASM.js: fix regular expression greed
11751         * wasm/function-tests/memory-alignment.js: Added.
11752         (const.op.of.WASM.opcodes):
11753         * wasm/wasm.json: fix formatting
11754
11755 2017-05-15  Mark Lam  <mark.lam@apple.com>
11756
11757         Rolling out r214038 and r213697: Crashes when using computed properties with rest destructuring and object spread.
11758         https://bugs.webkit.org/show_bug.cgi?id=172147
11759
11760         Rubber-stamped by Saam Barati.
11761
11762         * stress/object-rest-deconstruct.js: Removed.
11763         * stress/object-spread.js: Removed.
11764
11765 2017-05-11  JF Bastien  <jfbastien@apple.com>
11766
11767         WebAssembly: stop supporting 0xD
11768         https://bugs.webkit.org/show_bug.cgi?id=168788
11769         <rdar://problem/31880922>
11770
11771         Reviewed by Saam Barati.
11772
11773         Test that only version 1 is supported.
11774
11775         * wasm/js-api/version.js: Added.
11776
11777 2017-05-10  JF Bastien  <jfbastien@apple.com>
11778
11779         WebAssemby: builder doesn't do Memory section maximum correctly
11780         https://bugs.webkit.org/show_bug.cgi?id=171931
11781
11782         Reviewed by Keith Miller.
11783
11784         * wasm/Builder.js:
11785         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
11786         * wasm/Builder_WebAssemblyBinary.js:
11787         (const.emitters.Memory):
11788         * wasm/function-tests/memory-grow-invalid.js: Added.
11789
11790 2017-05-10  JF Bastien  <jfbastien@apple.com>
11791
11792         WebAssembly: support name section
11793         https://bugs.webkit.org/show_bug.cgi?id=171263
11794
11795         Reviewed by Keith Miller.
11796
11797         * wasm/function-tests/nameSection.js: Added.
11798         (const.compile):
11799         * wasm/function-tests/nameSection.wasm: Added.
11800         * wasm/function-tests/stack-trace.js: Update format
11801
11802 2017-05-10  Filip Pizlo  <fpizlo@apple.com>
11803
11804         Null pointer dereference in WTF::RefPtr<WTF::StringImpl>::operator!() under slow_path_get_direct_pname
11805         https://bugs.webkit.org/show_bug.cgi?id=171801
11806
11807         Reviewed by Michael Saboff.
11808
11809         These tests used to crash. The prefix and postfix tests cover different paths, except
11810         postfix-ignored goes down the same path as prefix due to an optimization.
11811
11812         * stress/for-in-postfix-ignored-index.js: Added.
11813         (foo):
11814         * stress/for-in-postfix-index.js: Added.
11815         (foo):
11816         * stress/for-in-prefix-index.js: Added.
11817         (foo):
11818
11819 2017-05-08  Mark Lam  <mark.lam@apple.com>
11820
11821         op_throw_static_error's use of its first operand should be reflected in DFG BytecodeUseDef as well.
11822         https://bugs.webkit.org/show_bug.cgi?id=171786
11823         <rdar://problem/32051023>
11824
11825         Reviewed by Saam Barati.
11826
11827         * stress/bug-171786.js: Added.
11828
11829 2017-05-06  Oleksandr Skachkov  <gskachkov@gmail.com>
11830
11831         [ES6] Arrow function. Issue in access to this after eval('super()') within constructor
11832         https://bugs.webkit.org/show_bug.cgi?id=171543
11833
11834         Reviewed by Saam Barati.
11835
11836         * stress/arrowfunction-lexical-bind-supercall-4.js:
11837         (J):
11838         (K):
11839
11840 2017-05-05  Saam Barati  <sbarati@apple.com>
11841
11842         putDirectIndex does not properly do defineOwnProperty
11843         https://bugs.webkit.org/show_bug.cgi?id=171591
11844         <rdar://problem/31735695>
11845
11846         Reviewed by Geoffrey Garen.
11847
11848         * stress/array-prototype-splice-making-typed-array.js:
11849         (test):
11850         * stress/array-species-config-array-constructor.js:
11851         (shouldThrow):
11852         (test):
11853         * stress/put-direct-index-broken-2.js: Added.
11854         (assert):
11855         (test):
11856         (makeLengthWritable):
11857         (set get restoreOldDesc):
11858         * stress/put-direct-index-broken.js: Added.
11859         (whatToTest):
11860         (tryRunning):
11861         (tryItOut):
11862         * stress/put-indexed-getter-setter.js: Added.
11863         (foo.X.prototype.set 7):
11864         (foo.X.prototype.get 7):
11865         (foo.X):
11866         (foo):
11867
11868 2017-05-04  Yusuke Suzuki  <utatane.tea@gmail.com>
11869
11870         [JSC] Math unary functions should be handled by DFG
11871         https://bugs.webkit.org/show_bug.cgi?id=171269
11872
11873         Reviewed by Saam Barati.
11874
11875         * stress/arith-acos-on-various-types.js: Added.
11876         (let.validInputTypedTestCases.validInputTestCases.map):
11877         (isIdentical):
11878         (opaqueACosNoArgument):
11879         (testNoArgument):
11880         (opaqueAllTypesACos):
11881         (testAllTypesCall):
11882         (testSingleTypeCall):
11883         (testConstant):
11884         (opaqueACosForSideEffects):
11885         (testSideEffect.let.testObject.valueOf):
11886         (testSideEffect):
11887         (opaqueACosForCSE):
11888         (testCSE.let.testObject.valueOf):
11889         (testCSE):
11890         (opaqueACosForDCE):
11891         (testDCE.let.testObject.valueOf):
11892         (testDCE):
11893         (testException.opaqueACosWithException):
11894         (testException):
11895         * stress/arith-acosh-on-various-types.js: Added.
11896         (let.validInputTypedTestCases.validInputTestCases.map):
11897         (isIdentical):
11898         (opaqueACoshNoArgument):
11899         (testNoArgument):
11900         (opaqueAllTypesACosh):
11901         (testAllTypesCall):
11902         (testSingleTypeCall):
11903         (testConstant):
11904         (opaqueACoshForSideEffects):
11905         (testSideEffect.let.testObject.valueOf):
11906         (testSideEffect):
11907         (opaqueACoshForCSE):
11908         (testCSE.let.testObject.valueOf):
11909         (testCSE):
11910         (opaqueACoshForDCE):
11911         (testDCE.let.testObject.valueOf):
11912         (testDCE):
11913         (testException.opaqueACoshWithException):
11914         (testException):
11915         * stress/arith-asin-on-various-types.js: Added.
11916         (let.validInputTypedTestCases.validInputTestCases.map):
11917         (isIdentical):
11918         (opaqueASinNoArgument):
11919         (testNoArgument):
11920         (opaqueAllTypesASin):
11921         (testAllTypesCall):
11922         (testSingleTypeCall):
11923         (testConstant):
11924         (opaqueASinForSideEffects):
11925         (testSideEffect.let.testObject.valueOf):
11926         (testSideEffect):
11927         (opaqueASinForCSE):
11928         (testCSE.let.testObject.valueOf):
11929         (testCSE):
11930         (opaqueASinForDCE):
11931         (testDCE.let.testObject.valueOf):
11932         (testDCE):
11933         (testException.opaqueASinWithException):
11934         (testException):
11935         * stress/arith-asinh-on-various-types.js: Added.
11936         (let.validInputTypedTestCases.validInputTestCases.map):
11937         (isIdentical):
11938         (opaqueASinhNoArgument):
11939         (testNoArgument):
11940         (opaqueAllTypesASinh):
11941         (testAllTypesCall):
11942         (testSingleTypeCall):
11943         (testConstant):
11944         (opaqueASinhForSideEffects):
11945         (testSideEffect.let.testObject.valueOf):
11946         (testSideEffect):
11947         (opaqueASinhForCSE):
11948         (testCSE.let.testObject.valueOf):
11949         (testCSE):
11950         (opaqueASinhForDCE):
11951         (testDCE.let.testObject.valueOf):
11952         (testDCE):
11953         (testException.opaqueASinhWithException):
11954         (testException):
11955         * stress/arith-atan-on-various-types.js: Added.
11956         (let.validInputTypedTestCases.validInputTestCases.map):
11957         (isIdentical):
11958         (opaqueATanNoArgument):
11959         (testNoArgument):
11960         (opaqueAllTypesATan):
11961         (testAllTypesCall):
11962         (testSingleTypeCall):
11963         (testConstant):
11964         (opaqueATanForSideEffects):
11965         (testSideEffect.let.testObject.valueOf):
11966         (testSideEffect):
11967         (opaqueATanForCSE):
11968         (testCSE.let.testObject.valueOf):
11969         (testCSE):
11970         (opaqueATanForDCE):
11971         (testDCE.let.testObject.valueOf):
11972         (testDCE):
11973         (testException.opaqueATanWithException):
11974         (testException):
11975         * stress/arith-atanh-on-various-types.js: Added.
11976         (let.validInputTypedTestCases.validInputTestCases.map):
11977         (isIdentical):
11978         (opaqueATanhNoArgument):
11979         (testNoArgument):
11980         (opaqueAllTypesATanh):
11981         (testAllTypesCall):
11982         (testSingleTypeCall):
11983         (testConstant):
11984         (opaqueATanhForSideEffects):
11985         (testSideEffect.let.testObject.valueOf):
11986         (testSideEffect):
11987         (opaqueATanhForCSE):
11988         (testCSE.let.testObject.valueOf):
11989         (testCSE):
11990         (opaqueATanhForDCE):
11991         (testDCE.let.testObject.valueOf):
11992         (testDCE):
11993         (testException.opaqueATanhWithException):
11994         (testException):
11995         * stress/arith-cbrt-on-various-types.js: Added.
11996         (let.validInputTypedTestCases.validInputTestCases.map):
11997         (isIdentical):
11998         (opaqueCbrtNoArgument):
11999         (testNoArgument):
12000         (opaqueAllTypesCbrt):
12001         (testAllTypesCall):
12002         (testSingleTypeCall):
12003         (testConstant):
12004         (opaqueCbrtForSideEffects):
12005         (testSideEffect.let.testObject.valueOf):
12006         (testSideEffect):
12007         (opaqueCbrtForCSE):
12008         (testCSE.let.testObject.valueOf):
12009         (testCSE):
12010         (opaqueCbrtForDCE):
12011         (testDCE.let.testObject.valueOf):
12012         (testDCE):
12013         (testException.opaqueCbrtWithException):
12014         (testException):
12015         * stress/arith-cosh-on-various-types.js: Added.
12016         (let.validInputTypedTestCases.validInputTestCases.map):
12017         (isIdentical):
12018         (opaqueCoshNoArgument):
12019         (testNoArgument):
12020         (opaqueAllTypesCosh):
12021         (testAllTypesCall):
12022         (testSingleTypeCall):
12023         (testConstant):
12024         (opaqueCoshForSideEffects):
12025         (testSideEffect.let.testObject.valueOf):
12026         (testSideEffect):
12027         (opaqueCoshForCSE):
12028         (testCSE.let.testObject.valueOf):
12029         (testCSE):
12030         (opaqueCoshForDCE):
12031         (testDCE.let.testObject.valueOf):
12032         (testDCE):
12033         (testException.opaqueCoshWithException):
12034         (testException):
12035         * stress/arith-expm1-on-various-types.js: Added.
12036         (let.validInputTypedTestCases.validInputTestCases.map):
12037         (isIdentical):
12038         (opaqueExpm1NoArgument):
12039         (testNoArgument):
12040         (opaqueAllTypesExpm1):
12041         (testAllTypesCall):
12042         (testSingleTypeCall):
12043         (testConstant):
12044         (opaqueExpm1ForSideEffects):
12045         (testSideEffect.let.testObject.valueOf):
12046         (testSideEffect):
12047         (opaqueExpm1ForCSE):
12048         (testCSE.let.testObject.valueOf):
12049         (testCSE):
12050         (opaqueExpm1ForDCE):
12051         (testDCE.let.testObject.valueOf):
12052         (testDCE):
12053         (testException.opaqueExpm1WithException):
12054         (testException):
12055         * stress/arith-log10-on-various-types.js: Added.
12056         (let.validInputTypedTestCases.validInputTestCases.map):
12057         (isIdentical):
12058         (opaqueLog10NoArgument):
12059         (testNoArgument):
12060         (opaqueAllTypesLog10):
12061         (testAllTypesCall):
12062         (testSingleTypeCall):
12063         (testConstant):
12064         (opaqueLog10ForSideEffects):
12065         (testSideEffect.let.testObject.valueOf):
12066         (testSideEffect):
12067         (opaqueLog10ForCSE):
12068         (testCSE.let.testObject.valueOf):
12069         (testCSE):
12070         (opaqueLog10ForDCE):
12071         (testDCE.let.testObject.valueOf):
12072         (testDCE):
12073         (testException.opaqueLog10WithException):
12074         (testException):
12075         * stress/arith-log2-on-various-types.js: Added.
12076         (let.validInputTypedTestCases.validInputTestCases.map):
12077         (isIdentical):
12078         (opaqueLog2NoArgument):
12079         (testNoArgument):
12080         (opaqueAllTypesLog2):
12081         (testAllTypesCall):
12082         (testSingleTypeCall):
12083         (testConstant):
12084         (opaqueLog2ForSideEffects):
12085         (testSideEffect.let.testObject.valueOf):
12086         (testSideEffect):
12087         (opaqueLog2ForCSE):
12088         (testCSE.let.testObject.valueOf):
12089         (testCSE):
12090         (opaqueLog2ForDCE):
12091         (testDCE.let.testObject.valueOf):
12092         (testDCE):
12093         (testException.opaqueLog2WithException):
12094         (testException):
12095         * stress/arith-sinh-on-various-types.js: Added.
12096         (let.validInputTypedTestCases.validInputTestCases.map):
12097         (isIdentical):
12098         (opaqueSinhNoArgument):
12099         (testNoArgument):
12100         (opaqueAllTypesSinh):
12101         (testAllTypesCall):
12102         (testSingleTypeCall):
12103         (testConstant):
12104         (opaqueSinhForSideEffects):
12105         (testSideEffect.let.testObject.valueOf):
12106         (testSideEffect):
12107         (opaqueSinhForCSE):
12108         (testCSE.let.testObject.valueOf):
12109         (testCSE):
12110         (opaqueSinhForDCE):
12111         (testDCE.let.testObject.valueOf):
12112         (testDCE):
12113         (testException.opaqueSinhWithException):
12114         (testException):
12115         * stress/arith-tan-on-various-types.js:
12116         (isIdentical):
12117         * stress/arith-tanh-on-various-types.js: Added.
12118         (let.validInputTypedTestCases.validInputTestCases.map):
12119         (isIdentical):
12120         (opaqueTanhNoArgument):
12121         (testNoArgument):
12122         (opaqueAllTypesTanh):
12123         (testAllTypesCall):
12124         (testSingleTypeCall):
12125         (testConstant):
12126         (opaqueTanhForSideEffects):
12127         (testSideEffect.let.testObject.valueOf):
12128         (testSideEffect):
12129         (opaqueTanhForCSE):
12130         (testCSE.let.testObject.valueOf):
12131         (testCSE):
12132         (opaqueTanhForDCE):
12133         (testDCE.let.testObject.valueOf):
12134         (testDCE):
12135         (testException.opaqueTanhWithException):
12136         (testException):
12137
12138 2017-05-03  Keith Miller  <keith_miller@apple.com>
12139
12140         Array.prototype.sort should also allow a null comparator
12141         https://bugs.webkit.org/show_bug.cgi?id=171621
12142
12143         Reviewed by Michael Saboff.
12144
12145         Add test to make it less likely we revert to the incompatable behavior.
12146         Also, fix now incorrect tests.
12147
12148         * ChakraCore/test/Array/array_sort.baseline-jsc:
12149         * stress/array-sort-bad-comparator.js:
12150         (test):
12151         * stress/sort-null-comparator.js: Added.
12152         (assertEq):
12153
12154 2017-05-03  Caitlin Potter  <caitp@igalia.com>
12155
12156         [JSC] remove unneeded asyncFunctionTests.yaml
12157         https://bugs.webkit.org/show_bug.cgi?id=171611
12158
12159         Reviewed by Yusuke Suzuki.
12160
12161         Async functions have shipped, and those tests are run as part of
12162         JSTests/stress and JSTests/test262.yaml. The file is no longer needed.
12163
12164         * asyncFunctionTests.yaml: Removed.
12165         * stress/async-await-long-loop.js:
12166         * stress/async-await-throw-loop.js:
12167
12168 2017-05-03  Keith Miller  <keith_miller@apple.com>
12169
12170         Different behaviour with the .sort(callback) method (unlike Firefox & Chrome)
12171         https://bugs.webkit.org/show_bug.cgi?id=47825
12172
12173         Reviewed by Saam Barati.
12174
12175         * stress/sorting-boolean-result-comparator.js: Added.
12176         (checkArray):
12177
12178 2017-05-02  David Kilzer  <ddkilzer@apple.com>
12179
12180         check-webkit-style should keep JavaScript test functions in sync
12181         <https://webkit.org/b/171424>
12182
12183         Reviewed by Joseph Pecoraro.
12184
12185         This change makes shouldBe(), shouldNotBe(), shouldNotThrow()
12186         and shouldThrow() in sync with other copies of these methods.
12187
12188         * stress/resources/standalone-pre.js:
12189         (shouldBe): Fix whitespace.  Prefix 'exception' and 'quiet'
12190         variables with underscore.
12191         (shouldThrow): Fix whitespace.
12192
12193 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
12194
12195         We initialize functions too early in an eval
12196         https://bugs.webkit.org/show_bug.cgi?id=161099
12197
12198         Reviewed by Saam Barati.
12199
12200         * stress/eval-func-decl-with-let-const-class.js: Added.
12201
12202 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
12203
12204         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
12205         https://bugs.webkit.org/show_bug.cgi?id=163208
12206
12207         Reviewed by Saam Barati.
12208
12209         * stress/eval-func-decl-block-scoping-reassign.js: Added.
12210         (assert):
12211         (throw.new.Error.f):
12212         (throw.new.Error):
12213         * stress/eval-func-decl-block-with-remove.js: Added.
12214         (assert):
12215         (foo.boo):
12216         (foo):
12217         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
12218         (assert):
12219         (assertThrow):
12220         (foo):
12221         (boo):
12222         (joo):
12223         (koo):
12224         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
12225         (assert):
12226         (assertThrow):
12227         (foo):
12228         (boo):
12229         (hoo):
12230         (joo):
12231         (koo):
12232         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
12233         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
12234         (assert):
12235         (assertThrow):
12236         (foo):
12237         (boo):
12238         (goo):
12239         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
12240         (assert):
12241         (assertThrow):
12242         (foo):
12243         (boo):
12244         (boo.let.val2):
12245         (boo.let.val3):
12246         * stress/eval-func-decl-in-frozen-global.js: Added.
12247         (assert):
12248         (assertThrow):
12249         (throw.new.Error):
12250         (Object.freeze):
12251         * stress/eval-func-decl-in-global-of-eval.js: Added.
12252         (assert):
12253         (assertThrow):
12254         (bar):
12255         (baz):
12256         (foobar):
12257         * stress/eval-func-decl-in-global.js: Added.
12258         (assert):
12259         (assertThrow):
12260         * stress/eval-func-decl-in-if.js: Added.
12261         (assert):
12262         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
12263         (assert):
12264         (assertThrow):
12265         (foo):
12266         (boo):
12267         (foobar):
12268         (hoo):
12269         (joo):
12270         (koo):
12271         (loo):
12272         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
12273         (assert):
12274         (assertThrow):
12275         (foo):
12276         (boo):
12277         (goo):
12278         * stress/variable-under-tdz-eval-tricky.js:
12279         (assert):
12280         * test262.yaml:
12281
12282 2017-04-27  Mark Lam  <mark.lam@apple.com>
12283
12284         Fix some RELEASE_ASSERT failures caused by OutOfMemoryErrors.
12285         https://bugs.webkit.org/show_bug.cgi?id=171404
12286         <rdar://problem/31876178>
12287
12288         Reviewed by Saam Barati.
12289
12290         * stress/js-fixed-array-out-of-memory.js: Added.
12291
12292 2017-04-27  David Kilzer  <ddkilzer@apple.com>
12293
12294         Enhance shouldBe()/shouldNotBe() to accept anonymous function arguments
12295         <https://webkit.org/b/171362>
12296         <rdar://problem/31867686>
12297
12298         Reviewed by Joseph Pecoraro.
12299
12300         * stress/resources/standalone-pre.js:
12301         (shouldBe):
12302         (shouldNotThrow):
12303         (shouldThrow):
12304         - Update shouldBe() to accept anonymous function arguments.
12305           (The shouldNotBe() function was never copied over.)
12306         - Also fix shouldThrow()/shouldNotThrow() to accept anonymous
12307           function arguments (which were missed in r202609 for Bug
12308           159232).
12309
12310 2017-04-27  Yusuke Suzuki  <utatane.tea@gmail.com>
12311
12312         [JSC] Handle PhantomSpread in LoadVarargs as the same to the others
12313         https://bugs.webkit.org/show_bug.cgi?id=171262
12314
12315         Reviewed by Saam Barati.
12316
12317         * stress/spread-outer-create-rest.js: Added.
12318         (assert):
12319         (foo):
12320         (bar):
12321         (baz):
12322
12323 2017-04-26  Saam Barati  <sbarati@apple.com>
12324
12325         Print Wasm function index in stack trace
12326         https://bugs.webkit.org/show_bug.cgi?id=171349
12327
12328         Reviewed by JF Bastien.
12329
12330         * wasm/function-tests/stack-trace.js: Added.
12331         (import.Builder.from.string_appeared_here.assert):
12332         (let.imp):
12333         * wasm/function-tests/trap-after-cross-instance-call.js:
12334         (wasmFrameCountFromError):
12335         * wasm/function-tests/trap-load-2.js:
12336         (wasmFrameCountFromError):
12337         * wasm/function-tests/trap-load.js:
12338         (wasmFrameCountFromError):
12339
12340 2017-04-26  Saam Barati  <sbarati@apple.com>
12341
12342         ASSERTION FAILED: inIndex != notFound in JSC::invalidParameterInSourceAppender()
12343         https://bugs.webkit.org/show_bug.cgi?id=170924
12344         <rdar://problem/31721052>
12345
12346         Reviewed by Mark Lam.
12347
12348         * stress/error-message-for-function-base-not-found.js: Added.
12349         (assert):
12350         (throw.new.Error):
12351         * stress/error-messages-for-in-operator-should-not-crash.js: Added.
12352         (catch):
12353
12354 2017-04-26  Keith Miller  <keith_miller@apple.com>
12355
12356         WebAssembly: Implement tier up
12357         https://bugs.webkit.org/show_bug.cgi?id=170134
12358
12359         Reviewed by Filip Pizlo.
12360
12361         * wasm/function-tests/trap-after-cross-instance-call.js:
12362         * wasm/tier-up/js-to-wasm.js: Added.
12363         (async.test):
12364         * wasm/tier-up/wasm-to-wasm.js: Added.
12365         (async.test):
12366
12367 2017-04-26  Caitlin Potter  <caitp@igalia.com>
12368
12369         [JSC] Object.keys() must discard property names with no PropertyDescriptor
12370         https://bugs.webkit.org/show_bug.cgi?id=171291
12371
12372         Reviewed by Yusuke Suzuki.
12373
12374         * es6/Proxy_ownKeys_duplicates.js:
12375         * stress/proxy-own-keys.js:
12376         (let.handler.getOwnPropertyDescriptor):
12377         (let.handler.ownKeys):
12378
12379 2017-04-25  Commit Queue  <commit-queue@webkit.org>
12380
12381         Unreviewed, rolling out r215476.
12382         https://bugs.webkit.org/show_bug.cgi?id=171304
12383
12384         "It broke JSBench" (Requested by saamyjoon on #webkit).
12385
12386         Reverted changeset:
12387
12388         "[ES6]. Implement Annex B.3.3 function hoisting rules for
12389         eval"
12390         https://bugs.webkit.org/show_bug.cgi?id=163208
12391         http://trac.webkit.org/changeset/215476
12392
12393 2017-04-25  Saam Barati  <sbarati@apple.com>
12394
12395         JSArray::isArrayPrototypeIteratorProtocolFastAndNonObservable is wrong because it does not do the necessary checks on the base object
12396         https://bugs.webkit.org/show_bug.cgi?id=171150
12397         <rdar://problem/31771880>
12398
12399         Reviewed by Sam Weinig.
12400
12401         * stress/spread-optimized-properly.js: Added.
12402         (assert):
12403         (test):
12404         (shallowEq):
12405         (makeArrayIterator):
12406         (test.bar):
12407         (test.callback):
12408         (test.arr.__proto__.Symbol.iterator):
12409         (test.arr.Symbol.iterator):
12410         (test.get bar):
12411         (test.hackedNext):
12412         (test.test):
12413         (test.):
12414
12415 2017-04-25  Mark Lam  <mark.lam@apple.com>
12416
12417         [Follow up] Array.prototype.slice() should ensure that end >= begin.
12418         https://bugs.webkit.org/show_bug.cgi?id=170989
12419         <rdar://problem/31705652>
12420
12421         Not reviewed.
12422
12423         Follow up to rename a test file that was accidentally named wrongly.
12424
12425         * stress/regress-170989.js: Copied from JSTests/stress/regress-170989.patch.
12426         * stress/regress-170989.patch: Removed.
12427
12428 2017-04-25  Mark Lam  <mark.lam@apple.com>
12429
12430         Array.prototype.slice() should ensure that end >= begin.
12431         https://bugs.webkit.org/show_bug.cgi?id=170989
12432         <rdar://problem/31705652>
12433
12434         Reviewed by Saam Barati.
12435
12436         * stress/regress-170989.patch: Added.
12437
12438 2017-04-25  Mark Lam  <mark.lam@apple.com>
12439
12440         Local CSE wrongly CSEs array accesses with different result types.
12441         https://bugs.webkit.org/show_bug.cgi?id=170990
12442         <rdar://problem/31705945>
12443
12444         Reviewed by Saam Barati.
12445
12446         * stress/regress-170990.js: Added.
12447
12448 2017-04-25  Yusuke Suzuki  <utatane.tea@gmail.com>
12449
12450         WebAssembly: exporting a property with a name that's a number doesn't work
12451         https://bugs.webkit.org/show_bug.cgi?id=168857
12452
12453         Reviewed by JF Bastien.
12454
12455         r213453 allows Wasm instances to expose indexed properties. We activate the tests.
12456
12457         * wasm/js-api/test_Instance.js:
12458         (ExportedNumber):
12459
12460 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
12461
12462         test262: test262/test/language/expressions/object/method-definition/early-errors-object-method-duplicate-parameters.js
12463         https://bugs.webkit.org/show_bug.cgi?id=171190
12464
12465         Reviewed by Saam Barati.
12466
12467         * stress/async-await-syntax.js:
12468         * test262.yaml:
12469
12470 2017-04-24  Yusuke Suzuki  <utatane.tea@gmail.com>
12471
12472         [JSC] Use JSFixedArray directly when using call_varargs
12473         https://bugs.webkit.org/show_bug.cgi?id=171057
12474
12475         Reviewed by Saam Barati.
12476
12477         * stress/spread-capture-rest.js: Added.
12478         (shouldBe):
12479         (capture):
12480         (a):
12481         (b):
12482         * stress/spread-multi-layers.js: Added.
12483         (shouldBe):
12484         (a):
12485         (b):
12486         (c):
12487         (d):
12488         * stress/spread-non-varargs.js: Added.
12489         (shouldBe):
12490         (a):
12491         (b):
12492
12493 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
12494
12495         test262: test262/test/language/computed-property-names/class/static/getter-prototype.js
12496         https://bugs.webkit.org/show_bug.cgi?id=170897
12497
12498         Reviewed by Saam Barati.
12499
12500         * test262.yaml:
12501
12502 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
12503
12504         Address some FIXMEs in JavaScript tests for bugs that have been fixed
12505         https://bugs.webkit.org/show_bug.cgi?id=171191
12506
12507         Reviewed by JF Bastien.
12508
12509         * stress/proxy-is-extensible.js:
12510
12511 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
12512
12513         test262: test262/test/language/statements/for-of/dstr-array-elem-init-fn-name-arrow.js
12514         https://bugs.webkit.org/show_bug.cgi?id=171160
12515
12516         Reviewed by JF Bastien.
12517
12518         * stress/inferred-names.js:
12519         * test262.yaml:
12520
12521 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
12522
12523         test262: test262/test/language/expressions/generators/yield-as-label.js
12524         https://bugs.webkit.org/show_bug.cgi?id=170979
12525
12526         Reviewed by Saam Barati.
12527
12528         * stress/async-await-module-reserved-word.js:
12529         * stress/async-await-reserved-word.js:
12530         Converge on "Cannot" instead of "Can't".
12531
12532         * catch-parameter-syntax.js:
12533         * yield-named-variable-generator.js:
12534         * yield-named-variable.js:
12535         * stress/yield-label-generator.js:
12536         * stress/yield-label.js:
12537         * stress/yield-reserved-word.js: Added.
12538         More complete list of when 'yield' is allowed.
12539
12540         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
12541         * test262.yaml:
12542
12543 2017-04-23  Commit Queue  <commit-queue@webkit.org>
12544
12545         Unreviewed, rolling out r215674.
12546         https://bugs.webkit.org/show_bug.cgi?id=171212
12547
12548         Possible unintended commit. This patch was on the wrong bug.
12549         (Requested by JoePeck on #webkit).
12550
12551         Reverted changeset:
12552
12553         "test262: test262/test/language/expressions/generators/yield-
12554         as-label.js"
12555         https://bugs.webkit.org/show_bug.cgi?id=170979
12556         http://trac.webkit.org/changeset/215674
12557
12558 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
12559
12560         test262: test262/test/built-ins/Number/prototype/toPrecision/nan.js
12561         https://bugs.webkit.org/show_bug.cgi?id=171197
12562
12563         Reviewed by Saam Barati.
12564
12565         * test262.yaml:
12566
12567 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
12568
12569         test262: test262/test/language/expressions/generators/yield-as-label.js
12570         https://bugs.webkit.org/show_bug.cgi?id=170979
12571
12572         Reviewed by Saam Barati.
12573
12574         * stress/async-await-module-reserved-word.js:
12575         * stress/async-await-reserved-word.js:
12576         Converge on "Cannot" instead of "Can't".
12577
12578         * catch-parameter-syntax.js:
12579         * yield-named-variable-generator.js:
12580         * yield-named-variable.js:
12581         * stress/yield-label-generator.js:
12582         * stress/yield-label.js:
12583         * stress/yield-reserved-word.js: Added.
12584         More complete list of when 'yield' is allowed.
12585
12586         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
12587         * test262.yaml:
12588
12589 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
12590
12591         test262: test262/test/built-ins/Number/parseFloat.js
12592         https://bugs.webkit.org/show_bug.cgi?id=171193
12593
12594         Reviewed by Yusuke Suzuki.
12595
12596         * test262.yaml:
12597
12598 2017-04-22  JF Bastien  <jfbastien@apple.com>
12599
12600         WebAssembly: Module.exports, Module.imports, Module.customSections are wrong
12601         https://bugs.webkit.org/show_bug.cgi?id=171078
12602
12603         Reviewed by Saam Barati.
12604
12605         They're static properties of Module, not instance properties of a module.
12606         https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymoduleexports
12607
12608         * wasm/js-api/Module.customSection.js:
12609         (assert.throws.WebAssembly.Module.customSections):
12610         (assert.eq):
12611         (assert.throws.WebAssembly.Module.prototype.customSections): Deleted.
12612         * wasm/js-api/Module.exports.js:
12613         (assert.throws.WebAssembly.Module.exports):
12614         (assert.truthy):
12615         (assert.throws.WebAssembly.Module.prototype.exports): Deleted.
12616         * wasm/js-api/Module.imports.js:
12617         (assert.throws.WebAssembly.Module.imports):
12618         (assert.truthy):
12619         (assert.throws.WebAssembly.Module.prototype.imports): Deleted.
12620
12621 2017-04-21  JF Bastien  <jfbastien@apple.com>
12622
12623         Silence noisy test
12624
12625         Unreviewed, Fil / Michael and I talked about it in the corridor. I
12626         just forgot to set verbose to false before commit.
12627
12628         * wasm/stress/oom.js:
12629
12630 2017-04-20  Yusuke Suzuki  <utatane.tea@gmail.com>
12631
12632         [JSC][FTL] FTL should support Arrayify
12633         https://bugs.webkit.org/show_bug.cgi?id=169596
12634
12635         Reviewed by Saam Barati.
12636
12637         * stress/arrayify.js: Added.
12638         (arrayifyInt32):
12639         (arrayifyDouble):
12640         (arrayifyContiguous):
12641
12642 2017-04-20  Mark Lam  <mark.lam@apple.com>
12643
12644         virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.
12645         https://bugs.webkit.org/show_bug.cgi?id=171079
12646         <rdar://problem/31684756>
12647
12648         Reviewed by Saam Barati.
12649
12650         * stress/regress-171079.js: Added.
12651
12652 2017-04-15  Filip Pizlo  <fpizlo@apple.com>
12653
12654         Optimize SharedArrayBuffer in the DFG+FTL
12655         https://bugs.webkit.org/show_bug.cgi?id=164108
12656
12657         Reviewed by Saam Barati.
12658
12659         Added a fairly comprehensive test of the intrinsics. This creates a function for each possible
12660         combination of type and operation, and then first uses it nicely and then tries a bunch of
12661         erroneous conditions like OOB.
12662
12663         * stress/SharedArrayBuffer-opt.js: Added.
12664         (string_appeared_here.switch):
12665         (string_appeared_here.str):
12666         (runAtomic):
12667         (shouldFail):
12668         (Symbol):
12669         (string_appeared_here.a.of.arrays.m.of.atomics):
12670         * stress/SharedArrayBuffer.js:
12671
12672 2017-04-19  Mark Lam  <mark.lam@apple.com>
12673
12674         B3StackmapSpecial should handle when stackmap values are not recoverable from a Def'ed arg.
12675         https://bugs.webkit.org/show_bug.cgi?id=170973
12676         <rdar://problem/30318657>
12677
12678         Reviewed by Filip Pizlo.
12679
12680         * stress/regress-170973.js: Added.
12681
12682 2017-04-19  JF Bastien  <jfbastien@apple.com>
12683
12684         WebAssembly: limit slow memories
12685         https://bugs.webkit.org/show_bug.cgi?id=170825
12686
12687         Reviewed by Saam Barati.
12688
12689         * wasm.yaml:
12690         * wasm/stress/oom.js: Added.
12691         (try.true.WebAssemblyMemoryMode):
12692         (catch):
12693
12694 2017-04-19  JF Bastien  <jfbastien@apple.com>
12695
12696         WebAssembly: don't expose any WebAssembly JS object if JIT is off
12697         https://bugs.webkit.org/show_bug.cgi?id=170782
12698
12699         Reviewed by Saam Barati.
12700
12701         * wasm.yaml:
12702         * wasm/noJIT/noJIT.js: Added.
12703
12704 2017-04-18  Mark Lam  <mark.lam@apple.com>
12705
12706         r211670 broke double to int conversion.
12707         https://bugs.webkit.org/show_bug.cgi?id=170961
12708         <rdar://problem/31687696>
12709
12710         Reviewed by Yusuke Suzuki.
12711
12712         * microbenchmarks/double-to-int32.js: Added.
12713         * stress/to-int32-sensible2.js: Added.
12714
12715 2017-04-18  Oleksandr Skachkov  <gskachkov@gmail.com>
12716
12717         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
12718         https://bugs.webkit.org/show_bug.cgi?id=163208
12719
12720         Reviewed by Saam Barati.
12721
12722         * stress/eval-func-decl-block-scoping-reassign.js: Added.
12723         (assert):
12724         (throw.new.Error.f):
12725         (throw.new.Error):
12726         * stress/eval-func-decl-block-with-remove.js: Added.
12727         (assert):
12728         (foo.boo):
12729         (foo):
12730         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
12731         (assert):
12732         (assertThrow):
12733         (foo):
12734         (boo):
12735         (joo):
12736         (koo):
12737         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
12738         (assert):
12739         (assertThrow):
12740         (foo):
12741         (boo):
12742         (hoo):
12743         (joo):
12744         (koo):
12745         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
12746         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
12747         (assert):
12748         (assertThrow):
12749         (foo):
12750         (boo):
12751         (goo):
12752         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
12753         (assert):
12754         (assertThrow):
12755         (foo):
12756         (boo):
12757         (boo.let.val2):
12758         (boo.let.val3):
12759         * stress/eval-func-decl-in-frozen-global.js: Added.
12760         (assert):
12761         (assertThrow):
12762         (throw.new.Error):
12763         (Object.freeze):
12764         * stress/eval-func-decl-in-global-of-eval.js: Added.
12765         (assert):
12766         (assertThrow):
12767         (bar):
12768         (baz):
12769         (foobar):
12770         * stress/eval-func-decl-in-global.js: Added.
12771         (assert):
12772         (assertThrow):
12773         * stress/eval-func-decl-in-if.js: Added.
12774         (assert):
12775         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
12776         (assert):
12777         (assertThrow):
12778         (foo):
12779         (boo):
12780         (foobar):
12781         (hoo):
12782         (joo):
12783         (koo):
12784         (loo):
12785         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
12786         (assert):
12787         (assertThrow):
12788         (foo):
12789         (boo):
12790         (goo):
12791         * stress/variable-under-tdz-eval-tricky.js:
12792         (assert):
12793         * test262.yaml:
12794
12795 2017-04-18  Filip Pizlo  <fpizlo@apple.com>
12796
12797         wasm/function-tests/memory-multiagent times out sometimes
12798         https://bugs.webkit.org/show_bug.cgi?id=170958
12799
12800         Reviewed by Keith Miller.
12801
12802         Add the ability to skip tests easily. Skip the test.
12803
12804         * wasm.yaml:
12805         * wasm/function-tests/memory-multiagent.js:
12806
12807 2017-04-18  Saam Barati  <sbarati@apple.com>
12808
12809         Follow up to debug build stack overflow in test after r215453
12810
12811         Rubber stamped by Mark Lam.
12812
12813         * stress/call-apply-exponential-bytecode-size.js: Decrease the call
12814         size to prevent stack overflow errors on debug builds.
12815
12816 2017-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
12817
12818         [DFG] Convert ValueAdd(Int32, String) => MakeRope(ToString(Int32), String)
12819         https://bugs.webkit.org/show_bug.cgi?id=170943
12820
12821         Reviewed by Geoffrey Garen.
12822
12823         * microbenchmarks/number-to-string-with-add-empty.js: Added.
12824         (toStringLeft):
12825         (toStringRight):
12826         * microbenchmarks/number-to-string-with-add-in-loop.js: Added.
12827         (toStringLeft):
12828         (toStringRight):
12829         * microbenchmarks/number-to-string-with-add.js: Added.
12830         (toStringLeft):
12831         (toStringRight):
12832         * stress/number-to-string-with-add.js: Added.
12833         (shouldBe):
12834         (toStringRight):
12835         (toStringLeftEmpty):
12836         (toStringRightEmpty):
12837
12838 2017-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
12839
12840         [DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object
12841         https://bugs.webkit.org/show_bug.cgi?id=170940
12842
12843         Reviewed by Filip Pizlo.
12844
12845         * microbenchmarks/for-of-array.js: Added.
12846         (fn):
12847
12848 2017-04-17  Saam Barati  <sbarati@apple.com>
12849
12850         BytecodeGenerator ".call" and ".apply" is exponential in nesting depth
12851         https://bugs.webkit.org/show_bug.cgi?id=139847
12852         <rdar://problem/19321122>
12853
12854         Reviewed by Oliver Hunt.
12855
12856         * stress/call-apply-exponential-bytecode-size.js: Added.
12857         (assert):
12858         (const.inc):
12859         (const.inc2):
12860         (bar):
12861         (randomApplyOrCall):
12862         (baz):
12863         (jaz):
12864         (haz):
12865         (foo):
12866
12867 2017-04-17  Mark Lam  <mark.lam@apple.com>
12868
12869         JSArray::appendMemcpy() needs to handle copying from Undecided indexing type too.
12870         https://bugs.webkit.org/show_bug.cgi?id=170896
12871         <rdar://problem/31651319>
12872
12873         Reviewed by JF Bastien and Keith Miller.
12874
12875         * stress/regress-170896.js: Added.
12876
12877 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
12878
12879         test262: test262/test/built-ins/Object/prototype/toLocaleString/primitive_this_value.js
12880         https://bugs.webkit.org/show_bug.cgi?id=170882
12881
12882         Reviewed by Saam Barati.
12883
12884         * test262.yaml:
12885
12886 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
12887
12888         test262: test262/test/built-ins/isNaN/toprimitive-not-callable-throws.js
12889         https://bugs.webkit.org/show_bug.cgi?id=170888
12890
12891         Reviewed by Saam Barati.
12892
12893         * stress/computed-accessor.js:
12894         * stress/eval-in-arrow-function.js:
12895         * stress/rest-elements.js:
12896         * stress/string-object-define-own-property.js:
12897         Remove unused shouldThrow.
12898
12899         * stress/symbol-toprimitive-errors.js: Added.
12900         Check for ToPrimitive TypeErrors.
12901
12902         * test262.yaml:
12903
12904 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
12905
12906         test262: test262/test/language/expressions/tagged-template/template-object.js
12907         https://bugs.webkit.org/show_bug.cgi?id=170878
12908
12909         Reviewed by Saam Barati.
12910
12911         * stress/array-length-not-writable.js: Added.
12912         (assert):
12913         * test262.yaml:
12914
12915 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
12916
12917         test262: test262/test/built-ins/Object/getOwnPropertyNames/15.2.3.4-4-44.js
12918         https://bugs.webkit.org/show_bug.cgi?id=170879
12919
12920         Reviewed by Saam Barati.
12921
12922         * ChakraCore/test/es5/enumerable.baseline-jsc:
12923         * test262.yaml:
12924
12925 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
12926
12927         test262: test262/test/built-ins/Date/prototype/Symbol.toPrimitive/name.js
12928         https://bugs.webkit.org/show_bug.cgi?id=170884
12929
12930         Reviewed by Yusuke Suzuki.
12931
12932         * test262.yaml:
12933
12934 2017-04-15  Joseph Pecoraro  <pecoraro@apple.com>
12935
12936         test262: test262/test/language/global-code/new.target-arrow.js
12937         https://bugs.webkit.org/show_bug.cgi?id=170872
12938
12939         Reviewed by Saam Barati.
12940
12941         * stress/async-arrow-functions-lexical-new.target-binding.js:
12942         (shouldThrowAsync): Deleted.
12943         (shouldThrowAsync.async): Deleted.
12944         This code should have thrown a SyntaxError. Instead it was throwing
12945         a ReferenceError for the internal @newTargetLocal variable.
12946
12947         * stress/new-target-syntax-errors.js:
12948         Cover the arrow function in global code cases.
12949
12950         * ChakraCore.yaml:
12951         * ChakraCore/test/es6/globalLambdaNewTargetSyntaxError.baseline-jsc:
12952         We now pass with an expected SyntaxError. Our error message is different.
12953
12954         * test262.yaml:
12955
12956 2017-04-14  Saam Barati  <sbarati@apple.com>
12957
12958         ParseInt intrinsic in DFG backend doesn't properly flush its operands
12959         https://bugs.webkit.org/show_bug.cgi?id=170865
12960
12961         Reviewed by Mark Lam and Geoffrey Garen.
12962
12963         * stress/parse-int-intrinsic-dfg-backend-flush.js: Added.
12964         (assert):
12965         (foo):
12966
12967 2017-04-14  Caitlin Potter  <caitp@igalia.com>
12968
12969         [JSC] use ExpressionErrorClassifier for AwaitExpression operand
12970         https://bugs.webkit.org/show_bug.cgi?id=170844
12971
12972         Reviewed by Saam Barati.
12973
12974         * stress/regress-170732.js: Added.
12975
12976 2017-04-14  Oleksandr Skachkov  <gskachkov@gmail.com>
12977
12978         Safari 10.1 JSON.parse returns incorrect object for numeric keys with decimal values
12979         https://bugs.webkit.org/show_bug.cgi?id=170442
12980
12981         Reviewed by Yusuke Suzuki.
12982
12983         * stress/object-number-properties.js:
12984
12985 2017-04-13  Yusuke Suzuki  <utatane.tea@gmail.com>
12986
12987         [JSC] Date.parse should accept wider range of representation
12988         https://bugs.webkit.org/show_bug.cgi?id=170720
12989
12990         Reviewed by Darin Adler.
12991
12992         * stress/date-relaxed.js: Added.
12993         (shouldBe):
12994         (throw.new.Error):
12995
12996 2017-04-13  Mark Lam  <mark.lam@apple.com>
12997
12998         Should use flushDirect() when flushing the scopeRegister due to needsScopeRegister().
12999         https://bugs.webkit.org/show_bug.cgi?id=170661
13000         <rdar://problem/31579046>
13001
13002         Reviewed by Filip Pizlo.
13003
13004         * stress/regress-170661.js: Added.
13005
13006 2017-04-13  JF Bastien  <jfbastien@apple.com>
13007
13008         WebAssembly: manage memory better
13009         https://bugs.webkit.org/show_bug.cgi?id=170628
13010
13011         Reviewed by Keith Miller, Michael Saboff.
13012
13013         * wasm/Builder.js: move a helper out so tests can use it
13014         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
13015         * wasm/WASM.js: add utilities to classify opcodes
13016         (export.opcodes):
13017         (export.const.memoryAccessInfo.op.const.sign):
13018         * wasm/function-tests/memory-access-past-4gib.js: Added. This test
13019         fails before this patch.
13020         (const.op.of.WASM.opcodes):
13021         * wasm/function-tests/memory-many.js: Added. This simple tests
13022         just shouldn't crash. In verbose mode it's useful at determining
13023         if the GC falls behind or not.
13024         * wasm/function-tests/memory-multiagent.js: Added. Emulate postMessage.
13025         (const.startAgents.numAgentsToStart.a.agent.receiveBroadcast):
13026         (const.startAgents.numAgentsToStart.a.write.const.idx.Math.random):
13027         (const.broadcastToAgents):
13028         * wasm/js-api/extension-MemoryMode.js: verbose logging.
13029         (testMemoryNoMax):
13030         (testMemory):
13031         (testInstanceNoMemory):
13032         (testInstanceNoMax):
13033         (testInstance):
13034         * wasm/utilities.js: move a utility here.
13035
13036 2017-04-12  Joseph Pecoraro  <pecoraro@apple.com>
13037
13038         test262: test262/test/built-ins/NativeErrors/EvalError/proto.js
13039         https://bugs.webkit.org/show_bug.cgi?id=170668
13040
13041         Reviewed by Keith Miller.
13042
13043         * ChakraCore.yaml:
13044         * ChakraCore/test/Lib/error.baseline-jsc: Added.
13045         This test does not match the spec.
13046
13047         * test262.yaml:
13048
13049 2017-04-12  Joseph Pecoraro  <pecoraro@apple.com>
13050
13051         test262: test262/test/language/literals/regexp/u-dec-esc.js
13052         https://bugs.webkit.org/show_bug.cgi?id=170687
13053
13054         Reviewed by Michael Saboff.
13055
13056         * test262.yaml:
13057
13058 2017-04-11  Michael Saboff  <msaboff@apple.com>
13059
13060         Implement Object.isFrozen() and Object.isSealed() per ECMA spec
13061         https://bugs.webkit.org/show_bug.cgi?id=170753
13062
13063         Reviewed by Mark Lam.
13064
13065         Added JSC baseline and enabled defineIndexProperty test.
13066
13067         Note that JSC differs from Chakra in that a JSC doesn't use indexed
13068         properties placed on the Array prototype when sorting the indexed
13069         properties of an Object.  This is behavior is considered undefined
13070         in the standard.
13071
13072         * ChakraCore.yaml:
13073         * ChakraCore/test/es5/defineIndexProperty.baseline-jsc: Added.
13074
13075 2017-04-11  Joseph Pecoraro  <pecoraro@apple.com>
13076
13077         test262: test262/test/annexB/language/comments/multi-line-html-close.js
13078         https://bugs.webkit.org/show_bug.cgi?id=170648
13079
13080         Reviewed by Keith Miller.
13081
13082         * test262.yaml:
13083
13084 2017-04-11  Joseph Pecoraro  <pecoraro@apple.com>
13085
13086         test262: test262/test/built-ins/Array/S15.4.3_A2.2.js
13087         https://bugs.webkit.org/show_bug.cgi?id=170652
13088
13089         Reviewed by Michael Saboff.
13090
13091         * stress/native-constructors-length.js: Added.
13092         (assertLengthDescriptorAttributes):
13093         Add a quick test for the length properties of all native constructors.
13094
13095         * ChakraCore/test/es5/enumerable.baseline-jsc:
13096         Rebaseline expectations for this test.
13097
13098         * test262.yaml:
13099
13100 2017-04-10  Keith Miller  <keith_miller@apple.com>
13101
13102         WebAssembly: Update spec tests
13103         https://bugs.webkit.org/show_bug.cgi?id=170683
13104
13105         Rubber-stamped by JF Bastien.
13106
13107         * wasm.yaml:
13108         * wasm/spec-tests/br_table.wast.js:
13109         * wasm/spec-tests/conversions.wast.js: Removed.
13110         * wasm/spec-tests/f32_bitwise.wast.js: Added.
13111         * wasm/spec-tests/f32_cmp.wast.js:
13112         * wasm/spec-tests/f64_bitwise.wast.js: Added.
13113         * wasm/spec-tests/f64_cmp.wast.js:
13114         * wasm/spec-tests/i32.wast.js:
13115         * wasm/spec-tests/i64.wast.js:
13116         * wasm/spec-tests/int_exprs.wast.js:
13117         * wasm/spec-tests/memory.wast.js:
13118
13119 2017-04-09  Joseph Pecoraro  <pecoraro@apple.com>
13120
13121         test262: test262/test/annexB/language/expressions/object/__proto__-fn-name.js
13122         https://bugs.webkit.org/show_bug.cgi?id=170650
13123
13124         Reviewed by Saam Barati.
13125
13126         * stress/inferred-names.js:
13127         * test262.yaml:
13128
13129 2017-04-09  Joseph Pecoraro  <pecoraro@apple.com>
13130
13131         test262: test262/test/annexB/language/literals/regexp/identity-escape.js
13132         https://bugs.webkit.org/show_bug.cgi?id=170651
13133
13134         Reviewed by Saam Barati.
13135
13136         * test262.yaml:
13137
13138 2017-04-07  Michael Saboff  <msaboff@apple.com>
13139
13140         Fix and enable ChakraCore/test/es6/ES6Function_bugs.js after r215072
13141         https://bugs.webkit.org/show_bug.cgi?id=170580
13142
13143         Reviewed by JF Bastien.
13144
13145         Commented out subtest that expects defineProperty("length") to a getter on a
13146         sealed function shouldn't throw.
13147
13148         * ChakraCore.yaml:
13149         * ChakraCore/test/es6/ES6Function_bugs.js:
13150
13151 2017-04-06  Michael Saboff  <msaboff@apple.com>
13152
13153         Cannot Object.seal() or Object.freeze() global "this"
13154         https://bugs.webkit.org/show_bug.cgi?id=170549
13155
13156         Reviewed by Mark Lam.
13157
13158         Enabled failing tests fixed by the corresponding code change:
13159             ChakraCore/test/LetConst/delete.js
13160             ChakraCore/test/LetConst/dop.js
13161             ChakraCore/test/LetConst/dop1.js
13162
13163         * ChakraCore.yaml:
13164         * ChakraCore/test/LetConst/dop.baseline-jsc: Added JSC specific expected output.
13165         * ChakraCore/test/LetConst/dop1.baseline-jsc: Added JSC specific expected output.
13166
13167 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
13168
13169         test262: ES2017 test progressions need updated expectations (arguments.caller removed)
13170         https://bugs.webkit.org/show_bug.cgi?id=170536
13171
13172         Reviewed by Mark Lam.
13173
13174         * test262.yaml:
13175         After r208867 the tests are out of date and are now expected to fail.
13176
13177 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
13178
13179         test262: Final rebaseline of existing tests, a few tests have started failing
13180         https://bugs.webkit.org/show_bug.cgi?id=170538
13181
13182         Reviewed by Mark Lam.
13183
13184         * test262.yaml:
13185         These tests started failing a while ago. Mark them as legitmate failures.
13186
13187 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
13188
13189         test262: Rebaseline expectations for now passing tests
13190         https://bugs.webkit.org/show_bug.cgi?id=170532
13191
13192         Reviewed by Ryosuke Niwa.
13193
13194         * test262.yaml:
13195         Update expectations for tests we are now passing.
13196
13197 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
13198
13199         test262: module test progressions need updated expectations (@@iterator changes)
13200         https://bugs.webkit.org/show_bug.cgi?id=170535
13201
13202         Reviewed by Saam Barati.
13203
13204         * test262.yaml:
13205         After r212430 the tests are out of date and are now expected to fail.
13206
13207 2017-04-05  Michael Saboff  <msaboff@apple.com>
13208
13209         Unreviewed rollout of r214642 as the test still intermittently fails.
13210
13211         Disabled ChakraCore/test/fieldopts/objtypespec-newobj-invalidation.1.js.
13212
13213         * ChakraCore.yaml:
13214
13215 2017-04-05  Michael Saboff  <msaboff@apple.com>
13216
13217         REGRESSION (Safari 10.1): Inserting elements into arrays fails when array contains very large numbers
13218         https://bugs.webkit.org/show_bug.cgi?id=170264
13219         <rdar://problem/31375593>
13220
13221         Rubber-stamped by Saam Barati.
13222
13223         The original bug was fixed in: https://trac.webkit.org/changeset/214714
13224         I'm just adding another test for good measure.
13225
13226         * stress/double-array-to-array-storage.js: Added.
13227         (assert):
13228
13229 2017-04-05  Keith Miller  <keith_miller@apple.com>
13230
13231         WebAssembly: We shouldn't need to pin size registers if we have a fast memory.
13232         https://bugs.webkit.org/show_bug.cgi?id=170504
13233
13234         Reviewed by Mark Lam.
13235
13236         * wasm/function-tests/trap-after-cross-instance-call.js: Added.
13237         (b.new.WebAssembly.Memory):
13238         (importObject.foo.bar):
13239         (wasmFrameCountFromError):
13240
13241 2017-03-16  Yusuke Suzuki  <utatane.tea@gmail.com>
13242
13243         [JSC] Generate TemplateObjects at linking time
13244         https://bugs.webkit.org/show_bug.cgi?id=169743
13245
13246         Reviewed by Keith Miller.
13247
13248         * stress/template-string-tags-eval.js: Added.
13249         (shouldBe):
13250         (tag):
13251
13252 2017-04-04  Mark Lam  <mark.lam@apple.com>
13253
13254         On ARM64, DFG::SpeculativeJIT::compileArithMod() failed to ensure result is of DataFormatInt32.
13255         https://bugs.webkit.org/show_bug.cgi?id=170473
13256         <rdar://problem/29912391>
13257
13258         Reviewed by Saam Barati.
13259
13260         * stress/regress-170473.js: Added.
13261
13262 2017-04-03  Mark Lam  <mark.lam@apple.com>
13263
13264         Fix incorrect capacity delta calculation reported in SparseArrayValueMap::add().
13265         https://bugs.webkit.org/show_bug.cgi?id=170412
13266         <rdar://problem/29697336>
13267
13268         Reviewed by Filip Pizlo.
13269
13270         * stress/regress-170412.js: Added.
13271
13272 2017-04-03  Keith Miller  <keith_miller@apple.com>
13273
13274         WebAssembly: Update spec tests
13275         https://bugs.webkit.org/show_bug.cgi?id=170361
13276
13277         Rubber-stamped by Saam Barati.
13278
13279         Update the spec tests to run tests generated by the newer spec
13280         test builder wasm-spec/test/builder.py. This patch also adds the
13281         necessary harness code in spec-harness.js so we can run the tests.
13282
13283         * wasm.yaml:
13284         * wasm/import-spec-tests.rb:
13285         * wasm/spec-harness.js: Added.
13286         (import.string_appeared_here.then):
13287         (test):
13288         (promise_test):
13289         (let.assert_unreached):
13290         * wasm/spec-harness/index.js: Added.
13291         (let.testNum):
13292         (assertThrows):
13293         (_assert):
13294         (ValueResult):
13295         (ErrorResult):
13296         (Result.prototype.isError):
13297         (binary):
13298         (module):
13299         (uniqueTest):
13300         (assert_invalid):
13301         (assert_soft_invalid):
13302         (register):
13303         (call):
13304         (get instance):
13305         (exports):
13306         (run):
13307         (assert_unlinkable):
13308         (assert_uninstantiable):
13309         (assert_trap):
13310         (try.f):
13311         (catch):
13312         (assert_exhaustion):
13313         (assert_return):
13314         (assert_return_nan):
13315         * wasm/spec-harness/testharness.css: Added.
13316         (html):
13317         (#log .warning,):
13318         (#log .error,):
13319         (section#summary):
13320         (table#results):
13321         (table#results th:first-child,):
13322         (table#results th:last-child,):
13323         (table#results.assertions th:last-child,):
13324         (table#results th):
13325         (table#results td):
13326         (tr.pass > td:first-child):
13327         (tr.fail > td:first-child):
13328         (tr.timeout > td:first-child):
13329         (tr.notrun > td:first-child):
13330         (.pass > td:first-child, .fail > td:first-child, .timeout > td:first-child, .notrun > td:first-child):
13331         (table#results span):
13332         (table#results span.expected):
13333         (table#results span.actual):
13334         (span.ok):
13335         (tr.error):
13336         (span.timeout):
13337         (span.ok, span.timeout, span.error):
13338         * wasm/spec-harness/testharness.js: Added.
13339         (WindowTestEnvironment):
13340         (WindowTestEnvironment.prototype._dispatch):
13341         (WindowTestEnvironment.prototype._forEach_windows):
13342         (WindowTestEnvironment.prototype.on_tests_ready):
13343         (WindowTestEnvironment.prototype.setup_messages):
13344         (WindowTestEnvironment.prototype.next_default_test_name):
13345         (WindowTestEnvironment.prototype.on_new_harness_properties):
13346         (WindowTestEnvironment.prototype.add_on_loaded_callback):
13347         (WindowTestEnvironment.prototype.test_timeout):
13348         (WindowTestEnvironment.prototype.global_scope):
13349         (WorkerTestEnvironment):
13350         (WorkerTestEnvironment.prototype._dispatch):
13351         (WorkerTestEnvironment.prototype._add_message_port):
13352         (WorkerTestEnvironment.prototype.next_default_test_name):
13353         (WorkerTestEnvironment.prototype.on_new_harness_properties):
13354         (WorkerTestEnvironment.prototype.on_tests_ready):
13355         (WorkerTestEnvironment.prototype.add_on_loaded_callback):
13356         (WorkerTestEnvironment.prototype.test_timeout):
13357         (WorkerTestEnvironment.prototype.global_scope):
13358         (DedicatedWorkerTestEnvironment):
13359         (DedicatedWorkerTestEnvironment.prototype.on_tests_ready):
13360         (SharedWorkerTestEnvironment):
13361         (SharedWorkerTestEnvironment.prototype.on_tests_ready):
13362         (ServiceWorkerTestEnvironment):
13363         (ServiceWorkerTestEnvironment.prototype.add_on_loaded_callback):
13364         (create_test_environment):
13365         (is_shared_worker):
13366         (is_service_worker):
13367         (test):
13368         (async_test):
13369         (promise_test):
13370         (this.wait_for):
13371         (EventWatcher):
13372         (setup):
13373         (done):
13374         (generate_tests):
13375         (step_timeout):
13376         (truncate):
13377         (is_node):
13378         (format_value):
13379         * wasm/spec-harness/testharnessreport.js: Added.
13380         * wasm/spec-harness/wasm-constants.js: Added.
13381         (bytes):
13382         (bytesWithHeader):
13383         (makeSig):
13384         (makeSig_v_x):
13385         (makeSig_v_xx):
13386         (makeSig_r_v):
13387         (makeSig_r_x):
13388         (makeSig_r_xx):
13389         (assertTraps):
13390         (assertWasmThrows):
13391         * wasm/spec-harness/wasm-module-builder.js: Added.
13392         (Binary.prototype.emit_u8):
13393         (Binary.prototype.emit_u16):
13394         (Binary.prototype.emit_u32):
13395         (Binary.prototype.emit_u32v):
13396         (Binary.prototype.emit_bytes):
13397         (Binary.prototype.emit_string):
13398         (Binary.prototype.emit_header):
13399         (Binary.prototype.emit_section):
13400         (Binary):
13401         (WasmFunctionBuilder):
13402         (WasmFunctionBuilder.prototype.exportAs):
13403         (WasmFunctionBuilder.prototype.exportFunc):
13404         (WasmFunctionBuilder.prototype.addBody):
13405         (WasmFunctionBuilder.prototype.addLocals):
13406         (WasmFunctionBuilder.prototype.end):
13407         (WasmGlobalBuilder):
13408         (WasmGlobalBuilder.prototype.exportAs):
13409         (WasmModuleBuilder):
13410         (WasmModuleBuilder.prototype.addStart):
13411         (WasmModuleBuilder.prototype.addMemory):
13412         (WasmModuleBuilder.prototype.addExplicitSection):
13413         (WasmModuleBuilder.prototype.addType):
13414         (WasmModuleBuilder.prototype.addGlobal):
13415         (WasmModuleBuilder.prototype.addFunction):
13416         (WasmModuleBuilder.prototype.addImport):
13417         (WasmModuleBuilder.prototype.addImportedGlobal):
13418         (WasmModuleBuilder.prototype.addImportedMemory):
13419         (WasmModuleBuilder.prototype.addImportedTable):
13420         (WasmModuleBuilder.prototype.addExport):
13421         (WasmModuleBuilder.prototype.addExportOfKind):
13422         (WasmModuleBuilder.prototype.addDataSegment):
13423         (WasmModuleBuilder.prototype.exportMemoryAs):
13424         (WasmModuleBuilder.prototype.addFunctionTableInit):
13425         (WasmModuleBuilder.prototype.appendToTable):
13426         (WasmModuleBuilder.prototype.setFunctionTableLength):
13427         (WasmModuleBuilder.prototype.toArray):
13428         (WasmModuleBuilder.prototype.toBuffer):
13429         (WasmModuleBuilder.prototype.instantiate):
13430         * wasm/spec-harness/wast.js: Added.
13431         (normalize):
13432         (require.else._registry.name):
13433         (require):
13434         (add_hex_char):
13435         (add_char):
13436         (string_with):
13437         (list_of_opt):
13438         (break_bytes.f):
13439         (break_bytes):
13440         (f):
13441         (decls):
13442         (func_type):
13443         (limits):
13444         (global_type):
13445         (testop):
13446         (relop):
13447         (unop):
13448         (binop):
13449         (cvtop):
13450         (oper):
13451         (mem_size):
13452         (extension):
13453         (memop):
13454         (storeop):
13455         (var):
13456         (constop):
13457         (instr.else.switch.case.0.f):
13458         (instr.else.switch.case.1.f.1):
13459         (instr.else.switch.case.2.f.2):
13460         (instr):
13461         (func_with_name):
13462         (func):
13463         (start):
13464         (table):
13465         (memory):
13466         (segment):
13467         (elems):
13468         (data):
13469         (typedef):
13470         (import_kind):
13471         (import):
13472         (export_kind):
13473         (export):
13474         (var_opt):
13475         (is_func_import):
13476         (is_table_import):
13477         (is_memory_import):
13478         (is_global_import):
13479         (f.1):
13480         (f.2):
13481         (f.3):
13482         (module_with_var_opt):
13483         (module_):
13484         (literal):
13485         (definition):
13486         (access):
13487         (action):
13488         (script):
13489         (_registry.string_appeared_here):
13490         (init):
13491         (make_matrix):
13492         (copy):
13493         (append):
13494         (sub):
13495         (fill):
13496         (blit):
13497         (iter):
13498         (map):
13499         (iteri):
13500         (mapi):
13501         (to_list):
13502         (list_length):
13503         (of_list):
13504         (fold_left):
13505         (fold_right):
13506         (maxson):
13507         (trickle):
13508         (bubble):
13509         (trickleup):
13510         (sort):
13511         (merge):
13512         (isortto):
13513         (sortto):
13514         (stable_sort):
13515         (import_type):
13516         (export_type):
13517         (dims.n):
13518         (dims.d.i):
13519         (dims):
13520         (map_file):
13521         (create):
13522         (of_array):
13523         (slice_left):
13524         (slice_right):
13525         (slice_left_1):
13526         (slice_right_1):
13527         (slice_left_2):
13528         (slice_right_2):
13529         (array1_of_genarray):
13530         (array2_of_genarray):
13531         (array3_of_genarray):
13532         (reshape_1):
13533         (reshape_2):
13534         (reshape_3):
13535         (reshape):
13536         (__):
13537         (contents):
13538         (to_bytes):
13539         (nth):
13540         (length):
13541         (clear):
13542         (reset):
13543         (resize):
13544         (add_substring):
13545         (add_subbytes):
13546         (add_string):
13547         (add_bytes):
13548         (add_buffer):
13549         (add_channel):
13550         (output_buffer):
13551         (closing):
13552         (advance_to_closing):
13553         (advance_to_non_alpha):
13554         (find_ident):
13555         (add_substitute):
13556         (make):
13557         (to_string):
13558         (of_string):
13559         (sub_string):
13560         (extend):
13561         (blit_string):
13562         (concat):
13563         (cat):
13564         (is_space):
13565         (trim):
13566         (escaped):
13567         (uppercase):
13568         (lowercase):
13569         (apply1):
13570         (capitalize):
13571         (uncapitalize):
13572         (index_rec):
13573         (index):
13574         (index_from):
13575         (rindex_rec):
13576         (rindex):
13577         (rindex_from):
13578         (contains_from):
13579         (contains):
13580         (rcontains_from):
13581         (caml_array_sub):
13582         (len):
13583         (caml_array_concat):
13584         (caml_make_vect):
13585         (caml_array_blit):
13586         (get if):
13587         (caml_set_oo_id):
13588         (get_id):
13589         (caml_int32_float_of_bits):
13590         (caml_int32_bits_of_float):
13591         (caml_classify_float):
13592         (caml_modf_float):
13593         (caml_ldexp_float):
13594         (caml_frexp_float):
13595         (caml_copysign_float):
13596         (caml_expm1_float):
13597         (caml_hypot_float):
13598         (caml_log10_float):
13599         (caml_failwith):
13600         (parse_digit):
13601         (int_of_string_base):
13602         (parse_sign_and_base):
13603         (caml_int_of_string.aux):
13604         (caml_int_of_string):
13605         (caml_int64_of_string.aux):
13606         (caml_int64_of_string):
13607         (int_of_base):
13608         (parse_format):
13609         (finish_formatting):
13610         (caml_format_int):
13611         (caml_int64_format):
13612         (caml_format_float):
13613         (float_of_string):
13614         (div):
13615         (mod_):
13616         (caml_bswap16):
13617         (caml_int32_bswap):
13618         (imul):
13619         (neg_signed):
13620         (not):
13621         (eq):
13622         (neg):
13623         (lsl_):
13624         (lsr_):
13625         (asr_):
13626         (is_zero):
13627         (mul):
13628         (swap):
13629         (xor):
13630         (or_):
13631         (and_):
13632         (ge):
13633         (lt):
13634         (gt):
13635         (le):
13636         (to_float):
13637         (of_float):
13638         (div_mod):
13639         (compare):
13640         (of_int32):
13641         (to_int32):
13642         (to_hex.aux):
13643         (to_hex):
13644         (discard_sign):
13645         (float_of_bits):
13646         (bits_of_float.to_nat):
13647         (bits_of_float):
13648         (get64):
13649         (erase_rel):
13650         (concat_fmtty):
13651         (concat_fmt):
13652         (create_char_set):
13653         (add_in_char_set):
13654         (rev_char_set):
13655         (is_in_char_set):
13656         (prec_of_prec_opt):
13657         (param_format_of_ignored_format):
13658         (buffer_check_size):
13659         (buffer_add_char):
13660         (buffer_add_string):
13661         (buffer_contents):
13662         (char_of_iconv):
13663         (char_of_fconv):
13664         (char_of_counter):
13665         (print_char):
13666         (set while.set var):
13667         (set while.set else):
13668         (set var):
13669         (set else):
13670         (set print_char):
13671         (set if):
13672         (bprint_padty):
13673         (bprint_ignored_flag):
13674         (bprint_pad_opt):
13675         (bprint_padding):
13676         (bprint_precision):
13677         (bprint_iconv_flag):
13678         (bprint_int_fmt):
13679         (bprint_altint_fmt):
13680         (bprint_fconv_flag):
13681         (bprint_float_fmt):
13682         (string_of_formatting_lit):
13683         (string_of_formatting_gen):
13684         (bprint_char_literal):
13685         (bprint_string_literal):
13686         (bprint_fmtty):
13687         (int_of_custom_arity):
13688         (bprint_fmt):
13689         (string_of_fmt):
13690         (symm):
13691         (fmtty_rel_det):
13692         (trans):
13693         (fmtty_of_formatting_gen):
13694         (fmtty_of_fmt):
13695         (fmtty_of_custom):
13696         (fmtty_of_padding_fmtty):
13697         (fmtty_of_precision_fmtty):
13698         (type_padding):
13699         (type_padprec):
13700         (type_ignored_param_one):
13701         (type_format_gen):
13702         (type_ignored_format_substitution):
13703         (type_format):
13704         (recast):
13705         (fix_padding):
13706         (fix_int_precision):
13707         (string_to_caml_string):
13708         (format_of_iconv):
13709         (format_of_aconv):
13710         (format_of_fconv):
13711         (convert_int):
13712         (convert_int32):
13713         (convert_nativeint):
13714         (convert_int64):
13715         (else.is_valid):
13716         (convert_float):
13717         (format_caml_char):
13718         (string_of_fmtty):
13719         (else.switch.):
13720         (else.switch.k.prime):
13721         (else.switch.else.):
13722         (else.switch.else.k.prime.1):
13723         (make_printf):
13724         (make_from_fmtty):
13725         (make_invalid_arg):
13726         (make_string_padding):
13727         (make_int_padding_precision):
13728         (make_custom):
13729         (output_acc):
13730         (bufput_acc):
13731         (strput_acc):
13732         (failwith_message.k):
13733         (failwith_message):
13734         (open_box_of_string.else.invalid_box):
13735         (open_box_of_string.else.parse_spaces):
13736         (open_box_of_string.else.parse_lword):
13737         (open_box_of_string.else.parse_int):
13738         (open_box_of_string):
13739         (make_padding_fmt_ebb):
13740         (make_precision_fmt_ebb):
13741         (make_padprec_fmt_ebb):
13742         (invalid_format_message):
13743         (invalid_format_without):
13744         (expected_character):
13745         (compute_int_conv):
13746         (incompatible_flag):
13747         (parse_positive):
13748         (parse_conv):
13749         (parse_after_precision):
13750         (else.parse_literal):
13751         (parse_after_padding):
13752         (parse_literal):
13753         (parse_after_at):
13754         (add_literal):
13755         (parse_spaces):
13756         (parse_integer):
13757         (compute_float_conv):
13758         (search_subformat_end):
13759         (check_no_0):
13760         (opt_of_pad):
13761         (get_prec_opt):
13762         (else.switch.case.99.char_format):
13763         (else.switch.scan_format):
13764         (parse_conversion):
13765         (set_flag):
13766         (parse_flags):
13767         (is_int_base):
13768         (counter_of_char):
13769         (add_range):
13770         (fail_single_percent):
13771         (parse_char_set_after_char):
13772         (parse_char_set_content):
13773         (parse_char_set_start):
13774         (parse_char_set):
13775         (check_open_box):
13776         (parse_tag):
13777         (fmt_ebb_of_string):
13778         (format_of_string_fmtty):
13779         (format_of_string_format):
13780         (caret):
13781         (caml_ml_open_descriptor_in):
13782         (caml_ml_open_descriptor_out):
13783         (caml_ml_flush):
13784         (node_std_output):
13785         (caml_ml_output_char):
13786         (caml_ml_input):
13787         (caml_ml_input_char):
13788         (caml_ml_out_channels_list):
13789         (fail):
13790         (caml_lex_array):
13791         (caml_lex_engine):
13792         (caml_lex_run_mem):
13793         (caml_lex_run_tag):
13794         (caml_new_lex_engine):
13795         (caml_obj_dup):
13796         (caml_obj_truncate):
13797         (caml_lazy_make_forward):
13798         (caml_update_dummy):
13799         (caml_int_compare):
13800         (caml_compare):
13801         (caml_equal):
13802         (caml_notequal):
13803         (caml_greaterequal):
13804         (caml_lessequal):
13805         (else.aux):
13806         (caml_get_public_method):
13807         (caml_parse_engine):
13808         (caml_set_parser_trace):
13809         (js_string_of_char):
13810         (caml_string_get):
13811         (caml_create_string):
13812         (caml_string_compare):
13813         (caml_fill_string):
13814         (caml_blit_string):
13815         (caml_blit_bytes):
13816         (bytes_of_string):
13817         (bytes_to_string):
13818         (caml_string_of_char_array):
13819         (caml_is_printable):
13820         (caml_string_get16):
13821         (caml_string_get32):
13822         (repeat):
13823         (chr):
13824         (app):
13825         (js):
13826         (curry_1):
13827         (_1):
13828         (js1):
13829         (__1):
13830         (curry_2):
13831         (_2):
13832         (js2):
13833         (__2):
13834         (curry_3):
13835         (_3):
13836         (js3):
13837         (__3):
13838         (curry_4):
13839         (_4):
13840         (js4):
13841         (__4):
13842         (curry_5):
13843         (_5):
13844         (js5):
13845         (__5):
13846         (curry_6):
13847         (_6):
13848         (js6):
13849         (__6):
13850         (curry_7):
13851         (_7):
13852         (js7):
13853         (__7):
13854         (curry_8):
13855         (_8):
13856         (js8):
13857         (__8):
13858         (stream):
13859         (eos):
13860         (skip):
13861         (read):
13862         (peek):
13863         (string_of_byte):
13864         (position):
13865         (region):
13866         (error):
13867         (guard):
13868         (get 1):
13869         (get expect):
13870         (get illegal):
13871         (at):
13872         (u32):
13873         (u64):
13874         (get require):
13875         (vuN):
13876         (get var):
13877         (vsN):
13878         (vu32):
13879         (vs32):
13880         (vs64):
13881         (f32):
13882         (f64):
13883         (len32):
13884         (string):
13885         (opt):
13886         (vec):
13887         (sized):
13888         (value_type):
13889         (elem_type):
13890         (stack_type):
13891         (table_type):
13892         (memory_type):
13893         (mutability.get if):
13894         (mutability):
13895         (instr.get if):
13896         (instr_block):
13897         (const):
13898         (id):
13899         (section):
13900         (type_section):
13901         (import_kind.get if):
13902         (import_section):
13903         (func_section):
13904         (table_section):
13905         (memory_section):
13906         (global):
13907         (global_section):
13908         (export_kind.get if):
13909         (export_section):
13910         (start_section):
13911         (local):
13912         (code):
13913         (code_section):
13914         (table_segment):
13915         (elem_section):
13916         (memory_segment):
13917         (data_section):
13918         (partial_arg.1):
13919         (custom):
13920         (custom_section):
13921         (iterate):
13922         (decode):
13923         (patch):
13924         (encode.u8):
13925         (encode.u16):
13926         (encode.u32):
13927         (encode.vu64):
13928         (encode.vs64):
13929         (encode.vu32):
13930         (encode.len):
13931         (encode.bool):
13932         (encode.string):
13933         (encode.vec):
13934         (encode.gap32):
13935         (encode.patch_gap32):
13936         (encode.value_type):
13937         (encode.stack_type):
13938         (encode.func_type):
13939         (encode.limits):
13940         (encode.table_type):
13941         (encode.memory_type):
13942         (encode.global_type):
13943         (encode.memop):
13944         (encode):
13945         (encode.instr):
13946         (encode.const):
13947         (encode.section):
13948         (encode.type_section):
13949         (encode.import):
13950         (encode.import_section):
13951         (encode.func):
13952         (encode.func_section):
13953         (encode.table):
13954         (encode.table_section):
13955         (encode.memory):
13956         (encode.memory_section):
13957         (encode.global):
13958         (encode.global_section):
13959         (encode.export_kind):
13960         (encode.export):
13961         (encode.export_section):
13962         (encode.start_section):
13963         (encode.combine):
13964         (encode.compress):
13965         (encode.local):
13966         (encode.code):
13967         (encode.code_section):
13968         (encode.segment):
13969         (encode.table_segment):
13970         (encode.elem_section):
13971         (encode.memory_segment):
13972         (encode.module_):
13973         (Make.warn):
13974         (Make.error):
13975         (Make):
13976         (print_nan_significand_digits):
13977         (Make.of_bits):
13978         (Make.to_bits):
13979         (Make.is_nan):
13980         (Make.canonicalize_nan):
13981         (Make.determine_binary_nan):
13982         (Make.determine_unary_nan):
13983         (Make.binary):
13984         (Make.unary):
13985         (Make.add):
13986         (Make.sub):
13987         (Make.mul):
13988         (Make.div):
13989         (Make.sqrt):
13990         (Make.ceil):
13991         (Make.floor):
13992         (Make.trunc):
13993         (Make.nearest):
13994         (Make.min):
13995         (Make.max):
13996         (Make.abs):
13997         (Make.neg):
13998         (Make.copysign):
13999         (Make.eq):
14000         (Make.ne):
14001         (Make.lt):
14002         (Make.gt):
14003         (Make.le):
14004         (Make.ge):
14005         (Make.of_signless_string):
14006         (Make.of_string):
14007         (Make.to_string):
14008         (add_queue):
14009         (peek_queue):
14010         (take_queue):
14011         (pp_enqueue):
14012         (pp_clear_queue):
14013         (pp_output_string):
14014         (break_new_line):
14015         (break_same_line):
14016         (pp_force_break_line):
14017         (switch.add_tab):
14018         (else.switch.find):
14019         (format_pp_token):
14020         (advance_left):
14021         (enqueue_advance):
14022         (enqueue_string_as):
14023         (set_size):
14024         (scan_push):
14025         (pp_open_box_gen):
14026         (pp_close_box):
14027         (pp_open_tag):
14028         (pp_close_tag):
14029         (pp_set_print_tags):
14030         (pp_set_mark_tags):
14031         (pp_get_print_tags):
14032         (pp_get_mark_tags):
14033         (pp_set_tags):
14034         (pp_get_formatter_tag_functions):
14035         (pp_set_formatter_tag_functions):
14036         (pp_rinit):
14037         (pp_flush_queue):
14038         (pp_print_as_size):
14039         (pp_print_string):
14040         (pp_print_int):
14041         (pp_print_float):
14042         (pp_print_bool):
14043         (pp_open_hbox):
14044         (pp_open_vbox):
14045         (pp_open_hvbox):
14046         (pp_open_hovbox):
14047         (pp_open_box):
14048         (pp_print_newline):
14049         (pp_print_flush):
14050         (pp_force_newline):
14051         (pp_print_if_newline):
14052         (pp_print_break):
14053         (pp_print_space):
14054         (pp_print_cut):
14055         (pp_open_tbox):
14056         (pp_close_tbox):
14057         (pp_print_tbreak):
14058         (pp_print_tab):
14059         (pp_set_tab):
14060         (pp_print_list):
14061         (flush):
14062         (pp_print_text):
14063         (pp_set_max_boxes):
14064         (pp_get_max_boxes):
14065         (pp_over_max_boxes):
14066         (pp_get_ellipsis_text):
14067         (pp_limit):
14068         (pp_set_max_indent):
14069         (pp_get_max_indent):
14070         (pp_set_margin):
14071         (pp_get_margin):
14072         (pp_set_formatter_out_functions):
14073         (pp_get_formatter_out_functions):
14074         (pp_set_formatter_output_functions):
14075         (pp_get_formatter_output_functions):
14076         (pp_set_all_formatter_output_functions):
14077         (pp_get_all_formatter_output_functions):
14078         (display_newline):
14079         (display_blanks):
14080         (state.16):
14081         (state.17):
14082         (state.18):
14083         (state.19):
14084         (pp_set_formatter_out_channel):
14085         (default_pp_mark_open_tag):
14086         (default_pp_mark_close_tag):
14087         (default_pp_print_open_tag):
14088         (default_pp_print_close_tag):
14089         (pp_make_formatter):
14090         (ppf.18):
14091         (ppf.19):
14092         (make_formatter):
14093         (formatter_of_out_channel):
14094         (formatter_of_buffer):
14095         (flush_str_formatter):
14096         (flush_buf_formatter):
14097         (open_hbox):
14098         (open_vbox):
14099         (open_hvbox):
14100         (open_hovbox):
14101         (open_box):
14102         (close_box):
14103         (open_tag):
14104         (close_tag):
14105         (print_as):
14106         (print_string):
14107         (print_int):
14108         (print_float):
14109         (print_bool):
14110         (print_cut):
14111         (print_space):
14112         (force_newline):
14113         (print_flush):
14114         (print_newline):
14115         (print_if_newline):
14116         (open_tbox):
14117         (close_tbox):
14118         (print_tbreak):
14119         (set_tab):
14120         (print_tab):
14121         (set_margin):
14122         (get_margin):
14123         (set_max_indent):
14124         (get_max_indent):
14125         (set_max_boxes):
14126         (get_max_boxes):
14127         (over_max_boxes):
14128         (set_ellipsis_text):
14129         (get_ellipsis_text):
14130         (set_formatter_out_channel):
14131         (set_formatter_out_functions):
14132         (get_formatter_out_functions):
14133         (set_formatter_output_functions):
14134         (get_formatter_output_functions):
14135         (set_all_formatter_output_functions):
14136         (get_all_formatter_output_functions):
14137         (set_formatter_tag_functions):
14138         (get_formatter_tag_functions):
14139         (set_print_tags):
14140         (get_print_tags):
14141         (set_mark_tags):
14142         (get_mark_tags):
14143         (set_tags):
14144         (compute_tag):
14145         (output_formatting_lit):
14146         (kfprintf):
14147         (ikfprintf):
14148         (fprintf):
14149         (ifprintf):
14150         (printf):
14151         (eprintf):
14152         (k.prime):
14153         (ksprintf):
14154         (sprintf):
14155         (asprintf.k.prime):
14156         (asprintf):
14157         (k):
14158         (bprintf):
14159         (succ):
14160         (pred):
14161         (abs):
14162         (lognot):
14163         (Make.cmp_u):
14164         (Make.divrem_u):
14165         (Make.div_s):
14166         (Make.div_u):
14167         (Make.rem_s):
14168         (Make.rem_u):
14169         (Make.shift):
14170         (Make.shl):
14171         (Make.shr_s):
14172         (Make.shr_u):
14173         (Make.clamp_rotate_count):
14174         (Make.rotl):
14175         (Make.rotr):
14176         (Make.loop):
14177         (Make.clz):
14178         (Make.ctz):
14179         (Make.popcnt):
14180         (Make.eqz):
14181         (Make.lt_u):
14182         (Make.le_u):
14183         (Make.gt_u):
14184         (Make.ge_u):
14185         (Make.of_int_u):
14186         (Make.to_string_u):
14187         (Make.require):
14188         (Make.dec_digit):
14189         (Make.hex_digit):
14190         (Make.parse_int):
14191         (Make.of_string_s):
14192         (Make.of_string_u):
14193         (convert_pos):
14194         (error_nest):
14195         (text):
14196         (intop):
14197         (floatop):
14198         (numop):
14199         (memsz):
14200         (ext):
14201         (token.else.switch):
14202         (token.else.switch.):
14203         (token):
14204         (__ocaml_lex_comment_rec):
14205         (engine):
14206         (new_engine):
14207         (from_function):
14208         (from_channel):
14209         (from_string):
14210         (lexeme):
14211         (sub_lexeme):
14212         (sub_lexeme_opt):
14213         (sub_lexeme_char):
14214         (sub_lexeme_char_opt):
14215         (lexeme_char):
14216         (lexeme_start):
14217         (lexeme_end):
14218         (lexeme_start_p):
14219         (lexeme_end_p):
14220         (new_line):
14221         (flush_input):
14222         (take):
14223         (drop):
14224         (last):
14225         (split_last):
14226         (index_of):
14227         (index_of_int32):
14228         (dim):
14229         (set 1):
14230         (get 2):
14231         (log2):
14232         (is_power_of_two):
14233         (loop):
14234         (breakup):
14235         (hd):
14236         (tl):
14237         (rev_append):
14238         (rev):
14239         (flatten):
14240         (rev_map):
14241         (map2):
14242         (rev_map2):
14243         (iter2):
14244         (fold_left2):
14245         (fold_right2):
14246         (for_all):
14247         (exists):
14248         (for_all2):
14249         (exists2):
14250         (mem):
14251         (memq):
14252         (assoc):
14253         (assq):
14254         (mem_assoc):
14255         (mem_assq):
14256         (remove_assoc):
14257         (remove_assq):
14258         (find):
14259         (find_all):
14260         (partition):
14261         (split):
14262         (combine):
14263         (chop):
14264         (rev_sort):
14265         (sort_uniq):
14266         (Make.height):
14267         (Make.create):
14268         (Make.singleton):
14269         (Make.bal):
14270         (Make.is_empty):
14271         (Make.find):
14272         (Make.mem):
14273         (Make.min_binding):
14274         (Make.max_binding):
14275         (Make.remove_min_binding):
14276         (Make.remove):
14277         (Make.iter):
14278         (Make.map):
14279         (Make.mapi):
14280         (Make.fold):
14281         (Make.for_all):
14282         (Make.exists):
14283         (Make.add_min_binding):
14284         (Make.add_max_binding):
14285         (Make.join):
14286         (Make.concat):
14287         (Make.concat_or_join):
14288         (Make.split):
14289         (Make.merge):
14290         (Make.filter):
14291         (Make.partition):
14292         (Make.cons_enum):
14293         (Make.compare):
14294         (Make.equal):
14295         (Make.cardinal):
14296         (Make.bindings_aux):
14297         (Make.bindings):
14298         (double_field):
14299         (set_double_field):
14300         (marshal):
14301         (unmarshal):
14302         (extension_slot):
14303         (extension_name):
14304         (extension_id):
14305         (i32_const):
14306         (i64_const):
14307         (f32_const):
14308         (f64_const):
14309         (block):
14310         (br):
14311         (br_if):
14312         (br_table):
14313         (if_):
14314         (call):
14315         (call_indirect):
14316         (get_local):
14317         (set_local):
14318         (tee_local):
14319         (get_global):
14320         (set_global):
14321         (i32_load):
14322         (i64_load):
14323         (f32_load):
14324         (f64_load):
14325         (i32_load8_s):
14326         (i32_load8_u):
14327         (i32_load16_s):
14328         (i32_load16_u):
14329         (i64_load8_s):
14330         (i64_load8_u):
14331         (i64_load16_s):
14332         (i64_load16_u):
14333         (i64_load32_s):
14334         (i64_load32_u):
14335         (i32_store):
14336         (i64_store):
14337         (f32_store):
14338         (f64_store):
14339         (i32_store8):
14340         (i32_store16):
14341         (i64_store8):
14342         (i64_store16):
14343         (i64_store32):
14344         (parse):
14345         (string_to):
14346         (string_to_script):
14347         (string_to_module):
14348         (parse_error):
14349         (position_to_pos):
14350         (positions_to_region):
14351         (ati):
14352         (nat):
14353         (nat32):
14354         (empty_context):
14355         (enter_func):
14356         (type_):
14357         (lookup):
14358         (label):
14359         (anon_type):
14360         (bind):
14361         (bind_func):
14362         (bind_local):
14363         (bind_global):
14364         (bind_table):
14365         (bind_memory):
14366         (anon):
14367         (anon_func):
14368         (anon_locals):
14369         (anon_global):
14370         (anon_table):
14371         (anon_memory):
14372         (anon_label):
14373         (explicit_sig):
14374         (inline_type):
14375         (yyact):
14376         (script1):
14377         (module1):
14378         (grow_stacks):
14379         (clear_parser):
14380         (current_lookahead_fun):
14381         (catch.else.current_lookahead_fun.0):
14382         (yyparse):
14383         (peek_val):
14384         (symbol_start_pos):
14385         (symbol_end_pos):
14386         (rhs_start_pos):
14387         (rhs_end_pos):
14388         (symbol_start):
14389         (symbol_end):
14390         (rhs_start):
14391         (rhs_end):
14392         (is_current_lookahead):
14393         (failwith):
14394         (invalid_arg):
14395         (min):
14396         (max):
14397         (lnot):
14398         (char_of_int):
14399         (string_of_bool):
14400         (bool_of_string):
14401         (string_of_int):
14402         (valid_float_lexem):
14403         (string_of_float):
14404         (open_out_gen):
14405         (open_out):
14406         (open_out_bin):
14407         (flush_all):
14408         (output_bytes):
14409         (output_string):
14410         (output):
14411         (output_substring):
14412         (output_value):
14413         (close_out):
14414         (close_out_noerr):
14415         (open_in_gen):
14416         (open_in):
14417         (open_in_bin):
14418         (input):
14419         (else.r):
14420         (unsafe_really_input):
14421         (really_input):
14422         (really_input_string):
14423         (input_line.build_result):
14424         (input_line.n):
14425         (input_line.scan):
14426         (input_line):
14427         (close_in_noerr):
14428         (print_bytes):
14429         (print_endline):
14430         (prerr_char):
14431         (prerr_string):
14432         (prerr_bytes):
14433         (prerr_int):
14434         (prerr_float):
14435         (prerr_endline):
14436         (prerr_newline):
14437         (read_line):
14438         (read_int):
14439         (read_float):
14440         (string_of_format):
14441         (at_exit.exit_function.0):
14442         (at_exit):
14443         (do_at_exit):
14444         (exit):
14445         (output_binary_int):
14446         (seek_out):
14447         (pos_out):
14448         (out_channel_length):
14449         (set_binary_mode_out):
14450         (input_binary_int):
14451         (input_value):
14452         (seek_in):
14453         (pos_in):
14454         (in_channel_length):
14455         (close_in):
14456         (set_binary_mode_in):
14457         (LargeFile_000):
14458         (LargeFile_001):
14459         (LargeFile_002):
14460         (LargeFile_003):
14461         (LargeFile_004):
14462         (LargeFile_005):
14463         (kbprintf):
14464         (plus):
14465         (pp):
14466         (print):
14467         (string_of_pos):
14468         (string_of_region):
14469         (escaped.needs_escape):
14470         (set_signal):
14471         (catch_break):
14472         (size):
14473         (string_of_value_type):
14474         (string_of_value_types):
14475         (string_of_elem_type):
14476         (string_of_limits):
14477         (string_of_table_type):
14478         (string_of_global_type):
14479         (string_of_stack_type):
14480         (string_of_func_type):
14481         (type_of):
14482         (default_value):
14483         (value_of_bool):
14484         (string_of_values):
14485         (to_value):
14486         (of_value):
14487         (g):
14488         (binary):
14489         (bytes):
14490         * wasm/spec-tests/address.wast.js:
14491         (register): Deleted.
14492         (module): Deleted.
14493         (instance): Deleted.
14494         (assert_malformed): Deleted.
14495         (assert_invalid): Deleted.
14496         (assert_soft_invalid): Deleted.
14497         (assert_unlinkable): Deleted.
14498         (assert_uninstantiable): Deleted.
14499         (assert_trap): Deleted.
14500         (assert_return): Deleted.
14501         (assert_return_nan): Deleted.
14502         * wasm/spec-tests/binary.wast.js:
14503         (register): Deleted.
14504         (module): Deleted.
14505         (instance): Deleted.
14506         (assert_malformed): Deleted.
14507         (assert_invalid): Deleted.
14508         (assert_soft_invalid): Deleted.
14509         (assert_unlinkable): Deleted.
14510         (assert_uninstantiable): Deleted.
14511         (assert_trap): Deleted.
14512         (assert_return): Deleted.
14513         (assert_return_nan): Deleted.
14514         * wasm/spec-tests/block.wast.js:
14515         (register): Deleted.
14516         (module): Deleted.
14517         (instance): Deleted.
14518         (assert_malformed): Deleted.
14519         (assert_invalid): Deleted.
14520         (assert_soft_invalid): Deleted.
14521         (assert_unlinkable): Deleted.
14522         (assert_uninstantiable): Deleted.
14523         (assert_trap): Deleted.
14524         (assert_return): Deleted.
14525         (assert_return_nan): Deleted.
14526         * wasm/spec-tests/br.wast.js:
14527         (register): Deleted.
14528         (module): Deleted.
14529         (instance): Deleted.
14530         (assert_malformed): Deleted.
14531         (assert_invalid): Deleted.
14532         (assert_soft_invalid): Deleted.
14533         (assert_unlinkable): Deleted.
14534         (assert_uninstantiable): Deleted.
14535         (assert_trap): Deleted.
14536         (assert_return): Deleted.
14537         (assert_return_nan): Deleted.
14538         * wasm/spec-tests/br_if.wast.js:
14539         (register): Deleted.
14540         (module): Deleted.
14541         (instance): Deleted.
14542         (assert_malformed): Deleted.
14543         (assert_invalid): Deleted.
14544         (assert_soft_invalid): Deleted.
14545         (assert_unlinkable): Deleted.
14546         (assert_uninstantiable): Deleted.
14547         (assert_trap): Deleted.
14548         (assert_return): Deleted.
14549         (assert_return_nan): Deleted.
14550         * wasm/spec-tests/br_table.wast.js:
14551         (register): Deleted.
14552         (module): Deleted.
14553         (instance): Deleted.
14554         (assert_malformed): Deleted.
14555         (assert_invalid): Deleted.
14556         (assert_soft_invalid): Deleted.
14557         (assert_unlinkable): Deleted.
14558         (assert_uninstantiable): Deleted.
14559         (assert_trap): Deleted.
14560         (assert_return): Deleted.
14561         (assert_return_nan): Deleted.
14562         * wasm/spec-tests/break-drop.wast.js:
14563         (register): Deleted.
14564         (module): Deleted.
14565         (instance): Deleted.
14566         (assert_malformed): Deleted.
14567         (assert_invalid): Deleted.
14568         (assert_soft_invalid): Deleted.
14569         (assert_unlinkable): Deleted.
14570         (assert_uninstantiable): Deleted.
14571         (assert_trap): Deleted.
14572         (assert_return): Deleted.
14573         (assert_return_nan): Deleted.
14574         * wasm/spec-tests/call.wast.js:
14575         (register): Deleted.
14576         (module): Deleted.
14577         (instance): Deleted.
14578         (assert_malformed): Deleted.
14579         (assert_invalid): Deleted.
14580         (assert_soft_invalid): Deleted.
14581         (assert_unlinkable): Deleted.
14582         (assert_uninstantiable): Deleted.
14583         (assert_trap): Deleted.
14584         (assert_return): Deleted.
14585         (assert_return_nan): Deleted.
14586         * wasm/spec-tests/call_indirect.wast.js:
14587         (register): Deleted.
14588         (module): Deleted.
14589         (instance): Deleted.
14590         (assert_malformed): Deleted.
14591         (assert_invalid): Deleted.
14592         (assert_soft_invalid): Deleted.
14593         (assert_unlinkable): Deleted.
14594         (assert_uninstantiable): Deleted.
14595         (assert_trap): Deleted.
14596         (assert_return): Deleted.
14597         (assert_return_nan): Deleted.
14598         * wasm/spec-tests/comments.wast.js:
14599         (register): Deleted.
14600         (module): Deleted.
14601         (instance): Deleted.
14602         (assert_malformed): Deleted.
14603         (assert_invalid): Deleted.
14604         (assert_soft_invalid): Deleted.
14605         (assert_unlinkable): Deleted.
14606         (assert_uninstantiable): Deleted.
14607         (assert_trap): Deleted.
14608         (assert_return): Deleted.
14609         (assert_return_nan): Deleted.
14610         * wasm/spec-tests/conversions.wast.js:
14611         (register): Deleted.
14612         (module): Deleted.
14613         (instance): Deleted.
14614         (assert_malformed): Deleted.
14615         (assert_invalid): Deleted.
14616         (assert_soft_invalid): Deleted.
14617         (assert_unlinkable): Deleted.
14618         (assert_uninstantiable): Deleted.
14619         (assert_trap): Deleted.
14620         (assert_return): Deleted.
14621         (assert_return_nan): Deleted.
14622         * wasm/spec-tests/custom_section.wast.js:
14623         (register): Deleted.
14624         (module): Deleted.
14625         (instance): Deleted.
14626         (assert_malformed): Deleted.
14627         (assert_invalid): Deleted.
14628         (assert_soft_invalid): Deleted.
14629         (assert_unlinkable): Deleted.
14630         (assert_uninstantiable): Deleted.
14631         (assert_trap): Deleted.
14632         (assert_return): Deleted.
14633         (assert_return_nan): Deleted.
14634         * wasm/spec-tests/endianness.wast.js:
14635         (register): Deleted.
14636         (module): Deleted.
14637         (instance): Deleted.
14638         (assert_malformed): Deleted.
14639         (assert_invalid): Deleted.
14640         (assert_soft_invalid): Deleted.
14641         (assert_unlinkable): Deleted.
14642         (assert_uninstantiable): Deleted.
14643         (assert_trap): Deleted.
14644         (assert_return): Deleted.
14645         (assert_return_nan): Deleted.
14646         * wasm/spec-tests/exports.wast.js:
14647         (register): Deleted.
14648         (module): Deleted.
14649         (instance): Deleted.
14650         (assert_malformed): Deleted.
14651         (assert_invalid): Deleted.
14652         (assert_soft_invalid): Deleted.
14653         (assert_unlinkable): Deleted.
14654         (assert_uninstantiable): Deleted.
14655         (assert_trap): Deleted.
14656         (assert_return): Deleted.
14657         (assert_return_nan): Deleted.
14658         * wasm/spec-tests/f32.wast.js: Removed.
14659         * wasm/spec-tests/f32_cmp.wast.js:
14660         (register): Deleted.
14661         (module): Deleted.
14662         (instance): Deleted.
14663         (assert_malformed): Deleted.
14664         (assert_invalid): Deleted.
14665         (assert_soft_invalid): Deleted.
14666         (assert_unlinkable): Deleted.
14667         (assert_uninstantiable): Deleted.
14668         (assert_trap): Deleted.
14669         (assert_return): Deleted.
14670         (assert_return_nan): Deleted.
14671         * wasm/spec-tests/f64.wast.js: Removed.
14672         * wasm/spec-tests/f64_cmp.wast.js:
14673         (register): Deleted.
14674         (module): Deleted.
14675         (instance): Deleted.
14676         (assert_malformed): Deleted.
14677         (assert_invalid): Deleted.
14678         (assert_soft_invalid): Deleted.
14679         (assert_unlinkable): Deleted.
14680         (assert_uninstantiable): Deleted.
14681         (assert_trap): Deleted.
14682         (assert_return): Deleted.
14683         (assert_return_nan): Deleted.
14684         * wasm/spec-tests/fac.wast.js:
14685         (register): Deleted.
14686         (module): Deleted.
14687         (instance): Deleted.
14688         (assert_malformed): Deleted.
14689         (assert_invalid): Deleted.
14690         (assert_soft_invalid): Deleted.
14691         (assert_unlinkable): Deleted.
14692         (assert_uninstantiable): Deleted.
14693         (assert_trap): Deleted.
14694         (assert_return): Deleted.
14695         (assert_return_nan): Deleted.
14696         * wasm/spec-tests/float_exprs.wast.js: Removed.
14697         * wasm/spec-tests/float_literals.wast.js:
14698         (register): Deleted.
14699         (module): Deleted.
14700         (instance): Deleted.
14701         (assert_malformed): Deleted.
14702         (assert_invalid): Deleted.
14703         (assert_soft_invalid): Deleted.
14704         (assert_unlinkable): Deleted.
14705         (assert_uninstantiable): Deleted.
14706         (assert_trap): Deleted.
14707         (assert_return): Deleted.
14708         (assert_return_nan): Deleted.
14709         * wasm/spec-tests/float_memory.wast.js:
14710         (register): Deleted.
14711         (module): Deleted.
14712         (instance): Deleted.
14713         (assert_malformed): Deleted.
14714         (assert_invalid): Deleted.
14715         (assert_soft_invalid): Deleted.
14716         (assert_unlinkable): Deleted.
14717         (assert_uninstantiable): Deleted.
14718         (assert_trap): Deleted.
14719         (assert_return): Deleted.
14720         (assert_return_nan): Deleted.
14721         * wasm/spec-tests/float_misc.wast.js: Removed.
14722         * wasm/spec-tests/forward.wast.js:
14723         (register): Deleted.
14724         (module): Deleted.
14725         (instance): Deleted.
14726         (assert_malformed): Deleted.
14727         (assert_invalid): Deleted.
14728         (assert_soft_invalid): Deleted.
14729         (assert_unlinkable): Deleted.
14730         (assert_uninstantiable): Deleted.
14731         (assert_trap): Deleted.
14732         (assert_return): Deleted.
14733         (assert_return_nan): Deleted.
14734         * wasm/spec-tests/func.wast.js:
14735         (register): Deleted.
14736         (module): Deleted.
14737         (instance): Deleted.
14738         (assert_malformed): Deleted.
14739         (assert_invalid): Deleted.
14740         (assert_soft_invalid): Deleted.
14741         (assert_unlinkable): Deleted.
14742         (assert_uninstantiable): Deleted.
14743         (assert_trap): Deleted.
14744         (assert_return): Deleted.
14745         (assert_return_nan): Deleted.
14746         * wasm/spec-tests/func_ptrs.wast.js:
14747         (register): Deleted.
14748         (module): Deleted.
14749         (instance): Deleted.
14750         (assert_malformed): Deleted.
14751         (assert_invalid): Deleted.
14752         (assert_soft_invalid): Deleted.
14753         (assert_unlinkable): Deleted.
14754         (assert_uninstantiable): Deleted.
14755         (assert_trap): Deleted.
14756         (assert_return): Deleted.
14757         (assert_return_nan): Deleted.
14758         * wasm/spec-tests/get_local.wast.js:
14759         (register): Deleted.
14760         (module): Deleted.
14761         (instance): Deleted.
14762         (assert_malformed): Deleted.
14763         (assert_invalid): Deleted.
14764         (assert_soft_invalid): Deleted.
14765         (assert_unlinkable): Deleted.
14766         (assert_uninstantiable): Deleted.
14767         (assert_trap): Deleted.
14768         (assert_return): Deleted.
14769         (assert_return_nan): Deleted.
14770         * wasm/spec-tests/globals.wast.js:
14771         (register): Deleted.
14772         (module): Deleted.
14773         (instance): Deleted.
14774         (assert_malformed): Deleted.
14775         (assert_invalid): Deleted.
14776         (assert_soft_invalid): Deleted.
14777         (assert_unlinkable): Deleted.
14778         (assert_uninstantiable): Deleted.
14779         (assert_trap): Deleted.
14780         (assert_return): Deleted.
14781         (assert_return_nan): Deleted.
14782         * wasm/spec-tests/i32.wast.js:
14783         (register): Deleted.
14784         (module): Deleted.
14785         (instance): Deleted.
14786         (assert_malformed): Deleted.
14787         (assert_invalid): Deleted.
14788         (assert_soft_invalid): Deleted.
14789         (assert_unlinkable): Deleted.
14790         (assert_uninstantiable): Deleted.
14791         (assert_trap): Deleted.
14792         (assert_return): Deleted.
14793         (assert_return_nan): Deleted.
14794         * wasm/spec-tests/i64.wast.js:
14795         (register): Deleted.
14796         (module): Deleted.
14797         (instance): Deleted.
14798         (assert_malformed): Deleted.
14799         (assert_invalid): Deleted.
14800         (assert_soft_invalid): Deleted.
14801         (assert_unlinkable): Deleted.
14802         (assert_uninstantiable): Deleted.
14803         (assert_trap): Deleted.
14804         (assert_return): Deleted.
14805         (assert_return_nan): Deleted.
14806         * wasm/spec-tests/if.wast.js: Added.
14807         * wasm/spec-tests/imports.wast.js:
14808         (register): Deleted.
14809         (module): Deleted.
14810         (instance): Deleted.
14811         (assert_malformed): Deleted.
14812         (assert_invalid): Deleted.
14813         (assert_soft_invalid): Deleted.
14814         (assert_unlinkable): Deleted.
14815         (assert_uninstantiable): Deleted.
14816         (assert_trap): Deleted.
14817         (assert_return): Deleted.
14818         (assert_return_nan): Deleted.
14819         * wasm/spec-tests/int_exprs.wast.js:
14820         (register): Deleted.
14821         (module): Deleted.
14822         (instance): Deleted.
14823         (assert_malformed): Deleted.
14824         (assert_invalid): Deleted.
14825         (assert_soft_invalid): Deleted.
14826         (assert_unlinkable): Deleted.
14827         (assert_uninstantiable): Deleted.
14828         (assert_trap): Deleted.
14829         (assert_return): Deleted.
14830         (assert_return_nan): Deleted.
14831         * wasm/spec-tests/int_literals.wast.js:
14832         (register): Deleted.
14833         (module): Deleted.
14834         (instance): Deleted.
14835         (assert_malformed): Deleted.
14836         (assert_invalid): Deleted.
14837         (assert_soft_invalid): Deleted.
14838         (assert_unlinkable): Deleted.
14839         (assert_uninstantiable): Deleted.
14840         (assert_trap): Deleted.
14841         (assert_return): Deleted.
14842         (assert_return_nan): Deleted.
14843         * wasm/spec-tests/jsapi.js: Added.
14844         (testJSAPI.get test):
14845         (testJSAPI.test):
14846         (testJSAPI.set test):
14847         (testJSAPI.assertCompileError):
14848         (testJSAPI.assertCompileSuccess):
14849         (testJSAPI):
14850         * wasm/spec-tests/labels.wast.js: Added.
14851         * wasm/spec-tests/left-to-right.wast.js:
14852         (register): Deleted.
14853         (module): Deleted.
14854         (instance): Deleted.
14855         (assert_malformed): Deleted.
14856         (assert_invalid): Deleted.
14857         (assert_soft_invalid): Deleted.
14858         (assert_unlinkable): Deleted.
14859         (assert_uninstantiable): Deleted.
14860         (assert_trap): Deleted.
14861         (assert_return): Deleted.
14862         (assert_return_nan): Deleted.
14863         * wasm/spec-tests/linking.wast.js:
14864         (register): Deleted.
14865         (module): Deleted.
14866         (instance): Deleted.
14867         (assert_malformed): Deleted.
14868         (assert_invalid): Deleted.
14869         (assert_soft_invalid): Deleted.
14870         (assert_unlinkable): Deleted.
14871         (assert_uninstantiable): Deleted.
14872         (assert_trap): Deleted.
14873         (assert_return): Deleted.
14874         (assert_return_nan): Deleted.
14875         * wasm/spec-tests/loop.wast.js:
14876         (register): Deleted.
14877         (module): Deleted.
14878         (instance): Deleted.
14879         (assert_malformed): Deleted.
14880         (assert_invalid): Deleted.
14881         (assert_soft_invalid): Deleted.
14882         (assert_unlinkable): Deleted.
14883         (assert_uninstantiable): Deleted.
14884         (assert_trap): Deleted.
14885         (assert_return): Deleted.
14886         (assert_return_nan): Deleted.
14887         * wasm/spec-tests/memory.wast.js:
14888         (register): Deleted.
14889         (module): Deleted.
14890         (instance): Deleted.
14891         (assert_malformed): Deleted.
14892         (assert_invalid): Deleted.
14893         (assert_soft_invalid): Deleted.
14894         (assert_unlinkable): Deleted.
14895         (assert_uninstantiable): Deleted.
14896         (assert_trap): Deleted.
14897         (assert_return): Deleted.
14898         (assert_return_nan): Deleted.
14899         * wasm/spec-tests/memory_redundancy.wast.js:
14900         (register): Deleted.
14901         (module): Deleted.
14902         (instance): Deleted.
14903         (assert_malformed): Deleted.
14904         (assert_invalid): Deleted.
14905         (assert_soft_invalid): Deleted.
14906         (assert_unlinkable): Deleted.
14907         (assert_uninstantiable): Deleted.
14908         (assert_trap): Deleted.
14909         (assert_return): Deleted.
14910         (assert_return_nan): Deleted.
14911         * wasm/spec-tests/memory_trap.wast.js: Removed.
14912         * wasm/spec-tests/names.wast.js:
14913         (register): Deleted.
14914         (module): Deleted.
14915         (instance): Deleted.
14916         (assert_malformed): Deleted.
14917         (assert_invalid): Deleted.
14918         (assert_soft_invalid): Deleted.
14919         (assert_unlinkable): Deleted.
14920         (assert_uninstantiable): Deleted.
14921         (assert_trap): Deleted.
14922         (assert_return): Deleted.
14923         (assert_return_nan): Deleted.
14924         * wasm/spec-tests/nop.wast.js:
14925         (register): Deleted.
14926         (module): Deleted.
14927         (instance): Deleted.
14928         (assert_malformed): Deleted.
14929         (assert_invalid): Deleted.
14930         (assert_soft_invalid): Deleted.
14931         (assert_unlinkable): Deleted.
14932         (assert_uninstantiable): Deleted.
14933         (assert_trap): Deleted.
14934         (assert_return): Deleted.
14935         (assert_return_nan): Deleted.
14936         * wasm/spec-tests/resizing.wast.js:
14937         (register): Deleted.
14938         (module): Deleted.
14939         (instance): Deleted.
14940         (assert_malformed): Deleted.
14941         (assert_invalid): Deleted.
14942         (assert_soft_invalid): Deleted.
14943         (assert_unlinkable): Deleted.
14944         (assert_uninstantiable): Deleted.
14945         (assert_trap): Deleted.
14946         (assert_return): Deleted.
14947         (assert_return_nan): Deleted.
14948         * wasm/spec-tests/return.wast.js:
14949         (register): Deleted.
14950         (module): Deleted.
14951         (instance): Deleted.
14952         (assert_malformed): Deleted.
14953         (assert_invalid): Deleted.
14954         (assert_soft_invalid): Deleted.
14955         (assert_unlinkable): Deleted.
14956         (assert_uninstantiable): Deleted.
14957         (assert_trap): Deleted.
14958         (assert_return): Deleted.
14959         (assert_return_nan): Deleted.
14960         * wasm/spec-tests/select.wast.js:
14961         (register): Deleted.
14962         (module): Deleted.
14963         (instance): Deleted.
14964         (assert_malformed): Deleted.
14965         (assert_invalid): Deleted.
14966         (assert_soft_invalid): Deleted.
14967         (assert_unlinkable): Deleted.
14968         (assert_uninstantiable): Deleted.
14969         (assert_trap): Deleted.
14970         (assert_return): Deleted.
14971         (assert_return_nan): Deleted.
14972         * wasm/spec-tests/set_local.wast.js:
14973         (register): Deleted.
14974         (module): Deleted.
14975         (instance): Deleted.
14976         (assert_malformed): Deleted.
14977         (assert_invalid): Deleted.
14978         (assert_soft_invalid): Deleted.
14979         (assert_unlinkable): Deleted.
14980         (assert_uninstantiable): Deleted.
14981         (assert_trap): Deleted.
14982         (assert_return): Deleted.
14983         (assert_return_nan): Deleted.
14984         * wasm/spec-tests/skip-stack-guard-page.wast.js:
14985         (register): Deleted.
14986         (module): Deleted.
14987         (instance): Deleted.
14988         (assert_malformed): Deleted.
14989         (assert_invalid): Deleted.
14990         (assert_soft_invalid): Deleted.
14991         (assert_unlinkable): Deleted.
14992         (assert_uninstantiable): Deleted.
14993         (assert_trap): Deleted.
14994         (assert_return): Deleted.
14995         (assert_return_nan): Deleted.
14996         * wasm/spec-tests/stack.wast.js:
14997         (register): Deleted.
14998         (module): Deleted.
14999         (instance): Deleted.
15000         (assert_malformed): Deleted.
15001         (assert_invalid): Deleted.
15002         (assert_soft_invalid): Deleted.
15003         (assert_unlinkable): Deleted.
15004         (assert_uninstantiable): Deleted.
15005         (assert_trap): Deleted.
15006         (assert_return): Deleted.
15007         (assert_return_nan): Deleted.
15008         * wasm/spec-tests/start.wast.js:
15009         (register): Deleted.
15010         (module): Deleted.
15011         (instance): Deleted.
15012         (assert_malformed): Deleted.
15013         (assert_invalid): Deleted.
15014         (assert_soft_invalid): Deleted.
15015         (assert_unlinkable): Deleted.
15016         (assert_uninstantiable): Deleted.
15017         (assert_trap): Deleted.
15018         (assert_return): Deleted.
15019         (assert_return_nan): Deleted.
15020         * wasm/spec-tests/store_retval.wast.js:
15021         (register): Deleted.
15022         (module): Deleted.
15023         (instance): Deleted.
15024         (assert_malformed): Deleted.
15025         (assert_invalid): Deleted.
15026         (assert_soft_invalid): Deleted.
15027         (assert_unlinkable): Deleted.
15028         (assert_uninstantiable): Deleted.
15029         (assert_trap): Deleted.
15030         (assert_return): Deleted.
15031         (assert_return_nan): Deleted.
15032         * wasm/spec-tests/switch.wast.js:
15033         (register): Deleted.
15034         (module): Deleted.
15035         (instance): Deleted.
15036         (assert_malformed): Deleted.
15037         (assert_invalid): Deleted.
15038         (assert_soft_invalid): Deleted.
15039         (assert_unlinkable): Deleted.
15040         (assert_uninstantiable): Deleted.
15041         (assert_trap): Deleted.
15042         (assert_return): Deleted.
15043         (assert_return_nan): Deleted.
15044         * wasm/spec-tests/tee_local.wast.js:
15045         (register): Deleted.
15046         (module): Deleted.
15047         (instance): Deleted.
15048         (assert_malformed): Deleted.
15049         (assert_invalid): Deleted.
15050         (assert_soft_invalid): Deleted.
15051         (assert_unlinkable): Deleted.
15052         (assert_uninstantiable): Deleted.
15053         (assert_trap): Deleted.
15054         (assert_return): Deleted.
15055         (assert_return_nan): Deleted.
15056         * wasm/spec-tests/traps.wast.js:
15057         (register): Deleted.
15058         (module): Deleted.
15059         (instance): Deleted.
15060         (assert_malformed): Deleted.
15061         (assert_invalid): Deleted.
15062         (assert_soft_invalid): Deleted.
15063         (assert_unlinkable): Deleted.
15064         (assert_uninstantiable): Deleted.
15065         (assert_trap): Deleted.
15066         (assert_return): Deleted.
15067         (assert_return_nan): Deleted.
15068         * wasm/spec-tests/typecheck.wast.js:
15069         (register): Deleted.
15070         (module): Deleted.
15071         (instance): Deleted.
15072         (assert_malformed): Deleted.
15073         (assert_invalid): Deleted.
15074         (assert_soft_invalid): Deleted.
15075         (assert_unlinkable): Deleted.
15076         (assert_uninstantiable): Deleted.
15077         (assert_trap): Deleted.
15078         (assert_return): Deleted.
15079         (assert_return_nan): Deleted.
15080         * wasm/spec-tests/unreachable.wast.js:
15081         (register): Deleted.
15082         (module): Deleted.
15083         (instance): Deleted.
15084         (assert_malformed): Deleted.
15085         (assert_invalid): Deleted.
15086         (assert_soft_invalid): Deleted.
15087         (assert_unlinkable): Deleted.
15088         (assert_uninstantiable): Deleted.
15089         (assert_trap): Deleted.
15090         (assert_return): Deleted.
15091         (assert_return_nan): Deleted.
15092         * wasm/spec-tests/unreached-invalid.wast.js: Added.
15093         * wasm/spec-tests/unwind.wast.js:
15094         (register): Deleted.
15095         (module): Deleted.
15096         (instance): Deleted.
15097         (assert_malformed): Deleted.
15098         (assert_invalid): Deleted.
15099         (assert_soft_invalid): Deleted.
15100         (assert_unlinkable): Deleted.
15101         (assert_uninstantiable): Deleted.
15102         (assert_trap): Deleted.
15103         (assert_return): Deleted.
15104         (assert_return_nan): Deleted.
15105
15106 2017-04-01  Oleksandr Skachkov  <gskachkov@gmail.com>
15107
15108         Object with numerical keys with gaps gets filled by NaN values
15109         https://bugs.webkit.org/show_bug.cgi?id=164412
15110
15111         Reviewed by Merk Lam.
15112
15113         * stress/object-number-properties.js: Added.
15114         (assert):
15115         (boo):
15116
15117 2017-03-30  Michael Saboff  <msaboff@apple.com>
15118
15119         Turning ChakraCore/test/fieldopts/objtypespec-newobj-invalidation.1.js back as it appears to always work
15120         https://bugs.webkit.org/show_bug.cgi?id=170313
15121
15122         Reviewed by Saam Barati.
15123
15124         Enable ChakraCore/test/fieldopts/objtypespec-newobj-invalidation.1.js as it seems solid.
15125
15126         * ChakraCore.yaml:
15127
15128 2017-03-30  Michael Saboff  <msaboff@apple.com>
15129
15130         Enable ChakraCore/Function/FuncBody.js test as it now works
15131         https://bugs.webkit.org/show_bug.cgi?id=170301
15132
15133         Reviewed by Mark Lam.
15134
15135         This test no longer crashes, so enable it and create a JSC specific
15136         expected file.
15137
15138         * ChakraCore.yaml:
15139         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc: Added.
15140
15141 2017-03-30  JF Bastien  <jfbastien@apple.com>
15142
15143         WebAssembly: fix misc JS API implementation inconsistencies
15144         https://bugs.webkit.org/show_bug.cgi?id=170187
15145
15146         Reviewed by Keith Miller.
15147
15148         Verify that WebAssembly function are on the object's __proto__.
15149
15150         * wasm/js-api/Module-compile.js:
15151         * wasm/js-api/validate.js:
15152         * wasm/js-api/web-assembly-instantiate.js:
15153
15154 2017-03-29  JF Bastien  <jfbastien@apple.com>
15155
15156         WebAssembly: add shell-only Memory mode helper
15157         https://bugs.webkit.org/show_bug.cgi?id=170227
15158
15159         Reviewed by Mark Lam.
15160
15161         * wasm/assert.js: fix a prior debug thing I forgot to remove
15162         * wasm/function-tests/memory-section-and-import.js: the assert
15163         issue was hiding a failure in error message here
15164         * wasm/js-api/element.js: the assert issue was hiding a failure in
15165         error message here
15166         (badInstantiation.test):
15167         (badInstantiation):
15168         * wasm/js-api/extension-MemoryMode.js: Added.
15169         (const.validateMode.what.switch):
15170         (testMemoryNoMax):
15171         (testMemory):
15172         (testInstanceNoMemory):
15173         (testInstanceNoMax):
15174         (testInstance):
15175         * wasm/js-api/test_memory.js: the assert issue was hiding a
15176         failure in error message here
15177         (test):
15178
15179 2017-03-28  Keith Miller  <keith_miller@apple.com>
15180
15181         WebAssembly: Make WebAssembly.instantiate/compile truly asynchronous
15182         https://bugs.webkit.org/show_bug.cgi?id=169187
15183
15184         Reviewed by Saam Barati.
15185
15186         * wasm/assert.js:
15187         * wasm/js-api/Module-compile.js:
15188         (async.testPromiseAPI):
15189         * wasm/js-api/web-assembly-compile-parallel.js: Added.
15190         (async.throwExn):
15191         (async.test):
15192         * wasm/js-api/web-assembly-instantiate-parallel.js: Added.
15193         (async.test):
15194         * wasm/js-api/web-assembly-instantiate.js:
15195         (assert.eq.async.test):
15196         (assert.eq):
15197         (assert.asyncTest.async.test):
15198         (assert.asyncTest):
15199         (assert.truthy.async.test): Deleted.
15200         (assert.truthy): Deleted.
15201
15202 2017-03-28  JF Bastien  <jfbastien@apple.com>
15203
15204         WebAssembly: implement Module imports/exports
15205         https://bugs.webkit.org/show_bug.cgi?id=166982
15206
15207         Reviewed by Saam Barati.
15208
15209         * wasm/js-api/Module.exports.js: Added.
15210         (assert.throws.WebAssembly.Module.prototype.exports):
15211         (assert.eq):
15212         * wasm/js-api/Module.imports.js: Added.
15213         (assert.throws.WebAssembly.Module.prototype.imports):
15214         (assert.eq):
15215
15216 2017-03-27  JF Bastien  <jfbastien@apple.com>
15217
15218         WebAssembly: misc memory testing
15219         https://bugs.webkit.org/show_bug.cgi?id=170137
15220
15221         Reviewed by Keith Miller.
15222
15223         * wasm/assert.js: handle newlines in code we print out, avoid regex
15224         * wasm/function-tests/memory-import-and-grow.js: Added.
15225         (const.instantiate):
15226         (const.test):
15227         * wasm/function-tests/memory-section-and-import.js: Added.
15228         (const.instantiate):
15229
15230 2017-03-23  Yusuke Suzuki  <utatane.tea@gmail.com>
15231
15232         [JSC] Use jsNontrivialString agressively for ToString(Int52)
15233         https://bugs.webkit.org/show_bug.cgi?id=170002
15234
15235         Reviewed by Sam Weinig.
15236
15237         * stress/to-string-int52.js: Added.
15238         (shouldBe):
15239         (toString10):
15240         (expected):
15241
15242 2017-03-23  Yusuke Suzuki  <utatane.tea@gmail.com>
15243
15244         [JSC][DFG] Make addShouldSpeculateAnyInt more conservative to avoid regression caused by Double <-> Int52 conversions
15245         https://bugs.webkit.org/show_bug.cgi?id=169998
15246
15247         Reviewed by Saam Barati.
15248
15249         * microbenchmarks/int52-back-and-forth.js: Added.
15250         (shouldBe):
15251         (num):
15252
15253 2017-03-23  Mark Lam  <mark.lam@apple.com>
15254
15255         Clients of JSArray::tryCreateForInitializationPrivate() should do their own null checks.
15256         https://bugs.webkit.org/show_bug.cgi?id=169783
15257
15258         Reviewed by Saam Barati.
15259
15260         * stress/regress-169783.js: Added.
15261
15262 2017-03-22  Yusuke Suzuki  <utatane.tea@gmail.com>
15263
15264         [JSC][DFG] Propagate AnyIntAsDouble information carefully to utilize it in fixup
15265         https://bugs.webkit.org/show_bug.cgi?id=169914
15266
15267         Reviewed by Saam Barati.
15268
15269         * stress/any-int-as-double-add.js: Added.
15270         (shouldBe):
15271         (test):
15272         * stress/to-this-numbers.js: Added.
15273         (shouldBe):
15274         (Number.prototype.toThis):
15275
15276 2017-03-22  Mark Lam  <mark.lam@apple.com>
15277
15278         Add support for Error.stackTraceLimit.
15279         https://bugs.webkit.org/show_bug.cgi?id=169904
15280
15281         Reviewed by Saam Barati.
15282
15283         * stress/error-stack-trace-limit.js: Added.
15284
15285 2017-03-22  Yusuke Suzuki  <utatane.tea@gmail.com>
15286
15287         [JSC] Use jsNontrivialString for Number toString operations
15288         https://bugs.webkit.org/show_bug.cgi?id=169965
15289
15290         Reviewed by Mark Lam.
15291
15292         * stress/to-string-int32.js: Added.
15293         (shouldBe):
15294         (toString10):
15295         (expected):
15296
15297 2017-03-22  JF Bastien  <jfbastien@apple.com>
15298
15299         WebAssembly: test module namespace object for WebAssembly.Instance
15300         https://bugs.webkit.org/show_bug.cgi?id=169951
15301
15302         Reviewed by Saam Barati.
15303
15304         * wasm/js-api/test_basic_api.js:
15305         (const.c.in.constructorProperties.switch):
15306
15307 2017-03-22  JF Bastien  <jfbastien@apple.com>
15308
15309         WebAssembly: constructors without new don't throw
15310         https://bugs.webkit.org/show_bug.cgi?id=165995
15311
15312         Reviewed by Saam Barati.
15313
15314         * wasm/js-api/test_basic_api.js:
15315         (const.c.in.constructorProperties.switch):
15316
15317 2017-03-21  Yusuke Suzuki  <utatane.tea@gmail.com>
15318
15319         [JSC] Optimize Number.prototype.toString on Int32 / Int52 / Double
15320         https://bugs.webkit.org/show_bug.cgi?id=167454
15321
15322         Reviewed by Saam Barati.
15323
15324         * stress/number-to-string-abstract-operation.js: Added.
15325         (shouldBe):
15326         (int32ToString):
15327         (shouldBe.int32ToString.new.Number.int52ToString):
15328         (shouldBe.int32ToString.new.Number):
15329         (shouldBe.doubleToString):
15330         * stress/number-to-string-radix.js: Added.
15331         (shouldBe):
15332         (int32ToString):
15333         (shouldBe.int32ToString.new.Number.int52ToString):
15334         (shouldBe.int32ToString.new.Number):
15335         (shouldBe.doubleToString):
15336         * stress/number-to-string.js: Added.
15337         (shouldBe):
15338         (int32ToString):
15339         (shouldBe.int32ToString.new.Number.int52ToString):
15340         (shouldBe.int32ToString.new.Number):
15341         (shouldBe.doubleToString):
15342
15343 2017-03-19  Chris Dumez  <cdumez@apple.com>
15344
15345         `const location = "foo"` throws in a worker
15346         https://bugs.webkit.org/show_bug.cgi?id=169839
15347
15348         Reviewed by Mark Lam.
15349
15350         * ChakraCore/test/es6/letconst_global_shadow_builtins_nonconfigurable.baseline-jsc:
15351         Update expected jsc result now that we throw a SyntaxError when trying to shadow undefined
15352         with a let variable. We used not to throw because the value is undefined but this was not
15353         as per EcmaScript. Both Firefox and Chrome throw in this case.
15354
15355         * stress/global-lexical-redeclare-variable.js:
15356         (catch):
15357         Update test that defines a non-configurable 'zoo' property on the global object and then
15358         expected shadowing it with a 'let zoo' variable to work because its value was undefined.
15359         This was not as per EcmaScript spec and both Firefox and Chrome throw in this case.
15360
15361 2017-03-19  Yusuke Suzuki  <utatane.tea@gmail.com>
15362
15363         import(arg) crashes when ToString(arg) throws
15364         https://bugs.webkit.org/show_bug.cgi?id=169778
15365
15366         Reviewed by Saam Barati.
15367
15368         * stress/import-reject-with-exception.js: Added.
15369         (shouldBe):
15370         (let.x.get toString):
15371
15372 2017-03-16  Filip Pizlo  <fpizlo@apple.com>
15373
15374         FTL should support global and eval code
15375         https://bugs.webkit.org/show_bug.cgi?id=169656
15376
15377         Reviewed by Geoffrey Garen and Saam Barati.
15378
15379         Added basic performance tests of global and eval code. These tests will run a lot faster in with
15380         the FTL because of the object allocation.
15381
15382         * microbenchmarks/eval-code-ftl-reentry.js: Added.
15383         * microbenchmarks/eval-code-ftl.js: Added.
15384         * microbenchmarks/global-code-ftl.js: Added.
15385         * stress/arith-log-on-various-types.js: This was a flaky fail with concurrent JIT, so I stopped running it with concurrent JIT. The failure was its assertion about how many times something gets compiled.
15386
15387 2017-03-16  Caio Lima  <ticaiolima@gmail.com>
15388
15389         [ESnext] Implement Object Spread
15390         https://bugs.webkit.org/show_bug.cgi?id=167963
15391
15392         Reviewed by Yusuke Suzuki.
15393
15394         * stress/object-spread.js: Added.
15395         (let.assert):
15396         (assert.sameValue):
15397         (let.o.get a):
15398         (let.obj.get c):
15399         (cthulhu.get x):
15400         (let.obj.set c):
15401         (calls.o.get z):
15402         (calls.o.get a):
15403         (try.let.obj.get foo):
15404         (get calls):
15405
15406 2017-03-15  Yusuke Suzuki  <utatane.tea@gmail.com>
15407
15408         [JSC] Default parameter part should be retrieved by op_get_argument opcode instead of changing arity
15409         https://bugs.webkit.org/show_bug.cgi?id=164582
15410
15411         Reviewed by Saam Barati.
15412
15413         * stress/function-with-defaults-inlining.js: Added.
15414         (shouldBe):
15415         (ok):
15416         (a):
15417         * stress/function-with-defaults-non-inlining.js: Added.
15418         (shouldBe):
15419         (ok):
15420         (a):
15421
15422 2017-03-15  Yusuke Suzuki  <utatane.tea@gmail.com>
15423
15424         [DFG] ToString operation should have fixup for primitives to say this node does not have side effects
15425         https://bugs.webkit.org/show_bug.cgi?id=169544
15426
15427         Reviewed by Saam Barati.
15428
15429         * microbenchmarks/template-string-array.js: Added.
15430         (test):
15431         * stress/to-string-non-cell-use.js: Added.
15432         (shouldBe):
15433         (shouldThrow):
15434
15435 2017-03-13  Commit Queue  <commit-queue@webkit.org>
15436
15437         Unreviewed, rolling out r213856.
15438         https://bugs.webkit.org/show_bug.cgi?id=169562
15439
15440         Breaks JSC stress test stress/super-property-access.js.ftl-
15441         eager failing (Requested by mlam|g on #webkit).
15442
15443         Reverted changeset:
15444
15445         "FTL should not flush strict arguments unless it really needs
15446         to"
15447         https://bugs.webkit.org/show_bug.cgi?id=169519
15448         http://trac.webkit.org/changeset/213856
15449
15450 2017-03-11  Filip Pizlo  <fpizlo@apple.com>
15451
15452         FTL should not flush strict arguments unless it really needs to
15453         https://bugs.webkit.org/show_bug.cgi?id=169519
15454
15455         Reviewed by Mark Lam.
15456
15457         This benchmark runs 3.5x faster thanks to this patch.
15458
15459         * microbenchmarks/strict-arguments-no-escape.js: Added.
15460         (foo):
15461         (bar):
15462         (baz):
15463
15464 2017-03-13  Caio Lima  <ticaiolima@gmail.com>
15465
15466         [JSC] It should be possible create a label named let when parsing Statement in non strict mode
15467         https://bugs.webkit.org/show_bug.cgi?id=168684
15468
15469         Reviewed by Saam Barati.
15470
15471         * ChakraCore/test/LetConst/DeclOutofBlock.baseline-jsc:
15472
15473 2017-03-10  Saam Barati  <sbarati@apple.com>
15474
15475         WebAssembly: Make more demos run
15476         https://bugs.webkit.org/show_bug.cgi?id=165510
15477         <rdar://problem/29760310>
15478
15479         Reviewed by Keith Miller.
15480
15481         * wasm/Builder.js:
15482         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
15483         * wasm/js-api/wrapper-function.js: Added.
15484         (exportImport):
15485         (return.new.WebAssembly.Module):
15486         (assert.throws.makeInstance):
15487         (assert.throws.Bar):
15488         (assert.throws):
15489
15490 2017-03-10  Mark Lam  <mark.lam@apple.com>
15491
15492         JSC: BindingNode::bindValue doesn't increase the scope's reference count.
15493         https://bugs.webkit.org/show_bug.cgi?id=168546
15494         <rdar://problem/30589551>
15495
15496         Reviewed by Saam Barati.
15497
15498         * stress/regress-168546.js: Added.
15499
15500 2017-03-09  Caio Lima  <ticaiolima@gmail.com>
15501
15502         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
15503         https://bugs.webkit.org/show_bug.cgi?id=167962
15504
15505         Reviewed by Keith Miller.
15506
15507         * stress/object-rest-deconstruct.js: Added.
15508         (let.assert):
15509         (let.assertPropDescriptor):
15510         (catch):
15511         (get 3):
15512         (foo):
15513         (let.src.get y):
15514         (let.src.set y):
15515         (let.gen):
15516
15517 2017-03-09  Saam Barati  <sbarati@apple.com>
15518
15519         WebAssembly: Make the Unity AngryBots demo run
15520         https://bugs.webkit.org/show_bug.cgi?id=169268
15521
15522         Reviewed by Keith Miller.
15523
15524         * wasm/function-tests/many-arguments-to-function.js: Added.
15525         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.I32Const.0.I32Const.1.I32Const.2.I32Const.3.I32Const.4.I32Const.5.I32Const.6.I32Const.7.I32Const.8.I32Const.9.I32Const.10.I32Const.11.I32Const.12.I32Const.13.I32Const.14.I32Const.15.I32Const.16.I32Const.17.Call.0.Return.End.End.foo):
15526         (i.instance.exports.f0.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.Call.Return.End.End.foo):
15527         (i.instance.exports.f0):
15528         (instance.exports.f0.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.Call.Return.End.End.foo):
15529         (instance.exports.f0):
15530
15531 2017-03-08  Yusuke Suzuki  <utatane.tea@gmail.com>
15532
15533         [GTK] JSC test stress/arity-check-ftl-throw.js.ftl-no-cjit-validate-sampling-profiler crashing on GTK bot
15534         https://bugs.webkit.org/show_bug.cgi?id=160124
15535
15536         Reviewed by Mark Lam.
15537
15538         * stress/spread-forward-call-varargs-stack-overflow.js:
15539
15540 2017-03-06  Saam Barati  <sbarati@apple.com>
15541
15542         WebAssembly: Implement the WebAssembly.instantiate API
15543         https://bugs.webkit.org/show_bug.cgi?id=165982
15544         <rdar://problem/29760110>
15545
15546         Reviewed by Keith Miller.
15547
15548         * wasm/js-api/web-assembly-instantiate.js: Added.
15549         (assert.eq.async.test):
15550         (assert.eq):
15551         (assert.truthy.async.test):
15552         (assert.truthy):
15553
15554 2017-03-06  Saam Barati  <sbarati@apple.com>
15555
15556         Unreviewed. Fix test expected error message.
15557
15558         * wasm/js-api/element.js:
15559         (assert.throws):
15560
15561 2017-03-06  Caio Lima  <ticaiolima@gmail.com>
15562
15563         op_get_by_id_with_this should use inline caching
15564         https://bugs.webkit.org/show_bug.cgi?id=162124
15565
15566         Reviewed by Saam Barati.
15567
15568         * microbenchmarks/super-getter.js: Added.
15569         (A.prototype.get f):
15570         (A):
15571         (B.prototype.get f):
15572         (B):
15573         * stress/super-force-ic-fail.js: Added.
15574         (let.assert):
15575         (let.aObj.get foo):
15576         (let.obj.jaz):
15577         (let.bObj.get foo):
15578         (let.obj2.foo):
15579         * stress/super-get-by-id.js: Added.
15580         (assert):
15581         (Base):
15582         (Base.prototype.get name):
15583         (Base.prototype.set name):
15584         (Subclass.prototype.get name):
15585         (Subclass):
15586         (getterName):
15587         (getterValue):
15588         (PolymorphicSubclass.prototype.get value):
15589         (PolymorphicSubclass):
15590         (i.let.BaseCode):
15591         (i.get value):
15592         (MegamorphicSubclass.prototype.get value):
15593         (MegamorphicSubclass):
15594         (let.subObj.get value):
15595         (i.catch):
15596         (subObj.get value):
15597         (BaseException):
15598         (BaseException.prototype.get name):
15599         (SubclassException.prototype.get name):
15600         (SubclassException):
15601         (prototype.foo):
15602         (prototype.get name):
15603         (SubclassExceptionComplex.prototype.get name):
15604         (SubclassExceptionComplex):
15605         * stress/super-getter-reset-ic.js: Added.
15606         (let.assert):
15607         (let.B.f):
15608
15609 2017-03-06  Saam Barati  <sbarati@apple.com>
15610
15611         WebAssembly: implement init_expr for Element
15612         https://bugs.webkit.org/show_bug.cgi?id=165888
15613         <rdar://problem/29760199>
15614
15615         Reviewed by Keith Miller.
15616
15617         * wasm/Builder_WebAssemblyBinary.js:
15618         (const.emitters.Element):
15619         * wasm/assert.js:
15620         * wasm/js-api/element.js:
15621         (assert.throws):
15622         (badInstantiation.makeModule):
15623         (badInstantiation.test):
15624         (badInstantiation):
15625         * wasm/js-api/global-error.js:
15626
15627 2017-03-06  Carlos Alberto Lopez Perez  <clopez@igalia.com>
15628
15629         [JSC] [Linux] Test stress/spread-forward-call-varargs-stack-overflow.js fails
15630         https://bugs.webkit.org/show_bug.cgi?id=169206
15631
15632         Unreviewed test gardening.
15633
15634         * stress/spread-forward-call-varargs-stack-overflow.js: Skip on Linux platforms.
15635
15636 2017-03-06  Yusuke Suzuki  <utatane.tea@gmail.com>
15637
15638         [JSC] Allow indexed module namespace object fields
15639         https://bugs.webkit.org/show_bug.cgi?id=168870
15640
15641         Reviewed by Saam Barati.
15642
15643         * wasm/spec-tests/names.wast.js:
15644
15645 2017-03-06  Yusuke Suzuki  <utatane.tea@gmail.com>
15646
15647         Null pointer crash when loading module with unresolved import also as a script file
15648         https://bugs.webkit.org/show_bug.cgi?id=168971
15649
15650         Reviewed by Saam Barati.
15651
15652         * stress/re-execute-error-module.js: Added.
15653         (shouldBe):
15654         (async):
15655         * stress/resources/error-module.js: Added.
15656
15657 2017-03-02  Keith Miller  <keith_miller@apple.com>
15658
15659         WebAssemblyFunction should have Function.prototype as its prototype
15660         https://bugs.webkit.org/show_bug.cgi?id=169101
15661
15662         Reviewed by Filip Pizlo.
15663
15664         * wasm/js-api/web-assembly-function.js: Added.
15665
15666 2017-02-28  Oleksandr Skachkov  <gskachkov@gmail.com>
15667
15668         Use of arguments in arrow function is slow
15669         https://bugs.webkit.org/show_bug.cgi?id=168829
15670
15671         Reviewed by Saam Barati.
15672
15673         * microbenchmarks/arrowfunciton-direct-arguments.js: Added.
15674         (fn):
15675         * microbenchmarks/arrowfunciton-reference-arguments.js: Added.
15676         (fn):
15677
15678 2017-02-27  Commit Queue  <commit-queue@webkit.org>
15679
15680         Unreviewed, rolling out r213019.
15681         https://bugs.webkit.org/show_bug.cgi?id=168925
15682
15683         "It broke 32-bit jsc tests in debug builds" (Requested by
15684         saamyjoon on #webkit).
15685
15686         Reverted changeset:
15687
15688         "op_get_by_id_with_this should use inline caching"
15689         https://bugs.webkit.org/show_bug.cgi?id=162124
15690         http://trac.webkit.org/changeset/213019
15691
15692 2017-02-27  JF Bastien  <jfbastien@apple.com>
15693
15694         WebAssembly: miscellaneous spec fixes part deux
15695         https://bugs.webkit.org/show_bug.cgi?id=168861
15696
15697         Reviewed by Keith Miller.
15698
15699         * wasm.yaml: more passing tests
15700         * wasm/Builder.js: use a Map instead of an Object for the function
15701         index space, because Number entries such as 0 were colliding with
15702         string entries such as "0". This in turn requires some hashing of
15703         objects which are inserted, because Map uses Object's insertion
15704         order when comparing.
15705         (export.default.Builder):
15706         (export.default.Builder.prototype._functionIndexSpaceKeyHash):
15707         (export.default.Builder.prototype._registerFunctionToIndexSpace):
15708         (export.default.Builder.prototype._getFunctionFromIndexSpace):
15709         * wasm/js-api/test_Instance.js: add a FIXME test
15710         * wasm/spec-tests/memory.wast.js:
15711         (assert_unlinkable):
15712         * wasm/spec-tests/names.wast.js:
15713
15714 2017-02-26  Caio Lima  <ticaiolima@gmail.com>
15715
15716         op_get_by_id_with_this should use inline caching
15717         https://bugs.webkit.org/show_bug.cgi?id=162124
15718
15719         Reviewed by Saam Barati.
15720
15721         * microbenchmarks/super-getter.js: Added.
15722         (A.prototype.get f):
15723         (A):
15724         (B.prototype.get f):
15725         (B):
15726         * stress/super-force-ic-fail.js: Added.
15727         (let.assert):
15728         (let.aObj.get foo):
15729         (let.obj.jaz):
15730         (let.bObj.get foo):
15731         (let.obj2.foo):
15732         * stress/super-get-by-id.js: Added.
15733         (assert):
15734         (Base):
15735         (Base.prototype.get name):
15736         (Base.prototype.set name):
15737         (Subclass.prototype.get name):
15738         (Subclass):
15739         (getterName):
15740         (getterValue):
15741         (PolymorphicSubclass.prototype.get value):
15742         (PolymorphicSubclass):
15743         (i.let.BaseCode):
15744         (i.get value):
15745         (MegamorphicSubclass.prototype.get value):
15746         (MegamorphicSubclass):
15747         (let.subObj.get value):
15748         (i.catch):
15749         (subObj.get value):
15750         (BaseException):
15751         (BaseException.prototype.get name):
15752         (SubclassException.prototype.get name):
15753         (SubclassException):
15754         (prototype.foo):
15755         (prototype.get name):
15756         (SubclassExceptionComplex.prototype.get name):
15757         (SubclassExceptionComplex):
15758         * stress/super-getter-reset-ic.js: Added.
15759         (let.assert):
15760         (let.B.f):
15761
15762 2017-02-24  JF Bastien  <jfbastien@apple.com>
15763
15764         WebAssembly: miscellaneous spec fixes
15765         https://bugs.webkit.org/show_bug.cgi?id=168822
15766
15767         Reviewed by Saam Barati.
15768
15769         * wasm.yaml: mark some skip tests as normal, now that they pass
15770         * wasm/Builder.js: error message was wrong, causing extra error if hit
15771         * wasm/js-api/global-error.js: new tests
15772         (assert.throws):
15773         * wasm/spec-tests/call.wast.js: comment out stack check tests
15774         * wasm/spec-tests/call_indirect.wast.js: comment out stack check tests
15775         * wasm/spec-tests/fac.wast.js: comment out stack check tests
15776         * wasm/spec-tests/float_exprs.wast.js: wabt is wrong, bug reported, we should update
15777         * wasm/spec-tests/imports.wast.js: bug in old wabt, fixed in recent wabt
15778         (assert_unlinkable):
15779
15780 2017-02-23  Saam Barati  <sbarati@apple.com>
15781
15782         Intrinsicify parseInt
15783         https://bugs.webkit.org/show_bug.cgi?id=168627
15784
15785         Reviewed by Filip Pizlo.
15786
15787         * stress/parse-int-intrinsic.js: Added.
15788         (assert):
15789         (testIntrinsic.let.s):
15790         (testIntrinsic):
15791         (testIntrinsic2.baz):
15792         (testIntrinsic2):
15793         (testIntrinsic3.foo):
15794         (testIntrinsic3):
15795         (testIntrinsic4.foo):
15796         (testIntrinsic4):
15797         (testIntrinsic5.foo):
15798         (testIntrinsic5):
15799         (testIntrinsic6.foo):
15800         (testIntrinsic6):
15801         (testIntrinsic7.foo):
15802         (testIntrinsic7):
15803
15804 2017-02-23  JF Bastien  <jfbastien@apple.com>
15805
15806         WebAssembly: support 0x1 version
15807         https://bugs.webkit.org/show_bug.cgi?id=168672
15808
15809         Reviewed by Keith Miller.
15810
15811         Update the version number for all the tests. Note that the spec
15812         tests are only updated with a new version number because spec+wabt
15813         aren't ready for 0x1 yet. This is tracked by bug #168784.
15814
15815         * wasm/import-spec-tests.rb: use the new spec repository layout
15816         * wasm/js-api/test_basic_api.js:
15817         * wasm/self-test/test_BuilderWebAssembly.js:
15818         (EmptyModule):
15819         (CustomSection):
15820         * wasm/spec-tests/address.wast.js:
15821         * wasm/spec-tests/binary.wast.js:
15822         * wasm/spec-tests/block.wast.js:
15823         * wasm/spec-tests/br.wast.js:
15824         * wasm/spec-tests/br_if.wast.js:
15825         * wasm/spec-tests/br_table.wast.js:
15826         * wasm/spec-tests/break-drop.wast.js:
15827         * wasm/spec-tests/call.wast.js:
15828         * wasm/spec-tests/call_indirect.wast.js:
15829         * wasm/spec-tests/comments.wast.js:
15830         * wasm/spec-tests/conversions.wast.js:
15831         * wasm/spec-tests/custom_section.wast.js:
15832         * wasm/spec-tests/endianness.wast.js:
15833         * wasm/spec-tests/exports.wast.js:
15834         * wasm/spec-tests/f32.wast.js:
15835         * wasm/spec-tests/f32_cmp.wast.js:
15836         * wasm/spec-tests/f64.wast.js:
15837         * wasm/spec-tests/f64_cmp.wast.js:
15838         * wasm/spec-tests/fac.wast.js:
15839         * wasm/spec-tests/float_exprs.wast.js:
15840         * wasm/spec-tests/float_literals.wast.js:
15841         * wasm/spec-tests/float_memory.wast.js:
15842         * wasm/spec-tests/float_misc.wast.js:
15843         * wasm/spec-tests/forward.wast.js:
15844         * wasm/spec-tests/func.wast.js:
15845         * wasm/spec-tests/func_ptrs.wast.js:
15846         * wasm/spec-tests/get_local.wast.js:
15847         * wasm/spec-tests/globals.wast.js:
15848         * wasm/spec-tests/i32.wast.js:
15849         * wasm/spec-tests/i64.wast.js:
15850         * wasm/spec-tests/imports.wast.js:
15851         * wasm/spec-tests/int_exprs.wast.js:
15852         * wasm/spec-tests/int_literals.wast.js:
15853         * wasm/spec-tests/left-to-right.wast.js:
15854         * wasm/spec-tests/linking.wast.js:
15855         * wasm/spec-tests/loop.wast.js:
15856         * wasm/spec-tests/memory.wast.js:
15857         * wasm/spec-tests/memory_redundancy.wast.js:
15858         * wasm/spec-tests/memory_trap.wast.js:
15859         * wasm/spec-tests/names.wast.js:
15860         * wasm/spec-tests/nop.wast.js:
15861         * wasm/spec-tests/resizing.wast.js:
15862         * wasm/spec-tests/return.wast.js:
15863         * wasm/spec-tests/select.wast.js:
15864         * wasm/spec-tests/set_local.wast.js:
15865         * wasm/spec-tests/skip-stack-guard-page.wast.js:
15866         * wasm/spec-tests/stack.wast.js:
15867         * wasm/spec-tests/start.wast.js:
15868         * wasm/spec-tests/store_retval.wast.js:
15869         * wasm/spec-tests/switch.wast.js:
15870         * wasm/spec-tests/tee_local.wast.js:
15871         * wasm/spec-tests/traps.wast.js:
15872         * wasm/spec-tests/typecheck.wast.js:
15873         * wasm/spec-tests/unreachable.wast.js:
15874         * wasm/spec-tests/unwind.wast.js:
15875         * wasm/wasm.json:
15876
15877 2017-02-22  Yusuke Suzuki  <utatane.tea@gmail.com>
15878
15879         JSModuleNamespace object should have IC
15880         https://bugs.webkit.org/show_bug.cgi?id=160590
15881
15882         Reviewed by Saam Barati.
15883
15884         * modules/module-assert-access-binding.js: Added.
15885         * modules/module-assert-access-namespace.js: Added.
15886         * modules/namespace-empty.js: Added.
15887         (from.string_appeared_here.access):
15888         (i.shouldThrow):
15889         * stress/module-namespace-access-change.js: Added.
15890         (shouldBe):
15891         (access):
15892         (import.string_appeared_here.then):
15893         * stress/module-namespace-access-non-constant.js: Added.
15894         (shouldBe):
15895         (import.string_appeared_here.then):
15896         * stress/module-namespace-access-poly.js: Added.
15897         (shouldBe):
15898         (access):
15899         (import.string_appeared_here.then):
15900         * stress/module-namespace-access-transitive-exports.js: Added.
15901         (shouldBe):
15902         (import.string_appeared_here.then):
15903         * stress/module-namespace-access.js: Added.
15904         (shouldBe):
15905         (import.string_appeared_here.then):
15906         * stress/resources/module-namespace-access-transitive-exports-2.js: Added.
15907         (export.cocoa):
15908         (export.change):
15909         * stress/resources/module-namespace-access-transitive-exports.js: Added.
15910         * stress/resources/module-namespace-access.js: Added.
15911         (export.cocoa):
15912         (export.change):
15913
15914 2017-02-20  Filip Pizlo  <fpizlo@apple.com>
15915
15916         The collector thread should only start when the mutator doesn't have heap access
15917         https://bugs.webkit.org/show_bug.cgi?id=167737
15918
15919         Reviewed by Keith Miller.
15920
15921         Add versions of splay that flash heap access, to simulate what might happen if a third-party app
15922         was running concurrent GC. In this case, we might actually start the collector thread.
15923
15924         * stress/splay-flash-access-1ms.js: Added.
15925         (performance.now):
15926         (this.Setup.setup.setup):
15927         (this.TearDown.tearDown.tearDown):
15928         (Benchmark):
15929         (BenchmarkResult):
15930         (BenchmarkResult.prototype.valueOf):
15931         (BenchmarkSuite):
15932         (alert):
15933         (Math.random):
15934         (BenchmarkSuite.ResetRNG):
15935         (RunStep):
15936         (BenchmarkSuite.RunSuites):
15937         (BenchmarkSuite.CountBenchmarks):
15938         (BenchmarkSuite.GeometricMean):
15939         (BenchmarkSuite.GeometricMeanTime):
15940         (BenchmarkSuite.AverageAbovePercentile):
15941         (BenchmarkSuite.GeometricMeanLatency):
15942         (BenchmarkSuite.FormatScore):
15943         (BenchmarkSuite.prototype.NotifyStep):
15944         (BenchmarkSuite.prototype.NotifyResult):
15945         (BenchmarkSuite.prototype.NotifyError):
15946         (BenchmarkSuite.prototype.RunSingleBenchmark):
15947         (RunNextSetup):
15948         (RunNextBenchmark):
15949         (RunNextTearDown):
15950         (BenchmarkSuite.prototype.RunStep):
15951         (GeneratePayloadTree):
15952         (GenerateKey):
15953         (SplayUpdateStats):
15954         (InsertNewNode):
15955         (SplaySetup):
15956         (SplayTearDown):
15957         (SplayRun):
15958         (SplayTree):
15959         (SplayTree.prototype.isEmpty):
15960         (SplayTree.prototype.insert):
15961         (SplayTree.prototype.remove):
15962         (SplayTree.prototype.find):
15963         (SplayTree.prototype.findMax):
15964         (SplayTree.prototype.findGreatestLessThan):
15965         (SplayTree.prototype.exportKeys):
15966         (SplayTree.prototype.splay_):
15967         (SplayTree.Node):
15968         (SplayTree.Node.prototype.traverse_):
15969         (jscSetUp):
15970         (jscTearDown):
15971         (jscRun):
15972         (averageAbovePercentile):
15973         (printPercentile):
15974         * stress/splay-flash-access.js: Added.
15975         (performance.now):
15976         (this.Setup.setup.setup):
15977         (this.TearDown.tearDown.tearDown):
15978         (Benchmark):
15979         (BenchmarkResult):
15980         (BenchmarkResult.prototype.valueOf):
15981         (BenchmarkSuite):
15982         (alert):
15983         (Math.random):
15984         (BenchmarkSuite.ResetRNG):
15985         (RunStep):
15986         (BenchmarkSuite.RunSuites):
15987         (BenchmarkSuite.CountBenchmarks):
15988         (BenchmarkSuite.GeometricMean):
15989         (BenchmarkSuite.GeometricMeanTime):
15990         (BenchmarkSuite.AverageAbovePercentile):
15991         (BenchmarkSuite.GeometricMeanLatency):
15992         (BenchmarkSuite.FormatScore):
15993         (BenchmarkSuite.prototype.NotifyStep):
15994         (BenchmarkSuite.prototype.NotifyResult):
15995         (BenchmarkSuite.prototype.NotifyError):
15996         (BenchmarkSuite.prototype.RunSingleBenchmark):
15997         (RunNextSetup):
15998         (RunNextBenchmark):
15999         (RunNextTearDown):
16000         (BenchmarkSuite.prototype.RunStep):
16001         (GeneratePayloadTree):
16002         (GenerateKey):
16003         (SplayUpdateStats):
16004         (InsertNewNode):
16005         (SplaySetup):
16006         (SplayTearDown):
16007         (SplayRun):
16008         (SplayTree):
16009         (SplayTree.prototype.isEmpty):
16010         (SplayTree.prototype.insert):
16011         (SplayTree.prototype.remove):
16012         (SplayTree.prototype.find):
16013         (SplayTree.prototype.findMax):
16014         (SplayTree.prototype.findGreatestLessThan):
16015         (SplayTree.prototype.exportKeys):
16016         (SplayTree.prototype.splay_):
16017         (SplayTree.Node):
16018         (SplayTree.Node.prototype.traverse_):
16019         (jscSetUp):
16020         (jscTearDown):
16021         (jscRun):
16022         (averageAbovePercentile):
16023         (printPercentile):
16024
16025 2017-02-21  Ryan Haddad  <ryanhaddad@apple.com>
16026
16027         Unreviewed, rolling out r212712.
16028
16029         This change broke the CLoop build.
16030
16031         Reverted changeset:
16032
16033         "JSModuleNamespace object should have IC"
16034         https://bugs.webkit.org/show_bug.cgi?id=160590
16035         http://trac.webkit.org/changeset/212712
16036
16037 2017-02-21  Yusuke Suzuki  <utatane.tea@gmail.com>
16038
16039         JSModuleNamespace object should have IC
16040         https://bugs.webkit.org/show_bug.cgi?id=160590
16041
16042         Reviewed by Saam Barati.
16043
16044         * modules/module-assert-access-binding.js: Added.
16045         * modules/module-assert-access-namespace.js: Added.
16046         * modules/namespace-empty.js: Added.
16047         (from.string_appeared_here.access):
16048         (i.shouldThrow):
16049         * stress/module-namespace-access-change.js: Added.
16050         (shouldBe):
16051         (access):
16052         (import.string_appeared_here.then):
16053         * stress/module-namespace-access-non-constant.js: Added.
16054         (shouldBe):
16055         (import.string_appeared_here.then):
16056         * stress/module-namespace-access-poly.js: Added.
16057         (shouldBe):
16058         (access):
16059         (import.string_appeared_here.then):
16060         * stress/module-namespace-access-transitive-exports.js: Added.
16061         (shouldBe):
16062         (import.string_appeared_here.then):
16063         * stress/module-namespace-access.js: Added.
16064         (shouldBe):
16065         (import.string_appeared_here.then):
16066         * stress/resources/module-namespace-access-transitive-exports-2.js: Added.
16067         (export.cocoa):
16068         (export.change):
16069         * stress/resources/module-namespace-access-transitive-exports.js: Added.
16070         * stress/resources/module-namespace-access.js: Added.
16071         (export.cocoa):
16072         (export.change):
16073
16074 2017-02-21  Yusuke Suzuki  <utatane.tea@gmail.com>
16075
16076         ASSERTION FAILED: "!scope.exception()" with Object.isSealed/isFrozen and uninitialized module bindings
16077         https://bugs.webkit.org/show_bug.cgi?id=168605
16078
16079         Reviewed by Saam Barati.
16080
16081         * modules/module-namespace-is-frozen.js: Added.
16082         (from.string_appeared_here.shouldThrow):
16083         (export.b):
16084         * modules/module-namespace-is-sealed.js: Added.
16085         (from.string_appeared_here.shouldThrow):
16086         (export.b):
16087
16088 2017-02-19  Commit Queue  <commit-queue@webkit.org>
16089
16090         Unreviewed, rolling out r212466.
16091         https://bugs.webkit.org/show_bug.cgi?id=168577
16092
16093         causes crashes on AArch64 on linux, maybe it's causing crashes
16094         on iOS too (Requested by pizlo on #webkit).
16095
16096         Reverted changeset:
16097
16098         "The collector thread should only start when the mutator
16099         doesn't have heap access"
16100         https://bugs.webkit.org/show_bug.cgi?id=167737
16101         http://trac.webkit.org/changeset/212466
16102
16103 2017-02-10  Filip Pizlo  <fpizlo@apple.com>
16104
16105         The collector thread should only start when the mutator doesn't have heap access
16106         https://bugs.webkit.org/show_bug.cgi?id=167737
16107
16108         Reviewed by Keith Miller.
16109
16110         Add versions of splay that flash heap access, to simulate what might happen if a third-party app
16111         was running concurrent GC. In this case, we might actually start the collector thread.
16112
16113         * stress/splay-flash-access-1ms.js: Added.
16114         (performance.now):
16115         (this.Setup.setup.setup):
16116         (this.TearDown.tearDown.tearDown):
16117         (Benchmark):
16118         (BenchmarkResult):
16119         (BenchmarkResult.prototype.valueOf):
16120         (BenchmarkSuite):
16121         (alert):
16122         (Math.random):
16123         (BenchmarkSuite.ResetRNG):
16124         (RunStep):
16125         (BenchmarkSuite.RunSuites):
16126         (BenchmarkSuite.CountBenchmarks):
16127         (BenchmarkSuite.GeometricMean):
16128         (BenchmarkSuite.GeometricMeanTime):
16129         (BenchmarkSuite.AverageAbovePercentile):
16130         (BenchmarkSuite.GeometricMeanLatency):
16131         (BenchmarkSuite.FormatScore):
16132         (BenchmarkSuite.prototype.NotifyStep):
16133         (BenchmarkSuite.prototype.NotifyResult):
16134         (BenchmarkSuite.prototype.NotifyError):
16135         (BenchmarkSuite.prototype.RunSingleBenchmark):
16136         (RunNextSetup):
16137         (RunNextBenchmark):
16138         (RunNextTearDown):
16139         (BenchmarkSuite.prototype.RunStep):
16140         (GeneratePayloadTree):
16141         (GenerateKey):
16142         (SplayUpdateStats):
16143         (InsertNewNode):
16144         (SplaySetup):
16145         (SplayTearDown):
16146         (SplayRun):
16147         (SplayTree):
16148         (SplayTree.prototype.isEmpty):
16149         (SplayTree.prototype.insert):
16150         (SplayTree.prototype.remove):
16151         (SplayTree.prototype.find):
16152         (SplayTree.prototype.findMax):
16153         (SplayTree.prototype.findGreatestLessThan):
16154         (SplayTree.prototype.exportKeys):
16155         (SplayTree.prototype.splay_):
16156         (SplayTree.Node):
16157         (SplayTree.Node.prototype.traverse_):
16158         (jscSetUp):
16159         (jscTearDown):
16160         (jscRun):
16161         (averageAbovePercentile):
16162         (printPercentile):
16163         * stress/splay-flash-access.js: Added.
16164         (performance.now):
16165         (this.Setup.setup.setup):
16166         (this.TearDown.tearDown.tearDown):
16167         (Benchmark):
16168         (BenchmarkResult):
16169         (BenchmarkResult.prototype.valueOf):
16170         (BenchmarkSuite):
16171         (alert):
16172         (Math.random):
16173         (BenchmarkSuite.ResetRNG):
16174         (RunStep):
16175         (BenchmarkSuite.RunSuites):
16176         (BenchmarkSuite.CountBenchmarks):
16177         (BenchmarkSuite.GeometricMean):
16178         (BenchmarkSuite.GeometricMeanTime):
16179         (BenchmarkSuite.AverageAbovePercentile):
16180         (BenchmarkSuite.GeometricMeanLatency):
16181         (BenchmarkSuite.FormatScore):
16182         (BenchmarkSuite.prototype.NotifyStep):
16183         (BenchmarkSuite.prototype.NotifyResult):
16184         (BenchmarkSuite.prototype.NotifyError):
16185         (BenchmarkSuite.prototype.RunSingleBenchmark):
16186         (RunNextSetup):
16187         (RunNextBenchmark):
16188         (RunNextTearDown):
16189         (BenchmarkSuite.prototype.RunStep):
16190         (GeneratePayloadTree):
16191         (GenerateKey):
16192         (SplayUpdateStats):
16193         (InsertNewNode):
16194         (SplaySetup):
16195         (SplayTearDown):
16196         (SplayRun):
16197         (SplayTree):
16198         (SplayTree.prototype.isEmpty):
16199         (SplayTree.prototype.insert):
16200         (SplayTree.prototype.remove):
16201         (SplayTree.prototype.find):
16202         (SplayTree.prototype.findMax):
16203         (SplayTree.prototype.findGreatestLessThan):
16204         (SplayTree.prototype.exportKeys):
16205         (SplayTree.prototype.splay_):
16206         (SplayTree.Node):
16207         (SplayTree.Node.prototype.traverse_):
16208         (jscSetUp):
16209         (jscTearDown):
16210         (jscRun):
16211         (averageAbovePercentile):
16212         (printPercentile):
16213
16214 2017-02-16  Yusuke Suzuki  <utatane.tea@gmail.com>
16215
16216         [JSC] Update module namespace object according to the latest ECMA262
16217         https://bugs.webkit.org/show_bug.cgi?id=168280
16218
16219         Reviewed by Saam Barati.
16220
16221         * modules/namespace-object-symbol-iterator-name.js:
16222         * modules/namespace-object-typed-array-fast-path.js:
16223         * modules/namespace.js:
16224         (shouldBe.JSON.stringify.Reflect.getOwnPropertyDescriptor):
16225         (shouldThrow):
16226
16227 2017-02-11  Yusuke Suzuki  <utatane.tea@gmail.com>
16228
16229         [JSC] Implement (Shared)ArrayBuffer.prototype.byteLength
16230         https://bugs.webkit.org/show_bug.cgi?id=166476
16231
16232         Reviewed by Saam Barati.
16233
16234         * ChakraCore/test/typedarray/arraybufferType.baseline-jsc:
16235         * stress/array-buffer-byte-length.js: Added.
16236         (shouldBe):
16237         (shouldThrow):
16238         (Symbol):
16239         * stress/reflect-set.js:
16240
16241 2017-02-10  Saam Barati  <sbarati@apple.com>
16242
16243         Object allocation sinking phase doesn't properly handle control flow when emitting a PutHint of a materialized object into a PromotedHeapLocation of a still sunken object
16244         https://bugs.webkit.org/show_bug.cgi?id=168140
16245         <rdar://problem/30205880>
16246
16247         Reviewed by Filip Pizlo.
16248
16249         * stress/allocation-sinking-puthint-control-flow.js: Added.
16250         (e):
16251         (bar):
16252         (let.y):
16253         (else.let.y):
16254         (baz):
16255         (foo):
16256         (catch):
16257
16258 2017-02-09  Mark Lam  <mark.lam@apple.com>
16259
16260         B3::Procedure::deleteOrphans() should neutralize upsilons with dead phis.
16261         https://bugs.webkit.org/show_bug.cgi?id=167437
16262         <rdar://problem/30198083>
16263
16264         Reviewed by Filip Pizlo.
16265
16266         * stress/b3-delete-orphans-should-neutralize-upsilons-with-dead-phis.js: Added.
16267
16268 2017-02-09  Saam Barati  <sbarati@apple.com>
16269
16270         Sloppy mode: We don't properly hoist functions names "arguments" when we have a non-simple parameter list
16271         https://bugs.webkit.org/show_bug.cgi?id=167319
16272         <rdar://problem/30149432>
16273
16274         Reviewed by Mark Lam.
16275
16276         * stress/sloppy-mode-hoist-arguments-function-non-simple-parameter-list.js: Added.
16277         (assert):
16278         (assert.arguments):
16279         (assert.b):
16280         (x.arguments):
16281         (x.b):
16282         (x):
16283
16284 2017-02-09  Mark Lam  <mark.lam@apple.com>
16285
16286         Fix max length check in ArrayPrototype.js' concatSlowPath().
16287         https://bugs.webkit.org/show_bug.cgi?id=167270
16288         <rdar://problem/30128133>
16289
16290         Reviewed by Filip Pizlo.
16291
16292         * stress/array-prototype-concat-of-long-spliced-arrays.js: Added.
16293         * stress/array-prototype-concat-of-long-spliced-arrays2.js: Added.
16294
16295 2017-02-09  Keith Miller  <keith_miller@apple.com>
16296
16297         We should not allow Function.caller to be used on native functions
16298         https://bugs.webkit.org/show_bug.cgi?id=165628
16299
16300         Reviewed by Mark Lam.
16301
16302         * stress/caller-native-code.js: Added.
16303         (f):
16304
16305 2017-02-04  Yusuke Suzuki  <utatane.tea@gmail.com>
16306
16307         [JSC] Add operationToInt32SensibleSlow to optimize kraken pbkdf2 and sha256
16308         https://bugs.webkit.org/show_bug.cgi?id=167736
16309
16310         Reviewed by Saam Barati.
16311
16312         * stress/to-int32-sensible.js: Added.
16313         (shouldBe):
16314         (toInt32):
16315         (test):
16316
16317 2017-02-01  Yusuke Suzuki  <utatane.tea@gmail.com>
16318
16319         Unreviewed, remove loop
16320         https://bugs.webkit.org/show_bug.cgi?id=167694
16321
16322         It causes timeout.
16323         Original bug can be tested even without this loop.
16324
16325         * stress/arity-fixup-should-not-touch-stack-area-below-sp.js:
16326
16327 2017-02-01  Yusuke Suzuki  <utatane.tea@gmail.com>
16328
16329         ArityFixup should adjust SP first
16330         https://bugs.webkit.org/show_bug.cgi?id=167239
16331
16332         Reviewed by Michael Saboff.
16333
16334         Significantly large arity fixup reliably causes this crash.
16335
16336         * stress/arity-fixup-should-not-touch-stack-area-below-sp.js: Added.
16337
16338 2017-01-31  Filip Pizlo  <fpizlo@apple.com>
16339
16340         Move slow-running microbenchmarks out of JSTests/microbenchmarks
16341         https://bugs.webkit.org/show_bug.cgi?id=167676
16342
16343         Reviewed by Saam Barati.
16344
16345         The microbenchmarks directory is profitable when it's cheap to run. This change moves very slow
16346         tests (>=200ms running time on my machine) and puts them in JSTests/slowMicrobenchmarks instead.
16347         That directory is run only through `slow!; defaultQuickRun` and is not run by run-jsc-benchmarks.
16348         This is a big progression in test running time. But because it frontloads more slow tests, the
16349         tests will seem to run more slowly when you first start the test runner.
16350
16351         * microbenchmarks/default-derived-constructor.js: Removed.
16352         * microbenchmarks/dense-set.js: Removed.
16353         * microbenchmarks/ftl-polymorphic-div.js: Removed.
16354         * microbenchmarks/ftl-polymorphic-mul.js: Removed.
16355         * microbenchmarks/function-bind-inlining.js: Removed.
16356         * microbenchmarks/function-bind-no-inlining.js: Removed.
16357         * microbenchmarks/large-map-iteration-with-additions.js: Removed.
16358         * microbenchmarks/large-map-iteration-with-mutation.js: Removed.
16359         * microbenchmarks/map-get-get-cse.js: Removed.
16360         * microbenchmarks/misc-bugs-847389-jpeg2000.js: Removed.
16361         * microbenchmarks/spread-small-array.js: Removed.
16362         * microbenchmarks/v8-raytrace-with-try-catch-high-frequency-throws.js: Removed.
16363         * slowMicrobenchmarks: Added.
16364         * slowMicrobenchmarks.yaml: Added.
16365         * slowMicrobenchmarks/README: Added.
16366         * slowMicrobenchmarks/default-derived-constructor.js: Copied from JSTests/microbenchmarks/default-derived-constructor.js.
16367         * slowMicrobenchmarks/dense-set.js: Copied from JSTests/microbenchmarks/dense-set.js.
16368         * slowMicrobenchmarks/ftl-polymorphic-div.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-div.js.
16369         * slowMicrobenchmarks/ftl-polymorphic-mul.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-mul.js.
16370         * slowMicrobenchmarks/function-bind-inlining.js: Copied from JSTests/microbenchmarks/function-bind-inlining.js.
16371         * slowMicrobenchmarks/function-bind-no-inlining.js: Copied from JSTests/microbenchmarks/function-bind-no-inlining.js.
16372         * slowMicrobenchmarks/large-map-iteration-with-additions.js: Copied from JSTests/microbenchmarks/large-map-iteration-with-additions.js.
16373         * slowMicrobenchmarks/large-map-iteration-with-mutation.js: Copied from JSTests/microbenchmarks/large-map-iteration-with-mutation.js.
16374         * slowMicrobenchmarks/map-get-get-cse.js: Copied from JSTests/microbenchmarks/map-get-get-cse.js.
16375         * slowMicrobenchmarks/misc-bugs-847389-jpeg2000.js: Copied from JSTests/microbenchmarks/misc-bugs-847389-jpeg2000.js.
16376         * slowMicrobenchmarks/spread-small-array.js: Copied from JSTests/microbenchmarks/spread-small-array.js.
16377         * slowMicrobenchmarks/v8-raytrace-with-try-catch-high-frequency-throws.js: Copied from JSTests/microbenchmarks/v8-raytrace-with-try-catch-high-frequency-throws.js.
16378
16379 2017-01-30  Yusuke Suzuki  <utatane.tea@gmail.com>
16380
16381         [JSC] Do not reject WebAssembly.compile() with Exception
16382         https://bugs.webkit.org/show_bug.cgi?id=167585
16383
16384         Reviewed by Mark Lam.
16385
16386         * wasm/js-api/Module-compile.js:
16387         (async.testPromiseAPI):
16388
16389 2017-01-27  Yusuke Suzuki  <utatane.tea@gmail.com>
16390
16391         Lift template escape sequence restrictions in tagged templates
16392         https://bugs.webkit.org/show_bug.cgi?id=166871
16393
16394         Reviewed by Saam Barati.
16395
16396         Update the error messages and add new tests.
16397
16398         * ChakraCore/test/es6/unicode_6_identifier_Blue524737.baseline-jsc:
16399         * stress/lift-template-literal.js: Added.
16400         (dump):
16401         (testTag.return.tag):
16402         (testTag):
16403         * stress/template-literal-syntax.js:
16404
16405 2017-01-26  Mark Lam  <mark.lam@apple.com>
16406
16407         Fix missing exception check in genericTypedArrayViewProtoFuncSet().
16408         https://bugs.webkit.org/show_bug.cgi?id=166812
16409         <rdar://problem/29916672>
16410
16411         Reviewed by Saam Barati.
16412
16413         * stress/regress-166812.js: Added.
16414
16415 2017-01-26  Commit Queue  <commit-queue@webkit.org>
16416
16417         Unreviewed, rolling out r211224.
16418         https://bugs.webkit.org/show_bug.cgi?id=167479
16419
16420         "It was a Kraken performance regression" (Requested by
16421         saamyjoon on #webkit).
16422
16423         Reverted changeset:
16424
16425         "OSR entry: delay outer-loop compilation when at inner-loop"
16426         https://bugs.webkit.org/show_bug.cgi?id=167149
16427         http://trac.webkit.org/changeset/211224
16428
16429 2017-01-26  JF Bastien  <jfbastien@apple.com>
16430
16431         OSR entry: delay outer-loop compilation when at inner-loop
16432         https://bugs.webkit.org/show_bug.cgi?id=167149
16433
16434         Reviewed by Filip Pizlo.
16435
16436         Try to be mean to OSR entry by using nested loops, and having
16437         non-int32 types or truly varying types.
16438
16439         Mandelbrot currently never tiers up to FTL because it exits too
16440         many times before this. That shouldn't happen because it's just
16441         numbers and int32s. I'll file a bug to fix this.
16442
16443         * microbenchmarks/mandelbrot.js: Added.
16444         (mandelbrot):
16445         (printable):
16446         * microbenchmarks/nonude.js: Added.
16447         (Array.prototype.remove):
16448         (const.u):
16449         (const.load):
16450         (const.scan):
16451         (const.main):
16452
16453 2017-01-25  Saam Barati  <sbarati@apple.com>
16454
16455         WebAssembly JS API: coerce return values from imports
16456         https://bugs.webkit.org/show_bug.cgi?id=165480
16457         <rdar://problem/29760318>
16458
16459         Reviewed by Yusuke Suzuki.
16460
16461         * wasm/function-tests/function-import-return-value.js: Added.
16462         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.tests.x.assert.eq):
16463         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.tests.Math.fround):
16464         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.type.of.Reflect.ownKeys):
16465         (test.1):
16466         (assert.truthy):
16467         (assert.throws):
16468
16469 2017-01-25  Filip Pizlo  <fpizlo@apple.com>
16470
16471         jsc.cpp should have the $.agent stuff for testing SAB
16472         https://bugs.webkit.org/show_bug.cgi?id=167431
16473
16474         Reviewed by Saam Barati.
16475
16476         Add a very basic test of Atomics using $.agent. This is based on
16477         LayoutTests/workers/sab/simple.html.
16478
16479         * stress/lars-sab-workers.js: Added.
16480         (startWorker):
16481         (resources):
16482         (wake):
16483         (else):
16484
16485 2017-01-24  Filip Pizlo  <fpizlo@apple.com>
16486
16487         Atomics.store should return the int-converted value according to toInteger
16488         https://bugs.webkit.org/show_bug.cgi?id=167399
16489
16490         Reviewed by Saam Barati.
16491
16492         * stress/atomics-add-uint32.js: Added.
16493         * stress/atomics-store-return.js: Fix the test to match what the spec wants.
16494
16495 2017-01-24  Yusuke Suzuki  <utatane.tea@gmail.com>
16496
16497         [JSC] Optimize Number#toString with Int52
16498         https://bugs.webkit.org/show_bug.cgi?id=167303
16499
16500         Reviewed by Sam Weinig.
16501
16502         * stress/to-string-with-int52.js: Added.
16503         (shouldBe):
16504
16505 2017-01-24  Filip Pizlo  <fpizlo@apple.com>
16506
16507         Atomics.store should return the int-converted value, not the value that it stored
16508         https://bugs.webkit.org/show_bug.cgi?id=167395
16509
16510         Reviewed by Saam Barati.
16511
16512         * stress/atomics-store-return.js: Added.
16513
16514 2017-01-24  Filip Pizlo  <fpizlo@apple.com>
16515
16516         -0 is a valid array index and AtomicsObject should know this
16517         https://bugs.webkit.org/show_bug.cgi?id=167386
16518
16519         Reviewed by Mark Lam.
16520
16521         * stress/atomics-neg-zero.js: Added.
16522
16523 2017-01-23  Saam Barati  <sbarati@apple.com>
16524
16525         https://bugs.webkit.org/show_bug.cgi?id=167247
16526         JSC: operationSpreadGeneric uses the wrong global object for the builtin function and slow_path_spread consults the wrong global object to prove if the iterator protocol is unobservable
16527         <rdar://problem/30121809>
16528
16529         Reviewed by Filip Pizlo.
16530
16531         * stress/spread-consults-correct-global-object.js: Added.
16532         (assert):
16533         (spread):
16534         * stress/spread-correct-global-object-on-exception.js: Added.
16535         (assert):
16536         (spread):
16537         (const.objectText.let.o.Symbol.iterator):
16538         (catch):
16539
16540 2017-01-21  Yusuke Suzuki  <utatane.tea@gmail.com>
16541
16542         dynamic import is ambiguous with import declaration at module code
16543         https://bugs.webkit.org/show_bug.cgi?id=167098
16544
16545         Reviewed by Darin Adler.
16546
16547         * modules/import-call.js: Added.
16548         (from.string_appeared_here.import.string_appeared_here.then):
16549         * modules/import-call/main.js: Added.
16550         * stress/import-syntax.js:
16551         (async):
16552
16553 2017-01-19  Skachkov Oleksandr  <gskachkov@gmail.com>
16554
16555         "this" missing after await in async arrow function
16556         https://bugs.webkit.org/show_bug.cgi?id=166919
16557
16558         Reviewed by Saam Barati.
16559
16560         * stress/async-arrow-functions-lexical-binding-in-class.js:
16561         (ChildClass.prototype.asyncThisPropWithAwaitBody):
16562         (ChildClass.prototype.asyncThisPropInEvalWithAwaitBody):
16563         (ChildClass.prototype.asyncThisValueBodyWithAwait):
16564         (ChildClass.prototype.asyncThisValueInEvalWithAwaitBody):
16565         (ChildClass):
16566         (ChildClass3):
16567         (ChildClass3.prototype.classValue):
16568         (ChildClass3.prototype.get classProperty):
16569         * stress/async-arrow-functions-lexical-new.target-binding.js:
16570         (C2WithAwait):
16571
16572 2017-01-16  Filip Pizlo  <fpizlo@apple.com>
16573
16574         Make opaque root scanning truly constraint-based
16575         https://bugs.webkit.org/show_bug.cgi?id=165760
16576
16577         Reviewed by Geoffrey Garen.
16578
16579         Added this test, which demonstrates the benefit of having a dedicated string subspace.
16580
16581         * microbenchmarks/stringalloc.js: Added.
16582
16583 2017-01-17  Michael Saboff  <msaboff@apple.com>
16584
16585         Nested parenthesized regular expressions with non-zero minimum counts appear to hang and use lots of memory
16586         https://bugs.webkit.org/show_bug.cgi?id=167125
16587
16588         Reviewed by Filip Pizlo.
16589
16590         * microbenchmarks/regexp-nested-nonzero-min-counted-parens.js: Added.
16591         New test with limits that run slow and take a reasonable amount of memory
16592         before the change and run fast, using little memory with the change.
16593
16594 2017-01-14  Yusuke Suzuki  <utatane.tea@gmail.com>
16595
16596         Annotate large string tests with largeHeap
16597         https://bugs.webkit.org/show_bug.cgi?id=167054
16598
16599         Reviewed by Filip Pizlo.
16600
16601         * microbenchmarks/dense-set.js:
16602         * microbenchmarks/lots-of-fields.js:
16603         * stress/joined-strings-should-not-exceed-max-string-length.js:
16604         * stress/make-large-string-jit-strcat.js:
16605         * stress/make-large-string-jit.js:
16606         * stress/make-large-string-strcat.js:
16607         * stress/make-large-string.js:
16608         * stress/string-joining-long-strings-should-not-crash.js:
16609         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js:
16610
16611 2017-01-14  Yusuke Suzuki  <utatane.tea@gmail.com>
16612
16613         Reserve capacity for StringBuilder in unescape
16614         https://bugs.webkit.org/show_bug.cgi?id=167008
16615
16616         Reviewed by Sam Weinig.
16617
16618         * stress/unescape.js: Added.
16619         (shouldBe):
16620
16621 2017-01-12  Saam Barati  <sbarati@apple.com>
16622
16623         Add a slice intrinsic to the DFG/FTL
16624         https://bugs.webkit.org/show_bug.cgi?id=166707
16625         <rdar://problem/29913445>
16626
16627         Reviewed by Filip Pizlo.
16628
16629         * stress/array-slice-intrinsic.js: Added.
16630         (assert):
16631         (shallowEq):
16632         (runTest1):
16633         (runTest2):
16634         * stress/array-slice-jettison-on-constructor-change.js: Added.
16635         (assert):
16636         (runTest1):
16637         (runTest2):
16638         (addRandomProperties):
16639         (runTests):
16640         * stress/array-slice-osr-exit-2.js: Added.
16641         (assert):
16642         (Foo):
16643         (shallowEq):
16644         (runTest1):
16645         (runTest2):
16646         (addRandomProperties):
16647         (runTests):
16648         * stress/array-slice-osr-exit.js: Added.
16649         (assert):
16650         (Foo):
16651         (shallowEq):
16652         (runTest1):
16653         (runTest2):
16654         (addRandomProperties):
16655         (runTests):
16656
16657 2017-01-11  Ryan Haddad  <ryanhaddad@apple.com>
16658
16659         Mark es6/typed_arrays_correct_prototype_chains.js as failing after r210570.
16660         https://bugs.webkit.org/show_bug.cgi?id=166931i
16661
16662         Unreviewed test gardening.
16663
16664         * es6.yaml:
16665
16666 2017-01-10  Commit Queue  <commit-queue@webkit.org>
16667
16668         Unreviewed, rolling out r210052.
16669         https://bugs.webkit.org/show_bug.cgi?id=166915
16670
16671         "breaks web compatability" (Requested by keith_miller on
16672         #webkit).
16673
16674         Reverted changeset:
16675
16676         "Add support for global"
16677         https://bugs.webkit.org/show_bug.cgi?id=165171
16678         http://trac.webkit.org/changeset/210052
16679
16680 2017-01-10  Mark Lam  <mark.lam@apple.com>
16681
16682         Property setters should not be called for bound arguments list entries.
16683         https://bugs.webkit.org/show_bug.cgi?id=165631
16684
16685         Reviewed by Filip Pizlo.
16686
16687         * stress/property-setters-should-not-be-called-for-bound-arguments-list-entries.js: Added.
16688
16689 2017-01-10  Skachkov Oleksandr  <gskachkov@gmail.com>
16690
16691         Calling async arrow function which is in a class's member function will cause error
16692         https://bugs.webkit.org/show_bug.cgi?id=166879
16693
16694         Reviewed by Saam Barati.
16695
16696         * stress/async-arrow-functions-lexical-binding-in-class.js: Added.
16697         (shouldBe):
16698         (shouldBeAsync):
16699         (BaseClass.prototype.baseClassValue):
16700         (BaseClass.prototype.get property):
16701         (BaseClass):
16702         (runSomething):
16703         (ChildClass.prototype.classValue):
16704         (ChildClass.prototype.get classProperty):
16705         (ChildClass.prototype.asyncValueExp):
16706         (ChildClass.prototype.asyncValueBody):
16707         (ChildClass.prototype.asyncThisPropExp):
16708         (ChildClass.prototype.asyncThisPropBody):
16709         (ChildClass.prototype.asyncThisPropInEvalExp):
16710         (ChildClass.prototype.asyncThisPropInEvalBody):
16711         (ChildClass.prototype.asyncThisValueExp):
16712         (ChildClass.prototype.asyncThisValueBody):
16713         (ChildClass.prototype.asyncThisValueInEvalExp):
16714         (ChildClass.prototype.asyncThisValueInEvalBody):
16715         (ChildClass):
16716         (ChildClass2):
16717         (ChildClass2.prototype.classValue):
16718         (ChildClass2.prototype.get classProperty):
16719         * stress/async-arrow-functions-lexical-super-binding.js:
16720
16721 2017-01-09  Yusuke Suzuki  <utatane.tea@gmail.com>
16722
16723         [JSC] Prototype dynamic-import
16724         https://bugs.webkit.org/show_bug.cgi?id=165724
16725
16726         Reviewed by Saam Barati.
16727
16728         * stress/import-basic.js: Added.
16729         (async.async.load):
16730         (async):
16731         (catch):
16732         * stress/import-from-eval.js: Added.
16733         (async):
16734         (catch):
16735         * stress/import-syntax.js: Added.
16736         (testSyntaxError):
16737         * stress/import-tests/cocoa.js: Added.
16738         (export.Cocoa):
16739         (export.hello):
16740         * stress/import-tests/multiple.js: Added.
16741         (export.result):
16742         * stress/import-tests/multiple2.js: Added.
16743         (export.ok):
16744         * stress/import-tests/should.js: Added.
16745         (export.shouldBe):
16746         (export.shouldThrow):
16747         * stress/modules-syntax-error.js:
16748
16749 2017-01-09  Commit Queue  <commit-queue@webkit.org>
16750
16751         Unreviewed, rolling out r210476.
16752         https://bugs.webkit.org/show_bug.cgi?id=166859
16753
16754         "4% JSBench regression" (Requested by keith_mi_ on #webkit).
16755
16756         Reverted changeset:
16757
16758         "Add a slice intrinsic to the DFG/FTL"
16759         https://bugs.webkit.org/show_bug.cgi?id=166707
16760         http://trac.webkit.org/changeset/210476
16761
16762 2017-01-06  Saam Barati  <sbarati@apple.com>
16763
16764         Add a slice intrinsic to the DFG/FTL
16765         https://bugs.webkit.org/show_bug.cgi?id=166707
16766
16767         Reviewed by Filip Pizlo.
16768
16769         * stress/array-slice-intrinsic.js: Added.
16770         (assert):
16771         (shallowEq):
16772         (runTest1):
16773         (runTest2):
16774         * stress/array-slice-jettison-on-constructor-change.js: Added.
16775         (assert):
16776         (runTest1):
16777         (runTest2):
16778         (addRandomProperties):
16779         (runTests):
16780         * stress/array-slice-osr-exit-2.js: Added.
16781         (assert):
16782         (Foo):
16783         (shallowEq):
16784         (runTest1):
16785         (runTest2):
16786         (addRandomProperties):
16787         (runTests):
16788         * stress/array-slice-osr-exit.js: Added.
16789         (assert):
16790         (Foo):
16791         (shallowEq):
16792         (runTest1):
16793         (runTest2):
16794         (addRandomProperties):
16795         (runTests):
16796
16797 2017-01-06  Michael Saboff  <msaboff@apple.com>
16798
16799         @putByValDirect in Array.of and Array.from overwrites non-writable/configurable properties
16800         https://bugs.webkit.org/show_bug.cgi?id=153486
16801
16802         Reviewed by Saam Barati.
16803
16804         New regression test.
16805
16806         * stress/regress-153486.js: Added.
16807         (shouldEqual):
16808         (makeUnwriteableUnconfigurableObject):
16809         (testArrayOf):
16810         (testArrayFrom):
16811         (runTest):
16812
16813 2016-12-30  Filip Pizlo  <fpizlo@apple.com>
16814
16815         DeferGC::~DeferGC should be super cheap
16816         https://bugs.webkit.org/show_bug.cgi?id=166626
16817
16818         Reviewed by Saam Barati.
16819
16820         * stress/slow-path-generator-updating-current-node-dfg.js:
16821         * stress/unshift-array-storage.js:
16822
16823 2017-01-04  JF Bastien  <jfbastien@apple.com>
16824
16825         WebAssembly: sections with the same name are allowed
16826         https://bugs.webkit.org/show_bug.cgi?id=166708
16827
16828         Reviewed by Saam Barati.
16829
16830         * wasm/self-test/test_BuilderJSON.js:
16831         (SectionsWithSameCustomName):
16832
16833 2017-01-04  Saam Barati  <sbarati@apple.com>
16834
16835         stress/spread-calling.js timing out on the bots
16836         https://bugs.webkit.org/show_bug.cgi?id=166689
16837         <rdar://problem/29779182>
16838
16839         Reviewed by Mark Lam.
16840
16841         * stress/spread-calling.js:
16842
16843 2017-01-04  JF Bastien  <jfbastien@apple.com>
16844
16845         WebAssembly JS API: add Module.sections
16846         https://bugs.webkit.org/show_bug.cgi?id=165159
16847         <rdar://problem/29760326>
16848
16849         Reviewed by Mark Lam.
16850
16851         As described here: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymodulecustomsections
16852
16853         * wasm/Builder.js: allow custom sections to be duplicated
16854         * wasm/js-api/Module.customSection.js: Added.
16855         (assert.throws.WebAssembly.Module.prototype.customSections):
16856         (assert.eq):
16857
16858 2017-01-04  Saam Barati  <sbarati@apple.com>
16859
16860         We don't properly handle exceptions inside the nativeCallTrampoline macro in the LLInt
16861         https://bugs.webkit.org/show_bug.cgi?id=163720
16862
16863         Reviewed by Mark Lam.
16864
16865         * stress/bound-function-tail-call-with-exception.js: Added.
16866         (bar):
16867         (foo):
16868         (catch):
16869
16870 2017-01-03  JF Bastien  <jfbastien@apple.com>
16871
16872         WebAssembly JS API: check and test in-call / out-call values
16873         https://bugs.webkit.org/show_bug.cgi?id=164876
16874         <rdar://problem/29844107>
16875
16876         Reviewed by Saam Barati.
16877
16878         * wasm.yaml:
16879         * wasm/assert.js: add an assert for NaN comparison
16880         * wasm/fuzz/export-function.js: Added. Generate random wasm export
16881         signatures, and call them with random parameters.
16882         (const.paramExporter):
16883         (const.setBuffer):
16884         (const.types.generate):
16885         (generate):
16886         * wasm/js-api/export-arity.js: Added.
16887         (const.paramExporter): Test that mismatched arities when JS calls
16888         wasm follow the defined semantics: i32 is 0, f32 / f64 are NaN.
16889         https://github.com/WebAssembly/design/blob/master/JS.md#exported-function-exotic-objects
16890         * wasm/js-api/export-void-is-undef.js: Added. Test that "void"
16891         wasm functions return "undefined" in JS.
16892
16893 2017-01-02  JF Bastien  <jfbastien@apple.com>
16894
16895         WebAssembly: handle and optimize wasm export → wasm import calls
16896         https://bugs.webkit.org/show_bug.cgi?id=165282
16897
16898         Reviewed by Saam Barati.
16899
16900         * wasm/Builder.js: Add a Proxy to Builder.js, which intercepts
16901         unknown property lookups. This creates way better error messages
16902         on typos than 'undefined is not a function', which happens
16903         semi-frequently as I typo opcode names (and which one is a typo is
16904         hard to find because we chain builders).
16905         (const._isValidValue):
16906         (get target):
16907         (const._importFunctionContinuation):
16908         (const._importMemoryContinuation):
16909         (const._importTableContinuation):
16910         (const._exportFunctionContinuation):
16911         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
16912         (export.default.Builder.prototype._registerSectionBuilders.this.Unknown):
16913         * wasm/LowLevelBinary.js: Add limited support for var{u}int64 (only the 32-bit values)
16914         (export.default.LowLevelBinary.prototype.varint32):
16915         (export.default.LowLevelBinary.prototype.varuint64):
16916         (export.default.LowLevelBinary.prototype.varint64):
16917         * wasm/function-tests/exceptions.js: update error message
16918         * wasm/function-tests/trap-load.js: update error message
16919         * wasm/function-tests/trap-store.js: update error message
16920         * wasm/js-api/wasm-to-wasm-bad-signature.js: Added. Test a bunch of bad wasm->wasm import signatures
16921         (const.makeImportee.signature.switch):
16922         (BadSignatureDropStartParams):
16923         * wasm/js-api/wasm-to-wasm.js: Added. Test 64-bit wasm->wasm import calls
16924         (const.callerModule):
16925         (const.calleeModule):
16926         (WasmToWasm):
16927
16928 2017-01-02  Saam Barati  <sbarati@apple.com>
16929
16930         WebAssembly: Some loads don't take into account the offset
16931         https://bugs.webkit.org/show_bug.cgi?id=166616
16932         <rdar://problem/29841541>
16933
16934         Reviewed by Keith Miller.
16935
16936         * wasm/function-tests/load-offset.js: Added.
16937
16938 2016-12-29  Saam Barati  <sbarati@apple.com>
16939
16940         WebAssembly: Rebase spec-tests now that wabt has been updated to produce certain kinds of invalid modules
16941         https://bugs.webkit.org/show_bug.cgi?id=166491
16942         <rdar://problem/29814999>
16943
16944         Reviewed by Yusuke Suzuki.
16945
16946         Based off these revisions:
16947         - spec: b055d01ea1dfdd7a5231ae779095435f836de97f
16948         - wabt: d0d44702c753f851b094615298a2f4d4e3c21035
16949
16950         The reason for the rebase is that wabt was updated to stop
16951         silently rejecting invalid modules. This was needed because
16952         some of the spec tests check to make sure that the module
16953         is invalid, but wabt was silently ignoring the errors and
16954         generating valid modules:
16955         https://github.com/WebAssembly/wabt/issues/256
16956
16957         * wasm.yaml:
16958         * wasm/spec-tests/address.wast.js:
16959         * wasm/spec-tests/binary.wast.js:
16960         * wasm/spec-tests/block.wast.js:
16961         * wasm/spec-tests/br.wast.js:
16962         * wasm/spec-tests/br_if.wast.js:
16963         * wasm/spec-tests/br_table.wast.js:
16964         * wasm/spec-tests/break-drop.wast.js:
16965         * wasm/spec-tests/call.wast.js:
16966         * wasm/spec-tests/call_indirect.wast.js:
16967         * wasm/spec-tests/comments.wast.js:
16968         * wasm/spec-tests/conversions.wast.js:
16969         * wasm/spec-tests/custom_section.wast.js:
16970         * wasm/spec-tests/endianness.wast.js:
16971         * wasm/spec-tests/exports.wast.js:
16972         * wasm/spec-tests/f32.wast.js:
16973         * wasm/spec-tests/f32_cmp.wast.js:
16974         * wasm/spec-tests/f64.wast.js:
16975         * wasm/spec-tests/f64_cmp.wast.js:
16976         * wasm/spec-tests/fac.wast.js:
16977         * wasm/spec-tests/float_exprs.wast.js:
16978         * wasm/spec-tests/float_literals.wast.js:
16979         * wasm/spec-tests/float_memory.wast.js:
16980         * wasm/spec-tests/float_misc.wast.js:
16981         * wasm/spec-tests/forward.wast.js:
16982         * wasm/spec-tests/func.wast.js:
16983         * wasm/spec-tests/func_ptrs.wast.js:
16984         * wasm/spec-tests/get_local.wast.js:
16985         * wasm/spec-tests/globals.wast.js:
16986         * wasm/spec-tests/i32.wast.js:
16987         * wasm/spec-tests/i64.wast.js:
16988         * wasm/spec-tests/imports.wast.js:
16989         * wasm/spec-tests/int_exprs.wast.js:
16990         * wasm/spec-tests/int_literals.wast.js:
16991         * wasm/spec-tests/left-to-right.wast.js:
16992         * wasm/spec-tests/linking.wast.js:
16993         * wasm/spec-tests/loop.wast.js:
16994         * wasm/spec-tests/memory.wast.js:
16995         * wasm/spec-tests/memory_redundancy.wast.js:
16996         * wasm/spec-tests/memory_trap.wast.js:
16997         * wasm/spec-tests/names.wast.js:
16998         * wasm/spec-tests/nop.wast.js:
16999         * wasm/spec-tests/resizing.wast.js:
17000         * wasm/spec-tests/return.wast.js:
17001         * wasm/spec-tests/select.wast.js:
17002         * wasm/spec-tests/set_local.wast.js:
17003         * wasm/spec-tests/skip-stack-guard-page.wast.js:
17004         * wasm/spec-tests/stack.wast.js:
17005         * wasm/spec-tests/start.wast.js:
17006         * wasm/spec-tests/store_retval.wast.js:
17007         * wasm/spec-tests/switch.wast.js:
17008         * wasm/spec-tests/tee_local.wast.js:
17009         * wasm/spec-tests/traps.wast.js:
17010         * wasm/spec-tests/typecheck.wast.js:
17011         * wasm/spec-tests/unreachable.wast.js:
17012         * wasm/spec-tests/unwind.wast.js:
17013
17014 2016-12-28  Saam Barati  <sbarati@apple.com>
17015
17016         WebAssembly: Don't allow duplicate export names
17017         https://bugs.webkit.org/show_bug.cgi?id=166490
17018         <rdar://problem/29815000>
17019
17020         Reviewed by Keith Miller.
17021
17022         * wasm.yaml:
17023         * wasm/function-tests/invalid-duplicate-export.js: Added.
17024
17025 2016-12-28  Saam Barati  <sbarati@apple.com>
17026
17027         WebAssembly: Implement grow_memory and current_memory
17028         https://bugs.webkit.org/show_bug.cgi?id=166448
17029         <rdar://problem/29803676>
17030
17031         Reviewed by Keith Miller.
17032
17033         I rewrote some of the testWasmModuleFunctions that used Memory to use
17034         the JS API since the jsc.cpp version can no longer use memory.
17035
17036         * wasm.yaml:
17037         * wasm/function-tests/add-12.js:
17038         (testWasmModuleFunctions):
17039         * wasm/function-tests/br-if-loop-less-than.js:
17040         (testWasmModuleFunctions):
17041         * wasm/function-tests/brTableAsIf.js:
17042         (testWasmModuleFunctions):
17043         * wasm/function-tests/brTableManyValues.js:
17044         (testWasmModuleFunctions):
17045         * wasm/function-tests/brTableWithLoop.js:
17046         (testWasmModuleFunctions):
17047         * wasm/function-tests/dumb-eq-if-then-else.js:
17048         * wasm/function-tests/eqz.js:
17049         * wasm/function-tests/grow-memory-2.js: Added.
17050         (const.func):
17051         (assert.eq.instance.exports.foo):
17052         * wasm/function-tests/grow-memory-3.js: Added.
17053         * wasm/function-tests/grow-memory-4.js: Added.
17054         (const.func):
17055         * wasm/function-tests/grow-memory.js: Added.
17056         (binaryShouldNotParse):
17057         (assert.truthy):
17058         (assert.eq):
17059         (memory.grow):
17060         * wasm/function-tests/i32-load.js:
17061         (testWasmModuleFunctions):
17062         * wasm/function-tests/i32-load8-s.js:
17063         * wasm/function-tests/max.js:
17064         * wasm/function-tests/min.js:
17065         * wasm/js-api/memory-grow.js: Added.
17066         (i.i):
17067         (assertEq):
17068         * wasm/js-api/test_memory.js:
17069         * wasm/wasm.json:
17070
17071 2016-12-25  Yusuke Suzuki  <utatane.tea@gmail.com>
17072
17073         Propagate the source origin as much as possible
17074         https://bugs.webkit.org/show_bug.cgi?id=166348
17075
17076         Reviewed by Darin Adler.
17077
17078         * stress/source-origin.js: Added.
17079         (shouldBe):
17080
17081 2016-12-24  Caio Lima  <ticaiolima@gmail.com>
17082
17083         [test262] Fixing mapped arguments object property test case
17084         https://bugs.webkit.org/show_bug.cgi?id=159398
17085
17086         Reviewed by Saam Barati.
17087
17088         * stress/arguments-bizarre-behaviour-disable-enumerability.js:
17089         * stress/arguments-define-property.js: Added.
17090         (assert):
17091         (testProperties):
17092         * stress/arguments-non-configurable.js: Added.
17093         (assert):
17094         (tryChangeNonConfigurableDescriptor):
17095         (set tryChangeNonConfigurableDescriptor):
17096         (tryChangeWritableOfNonConfigurableDescriptor):
17097         * test262.yaml:
17098
17099 016-12-20  Caio Lima  <ticaiolima@gmail.com>
17100
17101         [test262] Fixing mapped arguments object property test case
17102         https://bugs.webkit.org/show_bug.cgi?id=159398
17103
17104         Reviewed by .
17105
17106         * stress/arguments-bizarre-behaviour-disable-enumerability.js:
17107         * stress/arguments-define-property.js: Added.
17108         (assert):
17109         (testProperties):
17110         * stress/arguments-non-configurable.js: Added.
17111         (assert):
17112         (tryChangeNonConfigurableDescriptor):
17113         (set tryChangeNonConfigurableDescriptor):
17114         (tryChangeWritableOfNonConfigurableDescriptor):
17115         * test262.yaml:
17116
17117 2016-12-23  Keith Miller  <keith_miller@apple.com>
17118
17119         WebAssembly: trap on bad division.
17120         https://bugs.webkit.org/show_bug.cgi?id=164786
17121
17122         Reviewed by Mark Lam.
17123
17124         Also, mark conversions as passing.
17125
17126         * wasm.yaml:
17127         * wasm/wasm.json:
17128
17129 2016-12-22  Keith Miller  <keith_miller@apple.com>
17130
17131         WebAssembly: Make spec-tests/f32.wast.js and spec-tests/f64.wast.js pass
17132         https://bugs.webkit.org/show_bug.cgi?id=166447
17133
17134         Reviewed by Saam Barati.
17135
17136         * wasm.yaml:
17137         * wasm/wasm.json:
17138
17139 2016-12-22  Saam Barati  <sbarati@apple.com>
17140
17141         WebAssembly: Make calling Wasm functions that returns or takes an i64 as a parameter an early exception
17142         https://bugs.webkit.org/show_bug.cgi?id=166437
17143         <rdar://problem/29793949>
17144
17145         Reviewed by Keith Miller.
17146
17147         * wasm.yaml:
17148         * wasm/function-tests/i64-from-js-exceptions.js: Added.
17149         (const.imp.import.sideEffects):
17150         (assert.throws.instance.exports.foo.valueOf):
17151
17152 2016-12-22  Mark Lam  <mark.lam@apple.com>
17153
17154         De-duplicate finally blocks.
17155         https://bugs.webkit.org/show_bug.cgi?id=160168
17156
17157         Reviewed by Saam Barati.
17158
17159         Re-landing r209952 with a few new tests added in test-finally.js.
17160
17161         * stress/deeply-nested-finallys.js: Copied from JSTests/stress/deeply-nested-finallys.js.
17162         - Tests many levels of finally nesting.  This causes the old code to hang (and
17163           crashes eventually) while trying to generate bytecode for the exponentially
17164           duplicated finally blocks.  The new code completes this test almost instantly.
17165
17166         * stress/test-finally.js: Copied from JSTests/stress/test-finally.js.
17167         - Tests control flow through various permutations of finally blocks.
17168
17169 2016-12-22  Saam Barati  <sbarati@apple.com>
17170
17171         WebAssembly: Make the spec-tests/address.wast.js test pass
17172         https://bugs.webkit.org/show_bug.cgi?id=166429
17173         <rdar://problem/29793220>
17174
17175         Reviewed by Keith Miller.
17176
17177         * wasm.yaml:
17178
17179 2016-12-22  Keith Miller  <keith_miller@apple.com>
17180
17181         WebAssembly: The validator should not allow unused stack entries at the end of a block
17182         https://bugs.webkit.org/show_bug.cgi?id=166411
17183
17184         Reviewed by Saam Barati.
17185
17186         Test cleanup and enable new passing tests.
17187
17188         * wasm.yaml:
17189         * wasm/function-tests/br-if-as-return.js:
17190
17191 2016-12-22  Saam Barati  <sbarati@apple.com>
17192
17193         WebAssembly: Make the spec-tests/start.wast.js test pass
17194         https://bugs.webkit.org/show_bug.cgi?id=166416
17195         <rdar://problem/29784532>
17196
17197         Reviewed by Yusuke Suzuki.
17198
17199         * wasm.yaml:
17200
17201 2016-12-21  Keith Miller  <keith_miller@apple.com>
17202
17203         WebAssembly: Fix decode floating point constants in unreachable code
17204         https://bugs.webkit.org/show_bug.cgi?id=166400
17205
17206         Reviewed by Saam Barati.
17207
17208         * wasm.yaml:
17209
17210 2016-12-21  Keith Miller  <keith_miller@apple.com>
17211
17212         WebAssembly: Allow br, br_if, and br_table to act as a return
17213         https://bugs.webkit.org/show_bug.cgi?id=166393
17214
17215         Reviewed by Saam Barati.
17216
17217         Add tests for breaks acting as returns and fix tests that
17218         validate error messages.
17219
17220         * wasm/function-tests/br-as-return.js: Added.
17221         * wasm/function-tests/br-if-as-return.js: Added.
17222         * wasm/function-tests/br-table-as-return.js: Added.
17223         * wasm/function-tests/if-no-else-non-void.js:
17224         * wasm/function-tests/struct.js: Added.
17225         * wasm/js-api/global-error.js:
17226         (assert.throws):
17227         * wasm/js-api/table.js:
17228         (assert.throws):
17229
17230 2016-12-21  Saam Barati  <sbarati@apple.com>
17231
17232         WebAssembly: Import spec tests
17233         https://bugs.webkit.org/show_bug.cgi?id=166395
17234
17235         Rubber stamped by Keith Miller.
17236
17237         This patch implements the Wasm spec's tests found here:
17238         https://github.com/WebAssembly/spec/tree/master/interpreter/test
17239
17240         These tests are in .wast s-epxression format. To convert
17241         them to JS, I use a script from the wabt library, found here:
17242         https://github.com/WebAssembly/wabt/blob/master/test/run-gen-spec-js.py
17243
17244         I also added a script that automatically imports the tests as
17245         JS files. The inputs to the script is the path to the Wasm spec
17246         git repo and the path to the wabt git repo. This will make importing
17247         new tests easy in the future.
17248
17249         The wasm spec imported is at commit: b055d01ea1dfdd7a5231ae779095435f836de97f
17250         The wabt used to do the import is at commit: 622b42dced6d793e9d49e9b1fd1d1524defd1387
17251
17252         * wasm.yaml:
17253         * wasm/import-spec-tests.rb: Added.
17254         * wasm/spec-tests: Added.
17255         * wasm/spec-tests/address.wast.js: Added.
17256         (register):
17257         (module):
17258         (instance):
17259         (assert_malformed):
17260         (assert_invalid):
17261         (assert_soft_invalid):
17262         (assert_unlinkable):
17263         (assert_uninstantiable):
17264         (assert_trap):
17265         (assert_return):
17266         (assert_return_nan):
17267         * wasm/spec-tests/binary.wast.js: Added.
17268         (register):
17269         (module):
17270         (instance):
17271         (assert_malformed):
17272         (assert_invalid):
17273         (assert_soft_invalid):
17274         (assert_unlinkable):
17275         (assert_uninstantiable):
17276         (assert_trap):
17277         (assert_return):
17278         (assert_return_nan):
17279         * wasm/spec-tests/block.wast.js: Added.
17280         (register):
17281         (module):
17282         (instance):
17283         (assert_malformed):
17284         (assert_invalid):
17285         (assert_soft_invalid):
17286         (assert_unlinkable):
17287         (assert_uninstantiable):
17288         (assert_trap):
17289         (assert_return):
17290         (assert_return_nan):
17291         * wasm/spec-tests/br.wast.js: Added.
17292         (register):
17293         (module):
17294         (instance):
17295         (assert_malformed):
17296         (assert_invalid):
17297         (assert_soft_invalid):
17298         (assert_unlinkable):
17299         (assert_uninstantiable):
17300         (assert_trap):
17301         (assert_return):
17302         (assert_return_nan):
17303         * wasm/spec-tests/br_if.wast.js: Added.
17304         (register):
17305         (module):
17306         (instance):
17307         (assert_malformed):
17308         (assert_invalid):
17309         (assert_soft_invalid):
17310         (assert_unlinkable):
17311         (assert_uninstantiable):
17312         (assert_trap):
17313         (assert_return):
17314         (assert_return_nan):
17315         * wasm/spec-tests/br_table.wast.js: Added.
17316         (register):
17317         (module):
17318         (instance):
17319         (assert_malformed):
17320         (assert_invalid):
17321         (assert_soft_invalid):
17322         (assert_unlinkable):
17323         (assert_uninstantiable):
17324         (assert_trap):
17325         (assert_return):
17326         (assert_return_nan):
17327         * wasm/spec-tests/break-drop.wast.js: Added.
17328         (register):
17329         (module):
17330         (instance):
17331         (assert_malformed):
17332         (assert_invalid):
17333         (assert_soft_invalid):
17334         (assert_unlinkable):
17335         (assert_uninstantiable):
17336         (assert_trap):
17337         (assert_return):
17338         (assert_return_nan):
17339         * wasm/spec-tests/call.wast.js: Added.
17340         (register):
17341         (module):
17342         (instance):
17343         (assert_malformed):
17344         (assert_invalid):
17345         (assert_soft_invalid):
17346         (assert_unlinkable):
17347         (assert_uninstantiable):
17348         (assert_trap):
17349         (assert_return):
17350         (assert_return_nan):
17351         * wasm/spec-tests/call_indirect.wast.js: Added.
17352         (register):
17353         (module):
17354         (instance):
17355         (assert_malformed):
17356         (assert_invalid):
17357         (assert_soft_invalid):
17358         (assert_unlinkable):
17359         (assert_uninstantiable):
17360         (assert_trap):
17361         (assert_return):
17362         (assert_return_nan):
17363         * wasm/spec-tests/comments.wast.js: Added.
17364         (register):
17365         (module):
17366         (instance):
17367         (assert_malformed):
17368         (assert_invalid):
17369         (assert_soft_invalid):
17370         (assert_unlinkable):
17371         (assert_uninstantiable):
17372         (assert_trap):
17373         (assert_return):
17374         (assert_return_nan):
17375         * wasm/spec-tests/conversions.wast.js: Added.
17376         (register):
17377         (module):
17378         (instance):
17379         (assert_malformed):
17380         (assert_invalid):
17381         (assert_soft_invalid):
17382         (assert_unlinkable):
17383         (assert_uninstantiable):
17384         (assert_trap):
17385         (assert_return):
17386         (assert_return_nan):
17387         * wasm/spec-tests/custom_section.wast.js: Added.
17388         (register):
17389         (module):
17390         (instance):
17391         (assert_malformed):
17392         (assert_invalid):
17393         (assert_soft_invalid):
17394         (assert_unlinkable):
17395         (assert_uninstantiable):
17396         (assert_trap):
17397         (assert_return):
17398         (assert_return_nan):
17399         * wasm/spec-tests/endianness.wast.js: Added.
17400         (register):
17401         (module):
17402         (instance):
17403         (assert_malformed):
17404         (assert_invalid):
17405         (assert_soft_invalid):
17406         (assert_unlinkable):
17407         (assert_uninstantiable):
17408         (assert_trap):
17409         (assert_return):
17410         (assert_return_nan):
17411         * wasm/spec-tests/exports.wast.js: Added.
17412         (register):
17413         (module):
17414         (instance):
17415         (assert_malformed):
17416         (assert_invalid):
17417         (assert_soft_invalid):
17418         (assert_unlinkable):
17419         (assert_uninstantiable):
17420         (assert_trap):
17421         (assert_return):
17422         (assert_return_nan):
17423         * wasm/spec-tests/f32.wast.js: Added.
17424         (register):
17425         (module):
17426         (instance):
17427         (assert_malformed):
17428         (assert_invalid):
17429         (assert_soft_invalid):
17430         (assert_unlinkable):
17431         (assert_uninstantiable):
17432         (assert_trap):
17433         (assert_return):
17434         (assert_return_nan):
17435         * wasm/spec-tests/f32_cmp.wast.js: Added.
17436         (register):
17437         (module):
17438         (instance):
17439         (assert_malformed):
17440         (assert_invalid):
17441         (assert_soft_invalid):
17442         (assert_unlinkable):
17443         (assert_uninstantiable):
17444         (assert_trap):
17445         (assert_return):
17446         (assert_return_nan):
17447         * wasm/spec-tests/f64.wast.js: Added.
17448         (register):
17449         (module):
17450         (instance):
17451         (assert_malformed):
17452         (assert_invalid):
17453         (assert_soft_invalid):
17454         (assert_unlinkable):
17455         (assert_uninstantiable):
17456         (assert_trap):
17457         (assert_return):
17458         (assert_return_nan):
17459         * wasm/spec-tests/f64_cmp.wast.js: Added.
17460         (register):
17461         (module):
17462         (instance):
17463         (assert_malformed):
17464         (assert_invalid):
17465         (assert_soft_invalid):
17466         (assert_unlinkable):
17467         (assert_uninstantiable):
17468         (assert_trap):
17469         (assert_return):
17470         (assert_return_nan):
17471         * wasm/spec-tests/fac.wast.js: Added.
17472         (register):
17473         (module):
17474         (instance):
17475         (assert_malformed):
17476         (assert_invalid):
17477         (assert_soft_invalid):
17478         (assert_unlinkable):
17479         (assert_uninstantiable):
17480         (assert_trap):
17481         (assert_return):
17482         (assert_return_nan):
17483         * wasm/spec-tests/float_exprs.wast.js: Added.
17484         (register):
17485         (module):
17486         (instance):
17487         (assert_malformed):
17488         (assert_invalid):
17489         (assert_soft_invalid):
17490         (assert_unlinkable):
17491         (assert_uninstantiable):
17492         (assert_trap):
17493         (assert_return):
17494         (assert_return_nan):
17495         * wasm/spec-tests/float_literals.wast.js: Added.
17496         (register):
17497         (module):
17498         (instance):
17499         (assert_malformed):
17500         (assert_invalid):
17501         (assert_soft_invalid):
17502         (assert_unlinkable):
17503         (assert_uninstantiable):
17504         (assert_trap):
17505         (assert_return):
17506         (assert_return_nan):
17507         * wasm/spec-tests/float_memory.wast.js: Added.
17508         (register):
17509         (module):
17510         (instance):
17511         (assert_malformed):
17512         (assert_invalid):
17513         (assert_soft_invalid):
17514         (assert_unlinkable):
17515         (assert_uninstantiable):
17516         (assert_trap):
17517         (assert_return):
17518         (assert_return_nan):
17519         * wasm/spec-tests/float_misc.wast.js: Added.
17520         (register):
17521         (module):
17522         (instance):
17523         (assert_malformed):
17524         (assert_invalid):
17525         (assert_soft_invalid):
17526         (assert_unlinkable):
17527         (assert_uninstantiable):
17528         (assert_trap):
17529         (assert_return):
17530         (assert_return_nan):
17531         * wasm/spec-tests/forward.wast.js: Added.
17532         (register):
17533         (module):
17534         (instance):
17535         (assert_malformed):
17536         (assert_invalid):
17537         (assert_soft_invalid):
17538         (assert_unlinkable):
17539         (assert_uninstantiable):
17540         (assert_trap):
17541         (assert_return):
17542         (assert_return_nan):
17543         * wasm/spec-tests/func.wast.js: Added.
17544         (register):
17545         (module):
17546         (instance):
17547         (assert_malformed):
17548         (assert_invalid):
17549         (assert_soft_invalid):
17550         (assert_unlinkable):
17551         (assert_uninstantiable):
17552         (assert_trap):
17553         (assert_return):
17554         (assert_return_nan):
17555         * wasm/spec-tests/func_ptrs.wast.js: Added.
17556         (register):
17557         (module):
17558         (instance):
17559         (assert_malformed):
17560         (assert_invalid):
17561         (assert_soft_invalid):
17562         (assert_unlinkable):
17563         (assert_uninstantiable):
17564         (assert_trap):
17565         (assert_return):
17566         (assert_return_nan):
17567         * wasm/spec-tests/get_local.wast.js: Added.
17568         (register):
17569         (module):
17570         (instance):
17571         (assert_malformed):
17572         (assert_invalid):
17573         (assert_soft_invalid):
17574         (assert_unlinkable):
17575         (assert_uninstantiable):
17576         (assert_trap):
17577         (assert_return):
17578         (assert_return_nan):
17579         * wasm/spec-tests/globals.wast.js: Added.
17580         (register):
17581         (module):
17582         (instance):
17583         (assert_malformed):
17584         (assert_invalid):
17585         (assert_soft_invalid):
17586         (assert_unlinkable):
17587         (assert_uninstantiable):
17588         (assert_trap):
17589         (assert_return):
17590         (assert_return_nan):
17591         * wasm/spec-tests/i32.wast.js: Added.
17592         (register):
17593         (module):
17594         (instance):
17595         (assert_malformed):
17596         (assert_invalid):
17597         (assert_soft_invalid):
17598         (assert_unlinkable):
17599         (assert_uninstantiable):
17600         (assert_trap):
17601         (assert_return):
17602         (assert_return_nan):
17603         * wasm/spec-tests/i64.wast.js: Added.
17604         (register):
17605         (module):
17606         (instance):
17607         (assert_malformed):
17608         (assert_invalid):
17609         (assert_soft_invalid):
17610         (assert_unlinkable):
17611         (assert_uninstantiable):
17612         (assert_trap):
17613         (assert_return):
17614         (assert_return_nan):
17615         * wasm/spec-tests/imports.wast.js: Added.
17616         (register):
17617         (module):
17618         (instance):
17619         (assert_malformed):
17620         (assert_invalid):
17621         (assert_soft_invalid):
17622         (assert_unlinkable):
17623         (assert_uninstantiable):
17624         (assert_trap):
17625         (assert_return):
17626         (assert_return_nan):
17627         * wasm/spec-tests/int_exprs.wast.js: Added.
17628         (register):
17629         (module):
17630         (instance):
17631         (assert_malformed):
17632         (assert_invalid):
17633         (assert_soft_invalid):
17634         (assert_unlinkable):
17635         (assert_uninstantiable):
17636         (assert_trap):
17637         (assert_return):
17638         (assert_return_nan):
17639         * wasm/spec-tests/int_literals.wast.js: Added.
17640         (register):
17641         (module):
17642         (instance):
17643         (assert_malformed):
17644         (assert_invalid):
17645         (assert_soft_invalid):
17646         (assert_unlinkable):
17647         (assert_uninstantiable):
17648         (assert_trap):
17649         (assert_return):
17650         (assert_return_nan):
17651         * wasm/spec-tests/left-to-right.wast.js: Added.
17652         (register):
17653         (module):
17654         (instance):
17655         (assert_malformed):
17656         (assert_invalid):
17657         (assert_soft_invalid):
17658         (assert_unlinkable):
17659         (assert_uninstantiable):
17660         (assert_trap):
17661         (assert_return):
17662         (assert_return_nan):
17663         * wasm/spec-tests/linking.wast.js: Added.
17664         (register):
17665         (module):
17666         (instance):
17667         (assert_malformed):
17668         (assert_invalid):
17669         (assert_soft_invalid):
17670         (assert_unlinkable):
17671         (assert_uninstantiable):
17672         (assert_trap):
17673         (assert_return):
17674         (assert_return_nan):
17675         * wasm/spec-tests/loop.wast.js: Added.
17676         (register):
17677         (module):
17678         (instance):
17679         (assert_malformed):
17680         (assert_invalid):
17681         (assert_soft_invalid):
17682         (assert_unlinkable):
17683         (assert_uninstantiable):
17684         (assert_trap):
17685         (assert_return):
17686         (assert_return_nan):
17687         * wasm/spec-tests/memory.wast.js: Added.
17688         (register):
17689         (module):
17690         (instance):
17691         (assert_malformed):
17692         (assert_invalid):
17693         (assert_soft_invalid):
17694         (assert_unlinkable):
17695         (assert_uninstantiable):
17696         (assert_trap):
17697         (assert_return):
17698         (assert_return_nan):
17699         * wasm/spec-tests/memory_redundancy.wast.js: Added.
17700         (register):
17701         (module):
17702         (instance):
17703         (assert_malformed):
17704         (assert_invalid):
17705         (assert_soft_invalid):
17706         (assert_unlinkable):
17707         (assert_uninstantiable):
17708         (assert_trap):
17709         (assert_return):
17710         (assert_return_nan):
17711         * wasm/spec-tests/memory_trap.wast.js: Added.
17712         (register):
17713         (module):
17714         (instance):
17715         (assert_malformed):
17716         (assert_invalid):
17717         (assert_soft_invalid):
17718         (assert_unlinkable):
17719         (assert_uninstantiable):
17720         (assert_trap):
17721         (assert_return):
17722         (assert_return_nan):
17723         * wasm/spec-tests/names.wast.js: Added.
17724         (register):
17725         (module):
17726         (instance):
17727         (assert_malformed):
17728         (assert_invalid):
17729         (assert_soft_invalid):
17730         (assert_unlinkable):
17731         (assert_uninstantiable):
17732         (assert_trap):
17733         (assert_return):
17734         (assert_return_nan):
17735         * wasm/spec-tests/nop.wast.js: Added.
17736         (register):
17737         (module):
17738         (instance):
17739         (assert_malformed):
17740         (assert_invalid):
17741         (assert_soft_invalid):
17742         (assert_unlinkable):
17743         (assert_uninstantiable):
17744         (assert_trap):
17745         (assert_return):
17746         (assert_return_nan):
17747         * wasm/spec-tests/resizing.wast.js: Added.
17748         (register):
17749         (module):
17750         (instance):
17751         (assert_malformed):
17752         (assert_invalid):
17753         (assert_soft_invalid):
17754         (assert_unlinkable):
17755         (assert_uninstantiable):
17756         (assert_trap):
17757         (assert_return):
17758         (assert_return_nan):
17759         * wasm/spec-tests/return.wast.js: Added.
17760         (register):
17761         (module):
17762         (instance):
17763         (assert_malformed):
17764         (assert_invalid):
17765         (assert_soft_invalid):
17766         (assert_unlinkable):
17767         (assert_uninstantiable):
17768         (assert_trap):
17769         (assert_return):
17770         (assert_return_nan):
17771         * wasm/spec-tests/select.wast.js: Added.
17772         (register):
17773         (module):
17774         (instance):
17775         (assert_malformed):
17776         (assert_invalid):
17777         (assert_soft_invalid):
17778         (assert_unlinkable):
17779         (assert_uninstantiable):
17780         (assert_trap):
17781         (assert_return):
17782         (assert_return_nan):
17783         * wasm/spec-tests/set_local.wast.js: Added.
17784         (register):
17785         (module):
17786         (instance):
17787         (assert_malformed):
17788         (assert_invalid):
17789         (assert_soft_invalid):
17790         (assert_unlinkable):
17791         (assert_uninstantiable):
17792         (assert_trap):
17793         (assert_return):
17794         (assert_return_nan):
17795         * wasm/spec-tests/skip-stack-guard-page.wast.js: Added.
17796         (register):
17797         (module):
17798         (instance):
17799         (assert_malformed):
17800         (assert_invalid):
17801         (assert_soft_invalid):
17802         (assert_unlinkable):
17803         (assert_uninstantiable):
17804         (assert_trap):
17805         (assert_return):
17806         (assert_return_nan):
17807         * wasm/spec-tests/stack.wast.js: Added.
17808         (register):
17809         (module):
17810         (instance):
17811         (assert_malformed):
17812         (assert_invalid):
17813         (assert_soft_invalid):
17814         (assert_unlinkable):
17815         (assert_uninstantiable):
17816         (assert_trap):
17817         (assert_return):
17818         (assert_return_nan):
17819         * wasm/spec-tests/start.wast.js: Added.
17820         (register):
17821         (module):
17822         (instance):
17823         (assert_malformed):
17824         (assert_invalid):
17825         (assert_soft_invalid):
17826         (assert_unlinkable):
17827         (assert_uninstantiable):
17828         (assert_trap):
17829         (assert_return):
17830         (assert_return_nan):
17831         * wasm/spec-tests/store_retval.wast.js: Added.
17832         (register):
17833         (module):
17834         (instance):
17835         (assert_malformed):
17836         (assert_invalid):
17837         (assert_soft_invalid):
17838         (assert_unlinkable):
17839         (assert_uninstantiable):
17840         (assert_trap):
17841         (assert_return):
17842         (assert_return_nan):
17843         * wasm/spec-tests/switch.wast.js: Added.
17844         (register):
17845         (module):
17846         (instance):
17847         (assert_malformed):
17848         (assert_invalid):
17849         (assert_soft_invalid):
17850         (assert_unlinkable):
17851         (assert_uninstantiable):
17852         (assert_trap):
17853         (assert_return):
17854         (assert_return_nan):
17855         * wasm/spec-tests/tee_local.wast.js: Added.
17856         (register):
17857         (module):
17858         (instance):
17859         (assert_malformed):
17860         (assert_invalid):
17861         (assert_soft_invalid):
17862         (assert_unlinkable):
17863         (assert_uninstantiable):
17864         (assert_trap):
17865         (assert_return):
17866         (assert_return_nan):
17867         * wasm/spec-tests/traps.wast.js: Added.
17868         (register):
17869         (module):
17870         (instance):
17871         (assert_malformed):
17872         (assert_invalid):
17873         (assert_soft_invalid):
17874         (assert_unlinkable):
17875         (assert_uninstantiable):
17876         (assert_trap):
17877         (assert_return):
17878         (assert_return_nan):
17879         * wasm/spec-tests/typecheck.wast.js: Added.
17880         (register):
17881         (module):
17882         (instance):
17883         (assert_malformed):
17884         (assert_invalid):
17885         (assert_soft_invalid):
17886         (assert_unlinkable):
17887         (assert_uninstantiable):
17888         (assert_trap):
17889         (assert_return):
17890         (assert_return_nan):
17891         * wasm/spec-tests/unreachable.wast.js: Added.
17892         (register):
17893         (module):
17894         (instance):
17895         (assert_malformed):
17896         (assert_invalid):
17897         (assert_soft_invalid):
17898         (assert_unlinkable):
17899         (assert_uninstantiable):
17900         (assert_trap):
17901         (assert_return):
17902         (assert_return_nan):
17903         * wasm/spec-tests/unwind.wast.js: Added.
17904         (register):
17905         (module):
17906         (instance):
17907         (assert_malformed):
17908         (assert_invalid):
17909         (assert_soft_invalid):
17910         (assert_unlinkable):
17911         (assert_uninstantiable):
17912         (assert_trap):
17913         (assert_return):
17914         (assert_return_nan):
17915
17916 2016-12-20  Keith Miller  <keith_miller@apple.com>
17917
17918         Add support for global
17919         https://bugs.webkit.org/show_bug.cgi?id=165171
17920
17921         Reviewed by Filip Pizlo.
17922
17923         * stress/global.js: Added.
17924
17925 2016-12-20  JF Bastien  <jfbastien@apple.com>
17926
17927         WebAssembly API: implement WebAssembly.LinkError
17928         https://bugs.webkit.org/show_bug.cgi?id=165805
17929         <rdar://problem/29747874>
17930
17931         Reviewed by Mark lam.
17932
17933         Update all exception sites which now throw WebAssembly.LinkError.
17934
17935         * wasm/js-api/element-data.js:
17936         * wasm/js-api/element.js:
17937         (assert.throws):
17938         * wasm/js-api/global-error.js:
17939         (new.Number):
17940         * wasm/js-api/table.js:
17941         (assert.throws):
17942         (new.WebAssembly.Table):
17943         * wasm/js-api/test_Data.js:
17944         * wasm/js-api/test_basic_api.js:
17945         (const.c.in.constructorProperties.switch):
17946         * wasm/js-api/test_memory.js:
17947         (test):
17948         (test.testMemImportError): Deleted.
17949
17950 2016-12-20  JF Bastien  <jfbastien@apple.com>
17951
17952         WebAssembly: unique function signatures
17953         https://bugs.webkit.org/show_bug.cgi?id=165957
17954         <rdar://problem/29735737>
17955
17956         Reviewed by Saam Barati.
17957
17958         * wasm/function-tests/table-basic.js: FIXME is now addressed,
17959         though instance to instance calls still need work which bug
17960         #165282 will address
17961         (i.assert.eq.foo):
17962         * wasm/js-api/unique-signature.js: Added.
17963         (CallIndirectWithDuplicateSignatures):
17964
17965 2016-12-19  Mark Lam  <mark.lam@apple.com>
17966
17967         Rolling out r209974 and r209952. They break some websites in mysterious ways. Step 2: Rollout r209952.
17968         https://bugs.webkit.org/show_bug.cgi?id=166049
17969
17970         Not reviewed.
17971
17972         * stress/deeply-nested-finallys.js: Removed.
17973         * stress/test-finally.js: Removed.
17974
17975 2016-12-19  Saam Barati  <sbarati@apple.com>
17976
17977         WebAssembly: Make running Wasm tests take less time by reducing some tests' iteration count and by splitting some tests into different files
17978         https://bugs.webkit.org/show_bug.cgi?id=166017
17979
17980         Reviewed by Yusuke Suzuki.
17981
17982         * wasm/function-tests/trap-load-2.js: Added.
17983         (assert):
17984         (wasmFrameCountFromError):
17985         (continuation):
17986         (i.catch):
17987         * wasm/function-tests/trap-load.js:
17988         (assert.continuation): Deleted.
17989         * wasm/function-tests/trap-store-2.js: Added.
17990         (import.Builder.from.string_appeared_here.assert):
17991         (continuation):
17992         (i.catch):
17993         * wasm/function-tests/trap-store.js:
17994         (assert.continuation): Deleted.
17995         (assert): Deleted.
17996         * wasm/js-api/test_memory.js:
17997         (test):
17998
17999 2016-12-18  Saam Barati  <sbarati@apple.com>
18000
18001         WebAssembly: Implement the WebAssembly.compile and WebAssembly.validate
18002         https://bugs.webkit.org/show_bug.cgi?id=165936
18003
18004         Reviewed by Mark Lam.
18005
18006         * wasm/js-api/Module-compile.js: Added.
18007         (async.testPromiseAPI):
18008         * wasm/js-api/test_basic_api.js:
18009         (const.c.in.constructorProperties.switch):
18010         * wasm/js-api/validate.js: Added.
18011         (assert.truthy.WebAssembly.validate.builder.WebAssembly):
18012
18013 2016-12-16  Mark Lam  <mark.lam@apple.com>
18014
18015         De-duplicate finally blocks.
18016         https://bugs.webkit.org/show_bug.cgi?id=160168
18017
18018         Reviewed by Keith Miller.
18019
18020         * stress/deeply-nested-finallys.js: Added.
18021         - Tests many levels of finally nesting.  This causes the old code to hang (and
18022           crashes eventually) while trying to generate bytecode for the exponentially
18023           duplicated finally blocks.  The new code completes this test almost instantly.
18024
18025         * stress/test-finally.js: Added.
18026         - Tests control flow through various permutations of finally blocks.
18027
18028 2016-12-16  Saam Barati  <sbarati@apple.com>
18029
18030         WebAssembly: WasmB3IRGenerator should throw exceptions instead of crash
18031         https://bugs.webkit.org/show_bug.cgi?id=165834
18032
18033         Reviewed by Keith Miller.
18034
18035         * wasm/function-tests/exceptions.js: Added.
18036         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
18037         * wasm/function-tests/table-basic.js:
18038         (i.i.42.throw.new.Error):
18039
18040 2016-12-16  Keith Miller  <keith_miller@apple.com>
18041
18042         i64.eqz should use an Int64 zero
18043         https://bugs.webkit.org/show_bug.cgi?id=165942
18044
18045         Reviewed by Mark Lam.
18046
18047         * wasm/wasm.json:
18048
18049 2016-12-15  Keith Miller  <keith_miller@apple.com>
18050
18051         Fix validation of non-void if blocks with no else
18052         https://bugs.webkit.org/show_bug.cgi?id=165938
18053
18054         Reviewed by Saam Barati.
18055
18056         Add a new failing test and a fix an existing one.
18057
18058         * wasm/function-tests/dead-call.js:
18059         * wasm/function-tests/if-no-else-non-void.js: Added.
18060
18061 2016-12-15  Keith Miller  <keith_miller@apple.com>
18062
18063         Wasm should not create empty unlinked callsites
18064         https://bugs.webkit.org/show_bug.cgi?id=165933
18065
18066         Reviewed by Mark Lam.
18067
18068         * wasm/function-tests/dead-call.js: Added.
18069
18070 2016-12-15  JF Bastien  <jfbastien@apple.com>
18071
18072         WebAssembly: improve compilation error messages
18073         https://bugs.webkit.org/show_bug.cgi?id=163919
18074
18075         Reviewed by Saam Barati.
18076
18077         Update error messages in these tests.
18078         Use the assert.throws facility in many of them which weren't already.
18079
18080         * wasm/js-api/element.js:
18081         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
18082         (assert.throws):
18083         * wasm/js-api/global-error.js:
18084         (assert.throws.new.WebAssembly.Module.bin):
18085         (assert.throws):
18086         (new.Number):
18087         * wasm/js-api/table.js:
18088         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
18089         (assert.throws):
18090         (assertBadTableImport):
18091         * wasm/js-api/test_Data.js:
18092         (DataSectionWithoutMemory):
18093         * wasm/js-api/test_Start.js:
18094         (InvalidStartFunctionIndex):
18095         * wasm/js-api/test_basic_api.js:
18096         (const.c.in.constructorProperties.switch):
18097
18098 2016-12-15  JF Bastien  <jfbastien@apple.com>
18099
18100         WebAssembly API: improve data section errors
18101         https://bugs.webkit.org/show_bug.cgi?id=165733
18102
18103         Reviewed by Keith Miller.
18104
18105         * wasm/js-api/element-data.js: Added.
18106         (ElementBeforeData.set const):
18107         (ElementBeforeData): check the order of initialization, which is observable on failure
18108         * wasm/js-api/test_Data.js:
18109         (DataSectionWithoutMemory):
18110         (DataSectionOffTheEnd): Deleted.
18111         (DataSectionPartlyOffTheEnd): Deleted.
18112         (DataSectionEmptyOffTheEnd): Deleted.
18113         (DataSectionSeenByStart): Deleted.
18114
18115 2016-12-15  Keith Miller  <keith_miller@apple.com>
18116
18117         Fix 64-bit shift family Wasm opcodes
18118         https://bugs.webkit.org/show_bug.cgi?id=165902
18119
18120         Reviewed by Geoffrey Garen.
18121
18122         Add tests for shift family of instructions. Since
18123         we can't generate i64 values to pass to wasm we only compile
18124         the code for those functions. Attempting to generate any i64
18125         code using these instructions would have been enough to cause
18126         the B3 Validation error anyway.
18127
18128         * wasm/assert.js:
18129         * wasm/function-tests/rotl.js: Added.
18130         * wasm/function-tests/rotr.js: Added.
18131         * wasm/function-tests/shl.js: Added.
18132         * wasm/function-tests/shr-s.js: Added.
18133         * wasm/function-tests/shr-u.js: Added.
18134         * wasm/wasm.json:
18135
18136 2016-12-14  Keith Miller  <keith_miller@apple.com>
18137
18138         WebAssembly: test_BuilderJSON.js is broken
18139         https://bugs.webkit.org/show_bug.cgi?id=165893
18140
18141         Reviewed by Michael Saboff.
18142
18143         * wasm/Builder.js:
18144         (const._isValidValue):
18145         * wasm/self-test/test_BuilderJSON.js:
18146
18147 2016-12-14  Keith Miller  <keith_miller@apple.com>
18148
18149         Unreviewed, fix test.
18150
18151         * wasm/function-tests/i32-const.js:
18152
18153 2016-12-14  Keith Miller  <keith_miller@apple.com>
18154
18155         Wasm should decode constants correctly
18156         https://bugs.webkit.org/show_bug.cgi?id=165886
18157
18158         Reviewed by Saam Barati.
18159
18160         * wasm/Builder.js:
18161         (const._isValidValue):
18162         * wasm/Builder_WebAssemblyBinary.js:
18163         (const.putOp):
18164         * wasm/LowLevelBinary.js:
18165         (export.default.LowLevelBinary.prototype.float):
18166         (export.default.LowLevelBinary.prototype.double):
18167         * wasm/function-tests/f32-const.js: Added.
18168         * wasm/function-tests/f64-const.js: Added.
18169         * wasm/function-tests/i32-const.js: Added.
18170         * wasm/wasm.json:
18171
18172 2016-12-14  Saam Barati  <sbarati@apple.com>
18173
18174         WebAssembly: Add various low hanging fruit that will allow us to run the LLVM torture tests in Wasm
18175         https://bugs.webkit.org/show_bug.cgi?id=165883
18176
18177         Reviewed by Keith Miller.
18178
18179         * wasm/Builder.js:
18180         (export.default.Builder.prototype._registerSectionBuilders.switch.case.string_appeared_here.this.section):
18181         * wasm/Builder_WebAssemblyBinary.js:
18182         (const.emitters.Export):
18183         * wasm/js-api/table.js:
18184         (assertBadBinary):
18185         (assertBadTable):
18186         (assert.truthy):
18187         * wasm/js-api/test_memory.js:
18188         (binaryShouldNotParse):
18189         (test):
18190         (test.testMemImportError):
18191         (assert.truthy):
18192         (assert): Deleted.
18193
18194 2016-12-14  Filip Pizlo  <fpizlo@apple.com>
18195
18196         DirectTailCall implementation needs to tell the shuffler what to put into the ArgumentCount explicitly
18197         https://bugs.webkit.org/show_bug.cgi?id=165882
18198
18199         Reviewed by Mark Lam.
18200
18201         * stress/direct-tail-call-arity-mismatch-count-args.js: Added.
18202         (foo):
18203         (bar):
18204
18205 2016-12-14  Keith Miller  <keith_miller@apple.com>
18206
18207         WebAssembly JS API: implement Global
18208         https://bugs.webkit.org/show_bug.cgi?id=164133
18209
18210         Reviewed by Saam Barati.
18211
18212         * wasm/Builder.js:
18213         (export.default.Builder.prototype._registerSectionBuilders.switch.case.string_appeared_here.this.section):
18214         * wasm/Builder_WebAssemblyBinary.js:
18215         (const.valueType.WASM.description.type.i32.type.const.putGlobalType):
18216         (const.putOp):
18217         (const.putInitExpr):
18218         (const.emitters.Import):
18219         (const.emitters.Global):
18220         (const.emitters.Export):
18221         (const.emitters.Code):
18222         * wasm/LowLevelBinary.js:
18223         (export.default.LowLevelBinary.prototype.varuint32):
18224         (export.default.LowLevelBinary.prototype.varint32):
18225         * wasm/js-api/global-error.js: Added.
18226         (catch):
18227         (assert.truthy):
18228         * wasm/js-api/global-external-init-from-import.js: Added.
18229         * wasm/js-api/global-internal-init-from-import.js: Added.
18230         * wasm/js-api/global-mutate.js: Added.
18231         (createInternalGlobalModule):
18232         * wasm/js-api/globals-export.js: Added.
18233         * wasm/js-api/globals-import.js: Added.
18234         * wasm/wasm.json:
18235
18236 2016-12-13  Saam Barati  <sbarati@apple.com>
18237
18238         WebAssembly: implement the elements section
18239         https://bugs.webkit.org/show_bug.cgi?id=165715
18240
18241         Reviewed by Keith Miller.
18242
18243         * wasm/Builder.js:
18244         (export.default.Builder.prototype._registerSectionBuilders.switch.case.string_appeared_here.this.section):
18245         (export.default.Builder.prototype._registerSectionBuilders.switch):
18246         * wasm/Builder_WebAssemblyBinary.js:
18247         (const.emitters.Element):
18248         * wasm/function-tests/basic-element.js: Added.
18249         * wasm/js-api/element.js: Added.
18250         (assertBadBinary):
18251         (assertBadBinary.badInstantiation):
18252
18253 2016-12-13  Saam Barati  <sbarati@apple.com>
18254
18255         WebAssembly: implement the table section and table import
18256         https://bugs.webkit.org/show_bug.cgi?id=165716
18257
18258         Reviewed by Keith Miller.
18259
18260         * wasm/Builder.js:
18261         (const._importMemoryContinuation):
18262         (const._importTableContinuation):
18263         (export.default.Builder.prototype._registerSectionBuilders.switch.case.string_appeared_here.this.section):
18264         (const._importMemoryContinuation.section): Deleted.
18265         (const): Deleted.
18266         (const._importMemoryContinuation.assert): Deleted.
18267         * wasm/Builder_WebAssemblyBinary.js:
18268         (const.putResizableLimits):
18269         (const.putTable):
18270         (const.emitters.Import):
18271         (const.emitters.Table):
18272         * wasm/function-tests/call-indirect-params.js:
18273         * wasm/function-tests/call-indirect.js:
18274         * wasm/function-tests/table-basic-2.js: Added.
18275         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
18276         (func):
18277         * wasm/function-tests/table-basic.js: Added.
18278         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
18279         * wasm/js-api/call-indirect-results.js:
18280         (const.wasmModuleWhichImportJS): Deleted.
18281         (MonomorphicImport): Deleted.
18282         * wasm/js-api/call-indirect.js:
18283         (const.wasmModuleWhichImportJS):
18284         (const.makeTable):
18285         (Polyphic2Import):
18286         (VirtualImport):
18287         (MonomorphicImport): Deleted.
18288         * wasm/js-api/table.js: Added.
18289         (assertBadBinary):
18290         (assert.truthy):
18291         (assertBadTable):
18292         (assertBadTableImport):
18293         (assertBadBinary.assertBadTableInstance):
18294         (assertBadTableInstance):
18295         (new.WebAssembly.Table):
18296         * wasm/js-api/test_basic_api.js:
18297         (const.c.in.constructorProperties.switch):
18298
18299 2016-12-13  Commit Queue  <commit-queue@webkit.org>
18300
18301         Unreviewed, rolling out r209725.
18302         https://bugs.webkit.org/show_bug.cgi?id=165811
18303
18304         "Broke ARMv7 builds" (Requested by msaboff on #webkit).
18305
18306         Reverted changeset:
18307
18308         "REGRESSION(r209653): speedometer crashes making virtual slow
18309         path tailcalls"
18310         https://bugs.webkit.org/show_bug.cgi?id=165748
18311         http://trac.webkit.org/changeset/209725
18312
18313 2016-12-12  Michael Saboff  <msaboff@apple.com>
18314
18315         REGRESSION(r209653): speedometer crashes making virtual slow path tailcalls
18316         https://bugs.webkit.org/show_bug.cgi?id=165748
18317
18318         Reviewed by Filip Pizlo.
18319
18320         New regression test.
18321
18322         * stress/regress-165748.js: Added.
18323         (sum1):
18324         (sum2):
18325         (sum3):
18326         (sum4):
18327         (sum5):
18328         (sum6):
18329         (tailCaller):
18330         (test):
18331
18332 2016-12-12  Mark Lam  <mark.lam@apple.com>
18333
18334         Debug JSC test timeout: stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js.ftl-no-cjit.
18335         https://bugs.webkit.org/show_bug.cgi?id=164630
18336
18337         Reviewed by Keith Miller.
18338
18339         Speculative fix for timeout issue.  It looks like this test just runs a bit
18340         slower on debug builds.  So, we'll give it a little more time to run.
18341
18342         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js:
18343
18344 2016-12-11  Saam Barati  <sbarati@apple.com>
18345
18346         We should be able to throw exceptions from Wasm code and when Wasm frames are on the stack
18347         https://bugs.webkit.org/show_bug.cgi?id=165429
18348
18349         Reviewed by Keith Miller.
18350
18351         * wasm/function-tests/trap-load.js: Added.
18352         (assert):
18353         (wasmFrameCountFromError):
18354         (i.catch):
18355         (assert.continuation):
18356         * wasm/function-tests/trap-store.js: Added.
18357         (import.Builder.from.string_appeared_here.assert):
18358         (i.catch):
18359         (assert.continuation):
18360         (assert):
18361         * wasm/js-api/test_memory_constructor.js:
18362         (assert):
18363
18364 2016-12-10  Commit Queue  <commit-queue@webkit.org>
18365
18366         Unreviewed, rolling out r209653, r209654, r209663, and
18367         r209673.
18368         https://bugs.webkit.org/show_bug.cgi?id=165739
18369
18370         speedometer crashes (Requested by pizlo on #webkit).
18371
18372         Reverted changesets:
18373
18374         "JSVALUE64: Pass arguments in platform argument registers when
18375         making JavaScript calls"
18376         https://bugs.webkit.org/show_bug.cgi?id=160355
18377         http://trac.webkit.org/changeset/209653
18378
18379         "Unreviewed build fix for 32 bit builds."
18380         http://trac.webkit.org/changeset/209654
18381
18382         "Unreviewed build fix for the CLOOP after r209653"
18383         http://trac.webkit.org/changeset/209663
18384
18385         "REGRESSION(r209653) Crash in CallFrameShuffler::snapshot()"
18386         https://bugs.webkit.org/show_bug.cgi?id=165728
18387         http://trac.webkit.org/changeset/209673
18388
18389 2016-12-10  Michael Saboff  <msaboff@apple.com>
18390
18391         REGRESSION(r209653) Crash in CallFrameShuffler::snapshot()
18392         https://bugs.webkit.org/show_bug.cgi?id=165728
18393
18394         Reviewed by Filip Pizlo.
18395
18396         New regression test.
18397
18398         * stress/regress-165728.js: Added.
18399         (sum1):
18400         (sum2):
18401         (tailCaller):
18402         (test):
18403
18404 2016-12-10  Keith Miller  <keith_miller@apple.com>
18405
18406         Fix indirect_call if the result type is used.
18407         https://bugs.webkit.org/show_bug.cgi?id=165727
18408
18409         Reviewed by Michael Saboff.
18410
18411         * wasm/js-api/call-indirect-results.js: Added.
18412         (const.wasmModuleWhichImportJS):
18413         (MonomorphicImport):
18414
18415 2016-12-10  Yusuke Suzuki  <utatane.tea@gmail.com>
18416
18417         [JSC] Module namespace object behaves like immutable prototype exotic object
18418         https://bugs.webkit.org/show_bug.cgi?id=165598
18419
18420         Reviewed by Mark Lam.
18421
18422         * modules/namespace-prototype-assignment.js: Added.
18423         (else):
18424         (reportError):
18425         (shouldEqual):
18426         (shouldThrow):
18427         (stringify):
18428         (makeTestID):
18429         (doInternalSetPrototypeOf):
18430         (ordinarySetPrototypeOf):
18431         (setImmutablePrototype):
18432         (windowProxySetPrototypeOf):
18433         (initSetterExpectation):
18434         (throwIfNoExceptionPending):
18435         (objectSetPrototypeOf):
18436         (setUnderscoreProto):
18437         (reflectSetPrototypeOf):
18438         (setPrototypeOf):
18439         (newObjectProto.toString):
18440         (Symbol):
18441         (test):
18442         (runTests):
18443         * modules/namespace-set-prototype-of.js: Added.
18444         (shouldThrow):
18445         (TypeError.Cannot.set prototype):
18446
18447 2016-12-09  Michael Saboff  <msaboff@apple.com>
18448
18449         JSVALUE64: Pass arguments in platform argument registers when making JavaScript calls
18450         https://bugs.webkit.org/show_bug.cgi?id=160355
18451
18452         Reviewed by Filip Pizlo.
18453
18454         New microbenchmarks to measure call type performance.
18455
18456         * microbenchmarks/calling-computed-args.js: Added.
18457         * microbenchmarks/calling-many-callees.js: Added.
18458         * microbenchmarks/calling-one-callee-fixed.js: Added.
18459         * microbenchmarks/calling-one-callee.js: Added.
18460         * microbenchmarks/calling-poly-callees.js: Added.
18461         * microbenchmarks/calling-poly-extra-arity-callees.js: Added.
18462         * microbenchmarks/calling-tailcall.js: Added.
18463         * microbenchmarks/calling-virtual-arity-fixup-callees.js: Added.
18464         * microbenchmarks/calling-virtual-arity-fixup-stackargs.js: Added.
18465         * microbenchmarks/calling-virtual-callees.js: Added.
18466         * microbenchmarks/calling-virtual-extra-arity-callees.js: Added.
18467
18468 2016-12-09  Keith Miller  <keith_miller@apple.com>
18469
18470         Wasm should support call_indirect
18471         https://bugs.webkit.org/show_bug.cgi?id=165718
18472
18473         Reviewed by Filip Pizlo.
18474
18475         * wasm/Builder.js:
18476         * wasm/function-tests/call-indirect-params.js: Added.
18477         * wasm/function-tests/call-indirect.js: Added.
18478         * wasm/js-api/call-indirect.js: Added.
18479         (const.wasmModuleWhichImportJS):
18480         (MonomorphicImport):
18481         (Polyphic2Import):
18482         (VirtualImport):
18483         * wasm/wasm.json:
18484
18485 2016-12-09  JF Bastien  <jfbastien@apple.com>
18486
18487         WebAssembly: implement data section
18488         https://bugs.webkit.org/show_bug.cgi?id=165696
18489
18490         Reviewed by Keith Miller.
18491
18492         As specified in https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md#data-section
18493         Note that some of the interesting corner cases are ill-defined by the spec: https://github.com/WebAssembly/design/issues/897
18494
18495         * wasm/Builder.js: create a data section from JavaScript
18496         * wasm/Builder_WebAssemblyBinary.js: assemble the data section into the proper binary encoding
18497         (const.emitters.Data):
18498         * wasm/js-api/test_Data.js: Added.
18499         (DataSection):
18500         (DataSectionOffTheEnd):
18501         (DataSectionPartlyOffTheEnd):
18502         (DataSectionEmptyOffTheEnd):
18503         (DataSectionSeenByStart):
18504         * wasm/self-test/test_BuilderJSON.js: make sure the JSON structure is fine (this sanity checks before going to binary)
18505
18506 2016-12-09  JF Bastien  <jfbastien@apple.com>
18507
18508         WebAssembly JS API: implement start function
18509         https://bugs.webkit.org/show_bug.cgi?id=165150
18510
18511         Reviewed by Saam Barati.
18512
18513         * wasm/Builder.js: allow building a .Start()
18514         * wasm/Builder_WebAssemblyBinary.js:
18515         * wasm/js-api/test_Start.js: Added.
18516         (const.emitters.Start): serialize a start section
18517         * wasm/self-test/test_BuilderJSON.js: validate the start section's content
18518
18519 2016-12-09  Saam Barati  <sbarati@apple.com>
18520
18521         WebAssembly JS API: implement importing and defining Memory
18522         https://bugs.webkit.org/show_bug.cgi?id=164134
18523
18524         Reviewed by Keith Miller.
18525
18526         * wasm/Builder.js:
18527         (const._importMemoryContinuation.section):
18528         (const._importMemoryContinuation.assert):
18529         (const._importMemoryContinuation):
18530         (const._exportFunctionContinuation.const): Deleted.
18531         (const._exportFunctionContinuation): Deleted.
18532         * wasm/Builder_WebAssemblyBinary.js:
18533         (const.emitters.Import):
18534         * wasm/js-api/test_basic_api.js:
18535         (const.c.in.constructorProperties.switch):
18536         * wasm/js-api/test_memory.js: Added.
18537         (assert):
18538         (binaryShouldNotParse):
18539         (test):
18540         (test.testMemImportError):
18541         * wasm/js-api/test_memory_constructor.js: Added.
18542         (assert):
18543         (throw.new.Error):
18544         (testInvalidSize):
18545         (assert.testInvalidInitial):
18546         (testInvalidInitial.testInvalidMaximum):
18547         (testInvalidInitial):
18548         (testInvalidMaximum):
18549         * wasm/self-test/test_BuilderJSON.js:
18550
18551 2016-12-08  JF Bastien  <jfbastien@apple.com>
18552
18553         WebAssembly: JSC::link* shouldn't need a CodeBlock
18554         https://bugs.webkit.org/show_bug.cgi?id=165591
18555
18556         Reviewed by Keith Miller.
18557
18558         test that wasm -> JS works, including the IC
18559
18560         * wasm/js-api/test_Instance.js:
18561         (const.wasmModuleWhichImportJS):
18562         (MonomorphicImport):
18563         (Polyphic2Import):
18564         (Polyphic3Import):
18565         (VirtualImport):
18566
18567 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
18568
18569         Green the cloop bot by raising this threshold.
18570
18571         * mozilla/js1_5/Array/regress-101964.js:
18572
18573 2016-12-08  JF Bastien  <jfbastien@apple.com>
18574
18575         WebAssembly JS API: wire up Instance imports
18576         https://bugs.webkit.org/show_bug.cgi?id=165118
18577
18578         Reviewed by Saam Barati.
18579
18580         * wasm/js-api/test_Instance.js: add the test, disabled for now
18581
18582 2016-12-07  Keith Miller  <keith_miller@apple.com>
18583
18584         Add more missing trivial wasm ops.
18585         https://bugs.webkit.org/show_bug.cgi?id=165564
18586
18587         Add tests for drop and tee_local.
18588
18589         Reviewed by Geoffrey Garen.
18590
18591         * wasm/function-tests/drop.js: Added.
18592         * wasm/function-tests/nop.js: Added.
18593         * wasm/function-tests/tee-local.js: Added.
18594
18595 2016-12-06  Keith Miller  <keith_miller@apple.com>
18596
18597         Add support for truncation operators
18598         https://bugs.webkit.org/show_bug.cgi?id=165519
18599
18600         Reviewed by Geoffrey Garen.
18601
18602         * wasm/function-tests/i32-trunc-s-f32.js: Added.
18603         * wasm/function-tests/i32-trunc-s-f64.js: Added.
18604         * wasm/function-tests/i32-trunc-u-f32.js: Added.
18605         * wasm/function-tests/i32-trunc-u-f64.js: Added.
18606         * wasm/function-tests/i64-trunc-s-f32.js: Added.
18607         * wasm/function-tests/i64-trunc-s-f64.js: Added.
18608         * wasm/function-tests/i64-trunc-u-f32.js: Added.
18609         * wasm/function-tests/i64-trunc-u-f64.js: Added.
18610
18611 2016-12-06  Mark Lam  <mark.lam@apple.com>
18612
18613         Introduce the concept of Immutable Prototype Exotic Objects to comply with the spec.
18614         https://bugs.webkit.org/show_bug.cgi?id=165227
18615         <rdar://problem/29442665>
18616
18617         Reviewed by Saam Barati.
18618
18619         * stress/get-from-scope-dynamic-onto-proxy.js:
18620         - Updated error message.
18621
18622         * stress/proxy-dont-infinite-loop.js: Removed.
18623         * stress/proxy-json-path.js: Removed.
18624         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Removed.
18625         - Removed these tests because the issue they are testing relies on being able to
18626           set Object.prototype.__proto__ to something else (which is now not possible).
18627
18628 2016-12-05  Caitlin Potter  <caitp@igalia.com>
18629
18630         [JSC] report unexpected token when "async" is followed by identifier
18631         https://bugs.webkit.org/show_bug.cgi?id=165091
18632
18633         Reviewed by Mark Lam.
18634
18635         * stress/bug-165091.js:
18636
18637 2016-12-05  Keith Miller  <keith_miller@apple.com>
18638
18639         Add Wasm i64 to i32 conversion.
18640         https://bugs.webkit.org/show_bug.cgi?id=165378
18641
18642         Reviewed by Filip Pizlo.
18643
18644         It turns out the wrap operation is just B3's Trunc.
18645
18646         * wasm/wasm.json:
18647
18648 2016-12-04  Keith Miller  <keith_miller@apple.com>
18649
18650         Add support for Wasm ctz and popcnt
18651         https://bugs.webkit.org/show_bug.cgi?id=165369
18652
18653         Reviewed by Saam Barati.
18654
18655         * wasm/function-tests/ctz.js: Added.
18656         * wasm/function-tests/popcnt.js: Added.
18657
18658 2016-12-03  JF Bastien  <jfbastien@apple.com>
18659
18660         WebAssembly: update binary format to 0xD version
18661         https://bugs.webkit.org/show_bug.cgi?id=165345
18662
18663         Reviewed by Keith Miller.
18664
18665         As described in the following PR: https://github.com/WebAssembly/design/pull/836
18666         Originally committed in r209175, reverted in r209242, and fixed in r209284.
18667
18668         * wasm/Builder.js:
18669         (const._normalizeFunctionSignature):
18670         * wasm/Builder_WebAssemblyBinary.js:
18671         (const.emitters.Type):
18672         (const.emitters.Code):
18673         * wasm/LowLevelBinary.js:
18674         (export.default.LowLevelBinary.prototype.block_type):
18675         (export.default.LowLevelBinary.prototype.inline_signature_type): Deleted.
18676         * wasm/WASM.js:
18677         * wasm/js-api/test_basic_api.js:
18678         * wasm/self-test/test_BuilderWebAssembly.js:
18679         (EmptyModule):
18680         (CustomSection):
18681         * wasm/self-test/test_WASM.js:
18682         * wasm/wasm.json:
18683
18684 2016-12-02  Keith Miller  <keith_miller@apple.com>
18685
18686         Add Wasm copysign
18687         https://bugs.webkit.org/show_bug.cgi?id=165355
18688
18689         Reviewed by Filip Pizlo.
18690
18691         * wasm/function-tests/copysign.js: Added.
18692
18693 2016-12-03  Commit Queue  <commit-queue@webkit.org>
18694
18695         Unreviewed, rolling out r209298.
18696         https://bugs.webkit.org/show_bug.cgi?id=165359
18697
18698         broke the build (Requested by smfr on #webkit).
18699
18700         Reverted changeset:
18701
18702         "Add Wasm copysign"
18703         https://bugs.webkit.org/show_bug.cgi?id=165355
18704         http://trac.webkit.org/changeset/209298
18705
18706 2016-12-02  Keith Miller  <keith_miller@apple.com>
18707
18708         Add Wasm copysign
18709         https://bugs.webkit.org/show_bug.cgi?id=165355
18710
18711         Reviewed by Filip Pizlo.
18712
18713         * wasm/function-tests/copysign.js: Added.
18714
18715 2016-12-02  Keith Miller  <keith_miller@apple.com>
18716
18717         Unreviewed, fix git having a breakdown over trying to reland a rollout.
18718
18719 2016-12-02  Keith Miller  <keith_miller@apple.com>
18720
18721         Add Wasm floating point nearest and trunc
18722         https://bugs.webkit.org/show_bug.cgi?id=165339
18723
18724         Reviewed by Saam Barati.
18725
18726         * wasm/function-tests/nearest.js: Added.
18727         * wasm/function-tests/trunc.js: Added.
18728
18729 2016-12-02  Caitlin Potter  <caitp@igalia.com>
18730
18731 [JSC] add additional bit to JSTokenType bitfield
18732         https://bugs.webkit.org/show_bug.cgi?id=165091
18733
18734         Reviewed by Geoffrey Garen.
18735
18736         * stress/bug-165091.js: Added.
18737         (shouldThrowSyntaxError):
18738
18739 2016-12-02  Commit Queue  <commit-queue@webkit.org>
18740
18741         Unreviewed, rolling out r209275 and r209276.
18742         https://bugs.webkit.org/show_bug.cgi?id=165348
18743
18744         "broke the arm build" (Requested by keith_miller on #webkit).
18745
18746         Reverted changesets:
18747
18748         "Add Wasm floating point nearest and trunc"
18749         https://bugs.webkit.org/show_bug.cgi?id=165339
18750         http://trac.webkit.org/changeset/209275
18751
18752         "Unreviewed, forgot to change instruction after renaming."
18753         http://trac.webkit.org/changeset/209276
18754
18755 2016-12-02  Keith Miller  <keith_miller@apple.com>
18756
18757         Add Wasm floating point nearest and trunc
18758         https://bugs.webkit.org/show_bug.cgi?id=165339
18759
18760         Reviewed by Filip Pizlo.
18761
18762         * wasm/function-tests/nearest.js: Added.
18763         * wasm/function-tests/trunc.js: Added.
18764
18765 2016-12-02  JF Bastien  <jfbastien@apple.com>
18766
18767         WebAssembly: revert patch causing odd breakage
18768         https://bugs.webkit.org/show_bug.cgi?id=165308
18769
18770         Unreviewed.
18771
18772         Bug #164724 seems to cause build issues which I haven't tracked down yet. WasmOps.h can't be found:
18773         ./Source/JavaScriptCore/wasm/WasmFormat.h:34:10: fatal error: 'WasmOps.h' file not found
18774
18775         It's weird since the file is auto-generated and has been for a while. #164724 merely includes it in WasmFormat.h.
18776
18777         * wasm/Builder.js:
18778         (const._normalizeFunctionSignature):
18779         * wasm/Builder_WebAssemblyBinary.js:
18780         (const.emitters.Type):
18781         (const.emitters.Code):
18782         * wasm/LowLevelBinary.js:
18783         (export.default.LowLevelBinary.prototype.inline_signature_type):
18784         (export.default.LowLevelBinary.prototype.block_type): Deleted.
18785         * wasm/WASM.js:
18786         * wasm/js-api/test_basic_api.js:
18787         * wasm/self-test/test_BuilderWebAssembly.js:
18788         (EmptyModule):
18789         (CustomSection):
18790         * wasm/self-test/test_WASM.js:
18791         * wasm/wasm.json:
18792
18793 2016-12-01  Ryan Haddad  <ryanhaddad@apple.com>
18794
18795         Skip flaky test ChakraCore/test/fieldopts/objtypespec-newobj-invalidation.1.js
18796         https://bugs.webkit.org/show_bug.cgi?id=162567
18797
18798         Reviewed by Saam Barati.
18799
18800         * ChakraCore.yaml:
18801
18802 2016-12-01  Keith Miller  <keith_miller@apple.com>
18803
18804         Add wasm int to floating point opcodes
18805         https://bugs.webkit.org/show_bug.cgi?id=165252
18806
18807         Reviewed by Geoffrey Garen.
18808
18809         Add tests for Wasm integral to floating point conversion opcodes.
18810
18811         * wasm/function-tests/int-to-floating-point.js: Added.
18812         * wasm/wasm.json:
18813
18814 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
18815
18816         Land a test case for <rdar://problem/27889416>
18817         https://bugs.webkit.org/show_bug.cgi?id=165272
18818
18819         Reviewed by Saam Barati.
18820
18821         * stress/marked-argument-buffer.js: Added.
18822         (allocate):
18823         (test.o.toString):
18824         (test):
18825
18826 2016-11-29  Per Arne Vollan  <pvollan@apple.com>
18827
18828         [Win] Skip failing JSC tests.
18829         https://bugs.webkit.org/show_bug.cgi?id=165140
18830
18831         Reviewed by Mark Lam.
18832
18833         * ChakraCore.yaml:
18834         * microbenchmarks/tan.js:
18835
18836 2016-11-30  JF Bastien  <jfbastien@apple.com>
18837
18838         WebAssembly builder: don't throw when checker not implemented
18839         https://bugs.webkit.org/show_bug.cgi?id=165219
18840
18841         Reviewed by Mark Lam.
18842
18843         We should perform whichever checks we've implemented, and assume the rest are OK until bug #163421 is fixed.
18844
18845         * wasm/Builder.js:
18846         * wasm/README.md:
18847         * wasm/function-tests/add-12.js:
18848         * wasm/function-tests/br-if-loop-less-than.js:
18849         * wasm/function-tests/brTableAsIf.js:
18850         * wasm/function-tests/brTableManyValues.js:
18851         * wasm/function-tests/brTableWithLoop.js:
18852         * wasm/function-tests/dumb-eq-if-then-else.js:
18853         * wasm/function-tests/dumb-less-than-fallthrough.js:
18854         * wasm/function-tests/dumb-less-than-ite.js:
18855         * wasm/function-tests/eqz.js:
18856         * wasm/function-tests/factorial.js:
18857         * wasm/function-tests/float-sub.js:
18858         * wasm/function-tests/i32-load.js:
18859         * wasm/function-tests/i32-load8-s.js:
18860         * wasm/function-tests/if-then-else-fallthrough.js:
18861         * wasm/function-tests/if-then-fallthrough.js:
18862         * wasm/function-tests/loop-mult.js:
18863         * wasm/function-tests/loop-sum.js:
18864         * wasm/function-tests/max.js:
18865         * wasm/function-tests/min.js:
18866         * wasm/function-tests/ret5.js:
18867         * wasm/function-tests/select.js:
18868         * wasm/self-test/test_BuilderJSON.js:
18869
18870 2016-11-29  JF Bastien  <jfbastien@apple.com>
18871
18872         WebAssembly JS API: improve Instance
18873         https://bugs.webkit.org/show_bug.cgi?id=164757
18874
18875         Reviewed by Keith Miller.
18876
18877         An Instance's `exports` property wasn't populated with exports.
18878
18879         A follow-up patch will do imports.
18880
18881         A few things of note:
18882
18883          - LowLevelBinary: support 3-byte integers.
18884          - LowLevelBinary: support proper UTF-8 2003 code points (instead of UTF-16).
18885
18886         * wasm/Builder.js:
18887         * wasm/Builder_WebAssemblyBinary.js: wire up exports, stub other things out some more
18888         (const.emitters.Export):
18889         * wasm/LowLevelBinary.js:
18890         (export.default.LowLevelBinary.prototype.uint24): add, used for UTF-8
18891         (export.default.LowLevelBinary.prototype.string): support UTF-8
18892         (export.default.LowLevelBinary.prototype.getUint24): add, used for UTF-8
18893         (export.default.LowLevelBinary.prototype.getVaruint1): was missing
18894         (export.default.LowLevelBinary.prototype.getString): support UTF-8
18895         (export.default.LowLevelBinary):
18896         * wasm/js-api/test_Instance.js: instance.exports.answer() // <-- this is where the magic of this entire patch is
18897         (ExportedAnswerI32):
18898         * wasm/js-api/test_basic_api.js: punt test to later
18899         (const.c.in.constructorProperties.switch):
18900         * wasm/self-test/test_BuilderWebAssembly.js: UTF-8
18901         (CustomSection):
18902         * wasm/self-test/test_LowLevelBinary_string.js: UTF-8 now works
18903         * wasm/self-test/test_LowLevelBinary_uint16.js: was missing one value
18904         * wasm/self-test/test_LowLevelBinary_uint24.js: Copied from JSTests/wasm/self-test/test_LowLevelBinary_uint8.js.
18905         * wasm/self-test/test_LowLevelBinary_uint8.js: was missing one value
18906         * wasm/self-test/test_LowLevelBinary_varuint1.js: Added.
18907         * wasm/utilities.js: this `dump` thing was useful
18908         (const._dump):
18909
18910 2016-11-29  Saam Barati  <sbarati@apple.com>
18911
18912         We should be able optimize the pattern where we spread a function's rest parameter to another call
18913         https://bugs.webkit.org/show_bug.cgi?id=163865
18914
18915         Reviewed by Filip Pizlo.
18916
18917         * microbenchmarks/default-derived-constructor.js: Added.
18918         (createClassHierarchy.let.currentClass):
18919         (createClassHierarchy):
18920         * stress/call-varargs-spread.js: Added.
18921         (assert):
18922         (bar):
18923         (foo):
18924         * stress/load-varargs-on-new-array-with-spread-convert-to-static-loads.js: Added.
18925         (assert):
18926         (baz):
18927         (bar):
18928         (foo):
18929         * stress/new-array-with-spread-with-normal-spread-and-phantom-spread.js: Added.
18930         (assert):
18931         (foo):
18932         (escape):
18933         (bar):
18934         * stress/phantom-new-array-with-spread-osr-exit.js: Added.
18935         (assert):
18936         (baz):
18937         (bar):
18938         (effects):
18939         (foo):
18940         * stress/phantom-spread-forward-varargs.js: Added.
18941         (assert):
18942         (test1.bar):
18943         (test1.foo):
18944         (test1):
18945         (test2.bar):
18946         (test2.foo):
18947         (test3.baz):
18948         (test3.bar):
18949         (test3.foo):
18950         (test4.baz):
18951         (test4.bar):
18952         (test4.foo):
18953         (test5.baz):
18954         (test5.bar):
18955         (test5.foo):
18956         * stress/phantom-spread-osr-exit.js: Added.
18957         (assert):
18958         (baz):
18959         (bar):
18960         (effects):
18961         (foo):
18962         * stress/spread-call-convert-to-static-call.js: Added.
18963         (assert):
18964         (baz):
18965         (bar):
18966         (foo):
18967         * stress/spread-forward-call-varargs-stack-overflow.js: Added.
18968         (assert):
18969         (identity):
18970         (bar):
18971         (foo):
18972         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol-2.js: Added.
18973         (assert):
18974         (baz.Array.prototype.Symbol.iterator):
18975         (baz):
18976         (bar):
18977         (foo):
18978         (test):
18979         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol.js: Added.
18980         (assert):
18981         (baz.Array.prototype.Symbol.iterator):
18982         (baz):
18983         (bar):
18984         (foo):
18985         * stress/spread-forward-varargs-stack-overflow.js: Added.
18986         (assert):
18987         (bar):
18988         (foo):
18989
18990 2016-11-29  Caitlin Potter  <caitp@igalia.com>
18991
18992         [JSC] always wrap AwaitExpression operand in a new Promise
18993         https://bugs.webkit.org/show_bug.cgi?id=165181
18994
18995         Reviewed by Yusuke Suzuki.
18996
18997         * stress/async-await-basic.js:
18998         (async.awaitedPromisesAreWrapped):
18999
19000 2016-11-29  Keith Miller  <keith_miller@apple.com>
19001
19002         Add simple way to implement Wasm ops that require more than one B3 opcode
19003         https://bugs.webkit.org/show_bug.cgi?id=165129
19004
19005         Reviewed by Geoffrey Garen.
19006
19007         * wasm/function-tests/eqz.js: Added.
19008         * wasm/function-tests/max.js: Added.
19009         * wasm/function-tests/min.js: Added.
19010         * wasm/wasm.json:
19011
19012 2016-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
19013
19014         Crash in com.apple.JavaScriptCore: WTF::ThreadSpecific<WTF::WTFThreadData, + 142
19015         https://bugs.webkit.org/show_bug.cgi?id=164898
19016
19017         Reviewed by Darin Adler.
19018
19019         * stress/tagged-template-registry-key-collect.js: Added.
19020         (shouldBe):
19021         (tag):
19022         (i.eval):
19023         * stress/tagged-template-registry-key.js: Added.
19024         (shouldBe):
19025         (tag):
19026         (a):
19027         (b):
19028
19029 2016-11-20  Caitlin Potter  <caitp@igalia.com>
19030
19031         [JSC] speed up parsing of async functions
19032         https://bugs.webkit.org/show_bug.cgi?id=164808
19033
19034         Reviewed by Yusuke Suzuki.
19035
19036         Add tests for line terminator following "async" keyword in async
19037         function syntax.
19038
19039         * stress/async-await-syntax.js:
19040         (shouldBe):
19041
19042 2016-11-19  Mark Lam  <mark.lam@apple.com>
19043
19044         op_mod-* JSC tests needs a longer timeout too.
19045         https://bugs.webkit.org/show_bug.cgi?id=164994
19046
19047         Reviewed by Yusuke Suzuki.
19048
19049         * stress/op_mod-ConstVar.js:
19050         * stress/op_mod-VarConst.js:
19051         * stress/op_mod-VarVar.js:
19052
19053 2016-11-19  Mark Lam  <mark.lam@apple.com>
19054
19055         Add --timeoutMultiplier option to allow some tests more time to run.
19056         https://bugs.webkit.org/show_bug.cgi?id=164951
19057
19058         Reviewed by Yusuke Suzuki.
19059
19060         Extended the timeout for these tests by 50% more because they run quite slow on
19061         low-end machines.
19062
19063         * stress/op_div-ConstVar.js:
19064         * stress/op_div-VarConst.js:
19065         * stress/op_div-VarVar.js:
19066
19067 2016-11-18  Yusuke Suzuki  <utatane.tea@gmail.com>
19068
19069         REGRESSION(r208867): JSC test failure: ChakraCore.yaml/ChakraCore/test/strict/05.arguments_sm.js.default
19070         https://bugs.webkit.org/show_bug.cgi?id=164929
19071
19072         Reviewed by Mark Lam.
19073
19074         ES2017 drops arguments.caller and JavaScriptCore is updated to meet the spec.
19075         This patch rebaselines the result of ChakraCore test for JSC.
19076
19077         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
19078
19079 2016-11-18  Joseph Pecoraro  <pecoraro@apple.com>
19080
19081         Web Inspector: Generator functions should have a displayable name when shown in stack traces
19082         https://bugs.webkit.org/show_bug.cgi?id=164844
19083         <rdar://problem/29300697>
19084
19085         Reviewed by Yusuke Suzuki.
19086
19087         * stress/generator-function-name.js:
19088         Add another test now that we name the inner generator function
19089         that we do not break the lexical resolution of names.
19090
19091 2016-11-17  Yusuke Suzuki  <utatane.tea@gmail.com>
19092
19093         [JSC] Drop arguments.caller
19094         https://bugs.webkit.org/show_bug.cgi?id=164859
19095
19096         Reviewed by Saam Barati.
19097
19098         * stress/strict-mode-arguments-caller.js: Added.
19099         (strictArguments):
19100         (shouldBe):
19101
19102 2016-11-17  Keith Miller  <keith_miller@apple.com>
19103
19104         Add rotate to Wasm
19105         https://bugs.webkit.org/show_bug.cgi?id=164871
19106
19107         Reviewed by Filip Pizlo.
19108
19109         * wasm/wasm.json:
19110
19111 2016-11-17  Keith Miller  <keith_miller@apple.com>
19112
19113         Add sqrt to Wasm
19114         https://bugs.webkit.org/show_bug.cgi?id=164877
19115
19116         Reviewed by Mark Lam.
19117
19118         B3 already has a Sqrt opcode we just need to map Wasm to it.
19119
19120         * wasm/wasm.json:
19121
19122 2016-11-17  Saam Barati  <sbarati@apple.com>
19123
19124         Remove async/await compile time flag and enable tests
19125         https://bugs.webkit.org/show_bug.cgi?id=164828
19126         <rdar://problem/28639334>
19127
19128         Reviewed by Yusuke Suzuki.
19129
19130         * stress/async-arrow-functions-lexical-arguments-binding.js:
19131         * stress/async-arrow-functions-lexical-new.target-binding.js:
19132         * stress/async-arrow-functions-lexical-super-binding.js:
19133         * stress/async-arrow-functions-lexical-this-binding.js:
19134         * stress/async-await-basic.js:
19135         * stress/async-await-long-loop.js:
19136         * stress/async-await-module-reserved-word.js:
19137         * stress/async-await-mozilla.js:
19138         (mozSyntaxErrors):
19139         * stress/async-await-reserved-word.js:
19140         * stress/async-await-syntax.js:
19141         * stress/async-await-throw-loop.js:
19142         * stress/async-function-create-nobaseline.js:
19143         * stress/async-function-create-optimized.js:
19144         * stress/async-function-declaration-sinking-no-double-allocate.js:
19145         * stress/async-function-declaration-sinking-osrexit.js:
19146         * stress/async-function-declaration-sinking-put.js:
19147         * stress/async-function-expression-sinking-no-double-allocate.js:
19148         * stress/async-function-expression-sinking-osrexit.js:
19149         * stress/async-function-expression-sinking-put.js:
19150         * test262.yaml:
19151
19152 2016-11-15  Mark Lam  <mark.lam@apple.com>
19153
19154         Make JSC test functions more robust.
19155         https://bugs.webkit.org/show_bug.cgi?id=164807
19156
19157         Reviewed by Keith Miller.
19158
19159         * stress/jsc-test-functions-should-be-more-robust.js: Added.
19160
19161 2016-11-15  Keith Miller  <keith_miller@apple.com>
19162
19163         B3 should support UDiv/UMod
19164         https://bugs.webkit.org/show_bug.cgi?id=164811
19165
19166         Reviewed by Filip Pizlo.
19167
19168         Link new instructions to wasm.
19169
19170         * wasm/wasm.json:
19171
19172 2016-11-15  Saam Barati  <sbarati@apple.com>
19173
19174         Debug JSC test timeout: stress/has-own-property-name-cache-symbols-and-strings.js.ftl-no-cjit-small-pool
19175         https://bugs.webkit.org/show_bug.cgi?id=163012
19176
19177         Unreviewed. This patch makes a test run for less time because it's timing out on the bots.
19178
19179         * stress/has-own-property-name-cache-symbols-and-strings.js:
19180
19181 2016-11-15  Mark Lam  <mark.lam@apple.com>
19182
19183         The jsc shell's setImpureGetterDelegate() should ensure that the set value is an ImpureGetter.
19184         https://bugs.webkit.org/show_bug.cgi?id=164781
19185         <rdar://problem/28418590>
19186
19187         Reviewed by Geoffrey Garen and Michael Saboff.
19188
19189         * stress/jsc-setImpureGetterDelegate-on-bad-type.js: Added.
19190
19191 2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
19192
19193         [DOMJIT] Allow using macro assembler scratches in FTL CheckDOM
19194         https://bugs.webkit.org/show_bug.cgi?id=164727
19195
19196         Reviewed by Filip Pizlo.
19197
19198         * stress/check-dom-with-signature.js: Added.
19199         (shouldBe):
19200         (calling):
19201         (i.array.forEach):
19202
19203 2016-11-14  Caitlin Potter  <caitp@igalia.com>
19204
19205         [JSC] do not reference AwaitExpression Promises in async function Promise chain
19206         https://bugs.webkit.org/show_bug.cgi?id=164753
19207
19208         Reviewed by Yusuke Suzuki.
19209
19210         * asyncFunctionTests.yaml:
19211         * stress/async-await-long-loop.js: Added.
19212         (shouldBe):
19213         (async.longLoop):
19214         * stress/async-await-throw-loop.js: Added.
19215         (shouldBe):
19216         (async.thrower):
19217         (async.throwLoop):
19218
19219 2016-11-14  Keith Miller  <keith_miller@apple.com>
19220
19221         Add Wasm select
19222         https://bugs.webkit.org/show_bug.cgi?id=164743
19223
19224         Reviewed by Saam Barati.
19225
19226         * wasm/function-tests/select.js: Added.
19227
19228 2016-11-14  Caitlin Potter  <caitp@igalia.com>
19229
19230         [JSC] Handle new_async_func / new_async_func_exp in DFG / FTL
19231         https://bugs.webkit.org/show_bug.cgi?id=164037
19232
19233         Reviewed by Yusuke Suzuki.
19234
19235         Add tests based on tests from https://trac.webkit.org/changeset/194216.
19236
19237         * asyncFunctionTests.yaml:
19238         * stress/async-function-create-nobaseline.js: Added.
19239         * stress/async-function-create-optimized.js: Added.
19240         * stress/async-function-declaration-sinking-no-double-allocate.js: Added.
19241         * stress/async-function-declaration-sinking-osrexit.js: Added.
19242         * stress/async-function-declaration-sinking-put.js: Added.
19243         * stress/async-function-expression-sinking-no-double-allocate.js: Added.
19244         * stress/async-function-expression-sinking-osrexit.js: Added.
19245         * stress/async-function-expression-sinking-put.js: Added.
19246
19247 2016-11-14  Mark Lam  <mark.lam@apple.com>
19248
19249         Some of JSStringView::SafeView methods are not idiomatically safe for JSString to StringView conversions.
19250         https://bugs.webkit.org/show_bug.cgi?id=164701
19251         <rdar://problem/27462104>
19252
19253         Reviewed by Darin Adler.
19254
19255         * stress/string-prototype-charCodeAt-on-too-long-rope.js: Added.
19256
19257 2016-11-14  Mark Lam  <mark.lam@apple.com>
19258
19259         RegExpObject::exec/match should handle errors gracefully.
19260         https://bugs.webkit.org/show_bug.cgi?id=155145
19261         <rdar://problem/27435934>
19262
19263         Reviewed by Keith Miller.
19264
19265         * stress/regexp-prototype-exec-on-too-long-rope.js: Added.
19266         * stress/regexp-prototype-match-on-too-long-rope.js: Added.
19267         * stress/regexp-prototype-test-on-too-long-rope.js: Added.
19268
19269 2016-11-14  Mark Lam  <mark.lam@apple.com>
19270
19271         Enhance run-jsc-stress-test script to allow optional test specific options to be added for all test run configurations.
19272         https://bugs.webkit.org/show_bug.cgi?id=164695
19273
19274         Reviewed by Keith Miller.
19275
19276         Replace use of runMisc* test run configurations with equivalents.
19277
19278         * stress/licm-no-pre-header-nested.js:
19279         * stress/licm-no-pre-header.js:
19280         * stress/licm-pre-header-cannot-exit-nested.js:
19281         * stress/licm-pre-header-cannot-exit.js:
19282         * stress/make-dictionary-repatch.js:
19283         * stress/retry-cache-later.js:
19284         * stress/shadow-chicken-reading-from-scope-after-ftl-osr-exit-bytecode-liveness.js:
19285         * stress/slow-path-generator-updating-current-node-dfg.js:
19286         * stress/unshift-array-storage.js:
19287
19288 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
19289
19290         test262: DataView with explicit undefined byteLength should be the same as it not being present
19291         https://bugs.webkit.org/show_bug.cgi?id=164453
19292
19293         Reviewed by Darin Adler.
19294
19295         * stress/dataview-construct.js: Added.
19296         (assert):
19297         (shouldThrow):
19298         * test262.yaml:
19299
19300 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
19301
19302         test262: DataView get methods should allow for missing offset, set methods should allow for missing value
19303         https://bugs.webkit.org/show_bug.cgi?id=164451
19304
19305         Reviewed by Darin Adler.
19306
19307         * test262.yaml:
19308
19309 2016-11-11  Saam Barati  <sbarati@apple.com>
19310
19311         We should have a more concise way of determining when we're varargs calling a function using rest parameters
19312         https://bugs.webkit.org/show_bug.cgi?id=164258
19313
19314         Reviewed by Yusuke Suzuki.
19315
19316         * microbenchmarks/call-using-spread.js: Added.
19317         (bar):
19318         (foo):
19319         * microbenchmarks/spread-large-array.js: Added.
19320         (foo):
19321         (arrays.push):
19322         * microbenchmarks/spread-small-array.js: Added.
19323         (foo):
19324         * stress/spread-array-iterator-watchpoint-2.js: Added.
19325         (foo):
19326         (arrayIterator.next):
19327         * stress/spread-array-iterator-watchpoint.js: Added.
19328         (foo):
19329         (Array.prototype.Symbol.iterator):
19330         * stress/spread-non-array.js: Added.
19331         (assert):
19332         (foo):
19333         (let.customIterator.Symbol.iterator):
19334         (bar):
19335
19336 2016-11-11  Keith Miller  <keith_miller@apple.com>
19337
19338         Relocate wasm tests and actually add them to the test runner
19339         https://bugs.webkit.org/show_bug.cgi?id=164668
19340
19341         Reviewed by Yusuke Suzuki.
19342
19343         This moves the Wasm tests from their current location down a level.
19344         Without relocating, the tests cannot properly be run by the wasm test runner.
19345
19346         * wasm.yaml:
19347         * wasm/Builder.js: Fix typos, yay lazy synatx checking!
19348         * wasm/LowLevelBinary.js: Fix typos, yay lazy synatx checking!
19349         (export.default.LowLevelBinary.prototype.get return):
19350         * wasm/function-tests/add-12.js: Renamed from JSTests/wasm/js-api/function-tests/add-12.js.
19351         * wasm/function-tests/br-if-loop-less-than.js: Renamed from JSTests/wasm/js-api/function-tests/br-if-loop-less-than.js.
19352         * wasm/function-tests/brTableAsIf.js: Renamed from JSTests/wasm/js-api/function-tests/brTableAsIf.js.
19353         * wasm/function-tests/brTableManyValues.js: Renamed from JSTests/wasm/js-api/function-tests/brTableManyValues.js.
19354         * wasm/function-tests/brTableWithLoop.js: Renamed from JSTests/wasm/js-api/function-tests/brTableWithLoop.js.
19355         * wasm/function-tests/dumb-eq-if-then-else.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-eq-if-then-else.js.
19356         * wasm/function-tests/dumb-less-than-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-fallthrough.js.
19357         * wasm/function-tests/dumb-less-than-ite.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-ite.js.
19358         * wasm/function-tests/factorial.js: Renamed from JSTests/wasm/js-api/function-tests/factorial.js.
19359         * wasm/function-tests/float-sub.js: Renamed from JSTests/wasm/js-api/function-tests/float-sub.js.
19360         * wasm/function-tests/i32-load.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load.js.
19361         * wasm/function-tests/i32-load8-s.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load8-s.js.
19362         * wasm/function-tests/if-then-else-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-else-fallthrough.js.
19363         * wasm/function-tests/if-then-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-fallthrough.js.
19364         * wasm/function-tests/loop-mult.js: Renamed from JSTests/wasm/js-api/function-tests/loop-mult.js.
19365         * wasm/function-tests/loop-sum.js: Renamed from JSTests/wasm/js-api/function-tests/loop-sum.js.
19366         * wasm/function-tests/ret5.js: Renamed from JSTests/wasm/js-api/function-tests/ret5.js.
19367         * wasm/self-test/test_BuilderJSON.js: Rebasline
19368
19369 2016-11-11  Keith Miller  <keith_miller@apple.com>
19370
19371         Move Wasm tests to JS
19372         https://bugs.webkit.org/show_bug.cgi?id=164611
19373
19374         Reviewed by Geoffrey Garen.
19375
19376         This patch translates most of the tests from testWasm.cpp to the JS testing api. Most of the
19377         ommited tests were earliest tests, which tested trivial things, like adding two
19378         constants. Some tests are ommited for other reasons, however. These are:
19379
19380         1) Tests using I64 since the testing api does not yet know how to handle 64-bit numbers.  2)
19381         Tests that would validate the memory of the module once wasm was done with it since that's
19382         not really possible in JS.
19383
19384         In order to make such a translation easier this patch also adds some features to the JS
19385         testing api:
19386
19387         1) Blocks can now be done lexically by adding a lambda as the last argument of the block
19388         opcode. For example one can do:
19389             ...
19390             .Block("i32", b => b.I32Const(1) )
19391
19392         and the nested lambda will automatically have an end attached.
19393
19394         2) The JS testing api can now handle inline signature types.
19395
19396         3) Relocate some code to make it easier to follow and prevent 44 space indentation.
19397
19398         4) Rename varuint/varint to varuint32/varint32, this lets them be directly called from the
19399         wasm.json without being remapped.
19400
19401         5) Add support for Memory and Function sections to the Builder.
19402
19403         6) Add support for local variables.
19404
19405         On the JSC side, we needed to expose a new function to validate the compiled wasm code
19406         behaves the way we expect. At least until the JS Wasm API is finished. The new validation
19407         function, testWasmModuleFunctions, takes an array buffer containing the wasm binary, the
19408         number of functions in the blob and tests for each of those functions.
19409
19410         * wasm/Builder.js:
19411         (const._maybeRegisterType):
19412         (const): Deleted.
19413         (switch.typeof): Deleted.
19414         * wasm/Builder_WebAssemblyBinary.js:
19415         (const.emitters.Type):
19416         (const.emitters.Import):
19417         (const.emitters.Function):
19418         (const.emitters.Memory):
19419         (const.emitters.Code):
19420         (export.const.Binary):
19421         * wasm/LowLevelBinary.js:
19422         (export.default.LowLevelBinary.prototype.get return):
19423         (export.default.LowLevelBinary.prototype.varuint32):
19424         (export.default.LowLevelBinary.prototype.varint32):
19425         (export.default.LowLevelBinary.prototype.varuint1):
19426         (export.default.LowLevelBinary.prototype.varint7):
19427         (export.default.LowLevelBinary.prototype.varuint7):
19428         (export.default.LowLevelBinary.prototype.inline_signature_type):
19429         (export.default.LowLevelBinary.prototype.string):
19430         (export.default.LowLevelBinary.prototype.getVaruint32):
19431         (export.default.LowLevelBinary.prototype.getVarint32):
19432         (export.default.LowLevelBinary.prototype.getVaruint7):
19433         (export.default.LowLevelBinary.prototype.getString):
19434         (export.default.LowLevelBinary):
19435         (export.default.LowLevelBinary.prototype.varuint): Deleted.
19436         (export.default.LowLevelBinary.prototype.varint): Deleted.
19437         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
19438         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
19439         * wasm/js-api/test_old_tests.js: Added.
19440         (ret5):
19441         (brTableWithLoop):
19442         (brTableManyValues):
19443         (run.brTableManyValues.brTableAsIf):
19444         (ifThenFallthrough):
19445         (ifThenElseFallthrough):
19446         (dumbLessThanFallthrough):
19447         (run.dumbLessThanFallthrough.floatSub):
19448         (run.floatSub.add12):
19449         (run.add12.factorial):
19450         (i32load):
19451         (run.i32load.i32load8s):
19452         (run.i32load8s.dumbEqIfThenElse):
19453         (run.dumbEqIfThenElse.dumbEqIfThenElse):
19454         (run.dumbEqIfThenElse.dumbLessThanIfThenElse):
19455         (run.dumbLessThanIfThenElse.loopSum):
19456         (run.loopSum.loopMult):
19457         (brIfLoopLessThan):
19458         (run.brIfLoopLessThan.run):
19459         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
19460         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
19461
19462         * wasm/Builder.js:
19463         (const._maybeRegisterType):
19464         (const): Deleted.
19465         (switch.typeof): Deleted.
19466         * wasm/Builder_WebAssemblyBinary.js:
19467         (const.emitters.Type):
19468         (const.emitters.Import):
19469         (const.emitters.Function):
19470         (const.emitters.Memory):
19471         (const.emitters.Code):
19472         (export.const.Binary):
19473         * wasm/LowLevelBinary.js:
19474         (export.default.LowLevelBinary.prototype.get return):
19475         (export.default.LowLevelBinary.prototype.varuint32):
19476         (export.default.LowLevelBinary.prototype.varint32):
19477         (export.default.LowLevelBinary.prototype.varuint1):
19478         (export.default.LowLevelBinary.prototype.varint7):
19479         (export.default.LowLevelBinary.prototype.varuint7):
19480         (export.default.LowLevelBinary.prototype.inline_signature_type):
19481         (export.default.LowLevelBinary.prototype.string):
19482         (export.default.LowLevelBinary.prototype.getVaruint32):
19483         (export.default.LowLevelBinary.prototype.getVarint32):
19484         (export.default.LowLevelBinary.prototype.getVaruint7):
19485         (export.default.LowLevelBinary.prototype.getString):
19486         (export.default.LowLevelBinary):
19487         (export.default.LowLevelBinary.prototype.varuint): Deleted.
19488         (export.default.LowLevelBinary.prototype.varint): Deleted.
19489         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
19490         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
19491         * wasm/js-api/function-tests/add-12.js: Added.
19492         * wasm/js-api/function-tests/br-if-loop-less-than.js: Added.
19493         * wasm/js-api/function-tests/brTableAsIf.js: Added.
19494         * wasm/js-api/function-tests/brTableManyValues.js: Added.
19495         * wasm/js-api/function-tests/brTableWithLoop.js: Added.
19496         * wasm/js-api/function-tests/dumb-eq-if-then-else.js: Added.
19497         * wasm/js-api/function-tests/dumb-less-than-fallthrough.js: Added.
19498         * wasm/js-api/function-tests/dumb-less-than-ite.js: Added.
19499         * wasm/js-api/function-tests/factorial.js: Added.
19500         * wasm/js-api/function-tests/float-sub.js: Added.
19501         * wasm/js-api/function-tests/i32-load.js: Added.
19502         * wasm/js-api/function-tests/i32-load8-s.js: Added.
19503         * wasm/js-api/function-tests/if-then-else-fallthrough.js: Added.
19504         * wasm/js-api/function-tests/if-then-fallthrough.js: Added.
19505         * wasm/js-api/function-tests/loop-mult.js: Added.
19506         * wasm/js-api/function-tests/loop-sum.js: Added.
19507         * wasm/js-api/function-tests/ret5.js: Added.
19508         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
19509         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
19510
19511 2016-11-11  Saam Barati  <sbarati@apple.com>
19512
19513         We recursively grab a lock in the DFGBytecodeParser causing us to deadlock
19514         https://bugs.webkit.org/show_bug.cgi?id=164650
19515
19516         Reviewed by Geoffrey Garen.
19517
19518         * stress/dont-dead-lock-put-by-val-as-put-by-id.js: Added.
19519         (ident):
19520         (let.o.set foo):
19521         (foo):
19522
19523 2016-11-11  Chris Dumez  <cdumez@apple.com>
19524
19525         Unreviewed, rolling out r208584.
19526
19527         Seems to have regressed Speedometer by 1% on Mac
19528
19529         Reverted changeset:
19530
19531         "We should have a more concise way of determining when we're
19532         varargs calling a function using rest parameters"
19533         https://bugs.webkit.org/show_bug.cgi?id=164258
19534         http://trac.webkit.org/changeset/208584
19535
19536 2016-11-11  Chris Dumez  <cdumez@apple.com>
19537
19538         Unreviewed, rolling out r208117 and r208160.
19539
19540         Regressed Speedometer by >1.5%
19541
19542         Reverted changesets:
19543
19544         "We should have a way of profiling when a get_by_id is pure
19545         and to emit a PureGetById in the DFG/FTL"
19546         https://bugs.webkit.org/show_bug.cgi?id=163305
19547         http://trac.webkit.org/changeset/208117
19548
19549         "Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing
19550         out"
19551         https://bugs.webkit.org/show_bug.cgi?id=164227
19552         http://trac.webkit.org/changeset/208160
19553
19554 2016-11-11  Saam Barati  <sbarati@apple.com>
19555
19556         We should have a more concise way of determining when we're varargs calling a function using rest parameters
19557         https://bugs.webkit.org/show_bug.cgi?id=164258
19558
19559         Reviewed by Yusuke Suzuki.
19560
19561         * microbenchmarks/call-using-spread.js: Added.
19562         (bar):
19563         (foo):
19564         * microbenchmarks/spread-large-array.js: Added.
19565         (foo):
19566         (arrays.push):
19567         * microbenchmarks/spread-small-array.js: Added.
19568         (foo):
19569         * stress/spread-array-iterator-watchpoint-2.js: Added.
19570         (foo):
19571         (arrayIterator.next):
19572         * stress/spread-array-iterator-watchpoint.js: Added.
19573         (foo):
19574         (Array.prototype.Symbol.iterator):
19575         * stress/spread-non-array.js: Added.
19576         (assert):
19577         (foo):
19578         (let.customIterator.Symbol.iterator):
19579         (bar):
19580
19581 2016-11-10  Mark Lam  <mark.lam@apple.com>
19582
19583         Fix broken have-a-bad-time-with-arguments.js test.
19584         https://bugs.webkit.org/show_bug.cgi?id=164626
19585
19586         Reviewed by Filip Pizlo.
19587
19588         But also saved a copy of the broken one as broken-have-a-bad-time-with-arguments-for-gc-testing.js
19589         because coincidentally, it stresses the GC in ways that help reveal bugs.
19590
19591         * stress/broken-have-a-bad-time-with-arguments-for-gc-testing.js: Added.
19592         (testFunction):
19593         (warmupFunction):
19594         (let.argsDeclIndex.in.argumentsDecls.let.indexToReturnIndex.in.indicesToReturn.let.insertElementActionIndex.in.insertElementActions.let.tierWarmupCountIndex.in.tierWarmupCounts.let.testArgsIndex.in.testArgsList.catch):
19595         * stress/have-a-bad-time-with-arguments.js:
19596
19597 2016-11-10  JF Bastien  <jfbastien@apple.com>
19598
19599         ASSERTION FAILED: length > offset encountered with wasm.yaml/wasm/js-api/test_Module.js.default-wasm
19600         https://bugs.webkit.org/show_bug.cgi?id=164597
19601
19602         Reviewed by Keith Miller.
19603
19604         Trim the array buffer before returning it: it's optimistically
19605         over-allocated to avoid growing all the time, but when parsed it
19606         can't have extra content.
19607
19608         * wasm/Builder_WebAssemblyBinary.js:
19609         (export.const.Binary):
19610         * wasm/LowLevelBinary.js:
19611         (export.default.LowLevelBinary.prototype.get return):
19612
19613 2016-11-10  Joseph Pecoraro  <pecoraro@apple.com>
19614
19615         test262: DataView / TypedArray methods should throw RangeErrors for negative numbers (ToIndex)
19616         https://bugs.webkit.org/show_bug.cgi?id=164450
19617
19618         Reviewed by Darin Adler.
19619
19620         * stress/dataview-typedarray-toindex.js: Added.
19621         Tests for all cases where ToIndex should be used.
19622
19623         * test262.yaml:
19624         New passing tests.
19625
19626 2016-11-10  Mark Lam  <mark.lam@apple.com>
19627
19628         Graph::methodOfGettingAValueProfileFor() should be returning the profile for the operand node.
19629         https://bugs.webkit.org/show_bug.cgi?id=164600
19630         <rdar://problem/28828676>
19631
19632         Reviewed by Filip Pizlo.
19633
19634         * stress/osr-exit-on-op-negate-should-no-fail-assertions.js: Added.
19635
19636 2016-11-08  Yusuke Suzuki  <utatane.tea@gmail.com>
19637
19638         [JSC] Avoid cloned arguments allocation in ArrayPrototype methods
19639         https://bugs.webkit.org/show_bug.cgi?id=164502
19640
19641         Reviewed by Saam Barati.
19642
19643         * stress/argument-intrinsic-basic.js: Added.
19644         (shouldBe):
19645         (builtin.createBuiltin):
19646         * stress/argument-intrinsic-inlining-with-result-escape.js: Added.
19647         (shouldBe):
19648         (builtin.createBuiltin):
19649         (escape):
19650         * stress/argument-intrinsic-nested-inlining.js: Added.
19651         (shouldBe):
19652         (builtin.createBuiltin):
19653         (builtinCaller1):
19654         (builtinCaller2):
19655         (escape):
19656         * stress/argument-intrinsic-not-convert-to-get-argument.js: Added.
19657         (shouldBe):
19658         (builtin.createBuiltin):
19659         * stress/argument-intrinsic-with-stack-write.js: Added.
19660         (shouldBe):
19661         (builtin.createBuiltin):
19662
19663 2016-11-09  Saam Barati  <sbarati@apple.com>
19664
19665         Math.min()/Math.max() with no arguments is lowered incorrectly in the BytecodeParser
19666         https://bugs.webkit.org/show_bug.cgi?id=164464
19667         <rdar://problem/29131452>
19668
19669         Reviewed by Darin Adler.
19670
19671         * stress/math-max-min-no-arguments.js: Added.
19672         (assert):
19673         (min):
19674         (max):
19675         (test):
19676
19677 2016-11-09  Saam Barati  <sbarati@apple.com>
19678
19679         TypeProfiler and running GC collection on another thread don't play nicely with each other
19680         https://bugs.webkit.org/show_bug.cgi?id=164441
19681         <rdar://problem/29132174>
19682
19683         Reviewed by Geoffrey Garen.
19684
19685         * typeProfiler/type-profiler-gc.js: Added.
19686         (bar):
19687         (foo):
19688
19689 2016-11-04  Mark Lam  <mark.lam@apple.com>
19690
19691         Error description code should be able to handle Symbol values.
19692         https://bugs.webkit.org/show_bug.cgi?id=164436
19693         <rdar://problem/29115583>
19694
19695         Reviewed by Filip Pizlo and Saam Barati.
19696
19697         * stress/error-description-on-symbols-should-not-crash.js: Added.
19698
19699 2016-11-03  Geoffrey Garen  <ggaren@apple.com>
19700
19701         EvalCodeCache should not give up in strict mode and other cases
19702         https://bugs.webkit.org/show_bug.cgi?id=164357
19703
19704         Reviewed by Michael Saboff.
19705
19706         * microbenchmarks/eval-cached.js: Added. 45x faster now.
19707         * stress/eval-cached.js: Added. Try running the same eval text in a bunch
19708         of different scopes and verify that we access the right scope.
19709
19710 2016-11-04  JF Bastien  <jfbastien@apple.com>
19711
19712         WebAssembly JS API: implement more sections
19713         https://bugs.webkit.org/show_bug.cgi?id=164023
19714
19715         Reviewed by Keith Miller.
19716
19717         On the JSC side:
19718
19719          - Put in parser stubs for all WebAssembly sections.
19720          - Parse Import, Export sections.
19721          - Use tryReserveCapacity instead of reserve, and bail out of the parser if it fails. This prevents the parser from bringing everything down when faced with a malicious input.
19722          - Encapsulate all parsed module information into its own structure, making it easier to pass around (from parser to Plan to Module to Instance).
19723          - Create WasmFormat.cpp to hold parsed module information's dtor to avoid including WasmMemory.h needlessly.
19724          - parseCode: avoid overflow through function size.
19725          - Remove all remainders of polyfill-prototype-1, and update license.
19726          - Add missing WasmOps.h and WasmValidateInlines.h auto-generation for cmake build.
19727
19728         On the Builder.js testing side:
19729
19730          - Implement Type, Import (function only), Export (function only) sections.
19731          - Check section order and uniqueness.
19732          - Optionally auto-generate the Type section from subsequent Export / Import / Code entries.
19733          - Allow re-exporting an import.
19734
19735         * wasm/Builder.js: build type, import, and export sections
19736         (const._normalizeFunctionSignature):
19737         * wasm/Builder_WebAssemblyBinary.js: Added. Forked from Builder.js
19738         (const.emitters.Type):
19739         (const.emitters.Import):
19740         (const.emitters.Function):
19741         (const.emitters.Table):
19742         (const.emitters.Memory):
19743         (const.emitters.Global):
19744         (const.emitters.Export):
19745         (const.emitters.Start):
19746         (const.emitters.Element):
19747         (const.emitters.Code):
19748         (const.emitters.Data):
19749         (export.const.Binary):
19750         * wasm/LowLevelBinary.js: Add a few useful outputs
19751         (export.default.LowLevelBinary.prototype.varuint1):
19752         (export.default.LowLevelBinary.prototype.varint7):
19753         * wasm/WASM.js: value type and external kind helpers
19754         * wasm/assert.js: array element-wise equality comparison
19755         (const._eq):
19756         * wasm/js-api/test_Module.js:
19757         (ModuleWithImports):
19758         * wasm/self-test/test_BuilderJSON.js: many more tests for all the new Builder APIs, and update to some older tests which now require a Type section or rejiggered Function signature
19759         (const.assertOpThrows):
19760         (SectionsWithSameCustomName):
19761         (TwoTypeSections):
19762         (EmptyImportSection):
19763         (ImportBeforeTypeSections):
19764         * wasm/self-test/test_BuilderWebAssembly.js: remove a test which wasn't helpful and is now obsolete
19765         (CustomSection):
19766
19767 2016-11-03  Mark Lam  <mark.lam@apple.com>
19768
19769         ClonedArguments need to also support haveABadTime mode.
19770         https://bugs.webkit.org/show_bug.cgi?id=164200
19771         <rdar://problem/27211336>
19772
19773         Reviewed by Geoffrey Garen.
19774
19775         * stress/have-a-bad-time-with-arguments.js: Added.
19776
19777 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
19778
19779         DFG plays fast and loose with the shadow values of a Phi
19780         https://bugs.webkit.org/show_bug.cgi?id=164309
19781
19782         Reviewed by Saam Barati.
19783
19784         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
19785
19786         * stress/dfg-ssa-swap.js: Added.
19787         (foo):
19788
19789 2016-11-03  Commit Queue  <commit-queue@webkit.org>
19790
19791         Unreviewed, rolling out r208364.
19792         https://bugs.webkit.org/show_bug.cgi?id=164402
19793
19794         broke the build (Requested by smfr on #webkit).
19795
19796         Reverted changeset:
19797
19798         "DFG plays fast and loose with the shadow values of a Phi"
19799         https://bugs.webkit.org/show_bug.cgi?id=164309
19800         http://trac.webkit.org/changeset/208364
19801
19802 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
19803
19804         DFG plays fast and loose with the shadow values of a Phi
19805         https://bugs.webkit.org/show_bug.cgi?id=164309
19806
19807         Reviewed by Saam Barati.
19808
19809         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
19810
19811         * stress/dfg-ssa-swap.js: Added.
19812         (foo):
19813
19814 2016-11-03  Saam Barati  <sbarati@apple.com>
19815
19816         Asking for a value profile prediction should be defensive against not finding a value profile
19817         https://bugs.webkit.org/show_bug.cgi?id=164306
19818
19819         Reviewed by Mark Lam.
19820
19821         * stress/inlined-tail-call-in-inlined-setter-should-not-crash-when-getting-value-profile.js: Added.
19822         (let.o.set foo):
19823         (bar):
19824
19825 2016-11-02  Saam Barati  <sbarati@apple.com>
19826
19827         Allocation elimination of rest parameter doesn't take into account indexed properties on Array.prototype/Object.prototype
19828         https://bugs.webkit.org/show_bug.cgi?id=164301
19829
19830         Reviewed by Geoffrey Garen.
19831
19832         * stress/rest-parameter-allocation-elimination-watchpoints-2.js: Added.
19833         (assert):
19834         (foo):
19835         * stress/rest-parameter-allocation-elimination-watchpoints-3.js: Added.
19836         (assert):
19837         (foo):
19838         * stress/rest-parameter-allocation-elimination-watchpoints-4.js: Added.
19839         (assert):
19840         (foo):
19841         * stress/rest-parameter-allocation-elimination-watchpoints-5.js: Added.
19842         (assert):
19843         (foo):
19844         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Added.
19845         (assert):
19846         (foo):
19847         * stress/rest-parameter-allocation-elimination-watchpoints.js: Added.
19848         (assert):
19849         (foo):
19850
19851 2016-11-01  Saam Barati  <sbarati@apple.com>
19852
19853         We should be able to eliminate rest parameter allocations
19854         https://bugs.webkit.org/show_bug.cgi?id=163925
19855
19856         Reviewed by Filip Pizlo.
19857
19858         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
19859         (assert):
19860         (test1.bar):
19861         (test1):
19862         (test2.jaz):
19863         (test2.jaz2.kaz):
19864         (test2.jaz2):
19865         (test2):
19866         (test3.foo):
19867         (test3.baz):
19868         (test3.jaz):
19869         (test3):
19870         (test4.baz):
19871         (test4.jaz):
19872         (test4):
19873         (test5.baz):
19874         (test5.jaz):
19875         (test5):
19876         (test6.baz):
19877         (test6.jaz):
19878         (test6):
19879         (test7.baz):
19880         (test7.jaz):
19881         (test7.check):
19882         (test7):
19883         (test8.baz):
19884         (test8.jaz):
19885         (test8.check):
19886         (test8):
19887         (test9.baz):
19888         (test9.jaz):
19889         (test9.check):
19890         (test9):
19891         (test10.baz):
19892         (test10.jaz):
19893         (test10):
19894         (test11.bar):
19895         (test11.foo):
19896         (test11.makeArguments):
19897         (test11.):
19898         (test12):
19899         (test12.bar):
19900         (test12.foo):
19901         (test12.makeArguments):
19902         (test12.):
19903         (test13.bar):
19904         (test13.top):
19905         (test13.foo):
19906         (test13.makeArguments):
19907         (test13.):
19908         (test13):
19909         (test14.bar):
19910         (test14.top):
19911         (test14.foo):
19912         (test14.makeArguments):
19913         (test14.):
19914         (test14):
19915         (test15.bar):
19916         (test15.top):
19917         (test15.foo):
19918         (test15.makeArguments):
19919         (test15.):
19920         (test15):
19921
19922 2016-11-01  Commit Queue  <commit-queue@webkit.org>
19923
19924         Unreviewed, rolling out r208208 and r208210.
19925         https://bugs.webkit.org/show_bug.cgi?id=164276
19926
19927         This change caused 28 JSC test failures. (Requested by
19928         ryanhaddad on #webkit).
19929
19930         Reverted changesets:
19931
19932         "We should be able to eliminate rest parameter allocations"
19933         https://bugs.webkit.org/show_bug.cgi?id=163925
19934         http://trac.webkit.org/changeset/208208
19935
19936         "Fix the EFL build."
19937         http://trac.webkit.org/changeset/208210
19938
19939 2016-10-31  Filip Pizlo  <fpizlo@apple.com>
19940
19941         JSC should support SharedArrayBuffer
19942         https://bugs.webkit.org/show_bug.cgi?id=163986
19943
19944         Reviewed by Keith Miller.
19945
19946         This adds our own test for the various corner cases of SharedArrayBuffer. This test is meant to
19947         check all of the things that don't require concurrency.
19948
19949         * stress/SharedArrayBuffer.js: Added.
19950         (checkAtomics):
19951         (shouldFail):
19952         (Symbol):
19953         (runAtomic):
19954
19955 2016-10-31  Saam Barati  <sbarati@apple.com>
19956
19957         We should be able to eliminate rest parameter allocations
19958         https://bugs.webkit.org/show_bug.cgi?id=163925
19959
19960         Reviewed by Filip Pizlo.
19961
19962         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
19963         (assert):
19964         (test1.bar):
19965         (test1):
19966         (test2.jaz):
19967         (test2.jaz2.kaz):
19968         (test2.jaz2):
19969         (test2):
19970         (test3.foo):
19971         (test3.baz):
19972         (test3.jaz):
19973         (test3):
19974         (test4.baz):
19975         (test4.jaz):
19976         (test4):
19977         (test5.baz):
19978         (test5.jaz):
19979         (test5):
19980         (test6.baz):
19981         (test6.jaz):
19982         (test6):
19983         (test7.baz):
19984         (test7.jaz):
19985         (test7.check):
19986         (test7):
19987         (test8.baz):
19988         (test8.jaz):
19989         (test8.check):
19990         (test8):
19991         (test9.baz):
19992         (test9.jaz):
19993         (test9.check):
19994         (test9):
19995         (test10.baz):
19996         (test10.jaz):
19997         (test10):
19998         (test11.bar):
19999         (test11.foo):
20000         (test11.makeArguments):
20001         (test11.):
20002         (test12):
20003         (test12.bar):
20004         (test12.foo):
20005         (test12.makeArguments):
20006         (test12.):
20007         (test13.bar):
20008         (test13.top):
20009         (test13.foo):
20010         (test13.makeArguments):
20011         (test13.):
20012         (test13):
20013         (test14.bar):
20014         (test14.top):
20015         (test14.foo):
20016         (test14.makeArguments):
20017         (test14.):
20018         (test14):
20019         (test15.bar):
20020         (test15.top):
20021         (test15.foo):
20022         (test15.makeArguments):
20023         (test15.):
20024         (test15):
20025
20026 2016-10-31  Saam Barati  <sbarati@apple.com>
20027
20028         Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing out
20029         https://bugs.webkit.org/show_bug.cgi?id=164227
20030
20031         Unreviewed timeout fix.
20032
20033         * microbenchmarks/pure-get-by-id-cse-2.js:
20034
20035 2016-10-31  Keith Miller  <keith_miller@apple.com>
20036
20037         autogenerated files from wasm.json should be in derived sources.
20038         https://bugs.webkit.org/show_bug.cgi?id=164152
20039
20040         Reviewed by Filip Pizlo.
20041
20042         Delete generation script since it is no longer used.
20043
20044         * wasm/generate-wasmops-header.js: Removed.
20045
20046 2016-10-29  Yusuke Suzuki  <utatane.tea@gmail.com>
20047
20048         [JSC] JSON.stringify should handle Proxy which is non JSArray but isArray is true
20049         https://bugs.webkit.org/show_bug.cgi?id=164123
20050
20051         Reviewed by Mark Lam.
20052
20053         * stress/json-stringify-with-non-jsarray-array.js: Added.
20054         (shouldBe):
20055         (shouldBe.JSON.stringify.new.Proxy):
20056
20057 2016-10-29  Saam Barati  <sbarati@apple.com>
20058
20059         We should have a way of profiling when a get_by_id is pure and to emit a PureGetById in the DFG/FTL
20060         https://bugs.webkit.org/show_bug.cgi?id=163305
20061
20062         Reviewed by Keith Miller.
20063
20064         * microbenchmarks/pure-get-by-id-cse-2.js: Added.
20065         (foo):
20066         * microbenchmarks/pure-get-by-id-cse.js: Added.
20067         (foo):
20068         * stress/pure-get-by-id-cse-correctness.js: Added.
20069         (assert):
20070         (foo):
20071         * stress/pure-get-by-id-on-non-object.js: Added.
20072         (assert):
20073         (foo):
20074
20075 2016-10-28  Csaba Osztrogonác  <ossy@webkit.org>
20076
20077         Skip JSTests/microbenchmarks/dense-set.js on memory limited devices
20078         https://bugs.webkit.org/show_bug.cgi?id=164128
20079
20080         Reviewed by Mark Lam.
20081
20082         * microbenchmarks/dense-set.js:
20083
20084 2016-10-20  Caitlin Potter  <caitp@igalia.com>
20085
20086         [JSC] implement runtime for async functions
20087         https://bugs.webkit.org/show_bug.cgi?id=163760
20088
20089         Reviewed by Yusuke Suzuki.
20090
20091         * stress/async-await-basic.js: Added.
20092         (shouldBe):
20093         (shouldBeAsync):
20094         (shouldThrow):
20095         (shouldThrowAsync):
20096         (shouldThrowSyntaxError):
20097         (let.AsyncFunction.async):
20098         (async.asyncFunctionForProto):
20099         (Object.getPrototypeOf.async):
20100         (Object.getPrototypeOf.async.method):
20101         (async):
20102         (async.method):
20103         (async.asyncNonConstructorDecl):
20104         (shouldThrow.new.async):
20105         (shouldThrow.new.async.nonConstructor):
20106         (async.asyncDecl):
20107         (async.f):
20108         (MyError):
20109         (async.asyncDeclThrower):
20110         (shouldThrowAsync.async):
20111         (resolveLater):
20112         (rejectLater):
20113         (async.resumeAfterNormal):
20114         (O.async.resumeAfterNormal):
20115         (resumeAfterNormalArrow.async):
20116         (async.resumeAfterThrow):
20117         (O.async.resumeAfterThrow):
20118         (resumeAfterThrowArrow.async):
20119         (catch):
20120         * stress/async-await-module-reserved-word.js: Added.
20121         (shouldThrow):
20122         (SyntaxError.Canstring_appeared_hereawait.checkModuleSyntaxError.String.raw.await):
20123         (checkModuleSyntaxError.String.raw.await):
20124         (checkModuleSyntaxError.String.raw.async.await):
20125         (SyntaxError.Cannot.declare.named):
20126         * stress/async-await-mozilla.js: Added.
20127         (shouldBe):
20128         (shouldBeAsync):
20129         (shouldThrow):
20130         (shouldThrowAsync):
20131         (assert):
20132         (shouldThrowSyntaxError):
20133         (mozSemantics.async.empty):
20134         (mozSemantics.async.simpleReturn):
20135         (mozSemantics.async.simpleAwait):
20136         (mozSemantics.async.simpleAwaitAsync):
20137         (mozSemantics.async.returnOtherAsync):
20138         (mozSemantics.async.simpleThrower):
20139         (mozSemantics.async.delegatedThrower):
20140         (mozSemantics.async.tryCatch):
20141         (mozSemantics.async.tryCatchThrow):
20142         (mozSemantics.async.wellFinally):
20143         (mozSemantics.async.finallyMayFail):
20144         (mozSemantics.async.embedded.async.inner):
20145         (mozSemantics.async.embedded):
20146         (mozSemantics.async.fib):
20147         (mozSemantics.async.isOdd.async.isEven):
20148         (mozSemantics.async.isOdd):
20149         (mozSemantics.hardcoreFib.async.fib2):
20150         (mozSemantics.namedAsyncExpr.async.simple):
20151         (mozSemantics.async.executionOrder.async.first):
20152         (mozSemantics.async.executionOrder.async.second):
20153         (mozSemantics.async.executionOrder.async.third):
20154         (mozSemantics.async.executionOrder):
20155         (mozSemantics.async.miscellaneous):
20156         (mozSemantics.thrower):
20157         (mozSemantics.async.defaultArgs):
20158         (mozSemantics.shouldThrow):
20159         (mozSemantics):
20160         (mozMethods.X):
20161         (mozMethods.X.prototype.async.getValue):
20162         (mozMethods.X.prototype.setValue):
20163         (mozMethods.X.prototype.async.increment):
20164         (mozMethods.X.prototype.async.getBaseClassName):
20165         (mozMethods.X.async.getStaticValue):
20166         (mozMethods.Y.prototype.async.getBaseClassName):
20167         (mozMethods.Y):
20168         (mozFunctionNameInferrence.async.test):
20169         (mozSyntaxErrors):
20170         * stress/async-await-reserved-word.js: Added.
20171         (assert):
20172         (shouldThrowSyntaxError):
20173         (AsyncFunction.async):
20174         * stress/async_arrow_functions_lexical_arguments_binding.js: Added.
20175         (shouldBe):
20176         (shouldBeAsync):
20177         (shouldThrowAsync):
20178         (noArgumentsArrow2.async):
20179         * stress/async_arrow_functions_lexical_new.target_binding.js: Added.
20180         (shouldBe):
20181         (shouldBeAsync):
20182         (shouldThrowAsync):
20183         (C1):
20184         (C2):
20185         (shouldThrowAsync.async):
20186         * stress/async_arrow_functions_lexical_super_binding.js: Added.
20187         (shouldBe):
20188         (shouldBeAsync):
20189         (BaseClass.prototype.baseClassValue):
20190         (BaseClass.prototype.get property):
20191         (BaseClass):
20192         (ChildClass.prototype.asyncSuperProp):
20193         (ChildClass.prototype.asyncSuperProp2):
20194         (ChildClass):
20195         (ChildClass2):
20196         * stress/async_arrow_functions_lexical_this_binding.js: Added.
20197         (shouldBe):
20198         (shouldBeAsync):
20199         (d.y):
20200
20201 2016-10-28  Csaba Osztrogonác  <ossy@webkit.org>
20202
20203         Skip 2 JS stress tests on memory limited devices
20204         https://bugs.webkit.org/show_bug.cgi?id=164125
20205
20206         Unreviewed quick fix to unbreak JSCOnly ARM bots as soon as possible.
20207
20208         * stress/joined-strings-should-not-exceed-max-string-length.js:
20209         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js:
20210
20211 2016-10-27  Caitlin Potter  <caitp@igalia.com>
20212
20213         [JSC] forbid lexical redeclaration of generator formal parameters
20214         https://bugs.webkit.org/show_bug.cgi?id=163930
20215
20216         Reviewed by Yusuke Suzuki.
20217
20218         * stress/async-await-syntax.js:
20219         * stress/generator-syntax.js:
20220         (testSyntaxError.gen):
20221         (testSyntaxError.arguments):
20222         (testSyntaxError.eval):
20223         * test262.yaml:
20224
20225 2016-10-26  JF Bastien  <jfbastien@apple.com>
20226
20227         WebAssembly API: implement Instance
20228
20229         As described in: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblyinstance-objects
20230
20231          - Take ownership of Wasm::Plan's compilation result when successfully creating a JSWebAssemblyModule object.
20232          - Construct a basic Instance with a Module.
20233          - Handle second argument (importObject) of WebAssembly.Instance.
20234          - Add reference text from the spec to WebAssembly.Module's code.
20235          - Expose and test an empty 'exports' ModuleNamespaceObject on WebAssembly.Instance.
20236
20237         The implementation isn't complete yet: it relies on further work for which I've filed bugs.
20238
20239         WebAssembly API: implement Instance
20240         https://bugs.webkit.org/show_bug.cgi?id=163998
20241
20242         Reviewed by Keith Miller.
20243
20244         * wasm/js-api/test_Instance.js: Added.
20245         (EmptyModule): use the Builder, create the simplest Module possible, and create an Instance from it
20246         * wasm/js-api/test_basic_api.js:
20247         (const.c.in.constructorProperties.switch): basic tests of the API
20248
20249 2016-10-26  Mark Lam  <mark.lam@apple.com>
20250
20251         JSGenericTypedArrayView::set() should check for exceptions.
20252         https://bugs.webkit.org/show_bug.cgi?id=164007
20253         <rdar://problem/28853775>
20254
20255         Reviewed by Filip Pizlo.
20256
20257         * stress/typed-array-view-set-should-not-crash-on-exception.js: Added.
20258
20259 2016-10-25  Mark Lam  <mark.lam@apple.com>
20260
20261         String.prototype.replace() should throw an OutOfMemoryError when using too much memory.
20262         https://bugs.webkit.org/show_bug.cgi?id=163996
20263         <rdar://problem/28263117>
20264
20265         Reviewed by Geoffrey Garen.
20266
20267         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: Added.
20268
20269 2016-10-25  Mark Lam  <mark.lam@apple.com>
20270
20271         JSStringJoiner::joinedLength() should limit joined string lengths to INT_MAX.
20272         https://bugs.webkit.org/show_bug.cgi?id=163937
20273         <rdar://problem/28642990>
20274
20275         Reviewed by Geoffrey Garen.
20276
20277         * stress/joined-strings-should-not-exceed-max-string-length.js: Added.
20278
20279 2016-10-25  JF Bastien  <jfbastien@apple.com>
20280
20281         WebAssembly JS API: simple Module test
20282         https://bugs.webkit.org/show_bug.cgi?id=163963
20283
20284         Reviewed by Filip Pizlo.
20285
20286         * wasm/LowLevelBinary.js:
20287         (export.default.LowLevelBinary.prototype.get return): get the ArrayBuffer
20288         (export.default.LowLevelBinary.prototype.hexdump): Deleted.
20289         (export.default.LowLevelBinary.prototype._maybeGrow): Deleted.
20290         * wasm/js-api/test_Module.js: Added.
20291         (EmptyModule): The most basic module possible
20292
20293 2016-10-25  JF Bastien  <jfbastien@apple.com>
20294
20295         WebAssembly JS API: implement Module
20296
20297         This implementation allows us to:
20298          - Syncrhonously create a WebAssembly.Module with a typed array.
20299          - Creates a compilation plan.
20300          - Parse the Module and creates corresponding code.
20301          - Throw WebAssembly.CompileError with mildly helpful [*] error messages on
20302            failure.
20303
20304         Consult the API documentation for expected behavior: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymodule-constructor
20305
20306         For now the implementation discards the generated code.
20307
20308         The next steps will be:
20309          - Expose a Module's exports.
20310          - Implement WebAssembly.Instance, which allows instantiating and running a
20311            compiled Module.
20312          - Beef up the testing infrastructure under JSTests/wasm so that more complex
20313            modules can be created and tested (instead of writing the bits by hand).
20314
20315         This patch also:
20316          - Adds assert.instanceof in assert.js.
20317          - Refactors Wasm::Parser and friends to accept const uint8_t* as well as a
20318            Vector, to avoid copying when invoked synchronously.
20319          - Remove useless Structure from some of the wasm constructors: they're already
20320            on the JSGlobalObject, visited properly and all.
20321          - Fix off-by-one error in parsing: Parser::parseUInt32 failed if the integer
20322            was exactly at end of file.
20323
20324          [*] On error messages while parsing: I filed https://bugs.webkit.org/show_bug.cgi?id=163919
20325
20326         WebAssembly JS API: implement Module
20327         https://bugs.webkit.org/show_bug.cgi?id=163903
20328
20329         Reviewed by Keith Miller.
20330
20331         * wasm/assert.js: use underscore in name, and remove when exporting to avoid clasing with builtin names
20332         (const._notUndef):
20333         (const._isUndef):
20334         (const._eq):
20335         (const._ge):
20336         (const._throws):
20337         * wasm/js-api/test_basic_api.js: test the WebAssembly.Module API
20338         (const.c.in.constructorProperties.switch):
20339
20340 2016-10-25  Keith Miller  <keith_miller@apple.com>
20341
20342         Add trivial Wasm conversion opcodes
20343         https://bugs.webkit.org/show_bug.cgi?id=163950
20344
20345         Reviewed by Filip Pizlo.
20346
20347         This patch differentiates between Wasm opcodes that are trivially mapped to a B3 opcode and
20348         those that are not.  Some of the Wasm opcodes that are currently a non-simple opcode will
20349         become simple as we add B3 opcodes for Wasm operations.  The remaining opcodes will need to
20350         be added via patchpoints in a later patch.
20351
20352         * wasm/generate-wasmops-header.js:
20353         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.Wasm.inline.bool.isSimple):
20354         * wasm/wasm.json:
20355
20356 2016-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
20357
20358         Arrow functions with concise bodies cannot return regular expressions
20359         https://bugs.webkit.org/show_bug.cgi?id=163162
20360
20361         Reviewed by Filip Pizlo.
20362
20363         * ChakraCore/test/Operators/instanceof.baseline-jsc:
20364         * ChakraCore/test/Regex/nul_character.baseline-jsc:
20365         * ChakraCore/test/es5/Lex_u3.baseline-jsc:
20366         * stress/parse-regexp-as-token.js: Added.
20367         (shouldBe):
20368
20369 2016-10-24  Keith Miller  <keith_miller@apple.com>
20370
20371         Wasm should support floating point operations.
20372         https://bugs.webkit.org/show_bug.cgi?id=163770
20373
20374         Reviewed by Michael Saboff.
20375
20376         Add appropriate b3op names for floating point wasm bytecodes, where they exist.
20377         Also, fix some WASM => Wasm in WasmOps.h generator script that I missed
20378         the first time I made the change.
20379
20380         * wasm/generate-wasmops-header.js:
20381         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.template.typename.Int.inline.bool.isValidOpType): Deleted.
20382         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.BinaryOpType): Deleted.
20383         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.UnaryOpType): Deleted.
20384         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.LoadOpType): Deleted.
20385         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.StoreOpType): Deleted.
20386         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.undef.CREATE_ENUM_VALUE.inline.bool.isControlOp): Deleted.
20387         * wasm/wasm.json:
20388
20389 2016-10-21  Saam Barati  <sbarati@apple.com>
20390
20391         SpeculativeJIT::compileTryGetById needs to pass in NeedsToSpill along both the cell speculation and untyped speculation path
20392         https://bugs.webkit.org/show_bug.cgi?id=163622
20393
20394         Reviewed by Yusuke Suzuki.
20395
20396         * stress/try-get-by-id-should-spill-registers-dfg.js: Added.
20397         (let.f.createBuiltin):
20398
20399 2016-10-21  Caitlin Potter  <caitp@igalia.com>
20400
20401         [JSC] don't crash when arguments to `new Function()` produce unexpected AST
20402         https://bugs.webkit.org/show_bug.cgi?id=163748
20403
20404         Reviewed by Mark Lam.
20405
20406         * stress/regress-163748.js: Added.
20407         (assert):
20408         (shouldThrowSyntaxError):
20409         (GeneratorFunction):
20410
20411 2016-10-20  Keith Miller  <keith_miller@apple.com>
20412
20413         Add support for WASM calls
20414         https://bugs.webkit.org/show_bug.cgi?id=161727
20415
20416         Reviewed by Filip Pizlo and Michael Saboff.
20417
20418         Add members of the Call category to the WASMOps special group.
20419
20420         * wasm/generate-wasmops-header.js:
20421
20422 2016-10-20  Yusuke Suzuki  <utatane.tea@gmail.com>
20423
20424         [JSC] Drop isEnvironmentRecord type info flag and use JSType information instead
20425         https://bugs.webkit.org/show_bug.cgi?id=163761
20426
20427         Reviewed by Keith Miller.
20428
20429         * modules/string-prototype-module-scope.js: Added.
20430         (shouldBe):
20431         (catch):
20432         (refer):
20433         * stress/string-prototype-scopes-global-lexical-environment-strict.js: Added.
20434         (shouldBe):
20435         (catch):
20436         * stress/string-prototype-scopes-global-lexical-environment.js: Added.
20437         (shouldBe):
20438         (catch):
20439         * stress/string-prototype-scopes-strict.js: Added.
20440         (shouldBe):
20441         (catch):
20442         (try.refer):
20443         (refer):
20444         * stress/string-prototype-scopes.js: Added.
20445         (shouldBe):
20446         (catch):
20447         (try.refer):
20448         (refer):
20449         (object.toString):
20450         (with):
20451
20452 2016-10-20  JF Bastien  <jfbastien@apple.com>
20453
20454         WebAssembly API: implement exception constructors properly
20455
20456          - Rename WebAssemblyObject to JSWebAssembly for consistency.
20457          - WebAssembly object now has its own prototype: add WebAssemblyPrototype, and
20458            use it to register JSWebAssembly's function properties through auto-generated
20459            .lut.h, instead of manually.
20460          - The error constructors used to throw (e.g. `new WebAssembly.CompileError()`).
20461          - Register WebAssembly's constructors from the global object, and hold a
20462            reference to their structure and prototype so that invoking the constructor
20463            can use the structure directly from the global object.
20464          - Add a prototype base field to global object creation. Previous ones all had
20465            Object's prototype as their base, but WebAssembly's error constructors have
20466            Error as their base.
20467          - Test for the error object's correctness.
20468          - Add missing #if ENABLE(WEBASSEMBLY)
20469
20470         WebAssembly API: implement exception constructors properly
20471         https://bugs.webkit.org/show_bug.cgi?id=163699
20472
20473         Reviewed by Keith Miller.
20474
20475         * wasm/js-api/test_basic_api.js:
20476         (const.c.in.constructorProperties): more tests
20477
20478 2016-10-20  Caitlin Potter  <caitp@igalia.com>
20479
20480         [JSC] disallow references to `await` in AsyncFunction formal parameters
20481         https://bugs.webkit.org/show_bug.cgi?id=163694
20482
20483         Reviewed by Saam Barati.
20484
20485         * stress/async-await-syntax.js:
20486
20487 2016-10-20  Keith Miller  <keith_miller@apple.com>
20488
20489         Invalid assertion in arguments elimination
20490         https://bugs.webkit.org/show_bug.cgi?id=163740
20491         <rdar://problem/27911462>
20492
20493         Reviewed by Michael Saboff.
20494
20495         * stress/direct-arguments-osr-entry.js: Added.
20496         (foo.):
20497         (foo):
20498
20499 2016-10-20  Caitlin Potter  <caitp@igalia.com>
20500
20501         [JSC] throw TypeError when constructing dynamically created JSGeneratorFunction
20502         https://bugs.webkit.org/show_bug.cgi?id=163714
20503
20504         Reviewed by Mark Lam.
20505
20506         Add missing test coverage that dynamically created
20507         JSGeneratorFunctions can not be constructed.
20508
20509         * stress/generator-function-constructor.js:
20510         (shouldThrow):
20511
20512 2016-10-19  JF Bastien  <jfbastien@apple.com>
20513
20514         JavaScript WebAssembly API: baby steps
20515
20516          - Expand WebAssembly constructors into their own files. This requires a lot of
20517            boilerplate, as well as adding the .lut.h files. All of the
20518            JSWebAssembly*.{h,cpp}, as well as Constructor and Prototype files, are
20519            currently the same between the 4 specified WebAssembly constructors. It'll be
20520            easy to implement individual functions on constructed objects as per the
20521            spec, and have each of these files diverge. The error constructors are also
20522            similar, except that their instance derives from ErrorInstance.
20523          - Use constructor macro when initializing the global object.
20524          - Dramatically improve testing of the WebAssembly API by checking for
20525            properties specified in the spec [*].
20526          - Clean up assert.js' exception testing.
20527          - Fix a copy-paste bug in wasm.json: floating-point const return values were
20528            swapped.
20529
20530         [*] https://github.com/WebAssembly/design/blob/master/JS.md
20531
20532         Implement more of the JavaScript WebAssembly API
20533         https://bugs.webkit.org/show_bug.cgi?id=163571
20534
20535         Reviewed by Keith Miller.
20536
20537         * wasm/assert.js:
20538         (export.const.isUndef): add this useful helper
20539         (export.const.throws): fold other throw checks into this one, and check message as well
20540         * wasm/js-api/test_basic_api.js:
20541         (const.checkOwnPropertyDescriptor): check own property descriptor follows the spec
20542         * wasm/self-test/test_BuilderJSON.js:
20543         (const.assertOpThrows): use new assert API
20544         (CheckedOpcodeArgumentsTooMany): ditto
20545         (CheckedOpcodeArgumentsNotEnough): ditto
20546         (CallInvalid): ditto
20547         (I32ConstInvalid): ditto
20548         (F32ConstInvalid): ditto (and this caugth the JSON copy-paste bug)
20549         (F64ConstInvalid): ditto
20550         * wasm/self-test/test_LowLevelBinary_varint.js: use new assert API
20551         * wasm/self-test/test_LowLevelBinary_varuint.js: use new assert API
20552         * wasm/utilities.js: add "global" object, used in basic API test (to access global.WebAssembly).
20553         * wasm/wasm.json: fix copy-paste
20554
20555 2016-10-19  Caitlin Potter  <caitp@igalia.com>
20556
20557         [JSC] forbid "use strict" directive in generator functions with non-simple parameters
20558         https://bugs.webkit.org/show_bug.cgi?id=163683
20559
20560         Reviewed by Geoffrey Garen.
20561
20562         Update various generator*-non-simple-param.js tests to be passing.
20563
20564         * test262.yaml:
20565
20566 2016-10-18  Mark Lam  <mark.lam@apple.com>
20567
20568         Invoking Object.prototype.__proto__ accessors directly should throw a TypeError.
20569         https://bugs.webkit.org/show_bug.cgi?id=154377
20570         <rdar://problem/27330808>
20571
20572         Reviewed by Filip Pizlo and Saam Barati.
20573
20574         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js: Added.
20575
20576 2016-10-18  Keith Miller  <keith_miller@apple.com>
20577
20578         GetByVal to GetById conversion in the DFG is incorrect for getters with control flow
20579         https://bugs.webkit.org/show_bug.cgi?id=163629
20580
20581         Reviewed by Yusuke Suzuki.
20582
20583         * stress/get-by-val-to-id-with-getter.js: Added.
20584         (foo):
20585         (o.get hello):
20586
20587 2016-10-15  Filip Pizlo  <fpizlo@apple.com>
20588
20589         DFG and FTL should be able to use DirectCall ICs when they proved the callee or its executable
20590         https://bugs.webkit.org/show_bug.cgi?id=163371
20591
20592         Reviewed by Geoffrey Garen and Saam Barati.
20593
20594         Add microbenchmarks for all of the cases that this patch optimizes.
20595
20596         * microbenchmarks/direct-call-arity-mismatch.js: Added.
20597         (foo):
20598         (bar):
20599         * microbenchmarks/direct-call.js: Added.
20600         (foo):
20601         (bar):
20602         * microbenchmarks/direct-construct-arity-mismatch.js: Added.
20603         (Foo):
20604         (bar):
20605         * microbenchmarks/direct-construct.js: Added.
20606         (Foo):
20607         (bar):
20608         * microbenchmarks/direct-tail-call-arity-mismatch.js: Added.
20609         (foo):
20610         (bar):
20611         * microbenchmarks/direct-tail-call-inlined-caller-arity-mismatch.js: Added.
20612         (foo):
20613         (bar):
20614         (baz):
20615         * microbenchmarks/direct-tail-call-inlined-caller.js: Added.
20616         (foo):
20617         (bar):
20618         (baz):
20619         * microbenchmarks/direct-tail-call.js: Added.
20620         (foo):
20621         (bar):
20622
20623 2016-10-18  Caitlin Potter  <caitp@igalia.com>
20624
20625         [JSC] ES6 Method functions should not have prototype
20626         https://bugs.webkit.org/show_bug.cgi?id=162530
20627
20628         Reviewed by Saam Barati.
20629
20630         Fix test262 expectations about MethodDefinitions
20631
20632         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
20633         * stress/reflect-set.js:
20634         * test262.yaml:
20635
20636 2016-10-17  Keith Miller  <keith_miller@apple.com>
20637
20638         Add support for WASM Memory.
20639         https://bugs.webkit.org/show_bug.cgi?id=161710
20640
20641         Reviewed by Geoffrey Garen.
20642
20643         Add store and load opcodes to wasm.json. Additionally, add new
20644         enums for those opcodes in the generator.
20645
20646         * stress/wasm/generate-wasmops-header.js:
20647         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.LoadOpType):
20648         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.StoreOpType):
20649
20650 2016-10-17  Saam Barati  <sbarati@apple.com>
20651
20652         Add more tests for the double->String conversion in ValueAdd constant folding
20653         https://bugs.webkit.org/show_bug.cgi?id=163517
20654
20655         Reviewed by Yusuke Suzuki.
20656
20657         * microbenchmarks/string-add-constant-folding.js:
20658         (test):
20659
20660 2016-10-17  JF Bastien  <jfbastien@apple.com>
20661
20662         WebAssembly JS API: implement basic stub
20663
20664         Implement the global WebAssembly JavaScript object, and its constructor +
20665         function properties as described in:
20666           https://github.com/WebAssembly/design/blob/master/JS.md
20667
20668         These don't do anything at the moment, the parent bug will take care of adding
20669         more functionality and associated tests.
20670
20671         WebAssembly JS API: implement basic stub
20672         https://bugs.webkit.org/show_bug.cgi?id=163404
20673
20674         Reviewed by Keith Miller.
20675
20676         * wasm.yaml:
20677         * wasm/js-api/test_basic_api.js: Added.
20678         (const.f.of.functionProperties.WebAssembly.f.undefined.throw.new.Error.Couldn.const.c.of.constructorProperties.WebAssembly.c.undefined.throw.new.Error.Couldn):
20679         (const.c.of.constructorProperties.catch):
20680
20681 2016-10-17  Yusuke Suzuki  <utatane.tea@gmail.com>
20682
20683         [DOMJIT] Use DOMJIT::Patchpoint in IC
20684         https://bugs.webkit.org/show_bug.cgi?id=163223
20685
20686         Reviewed by Saam Barati.
20687
20688         * stress/domjit-exception-ic.js: Added.
20689         (shouldBe):
20690         (access):
20691         * stress/domjit-exception.js: Added.
20692         (shouldBe):
20693         (access):
20694         * stress/domjit-getter-complex-with-incorrect-object.js: Added.
20695         (shouldThrow):
20696         (access):
20697         (i.shouldThrow):
20698         * stress/domjit-getter-complex.js: Added.
20699         (shouldBe):
20700         (access):
20701         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js: Added.
20702         (assert):
20703         (bar):
20704         (foo):
20705
20706 2016-10-15  Saam Barati  <sbarati@apple.com>
20707
20708         Assertion failed under operationToLowerCase with a rope with zero length
20709         https://bugs.webkit.org/show_bug.cgi?id=163314
20710
20711         Reviewed by Mark Lam.
20712
20713         * stress/to-lower-case-intrinsic-on-empty-rope.js: Added.
20714         (assert):
20715         (returnRope.helper):
20716         (returnRope):
20717         (lower):
20718
20719 2016-10-14  Benjamin Poulain  <bpoulain@apple.com>
20720
20721         [JSC] op_negate should with any type
20722         https://bugs.webkit.org/show_bug.cgi?id=162587
20723
20724         Reviewed by Saam Barati.
20725
20726         * stress/arith-abs-to-arith-negate-range-optimizaton.js: Added.
20727         Cover OSR Exits when converting Math.abs() into ArithNegate.
20728
20729         * stress/arith-negate-on-various-types.js: Added.
20730         Cover ArithNegate with all types.
20731
20732 2016-10-14  JF Bastien  <jfbastien@apple.com>
20733
20734         Basic WebAssembly testing
20735
20736         Create a small DSL in JavaScript which can build WebAssembly binary modules based on the JSON description of the format as described in:
20737         https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md
20738
20739         This DSL can then be used to write small text description of valid and invalid WebAssembly binaries, making testing the JSC implementation much easier.
20740
20741         Details and example in README.md.
20742
20743         Basic WebAssembly testing
20744         https://bugs.webkit.org/show_bug.cgi?id=163267
20745
20746         Reviewed by Keith Miller.
20747
20748         * stress/wasm/wasm.json: Removed.
20749         * wasm.yaml: Added.
20750         * wasm/Builder.js: Added.
20751         (const._isValidValue):
20752         (const._BuildWebAssemblyBinary):
20753         (export.default.Builder):
20754         (export.default.Builder.prototype.setChecked):
20755         (export.default.Builder.prototype.setPreamble):
20756         (export.default.Builder.prototype._registerSectionBuilders.switch.case.string_appeared_here.this.section):
20757         (export.default.Builder.prototype._registerSectionBuilders.this.Unknown):
20758         (export.default.Builder.prototype._registerSectionBuilders):
20759         (export.default.Builder.prototype._addSection):
20760         (export.default.Builder.prototype.optimize):
20761         (export.default.Builder.prototype.json):
20762         (export.default.Builder.prototype.AsmJS):
20763         (export.default.Builder.prototype.WebAssembly):
20764         * wasm/LowLevelBinary.js: Added.
20765         (const._getterRangeCheck):
20766         (const._hexdump):
20767         (export.default.LowLevelBinary):
20768         (export.default.LowLevelBinary.prototype.newPatchable):
20769         (export.default.LowLevelBinary.prototype.hexdump):
20770         (export.default.LowLevelBinary.prototype._maybeGrow):
20771         (export.default.LowLevelBinary.prototype._push8):
20772         (export.default.LowLevelBinary.prototype.uint8):
20773         (export.default.LowLevelBinary.prototype.uint16):
20774         (export.default.LowLevelBinary.prototype.uint32):
20775         (export.default.LowLevelBinary.prototype.varuint):
20776         (export.default.LowLevelBinary.prototype.varint):
20777         (export.default.LowLevelBinary.prototype.varuint7):
20778         (export.default.LowLevelBinary.prototype.string):
20779         (export.default.LowLevelBinary.prototype.getSize):
20780         (export.default.LowLevelBinary.prototype.getUint8):
20781         (export.default.LowLevelBinary.prototype.getUint16):
20782         (export.default.LowLevelBinary.prototype.getUint32):
20783         (export.default.LowLevelBinary.prototype.getVaruint):
20784         (export.default.LowLevelBinary.prototype.getVarint):
20785         (export.default.LowLevelBinary.prototype.getVaruint7):
20786         (export.default.LowLevelBinary.prototype.getString):
20787         (PatchableLowLevelBinary):
20788         (PatchableLowLevelBinary.prototype._push8):
20789         (PatchableLowLevelBinary.prototype.apply):
20790         * wasm/README.md: Added.
20791         * wasm/WASM.js: Added.
20792         * wasm/assert.js: Added.
20793         (export.const.notUndef):
20794         (export.const.eq):
20795         (export.const.ge):
20796         (export.const.throwsError):
20797         (export.const.throwsRangeError):
20798         * wasm/generate-wasmops-header.js: Renamed from JSTests/stress/wasm/generate-wasmops-header.js.
20799         * wasm/self-test/test_BuilderJSON.js: Added.
20800         (const.assertOpThrows):
20801         (EmptyModule):
20802         (CustomMagicNumber):
20803         (CustomVersion):
20804         (CustomSection):
20805         (CustomSectionAllBytes):
20806         (CustomSectionInvalidByte):
20807         (TwoCustomSections):
20808         (EmptyCodeSection):
20809         (CodeSectionWithEmptyFunction):
20810         (CodeSectionWithEmptyFunctionWithParameters):
20811         (InvalidFunctionParameters):
20812         (SimpleFunction):
20813         (TwoSimpleFunctions):
20814         (TwoBuildersAtTheSameTime):
20815         (CheckedOpcodeArgumentsTooMany):
20816         (CheckedOpcodeArgumentsNotEnough):
20817         (CallNoArguments):
20818         (CallInvalid):
20819         (I32ConstInvalid):
20820         (F32ConstInvalid):
20821         (F64ConstInvalid):
20822         (CallManyFromStack):
20823         (OpcodeAdd):
20824         (OpcodeUnreachable):
20825         (OpcodeUnreachableCombinations):
20826         (OpcodeSelect):
20827         * wasm/self-test/test_BuilderWebAssembly.js: Added.
20828         (EmptyModule):
20829         (CustomSection):
20830         (Basic):
20831         * wasm/self-test/test_LowLevelBinary_encode.js: Added.
20832         * wasm/self-test/test_LowLevelBinary_string.js: Added.
20833         * wasm/self-test/test_LowLevelBinary_uint16.js: Added.
20834         * wasm/self-test/test_LowLevelBinary_uint32.js: Added.
20835         * wasm/self-test/test_LowLevelBinary_uint8.js: Added.
20836         * wasm/self-test/test_LowLevelBinary_varint.js: Added.
20837         * wasm/self-test/test_LowLevelBinary_varuint.js: Added.
20838         * wasm/self-test/test_LowLevelBinary_varuint7.js: Added.
20839         * wasm/self-test/test_WASM.js: Added.
20840         * wasm/test.sh: Added.
20841         * wasm/utilities.js: Added.
20842         (const._read.filename.switch):
20843         (const._load.filename.switch):
20844         (const._json.filename.switch):
20845         * wasm/wasm.json: Added.
20846
20847 2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
20848
20849         test262: @isConstructor incorrectly thinks Math.cos is a constructor
20850         https://bugs.webkit.org/show_bug.cgi?id=163437
20851
20852         Reviewed by Saam Barati.
20853
20854         * stress/is-constructor.js: Added.
20855         (assert):
20856         (prototype.assert):
20857         New test to cover the @isConstructor builtin.
20858
20859         * test262.yaml:
20860         Test now passes.
20861
20862 2016-10-14  Ryan Haddad  <ryanhaddad@apple.com>
20863
20864         Unreviewed, rolling out r207322.
20865
20866         This change caused JSC test failures
20867
20868         Reverted changeset:
20869
20870         "Fix Array.prototype.splice ES6 compliance."
20871         https://bugs.webkit.org/show_bug.cgi?id=163372
20872         http://trac.webkit.org/changeset/207322
20873
20874 2016-10-14  Mark Lam  <mark.lam@apple.com>
20875
20876         JSON.parse should not modify frozen objects.
20877         https://bugs.webkit.org/show_bug.cgi?id=163430
20878
20879         Reviewed by Saam Barati.
20880
20881         * stress/json-parse-on-frozen-object.js: Added.
20882
20883 2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
20884
20885         test262: Failure with RegExp.prototype.compile when pattern is undefined
20886         https://bugs.webkit.org/show_bug.cgi?id=163431
20887
20888         Reviewed by Yusuke Suzuki.
20889
20890         * test262.yaml:
20891
20892 2016-10-13  Joseph Pecoraro  <pecoraro@apple.com>
20893
20894         Exception message for expressions with multiple bracket accesses is inconsistent / incorrect
20895         https://bugs.webkit.org/show_bug.cgi?id=163426
20896
20897         Reviewed by Geoffrey Garen.
20898
20899         * ChakraCore/test/Error/CallNonFunction_3.baseline-jsc:
20900         * ChakraCore/test/Object/null.baseline-jsc:
20901         * stress/exception-in-to-property-key-should-be-handled-early.js:
20902         Better exception messages.
20903
20904 2016-10-13  Mark Lam  <mark.lam@apple.com>
20905
20906         Fix Array.prototype.splice ES6 compliance.
20907         https://bugs.webkit.org/show_bug.cgi?id=163372
20908
20909         Reviewed by Geoffrey Garen and Yusuke Suzuki.
20910
20911         * stress/array-splice-on-frozen-object.js: Added.
20912
20913 2016-10-12  Keith Miller  <keith_miller@apple.com>
20914
20915         Handle non-function, non-undefined comparator in Array.prototype.sort
20916         https://bugs.webkit.org/show_bug.cgi?id=163085
20917
20918         Reviewed by Yusuke Suzuki.
20919
20920         * ChakraCore/test/Array/array_sort.baseline-jsc:
20921         * stress/array-sort-bad-comparator.js: Added.
20922         (test):
20923
20924 2016-10-12  Mark Lam  <mark.lam@apple.com>
20925
20926         Array.prototype.slice should not modify frozen objects.
20927         https://bugs.webkit.org/show_bug.cgi?id=163338
20928
20929         Reviewed by Filip Pizlo.
20930
20931         * stress/array-slice-on-frozen-object.js: Added.
20932
20933 2016-10-11  Mark Lam  <mark.lam@apple.com>
20934
20935         Array.prototype.concat should not modify frozen objects.
20936         https://bugs.webkit.org/show_bug.cgi?id=163302
20937
20938         Reviewed by Filip Pizlo.
20939
20940         * stress/array-concat-on-frozen-object.js: Added.
20941
20942 2016-10-11  Saam Barati  <sbarati@apple.com>
20943
20944         ValueAdd should be constant folded if the operands are constant String,Primitive or Primitive,String
20945         https://bugs.webkit.org/show_bug.cgi?id=163182
20946
20947         Reviewed by Filip Pizlo.
20948
20949         * microbenchmarks/string-add-constant-folding.js: Added.
20950         (assert):
20951         (runTests):
20952         (add):
20953         (test):
20954
20955 2016-10-07  Mark Lam  <mark.lam@apple.com>
20956
20957         Object.freeze() and seal() should throw if [[PreventExtensions]]() fails.
20958         https://bugs.webkit.org/show_bug.cgi?id=163160
20959
20960         Reviewed by Saam Barati.
20961
20962         * stress/object-freeze-with-proxy-preventExtensions.js: Added.
20963         * stress/object-seal-with-proxy-preventExtensions.js: Added.
20964
20965 2016-10-05  Yusuke Suzuki  <utatane.tea@gmail.com>
20966
20967         [DOMJIT] Add initial CheckDOM and CallDOM implementations
20968         https://bugs.webkit.org/show_bug.cgi?id=162941
20969
20970         Reviewed by Filip Pizlo.
20971
20972         * stress/domjit-getter-poly.js: Added.
20973         (shouldBe):
20974         (access):
20975         * stress/domjit-getter-proto.js: Added.
20976         (shouldBe):
20977         (access):
20978         * stress/domjit-getter-super-poly.js: Added.
20979         (shouldBe):
20980         (access):
20981         * stress/domjit-getter.js: Added.
20982         (shouldBe):
20983         (access):
20984
20985 2016-10-04  Saam Barati  <sbarati@apple.com>
20986
20987         String.prototype.toLowerCase should be a DFG/FTL intrinsic
20988         https://bugs.webkit.org/show_bug.cgi?id=162887
20989
20990         Reviewed by Filip Pizlo and Yusuke Suzuki.
20991
20992         * microbenchmarks/to-lower-case.js: Added.
20993         (assert):
20994         (foo):
20995         (bar):
20996         * stress/to-lower-case.js: Added.
20997         (assert):
20998         (foo):
20999
21000 2016-10-04  JF Bastien  <jfbastien@apple.com>
21001
21002         WebAssembly: handle a few corner cases
21003         https://bugs.webkit.org/show_bug.cgi?id=162884
21004
21005         Reviewed by Keith Miller.
21006
21007         * stress/wasm/generate-wasmops-header.js:
21008         (const.opcodeIterator): max opcode value
21009
21010 2016-10-03  JF Bastien  <jfbastien@apple.com>
21011
21012         Auto-generate WASMOps.h, share with testing JSON file
21013         https://bugs.webkit.org/show_bug.cgi?id=162870
21014
21015         Reviewed by Keith Miller.
21016
21017         * stress/wasm/to-c++.js: Added. Generates WASMOps.h, siilar to the current one but with more data.
21018         (const.opcode_iterator):
21019         (opcode_macroizer):
21020         * stress/wasm/wasm.json: Added. Data from 0xC binary format version.
21021
21022 2016-10-03  Saam Barati  <sbarati@apple.com>
21023
21024         MapHash should speculate on the type of its child node
21025         https://bugs.webkit.org/show_bug.cgi?id=161922
21026
21027         Reviewed by Filip Pizlo.
21028
21029         * microbenchmarks/map-key-well-typed.js: Added.
21030         (assert):
21031         (intKey):
21032         (doubleKey):
21033         (objectKey):
21034         (stringKey):
21035         (booleanKey):
21036         (symbolKey):
21037         (cellKey):
21038         (assert.doubleKey):
21039         (assert.booleanKey):
21040
21041 2016-10-03  Yusuke Suzuki  <utatane.tea@gmail.com>
21042
21043         [ES6] GeneratorFunction (a.k.a. GeneratorWrapperFunction)'s prototype object does not have constructor property
21044         https://bugs.webkit.org/show_bug.cgi?id=162849
21045
21046         Reviewed by Geoffrey Garen.
21047
21048         * test262.yaml:
21049
21050 2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
21051
21052         [ES6] Align attributes of Generator related properties to spec
21053         https://bugs.webkit.org/show_bug.cgi?id=162839
21054
21055         Reviewed by Saam Barati.
21056
21057         * test262.yaml:
21058
21059 2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
21060
21061         [ES6] GeneratorFunction constructor should instantiate generator function
21062         https://bugs.webkit.org/show_bug.cgi?id=162838
21063
21064         Reviewed by Saam Barati.
21065
21066         * stress/generator-function-constructor-is-subclassible.js: Added.
21067         (shouldBe):
21068         (GeneratorFunction):
21069         (prototype.hello):
21070         * stress/generator-function-constructor.js:
21071         * test262.yaml:
21072
21073 2016-09-30  Saam Barati  <sbarati@apple.com>
21074
21075         Arrow functions should not allow duplicate parameter names
21076         https://bugs.webkit.org/show_bug.cgi?id=162741
21077
21078         Reviewed by Filip Pizlo.
21079
21080         * test262.yaml:
21081
21082 2016-09-30  Saam Barati  <sbarati@apple.com>
21083
21084         Make some microbenchmarks run for less time.
21085
21086         Rubber stamped by Filip Pizlo.
21087
21088         * microbenchmarks/bound-function-construction-performance.js:
21089         (foo):
21090         * microbenchmarks/getter-richards-try-catch.js:
21091
21092 2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
21093
21094         Arrow functions do not infer name from computed property but normal functions do
21095         https://bugs.webkit.org/show_bug.cgi?id=162720
21096
21097         Reviewed by Saam Barati.
21098
21099         * stress/inferred-names.js:
21100
21101 2016-09-29  Mark Lam  <mark.lam@apple.com>
21102
21103         Break some slow running tests into smaller bits so they don't time out.
21104         https://bugs.webkit.org/show_bug.cgi?id=162743
21105
21106         Reviewed by Keith Miller.
21107
21108         The following tests have shown to be slow running:
21109             op_div.js
21110             op_lshift.js
21111             op_mod.js
21112             op_mul.js
21113             op_rshift.js
21114             op_sub.js
21115             op_urshift
21116
21117         These tests auto-generate permutations of values to apply to binary operations.
21118         They also test the operations with 3 permutations of value types:
21119             1. VarVar - both operands variables
21120             2. VarConst - variable operand 1, constant / literal operand 2
21121             3. ConstVar - constant / literal operand 1, variable operand 2
21122
21123         We can prevent these tests from timing out by breaking each up to only run 1 of
21124         the 3 permutations of value types.
21125
21126         * stress/op_div-ConstVar.js: Added.
21127         * stress/op_div-VarConst.js: Added.
21128         * stress/op_div-VarVar.js: Copied from JSTests/stress/op_div.js.
21129         (o1.valueOf): Deleted.
21130         * stress/op_div.js: Removed.
21131         * stress/op_lshift-ConstVar.js: Added.
21132         * stress/op_lshift-VarConst.js: Added.
21133         * stress/op_lshift-VarVar.js: Copied from JSTests/stress/op_lshift.js.
21134         (o1.valueOf): Deleted.
21135         * stress/op_lshift.js: Removed.
21136         * stress/op_mod-ConstVar.js: Added.
21137         * stress/op_mod-VarConst.js: Added.
21138         * stress/op_mod-VarVar.js: Copied from JSTests/stress/op_mod.js.
21139         (o1.valueOf): Deleted.
21140         * stress/op_mod.js: Removed.
21141         * stress/op_mul-ConstVar.js: Added.
21142         * stress/op_mul-VarConst.js: Added.
21143         * stress/op_mul-VarVar.js: Copied from JSTests/stress/op_mul.js.
21144         (o1.valueOf): Deleted.
21145         * stress/op_mul.js: Removed.
21146         * stress/op_rshift-ConstVar.js: Added.
21147         * stress/op_rshift-VarConst.js: Added.
21148         * stress/op_rshift-VarVar.js: Copied from JSTests/stress/op_rshift.js.
21149         (o1.valueOf): Deleted.
21150         * stress/op_rshift.js: Removed.
21151         * stress/op_sub-ConstVar.js: Added.
21152         * stress/op_sub-VarConst.js: Added.
21153         * stress/op_sub-VarVar.js: Copied from JSTests/stress/op_sub.js.
21154         (o1.valueOf): Deleted.
21155         * stress/op_sub.js: Removed.
21156         * stress/op_urshift-ConstVar.js: Added.
21157         * stress/op_urshift-VarConst.js: Added.
21158         * stress/op_urshift-VarVar.js: Copied from JSTests/stress/op_urshift.js.
21159         (o1.valueOf): Deleted.
21160         * stress/op_urshift.js: Removed.
21161         * stress/resources/binary-op-values.js: Added.
21162         (o1.valueOf):
21163
21164 2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
21165
21166         test262: class and function names should be inferred in assignment
21167         https://bugs.webkit.org/show_bug.cgi?id=146262
21168
21169         Reviewed by Saam Barati.
21170
21171         * stress/arrowfunction-name.js: Added.
21172         Quick tests for arrow function names.
21173
21174         * stress/inferred-names.js: Added.
21175         General test for inferred function names.
21176
21177         * test262.yaml:
21178         Pass many tests checking inferred function names.
21179
21180 2016-09-29  Saam Barati  <sbarati@apple.com>
21181
21182         We don't properly propagate non-simple-parameter-list when parsing a setter
21183         https://bugs.webkit.org/show_bug.cgi?id=160483
21184
21185         Reviewed by Joseph Pecoraro.
21186
21187         * test262.yaml:
21188
21189 2016-09-28  Saam Barati  <sbarati@apple.com>
21190
21191         stringProtoFuncRepeatCharacter will return `null` when it should not
21192         https://bugs.webkit.org/show_bug.cgi?id=161944
21193
21194         Reviewed by Yusuke Suzuki.
21195
21196         * stress/pad-start-calls-repeat-character-with-double.js: Added.
21197         (logLinesWithContext):
21198
21199 2016-09-27  Filip Pizlo  <fpizlo@apple.com>
21200
21201         B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64
21202         https://bugs.webkit.org/show_bug.cgi?id=162644
21203
21204         Reviewed by Keith Miller.
21205
21206         * stress/chill-mod-chill-mod.js: Added.
21207         (foo):
21208
21209 2016-09-26  Csaba Osztrogonác  <oszi@inf.u-szeged.hu>
21210
21211         Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
21212         https://bugs.webkit.org/show_bug.cgi?id=162386
21213
21214         Unreviewed, relanding r206317 after typo fix.
21215
21216         * stress/string-joining-long-strings-should-not-crash.js:
21217
21218 2016-09-24  Caitlin Potter  <caitp@igalia.com>
21219
21220         [JSTests] fix test262 expectations following r206333
21221         https://bugs.webkit.org/show_bug.cgi?id=162533
21222
21223         Reviewed by Yusuke Suzuki.
21224
21225         * test262.yaml:
21226
21227 2016-09-23  Caitlin Potter  <caitp@igalia.com>
21228
21229         [JSC] Implement parsing of Async Functions
21230         https://bugs.webkit.org/show_bug.cgi?id=161409
21231
21232         Reviewed by Yusuke Suzuki.
21233
21234         * stress/async-await-syntax.js: Added.
21235         (testSyntax):
21236         (testSyntaxError):
21237         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
21238         (testTopLevelAsyncAwaitSyntaxSloppyMode):
21239         (testTopLevelAsyncAwaitSyntaxStrictMode):
21240         (testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
21241         (testNestedAsyncAwaitSyntax.async):
21242         (testNestedAsyncAwaitSyntax.foo):
21243         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
21244
21245 2016-09-23  Ryan Haddad  <ryanhaddad@apple.com>
21246
21247         Unreviewed, rolling out r206317.
21248
21249         This change caused timeouts on El Capitan Release JSC tests
21250
21251         Reverted changeset:
21252
21253         "Skip stress/string-joining-long-strings-should-not-crash.js
21254         on memory limited devices"
21255         https://bugs.webkit.org/show_bug.cgi?id=162386
21256         http://trac.webkit.org/changeset/206317
21257
21258 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
21259
21260         Skip mozilla-tests.yaml/js1_5/Array/regress-157652 on memory limited devices
21261         https://bugs.webkit.org/show_bug.cgi?id=162381
21262
21263         Reviewed by Mark Lam.
21264
21265         * mozilla/mozilla-tests.yaml:
21266
21267 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
21268
21269         Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
21270         https://bugs.webkit.org/show_bug.cgi?id=162386
21271
21272         Reviewed by Mark Lam.
21273
21274         * stress/string-joining-long-strings-should-not-crash.js:
21275
21276 2016-09-22  Benjamin Poulain  <bpoulain@apple.com>
21277
21278         [JSC] Use an inline cache to generate op_negate
21279         https://bugs.webkit.org/show_bug.cgi?id=162371
21280
21281         Reviewed by Saam Barati.
21282
21283         * stress/op-negate-inline-cache.js: Added.
21284
21285 2016-09-22  Mark Lam  <mark.lam@apple.com>
21286
21287         Array.prototype.join should do overflow checks on string joins.
21288         https://bugs.webkit.org/show_bug.cgi?id=162459
21289
21290         Reviewed by Saam Barati.
21291
21292         * stress/array-join-on-strings-need-overflow-checks.js: Added.
21293         (assert):
21294         (catch):
21295
21296 2016-09-22  Joseph Pecoraro  <pecoraro@apple.com>
21297
21298         test262: Function length should be number of parameters before parameters with default values
21299         https://bugs.webkit.org/show_bug.cgi?id=162377
21300
21301         Reviewed by Saam Barati.
21302
21303         * stress/es6-default-parameters.js:
21304         Add our own tests for function lengths with default parameters.
21305
21306         * test262.yaml:
21307         We now pass all dflt-length tests.
21308
21309 2016-09-20  Benjamin Poulain  <bpoulain@apple.com>
21310
21311         [JSC] Do not use EagerRun on tests counting recompilation
21312         https://bugs.webkit.org/show_bug.cgi?id=162248
21313
21314         Reviewed by Geoffrey Garen.
21315
21316         This patch adds defaultNoEagerRun to all the tests
21317         for which recompilation is the symptom of a bug.
21318         The reason is that an OSR Exit can be unrelated to the tested
21319         nodes when we are running in Eager mode.
21320
21321         * stress/arith-abs-on-various-types.js:
21322         * stress/arith-ceil-on-various-types.js:
21323         * stress/arith-clz32-on-various-types.js:
21324         * stress/arith-cos-on-various-types.js:
21325         * stress/arith-floor-on-various-types.js:
21326         * stress/arith-fround-on-various-types.js:
21327         * stress/arith-log-on-various-types.js:
21328         * stress/arith-round-on-various-types.js:
21329         * stress/arith-sin-on-various-types.js:
21330         * stress/arith-sqrt-on-various-types.js:
21331         * stress/arith-tan-on-various-types.js:
21332         * stress/arith-trunc-on-various-types.js:
21333
21334         * stress/compare-strict-eq-on-various-types.js:
21335         (testAllTypesCall):
21336         The value 2 came from the other tests.
21337         CompareStrictEq supports many more cases, the worst case
21338         is bool->int->int52->number->polymorphic.
21339
21340 2016-09-20  Filip Pizlo  <fpizlo@apple.com>
21341
21342         Make MarkedBlock state tracking support overlapped allocation and marking state
21343         https://bugs.webkit.org/show_bug.cgi?id=161581
21344
21345         Reviewed by Geoffrey Garen.
21346
21347         Add a microbenchmark for why we want to reclaim empty blocks from other allocators.
21348
21349         * microbenchmarks/switching-size-classes.js: Added.
21350
21351 2016-09-20  Saam Barati  <sbarati@apple.com>
21352
21353         Unreviewed, added test for x86 32-bit failure for HasOwnProperty node in DFG.
21354
21355         * stress/has-own-property-called-on-non-object.js: Added.
21356         (let.objs):
21357         (new.String):
21358         (foo):
21359
21360 2016-09-20  Yusuke Suzuki  <utatane.tea@gmail.com>
21361
21362         [JSC] Add `typeof value === "symbol"` handling to bytecode compiler
21363         https://bugs.webkit.org/show_bug.cgi?id=162253
21364
21365         Reviewed by Sam Weinig.
21366
21367         * microbenchmarks/is-symbol-mixed.js: Added.
21368         (isSymbol):
21369         (i.let.pair.of.list.String):
21370         * microbenchmarks/is-symbol.js: Added.
21371         (isSymbol):
21372
21373 2016-09-19  Saam Barati  <sbarati@apple.com>
21374
21375         Make HasOwnProperty faster
21376         https://bugs.webkit.org/show_bug.cgi?id=161708
21377
21378         Reviewed by Geoffrey Garen.
21379
21380         * microbenchmarks/has-own-property-name-cache.js: Added.
21381         (foo):
21382         * stress/has-own-property-cache-basics.js: Added.
21383         (assert):
21384         (foo):
21385         * stress/has-own-property-name-cache-string-keys.js: Added.
21386         (assert):
21387         (foo):
21388         * stress/has-own-property-name-cache-symbol-keys.js: Added.
21389         (assert):
21390         (foo):
21391         * stress/has-own-property-name-cache-symbols-and-strings.js: Added.
21392         (assert):
21393         (foo):
21394
21395 2016-09-19  Benjamin Poulain  <bpoulain@apple.com>
21396
21397         [JSC] Make the rounding-related nodes support any type
21398         https://bugs.webkit.org/show_bug.cgi?id=161895
21399
21400         Reviewed by Geoffrey Garen.
21401
21402         * stress/arith-ceil-on-various-types.js: Added.
21403         * stress/arith-floor-on-various-types.js: Added.
21404         * stress/arith-round-on-various-types.js: Added.
21405         * stress/arith-trunc-on-various-types.js: Added.
21406
21407 2016-09-18  Yusuke Suzuki  <utatane.tea@gmail.com>
21408
21409         [JSC] Do not need to use defineProperty to define methods for object literals
21410         https://bugs.webkit.org/show_bug.cgi?id=162111
21411
21412         Reviewed by Saam Barati.
21413
21414         * stress/object-literal-methods.js: Added.
21415         (shouldBe):
21416         (throw.new.Error.let.object.get name):
21417         (throw.new.Error):
21418         (shouldBe.let.object.get name):
21419         (shouldBe.let.object.get prototype):
21420         (shouldBe.let.object.get 42):
21421
21422 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
21423
21424         [DFG] Introduce IsCellWithType node and unify IsJSArray, IsRegExpObject and newly added IsProxyObject
21425         https://bugs.webkit.org/show_bug.cgi?id=162000
21426
21427         Reviewed by Filip Pizlo.
21428
21429         * microbenchmarks/is-array-for-array.js: Added.
21430         (isArray):
21431         * microbenchmarks/is-array-for-mixed-case.js: Added.
21432         (isArray):
21433         * microbenchmarks/is-array-for-non-array-object.js: Added.
21434         (isArray):
21435         * microbenchmarks/is-array-for-proxy.js: Added.
21436         (isArray):
21437         (isArray.proxy.throw.new.Error.isArray):
21438         (isArray.proxy.throw.new.Error):
21439
21440 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
21441
21442         Unreviewed, gardening test262 results
21443
21444         Some tests are now passed with JSC, but marked as failed.
21445
21446         * test262.yaml:
21447
21448 2016-09-16  Joseph Pecoraro  <pecoraro@apple.com>
21449
21450         test262: Various Constructors length properties should be configurable
21451         https://bugs.webkit.org/show_bug.cgi?id=161998
21452
21453         Reviewed by Saam Barati.
21454
21455         * test262.yaml:
21456
21457 2016-09-15  Commit Queue  <commit-queue@webkit.org>
21458
21459         Unreviewed, rolling out r205931.
21460         https://bugs.webkit.org/show_bug.cgi?id=162021
21461
21462         Tests for this change fail on 32-bit JSC bots (Requested by
21463         ryanhaddad on #webkit).
21464
21465         Reverted changeset:
21466
21467         "[JSC] Make the rounding-related nodes support any type"
21468         https://bugs.webkit.org/show_bug.cgi?id=161895
21469         http://trac.webkit.org/changeset/205931
21470
21471 2016-09-15  Joseph Pecoraro  <pecoraro@apple.com>
21472
21473         test262: Should be a SyntaxError for duplicate parameter names in function with default parameters
21474         https://bugs.webkit.org/show_bug.cgi?id=162013
21475
21476         Reviewed by Saam Barati.
21477
21478         * stress/es6-default-parameters.js:
21479         * test262.yaml:
21480
21481 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
21482
21483         ASSERT_NOT_REACHED when using spread inside an array literal with Function.prototype.apply
21484         https://bugs.webkit.org/show_bug.cgi?id=162003
21485
21486         Reviewed by Saam Barati.
21487
21488         * stress/spread-calling.js:
21489         * test262.yaml:
21490
21491 2016-09-14  Michael Saboff  <msaboff@apple.com>
21492
21493         YARR doesn't check for invalid flags for literal regular expressions
21494         https://bugs.webkit.org/show_bug.cgi?id=161995
21495
21496         Reviewed by Mark Lam.
21497
21498         New test.
21499
21500         * stress/regress-161995.js: Added.
21501         (testStatic):
21502         (catch):
21503
21504 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
21505
21506         test262: TypedArray constructors length should be 3 and configurable
21507         https://bugs.webkit.org/show_bug.cgi?id=161955
21508
21509         Reviewed by Mark Lam.
21510
21511         * test262.yaml:
21512
21513 2016-09-14  Benjamin Poulain  <bpoulain@apple.com>
21514
21515         [JSC] Make the rounding-related nodes support any type
21516         https://bugs.webkit.org/show_bug.cgi?id=161895
21517
21518         Reviewed by Geoffrey Garen.
21519
21520         * stress/arith-ceil-on-various-types.js: Added.
21521         * stress/arith-floor-on-various-types.js: Added.
21522         * stress/arith-round-on-various-types.js: Added.
21523         * stress/arith-trunc-on-various-types.js: Added.
21524
21525 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
21526
21527         TaggedTemplateString function calls should emit tail position calls
21528         https://bugs.webkit.org/show_bug.cgi?id=161948
21529
21530         Reviewed by Yusuke Suzuki.
21531
21532         * stress/tail-call-recognize.js:
21533         (runTests):
21534         Ensure a tagged template string function call is tail call.
21535
21536         * test262.yaml:
21537         These now pass.
21538
21539 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
21540
21541         test262: Array.prototype.slice should always set length
21542         https://bugs.webkit.org/show_bug.cgi?id=161953
21543
21544         Reviewed by Mark Lam.
21545
21546         * test262.yaml:
21547
21548 2016-09-13  JF Bastien  <jfbastien@apple.com>
21549
21550         Support jsc shell builtin `read`
21551         https://bugs.webkit.org/show_bug.cgi?id=161662
21552
21553         Reviewed by Keith Miller.
21554
21555         * stress/jsc-read.js: Added.
21556         (test): test `read` and `readFile` shell builtins, in string and binary mode.
21557
21558 2016-09-12  Skachkov Oleksandr  <gskachkov@gmail.com>
21559
21560         ES6: Classes: Should be allowed to create a static method with name "arguments"
21561         https://bugs.webkit.org/show_bug.cgi?id=152985
21562
21563         Reviewed by Keith Miller.
21564
21565         * test262.yaml:
21566
21567 2016-09-12  Saam Barati  <sbarati@apple.com>
21568
21569         Speed up Function.prototype.bind a bit by making it a builtin
21570         https://bugs.webkit.org/show_bug.cgi?id=161879
21571
21572         Reviewed by Filip Pizlo.
21573
21574         * microbenchmarks/function-bind-inlining.js: Added.
21575         (assert):
21576         (test):
21577         (test2):
21578         (foo):
21579         * microbenchmarks/function-bind-no-inlining.js: Added.
21580         (assert):
21581         (test):
21582         (test2):
21583         (foo):
21584
21585 2016-09-12  Saam Barati  <sbarati@apple.com>
21586
21587         HashMapImpl should take into account m_deleteCount in its load factor and it should be able to rehash the table to be smaller
21588         https://bugs.webkit.org/show_bug.cgi?id=161640
21589
21590         Reviewed by Geoffrey Garen.
21591
21592         * microbenchmarks/map-rehash.js: Added.
21593         * stress/map-delete.js: Added.
21594         (assert):
21595         * stress/map-rehash-2.js: Added.
21596         (assert):
21597         * stress/map-rehash.js: Added.
21598         (assert):
21599
21600 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
21601
21602         Unreviewed, fix tests for different libm environments
21603         https://bugs.webkit.org/show_bug.cgi?id=161857
21604
21605         * stress/ftl-arithtan.js:
21606
21607 2016-09-12  Benjamin Poulain  <bpoulain@apple.com>
21608
21609         [JSC] Use GetArrayLength for JSArray.length even when the array type is undecided
21610         https://bugs.webkit.org/show_bug.cgi?id=161671
21611
21612         Reviewed by Geoffrey Garen.
21613
21614         * stress/get-array-length-on-undecided.js: Added.
21615
21616 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
21617
21618         [DFG][FTL] Add ArithTan
21619         https://bugs.webkit.org/show_bug.cgi?id=161857
21620
21621         Reviewed by Filip Pizlo.
21622
21623         * microbenchmarks/tan.js: Added.
21624         * stress/arith-tan-on-various-types.js: Added.
21625         (let.validInputTypedTestCases.validInputTestCases.map):
21626         (isIdentical):
21627         (opaqueTanNoArgument):
21628         (testNoArgument):
21629         (opaqueAllTypesTan):
21630         (testAllTypesCall):
21631         (testTangleTypeCall):
21632         (testConstant):
21633         (opaqueTanForSideEffects):
21634         (testSideEffect.let.testObject.valueOf):
21635         (testSideEffect):
21636         (opaqueTanForCSE):
21637         (testCSE.let.testObject.valueOf):
21638         (testCSE):
21639         (opaqueTanForDCE):
21640         (testDCE.let.testObject.valueOf):
21641         (testDCE):
21642         (testException.opaqueTanWithException):
21643         (testException):
21644         * stress/ftl-arithtan.js: Added.
21645         (foo):
21646
21647 2016-09-12  Saam Barati  <sbarati@apple.com>
21648
21649         MapHash should do constant folding when it has a constant argument and its legal to hash that value
21650         https://bugs.webkit.org/show_bug.cgi?id=161639
21651
21652         Reviewed by Filip Pizlo.
21653
21654         * microbenchmarks/map-constant-key.js: Added.
21655         (assert):
21656         (test):
21657         (foo):
21658
21659 2016-09-12  Michael Saboff  <msaboff@apple.com>
21660
21661         JSC test timeout: ChakraCore.yaml/ChakraCore/test/Bugs/bug56026_trycatch.js.default
21662         https://bugs.webkit.org/show_bug.cgi?id=161863
21663
21664         Reviewed by Saam Barati.
21665
21666         * ChakraCore.yaml:
21667         Disabled Bugs/bug56026_trycatch.js.
21668
21669 2016-09-09  Michael Saboff  <msaboff@apple.com>
21670
21671         Unreviewed, rolling r205759 back in with a fix.
21672
21673         The expectation file, JSTests/ChakraCore/test/Lib/tostring.baseline-jsc,
21674         should be named "toString.baseline-jsc".
21675
21676         * ChakraCore/test/Lib/toString.baseline-jsc: Copied from JSTests/ChakraCore/test/Lib/tostring.baseline-jsc.
21677         * ChakraCore/test/Lib/tostring.baseline-jsc: Removed.
21678
21679 2016-09-09  Michael Saboff  <msaboff@apple.com>
21680
21681         Disable three flakey Chakra Tests
21682         https://bugs.webkit.org/show_bug.cgi?id=161807
21683
21684         Reviewed by Saam Barati.
21685
21686         * ChakraCore.yaml: Disabled the flakey tests
21687         ChakraCore/test/Array/protoLookup_native.js
21688         ChakraCore/test/LetConst/delete.js
21689         ChakraCore/test/fieldopts/fieldhoist_sideeffect.js
21690
21691 2016-09-08  Saam Barati  <sbarati@apple.com>
21692
21693         We should inline operationConvertJSValueToBoolean into JIT code
21694         https://bugs.webkit.org/show_bug.cgi?id=161729
21695
21696         Reviewed by Filip Pizlo.
21697
21698         * stress/value-to-boolean.js: Added.
21699         (assert):
21700         (test1):
21701         (test2):
21702         (test3):
21703
21704 2016-09-08  Mark Lam  <mark.lam@apple.com>
21705
21706         REGRESSION (r205569?): 32-bit JSC test timeout: stress/rest-parameter-many-arguments.js.dfg-maximal-flush-validate-no-cjit
21707         https://bugs.webkit.org/show_bug.cgi?id=161756
21708
21709         Reviewed by Saam Barati.
21710
21711         It looks like the 32-bit JSC bot is just too slow at running this test with the
21712         dfg-maximal-flush-validate-no-cjit configuration.  We'll try excluding that
21713         configuration.
21714
21715         * stress/rest-parameter-many-arguments.js:
21716
21717 2016-09-08  JF Bastien  <jfbastien@apple.com>
21718
21719         Delete older WebAssembly tests
21720         https://bugs.webkit.org/show_bug.cgi?id=161758
21721
21722         Reviewed by Filip Pizlo.
21723
21724         They're not running, rely on the older polyfill prototype, and the older code was deleted in: https://trac.webkit.org/changeset/204180
21725
21726         * stress/wasm-arithmetic-float32.js: Removed.
21727         * stress/wasm-arithmetic-float64.js: Removed.
21728         * stress/wasm-arithmetic-int32.js: Removed.
21729         * stress/wasm-calls.js: Removed.
21730         * stress/wasm-comma.js: Removed.
21731         * stress/wasm-control-flow.js: Removed.
21732         * stress/wasm-globals.js: Removed.
21733         * stress/wasm-linear-memory.js: Removed.
21734         * stress/wasm-locals.js: Removed.
21735         * stress/wasm-relational.js: Removed.
21736         * stress/wasm-type-conversion.js: Removed.
21737         * stress/wasm/arithmetic-float32.wasm: Removed.
21738         * stress/wasm/arithmetic-float64.wasm: Removed.
21739         * stress/wasm/arithmetic-int32.wasm: Removed.
21740         * stress/wasm/calls.wasm: Removed.
21741         * stress/wasm/comma.wasm: Removed.
21742         * stress/wasm/control-flow.wasm: Removed.
21743         * stress/wasm/globals.wasm: Removed.
21744         * stress/wasm/linear-memory.wasm: Removed.
21745         * stress/wasm/locals.wasm: Removed.
21746         * stress/wasm/relational.wasm: Removed.
21747         * stress/wasm/type-conversion.wasm: Removed.
21748
21749 2016-09-08  Per Arne Vollan  <pvollan@apple.com>
21750
21751         [Win] Exception fuzz tests fail
21752         https://bugs.webkit.org/show_bug.cgi?id=140928
21753
21754         Reviewed by Mark Lam.
21755
21756         Unskip tests.
21757
21758         * exceptionFuzz.yaml:
21759
21760 2016-09-06  Saam Barati  <sbarati@apple.com>
21761
21762         ProxyObject's structure should not have ObjectPrototype as its prototype and it should not have special behavior for intercepting "__proto__"
21763         https://bugs.webkit.org/show_bug.cgi?id=161558
21764
21765         Reviewed by Benjamin Poulain.
21766
21767         * stress/proxy-get-prototype-of.js:
21768         * stress/proxy-set-prototype-of.js:
21769         (let.handler.setPrototypeOf): Deleted.
21770         * stress/proxy-underscore-proto.js: Added.
21771         (assert):
21772
21773 2016-09-06  Saam Barati  <sbarati@apple.com>
21774
21775         Make JSMap and JSSet faster
21776         https://bugs.webkit.org/show_bug.cgi?id=160989
21777
21778         Reviewed by Filip Pizlo.
21779
21780         * microbenchmarks/dense-set.js: Added.
21781         (bench):
21782         * microbenchmarks/large-map-iteration-with-additions.js: Added.
21783         (bar):
21784         (foo):
21785         * microbenchmarks/large-map-iteration-with-mutation.js: Added.
21786         (bar):
21787         (foo):
21788         * microbenchmarks/large-map-iteration.js: Added.
21789         (bar):
21790         (foo):
21791         * microbenchmarks/map-get-get-cse.js: Added.
21792         (bar):
21793         (foo):
21794         * microbenchmarks/map-has-get-cse-opportunity.js: Added.
21795         (bar):
21796         (foo):
21797         * microbenchmarks/sparse-set.js: Added.
21798         (bench):
21799         * stress/map-cse-correctness.js: Added.
21800         (assert):
21801         (testHas):
21802         (testGet):
21803         (foo):
21804         * stress/map-iteration.js: Added.
21805         (assert):
21806         (test1):
21807         (test2):
21808         (test3):
21809         (test4):
21810         (test5):
21811         (test6):
21812         (test7):
21813         (test8):
21814         (test9):
21815         (test10):
21816         (test11):
21817         (test12):
21818         (test13):
21819         (test14):
21820         (test15):
21821         (test16):
21822         (test17):
21823         (test18):
21824
21825 2016-09-06  Benjamin Poulain  <bpoulain@apple.com>
21826
21827         [JSC] Make ArithClz32 work with Cell arguments
21828         https://bugs.webkit.org/show_bug.cgi?id=161369
21829
21830         Reviewed by Geoffrey Garen.
21831
21832         * stress/arith-clz32-on-various-types.js: Added.
21833
21834 2016-09-06  Commit Queue  <commit-queue@webkit.org>
21835
21836         Unreviewed, rolling out r205504.
21837         https://bugs.webkit.org/show_bug.cgi?id=161645
21838
21839         Broke the iOS device build (Requested by ryanhaddad on
21840         #webkit).
21841
21842         Reverted changeset:
21843
21844         "Make JSMap and JSSet faster"
21845         https://bugs.webkit.org/show_bug.cgi?id=160989
21846         http://trac.webkit.org/changeset/205504
21847
21848 2016-09-06  Saam Barati  <sbarati@apple.com>
21849
21850         Make JSMap and JSSet faster
21851         https://bugs.webkit.org/show_bug.cgi?id=160989
21852
21853         Reviewed by Filip Pizlo.
21854
21855         * microbenchmarks/dense-set.js: Added.
21856         (bench):
21857         * microbenchmarks/large-map-iteration-with-additions.js: Added.
21858         (bar):
21859         (foo):
21860         * microbenchmarks/large-map-iteration-with-mutation.js: Added.
21861         (bar):
21862         (foo):
21863         * microbenchmarks/large-map-iteration.js: Added.
21864         (bar):
21865         (foo):
21866         * microbenchmarks/map-get-get-cse.js: Added.
21867         (bar):
21868         (foo):
21869         * microbenchmarks/map-has-get-cse-opportunity.js: Added.
21870         (bar):
21871         (foo):
21872         * microbenchmarks/sparse-set.js: Added.
21873         (bench):
21874         * stress/map-cse-correctness.js: Added.
21875         (assert):
21876         (testHas):
21877         (testGet):
21878         (foo):
21879         * stress/map-iteration.js: Added.
21880         (assert):
21881         (test1):
21882         (test2):
21883         (test3):
21884         (test4):
21885         (test5):
21886         (test6):
21887         (test7):
21888         (test8):
21889         (test9):
21890         (test10):
21891         (test11):
21892         (test12):
21893         (test13):
21894         (test14):
21895         (test15):
21896         (test16):
21897         (test17):
21898         (test18):
21899
21900 2016-08-31  Filip Pizlo  <fpizlo@apple.com>
21901
21902         Butterflies should be allocated in Auxiliary MarkedSpace instead of CopiedSpace and we should rewrite as much of the GC as needed to make this not a regression
21903         https://bugs.webkit.org/show_bug.cgi?id=160125
21904
21905         Reviewed by Geoffrey Garen and Keith Miller.
21906
21907         Most of the things I did properly covered by existing tests, but I found some simple cases of
21908         unshifting that had sketchy coverage.
21909
21910         * stress/array-storage-array-unshift.js: Added.
21911         * stress/contiguous-array-unshift.js: Added.
21912         * stress/double-array-unshift.js: Added.
21913         * stress/int32-array-unshift.js: Added.
21914
21915 2016-09-02  Michael Saboff  <msaboff@apple.com>
21916
21917         Unreviewed fix after importing Chakra test
21918
21919         * ChakraCore.yaml: Skipped ChakraCore/test/UnifiedRegex/crazy.js because the original
21920         test contained tab characters.  I removed the tabs before landing.  This test depended
21921         on the tab characters and now fails after they were removed.
21922         test.
21923
21924 2016-09-01  Michael Saboff  <msaboff@apple.com>
21925
21926         Import Chakra tests to JSC
21927         https://bugs.webkit.org/show_bug.cgi?id=154697
21928
21929         Reviewed by Saam Barati.
21930
21931         Added Chakra tests.  All these tests are under Chakra/test.  This is the same layout
21932         for tests in the Chakra tree.
21933
21934         Created a ChakraCore.yaml file to be used with run-jsc-stress-tests.  This file contains
21935         the tests that are run when the original Chakra runtests.py script is run.  That script
21936         is the test driver for *nix platforms and does not attempt to run all tests or all
21937         variations of tests.  The runtest.py driver consults rlexe.xml files in each test
21938         subdirectory to determine the test to run, the options to pass to the test and how to
21939         determine pass/fail of the test.  With runtests.py as the start, tests that didn't
21940         pass directly where either skipped, with a message describing why or through
21941         adjustments to the test infrastructure, as described below, where made to pass.
21942
21943         The only modification to the test infrastrucutre are:
21944
21945          1) Added simple mapping of Chakra expected exception text to JSC expected text in
21946             test/UnitTestFramework/UnitTestFramework.js.  It would make sense to also
21947             map some JSC specific exception text to more generic text for the cases where
21948             that text contains indetifier names or other source specific strings and the
21949             Chakra equivolent exception texts are generic.
21950
21951          2) Created JSC specific expected text files where it is clear that the text work
21952             as expected on JSC but the test output is different.  Typically the differences
21953             fall into three categories, different exception output, different output from
21954             toString() of a function, slight numeric differences, and test that rely on
21955             iteration order.
21956
21957          3) Stripped the CR's from the CR-LF line terminations of the files.
21958
21959         No actual test .js files were modified.
21960
21961         * ChakraCore: Added.
21962         * ChakraCore.yaml: Added.
21963         * ChakraCore/CONTRIBUTING.md: Added.
21964         * ChakraCore/LICENSE.txt: Added.
21965         * ChakraCore/README.md: Added.
21966         * ChakraCore/THIRD-PARTY-NOTICES.txt: Added.
21967         * ChakraCore/test: Added this directory and the tests included therein.
21968
21969 2016-09-01  JF Bastien  <jfbastien@apple.com>
21970
21971         GetByIdWithThis/GetByValWithThis should have ValueProfiles so that they can predict their result types
21972         https://bugs.webkit.org/show_bug.cgi?id=160922
21973
21974         Reviewed by Keith Miller.
21975
21976         Benchmark GetBy{Id,Val}WithThis in monomorphic and polymorphic uses.
21977         The value profile is used by the calc functions, which do some mild math with the result.
21978         These benchmarks get ~4% faster with value profiling.
21979
21980         * microbenchmarks/super-get-by-id-with-this-monomorphic.js: Added.
21981         (A):
21982         (A.prototype.set value):
21983         (A.prototype.get value):
21984         (B.prototype.set value):
21985         (B.prototype.get value):
21986         (B):
21987         (const.bench):
21988         * microbenchmarks/super-get-by-id-with-this-polymorphic.js: Added.
21989         (A):
21990         (A.prototype.set value):
21991         (A.prototype.get value):
21992         (B.prototype.set value):
21993         (B.prototype.get value):
21994         (B):
21995         (const.bench):
21996         * microbenchmarks/super-get-by-val-with-this-monomorphic.js: Added.
21997         (value):
21998         (A):
21999         (A.prototype.set v):
22000         (A.prototype.get v):
22001         (B.prototype.set v):
22002         (B.prototype.get v):
22003         (B):
22004         (const.bench):
22005         * microbenchmarks/super-get-by-val-with-this-polymorphic.js: Added.
22006         (value):
22007         (A):
22008         (A.prototype.set v):
22009         (A.prototype.get v):
22010         (B.prototype.set v):
22011         (B.prototype.get v):
22012         (B):
22013         (const.bench):
22014
22015 2016-09-01  Benjamin Poulain  <bpoulain@apple.com>
22016
22017         arith-abs-on-various-types.js is flaky
22018
22019         Unreviewed.
22020
22021         * stress/arith-abs-on-various-types.js:
22022         Two compilation is too small for the worst case.
22023         Math.abs() can be typed integer->number->untyped if we are very unlucky.
22024
22025 2016-09-01  Filip Pizlo  <fpizlo@apple.com>
22026
22027         ObjectAllocationSinkingPhase::insertOSRHintsForUpdate() fails to emit updated hints in some cases
22028         https://bugs.webkit.org/show_bug.cgi?id=161492
22029
22030         Reviewed by Mark Lam.
22031
22032         This bug affected function->activation references but not object->object field references,
22033         because object->object field references are !neededForMaterialization(). So, the object
22034         test always passed but the activation/function test used to always fail. It passes now.
22035
22036         * stress/materialize-activation-referenced-from-phantom-function.js: Added.
22037         (bar):
22038         (inc):
22039         (dec):
22040         (foo):
22041         (test):
22042         * stress/materialize-object-referenced-from-phantom-object.js: Added.
22043         (bar):
22044         (foo):
22045         (test):
22046
22047 2016-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
22048
22049         stress/random-53bit.js.ftl-no-cjit-no-inline-validate sometimes fails
22050         https://bugs.webkit.org/show_bug.cgi?id=161436
22051
22052         Reviewed by Filip Pizlo.
22053
22054         The test checks Math.random() correctly produces 53bit random values.
22055         The test can fail by design, but this should be fairly rare.
22056
22057         However, when introducing, we wrap the `test()` with 1e4 to ensure the FTL compilation, and this
22058         increases the failure rate. By increasing the MAX in the test, we make the failures much more rare case.
22059
22060         And we also add getRandomSeed() and setRandomSeed(seed) JSC shell helpers to dump more useful information
22061         and reproduce the situation easily.
22062
22063         * stress/random-53bit.js:
22064         (test):
22065
22066 2016-08-29  Benjamin Poulain  <bpoulain@apple.com>
22067
22068         [JSC] Improve ArithAbs with polymorphic input
22069         https://bugs.webkit.org/show_bug.cgi?id=161286
22070
22071         Reviewed by Saam Barati.
22072
22073         * stress/arith-abs-on-various-types.js: Added.
22074         New tests.
22075
22076         * stress/arith-cos-on-various-types.js:
22077         * stress/arith-fround-on-various-types.js:
22078         * stress/arith-log-on-various-types.js:
22079         * stress/arith-sin-on-various-types.js:
22080         * stress/arith-sqrt-on-various-types.js:
22081         Extend the existing tests to cover the DCE case.
22082
22083 2016-08-26  Benjamin Poulain  <benjamin@webkit.org>
22084
22085         [JSC] Implement CompareStrictEq(String, Untyped) in FTL
22086         https://bugs.webkit.org/show_bug.cgi?id=161229
22087
22088         Reviewed by Geoffrey Garen.
22089
22090         * stress/compare-strict-eq-on-various-types.js: Added.
22091
22092 2016-08-26  Yusuke Suzuki  <utatane.tea@gmail.com>
22093
22094         [ES6] newPromiseCapabilities should check the given argument is constructor
22095         https://bugs.webkit.org/show_bug.cgi?id=161226
22096
22097         Reviewed by Mark Lam.
22098
22099         The arrow function should not be a constructor. So the error should be raised.
22100
22101         * stress/new-promise-capabilities-requires-constructor.js: Added.
22102         (shouldThrow):
22103
22104 2016-08-25  Benjamin Poulain  <bpoulain@apple.com>
22105
22106         [JSC] Clean up the abstract interpreter for cos/sin/sqrt/fround/log
22107         https://bugs.webkit.org/show_bug.cgi?id=161181
22108
22109         Reviewed by Geoffrey Garen.
22110
22111         Extend the tests to constants.
22112         Add no-argument cases where needed.
22113
22114         * stress/arith-cos-on-various-types.js:
22115         * stress/arith-fround-on-various-types.js:
22116         * stress/arith-log-on-various-types.js:
22117         * stress/arith-sin-on-various-types.js:
22118         * stress/arith-sqrt-on-various-types.js:
22119
22120 2016-08-25  Yusuke Suzuki  <utatane.tea@gmail.com>
22121
22122         [DFG][FTL] Implement ES6 Generators in DFG / FTL
22123         https://bugs.webkit.org/show_bug.cgi?id=152723
22124
22125         Reviewed by Filip Pizlo.
22126
22127         * stress/generator-fib-ftl-and-array.js: Added.
22128         (fib):
22129         * stress/generator-fib-ftl-and-object.js: Added.
22130         (fib):
22131         * stress/generator-fib-ftl-and-string.js: Added.
22132         (fib):
22133         * stress/generator-fib-ftl.js: Added.
22134         (fib):
22135         * stress/generator-frame-empty.js: Added.
22136         (shouldThrow):
22137         (shouldThrow.fib):
22138         * stress/generator-reduced-save-point-put-to-scope.js: Added.
22139         (shouldBe):
22140         (gen):
22141         * stress/generator-transfer-register-beyond-mutiple-yields.js: Added.
22142         (shouldBe):
22143         (gen):
22144
22145 2016-08-25  JF Bastien  <jfbastien@apple.com>
22146
22147         TryGetById should have a ValueProfile so that it can predict its output type
22148         https://bugs.webkit.org/show_bug.cgi?id=160921
22149
22150         Reviewed by Saam Barati.
22151
22152         * microbenchmarks/try-get-by-id-basic.js: Added.
22153         (const.check):
22154         (const.bench.f.const.fooPlusBar.createBuiltin):
22155         * microbenchmarks/try-get-by-id-polymorphic.js: Added.
22156         (const.check):
22157         (fooPlusBar.createBuiltin):
22158         (bench):
22159
22160 2016-08-25  Caio Lima  <ticaiolima@gmail.com>
22161
22162         NewRegexp should not prevent inlining
22163         https://bugs.webkit.org/show_bug.cgi?id=154808
22164
22165         Reviewed by Geoffrey Garen.
22166
22167         Added test where functions with NewRegExp can be inlined right now.
22168
22169         * stress/new-regex-inline.js: Added.
22170         (assert):
22171         (testRegexpInline):
22172         (toInlineGlobal):
22173         (withRegexp):
22174         (inlineRegexpNotGlobal):
22175         (toInlineRecursive):
22176         (regexpContainsRecursive):
22177
22178 2016-08-24  Benjamin Poulain  <benjamin@webkit.org>
22179
22180         [JSC] Make FRound work with any type
22181         https://bugs.webkit.org/show_bug.cgi?id=161129
22182
22183         Reviewed by Geoffrey Garen.
22184
22185         * stress/arith-fround-on-various-types.js: Added.
22186
22187 2016-08-24  Filip Pizlo  <fpizlo@apple.com>
22188
22189         Unreviewed, roll out r204901, r204897, r204866, r204856, r204854.
22190
22191         * stress/array-storage-array-unshift.js: Removed.
22192         * stress/contiguous-array-unshift.js: Removed.
22193         * stress/double-array-unshift.js: Removed.
22194         * stress/int32-array-unshift.js: Removed.
22195
22196 2016-08-24  Skachkov Oleksandr  <gskachkov@gmail.com>
22197
22198         [ES2016] Allow assignment in for-in head in not-strict mode
22199         https://bugs.webkit.org/show_bug.cgi?id=160955
22200
22201         Reviewed by Saam Barati.
22202
22203         * stress/for-in-tests.js:
22204         (foo):
22205         (boo):
22206         (catch):
22207
22208 2016-08-23  Benjamin Poulain  <benjamin@webkit.org>
22209
22210         [JSC] Make ArithLog works with any type
22211         https://bugs.webkit.org/show_bug.cgi?id=161110
22212
22213         Reviewed by Geoffrey Garen.
22214
22215         * stress/arith-log-on-various-types.js: Added.
22216
22217 2016-08-23  Saam Barati  <sbarati@apple.com>
22218
22219         JSC should have a "microbenchmarks" directory instead of "regress" directory
22220         https://bugs.webkit.org/show_bug.cgi?id=161096
22221
22222         Rubber stamped by Mark Lam.
22223
22224         * microbenchmarks: Copied from LayoutTests/js/regress/script-tests.
22225
22226 2016-08-23  Keith Miller  <keith_miller@apple.com>
22227
22228         %TypedArray%.prototype.slice needs to check that the source and destination have not been detached.
22229         https://bugs.webkit.org/show_bug.cgi?id=161031
22230         <rdar://problem/27937019>
22231
22232         Reviewed by Geoffrey Garen.
22233
22234         * stress/typedarray-slice.js:
22235         (get let):
22236         (get try):
22237         (testSpeciesWithTransferring):
22238
22239 2016-08-22  Filip Pizlo  <fpizlo@apple.com>
22240
22241         Butterflies should be allocated in Auxiliary MarkedSpace instead of CopiedSpace and we should rewrite as much of the GC as needed to make this not a regression
22242         https://bugs.webkit.org/show_bug.cgi?id=160125
22243
22244         Reviewed by Geoffrey Garen.
22245
22246         Most of the things I did properly covered by existing tests, but I found some simple cases of
22247         unshifting that had sketchy coverage.
22248
22249         * stress/array-storage-array-unshift.js: Added.
22250         * stress/contiguous-array-unshift.js: Added.
22251         * stress/double-array-unshift.js: Added.
22252         * stress/int32-array-unshift.js: Added.
22253
22254 2016-08-23  Keith Miller  <keith_miller@apple.com>
22255
22256         Update/add new test262 tests
22257         https://bugs.webkit.org/show_bug.cgi?id=161098
22258
22259         Reviewed by Saam Barati.
22260
22261         * test262.yaml:
22262         * test262/test/annexB/language/statements/for-in/bare-initializer.js: Added.
22263         * test262/test/annexB/language/statements/for-in/const-initializer.js: Added.
22264         * test262/test/annexB/language/statements/for-in/let-initializer.js: Added.
22265         * test262/test/annexB/language/statements/for-in/nonstrict-initializer.js: Added.
22266         (a):
22267         * test262/test/annenxB/language/statements/for-in/strict-initializer.js: Added.
22268         * test262/test/annexB/language/statements/for-in/var-arraybindingpattern-initializer.js: Added.
22269         * test262/test/annexB/language/statements/for-in/var-objectbindingpattern-initializer.js: Added.
22270         * test262/test/built-ins/AsyncFunction/AsyncFunction-construct.js: Added.
22271         (AsyncFunction.async.foo):
22272         * test262/test/built-ins/AsyncFunction/AsyncFunction-is-extensible.js: Added.
22273         (AsyncFunction.async):
22274         * test262/test/built-ins/AsyncFunction/AsyncFunction-is-subclass.js: Added.
22275         (async.foo):
22276         * test262/test/built-ins/AsyncFunction/AsyncFunction-length.js: Added.
22277         (AsyncFunction.async.foo):
22278         * test262/test/built-ins/AsyncFunction/AsyncFunction-name.js: Added.
22279         (AsyncFunction.async.foo):
22280         * test262/test/built-ins/AsyncFunction/AsyncFunction-prototype.js: Added.
22281         (AsyncFunction.async.foo):
22282         * test262/test/built-ins/AsyncFunction/AsyncFunction.js: Added.
22283         (AsyncFunction.async.foo):
22284         * test262/test/built-ins/AsyncFunction/AsyncFunctionPrototype-is-extensible.js: Added.
22285         (AsyncFunction.async.foo):
22286         * test262/test/built-ins/AsyncFunction/AsyncFunctionPrototype-prototype.js: Added.
22287         (AsyncFunction.async.foo):
22288         * test262/test/built-ins/AsyncFunction/AsyncFunctionPrototype-to-string.js: Added.
22289         (AsyncFunction.async.foo):
22290         * test262/test/built-ins/AsyncFunction/instance-construct.js: Added.
22291         (async.foo):
22292         * test262/test/built-ins/AsyncFunction/instance-has-name.js: Added.
22293         (async.foo):
22294         * test262/test/built-ins/AsyncFunction/instance-length.js: Added.
22295         (async.l0):
22296         (async.l1):
22297         (async.l2):
22298         * test262/test/built-ins/AsyncFunction/instance-prototype-property.js: Added.
22299         (async.foo):
22300         * test262/test/built-ins/AsyncFunction/is-not-a-global.js: Added.
22301         * test262/test/built-ins/DataView/prototype/getFloat32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getFloat32/detached-buffer-after-integer-byteoffset.js.
22302         * test262/test/built-ins/DataView/prototype/getFloat32/detached-buffer-before-outofrange-byteoffset.js:
22303         * test262/test/built-ins/DataView/prototype/getFloat64/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getFloat64/detached-buffer-after-integer-byteoffset.js.
22304         * test262/test/built-ins/DataView/prototype/getFloat64/detached-buffer-before-outofrange-byteoffset.js:
22305         * test262/test/built-ins/DataView/prototype/getInt16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getInt16/detached-buffer-after-integer-byteoffset.js.
22306         * test262/test/built-ins/DataView/prototype/getInt16/detached-buffer-before-outofrange-byteoffset.js:
22307         * test262/test/built-ins/DataView/prototype/getInt32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getInt32/detached-buffer-after-integer-byteoffset.js.
22308         * test262/test/built-ins/DataView/prototype/getInt32/detached-buffer-before-outofrange-byteoffset.js:
22309         * test262/test/built-ins/DataView/prototype/getInt8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getInt8/detached-buffer-after-integer-byteoffset.js.
22310         * test262/test/built-ins/DataView/prototype/getInt8/detached-buffer-before-outofrange-byteoffset.js:
22311         * test262/test/built-ins/DataView/prototype/getUint16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getUint16/detached-buffer-after-integer-byteoffset.js.
22312         * test262/test/built-ins/DataView/prototype/getUint16/detached-buffer-before-outofrange-byteoffset.js:
22313         * test262/test/built-ins/DataView/prototype/getUint32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getUint32/detached-buffer-after-integer-byteoffset.js.
22314         * test262/test/built-ins/DataView/prototype/getUint32/detached-buffer-before-outofrange-byteoffset.js:
22315         * test262/test/built-ins/DataView/prototype/getUint8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getUint8/detached-buffer-after-integer-byteoffset.js.
22316         * test262/test/built-ins/DataView/prototype/getUint8/detached-buffer-before-outofrange-byteoffset.js:
22317         * test262/test/built-ins/DataView/prototype/setFloat32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setFloat32/detached-buffer-after-integer-byteoffset.js.
22318         * test262/test/built-ins/DataView/prototype/setFloat32/detached-buffer-before-outofrange-byteoffset.js:
22319         * test262/test/built-ins/DataView/prototype/setFloat32/index-check-before-value-conversion.js:
22320         * test262/test/built-ins/DataView/prototype/setFloat32/range-check-after-value-conversion.js:
22321         * test262/test/built-ins/DataView/prototype/setFloat64/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setFloat64/detached-buffer-after-integer-byteoffset.js.
22322         * test262/test/built-ins/DataView/prototype/setFloat64/detached-buffer-before-outofrange-byteoffset.js:
22323         * test262/test/built-ins/DataView/prototype/setFloat64/index-check-before-value-conversion.js:
22324         * test262/test/built-ins/DataView/prototype/setFloat64/range-check-after-value-conversion.js:
22325         * test262/test/built-ins/DataView/prototype/setInt16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setInt16/detached-buffer-after-integer-byteoffset.js.
22326         * test262/test/built-ins/DataView/prototype/setInt16/detached-buffer-before-outofrange-byteoffset.js:
22327         * test262/test/built-ins/DataView/prototype/setInt16/index-check-before-value-conversion.js:
22328         * test262/test/built-ins/DataView/prototype/setInt16/range-check-after-value-conversion.js:
22329         * test262/test/built-ins/DataView/prototype/setInt32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setInt32/detached-buffer-after-integer-byteoffset.js.
22330         * test262/test/built-ins/DataView/prototype/setInt32/detached-buffer-before-outofrange-byteoffset.js:
22331         * test262/test/built-ins/DataView/prototype/setInt32/index-check-before-value-conversion.js:
22332         * test262/test/built-ins/DataView/prototype/setInt32/range-check-after-value-conversion.js:
22333         * test262/test/built-ins/DataView/prototype/setInt8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setInt8/detached-buffer-after-integer-byteoffset.js.
22334         * test262/test/built-ins/DataView/prototype/setInt8/detached-buffer-before-outofrange-byteoffset.js:
22335         * test262/test/built-ins/DataView/prototype/setInt8/index-check-before-value-conversion.js:
22336         * test262/test/built-ins/DataView/prototype/setInt8/range-check-after-value-conversion.js:
22337         * test262/test/built-ins/DataView/prototype/setUint16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setUint16/detached-buffer-after-integer-byteoffset.js.
22338         * test262/test/built-ins/DataView/prototype/setUint16/detached-buffer-before-outofrange-byteoffset.js:
22339         * test262/test/built-ins/DataView/prototype/setUint16/index-check-before-value-conversion.js:
22340         * test262/test/built-ins/DataView/prototype/setUint16/range-check-after-value-conversion.js:
22341         * test262/test/built-ins/DataView/prototype/setUint32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setUint32/detached-buffer-after-integer-byteoffset.js.
22342         * test262/test/built-ins/DataView/prototype/setUint32/detached-buffer-before-outofrange-byteoffset.js:
22343         * test262/test/built-ins/DataView/prototype/setUint32/index-check-before-value-conversion.js:
22344         * test262/test/built-ins/DataView/prototype/setUint32/range-check-after-value-conversion.js:
22345         * test262/test/built-ins/DataView/prototype/setUint8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setUint8/detached-buffer-after-integer-byteoffset.js.
22346         * test262/test/built-ins/DataView/prototype/setUint8/detached-buffer-before-outofrange-byteoffset.js:
22347         * test262/test/built-ins/DataView/prototype/setUint8/index-check-before-value-conversion.js:
22348         * test262/test/built-ins/DataView/prototype/setUint8/range-check-after-value-conversion.js:
22349         * test262/test/built-ins/Function/prototype/bind/instance-construct-newtarget-boundtarget-bound.js: Added.
22350         (A):
22351         * test262/test/built-ins/Function/prototype/bind/instance-construct-newtarget-boundtarget.js: Added.
22352         (A):
22353         * test262/test/built-ins/Function/prototype/bind/instance-construct-newtarget-self-new.js: Added.
22354         (A):
22355         * test262/test/built-ins/Function/prototype/bind/instance-construct-newtarget-self-reflect.js: Added.
22356         (A):
22357         * test262/test/built-ins/Function/prototype/toString/AsyncFunction.js: Added.
22358         (async.f):
22359         * test262/test/built-ins/Function/prototype/toString/async-function-declaration.js: Added.
22360         (async.f):
22361         * test262/test/built-ins/Function/prototype/toString/async-function-expression.js: Added.
22362         (let.f.async.f):
22363         * test262/test/built-ins/Function/prototype/toString/async-method.js: Added.
22364         (let.f.async.f):
22365         (let.g.async.string_appeared_here):
22366         * test262/test/built-ins/JSON/parse/reviver-array-define-prop-err.js: Added.
22367         (defineProperty):
22368         * test262/test/built-ins/JSON/parse/reviver-array-delete-err.js: Added.
22369         (deleteProperty):
22370         * test262/test/built-ins/JSON/parse/reviver-array-length-coerce-err.js: Added.
22371         (uncoercible.valueOf):
22372         (get if):
22373         * test262/test/built-ins/JSON/parse/reviver-array-length-get-err.js: Added.
22374         (get if):
22375         * test262/test/built-ins/JSON/parse/reviver-call-err.js: Added.
22376         * test262/test/built-ins/JSON/parse/reviver-get-name-err.js: Added.
22377         (thrower):
22378         * test262/test/built-ins/JSON/parse/reviver-object-define-prop-err.js: Added.
22379         (defineProperty):
22380         * test262/test/built-ins/JSON/parse/reviver-object-delete-err.js: Added.
22381         (deleteProperty):
22382         * test262/test/built-ins/JSON/parse/reviver-object-own-keys-err.js: Added.
22383         (ownKeys):
22384         * test262/test/built-ins/Number/prototype/toExponential/infinity.js: Added.
22385         * test262/test/built-ins/Number/prototype/toExponential/nan.js: Added.
22386         * test262/test/built-ins/Number/prototype/toExponential/prop-desc.js: Added.
22387         * test262/test/built-ins/Number/prototype/toExponential/return-abrupt-tointeger-fractiondigits-symbol.js: Added.
22388         * test262/test/built-ins/Number/prototype/toExponential/return-abrupt-tointeger-fractiondigits.js: Added.
22389         (fd1.valueOf):
22390         (fd2.toString):
22391         * test262/test/built-ins/Number/prototype/toExponential/return-values.js: Added.
22392         * test262/test/built-ins/Number/prototype/toExponential/this-is-0-fractiondigits-is-0.js: Added.
22393         * test262/test/built-ins/Number/prototype/toExponential/this-is-0-fractiondigits-is-not-0.js: Added.
22394         * test262/test/built-ins/Number/prototype/toExponential/this-type-not-number-or-number-object.js: Added.
22395         * test262/test/built-ins/Number/prototype/toExponential/tointeger-fractiondigits.js: Added.
22396         * test262/test/built-ins/Number/prototype/toExponential/undefined-fractiondigits.js: Added.
22397         * test262/test/built-ins/Object/getOwnPropertyDescriptors/duplicate-keys.js:
22398         * test262/test/built-ins/Object/getOwnPropertyDescriptors/proxy-undefined-descriptor.js: Added.
22399         (badProxyHandlers.allowProxyTraps.getOwnPropertyDescriptor):
22400         (badProxyHandlers.allowProxyTraps.ownKeys):
22401         * test262/test/built-ins/Proxy/setPrototypeOf/boolean-trap-result-extensible-target.js: Removed.
22402         (setPrototypeOf): Deleted.
22403         * test262/test/built-ins/Proxy/setPrototypeOf/internals-call-order.js: Added.
22404         (target.new.Proxy.Object.create.isExtensible):
22405         (target.new.Proxy.Object.create.getPrototypeOf):
22406         (target.new.Proxy.Object.create):
22407         (setPrototypeOf):
22408         * test262/test/built-ins/Proxy/setPrototypeOf/not-extensible-target-not-same-target-prototype.js:
22409         (setPrototypeOf):
22410         * test262/test/built-ins/Proxy/setPrototypeOf/not-extensible-target-same-target-prototype.js:
22411         (setPrototypeOf):
22412         * test262/test/built-ins/Proxy/setPrototypeOf/not-extensible-trap-is-false-return-false.js: Removed.
22413         (setPrototypeOf): Deleted.
22414         * test262/test/built-ins/Proxy/setPrototypeOf/return-abrupt-from-get-trap.js: Added.
22415         * test262/test/built-ins/Proxy/setPrototypeOf/return-abrupt-from-isextensible-target.js: Added.
22416         (isExtensible):
22417         (setPrototypeOf):
22418         * test262/test/built-ins/Proxy/setPrototypeOf/return-abrupt-from-target-getprototypeof.js: Added.
22419         (getPrototypeOf):
22420         (setPrototypeOf):
22421         * test262/test/built-ins/Proxy/setPrototypeOf/return-abrupt-from-trap.js: Renamed from JSTests/test262/test/built-ins/Proxy/setPrototypeOf/return-is-abrupt.js.
22422         (setPrototypeOf):
22423         * test262/test/built-ins/Proxy/setPrototypeOf/return-is-abrupt.js:
22424         (setPrototypeOf): Deleted.
22425         * test262/test/built-ins/Proxy/setPrototypeOf/toboolean-trap-result-false.js: Added.
22426         (isExtensible):
22427         (setPrototypeOf):
22428         * test262/test/built-ins/Proxy/setPrototypeOf/toboolean-trap-result-true-target-is-extensible.js: Added.
22429         (isExtensible):
22430         (getPrototypeOf):
22431         (setPrototypeOf):
22432         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable.js:
22433         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-undefined-or-null.js: Added.
22434         (setPrototypeOf):
22435         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-undefined.js: Removed.
22436         * test262/test/built-ins/RegExp/lastIndex.js: Added.
22437         * test262/test/built-ins/RegExp/prototype/global/15.10.7.2-1.js: Removed.
22438         * test262/test/built-ins/RegExp/prototype/global/this-val-invalid-obj.js: Added.
22439         (get Object):
22440         * test262/test/built-ins/RegExp/prototype/global/this-val-non-obj.js: Added.
22441         (get Object):
22442         * test262/test/built-ins/RegExp/prototype/global/this-val-regexp-prototype.js: Added.
22443         * test262/test/built-ins/RegExp/prototype/ignoreCase/15.10.7.3-1.js: Removed.
22444         * test262/test/built-ins/RegExp/prototype/ignoreCase/this-val-invalid-obj.js: Added.
22445         (get Object):
22446         * test262/test/built-ins/RegExp/prototype/ignoreCase/this-val-non-obj.js: Added.
22447         (get Object):
22448         * test262/test/built-ins/RegExp/prototype/ignoreCase/this-val-regexp-prototype.js: Added.
22449         * test262/test/built-ins/RegExp/prototype/lastIndex/15.10.7.5-1.js: Removed.
22450         * test262/test/built-ins/RegExp/prototype/lastIndex/15.10.7.5-2.js: Removed.
22451         * test262/test/built-ins/RegExp/prototype/lastIndex/S15.10.7.5_A8.js: Removed.
22452         (__re.hasOwnProperty): Deleted.
22453         (__re.propertyIsEnumerable): Deleted.
22454         (count.0): Deleted.
22455         * test262/test/built-ins/RegExp/prototype/lastIndex/S15.10.7.5_A9.js: Removed.
22456         (__re.hasOwnProperty): Deleted.
22457         (catch): Deleted.
22458         * test262/test/built-ins/RegExp/prototype/multiline/15.10.7.4-1.js: Removed.
22459         * test262/test/built-ins/RegExp/prototype/multiline/this-val-invalid-obj.js: Added.
22460         (get Object):
22461         * test262/test/built-ins/RegExp/prototype/multiline/this-val-non-obj.js: Added.
22462         (get Object):
22463         * test262/test/built-ins/RegExp/prototype/multiline/this-val-regexp-prototype.js: Added.
22464         * test262/test/built-ins/RegExp/prototype/no-regexp-matcher.js: Added.
22465         * test262/test/built-ins/RegExp/prototype/source/15.10.7.1-1.js: Removed.
22466         * test262/test/built-ins/RegExp/prototype/source/this-val-invalid-obj.js: Added.
22467         (get Object):
22468         * test262/test/built-ins/RegExp/prototype/source/this-val-non-obj.js: Added.
22469         (get Object):
22470         * test262/test/built-ins/RegExp/prototype/source/this-val-regexp-prototype.js: Added.
22471         * test262/test/built-ins/RegExp/prototype/source/value-empty.js: Added.
22472         * test262/test/built-ins/RegExp/prototype/source/value-line-terminator.js: Added.
22473         * test262/test/built-ins/RegExp/prototype/source/value-u.js: Added.
22474         * test262/test/built-ins/RegExp/prototype/source/value.js: Added.
22475         * test262/test/built-ins/RegExp/prototype/sticky/this-val-invalid-obj.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/sticky/this-invalid-obj.js.
22476         * test262/test/built-ins/RegExp/prototype/sticky/this-val-non-obj.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/sticky/this-non-obj.js.
22477         * test262/test/built-ins/RegExp/prototype/sticky/this-val-regexp-prototype.js: Added.
22478         * test262/test/built-ins/RegExp/prototype/sticky/this-val-regexp.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/sticky/this-regexp.js.
22479         * test262/test/built-ins/RegExp/prototype/unicode/this-val-invalid-obj.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/unicode/this-invald-obj.js.
22480         * test262/test/built-ins/RegExp/prototype/unicode/this-val-non-obj.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/unicode/this-non-obj.js.
22481         * test262/test/built-ins/RegExp/prototype/unicode/this-val-regexp-prototype.js: Added.
22482         * test262/test/built-ins/RegExp/prototype/unicode/this-val-regexp.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/unicode/this-regexp.js.
22483         * test262/test/built-ins/String/numeric-properties.js: Added.
22484         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/date-is-infinity-throws.js: Added.
22485         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/date-is-nan-throws.js: Added.
22486         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/formatToParts.js: Added.
22487         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/length.js: Added.
22488         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/main.js: Added.
22489         (reduce):
22490         (compareFTPtoFormat):
22491         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/name.js: Added.
22492         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/return-abrupt-tonumber-date.js: Added.
22493         (obj1.valueOf):
22494         (obj2.toString):
22495         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/this-has-not-internal-throws.js: Added.
22496         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/this-is-not-object-throws.js: Added.
22497         * test262/test/intl402/NumberFormat/prototype/formatToParts/formatToParts.js: Added.
22498         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js: Added.
22499         * test262/test/intl402/NumberFormat/prototype/formatToParts/main.js: Added.
22500         (reduce):
22501         (compareFTPtoFormat):
22502         * test262/test/intl402/NumberFormat/prototype/formatToParts/name.js: Added.
22503         * test262/test/intl402/NumberFormat/prototype/formatToParts/return-abrupt-tonumber.js: Added.
22504         (obj1.valueOf):
22505         (obj2.toString):
22506         * test262/test/intl402/NumberFormat/prototype/formatToParts/this-has-not-internal-throws.js: Added.
22507         * test262/test/intl402/NumberFormat/prototype/formatToParts/this-is-not-object-throws.js: Added.
22508         * test262/test/language/arguments-object/10.6-10-c-ii-2-s.js:
22509         (foo): Deleted.
22510         * test262/test/language/arguments-object/unmapped/via-params-dflt.js: Added.
22511         (dflt):
22512         * test262/test/language/arguments-object/unmapped/via-params-dstr.js: Added.
22513         (dstr):
22514         * test262/test/language/arguments-object/unmapped/via-params-rest.js: Added.
22515         (rest):
22516         * test262/test/language/arguments-object/unmapped/via-strict.js: Renamed from JSTests/test262/test/language/arguments-object/10.6-10-c-ii-2-s.js.
22517         (foo):
22518         * test262/test/language/block-scope/syntax/redeclaration-global/allowed-to-redeclare-function-declaration-with-function-declaration.js:
22519         (f): Deleted.
22520         * test262/test/language/eval-code/direct/super-call-arrow.js: Added.
22521         (catch):
22522         * test262/test/language/eval-code/direct/super-call-fn.js: Added.
22523         (f):
22524         * test262/test/language/eval-code/direct/super-call.js: Added.
22525         (catch):
22526         * test262/test/language/eval-code/direct/super-prop-arrow.js: Added.
22527         (catch):
22528         * test262/test/language/eval-code/direct/super-prop-method.js: Added.
22529         (o.method):
22530         * test262/test/language/eval-code/direct/super-prop.js: Added.
22531         (catch):
22532         * test262/test/language/eval-code/indirect/super-call.js: Added.
22533         (catch):
22534         (try.m):
22535         * test262/test/language/eval-code/indirect/super-prop.js: Added.
22536         (catch):
22537         (try.m):
22538         * test262/test/language/expressions/arrow-function/params-trailing-comma-length.js: Added.
22539         (assert.sameValue):
22540         * test262/test/language/expressions/arrow-function/params-trailing-comma.js: Added.
22541         * test262/test/language/expressions/async-arrow-function/arrow-returns-promise.js: Added.
22542         (p.then):
22543         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-NSPL-with-USD.js: Added.
22544         (async):
22545         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-arguments-in-formal-parameters.js: Added.
22546         (async):
22547         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-await-in-formals-default.js: Added.
22548         (async):
22549         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-await-in-formals.js: Added.
22550         (async):
22551         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-body-contains-super-call.js: Added.
22552         (async):
22553         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-body-contains-super-property.js: Added.
22554         (async):
22555         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-duplicate-parameters.js: Added.
22556         (async):
22557         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-eval-in-formal-parameters.js: Added.
22558         (async):
22559         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-formals-body-duplicate.js: Added.
22560         (async):
22561         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-formals-contains-super-call.js: Added.
22562         (async.foo.super):
22563         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-formals-contains-super-property.js: Added.
22564         (async):
22565         * test262/test/language/expressions/async-function/early-errors-expression-NSPL-with-USD.js: Added.
22566         (async):
22567         * test262/test/language/expressions/async-function/early-errors-expression-binding-identifier-arguments.js: Added.
22568         (async.arguments):
22569         * test262/test/language/expressions/async-function/early-errors-expression-binding-identifier-eval.js: Added.
22570         (async.eval):
22571         * test262/test/language/expressions/async-function/early-errors-expression-body-contains-super-call.js: Added.
22572         (async.foo):
22573         * test262/test/language/expressions/async-function/early-errors-expression-body-contains-super-property.js: Added.
22574         (async.foo):
22575         * test262/test/language/expressions/async-function/early-errors-expression-eval-in-formal-parameters.js: Added.
22576         (async.foo):
22577         * test262/test/language/expressions/async-function/early-errors-expression-formals-body-duplicate.js: Added.
22578         (async.foo):
22579         * test262/test/language/expressions/async-function/early-errors-expression-formals-contains-super-call.js: Added.
22580         (async.foo):
22581         * test262/test/language/expressions/async-function/early-errors-expression-formals-contains-super-property.js: Added.
22582         (async.foo):
22583         * test262/test/language/expressions/async-function/early-errors-expression-not-simple-assignment-target.js: Added.
22584         (async.foo):
22585         * test262/test/language/expressions/async-function/expression-returns-promise.js: Added.
22586         (p.async):
22587         * test262/test/language/expressions/async-function/syntax-expression-is-PrimaryExpression.js: Added.
22588         (async.foo):
22589         * test262/test/language/expressions/await/await-BindingIdentifier-in-global.js: Added.
22590         (async.await):
22591         * test262/test/language/expressions/await/await-BindingIdentifier-nested.js: Added.
22592         (async.foo.await):
22593         (async.foo):
22594         * test262/test/language/expressions/await/await-awaits-thenable-not-callable.js: Added.
22595         (async.foo):
22596         * test262/test/language/expressions/await/await-awaits-thenables-that-throw.js: Added.
22597         (thenable.then):
22598         (async.foo):
22599         * test262/test/language/expressions/await/await-awaits-thenables.js: Added.
22600         (thenable.then):
22601         (async.foo):
22602         * test262/test/language/expressions/await/await-in-function.js: Added.
22603         (foo):
22604         * test262/test/language/expressions/await/await-in-generator.js: Added.
22605         (foo):
22606         * test262/test/language/expressions/await/await-in-global.js: Added.
22607         * test262/test/language/expressions/await/await-in-nested-function.js: Added.
22608         (async.foo.bar):
22609         (async.foo):
22610         * test262/test/language/expressions/await/await-in-nested-generator.js: Added.
22611         (async.foo.bar):
22612         (async.foo):
22613         * test262/test/language/expressions/await/await-throws-rejections.js: Added.
22614         (async.foo):
22615         * test262/test/language/expressions/await/early-errors-await-not-simple-assignment-target.js: Added.
22616         (async.foo):
22617         * test262/test/language/expressions/await/no-operand.js: Added.
22618         (async.foo):
22619         * test262/test/language/expressions/await/syntax-await-has-UnaryExpression-with-MultiplicativeExpression.js: Added.
22620         (async.foo):
22621         * test262/test/language/expressions/await/syntax-await-has-UnaryExpression.js: Added.
22622         (async.foo):
22623         * test262/test/language/expressions/call/trailing-comma.js: Added.
22624         (foo):
22625         * test262/test/language/expressions/function/arguments-with-arguments-fn.js: Added.
22626         (f):
22627         * test262/test/language/expressions/function/arguments-with-arguments-lex.js: Added.
22628         (f):
22629         * test262/test/language/expressions/function/params-trailing-comma-arguments.js: Added.
22630         (f1):
22631         (f2):
22632         * test262/test/language/expressions/function/params-trailing-comma-length.js: Added.
22633         (assert.sameValue):
22634         * test262/test/language/expressions/function/params-trailing-comma.js: Added.
22635         * test262/test/language/expressions/generators/arguments-with-arguments-fn.js: Added.
22636         (g):
22637         * test262/test/language/expressions/generators/arguments-with-arguments-lex.js: Added.
22638         (g):
22639         * test262/test/language/expressions/generators/params-trailing-comma-arguments.js: Added.
22640         (f1):
22641         (f2):
22642         * test262/test/language/expressions/generators/params-trailing-comma-length.js: Added.
22643         (assert.sameValue):
22644         * test262/test/language/expressions/generators/params-trailing-comma.js: Added.
22645         * test262/test/language/expressions/object/computed-property-evaluation-order.js: Added.
22646         * test262/test/language/expressions/object/method-definition/async-super-call-body.js: Added.
22647         (sup.method):
22648         (child.async.method):
22649         * test262/test/language/expressions/object/method-definition/async-super-call-param.js: Added.
22650         (sup.method):
22651         (child.async.method.x.super.method):
22652         * test262/test/language/expressions/object/method-definition/early-errors-object-method-NSPL-with-USD.js: Added.
22653         (foo):
22654         * test262/test/language/expressions/object/method-definition/early-errors-object-method-arguments-in-formal-parameters.js: Added.
22655         (async.foo):
22656         * test262/test/language/expressions/object/method-definition/early-errors-object-method-await-in-formals-default.js: Added.
22657         (async.foo):
22658         * test262/test/language/expressions/object/method-definition/early-errors-object-method-await-in-formals.js: Added.
22659         (async.foo):
22660         * test262/test/language/expressions/object/method-definition/early-errors-object-method-body-contains-super-call.js: Added.
22661         (async.foo):
22662         * test262/test/language/expressions/object/method-definition/early-errors-object-method-duplicate-parameters.js: Added.
22663         (async.foo):
22664         * test262/test/language/expressions/object/method-definition/early-errors-object-method-eval-in-formal-parameters.js: Added.
22665         (async.foo):
22666         * test262/test/language/expressions/object/method-definition/early-errors-object-method-formals-body-duplicate.js: Added.
22667         (async.foo):
22668         * test262/test/language/expressions/object/method-definition/early-errors-object-method-formals-contains-super-call.js: Added.
22669         (async.foo.foo.super):
22670         * test262/test/language/expressions/object/method-definition/object-method-returns-promise.js: Added.
22671         (obj.async.method):
22672         * test262/test/language/expressions/object/method-definition/params-trailing-comma-arguments.js: Added.
22673         (obj.f1):
22674         (obj.f2):
22675         * test262/test/language/expressions/object/method-definition/params-trailing-comma-length.js: Added.
22676         (obj.one):
22677         (obj.two):
22678         * test262/test/language/expressions/object/method-definition/params-trailing-comma-rest.js: Added.
22679         (m):
22680         * test262/test/language/expressions/object/method-definition/params-trailing-comma.js: Added.
22681         (one):
22682         (two):
22683         * test262/test/language/global-code/decl-func-dup.js: Renamed from JSTests/test262/test/language/block-scope/syntax/redeclaration-global/allowed-to-redeclare-function-declaration-with-function-declaration.js.
22684         (f):
22685         * test262/test/language/global-code/decl-func.js: Added.
22686         (brandNew):
22687         * test262/test/language/global-code/decl-lex-configurable-global.js: Added.
22688         * test262/test/language/global-code/decl-lex-deletion.js: Added.
22689         (test262class):
22690         * test262/test/language/global-code/decl-lex-restricted-global.js: Added.
22691         * test262/test/language/global-code/decl-lex.js: Added.
22692         (test262class):
22693         * test262/test/language/global-code/decl-var.js: Added.
22694         * test262/test/language/global-code/return.js: Added.
22695         * test262/test/language/global-code/script-decl-func-dups.js: Added.
22696         * test262/test/language/global-code/script-decl-func-err-non-configurable.js: Added.
22697         * test262/test/language/global-code/script-decl-func-err-non-extensible.js: Added.
22698         * test262/test/language/global-code/script-decl-func.js: Added.
22699         * test262/test/language/global-code/script-decl-lex-deletion.js: Added.
22700         * test262/test/language/global-code/script-decl-lex-lex.js: Added.
22701         (test262Class):
22702         * test262/test/language/global-code/script-decl-lex-restricted-global.js: Added.
22703         * test262/test/language/global-code/script-decl-lex-var.js: Added.
22704         (test262Fn):
22705         * test262/test/language/global-code/script-decl-lex.js: Added.
22706         * test262/test/language/global-code/script-decl-var-collision.js: Added.
22707         (test262Class):
22708         * test262/test/language/global-code/script-decl-var-err.js: Added.
22709         * test262/test/language/global-code/script-decl-var.js: Added.
22710         * test262/test/language/global-code/super-call-arrow.js: Added.
22711         * test262/test/language/global-code/super-call.js: Added.
22712         * test262/test/language/global-code/super-prop-arrow.js: Added.
22713         * test262/test/language/global-code/super-prop.js: Added.
22714         * test262/test/language/global-code/yield-non-strict.js: Added.
22715         (catch):
22716         * test262/test/language/global-code/yield-strict.js: Added.
22717         * test262/test/language/literals/regexp/lastIndex.js: Added.
22718         * test262/test/language/literals/regexp/u-unicode-esc-bounds.js:
22719         * test262/test/language/literals/regexp/y-assertion-start.js: Added.
22720         * test262/test/language/module-code/instn-star-err-not-found-faulty_FIXTURE.js:
22721         * test262/test/language/module-code/instn-star-err-not-found.js:
22722         * test262/test/language/module-code/namespace/internals/get-own-property-str-found-init.js:
22723         * test262/test/language/module-code/parse-err-return.js: Added.
22724         * test262/test/language/module-code/parse-err-yield.js: Added.
22725         * test262/test/language/rest-parameters/params-trailing-comma-rest.js: Added.
22726         * test262/test/language/statements/async-function/declaration-returns-promise.js: Added.
22727         (async.foo):
22728         * test262/test/language/statements/async-function/early-errors-declaration-NSPL-with-USD.js: Added.
22729         (async.foo):
22730         * test262/test/language/statements/async-function/early-errors-declaration-arguments-in-formal-parameters.js: Added.
22731         (async.foo):
22732         * test262/test/language/statements/async-function/early-errors-declaration-await-in-formals-default.js: Added.
22733         (async.foo):
22734         * test262/test/language/statements/async-function/early-errors-declaration-await-in-formals.js: Added.
22735         (async.foo):
22736         * test262/test/language/statements/async-function/early-errors-declaration-binding-identifier-arguments.js: Added.
22737         (async.arguments):
22738         * test262/test/language/statements/async-function/early-errors-declaration-binding-identifier-eval.js: Added.
22739         (async.eval):
22740         * test262/test/language/statements/async-function/early-errors-declaration-body-contains-super-call.js: Added.
22741         (async.foo):
22742         * test262/test/language/statements/async-function/early-errors-declaration-body-contains-super-property.js: Added.
22743         (async.foo):
22744         * test262/test/language/statements/async-function/early-errors-declaration-duplicate-parameters.js: Added.
22745         (async.foo):
22746         * test262/test/language/statements/async-function/early-errors-declaration-eval-in-formal-parameters.js: Added.
22747         (async.foo):
22748         * test262/test/language/statements/async-function/early-errors-declaration-formals-body-duplicate.js: Added.
22749         (async.foo):
22750         * test262/test/language/statements/async-function/early-errors-declaration-formals-contains-super-call.js: Added.
22751         (async.foo):
22752         * test262/test/language/statements/async-function/early-errors-declaration-formals-contains-super-property.js: Added.
22753         (async.foo):
22754         * test262/test/language/statements/async-function/early-errors-no-async-generator.js: Added.
22755         (async.foo):
22756         * test262/test/language/statements/async-function/evaluation-body-that-returns-after-await.js: Added.
22757         (async.foo):
22758         (foo.then):
22759         * test262/test/language/statements/async-function/evaluation-body-that-returns.js: Added.
22760         (async.foo):
22761         (foo.then):
22762         * test262/test/language/statements/async-function/evaluation-body-that-throws-after-await.js: Added.
22763         (async.foo):
22764         (foo.then):
22765         * test262/test/language/statements/async-function/evaluation-body-that-throws.js: Added.
22766         (async.foo):
22767         (foo.then):
22768         * test262/test/language/statements/async-function/evaluation-body.js: Added.
22769         (async.foo):
22770         * test262/test/language/statements/async-function/evaluation-default-that-throws.js: Added.
22771         (async.foo):
22772         (foo.then):
22773         * test262/test/language/statements/async-function/evaluation-mapped-arguments.js: Added.
22774         (async.foo):
22775         * test262/test/language/statements/async-function/evaluation-this-value-global.js: Added.
22776         (async.foo):
22777         * test262/test/language/statements/async-function/evaluation-this-value-passed.js: Added.
22778         (async.foo):
22779         * test262/test/language/statements/async-function/evaluation-unmapped-arguments.js: Added.
22780         (async.foo):
22781         * test262/test/language/statements/async-function/syntax-declaration-line-terminators-allowed.js: Added.
22782         (async.foo):
22783         * test262/test/language/statements/async-function/syntax-declaration-no-line-terminator.js: Added.
22784         (async.foo):
22785         * test262/test/language/statements/async-function/syntax-declaration.js: Added.
22786         (async.foo):
22787         (foo.then):
22788         * test262/test/language/statements/class/definition/class-method-returns-promise.js: Added.
22789         (Foo.prototype.async.method):
22790         (Foo):
22791         * test262/test/language/statements/class/definition/early-errors-class-method-NSPL-with-USD.js: Added.
22792         (Foo.prototype.async.bar):
22793         (Foo):
22794         * test262/test/language/statements/class/definition/early-errors-class-method-arguments-in-formal-parameters.js: Added.
22795         (Foo.prototype.async.foo):
22796         (Foo):
22797         * test262/test/language/statements/class/definition/early-errors-class-method-await-in-formals-default.js: Added.
22798         (Foo.prototype.async.foo):
22799         (Foo):
22800         * test262/test/language/statements/class/definition/early-errors-class-method-await-in-formals.js: Added.
22801         (Foo.prototype.async.foo):
22802         (Foo):
22803         * test262/test/language/statements/class/definition/early-errors-class-method-body-contains-super-call.js: Added.
22804         (Foo.prototype.async.foo):
22805         (Foo):
22806         * test262/test/language/statements/class/definition/early-errors-class-method-duplicate-parameters.js: Added.
22807         (Foo.prototype.async.foo):
22808         (Foo):
22809         * test262/test/language/statements/class/definition/early-errors-class-method-eval-in-formal-parameters.js: Added.
22810         (Foo.prototype.async.foo):
22811         (Foo):
22812         * test262/test/language/statements/class/definition/early-errors-class-method-formals-body-duplicate.js: Added.
22813         (Foo.async.foo):
22814         (Foo):
22815         * test262/test/language/statements/class/definition/early-errors-class-method-formals-contains-super-call.js: Added.
22816         (Foo.prototype.async.foo):
22817         (Foo):
22818         * test262/test/language/statements/class/definition/methods-async-super-call-body.js: Added.
22819         (A.prototype.async.method):
22820         (A):
22821         (B.prototype.async.method):
22822         (B):
22823         * test262/test/language/statements/class/definition/methods-async-super-call-param.js: Added.
22824         (A.prototype.async.method):
22825         (A):
22826         (B.prototype.async.method):
22827         (B):
22828         * test262/test/language/statements/class/definition/params-trailing-comma-arguments.js: Added.
22829         (C.prototype.f1):
22830         (C.prototype.f2):
22831         (C):
22832         * test262/test/language/statements/class/definition/params-trailing-comma-length.js: Added.
22833         (C.prototype.one):
22834         (C.prototype.two):
22835         (C):
22836         * test262/test/language/statements/class/definition/params-trailing-comma-rest.js: Added.
22837         (C.prototype.m):
22838         (C):
22839         * test262/test/language/statements/class/definition/params-trailing-comma.js: Added.
22840         (C.prototype.one):
22841         (C.prototype.two):
22842         (C):
22843         * test262/test/language/statements/function/arguments-with-arguments-fn.js: Added.
22844         (f):
22845         * test262/test/language/statements/function/arguments-with-arguments-lex.js: Added.
22846         (f):
22847         * test262/test/language/statements/function/params-trailing-comma-arguments.js: Added.
22848         (f1):
22849         (f2):
22850         * test262/test/language/statements/function/params-trailing-comma-length.js: Added.
22851         (one):
22852         (two):
22853         * test262/test/language/statements/function/params-trailing-comma.js: Added.
22854         (one):
22855         (two):
22856         * test262/test/language/statements/generators/arguments-with-arguments-fn.js: Added.
22857         (g):
22858         * test262/test/language/statements/generators/arguments-with-arguments-lex.js: Added.
22859         (g):
22860         * test262/test/language/statements/generators/params-trailing-comma-length.js: Added.
22861         (one):
22862         (two):
22863         * test262/test/language/statements/generators/params-trailing-comma.js: Added.
22864         (one):
22865         (two):
22866         * test262/test262-Revision.txt:
22867
22868 2016-08-23  Benjamin Poulain  <bpoulain@apple.com>
22869
22870         [JSC] Make Math.cos() and Math.sin() work with any argument type
22871         https://bugs.webkit.org/show_bug.cgi?id=161069
22872
22873         Reviewed by Geoffrey Garen.
22874
22875         * stress/arith-cos-on-various-types.js: Added.
22876         * stress/arith-sin-on-various-types.js: Added.
22877
22878 2016-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
22879
22880         [ES6] Module namespace object's Symbol.iterator method should only accept module namespace objects
22881         https://bugs.webkit.org/show_bug.cgi?id=161097
22882
22883         Reviewed by Keith Miller.
22884
22885         * test262.yaml:
22886
22887 2016-08-22  Yusuke Suzuki  <utatane.tea@gmail.com>
22888
22889         [ES6] Modules' `export default function/class` should be declaration
22890         https://bugs.webkit.org/show_bug.cgi?id=160499
22891
22892         Reviewed by Saam Barati.
22893
22894         Add several module tests. And flip the failed tests flags in test262.
22895
22896         * modules/export-default-function-name-in-assignment-expression.js: Added.
22897         (export.default):
22898         * modules/export-default-function-name-in-class-declaration.js: Added.
22899         * modules/export-default-function-name-in-function-declaration.js: Added.
22900         (export.default):
22901         * modules/export-default-function-name-in-generator-declaration.js: Added.
22902         (export.default):
22903         * stress/method-name.js: Added.
22904         (testSyntax):
22905         (testSyntaxError):
22906         (testSyntaxError.Hello.prototype.hello.hello):
22907         (testSyntaxError.Hello):
22908         (SyntaxError.Unexpected.identifier.string_appeared_here.Expected.an.opening.string_appeared_here.before.a.method.testSyntaxError.let.obj.hello.hello):
22909         (testSyntaxError.Hello.prototype.get hello):
22910         (testSyntaxError.Hello.prototype.set hello):
22911         * test262.yaml:
22912
22913 2016-08-22  Yusuke Suzuki  <utatane.tea@gmail.com>
22914
22915         [ES6] Module should not allow HTML comments
22916         https://bugs.webkit.org/show_bug.cgi?id=161041
22917
22918         Reviewed by Saam Barati.
22919
22920         * modules/html-comments.js: Added.
22921         (shouldThrow):
22922         * test262.yaml:
22923
22924 2016-08-21  Yusuke Suzuki  <utatane.tea@gmail.com>
22925
22926         [DFG] Should not fixup AnyIntUse in 32_64
22927         https://bugs.webkit.org/show_bug.cgi?id=161029
22928
22929         Reviewed by Saam Barati.
22930
22931         * typeProfiler/int52-dfg.js: Added.
22932         (test):
22933
22934 2016-08-21  Yusuke Suzuki  <utatane.tea@gmail.com>
22935
22936         Unreviewed, rolling out r204697
22937         https://bugs.webkit.org/show_bug.cgi?id=161029
22938
22939         * typeProfiler/int52-dfg.js: Removed.
22940         (test): Deleted.
22941         * typeProfiler/number-filter-dfg.js: Removed.
22942         (test): Deleted.
22943
22944 2016-08-21  Yusuke Suzuki  <utatane.tea@gmail.com>
22945
22946         [DFG] Should not fixup AnyIntUse in 32_64
22947         https://bugs.webkit.org/show_bug.cgi?id=161029
22948
22949         Reviewed by Saam Barati.
22950
22951         * typeProfiler/int52-dfg.js: Added.
22952         (test):
22953         * typeProfiler/number-filter-dfg.js: Added.
22954         (test):
22955
22956 2016-08-19  Benjamin Poulain  <bpoulain@apple.com>
22957
22958         [JSC] ArithSqrt should work with any argument type
22959         https://bugs.webkit.org/show_bug.cgi?id=160954
22960
22961         Reviewed by Saam Barati.
22962
22963         * stress/arith-sqrt-on-various-types.js: Added.
22964         (let.validInputTypedTestCases.validInputTestCases.map):
22965         (isIdentical):
22966         (opaqueAllTypesSqrt):
22967         (testAllTypesCall):
22968         (testSingleTypeCall):
22969         (opaqueSqrtForSideEffects):
22970         (testSideEffect.let.testObject.valueOf):
22971         (testSideEffect):
22972         (opaqueSqrtForCSE):
22973         (testCSE.let.testObject.valueOf):
22974         (testCSE):
22975         (testException.opaqueSqrtWithException):
22976         (testException):
22977
22978 2016-08-19  Joseph Pecoraro  <pecoraro@apple.com>
22979
22980         Make custom Error properties (line, column, sourceURL) configurable and writable
22981         https://bugs.webkit.org/show_bug.cgi?id=160984
22982         <rdar://problem/27905979>
22983
22984         Reviewed by Saam Barati.
22985
22986         * stress/native-error-properties.js: Added.
22987         (assert):
22988         (shouldNotThrow):
22989
22990         (checkEmptyErrorPropertiesDescriptors):
22991         (checkNonEmptyErrorPropertiesDescriptors):
22992         The spec only describes the "message" property, so
22993         ensure it has the right descriptor attributes.
22994
22995         (checkErrorPropertiesWritable):
22996         Ensure common error property names are writable.
22997         In strict mode this would have thrown an exception
22998         if they were readonly.
22999
23000 2016-08-18  Mark Lam  <mark.lam@apple.com>
23001
23002         ScopedArguments is using the wrong owner object for a write barrier.
23003         https://bugs.webkit.org/show_bug.cgi?id=160976
23004         <rdar://problem/27328506>
23005
23006         Reviewed by Keith Miller.
23007
23008         * stress/scoped-arguments-write-barrier-should-be-on-scope-object.js: Added.
23009
23010 2016-08-17  JF Bastien  <jfbastien@apple.com>
23011
23012         We allow assignments to const variables when in a for-in/for-of loop
23013         https://bugs.webkit.org/show_bug.cgi?id=156673
23014
23015         Reviewed by Filip Pizlo.
23016
23017         * stress/for-in-of-const.js: Added.
23018         (expect_nothrow):
23019         (expect_throw):
23020         (capture):
23021
23022 2016-08-17  Mark Lam  <mark.lam@apple.com>
23023
23024         Remove an invalid assertion in the DFG backend's GetById emitter.
23025         https://bugs.webkit.org/show_bug.cgi?id=160925
23026         <rdar://problem/27248961>
23027
23028         Reviewed by Filip Pizlo.
23029
23030         * stress/dfg-get-by-id-should-not-assert-non-null-prediction.js: Added.
23031
23032 2016-08-16  Ryan Haddad  <ryanhaddad@apple.com>
23033
23034         Unreviewed, rolling out r204464.
23035
23036         This is no longer needed after r204495.
23037
23038         Reverted changeset:
23039
23040         "Skip failing test mozilla/ecma/LexicalConventions/7.7.3.js"
23041         https://bugs.webkit.org/show_bug.cgi?id=160662
23042         http://trac.webkit.org/changeset/204464
23043
23044 2016-08-15  Ryan Haddad  <ryanhaddad@apple.com>
23045
23046         Skip failing test mozilla/ecma/LexicalConventions/7.7.3.js
23047         https://bugs.webkit.org/show_bug.cgi?id=160662
23048
23049         Unreviewed test gardening.
23050
23051         * mozilla/ecma/LexicalConventions/7.7.3.js:
23052
23053 2016-08-14  Skachkov Oleksandr  <gskachkov@gmail.com>
23054
23055         [2016] Set correct status for test262 after implementation of Object.values&Object.entries
23056         https://bugs.webkit.org/show_bug.cgi?id=160844
23057
23058         Reviewed by Saam Barati.
23059
23060         Patch contains fix statuses of specs in the test262 test collection after implementation of
23061         Object.values and Object.entries functions. Also patch contains small fixes in tests of the
23062         tests for Object.values/entries functions.
23063
23064         * stress/object-entries.js:
23065         (Object.getOwnPropertyDescriptor):
23066         * stress/object-values.js:
23067         (Object.getOwnPropertyDescriptor):
23068         * test262.yaml:
23069
23070 2016-08-12  Saam Barati  <sbarati@apple.com>
23071
23072         Inline store loop for CopyRest in DFG and FTL for certain array modes
23073         https://bugs.webkit.org/show_bug.cgi?id=159612
23074
23075         Reviewed by Filip Pizlo.
23076
23077         * stress/rest-parameter-having-a-bad-time.js: Added.
23078         * stress/rest-parameter-many-arguments.js: Added.
23079         * stress/rest-parameter-various-types.js: Added.
23080
23081 2016-08-12  Skachkov Oleksandr  <gskachkov@gmail.com>
23082
23083         [ES2016] Implement Object.entries
23084         https://bugs.webkit.org/show_bug.cgi?id=160412
23085
23086         Reviewed by Saam Barati.
23087
23088         Patch contains tests for Object.entries function and
23089         fix of wrong tests for Object.values function.
23090
23091         * stress/object-entries.js:
23092         (compare):
23093         (string_appeared_here.forEach):
23094         (const.getInvokedFunctions.):
23095         (const.getInvokedFunctions):
23096         (Array.prototype.push):
23097         * stress/object-values.js:
23098
23099 2016-08-11  Mark Lam  <mark.lam@apple.com>
23100
23101         OverridesHasInstance should not branch across register allocations.
23102         https://bugs.webkit.org/show_bug.cgi?id=160792
23103         <rdar://problem/27361778>
23104
23105         Reviewed by Benjamin Poulain.
23106
23107         * stress/OverrideHasInstance-should-not-branch-across-register-allocations.js: Added.
23108
23109 2016-08-11  Mark Lam  <mark.lam@apple.com>
23110
23111         The jsc shell's Element host constructor should throw if it fails to construct an object.
23112         https://bugs.webkit.org/show_bug.cgi?id=160773
23113         <rdar://problem/27328608>
23114
23115         Reviewed by Saam Barati.
23116
23117         * stress/generational-opaque-roots.js:
23118
23119 2016-08-11  Mark Lam  <mark.lam@apple.com>
23120
23121         Disallow synchronous sweeping for eden GCs.
23122         https://bugs.webkit.org/show_bug.cgi?id=160716
23123
23124         Reviewed by Geoffrey Garen.
23125
23126         * stress/eden-gc-with-retired-blocks.js: Added.
23127         - This test is just in case we add back support for eden GCs with synchronous
23128           sweeping in the future.
23129
23130 2016-08-10  Michael Saboff  <msaboff@apple.com>
23131
23132         Baseline GetByVal and PutByVal for cache ID stubs need to handle exceptions
23133         https://bugs.webkit.org/show_bug.cgi?id=160749
23134
23135         Reviewed by Filip Pizlo.
23136
23137         New test that causes baseline GetByValWithCachedId and PutByValWithCachedId
23138         stubs to be generated and then throws exceptions for those stub to handle
23139         to verify that they are properly handled.
23140
23141         * stress/regress-160749.js: Added.
23142         (testCachedGetByVal.):
23143         (testCachedGetByVal.get for):
23144         (testCachedGetByVal):
23145         (testCachedPutByVal.):
23146         (testCachedPutByVal.set for):
23147         (testCachedPutByVal):
23148
23149 2016-08-10  Mark Lam  <mark.lam@apple.com>
23150
23151         DFG's flushForTerminal() needs to add PhantomLocals for bytecode live locals.
23152         https://bugs.webkit.org/show_bug.cgi?id=160755
23153         <rdar://problem/27488507>
23154
23155         Reviewed by Filip Pizlo.
23156
23157         * stress/need-bytecode-liveness-for-unreachable-blocks-at-dfg-time.js: Added.
23158
23159 2016-08-09  Skachkov Oleksandr  <gskachkov@gmail.com>
23160
23161         [ES2016] Implement Object.values
23162         https://bugs.webkit.org/show_bug.cgi?id=160410
23163
23164         Reviewed by Saam Barati, Yusuke Suzuki.
23165
23166         * stress/object-values.js: Added.
23167         (compare):
23168         (string_appeared_here.forEach):
23169         (const.getInvokedFunctions.):
23170         (const.getInvokedFunctions):
23171         (Array.prototype.push):
23172
23173 2016-08-09  Saam Barati  <sbarati@apple.com>
23174
23175         JSBoundFunction should lazily generate its name string
23176         https://bugs.webkit.org/show_bug.cgi?id=160678
23177         <rdar://problem/27043194>
23178
23179         Reviewed by Mark Lam.
23180
23181         * stress/bound-function-lazy-name-generation.js: Added.
23182         (assert):
23183         (test.let.f):
23184         (test.f):
23185         (test):
23186
23187 2016-08-08  Mark Lam  <mark.lam@apple.com>
23188
23189         ASSERTION FAILED: hasInlineStorage() in JSFinalObject::visitChildren().
23190         https://bugs.webkit.org/show_bug.cgi?id=160666
23191
23192         Reviewed by Keith Miller.
23193
23194         * stress/object-constructor-should-be-new-target-aware.js:
23195
23196 2016-08-07  Yusuke Suzuki  <utatane.tea@gmail.com>
23197
23198         [ES6] Module namespace object should not allow unset IC
23199         https://bugs.webkit.org/show_bug.cgi?id=160553
23200
23201         Reviewed by Saam Barati.
23202
23203         * modules/namespace-object-get-property.js: Added.
23204         (import.as.ns.from.string_appeared_here.shouldThrow):
23205         * modules/namespace-object-has-property.js: Added.
23206         * modules/namespace-object-inline-caching.js: Added.
23207         (import.as.A.from.string_appeared_here.import.as.B.from.string_appeared_here.lookup):
23208         (shouldBe.lookup.lookup):
23209         (shouldBe.lookup):
23210         * modules/namespace-object-inline-caching/a.js: Added.
23211         * modules/namespace-object-inline-caching/b.js: Added.
23212         * modules/namespace-object-try-get.js: Added.
23213         (import.as.ns.from.string_appeared_here.tryGetByIdText):
23214         (tryGetByIdTextStrict):
23215         * modules/namespace-object-typed-array-fast-path.js: Added.
23216         * test262.yaml:
23217
23218 2016-08-05  Saam Barati  <sbarati@apple.com>
23219
23220         various math operations don't properly check for an exception after calling toNumber() on the lhs
23221         https://bugs.webkit.org/show_bug.cgi?id=160154
23222
23223         Reviewed by Mark Lam.
23224
23225         * stress/to-number-throws-correct-exception.js: Added.
23226         (test.let.test.runTest.):
23227         (test.let.test.runTest.get f):
23228         (test.let.test.runTest):
23229         (test.let.test):
23230         (test):
23231         (test2.runTest.):
23232         (test2.runTest.get f):
23233         (test2.runTest):
23234         (test2):
23235
23236 2016-08-05  Saam Barati  <sbarati@apple.com>
23237
23238         Assertion failure when accessing TDZ variable in catch through eval
23239         https://bugs.webkit.org/show_bug.cgi?id=160554
23240
23241         Reviewed by Mark Lam and Keith Miller.
23242
23243         * stress/catch-variables-under-tdz.js: Added.
23244         (test):
23245
23246 2016-08-04  Yusuke Suzuki  <utatane.tea@gmail.com>
23247
23248         [ES6] JSModuleNamespaceObject's Symbol.iterator function should have name
23249         https://bugs.webkit.org/show_bug.cgi?id=160549
23250
23251         Reviewed by Saam Barati.
23252
23253         * modules/namespace-object-symbol-iterator-name.js: Added.
23254         * test262.yaml:
23255
23256 2016-08-04  Keith Miller  <keith_miller@apple.com>
23257
23258         ASSERTION FAILED: !hasInstanceValueNode->isCellConstant() || defaultHasInstanceFunction == hasInstanceValueNode->asCell()
23259         https://bugs.webkit.org/show_bug.cgi?id=160562
23260
23261         Reviewed by Mark Lam.
23262
23263         * stress/instanceof-late-constant-folding.js: Added.
23264         (Constructor):
23265         (value):
23266         (body):
23267
23268 2016-08-04  Caitlin Potter  <caitp@igalia.com>
23269
23270         [JSC] fix generator-syntax.js JSTest again after yield grammar fix
23271         https://bugs.webkit.org/show_bug.cgi?id=160550
23272
23273         Reviewed by Yusuke Suzuki.
23274
23275         * stress/generator-syntax.js:
23276         (testYieldBindingIdentifier):
23277
23278 2016-08-03  Caitlin Potter  <caitp@igalia.com>
23279
23280         Clarify SyntaxErrors around yield and unskip tests
23281         https://bugs.webkit.org/show_bug.cgi?id=158460
23282
23283         Reviewed by Saam Barati.
23284
23285         Fix and unskip tests which erroneously asserted that `yield` is not a
23286         valid BindingIdentifier, and improve error message for YieldExpressions
23287         occuring in Arrow formal parameters.
23288
23289         * stress/generator-syntax.js:
23290         * stress/yield-out-of-generator.js:
23291
23292 2016-08-03  Filip Pizlo  <fpizlo@apple.com>
23293
23294         REGRESSION(r203368): broke some test262 tests
23295         https://bugs.webkit.org/show_bug.cgi?id=160479
23296
23297         Reviewed by Mark Lam.
23298
23299         Added a stress test for this case, since we don't always run test262.
23300
23301         * stress/freeze-setter.js: Added.
23302         (let.o.set foo):
23303
23304 2016-08-03  Saam Barati  <sbarati@apple.com>
23305
23306         Implement nested rest destructuring w.r.t the ES7 spec
23307         https://bugs.webkit.org/show_bug.cgi?id=160423
23308
23309         Reviewed by Filip Pizlo.
23310
23311         * stress/destructuring-rest-element.js: Added.
23312         (assert):
23313         (test):
23314         (arr):
23315         (eq):
23316         (gen):
23317         (fakeGen.return.Symbol.iterator):
23318         (fakeGen):
23319         * stress/rest-elements.js:
23320         (testSyntaxError.String.raw):
23321         * stress/rest-parameter-is-destructuring.js: Added.
23322         (assert):
23323         (test):
23324         (foo):
23325         (bar):
23326         * test262.yaml:
23327
23328 2016-08-02  Saam Barati  <sbarati@apple.com>
23329
23330         Rename Changelog to ChangeLog
23331
23332         Rubber stamped by Keith Miller.
23333
23334         * Changelog: Removed.
23335
23336 2016-08-02  Saam Barati  <sbarati@apple.com>
23337
23338         update a class extending null w.r.t the ES7 spec
23339         https://bugs.webkit.org/show_bug.cgi?id=160417
23340
23341         Reviewed by Keith Miller.
23342
23343         * Changelog:
23344         * stress/class-derived-from-null.js: Added.
23345         (assert):
23346         (test):
23347         (test1.C):
23348         (test1):
23349         (jsNull):
23350         (test2.C):
23351         (test2):
23352         (test3.C):
23353         (test3.D):
23354         (test3.E):
23355         (test3):
23356         (test4.E):
23357         (test4):
23358         (test5.E):
23359         (test5):
23360         (test6.Base):
23361         (test6.D):
23362         (test6.E):
23363         (test6.F):
23364         (test6.G):
23365         (test6):
23366         * test262.yaml:
23367
23368 2016-08-01  Filip Pizlo  <fpizlo@apple.com>
23369
23370         Rationalize varargs stack overflow checks
23371         https://bugs.webkit.org/show_bug.cgi?id=160425
23372
23373         Reviewed by Michael Saboff.
23374
23375         * stress/arity-check-ftl-throw-more-args.js: Added.
23376         (catch):
23377
23378 2016-08-01  Keith Miller  <keith_miller@apple.com>
23379
23380         We should not keep the JavaScript tests inside the Source/JavaScriptCore/ directory.
23381         https://bugs.webkit.org/show_bug.cgi?id=160372
23382
23383         Rubber stamped by Geoffrey Garen.
23384
23385         This patch moves all the JavaScript tests from Source/JavaScriptCore/tests to
23386         a new top level directory, JSTests. Having the tests in the Source directory
23387         was both confusing an inconvenient for people that just want to checkout the
23388         source code of WebKit. Since there is no other obvious place to put all the
23389         JavaScript tests a new top level directory seemed the most sensible.
23390
23391         * tests/: Deleted.