Google Git
Sign in
chromium/external/github.com/WebKit/webkit/refs/heads/webkitgtk/2.26/./JSTests/ChangeLog
blob: b4ceb40129b3fb1ff34b1f5630b0cd0d27d1c7e9 [file] [log] [blame] [edit]
2020-03-09 Caio Lima <[email protected]>
Tail calls are broken on ARM_THUMB2 and MIPS
https://bugs.webkit.org/show_bug.cgi?id=197797
Reviewed by Yusuke Suzuki.
* stress/tail-call-with-spilled-registers.js: Added.
2019-10-01 Saam Barati <[email protected]>
ObjectAllocationSinkingPhase shouldn't insert hints for allocations which are no longer valid
https://bugs.webkit.org/show_bug.cgi?id=199361
<rdar://problem/52454940>
Reviewed by Yusuke Suzuki.
* stress/allocation-sinking-hints-are-valid-ssa-2.js: Added.
(main.fn):
(main.executor):
(main):
* stress/allocation-sinking-hints-are-valid-ssa.js: Added.
(main.fn):
(main.executor):
(main):
2019-09-16 Saam Barati <[email protected]>
JSObject::putInlineSlow should not ignore "__proto__" for Proxy
https://bugs.webkit.org/show_bug.cgi?id=200386
<rdar://problem/53854946>
Reviewed by Yusuke Suzuki.
* stress/proxy-__proto__-in-prototype-chain.js: Added.
* stress/proxy-property-replace-structure-transition.js: Added.
2019-09-18 Saam Barati <[email protected]>
Phantom insertion phase may disagree with arguments forwarding about live ranges
https://bugs.webkit.org/show_bug.cgi?id=200715
<rdar://problem/54301717>
Reviewed by Yusuke Suzuki.
* stress/phantom-insertion-live-range-should-agree-with-arguments-forwarding.js: Added.
(main.v23):
(main.try.v43):
(main.):
(main):
2019-09-16 Michael Saboff <[email protected]>
[JSC] Perform check again when we found non-BMP characters
https://bugs.webkit.org/show_bug.cgi?id=201647
Reviewed by Yusuke Suzuki.
* stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js: Added.
* stress/regexp-unicode-within-string.js: Updated test to eliminate the bogus print().
(testRegExpInbounds):
2019-09-10 Michael Saboff <[email protected]>
JSC crashes due to stack overflow while building RegExp
https://bugs.webkit.org/show_bug.cgi?id=201649
Reviewed by Yusuke Suzuki.
New regression test.
* stress/regexp-bol-optimize-out-of-stack.js: Added.
(test):
(catch):
2019-08-30 Yusuke Suzuki <[email protected]>
[JSC] Generate new.target register only when it is used
https://bugs.webkit.org/show_bug.cgi?id=201335
Reviewed by Mark Lam.
* stress/ensure-new-register-allocated.js: Added.
(shouldBe):
(basic):
(arrow):
(Base):
(Derived):
(evaluate):
2019-08-30 Yusuke Suzuki <[email protected]>
[JSC] DFG ByteCodeParser should not copy JIT-related part of SimpleJumpTable
https://bugs.webkit.org/show_bug.cgi?id=201331
Reviewed by Mark Lam.
* stress/simple-jump-table-copy.js: Added.
(let.code):
(g2):
2019-08-30 Yusuke Suzuki <[email protected]>
[JSC] DFG inlining CheckBadCell slow path does not assume result VirtualRegister can be invalid
https://bugs.webkit.org/show_bug.cgi?id=201332
Reviewed by Mark Lam.
This test is very flaky, it is hard to reproduce.
* stress/setter-inlining-resulting-bad-cell-result-virtual-register-should-be-invalid.js: Added.
(code):
2019-08-29 Yusuke Suzuki <[email protected]>
[JSC] Repatch should construct CallCases and CasesValue at the same time
https://bugs.webkit.org/show_bug.cgi?id=201325
Reviewed by Saam Barati.
* stress/repatch-switch.js: Added.
(main.f2.f0):
(main.f2.f3):
(main.f2.f1):
(main.f2):
(main):
2019-08-29 Yusuke Suzuki <[email protected]>
[JSC] ObjectAllocationSinkingPhase wrongly deals with always-taken branches during interpretation
https://bugs.webkit.org/show_bug.cgi?id=198650
Reviewed by Saam Barati.
* stress/object-allocation-sinking-interpretation-can-interpret-edges-that-can-be-proven-unreachable-in-ai.js:
(main.v0):
(main):
2019-08-28 Mark Lam <[email protected]>
DFG/FTL: We should prefetch structures and do a loadLoadFence before doing PrototypeChainIsSane checks.
https://bugs.webkit.org/show_bug.cgi?id=201281
<rdar://problem/54028228>
Reviewed by Yusuke Suzuki and Saam Barati.
* stress/structure-storedPrototype-should-only-assert-on-the-mutator-thread.js: Added.
2019-08-28 Mark Lam <[email protected]>
Placate exception check validation in DFG's operationHasGenericProperty().
https://bugs.webkit.org/show_bug.cgi?id=201245
<rdar://problem/54777512>
Reviewed by Robin Morisset.
* stress/missing-exception-check-in-operationHasGenericProperty.js: Added.
2019-08-27 Mark Lam <[email protected]>
constructFunctionSkippingEvalEnabledCheck() should use tryMakeString() and check for OOM.
https://bugs.webkit.org/show_bug.cgi?id=201196
<rdar://problem/54703775>
Reviewed by Yusuke Suzuki.
* stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: Added.
2019-08-26 Ross Kirsling <[email protected]>
[JSC] Ensure x?.y ?? z is fast
https://bugs.webkit.org/show_bug.cgi?id=200875
Reviewed by Yusuke Suzuki.
* stress/nullish-coalescing.js:
2019-08-23 Tadeu Zagallo <[email protected]>
Remove MaximalFlushInsertionPhase
https://bugs.webkit.org/show_bug.cgi?id=201036
Reviewed by Saam Barati.
Remove all the references to maximal flush
* stress/arith-ceil-on-various-types.js:
(checkCompileCountForUselessNegativeZero):
* stress/arith-floor-on-various-types.js:
(checkCompileCountForUselessNegativeZero):
* stress/arith-negate-on-various-types.js:
(checkCompileCountForUselessNegativeZero):
* stress/arith-round-on-various-types.js:
(checkCompileCountForUselessNegativeZero):
* stress/arith-trunc-on-various-types.js:
(checkCompileCountForUselessNegativeZero):
* stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js:
* stress/has-indexed-property-should-accept-non-int32.js:
* stress/has-indexed-property-with-worsening-array-mode.js:
* stress/known-int32-cant-be-used-across-bytecode-boundary.js:
* stress/read-dead-bytecode-locals-in-must-handle-values1.js:
* stress/read-dead-bytecode-locals-in-must-handle-values2.js:
* stress/rest-parameter-many-arguments.js:
* stress/set-argument-maybe-maximal-flush-should-not-extend-liveness-2.js:
* stress/set-argument-maybe-maximal-flush-should-not-extend-liveness.js:
* stress/to-index-string-should-not-assume-incoming-value-is-uint32.js:
2019-08-23 Justin Michaud <[email protected]>
[WASM-References] Do not overwrite argument registers in jsCallEntrypoint
https://bugs.webkit.org/show_bug.cgi?id=200952
Reviewed by Saam Barati.
* wasm/references/func_ref.js:
(assert.throws):
2019-08-22 Justin Michaud <[email protected]>
Add missing exception check in canonicalizeLocaleList
https://bugs.webkit.org/show_bug.cgi?id=201021
Reviewed by Mark Lam.
* stress/missing-exception-check-in-canonicalizeLocaleList.js: Added.
(catch):
2019-08-21 Mark Lam <[email protected]>
Wasm::FunctionParser is failing to enforce maxFunctionLocals.
https://bugs.webkit.org/show_bug.cgi?id=201016
<rdar://problem/54579911>
Reviewed by Yusuke Suzuki.
* wasm/stress/too-many-locals.js: Added.
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.catch):
2019-08-21 Ross Kirsling <[email protected]>
JSTests/stress/optional-chaining should not call shouldThrowTypeError in a loop
https://bugs.webkit.org/show_bug.cgi?id=200965
Reviewed by Saam Barati.
This has nothing to do with ?. in particular, but throwing >1M type errors takes 100s in Debug on my machine.
The main idea here was to JITify the simple success cases, so let's not run the simple failures so many times.
* stress/optional-chaining.js:
2019-08-21 Michael Saboff <[email protected]>
[JSC] incorrent JIT lead to StackOverflow
https://bugs.webkit.org/show_bug.cgi?id=197823
Reviewed by Tadeu Zagallo.
New test.
* stress/bound-function-stack-overflow.js: Added.
(foo):
(catch):
2019-08-20 Justin Michaud <[email protected]>
Identify memcpy loops in b3
https://bugs.webkit.org/show_bug.cgi?id=200181
Reviewed by Saam Barati.
* microbenchmarks/memcpy-loop.js: Added.
(doTest):
(let.arr1):
* microbenchmarks/memcpy-typed-loop-large.js: Added.
(doTest):
(let.arr1.new.Int32Array.1000000.let.arr2.new.Int32Array.1000000):
(arr2):
* microbenchmarks/memcpy-typed-loop-small.js: Added.
(doTest):
(16.let.arr1.new.Int32Array.size.let.arr2.new.Int32Array.size):
(16.arr2):
* microbenchmarks/memcpy-typed-loop-speculative.js: Added.
(doTest):
(let.arr1.new.Int32Array.10.let.arr2.new.Int32Array.10):
(arr2):
* microbenchmarks/memcpy-wasm-large.js: Added.
(typeof.WebAssembly.string_appeared_here.eq):
(typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
* microbenchmarks/memcpy-wasm-medium.js: Added.
(typeof.WebAssembly.string_appeared_here.eq):
(typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
* microbenchmarks/memcpy-wasm-small.js: Added.
(typeof.WebAssembly.string_appeared_here.eq):
(typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
* microbenchmarks/memcpy-wasm.js: Added.
(typeof.WebAssembly.string_appeared_here.eq):
(typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
* stress/memcpy-typed-loops.js: Added.
(noLoop):
(invalidStart):
(const.size.10.let.arr1.new.Int32Array.size.let.arr2.new.Int32Array.size):
(arr2):
* wasm/function-tests/memcpy-wasm-loop.js: Added.
(0.GetLocal.3.I32Const.1.I32Add.SetLocal.3.Br.1.End.End.End.WebAssembly):
(string_appeared_here):
2019-08-20 Yusuke Suzuki <[email protected]>
[JSC] Array.prototype.toString should not get "join" function each time
https://bugs.webkit.org/show_bug.cgi?id=200905
Reviewed by Mark Lam.
* stress/array-prototype-join-change.js: Added.
(shouldBe):
(array2.join):
(DerivedArray):
(DerivedArray.prototype.join):
(array3.__proto__.join):
(Array.prototype.join):
2019-08-20 Justin Michaud <[email protected]>
Fix InBounds speculation of typed array PutByVal and add extra step to integer range optimization to search for equality relationships on the RHS value
https://bugs.webkit.org/show_bug.cgi?id=200782
Reviewed by Saam Barati.
Skip long memcpy test on debug, and try to fix flakiness for recompilation count tests by disabling cjit.
* microbenchmarks/memcpy-typed-loop.js:
* stress/int8-repeat-in-then-out-of-bounds.js:
2019-08-19 Alexey Shvayka <[email protected]>
Proxy constructor should throw if handler is revoked Proxy
https://bugs.webkit.org/show_bug.cgi?id=198755
Reviewed by Saam Barati.
* stress/proxy-revoke.js: Adjust error message.
* test262/expectations.yaml: Mark 2 test cases as passing.
2019-08-19 Yusuke Suzuki <[email protected]>
[JSC] OSR entry to Wasm OMG
https://bugs.webkit.org/show_bug.cgi?id=200362
Reviewed by Michael Saboff.
* wasm/stress/osr-entry-basic.js: Added.
(instance.exports.loop):
* wasm/stress/osr-entry-many-locals-f32.js: Added.
* wasm/stress/osr-entry-many-locals-f64.js: Added.
* wasm/stress/osr-entry-many-locals-i32.js: Added.
* wasm/stress/osr-entry-many-locals-i64.js: Added.
* wasm/stress/osr-entry-many-stacks-f32.js: Added.
* wasm/stress/osr-entry-many-stacks-f64.js: Added.
* wasm/stress/osr-entry-many-stacks-i32.js: Added.
* wasm/stress/osr-entry-many-stacks-i64.js: Added.
2019-08-19 Alexey Shvayka <[email protected]>
Date.prototype.toJSON throws if toISOString returns an object
https://bugs.webkit.org/show_bug.cgi?id=198495
Reviewed by Ross Kirsling.
* test262/expectations.yaml: Mark 6 test cases as passing.
2019-08-19 Yusuke Suzuki <[email protected]>
[JSC] DFG DataView get/set optimization should take care of the case little-endian flag is JSEmpty
https://bugs.webkit.org/show_bug.cgi?id=200899
<rdar://problem/54073341>
Reviewed by Mark Lam.
* stress/data-view-get-dfg-should-handle-empty-constant.js: Added.
(i.new.Promise):
* stress/data-view-set-dfg-should-handle-empty-constant.js: Added.
(i.new.Promise):
2019-08-19 Michael Saboff <[email protected]>
Webkit jsc Crash in RegExp::matchInline (this=<optimized out>
https://bugs.webkit.org/show_bug.cgi?id=197090
Reviewed by Yusuke Suzuki.
New test.
* stress/regexp-nonconsuming-counted-parens.js: Added.
2019-08-18 Ross Kirsling <[email protected]>
[JSC] Correct a->an in error messages and API docblocks
https://bugs.webkit.org/show_bug.cgi?id=200833
Reviewed by Don Olmstead.
* ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
(assert.assert.return.throws):
* stress/promise-finally-should-accept-non-promise-objects.js:
* wasm/js-api/table.js:
(assert.throws):
2019-08-17 Ross Kirsling <[email protected]>
[ESNext] Implement optional chaining
https://bugs.webkit.org/show_bug.cgi?id=200199
Reviewed by Yusuke Suzuki.
* stress/nullish-coalescing.js:
* stress/optional-chaining.js: Added.
* stress/tail-call-recognize.js:
2019-08-17 Ross Kirsling <[email protected]>
[ESNext] Support hashbang.
https://bugs.webkit.org/show_bug.cgi?id=200865
Reviewed by Mark Lam.
* stress/hashbang.js: Added.
* test262/expectations.yaml: Mark 6 cases as passing.
2019-08-17 Yusuke Suzuki <[email protected]>
[JSC] DFG ToNumber should support Boolean in fixup
https://bugs.webkit.org/show_bug.cgi?id=200864
Reviewed by Mark Lam.
* microbenchmarks/to-number-boolean.js: Added.
(test):
* stress/to-number-boolean-int32.js: Added.
(shouldBe):
(test):
(check):
* stress/to-number-boolean.js: Added.
(shouldBe):
(test):
(check):
* stress/to-number-int32.js: Added.
(shouldBe):
(test):
(check):
2019-08-16 Mark Lam <[email protected]>
More missing exception checks in string comparison operators.
https://bugs.webkit.org/show_bug.cgi?id=200844
<rdar://problem/54378684>
Reviewed by Saam Barati.
* stress/missing-exception-check-in-string-greater-than-compare.js: Added.
* stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: Added.
* stress/missing-exception-check-in-string-less-than-compare.js: Added.
* stress/missing-exception-check-in-string-less-than-or-equal-compare.js: Added.
2019-08-16 Mark Lam <[email protected]>
CodeBlock destructor should clear all of its watchpoints.
https://bugs.webkit.org/show_bug.cgi?id=200792
<rdar://problem/53947800>
Reviewed by Yusuke Suzuki.
* stress/codeblock-should-clear-watchpoints-on-destruction.js: Added.
2019-08-16 Justin Michaud <[email protected]>
Fix InBounds speculation of typed array PutByVal and add extra step to integer range optimization to search for equality relationships on the RHS value
https://bugs.webkit.org/show_bug.cgi?id=200782
Reviewed by Saam Barati.
* microbenchmarks/int8-out-of-bounds.js: Added.
(foo):
* microbenchmarks/memcpy-typed-loop.js: Added.
(doTest):
(let.arr1.new.Int32Array.1000.let.arr2.new.Int32Array.1000):
(arr2):
* stress/int8-repeat-in-then-out-of-bounds.js: Added.
(foo):
2019-08-16 Mark Lam <[email protected]>
[Re-land] ProxyObject should not be allow to access its target's private properties.
https://bugs.webkit.org/show_bug.cgi?id=200739
<rdar://problem/53972768>
Reviewed by Yusuke Suzuki.
* stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js: Copied from JSTests/stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js.
* stress/proxy-with-private-symbols.js:
2019-08-16 Yusuke Suzuki <[email protected]>
[JSC] Promise.prototype.finally should accept non-promise objects
https://bugs.webkit.org/show_bug.cgi?id=200829
Reviewed by Mark Lam.
* stress/promise-finally-should-accept-non-promise-objects.js: Added.
(shouldBe):
(Thenable):
(Thenable.prototype.then):
2019-08-16 Alexey Shvayka <[email protected]>
Promise constructor should check argument before [[Construct]]
https://bugs.webkit.org/show_bug.cgi?id=198976
Reviewed by Ross Kirsling.
* stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js: Fix test.
* stress/create-subclass-structure-might-throw.js: Fix test.
* test262/expectations.yaml: Mark 2 test cases as passing.
2019-08-16 Ryan Haddad <[email protected]>
Unreviewed, rolling out r248709.
Caused test/built-ins/Promise/prototype/finally/this-value-
non-promise.js to fail on test262 bot
Reverted changeset:
"ProxyObject should not be allow to access its target's
private properties."
https://bugs.webkit.org/show_bug.cgi?id=200739
https://trac.webkit.org/changeset/248709
2019-08-15 Alexey Shvayka <[email protected]>
DateConversion::formatDateTime incorrectly formats negative years
https://bugs.webkit.org/show_bug.cgi?id=199964
Reviewed by Ross Kirsling.
* test262/expectations.yaml: Mark 6 test cases as passing.
2019-08-15 Mark Lam <[email protected]>
More missing exception checks in String.prototype.
https://bugs.webkit.org/show_bug.cgi?id=200762
<rdar://problem/54333896>
Reviewed by Michael Saboff.
* stress/missing-exception-check-in-string-lastIndexOf.js: Added.
* stress/missing-exception-check-in-string-toLower.js: Added.
* stress/missing-exception-check-in-string-toUpper.js: Added.
2019-08-14 Mark Lam <[email protected]>
ProxyObject should not be allow to access its target's private properties.
https://bugs.webkit.org/show_bug.cgi?id=200739
<rdar://problem/53972768>
Reviewed by Yusuke Suzuki.
* stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js: Added.
* stress/proxy-with-private-symbols.js: Rebased.
2019-08-14 Mark Lam <[email protected]>
Missing exception check in string compare.
https://bugs.webkit.org/show_bug.cgi?id=200743
<rdar://problem/53975356>
Reviewed by Michael Saboff.
* stress/missing-exception-check-in-string-compare.js: Added.
2019-08-08 Ross Kirsling <[email protected]>
[JSC] Add "jump if (not) undefined or null" bytecode ops
https://bugs.webkit.org/show_bug.cgi?id=200480
Reviewed by Saam Barati.
* stress/destructuring-assignment-require-object-coercible.js:
* stress/nullish-coalescing.js:
2019-08-05 Michael Saboff <[email protected]>
JSC: assertion failure in SpeculativeJIT::compileGetByValOnIntTypedArray
https://bugs.webkit.org/show_bug.cgi?id=199997
Reviewed by Saam Barati.
New test.
* stress/typedarray-no-alreadyChecked-assert.js: Added.
(checkIntArray):
(checkFloatArray):
2019-08-02 Yusuke Suzuki <[email protected]>
[JSC] Support WebAssembly in SamplingProfiler
https://bugs.webkit.org/show_bug.cgi?id=200329
Reviewed by Saam Barati.
* stress/sampling-profiler-wasm-name-section.js: Added.
(const.compile):
(platformSupportsSamplingProfiler.vm.isWasmSupported.wasmEntry):
(platformSupportsSamplingProfiler.vm.isWasmSupported):
* stress/sampling-profiler-wasm.js: Added.
(platformSupportsSamplingProfiler.vm.isWasmSupported.wasmEntry):
(platformSupportsSamplingProfiler.vm.isWasmSupported):
* stress/sampling-profiler/loop.wasm: Added.
* stress/sampling-profiler/loop.wast: Added.
* stress/sampling-profiler/nameSection.wasm: Added.
2019-08-02 Yusuke Suzuki <[email protected]>
[JSC] LazyJSValue should be robust for empty JSValue
https://bugs.webkit.org/show_bug.cgi?id=200388
Reviewed by Saam Barati.
* stress/switch-constant-child-becomes-empty.js: Added.
(foo):
2019-08-01 Yusuke Suzuki <[email protected]>
GetterSetter type confusion during DFG compilation
https://bugs.webkit.org/show_bug.cgi?id=199903
Reviewed by Mark Lam.
* stress/cse-propagated-constant-may-not-follow-structure-restrictions.js: Added.
2019-08-01 Ross Kirsling <[email protected]>
Update Test262 (2019.08.01)
https://bugs.webkit.org/show_bug.cgi?id=200351
Reviewed by Keith Miller.
* test262/expectations.yaml:
* test262/harness/testIntl.js:
* test262/latest-changes-summary.txt:
* test262/test/:
* test262/test262-Revision.txt:
2019-07-30 Yusuke Suzuki <[email protected]>
[JSC] Make StructureChain less-tricky by using Auxiliary Buffer
https://bugs.webkit.org/show_bug.cgi?id=200192
Reviewed by Saam Barati.
* stress/structure-chain-stress.js: Added.
(keys):
2019-07-29 Yusuke Suzuki <[email protected]>
[JSC] Increment bytecode age only when SlotVisitor is first-visit
https://bugs.webkit.org/show_bug.cgi?id=200196
Reviewed by Robin Morisset.
* stress/reparsing-unlinked-codeblock.js:
2019-07-29 Justin Michaud <[email protected]>
[X86] Emit BT instruction for shift + mask in B3
https://bugs.webkit.org/show_bug.cgi?id=199891
Reviewed by Robin Morisset.
Lower the number of iterations to fix debug timeouts.
* microbenchmarks/bit-test-load.js:
(i):
2019-07-27 Justin Michaud <[email protected]>
[X86] Emit BT instruction for shift + mask in B3
https://bugs.webkit.org/show_bug.cgi?id=199891
Reviewed by Keith Miller.
* microbenchmarks/bit-test-constant.js: Added.
(let.glob.0.doTest):
* microbenchmarks/bit-test-load.js: Added.
(let.glob.0.let.arr.new.Int32Array.8.doTest):
(i):
* microbenchmarks/bit-test-nonconstant.js: Added.
(let.glob.0.doTest):
2019-07-26 Yusuke Suzuki <[email protected]>
[JSC] Potential GC fix for JSPropertyNameEnumerator
https://bugs.webkit.org/show_bug.cgi?id=200151
Reviewed by Mark Lam.
* stress/for-in-stress.js: Added.
(keys):
2019-07-25 Ross Kirsling <[email protected]>
Legacy numeric literals should not permit separators or BigInt
https://bugs.webkit.org/show_bug.cgi?id=199984
Reviewed by Keith Miller.
* stress/big-int-literals.js:
* stress/numeric-literal-separators.js:
2019-07-25 Ross Kirsling <[email protected]>
[ESNext] Implement nullish coalescing
https://bugs.webkit.org/show_bug.cgi?id=200072
Reviewed by Darin Adler.
* stress/nullish-coalescing.js: Added.
2019-07-24 Alexey Shvayka <[email protected]>
Three checks are missing in Proxy internal methods
https://bugs.webkit.org/show_bug.cgi?id=198630
Reviewed by Darin Adler.
* stress/proxy-delete.js: Assert isExtensible is called in correct order.
* test262/expectations.yaml: Mark 6 test cases as passing.
2019-07-23 Justin Michaud <[email protected]>
Sometimes we miss removable CheckInBounds
https://bugs.webkit.org/show_bug.cgi?id=200018
Reviewed by Saam Barati.
* microbenchmarks/typed-array-sum.js: Added.
(doTest):
2019-07-16 Mark Lam <[email protected]>
ArgumentsEliminationPhase should insert KillStack nodes before PutStack nodes that it adds.
https://bugs.webkit.org/show_bug.cgi?id=199821
<rdar://problem/52452328>
Reviewed by Filip Pizlo.
* stress/arguments-elimination-should-insert-KillStacks-before-added-PutStacks.js: Added.
2019-07-16 Keith Miller <[email protected]>
Unreviewed, test262 gardening.
* test262/expectations.yaml:
2019-07-15 Keith Miller <[email protected]>
A Possible Issue of Object.create method
https://bugs.webkit.org/show_bug.cgi?id=199744
Reviewed by Yusuke Suzuki.
* stress/object-create-non-object-properties-parameter.js: Added.
(catch):
2019-07-15 Keith Miller <[email protected]>
Update test262
https://bugs.webkit.org/show_bug.cgi?id=199801
Rubber-stamped by Yusuke Suzuki.
* test262/expectations.yaml:
* test262/latest-changes-summary.txt:
* test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/Symbol.toStringTag.js: Added.
(fg.new.FinalizationGroup):
(callback):
* test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-job-not-active-throws.js: Added.
(fg.new.FinalizationGroup):
(callback):
* test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-length.js: Added.
(fg.new.FinalizationGroup):
(callback):
* test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-missing-internal-throws.js: Added.
(fg.new.FinalizationGroup):
(callback):
* test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-name.js: Added.
(fg.new.FinalizationGroup):
(callback):
* test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-not-object-throws.js: Added.
(fg.new.FinalizationGroup):
(callback):
* test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-prop-desc.js: Added.
(fg.new.FinalizationGroup):
(callback):
* test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/proto.js: Added.
(callback):
(fg.new.FinalizationGroup):
* test262/test/built-ins/FinalizationGroup/constructor.js: Added.
* test262/test/built-ins/FinalizationGroup/gc-has-one-chance-to-call-cleanupCallback.js: Added.
(cb):
(fg.new.FinalizationGroup):
(emptyCells):
(async.fn):
(fn.then.async):
* test262/test/built-ins/FinalizationGroup/instance-extensible.js: Added.
(fg.new.FinalizationGroup):
* test262/test/built-ins/FinalizationGroup/length.js: Added.
* test262/test/built-ins/FinalizationGroup/name.js: Added.
* test262/test/built-ins/FinalizationGroup/newtarget-prototype-is-not-object.js: Added.
(newTarget):
(fn):
* test262/test/built-ins/FinalizationGroup/prop-desc.js: Added.
* test262/test/built-ins/FinalizationGroup/proto-from-ctor-realm.js: Added.
(fn):
* test262/test/built-ins/FinalizationGroup/proto.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype-from-newtarget-abrupt.js: Added.
(newTarget):
* test262/test/built-ins/FinalizationGroup/prototype-from-newtarget-custom.js: Added.
(newTarget):
* test262/test/built-ins/FinalizationGroup/prototype-from-newtarget.js: Added.
(fg.new.FinalizationGroup):
* test262/test/built-ins/FinalizationGroup/prototype/Symbol.toStringTag.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/callback-iterator-proto.js: Added.
(callback):
(fg.new.FinalizationGroup):
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/callback-not-callable-throws.js: Added.
(fg.new.FinalizationGroup):
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-prevented-with-reference.js: Added.
(cb):
(fg.new.FinalizationGroup):
(emptyCells):
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-prevented-with-unregister.js: Added.
(fg.new.FinalizationGroup):
(fg.cleanupSome.cb):
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanupcallback-iterator-proto.js: Added.
(callback):
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/custom-this.js: Added.
(fn):
(cb):
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/gc-cleanup-not-prevented-with-wr-deref.js: Added.
(cb):
(fg.new.FinalizationGroup):
(emptyCells):
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/iterator-dynamic.js: Added.
(fg.new.FinalizationGroup):
(callback):
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/iterator-holdings-multiple-values.js: Added.
(fg.new.FinalizationGroup):
(callback):
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/length.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/name.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/poisoned-callback-throws.js: Added.
(poisoned):
(fg.new.FinalizationGroup):
(emptyCells):
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/poisoned-cleanup-callback-throws.js: Added.
(poisoned):
(emptyCells):
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/prop-desc.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/return-undefined-with-gc.js: Added.
(fn):
(cb):
(emptyCells):
(prototype.assert.sameValue.fg.cleanupSome):
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/return-undefined.js: Added.
(fn):
(cb):
(poisoned):
(assert.sameValue.fg.cleanupSome):
(prototype.assert.sameValue.fg.cleanupSome):
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/this-does-not-have-internal-cells-throws.js: Added.
(cb):
* test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/this-not-object-throws.js: Added.
(cb):
* test262/test/built-ins/FinalizationGroup/prototype/constructor.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/prop-desc.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/proto.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/register/custom-this.js: Added.
(fn):
* test262/test/built-ins/FinalizationGroup/prototype/register/holdings-any-value-type.js: Added.
(fn):
* test262/test/built-ins/FinalizationGroup/prototype/register/holdings-same-as-target.js: Added.
(fg.new.FinalizationGroup):
* test262/test/built-ins/FinalizationGroup/prototype/register/length.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/register/name.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/register/prop-desc.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/register/return-undefined-register-itself.js: Added.
(fn):
* test262/test/built-ins/FinalizationGroup/prototype/register/return-undefined.js: Added.
(fn):
* test262/test/built-ins/FinalizationGroup/prototype/register/target-not-object-throws.js: Added.
(fg.new.FinalizationGroup):
* test262/test/built-ins/FinalizationGroup/prototype/register/this-does-not-have-internal-target-throws.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/register/this-not-object-throws.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-not-object-or-undefined-throws.js: Added.
(fg.new.FinalizationGroup):
* test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-holdings-and-target.js: Added.
(fg.new.FinalizationGroup):
* test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-holdings.js: Added.
(fg.new.FinalizationGroup):
* test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-target.js: Added.
(fg.new.FinalizationGroup):
* test262/test/built-ins/FinalizationGroup/prototype/unregister/custom-this.js: Added.
(fn):
* test262/test/built-ins/FinalizationGroup/prototype/unregister/length.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/unregister/name.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/unregister/prop-desc.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/unregister/this-does-not-have-internal-cells-throws.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/unregister/this-not-object-throws.js: Added.
* test262/test/built-ins/FinalizationGroup/prototype/unregister/unregister.js: Added.
(fn):
* test262/test/built-ins/FinalizationGroup/prototype/unregister/unregisterToken-not-object-throws.js: Added.
(fg.new.FinalizationGroup):
* test262/test/built-ins/FinalizationGroup/returns-new-object-from-constructor.js: Added.
(cleanupCallback):
(let.key.of.Object.getOwnPropertyNames):
(set for):
* test262/test/built-ins/FinalizationGroup/target-not-callable-throws.js: Added.
* test262/test/built-ins/FinalizationGroup/undefined-newtarget-throws.js: Added.
(FinalizationGroup):
* test262/test/built-ins/FinalizationGroup/unnaffected-by-poisoned-cleanupCallback.js: Added.
(cleanupCallback):
(let.key.of.Object.getOwnPropertyNames):
(set for):
* test262/test/built-ins/Function/StrictFunction_restricted-properties.js:
* test262/test/built-ins/Function/prototype/bind/BoundFunction_restricted-properties.js:
* test262/test/built-ins/Function/prototype/restricted-property-arguments.js:
* test262/test/built-ins/Function/prototype/restricted-property-caller.js:
* test262/test/built-ins/Object/prototype/toString/proxy-function-async.js: Added.
(asyncProxy.new.Proxy.async):
* test262/test/built-ins/Object/prototype/toString/proxy-function.js:
(asyncProxy.new.Proxy.async):
* test262/test/built-ins/Object/prototype/toString/symbol-tag-non-str-builtin.js: Added.
(setIter.set Symbol):
(set defaultTag):
(gen):
(get return):
(set new):
* test262/test/built-ins/Object/prototype/toString/symbol-tag-non-str-proxy-function.js: Added.
(generatorProxy.new.Proxy):
(asyncProxy.new.Proxy.async):
* test262/test/built-ins/Object/subclass-object-arg.js:
* test262/test/built-ins/Promise/all/invoke-resolve-get-error-close.js:
* test262/test/built-ins/Promise/all/resolve-element-function-name.js:
* test262/test/built-ins/Promise/allSettled/invoke-resolve-get-error-close.js:
* test262/test/built-ins/Promise/allSettled/reject-element-function-name.js:
* test262/test/built-ins/Promise/allSettled/resolve-element-function-name.js:
* test262/test/built-ins/Promise/executor-function-name.js:
* test262/test/built-ins/Promise/race/invoke-resolve-get-error-close.js:
* test262/test/built-ins/Promise/reject-function-name.js:
* test262/test/built-ins/Promise/resolve-function-name.js:
* test262/test/built-ins/Set/prototype/values/does-not-have-setdata-internal-slot-weakset.js:
* test262/test/built-ins/WeakRef/constructor.js: Added.
* test262/test/built-ins/WeakRef/instance-extensible.js: Added.
* test262/test/built-ins/WeakRef/length.js: Added.
* test262/test/built-ins/WeakRef/name.js: Added.
* test262/test/built-ins/WeakRef/newtarget-prototype-is-not-object.js: Added.
(newTarget):
* test262/test/built-ins/WeakRef/prop-desc.js: Added.
* test262/test/built-ins/WeakRef/proto-from-ctor-realm.js: Added.
* test262/test/built-ins/WeakRef/proto.js: Added.
* test262/test/built-ins/WeakRef/prototype-from-newtarget-abrupt.js: Added.
(newTarget):
* test262/test/built-ins/WeakRef/prototype-from-newtarget-custom.js: Added.
(newTarget):
* test262/test/built-ins/WeakRef/prototype-from-newtarget.js: Added.
* test262/test/built-ins/WeakRef/prototype/Symbol.toStringTag.js: Added.
* test262/test/built-ins/WeakRef/prototype/constructor.js: Added.
* test262/test/built-ins/WeakRef/prototype/deref/custom-this.js: Added.
* test262/test/built-ins/WeakRef/prototype/deref/gc-cleanup-not-prevented-with-wr-deref.js: Added.
(emptyCells):
* test262/test/built-ins/WeakRef/prototype/deref/length.js: Added.
* test262/test/built-ins/WeakRef/prototype/deref/name.js: Added.
* test262/test/built-ins/WeakRef/prototype/deref/prop-desc.js: Added.
* test262/test/built-ins/WeakRef/prototype/deref/return-target.js: Added.
* test262/test/built-ins/WeakRef/prototype/deref/this-does-not-have-internal-target-throws.js: Added.
(fg.new.FinalizationGroup):
* test262/test/built-ins/WeakRef/prototype/deref/this-not-object-throws.js: Added.
* test262/test/built-ins/WeakRef/prototype/prop-desc.js: Added.
* test262/test/built-ins/WeakRef/prototype/proto.js: Added.
* test262/test/built-ins/WeakRef/returns-new-object-from-constructor.js: Added.
(let.key.of.Object.getOwnPropertyNames):
(set for):
* test262/test/built-ins/WeakRef/target-not-object-throws.js: Added.
* test262/test/built-ins/WeakRef/undefined-newtarget-throws.js: Added.
* test262/test/intl402/BigInt/prototype/toLocaleString/builtin.js:
* test262/test/intl402/BigInt/prototype/toLocaleString/default-options-object-prototype.js:
* test262/test/intl402/BigInt/prototype/toLocaleString/length.js:
* test262/test/intl402/BigInt/prototype/toLocaleString/returns-same-results-as-NumberFormat.js:
* test262/test/intl402/BigInt/prototype/toLocaleString/taint-Intl-NumberFormat.js:
* test262/test/intl402/BigInt/prototype/toLocaleString/this-value-invalid.js:
* test262/test/intl402/BigInt/prototype/toLocaleString/throws-same-exceptions-as-NumberFormat.js:
* test262/test/intl402/DateTimeFormat/constructor-options-order-quarter.js: Removed.
* test262/test/intl402/DateTimeFormat/constructor-options-quarter-invalid.js: Removed.
* test262/test/intl402/DateTimeFormat/constructor-options-quarter-valid.js: Removed.
* test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-long-en.js: Added.
* test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-narrow-en.js: Added.
* test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-short-en.js: Added.
* test262/test/intl402/DateTimeFormat/prototype/format/fractionalSecondDigits.js: Added.
* test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-date-string.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-near-time-boundaries.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-to-integer.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRange/builtin.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRange/prop-desc.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-date-string.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-near-time-boundaries.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-to-integer.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/builtin.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/prop-desc.js:
* test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-long-en.js: Added.
(assertParts):
(assertPartsNumeric):
* test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-narrow-en.js: Added.
(assertParts):
(assertPartsNumeric):
* test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-short-en.js: Added.
(assertParts):
(assertPartsNumeric):
* test262/test/intl402/DateTimeFormat/prototype/formatToParts/fractionalSecondDigits.js: Added.
(assertParts):
* test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/order-quarter.js: Removed.
* test262/test/intl402/DateTimeFormat/taint-Object-prototype-quarter.js: Removed.
* test262/test/intl402/RelativeTimeFormat/prototype/format/en-us-numeric-auto.js:
* test262/test/intl402/RelativeTimeFormat/prototype/formatToParts/en-us-numeric-auto.js:
* test262/test/language/expressions/arrow-function/ArrowFunction_restricted-properties.js:
* test262/test/language/expressions/class/elements/private-field-access-on-inner-arrow-function.js: Added.
(C.prototype.method):
* test262/test/language/expressions/class/elements/private-field-access-on-inner-function.js: Added.
(C.prototype.method.innerFunction):
(C.prototype.method):
* test262/test/language/expressions/class/elements/private-getter-access-on-inner-arrow-function.js: Added.
(C):
(C.method):
* test262/test/language/expressions/class/elements/private-getter-access-on-inner-function.js: Added.
(C):
(C.method.innerFunction):
(C.method):
* test262/test/language/expressions/class/elements/private-getter-is-not-a-own-property.js: Added.
(C):
(C.checkPrivateGetter):
* test262/test/language/expressions/class/elements/private-method-access-on-inner-arrow-function.js: Added.
(C):
(C.method):
* test262/test/language/expressions/class/elements/private-method-access-on-inner-function.js: Added.
(C):
(C.method.innerFunction):
(C.method):
* test262/test/language/expressions/class/elements/private-method-is-not-a-own-property.js: Added.
(C):
(C.checkPrivateMethod):
* test262/test/language/expressions/class/elements/private-setter-access-on-inner-arrow-function.js: Added.
(C):
(C.method):
* test262/test/language/expressions/class/elements/private-setter-access-on-inner-function.js: Added.
(C):
(C.method.innerFunction):
(C.method):
* test262/test/language/expressions/class/elements/private-setter-is-not-a-own-property.js: Added.
(C):
(C.checkPrivateSetter):
* test262/test/language/expressions/class/elements/prod-private-getter-before-super-return-in-field-initializer.js:
* test262/test/language/expressions/class/elements/prod-private-method-before-super-return-in-field-initializer.js:
* test262/test/language/expressions/class/elements/prod-private-setter-before-super-return-in-field-initializer.js:
* test262/test/language/expressions/class/poisoned-underscore-proto.js: Added.
* test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(let.classStringExpression):
(let.classStringExpression.access):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(let.classStringExpression):
(let.classStringExpression.access):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(const.C):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(let.classStringExpression.return.prototype.m):
(let.classStringExpression.return.prototype.access):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(let.classStringExpression.return.prototype.m):
(let.classStringExpression.return.prototype.access):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(let.classStringExpression):
(let.classStringExpression.access):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(let.classStringExpression.prototype.m):
(let.classStringExpression.prototype.access):
(let.classStringExpression):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(let.classStringExpression.prototype.m):
(let.classStringExpression.prototype.access):
(let.classStringExpression):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(const.C):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(let.classStringExpression.return.C.prototype.m):
(let.classStringExpression.return.C.prototype.access):
(let.classStringExpression.return.C):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(let.classStringExpression.return.C.prototype.m):
(let.classStringExpression.return.C.prototype.access):
(let.classStringExpression.return.C):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(let.classStringExpression):
(let.classStringExpression.access):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(let.classStringExpression):
(let.classStringExpression.access):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(let.classStringExpression):
(let.classStringExpression.access):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(const.C):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(let.classStringExpression.return.prototype.m):
(let.classStringExpression.return.prototype.access):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(let.classStringExpression.return.prototype.m):
(let.classStringExpression.return.prototype.access):
(let.createAndInstantiateClass):
* test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
(let.classStringExpression):
(let.classStringExpression.access):
(let.createAndInstantiateClass):
* test262/test/language/expressions/new.target/unary-expr.js: Added.
(new):
(async):
* test262/test/language/expressions/super/call-poisoned-underscore-proto.js: Added.
(A):
* test262/test/language/expressions/super/prop-poisoned-underscore-proto.js: Added.
* test262/test/language/identifiers/vals-cjk-escaped.js: Added.
* test262/test/language/identifiers/vals-cjk.js: Added.
* test262/test/language/statements/class/elements/private-class-field-on-frozen-objects.js:
* test262/test/language/statements/class/elements/private-field-access-on-inner-arrow-function.js: Added.
(C.prototype.method):
(C):
* test262/test/language/statements/class/elements/private-field-access-on-inner-function.js: Added.
(C.prototype.method.innerFunction):
(C.prototype.method):
(C):
* test262/test/language/statements/class/elements/private-field-is-not-clobbered-by-computed-property.js: Added.
(C.prototype.checkPrivateField):
(C):
* test262/test/language/statements/class/elements/private-field-visible-to-direct-eval-on-initializer.js: Added.
(C):
* test262/test/language/statements/class/elements/private-field-visible-to-direct-eval.js: Added.
(C.prototype.getWithEval):
(C):
(D):
* test262/test/language/statements/class/elements/private-getter-access-on-inner-arrow-function.js: Added.
(C.prototype.get m):
(C.prototype.method):
(C):
* test262/test/language/statements/class/elements/private-getter-access-on-inner-function.js: Added.
(C.prototype.get m):
(C.prototype.method.innerFunction):
(C.prototype.method):
(C):
* test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js:
(let.createAndInstantiateClass):
* test262/test/language/statements/class/elements/private-getter-is-not-a-own-property.js: Added.
(C.prototype.get m):
(C.prototype.checkPrivateGetter):
(C):
* test262/test/language/statements/class/elements/private-getter-is-not-clobbered-by-computed-property.js: Added.
(C.prototype.get m):
(C.prototype.checkPrivateGetter):
(C):
* test262/test/language/statements/class/elements/private-getter-visible-to-direct-eval-on-initializer.js: Added.
(C.prototype.get m):
(C):
* test262/test/language/statements/class/elements/private-getter-visible-to-direct-eval.js: Added.
(C.prototype.get m):
(C.prototype.getWithEval):
(C):
(D.prototype.get m):
(D):
* test262/test/language/statements/class/elements/private-method-access-on-inner-arrow-function.js: Added.
(C.prototype.m):
(C.prototype.method):
(C):
* test262/test/language/statements/class/elements/private-method-access-on-inner-function.js: Added.
(C.prototype.m):
(C.prototype.method.innerFunction):
(C.prototype.method):
(C):
* test262/test/language/statements/class/elements/private-method-is-not-a-own-property.js: Added.
(C.prototype.m):
(C.prototype.checkPrivateMethod):
(C):
* test262/test/language/statements/class/elements/private-method-is-not-clobbered-by-computed-property.js: Added.
(C.prototype.m):
(C.prototype.checkPrivateMethod):
(C):
* test262/test/language/statements/class/elements/private-method-visible-to-direct-eval-on-initializer.js: Added.
(C.prototype.m):
(C):
* test262/test/language/statements/class/elements/private-method-visible-to-direct-eval.js: Added.
(C.prototype.m):
(C.prototype.getWithEval):
(C):
(D.prototype.m):
(D):
* test262/test/language/statements/class/elements/private-setter-access-on-inner-arrow-function.js: Added.
(C.prototype.set m):
(C.prototype.method):
(C):
* test262/test/language/statements/class/elements/private-setter-access-on-inner-function.js: Added.
(C.prototype.set m):
(C.prototype.method.innerFunction):
(C.prototype.method):
(C):
* test262/test/language/statements/class/elements/private-setter-is-not-a-own-property.js: Added.
(C.prototype.set m):
(C.prototype.checkPrivateSetter):
(C):
* test262/test/language/statements/class/elements/private-setter-is-not-clobbered-by-computed-property.js: Added.
(C.prototype.set m):
(C.prototype.checkPrivateSetter):
(C):
* test262/test/language/statements/class/elements/private-setter-visible-to-direct-eval-on-initializer.js: Added.
(C.prototype.set m):
(C):
* test262/test/language/statements/class/elements/private-setter-visible-to-direct-eval.js: Added.
(C.prototype.set m):
(C.prototype.setWithEval):
(C):
(D.prototype.set m):
(D):
* test262/test/language/statements/class/elements/prod-private-getter-before-super-return-in-field-initializer.js:
* test262/test/language/statements/class/elements/prod-private-method-before-super-return-in-field-initializer.js:
* test262/test/language/statements/class/elements/prod-private-setter-before-super-return-in-field-initializer.js:
* test262/test/language/statements/class/elements/super-access-inside-a-private-getter.js: Added.
(A.prototype.method):
(A):
(C.prototype.get m):
(C.prototype.access):
(C):
* test262/test/language/statements/class/elements/super-access-inside-a-private-method.js: Added.
(A.prototype.method):
(A):
(C.prototype.m):
(C.prototype.access):
(C):
* test262/test/language/statements/class/elements/super-access-inside-a-private-setter.js: Added.
(A.prototype.method):
(A):
(C.prototype.set m):
(C.prototype.access):
(C):
* test262/test/language/statements/class/poisoned-underscore-proto.js: Added.
(A):
* test262/test/language/statements/function/13.2-30-s.js:
* test262/test262-Revision.txt:
2019-07-15 Yusuke Suzuki <[email protected]>
[JSC] Improve wasm wpt test results by fixing miscellaneous issues
https://bugs.webkit.org/show_bug.cgi?id=199783
Reviewed by Mark Lam.
Fix our spec tests.
* wasm/js-api/Module-compile.js:
* wasm/js-api/test_basic_api.js:
(const.c.in.constructorProperties.switch):
* wasm/js-api/validate.js:
* wasm/js-api/web-assembly-instantiate.js:
* wasm/spec-tests/jsapi.js:
(testJSAPI.get test):
(testJSAPI.set test):
2019-07-15 Michael Catanzaro <[email protected]>
Unreviewed, rolling out r247440.
Broke builds
Reverted changeset:
"[JSC] Improve wasm wpt test results by fixing miscellaneous
issues"
https://bugs.webkit.org/show_bug.cgi?id=199783
https://trac.webkit.org/changeset/247440
2019-07-15 Yusuke Suzuki <[email protected]>
[JSC] Improve wasm wpt test results by fixing miscellaneous issues
https://bugs.webkit.org/show_bug.cgi?id=199783
Reviewed by Mark Lam.
Fix our spec tests.
* wasm/js-api/Module-compile.js:
* wasm/js-api/test_basic_api.js:
(const.c.in.constructorProperties.switch):
* wasm/js-api/validate.js:
* wasm/js-api/web-assembly-instantiate.js:
* wasm/spec-tests/jsapi.js:
(testJSAPI.get test):
(testJSAPI.set test):
2019-07-12 Justin Michaud <[email protected]>
B3 should reduce (integer) Sub(Neg(x), y) to Neg(Add(x, y))
https://bugs.webkit.org/show_bug.cgi?id=196371
Reviewed by Keith Miller.
* microbenchmarks/mul-immediate-sub.js: Added.
(doTest):
2019-07-12 Caio Lima <[email protected]>
[BigInt] Add ValueBitLShift into DFG
https://bugs.webkit.org/show_bug.cgi?id=192664
Reviewed by Saam Barati.
We are adding tests to cover ValueBitwise operations AI changes.
* stress/big-int-left-shift-untyped.js: Added.
* stress/bit-op-with-object-returning-int32.js:
* stress/value-bit-and-ai-rule.js: Added.
* stress/value-bit-lshift-ai-rule.js: Added.
* stress/value-bit-or-ai-rule.js: Added.
* stress/value-bit-xor-ai-rule.js: Added.
2019-07-11 Justin Michaud <[email protected]>
Add b3 macro lowering for CheckMul on arm64
https://bugs.webkit.org/show_bug.cgi?id=199251
Reviewed by Robin Morisset.
* microbenchmarks/check-mul-constant.js: Added.
(doTest):
* microbenchmarks/check-mul-no-constant.js: Added.
(doTest):
* microbenchmarks/check-mul-power-of-two.js: Added.
(doTest):
2019-07-10 Tadeu Zagallo <[email protected]>
Optimize join of large empty arrays
https://bugs.webkit.org/show_bug.cgi?id=199636
Reviewed by Mark Lam.
* microbenchmarks/large-empty-array-join.js: Added.
* microbenchmarks/large-empty-array-join-resolve-rope.js: Added.
2019-07-06 Michael Saboff <[email protected]>
switch(String) needs to check for exceptions when resolving the string
https://bugs.webkit.org/show_bug.cgi?id=199541
Reviewed by Mark Lam.
New tests.
* stress/switch-string-oom.js: Added.
(test):
(testLowerTiers):
(testFTL):
2019-07-05 Mark Lam <[email protected]>
ArgumentsEliminationPhase::eliminateCandidatesThatInterfere() should not decrement nodeIndex pass zero.
https://bugs.webkit.org/show_bug.cgi?id=199533
<rdar://problem/52669111>
Reviewed by Filip Pizlo.
* stress/ArgumentsEliminationPhase-eliminateCandidatesThatEscape-should-not-decrement-nodeIndex-pass-zero.js: Added.
2019-07-05 Alexey Shvayka <[email protected]>
[JSC] Clean up ArraySpeciesCreate
https://bugs.webkit.org/show_bug.cgi?id=182434
Reviewed by Yusuke Suzuki.
Adjusts error message expectations in stress tests.
* stress/array-flatmap.js:
* stress/array-flatten.js:
* stress/array-species-create-should-handle-masquerader.js:
* test262/expectations.yaml: Mark 4 test cases as passing.
2019-07-02 Michael Saboff <[email protected]>
Exception from For..of loop assignment eliminates TDZ checks in subsequent code
https://bugs.webkit.org/show_bug.cgi?id=199395
Reviewed by Filip Pizlo.
New regession test.
* stress/for-of-tdz-with-try-catch.js: Added.
(test):
(i.catch):
2019-07-02 Keith Miller <[email protected]>
Frozen Arrays length assignment should throw in strict mode
https://bugs.webkit.org/show_bug.cgi?id=199365
Reviewed by Yusuke Suzuki.
* stress/frozen-array-length-should-throw-strict.js: Added.
(test):
2019-07-01 Justin Michaud <[email protected]>
[Wasm-References] Disable references by default
https://bugs.webkit.org/show_bug.cgi?id=199390
Reviewed by Saam Barati.
* wasm/references-spec-tests/ref_is_null.js:
* wasm/references-spec-tests/ref_null.js:
* wasm/references/anyref_globals.js:
* wasm/references/anyref_modules.js:
* wasm/references/anyref_table.js:
* wasm/references/anyref_table_import.js:
* wasm/references/element_parsing.js:
* wasm/references/func_ref.js:
* wasm/references/is_null.js:
* wasm/references/multitable.js:
* wasm/references/table_misc.js:
* wasm/references/validation.js:
2019-07-01 Ryan Haddad <[email protected]>
Unreviewed, rolling out r246946.
Caused JSC test crashes on arm64
Reverted changeset:
"Add b3 macro lowering for CheckMul on arm64"
https://bugs.webkit.org/show_bug.cgi?id=199251
https://trac.webkit.org/changeset/246946
2019-06-28 Justin Michaud <[email protected]>
Add b3 macro lowering for CheckMul on arm64
https://bugs.webkit.org/show_bug.cgi?id=199251
Reviewed by Robin Morisset.
* microbenchmarks/check-mul-constant.js: Added.
(doTest):
* microbenchmarks/check-mul-no-constant.js: Added.
(doTest):
* microbenchmarks/check-mul-power-of-two.js: Added.
(doTest):
2019-06-26 Keith Miller <[email protected]>
speciesConstruct needs to throw if the result is a DataView
https://bugs.webkit.org/show_bug.cgi?id=199231
Reviewed by Mark Lam.
* stress/typedarray-filter.js:
(subclasses.forEach):
* stress/typedarray-map.js:
(subclasses.forEach):
* stress/typedarray-slice.js:
(typedArrays.forEach):
* stress/typedarray-subarray.js:
(subclasses.forEach):
2019-06-24 Commit Queue <[email protected]>
Unreviewed, rolling out r246714.
https://bugs.webkit.org/show_bug.cgi?id=199179
revert to do patch in a different way. (Requested by keith_mi_
on #webkit).
Reverted changeset:
"All prototypes should call didBecomePrototype()"
https://bugs.webkit.org/show_bug.cgi?id=196315
https://trac.webkit.org/changeset/246714
2019-06-24 Alexey Shvayka <[email protected]>
Add Array.prototype.{flat,flatMap} to unscopables
https://bugs.webkit.org/show_bug.cgi?id=194322
Reviewed by Keith Miller.
* stress/unscopables.js: Fix test.
* test262/expectations.yaml: Mark 2 test cases as passing.
2019-06-21 Mark Lam <[email protected]>
ArraySlice needs to keep the source array alive.
https://bugs.webkit.org/show_bug.cgi?id=197374
<rdar://problem/50304429>
Reviewed by Michael Saboff and Filip Pizlo.
* stress/array-slice-must-keep-source-array-alive.js: Added.
2019-06-22 Robin Morisset <[email protected]> and Yusuke Suzuki <[email protected]>
All prototypes should call didBecomePrototype()
https://bugs.webkit.org/show_bug.cgi?id=196315
Reviewed by Saam Barati.
* stress/function-prototype-indexed-accessor.js: Added.
2019-06-22 Yusuke Suzuki <[email protected]>
[JSC] Strict, Sloppy and Arrow functions should have different classInfo
https://bugs.webkit.org/show_bug.cgi?id=197631
Reviewed by Saam Barati.
* stress/has-own-property-arguments.js: Added.
(shouldBe):
(A):
2019-06-22 Yusuke Suzuki <[email protected]>
[JSC] ClassExpr should not store result in the middle of evaluation
https://bugs.webkit.org/show_bug.cgi?id=199106
Reviewed by Tadeu Zagallo.
* stress/class-expression-should-store-result-at-last.js: Added.
(shouldThrow):
(shouldThrow.let.a):
2019-06-20 Justin Michaud <[email protected]>
[WASM-References] Add extra tests for Wasm references + fix element parsing and subtyping bugs
https://bugs.webkit.org/show_bug.cgi?id=199044
Reviewed by Saam Barati.
Add wasm references spec tests as well as a worker test.
* wasm.yaml:
* wasm/Builder_WebAssemblyBinary.js:
(const.emitters.Element):
* wasm/js-api/element.js:
(assert.throws.new.WebAssembly.Module.builder.WebAssembly):
* wasm/references-spec-tests/ref_is_null.js: Added.
(hostref):
(is_hostref):
(is_funcref):
(eq_ref):
(let.handler.get target):
(register):
(module):
(instance):
(call):
(get instance):
(exports):
(run):
(assert_malformed):
(assert_invalid):
(assert_unlinkable):
(assert_uninstantiable):
(assert_trap):
(try.f):
(catch):
(assert_exhaustion):
(assert_return):
(assert_return_canonical_nan):
(assert_return_arithmetic_nan):
(assert_return_ref):
(assert_return_func):
* wasm/references-spec-tests/ref_null.js: Added.
(hostref):
(is_hostref):
(is_funcref):
(eq_ref):
(let.handler.get target):
(register):
(module):
(instance):
(call):
(get instance):
(exports):
(run):
(assert_malformed):
(assert_invalid):
(assert_unlinkable):
(assert_uninstantiable):
(assert_trap):
(try.f):
(catch):
(assert_exhaustion):
(assert_return):
(assert_return_canonical_nan):
(assert_return_arithmetic_nan):
(assert_return_ref):
(assert_return_func):
* wasm/references/element_parsing.js: Added.
(module):
* wasm/references/func_ref.js:
* wasm/references/multitable.js:
* wasm/references/table_misc.js:
(TableSize.0.End.End.WebAssembly):
* wasm/references/validation.js:
(assert.throws):
2019-06-19 Alexey Shvayka <[email protected]>
Optimize `resolve` method lookup in Promise static methods
https://bugs.webkit.org/show_bug.cgi?id=198864
Reviewed by Yusuke Suzuki.
* test262/expectations.yaml: Mark 18 test cases as passing.
2019-06-19 Justin Michaud <[email protected]>
[WASM-References] Rename anyfunc to funcref
https://bugs.webkit.org/show_bug.cgi?id=198983
Reviewed by Yusuke Suzuki.
* wasm/function-tests/basic-element.js:
* wasm/function-tests/context-switch.js:
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
(makeInstance):
(assert.eq.makeInstance):
* wasm/function-tests/exceptions.js:
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
* wasm/function-tests/grow-memory-2.js:
(assert.eq.instance.exports.foo):
* wasm/function-tests/nameSection.js:
(const.compile):
* wasm/function-tests/stack-overflow.js:
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
(assertOverflows.makeInstance):
* wasm/function-tests/table-basic-2.js:
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
* wasm/function-tests/table-basic.js:
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
* wasm/function-tests/trap-from-start-async.js:
* wasm/function-tests/trap-from-start.js:
* wasm/js-api/Module.exports.js:
(assert.truthy):
* wasm/js-api/Module.imports.js:
(assert.truthy):
* wasm/js-api/call-indirect.js:
(const.oneTable):
(const.multiTable):
(multiTable.const.makeTable):
(multiTable):
(multiTable.Polyphic2Import):
(multiTable.VirtualImport):
* wasm/js-api/element-data.js:
* wasm/js-api/element.js:
(assert.throws.new.WebAssembly.Module.builder.WebAssembly):
(assert.throws):
(badInstantiation.makeModule):
(badInstantiation.test):
(badInstantiation):
* wasm/js-api/extension-MemoryMode.js:
* wasm/js-api/table.js:
(new.WebAssembly.Module):
(assert.throws):
(assertBadTableImport):
(assert.throws.WebAssembly.Table.prototype.grow):
(new.WebAssembly.Table):
(assertBadTable):
(assert.truthy):
* wasm/js-api/test_basic_api.js:
(const.c.in.constructorProperties.switch):
* wasm/js-api/unique-signature.js:
(CallIndirectWithDuplicateSignatures):
* wasm/js-api/wrapper-function.js:
* wasm/modules/table.wat:
* wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat:
* wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat:
* wasm/modules/wasm-imports-wasm-exports/imports.wat:
* wasm/modules/wasm-imports-wasm-exports/sum.wat:
* wasm/references/anyref_table.js:
* wasm/references/anyref_table_import.js:
(doSet):
(assert.throws):
* wasm/references/func_ref.js:
(makeFuncrefIdent):
(assert.eq.instance.exports.fix):
(GetLocal.0.I32Const.0.TableSet.0.End.End.WebAssembly.assert.throws):
(GetLocal.0.I32Const.0.TableSet.0.End.End.WebAssembly):
(let.importedFun.of):
(makeAnyfuncIdent): Deleted.
(makeAnyfuncIdent.fun): Deleted.
* wasm/references/multitable.js:
(assert.eq):
(assert.throws):
* wasm/references/table_misc.js:
(GetLocal.0.TableFill.0.End.End.WebAssembly):
* wasm/references/validation.js:
(assert.throws.new.WebAssembly.Module.bin):
(assert.throws):
* wasm/spec-harness/index.js:
* wasm/spec-harness/wasm-constants.js:
* wasm/spec-harness/wasm-module-builder.js:
(WasmModuleBuilder.prototype.toArray):
* wasm/spec-harness/wast.js:
(elem_type):
(string_of_elem_type):
(string_of_table_type):
* wasm/spec-tests/jsapi.js:
* wasm/stress/wasm-table-grow-initialize.js:
* wasm/wasm.json:
2019-06-18 Justin Michaud <[email protected]>
[WASM-References] Add support for Table.size, grow and fill instructions
https://bugs.webkit.org/show_bug.cgi?id=198761
Reviewed by Yusuke Suzuki.
* wasm/Builder_WebAssemblyBinary.js:
(const.putOp):
* wasm/references/table_misc.js: Added.
(TableSize.End.End.WebAssembly):
(GetLocal.0.GetLocal.1.TableGrow.End.End.WebAssembly):
* wasm/wasm.json:
2019-06-18 Justin Michaud <[email protected]>
[WASM-References] Add support for multiple tables
https://bugs.webkit.org/show_bug.cgi?id=198760
Reviewed by Saam Barati.
* wasm/Builder.js:
* wasm/js-api/call-indirect.js:
(const.oneTable):
(const.multiTable):
(multiTable):
(multiTable.Polyphic2Import):
(multiTable.VirtualImport):
(const.wasmModuleWhichImportJS): Deleted.
(const.makeTable): Deleted.
(): Deleted.
(Polyphic2Import): Deleted.
(VirtualImport): Deleted.
* wasm/js-api/table.js:
(new.WebAssembly.Module):
(assert.throws):
(assertBadTableImport):
(assert.truthy):
(assert.throws.new.WebAssembly.Module.builder.WebAssembly): Deleted.
* wasm/references/anyref_table.js:
* wasm/references/anyref_table_import.js:
(makeImport):
(string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport):
(string_appeared_here.fullGC.assert.eq.1.exports.get_tbl):
* wasm/references/multitable.js: Added.
(assert.throws.1.exports.set_tbl0):
(assert.throws):
(assert.eq):
* wasm/references/validation.js:
(assert.throws.new.WebAssembly.Module.bin):
(assert.throws):
* wasm/spec-tests/imports.wast.js:
* wasm/wasm.json:
* wasm/Builder.js:
* wasm/js-api/call-indirect.js:
(const.oneTable):
(const.multiTable):
(multiTable):
(multiTable.Polyphic2Import):
(multiTable.VirtualImport):
(const.wasmModuleWhichImportJS): Deleted.
(const.makeTable): Deleted.
(): Deleted.
(Polyphic2Import): Deleted.
(VirtualImport): Deleted.
* wasm/js-api/table.js:
(new.WebAssembly.Module):
(assert.throws):
(assertBadTableImport):
(assert.truthy):
(assert.throws.new.WebAssembly.Module.builder.WebAssembly): Deleted.
* wasm/references/anyref_table.js:
* wasm/references/anyref_table_import.js:
(makeImport):
(string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport):
(string_appeared_here.fullGC.assert.eq.1.exports.get_tbl):
* wasm/references/func_ref.js:
(GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.fun): Deleted.
(GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.assert.throws): Deleted.
(GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly): Deleted.
* wasm/references/multitable.js: Added.
(assert.throws.1.exports.set_tbl0):
(assert.throws):
(assert.eq):
(string_appeared_here.tableInsanity):
(I32Const.0.GetLocal.0.TableSet.1.End.End.WebAssembly.):
(I32Const.0.GetLocal.0.TableSet.1.End.End.WebAssembly):
* wasm/references/validation.js:
(assert.throws.new.WebAssembly.Module.bin):
(assert.throws):
* wasm/spec-tests/imports.wast.js:
* wasm/wasm.json:
2019-06-18 Alexey Shvayka <[email protected]>
[ESNExt] String.prototype.matchAll
https://bugs.webkit.org/show_bug.cgi?id=186694
Reviewed by Yusuke Suzuki.
Implement String.prototype.matchAll.
(https://tc39.es/ecma262/#sec-string.prototype.matchall)
* test262/config.yaml:
2019-06-18 Tadeu Zagallo <[email protected]>
DFG code should not reify the names of builtin functions with private names
https://bugs.webkit.org/show_bug.cgi?id=198849
<rdar://problem/51733890>
Reviewed by Filip Pizlo.
* stress/builtin-private-function-name.js: Added.
(then):
(PromiseLike):
2019-06-18 Keith Miller <[email protected]>
MaybeParseAsGeneratorForScope sometimes loses track of its scope ref
https://bugs.webkit.org/show_bug.cgi?id=198969
<rdar://problem/51620714>
Reviewed by Tadeu Zagallo.
* stress/nested-yield-in-arrow-function-should-be-a-syntax-error.js: Added.
(catch):
2019-06-17 Justin Michaud <[email protected]>
Validate that table element type is funcref if using an element section
https://bugs.webkit.org/show_bug.cgi?id=198910
Reviewed by Yusuke Suzuki.
* wasm/references/anyref_table.js:
2019-06-17 Yusuke Suzuki <[email protected]>
[JSC] Introduce DisposableCallSiteIndex to enforce type-safety
https://bugs.webkit.org/show_bug.cgi?id=197378
Reviewed by Saam Barati.
* stress/disposable-call-site-index-with-call-and-this.js: Added.
(foo):
(bar):
* stress/disposable-call-site-index.js: Added.
(foo):
(bar):
2019-06-17 Justin Michaud <[email protected]>
[WASM-References] Add support for Funcref in parameters and return types
https://bugs.webkit.org/show_bug.cgi?id=198157
Reviewed by Yusuke Suzuki.
* wasm/Builder.js:
(export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
* wasm/references/anyref_globals.js:
* wasm/references/func_ref.js: Added.
(fullGC.gc.makeExportedFunction):
(makeExportedIdent):
(makeAnyfuncIdent):
(fun):
(assert.eq.instance.exports.fix.fun):
(assert.eq.instance.exports.fix):
(string_appeared_here.End.End.Function.End.Code.End.WebAssembly.imp.ref):
(string_appeared_here.End.End.Function.End.Code.End.WebAssembly):
(GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.fun):
(GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.assert.throws):
(GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly):
(assert.throws):
(assert.throws.doTest):
(let.importedFun.of):
(makeAnyfuncIdent.fun):
* wasm/references/validation.js:
(assert.throws):
* wasm/wasm.json:
2019-06-17 Ross Kirsling <[email protected]>
Update test262 tests (2019.06.13)
https://bugs.webkit.org/show_bug.cgi?id=198821
Reviewed by Konstantin Tokarev.
* test262/expectations.yaml:
* test262/harness/:
* test262/latest-changes-summary.txt:
* test262/test/:
* test262/test262-Revision.txt:
2019-06-16 Yusuke Suzuki <[email protected]>
[JSC] Grown region of WasmTable should be initialized with null
https://bugs.webkit.org/show_bug.cgi?id=198903
Reviewed by Saam Barati.
* wasm/stress/wasm-table-grow-initialize.js: Added.
(shouldBe):
2019-06-13 Yusuke Suzuki <[email protected]>
Yarr bytecode compilation failure should be gracefully handled
https://bugs.webkit.org/show_bug.cgi?id=198700
Reviewed by Michael Saboff.
* stress/regexp-bytecode-compilation-fail.js: Added.
(shouldThrow):
2019-06-12 Yusuke Suzuki <[email protected]>
[JSC] Polymorphic call stub's slow path should restore callee saves before performing tail call
https://bugs.webkit.org/show_bug.cgi?id=198770
Reviewed by Saam Barati.
* stress/poly-call-stub-slow-path-should-restore-callee-saves-when-doing-tail-call.js: Added.
(test):
2019-06-11 Alexey Shvayka <[email protected]>
JSC should throw if proxy set returns falsish in strict mode context
https://bugs.webkit.org/show_bug.cgi?id=177398
Reviewed by Yusuke Suzuki.
1. Add coverage for Proxy `set` trap returning falsy value in strict mode.
2. RegExp methods throw unless [[Set]] succeeds. Return `true` from Proxy `set` traps to fix the tests.
* stress/proxy-set.js: Add 2 test cases.
* stress/regexp-match-proxy.js: Fix test.
* stress/regexp-replace-proxy.js: Fix test.
2019-06-11 Alexey Shvayka <[email protected]>
Error message for non-callable Proxy `construct` trap is misleading
https://bugs.webkit.org/show_bug.cgi?id=198637
Reviewed by Saam Barati.
* stress/proxy-construct.js:
2019-06-10 Tadeu Zagallo <[email protected]>
AI BitURShift's result should not be unsigned
https://bugs.webkit.org/show_bug.cgi?id=198689
<rdar://problem/51550063>
Reviewed by Saam Barati.
* stress/urshift-int32-overflow.js: Added.
(foo.):
(foo):
2019-06-11 Guillaume Emont <[email protected]>
Skip stress/ftl-gettypedarrayoffset-wasteful.js on Arm/Linux
Unreviewed gardening.
* stress/ftl-gettypedarrayoffset-wasteful.js:
Skipped on arm/linux as it always times out on the bot since a change
between r246270 and r246278 inclusive.
2019-06-10 Yusuke Suzuki <[email protected]>
[JSC] UnlinkedCodeBlock should be eventually jettisoned in VM mini mode
https://bugs.webkit.org/show_bug.cgi?id=198023
Reviewed by Saam Barati.
* stress/reparsing-unlinked-codeblock.js: Added.
(shouldBe):
(hello):
2019-06-09 Yusuke Suzuki <[email protected]>
[JSC] Use mergePrediction in ValuePow prediction propagation
https://bugs.webkit.org/show_bug.cgi?id=198648
Reviewed by Saam Barati.
* stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js: Added.
2019-06-07 Tadeu Zagallo <[email protected]>
AI should get GetterSetter structure from the base's GlobalObject for GetGetterSetterByOffset
https://bugs.webkit.org/show_bug.cgi?id=198581
<rdar://problem/51099753>
Reviewed by Saam Barati.
* stress/global-object-proto-getter.js: Added.
(f):
(test):
2019-06-05 Justin Michaud <[email protected]>
[WASM-References] Add support for Anyref tables, Table.get and Table.set (for Anyref only).
https://bugs.webkit.org/show_bug.cgi?id=198398
Reviewed by Saam Barati.
* wasm/references/anyref_table.js: Added.
(string_appeared_here.doGCSet):
(doGCTest):
(doGCSet.doGCTest.let.count.0.doBarrierSet):
* wasm/references/anyref_table_import.js: Added.
(makeImport):
(string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport):
(string_appeared_here.fullGC.assert.eq.1.exports.get_tbl):
* wasm/references/is_null_error.js: Removed.
* wasm/references/validation.js: Added.
(assert.throws.new.WebAssembly.Module.bin):
(assert.throws):
* wasm/wasm.json:
2019-06-05 Justin Michaud <[email protected]>
WebAssembly: pow functions returns 0 when exponent 1.0 or -1.0
https://bugs.webkit.org/show_bug.cgi?id=198106
Reviewed by Saam Barati.
* wasm/regress/selectf64.js: Added.
* wasm/regress/selectf64.wasm: Added.
* wasm/regress/selectf64.wat: Added.
2019-06-04 Tadeu Zagallo <[email protected]>
Argument elimination should check transitive dependents for interference
https://bugs.webkit.org/show_bug.cgi?id=198520
<rdar://problem/50863343>
Reviewed by Filip Pizlo.
* stress/argument-elimination-inline-rest-past-kill.js: Added.
(f2):
(f3):
2019-06-04 Tadeu Zagallo <[email protected]>
Argument elimination should check for negative indices in GetByVal
https://bugs.webkit.org/show_bug.cgi?id=198302
<rdar://problem/51188095>
Reviewed by Filip Pizlo.
* stress/eliminate-arguments-negative-rest-access.js: Added.
(inlinee):
(opt):
2019-06-03 Caio Lima <[email protected]>
[ESNext][BigInt] Implement support for "**"
https://bugs.webkit.org/show_bug.cgi?id=190799
Reviewed by Saam Barati.
* stress/big-int-exp-basic.js: Added.
* stress/big-int-exp-jit-osr.js: Added.
* stress/big-int-exp-jit-untyped.js: Added.
* stress/big-int-exp-jit.js: Added.
* stress/big-int-exp-negative-exponent.js: Added.
* stress/big-int-exp-to-primitive.js: Added.
* stress/big-int-exp-type-error.js: Added.
* stress/big-int-exp-wrapped-value.js: Added.
* stress/value-pow-ai-rule.js: Added.
2019-05-30 Tadeu Zagallo <[email protected]> and Yusuke Suzuki <[email protected]>
[JSC] Implement op_wide16 / op_wide32 and introduce 16bit version bytecode
https://bugs.webkit.org/show_bug.cgi?id=197979
Reviewed by Filip Pizlo.
* stress/16bit-code.js: Added.
(shouldBe):
* stress/32bit-code.js: Added.
(shouldBe):
2019-05-30 Justin Michaud <[email protected]>
oss-fuzz: jsc: Issue 15016: jsc: Abrt in JSC::Wasm::AirIRGenerator::addLocal (15016)
https://bugs.webkit.org/show_bug.cgi?id=198355
Reviewed by Saam Barati.
* wasm/references/is_null.js:
2019-05-30 Stephan Szabo <[email protected]>
[PlayStation] Skip additional tests on PlayStation
https://bugs.webkit.org/show_bug.cgi?id=198352
Reviewed by Don Olmstead.
Skip pow test on PlayStation due to behavior difference in standard library.
Skip incremental marking test due to OOM on PlayStation systems.
* stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js:
* stress/math-pow-with-constants.js:
* stress/pow-with-constants.js:
2019-05-28 Dean Jackson <[email protected]>
Implement Promise.allSettled
https://bugs.webkit.org/show_bug.cgi?id=197600
<rdar://problem/50483885>
Reviewed by Keith Miller.
Start testing Promise.allSettled. We pass most of the tests.
The ones that fail are similar to the Promise.all tests we already fail.
* test262/config.yaml: Remove Promise.allSettled from skipped tests.
* test262/expectations.yaml: Add new expectations for allSettled tests.
2019-05-28 Michael Saboff <[email protected]>
[YARR] Properly handle RegExp's that require large ParenContext space
https://bugs.webkit.org/show_bug.cgi?id=198065
Reviewed by Keith Miller.
New test.
* stress/regexp-large-paren-context.js: Added.
(testLargeRegExp):
2019-05-28 Tadeu Zagallo <[email protected]>
JITOperations putByVal should mark negative array indices as out-of-bounds
https://bugs.webkit.org/show_bug.cgi?id=198271
Reviewed by Saam Barati.
* microbenchmarks/get-by-val-negative-array-index.js:
(foo):
Update the getByVal microbenchmark added in r245769. This now shows that r245769
is 4.2x faster than the previous commit.
* microbenchmarks/put-by-val-negative-array-index.js: Added.
(foo):
2019-05-25 Tadeu Zagallo <[email protected]>
JITOperations getByVal should mark negative array indices as out-of-bounds
https://bugs.webkit.org/show_bug.cgi?id=198229
Reviewed by Saam Barati.
* microbenchmarks/get-by-val-negative-array-index.js: Added.
(foo):
2019-05-24 Justin Michaud <[email protected]>
[WASM-References] Support Anyref in globals
https://bugs.webkit.org/show_bug.cgi?id=198102
Reviewed by Saam Barati.
Add test for anyrefs in globals, as well as adding a new RefNull initExpr for Builder.
* wasm/Builder.js:
(export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
* wasm/Builder_WebAssemblyBinary.js:
(const.putInitExpr):
* wasm/references/anyref_globals.js: Added.
(GetGlobal.0.End.End.WebAssembly):
(5.doGCSet):
(doGCTest):
(doGCSet.doGCTest.let.count.0.doBarrierSet):
2019-05-23 Tadeu Zagallo <[email protected]>
DFG::OSREntry should not perform arity check
https://bugs.webkit.org/show_bug.cgi?id=198189
Reviewed by Saam Barati.
* microbenchmarks/loop-osr-with-arity-mismatch.js: Added.
(foo):
2019-05-23 Stephan Szabo <[email protected]>
[PlayStation] Skip additional tests on PlayStation
https://bugs.webkit.org/show_bug.cgi?id=198145
Reviewed by Ross Kirsling.
* exceptionFuzz.yaml:
Add skip on hostOS playstation
* executableAllocationFuzz.yaml:
Add skip on hostOS playstation
2019-05-23 Tadeu Zagallo <[email protected]>
createListFromArrayLike should throw if value is not an object
https://bugs.webkit.org/show_bug.cgi?id=198138
Reviewed by Yusuke Suzuki.
* stress/create-list-from-array-like-not-object.js: Added.
(testValid):
(testInvalid):
* stress/proxy-get-own-property-names-should-not-clear-previous-results.js:
(opt):
* stress/proxy-proto-enumerator.js: Added.
(main):
* stress/proxy-proto-own-keys.js: Added.
(assert):
(ownKeys):
2019-05-22 Yusuke Suzuki <[email protected]>
[JSC] ArrayAllocationProfile should not access to butterfly in concurrent compiler
https://bugs.webkit.org/show_bug.cgi?id=197809
Reviewed by Michael Saboff.
* stress/array-allocation-profile-should-not-update-itself-in-concurrent-compiler.js: Added.
(foo):
2019-05-22 Ross Kirsling <[email protected]>
[ESNext] Implement support for Numeric Separators
https://bugs.webkit.org/show_bug.cgi?id=196351
Reviewed by Keith Miller.
* stress/numeric-literal-separators.js: Added.
Add tests for feature.
* test262/expectations.yaml:
Mark 60 test cases as passing.
2019-05-22 Tadeu Zagallo <[email protected]>
llint_slow_path_get_by_id needs to hold the CodeBlock's to update the metadata's mode
https://bugs.webkit.org/show_bug.cgi?id=198120
<rdar://problem/49668795>
Reviewed by Michael Saboff.
* stress/get-array-length-concurrently-change-mode.js: Added.
(main):
2019-05-22 Commit Queue <[email protected]>
Unreviewed, rolling out r245634.
https://bugs.webkit.org/show_bug.cgi?id=198140
'This patch makes JSC crash on launch in debug builds'
(Requested by tadeuzagallo on #webkit).
Reverted changeset:
"[ESNext] Implement support for Numeric Separators"
https://bugs.webkit.org/show_bug.cgi?id=196351
https://trac.webkit.org/changeset/245634
2019-05-22 Tadeu Zagallo <[email protected]>
Stack-buffer-overflow in decodeURIComponent
https://bugs.webkit.org/show_bug.cgi?id=198109
<rdar://problem/50397550>
Reviewed by Michael Saboff.
* stress/decode-uri-icu-count-trail-bytes.js: Added.
(i.j.try.i.toString):
(i.j.catch):
2019-05-22 Yusuke Suzuki <[email protected]>
Don't clear PropertyNameArray in Proxy code
https://bugs.webkit.org/show_bug.cgi?id=197691
Reviewed by Saam Barati.
* stress/proxy-get-own-property-names-should-not-clear-previous-results.js: Added.
(shouldBe):
(opt):
2019-05-22 Ross Kirsling <[email protected]>
[ESNext] Implement support for Numeric Separators
https://bugs.webkit.org/show_bug.cgi?id=196351
Reviewed by Keith Miller.
* stress/numeric-literal-separators.js: Added.
Add tests for feature.
* test262/expectations.yaml:
Mark 60 test cases as passing.
2019-05-22 Yusuke Suzuki <[email protected]>
[JSC] ArrayBufferContents::tryAllocate signs the pointer with allocation size and authenticates it with sizeInBytes
https://bugs.webkit.org/show_bug.cgi?id=198101
Reviewed by Michael Saboff.
* stress/zero-sized-array-buffer-pointer-should-be-signed-with-zero.js: Added.
(shouldBe):
2019-05-20 Keith Miller <[email protected]>
Cleanup Yarr regexp code around paren contexts.
https://bugs.webkit.org/show_bug.cgi?id=198063
Reviewed by Yusuke Suzuki.
* stress/regexp-many-named-sequential-capture-groups.js: Added.
(i.s):
* stress/regexp-many-unnamed-sequential-capture-groups.js: Added.
2019-05-17 Justin Michaud <[email protected]>
[WASM-References] Add support for Anyref in parameters and return types, Ref.null and Ref.is_null for Anyref values.
https://bugs.webkit.org/show_bug.cgi?id=197969
Reviewed by Keith Miller.
Support the anyref type in Builder.js, plus add some extra error logging.
Add new folder for wasm references tests.
* wasm.yaml:
* wasm/Builder.js:
(const._isValidValue):
* wasm/references/anyref_modules.js: Added.
(Call.3.RefIsNull.End.End.WebAssembly.js.ident):
(Call.3.RefIsNull.End.End.WebAssembly.js.make_null):
(Call.3.RefIsNull.End.End.WebAssembly):
(undefined):
* wasm/references/is_null.js: Added.
* wasm/references/is_null_error.js: Added.
* wasm/spec-harness/index.js:
* wasm/wasm.json:
2019-05-16 Ross Kirsling <[email protected]>
[JSC] Invalid AssignmentTargetType should be an early error.
https://bugs.webkit.org/show_bug.cgi?id=197603
Reviewed by Keith Miller.
* test262/expectations.yaml:
Update expectations to reflect new SyntaxErrors.
(Ideally, these should all be viewed as passing in the near future.)
* stress/async-await-basic.js:
* stress/big-int-literals.js:
Update tests to reflect new SyntaxErrors.
* ChakraCore.yaml:
* ChakraCore/test/EH/try6.baseline-jsc:
* ChakraCore/test/Error/variousErrors3.baseline-jsc: Added.
Update baselines to reflect new SyntaxErrors.
2019-05-15 Saam Barati <[email protected]>
Bound liveness of SetArgumentMaybe nodes when maximal flush insertion phase is enabled
https://bugs.webkit.org/show_bug.cgi?id=197855
<rdar://problem/50236506>
Reviewed by Michael Saboff.
* stress/set-argument-maybe-maximal-flush-should-not-extend-liveness-2.js: Added.
(f0):
(bar):
(foo):
* stress/set-argument-maybe-maximal-flush-should-not-extend-liveness.js: Added.
(f1):
(f2):
(foo):
2019-05-14 Keith Miller <[email protected]>
Fix issue with byteOffset on ARM64E
https://bugs.webkit.org/show_bug.cgi?id=197884
Reviewed by Saam Barati.
We didn't have any tests that run with non-byte/non-zero offset
typed arrays.
* stress/ftl-gettypedarrayoffset-wasteful.js:
2019-05-14 Yusuke Suzuki <[email protected]>
[JSC] Shrink sizeof(UnlinkedFunctionExecutable) more
https://bugs.webkit.org/show_bug.cgi?id=197833
Reviewed by Darin Adler.
* stress/generator-name.js: Added.
(shouldBe):
(gen):
(catch):
2019-05-13 Tadeu Zagallo <[email protected]>
JSObject::getOwnPropertyDescriptor is missing an exception check
https://bugs.webkit.org/show_bug.cgi?id=197693
<rdar://problem/50441784>
Reviewed by Saam Barati.
* stress/proxy-spread.js: Added.
(foo):
2019-05-10 Saam barati <[email protected]>
Call to JSToWasmICCallee::createStructure passes in wrong prototype value
https://bugs.webkit.org/show_bug.cgi?id=197807
<rdar://problem/50530400>
Reviewed by Yusuke Suzuki.
* stress/js-to-wasm-callee-has-correct-prototype.js: Added.
(test.getInstance):
(test):
2019-05-10 Ross Kirsling <[email protected]>
[Test262] Unreviewed expectations update following r245188.
* test262/config.yaml:
* test262/expectations.yaml:
* test262/test/intl402/DateTimeFormat/prototype/formatRange/date-is-infinity-throws.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRange/date-is-nan-throws.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRange/date-undefined-throws.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRange/date-x-greater-than-y-throws.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRange/this-is-not-object-throws.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-is-infinity-throws.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-is-nan-throws.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-undefined-throws.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-x-greater-than-y-throws.js:
* test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/this-is-not-object-throws.js:
These files have invalid YAML comments. Will also submit corrections back to Test262.
2019-05-10 Keith Miller <[email protected]>
Update test262 tests.
Rubber-stamped by Yusuke Suzuki.
* test262/*: mega-patch too many things to list individually.
2019-05-09 Keith Miller <[email protected]>
Unreview, fix test to have a try-catch.
* stress/many-nested-functions-parser-stack-overflow.js:
(catch):
2019-05-09 Keith Miller <[email protected]>
parseStatementListItem needs a stack overflow check
https://bugs.webkit.org/show_bug.cgi?id=197749
Reviewed by Saam Barati.
* stress/many-nested-functions-parser-stack-overflow.js: Added.
2019-05-08 Saam barati <[email protected]>
AccessGenerationState::emitExplicitExceptionHandler can clobber an in use register
https://bugs.webkit.org/show_bug.cgi?id=197715
<rdar://problem/50399252>
Reviewed by Filip Pizlo.
* stress/polymorphic-access-exception-handler-should-not-clobber-used-register.js: Added.
(foo):
(bar):
2019-05-08 Ryan Haddad <[email protected]>
Unreviewed, rolling out r245068.
Caused debug layout tests to exit early due to an assertion
failure.
Reverted changeset:
"All prototypes should call didBecomePrototype()"
https://bugs.webkit.org/show_bug.cgi?id=196315
https://trac.webkit.org/changeset/245068
2019-05-08 Yusuke Suzuki <[email protected]>
Invalid DFG JIT genereation in high CPU usage state
https://bugs.webkit.org/show_bug.cgi?id=197453
Reviewed by Saam Barati.
* stress/string-ident-use-clears-abstract-value-if-rope-string-constant-is-held.js: Added.
(trigger):
(main):
2019-05-08 Robin Morisset <[email protected]>
All prototypes should call didBecomePrototype()
https://bugs.webkit.org/show_bug.cgi?id=196315
Reviewed by Saam Barati.
This changelog already landed, but the commit was missing the actual changes.
* stress/function-prototype-indexed-accessor.js: Added.
2019-05-08 Caio Lima <[email protected]>
[BigInt] Add ValueMod into DFG
https://bugs.webkit.org/show_bug.cgi?id=186174
Reviewed by Saam Barati.
* microbenchmarks/mod-untyped.js: Added.
* stress/big-int-mod-osr.js: Added.
* stress/value-div-ai-rule.js: Added.
* stress/value-mod-ai-rule.js: Added.
2019-05-07 Yusuke Suzuki <[email protected]>
[JSC] DFG_ASSERT failed in lowInt52
https://bugs.webkit.org/show_bug.cgi?id=197569
Reviewed by Saam Barati.
* stress/getstack-int52.js: Added.
(opt):
(main):
2019-05-07 Yusuke Suzuki <[email protected]>
JSC: A bug in BytecodeGenerator::emitEqualityOpImpl
https://bugs.webkit.org/show_bug.cgi?id=197479
Reviewed by Saam Barati.
* stress/do-not-perform-bytecode-peephole-optimization-in-jump-target.js: Added.
(shouldBe):
2019-05-07 Yusuke Suzuki <[email protected]>
TemplateObject passed to template literal tags are not always identical for the same source location.
https://bugs.webkit.org/show_bug.cgi?id=190756
Reviewed by Saam Barati.
* complex.yaml:
* complex/tagged-template-regeneration-after.js: Added.
(shouldBe):
* complex/tagged-template-regeneration.js: Added.
(call):
(test):
* modules/tagged-template-inside-module.js: Added.
(from.string_appeared_here.call):
* modules/tagged-template-inside-module/other-tagged-templates.js: Added.
(call):
(export.otherTaggedTemplates):
* stress/call-and-construct-should-return-same-tagged-templates.js: Added.
(shouldBe):
(call):
(poly):
* stress/tagged-templates-in-direct-eval-should-not-produce-same-site-object.js: Added.
(shouldBe):
(call):
* stress/tagged-templates-in-function-in-direct-eval.js: Added.
(shouldBe):
(call):
(test):
* stress/tagged-templates-in-global-function-should-not-produce-same-site-object.js: Added.
(shouldBe):
(call):
* stress/tagged-templates-in-indirect-eval-should-not-produce-same-site-object.js: Added.
(shouldBe):
(call):
* stress/tagged-templates-in-multiple-functions.js: Added.
(shouldBe):
(call):
(a):
(b):
(c):
* stress/tagged-templates-with-same-start-offset.js: Added.
(shouldBe):
2019-05-07 Robin Morisset <[email protected]>
All prototypes should call didBecomePrototype()
https://bugs.webkit.org/show_bug.cgi?id=196315
Reviewed by Saam Barati.
* stress/function-prototype-indexed-accessor.js: Added.
2019-05-07 Commit Queue <[email protected]>
Unreviewed, rolling out r244978.
https://bugs.webkit.org/show_bug.cgi?id=197671
TemplateObject map should use start/end offsets (Requested by
yusukesuzuki on #webkit).
Reverted changeset:
"TemplateObject passed to template literal tags are not always
identical for the same source location."
https://bugs.webkit.org/show_bug.cgi?id=190756
https://trac.webkit.org/changeset/244978
2019-05-07 Tadeu Zagallo <[email protected]>
tryCachePutByID should not crash if target offset changes
https://bugs.webkit.org/show_bug.cgi?id=197311
<rdar://problem/48033612>
Reviewed by Filip Pizlo.
Add a series of tests related tryCachePutByID. Two of these tests used to crash and were fixed
by this patch: `cache-put-by-id-different-attributes.js` and `cache-put-by-id-different-offset.js`
* stress/cache-put-by-id-delete-prototype.js: Added.
(A.prototype.set y):
(A):
(B.prototype.set y):
(B):
(C):
* stress/cache-put-by-id-different-__proto__.js: Added.
(A.prototype.set y):
(A):
(B1):
(B2.prototype.set y):
(B2):
(C):
(D):
* stress/cache-put-by-id-different-attributes.js: Added.
(Foo):
(set x):
* stress/cache-put-by-id-different-offset.js: Added.
(Foo):
(set x):
* stress/cache-put-by-id-insert-prototype.js: Added.
(A.prototype.set y):
(A):
(C):
* stress/cache-put-by-id-poly-proto.js: Added.
(Foo):
(set _):
(createBar.Bar):
(createBar):
2019-05-07 Saam Barati <[email protected]>
Don't OSR enter into an FTL CodeBlock that has been jettisoned
https://bugs.webkit.org/show_bug.cgi?id=197531
<rdar://problem/50162379>
Reviewed by Yusuke Suzuki.
* stress/dont-osr-enter-into-jettisoned-ftl-code-block.js: Added.
2019-05-06 Dean Jackson <[email protected]>
Update test262 expectations for Proxy passes
https://bugs.webkit.org/show_bug.cgi?id=197628
Reviewed by Yusuke Suzuki.
There are two consistent passes in Proxy.ownKeys.
* test262/expectations.yaml:
2019-05-06 Yusuke Suzuki <[email protected]>
[JSC] We should check OOM for description string of Symbol
https://bugs.webkit.org/show_bug.cgi?id=197634
Reviewed by Keith Miller.
* stress/check-symbol-description-oom.js: Added.
(shouldThrow):
2019-05-06 Yusuke Suzuki <[email protected]>
Unreviewed, land one more test
https://bugs.webkit.org/show_bug.cgi?id=197587
* stress/setter-frame-flush.js: Added.
(setter):
(foo):
(bar):
2019-05-06 Yusuke Suzuki <[email protected]>
TemplateObject passed to template literal tags are not always identical for the same source location.
https://bugs.webkit.org/show_bug.cgi?id=190756
Reviewed by Saam Barati.
* complex.yaml:
* complex/tagged-template-regeneration-after.js: Added.
(shouldBe):
* complex/tagged-template-regeneration.js: Added.
(call):
(test):
* modules/tagged-template-inside-module.js: Added.
(from.string_appeared_here.call):
* modules/tagged-template-inside-module/other-tagged-templates.js: Added.
(call):
(export.otherTaggedTemplates):
* stress/call-and-construct-should-return-same-tagged-templates.js: Added.
(shouldBe):
(call):
(poly):
* stress/tagged-templates-in-direct-eval-should-not-produce-same-site-object.js: Added.
(shouldBe):
(call):
* stress/tagged-templates-in-global-function-should-not-produce-same-site-object.js: Added.
(shouldBe):
(call):
* stress/tagged-templates-in-indirect-eval-should-not-produce-same-site-object.js: Added.
(shouldBe):
(call):
* stress/tagged-templates-in-multiple-functions.js: Added.
(shouldBe):
(call):
(a):
(b):
(c):
2019-05-06 Stephan Szabo <[email protected]>
[PlayStation] JSC Stress tests failing due to timezone printing
https://bugs.webkit.org/show_bug.cgi?id=197615
PlayStation's strftime does not give timezone strings, which
results in time strings like "Wed Oct 23 1974 11:45:01 GMT-0700"
rather than "Wed Oct 23 1974 11:45:01 GMT-0700 (Pacific Daylight Time)"
which causes diff failures with the expectations. Add expectations
without the timezone string and use those on playstation.
Reviewed by Ross Kirsling.
* ChakraCore.yaml: Update these tests to use alternate expectation file on PlayStation
* ChakraCore/test/GlobalFunctions/InternalToString.baseline-jsc-playstation: Added.
* ChakraCore/test/Operators/equals.baseline-jsc-playstation: Added.
* ChakraCore/test/fieldopts/objtypespec-newobj.2.baseline-jsc-playstation: Added.
2019-05-06 Yusuke Suzuki <[email protected]>
[JSC] Add more tests for DFG SetLocal emission for adhoc SetterCall frame
https://bugs.webkit.org/show_bug.cgi?id=197587
Reviewed by Sam Weinig.
This patch adds more tests to r244939. It also inlines setter calls, and eventually see that no PutStack is emitted because MovHint's KillStack kills it.
* stress/adhoc-setter-frame-should-not-be-killed.js: Added.
2019-05-04 Tadeu Zagallo <[email protected]>
TypedArrays should not store properties that are canonical numeric indices
https://bugs.webkit.org/show_bug.cgi?id=197228
<rdar://problem/49557381>
Reviewed by Saam Barati.
* stress/array-species-config-array-constructor.js:
(test):
* stress/put-direct-index-broken-2.js:
* stress/typed-array-canonical-numeric-index-string.js: Added.
(makeTest.assert):
(makeTest):
(const.testInvalidIndices.makeTest.set assert):
(const.testInvalidIndices.makeTest):
(const.makeTestValidIndex.configurable.set assert):
(const.makeTestValidIndex.configurable):
* stress/typedarray-access-monomorphic-neutered.js:
(checkNoException):
(testNoException):
(testFTLNoException):
* stress/typedarray-access-neutered.js:
(testNoException):
* stress/typedarray-getownproperty-not-configurable.js:
(foo):
* test262/expectations.yaml:
2019-05-03 Yusuke Suzuki <[email protected]>
[JSC] Need to emit SetLocal if we emit MovHint in DFGByteCodeParser
https://bugs.webkit.org/show_bug.cgi?id=197584
Reviewed by Saam Barati.
* stress/adhoc-setter-frame-should-emit-setlocal-again.js: Added.
(X):
(foo):
2019-05-03 Michael Saboff <[email protected]>
iOS JSC tests frequently exiting with execption after stress/json-stringify-string-builder-overflow.js.no-cjit-validate-phases
https://bugs.webkit.org/show_bug.cgi?id=197586
Reviewed by Keith Miller.
We should only run one config of this test and only when we think we'll have the memory.
* stress/json-stringify-string-builder-overflow.js:
2019-05-03 Yusuke Suzuki <[email protected]>
[JSC] Generator CodeBlock generation should be idempotent
https://bugs.webkit.org/show_bug.cgi?id=197552
Reviewed by Keith Miller.
Add complex.yaml, which controls how to run JSC shell more.
We split test files into two to run macro task between them which allows debugger to be attached to VM.
* complex.yaml: Added.
* complex/generator-regeneration-after.js: Added.
* complex/generator-regeneration.js: Added.
(gen):
2019-05-02 Michael Saboff <[email protected]>
Unreviewed rollout of r244862.
* stress/proxy-getOwnPropertySlots-exceptionChecks.js:
2019-05-01 Saam barati <[email protected]>
Baseline JIT should do argument value profiling after checking for stack overflow
https://bugs.webkit.org/show_bug.cgi?id=197052
<rdar://problem/50009602>
Reviewed by Yusuke Suzuki.
* stress/check-stack-overflow-before-value-profiling-arguments.js: Added.
2019-05-01 Yusuke Suzuki <[email protected]>
[JSC] Inlining Getter/Setter should care availability of ad-hocly constructed frame
https://bugs.webkit.org/show_bug.cgi?id=197405
Reviewed by Saam Barati.
* stress/getter-setter-inlining-should-emit-movhint.js: Added.
(foo):
(test):
(i.o.get f):
(i.o.set f):
2019-05-01 Michael Saboff <[email protected]>
ASSERTION FAILED: !m_needExceptionCheck with --validateExceptionChecks=1; ProxyObject.getOwnPropertySlotCommon/JSFunction.callerGetter
https://bugs.webkit.org/show_bug.cgi?id=197485
Reviewed by Saam Barati.
New test.
* stress/proxy-getOwnPropertySlots-exceptionChecks.js: Added.
(foo):
2019-05-01 Ross Kirsling <[email protected]>
Unreviewed correction to Test262 expectations following r244828.
* test262/expectations.yaml:
2019-05-01 Stephan Szabo <[email protected]>
Add memory-limited skipping to some tests generating very large strings
https://bugs.webkit.org/show_bug.cgi?id=197437
Reviewed by Ross Kirsling.
* stress/StringObject-define-length-getter-rope-string-oom.js:
* stress/create-error-out-of-memory-rope-string.js:
* stress/string-16bit-repeat-overflow.js:
2019-04-30 Commit Queue <[email protected]>
Unreviewed, rolling out r244806.
https://bugs.webkit.org/show_bug.cgi?id=197446
Causing Test262 and JSC test failures on multiple builds
(Requested by ShawnRoberts on #webkit).
Reverted changeset:
"TypeArrays should not store properties that are canonical
numeric indices"
https://bugs.webkit.org/show_bug.cgi?id=197228
https://trac.webkit.org/changeset/244806
2019-04-30 Tadeu Zagallo <[email protected]>
TypeArrays should not store properties that are canonical numeric indices
https://bugs.webkit.org/show_bug.cgi?id=197228
<rdar://problem/49557381>
Reviewed by Darin Adler.
* stress/typed-array-canonical-numeric-index-string.js: Added.
(makeTest.assert):
(makeTest):
(const.testInvalidIndices.makeTest.set assert):
(const.testInvalidIndices.makeTest):
(const.testValidIndices.makeTest.set assert):
(const.testValidIndices.makeTest):
2019-04-29 Yusuke Suzuki <[email protected]>
normalizeMapKey should normalize NaN to one PureNaN bit pattern to make MapHash same
https://bugs.webkit.org/show_bug.cgi?id=197362
Reviewed by Saam Barati.
* stress/map-with-nan.js: Added.
(shouldBe):
(div):
(NaN1):
(NaN2):
(NaN3):
(NaN4):
(NaN1NoInline):
(NaN2NoInline):
(NaN3NoInline):
(NaN4NoInline):
(test1):
(test2):
(test3):
(test4):
* stress/set-with-nan.js: Added.
(shouldBe):
(div):
(NaN1):
(NaN2):
(NaN3):
(NaN4):
(NaN1NoInline):
(NaN2NoInline):
(NaN3NoInline):
(NaN4NoInline):
(test2):
(test4):
2019-04-26 Commit Queue <[email protected]>
Unreviewed, rolling out r244708.
https://bugs.webkit.org/show_bug.cgi?id=197334
"Broke the debug build" (Requested by rmorisset on #webkit).
Reverted changeset:
"All prototypes should call didBecomePrototype()"
https://bugs.webkit.org/show_bug.cgi?id=196315
https://trac.webkit.org/changeset/244708
2019-04-25 Yusuke Suzuki <[email protected]>
[JSC] linkPolymorphicCall now does GC
https://bugs.webkit.org/show_bug.cgi?id=197306
Reviewed by Saam Barati.
* stress/link-polymorphic-call-can-gc.js: Added.
(module):
(instance):
2019-04-26 Robin Morisset <[email protected]>
All prototypes should call didBecomePrototype()
https://bugs.webkit.org/show_bug.cgi?id=196315
Reviewed by Saam Barati.
* stress/function-prototype-indexed-accessor.js: Added.
2019-04-23 Saam Barati <[email protected]>
LICM incorrectly assumes it'll never insert a node which provably OSR exits
https://bugs.webkit.org/show_bug.cgi?id=196721
<rdar://problem/49556479>
Reviewed by Filip Pizlo.
* stress/licm-should-handle-if-a-hoist-causes-a-provable-osr-exit.js: Added.
(foo):
2019-04-19 Saam Barati <[email protected]>
AbstractValue can represent more than int52
https://bugs.webkit.org/show_bug.cgi?id=197118
<rdar://problem/49969960>
Reviewed by Michael Saboff.
* stress/abstract-value-can-include-int52.js: Added.
(foo):
(index.index.8.index.60.index.65.index.1234.index.1234.parseInt.string_appeared_here.String.fromCharCode):
2019-04-18 Yusuke Suzuki <[email protected]>
[WTF] StringBuilder should set correct m_is8Bit flag when merging
https://bugs.webkit.org/show_bug.cgi?id=197053
Reviewed by Saam Barati.
* stress/merge-string-builder-in-dfg.js: Added.
(foo):
2019-04-16 Caitlin Potter <[email protected]>
[JSC] Filter DontEnum properties in ProxyObject::getOwnPropertyNames()
https://bugs.webkit.org/show_bug.cgi?id=176810
Reviewed by Saam Barati.
Add tests for the DontEnum filtering, and variations of other tests
take the DontEnum-filtering path.
* stress/proxy-own-keys.js:
(i.catch):
(set assert):
(set add):
(let.set new):
(get let):
2019-04-15 Saam barati <[email protected]>
Modify how we do SetArgument when we inline varargs calls
https://bugs.webkit.org/show_bug.cgi?id=196712
<rdar://problem/49605012>
Reviewed by Michael Saboff.
* stress/get-stack-wrong-type-when-inline-varargs.js: Added.
(foo):
2019-04-15 Saam barati <[email protected]>
SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
https://bugs.webkit.org/show_bug.cgi?id=196945
<rdar://problem/49802750>
Reviewed by Filip Pizlo.
* stress/get-by-offset-should-use-correct-child.js: Added.
(foo.bar):
(foo):
2019-04-15 Robin Morisset <[email protected]>
DFG should be able to constant fold Object.create() with a constant prototype operand
https://bugs.webkit.org/show_bug.cgi?id=196886
Reviewed by Yusuke Suzuki.
Note that this new benchmark does not currently see a speedup with inlining removed.
The reason is that we do not yet have inline caching for Object.create(), we only optimize it when the DFG can see statically the prototype being passed.
* microbenchmarks/object-create-constant-prototype.js: Added.
(test):
2019-04-15 Tadeu Zagallo <[email protected]>
Incremental bytecode cache should not append function updates when loaded from memory
https://bugs.webkit.org/show_bug.cgi?id=196865
Reviewed by Filip Pizlo.
* stress/bytecode-cache-shared-code-block.js: Added.
(b):
(program):
2019-04-13 Tadeu Zagallo <[email protected]>
CodeCache should check that the UnlinkedCodeBlock was successfully created before caching it
https://bugs.webkit.org/show_bug.cgi?id=196880
Reviewed by Yusuke Suzuki.
* stress/bytecode-cache-syntax-error.js: Added.
(catch):
2019-04-12 Saam barati <[email protected]>
r244079 logically broke shouldSpeculateInt52
https://bugs.webkit.org/show_bug.cgi?id=196884
Reviewed by Yusuke Suzuki.
* microbenchmarks/int52-rand-function.js: Added.
(Math.random):
2019-04-11 Yusuke Suzuki <[email protected]>
[JSC] op_has_indexed_property should not assume subscript part is Uint32
https://bugs.webkit.org/show_bug.cgi?id=196850
Reviewed by Saam Barati.
* stress/has-indexed-property-should-accept-non-int32.js: Added.
(foo):
2019-04-11 Saam barati <[email protected]>
Remove invalid assertion in operationInstanceOfCustom
https://bugs.webkit.org/show_bug.cgi?id=196842
<rdar://problem/49725493>
Reviewed by Michael Saboff.
* stress/operationInstanceOfCustom-bad-assertion.js: Added.
2019-04-10 Saam Barati <[email protected]>
AbstractValue::validateOSREntryValue is wrong for Int52 constants
https://bugs.webkit.org/show_bug.cgi?id=196801
<rdar://problem/49771122>
Reviewed by Yusuke Suzuki.
* stress/abstract-value-int52-constant-validation-should-not-care-about-representation.js: Added.
2019-04-10 Robin Morisset <[email protected]>
We should clear m_needsOverflowCheck when hitting an exception in defineProperties in ObjectConstructor.cpp
https://bugs.webkit.org/show_bug.cgi?id=196746
Reviewed by Yusuke Suzuki.
* stress/cyclic-define-properties.js: Added.
(foo):
2019-04-09 Saam barati <[email protected]>
Clean up Int52 code and some bugs in it
https://bugs.webkit.org/show_bug.cgi?id=196639
<rdar://problem/49515757>
Reviewed by Yusuke Suzuki.
* stress/spec-any-int-as-double-produces-any-int52-from-int52-rep.js: Added.
2019-04-09 Tadeu Zagallo <[email protected]>
ASSERTION FAILED: !scope.exception() || !hasProperty in JSObject::get
https://bugs.webkit.org/show_bug.cgi?id=196708
<rdar://problem/49556803>
Reviewed by Yusuke Suzuki.
* stress/proxy-getter-stack-overflow.js: Added.
(const.handler.get target):
(const.handler.has):
(try.with):
(catch):
2019-04-08 Yusuke Suzuki <[email protected]>
[JSC] DFG should respect node's strict flag
https://bugs.webkit.org/show_bug.cgi?id=196617
Reviewed by Saam Barati.
* stress/put-by-val-direct-should-respect-strict-mode-of-inlining-codeblock.js: Added.
(shouldEqual):
(makeUnwriteableUnconfigurableObject):
(runTest):
* stress/put-dynamic-var-strict-and-sloppy.js: Added.
(shouldBe):
(shouldThrow):
(with.result):
(with.putValueStrict):
(with.putValueSloppy):
2019-04-08 Yusuke Suzuki <[email protected]>
[JSC] isRope jump in StringSlice should not jump over register allocations
https://bugs.webkit.org/show_bug.cgi?id=196716
Reviewed by Saam Barati.
* stress/is-rope-check-in-string-slice-should-not-jump-over-register-allocations.js: Added.
(foo.bar):
(foo):
2019-04-08 Yusuke Suzuki <[email protected]>
[JSC] to_index_string should not assume incoming value is Uint32
https://bugs.webkit.org/show_bug.cgi?id=196713
Reviewed by Saam Barati.
* stress/to-index-string-should-not-assume-incoming-value-is-uint32.js: Added.
(foo):
2019-04-08 Yusuke Suzuki <[email protected]>
[JSC] Add more tests for r243966
https://bugs.webkit.org/show_bug.cgi?id=196711
Reviewed by Saam Barati.
Adding one more test for r243966 fix. The added test will not crash after r243966.
* stress/stress-cleared-calllinkinfo.js: Added.
(runNearStackLimit.t):
(runNearStackLimit):
(repeat):
(cls):
(let.item.of.array.runNearStackLimit):
2019-04-08 Saam Barati <[email protected]>
WebAssembly.RuntimeError missing exception check
https://bugs.webkit.org/show_bug.cgi?id=196700
<rdar://problem/49693932>
Reviewed by Yusuke Suzuki.
* wasm/js-api/runtime-error-should-exception-check.js: Added.
2019-04-08 Yusuke Suzuki <[email protected]>
Unreviewed, rolling in r243948 with test fix
https://bugs.webkit.org/show_bug.cgi?id=196486
* stress/arrow-function-and-use-strict-directive.js: Added.
* stress/arrow-function-syntax.js: Added.
(checkSyntax):
(checkSyntaxError):
2019-04-08 Ryan Haddad <[email protected]>
Unreviewed, rolling out r243948.
Caused inspector/runtime/parse.html to fail
Reverted changeset:
"SIGSEGV in JSC::BytecodeGenerator::addStringConstant"
https://bugs.webkit.org/show_bug.cgi?id=196486
https://trac.webkit.org/changeset/243948
2019-04-08 Ryan Haddad <[email protected]>
Unreviewed, rolling out r243943.
Caused test262 failures.
Reverted changeset:
"[JSC] Filter DontEnum properties in
ProxyObject::getOwnPropertyNames()"
https://bugs.webkit.org/show_bug.cgi?id=176810
https://trac.webkit.org/changeset/243943
2019-04-07 Michael Saboff <[email protected]>
REGRESSION (r243642): Crash in reddit.com page
https://bugs.webkit.org/show_bug.cgi?id=196684
Reviewed by Geoffrey Garen.
New regression test.
* stress/regexp-nongreedy-charclass-backtracks.js: Added.
2019-04-07 Yusuke Suzuki <[email protected]>
[JSC] CallLinkInfo should clear Callee or CodeBlock even if it is unlinked by jettison
https://bugs.webkit.org/show_bug.cgi?id=196683
Reviewed by Saam Barati.
* stress/clear-callee-or-codeblock-in-calllinkinfo-even-cleared-by-jettison.js: Added.
(foo):
2019-04-05 Yusuke Suzuki <[email protected]>
[JSC] OSRExit recovery for SpeculativeAdd does not consier "A = A + A" pattern
https://bugs.webkit.org/show_bug.cgi?id=196582
Reviewed by Saam Barati.
* stress/add-overflow-check-with-three-same-registers.js: Added.
(foo):
(Number.prototype.valueOf):
(runWithNumber):
2019-04-05 Ryan Haddad <[email protected]>
Unreviewed, rolling out r243665.
Caused iOS JSC tests to exit with an exception.
Reverted changeset:
"Assertion failed in JSC::createError"
https://bugs.webkit.org/show_bug.cgi?id=196305
https://trac.webkit.org/changeset/243665
2019-04-05 Yusuke Suzuki <[email protected]>
SIGSEGV in JSC::BytecodeGenerator::addStringConstant
https://bugs.webkit.org/show_bug.cgi?id=196486
Reviewed by Saam Barati.
* stress/arrow-function-and-use-strict-directive.js: Added.
* stress/arrow-function-syntax.js: Added. Checking EOF token handling.
(checkSyntax):
(checkSyntaxError): Currently not using it. But it is useful for testing more things related to arrow function syntax.
2019-04-05 Caitlin Potter <[email protected]>
[JSC] Filter DontEnum properties in ProxyObject::getOwnPropertyNames()
https://bugs.webkit.org/show_bug.cgi?id=176810
Reviewed by Saam Barati.
Add tests for the DontEnum filtering, and variations of other tests
take the DontEnum-filtering path.
* stress/proxy-own-keys.js:
(i.catch):
(set assert):
(set add):
(let.set new):
(get let):
2019-04-05 Caitlin Potter <[email protected]>
[JSC] throw if 'ownKeys' Proxy trap result contains duplicate keys
https://bugs.webkit.org/show_bug.cgi?id=185211
Reviewed by Saam Barati.
This is for the normative spec change in https://github.com/tc39/ecma262/pull/833
This changes several assertions to expect a TypeError to be thrown (in some cases,
changing thee expected message).
* es6/Proxy_ownKeys_duplicates.js:
(handler):
(shouldThrow):
(test):
* stress/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js:
(shouldThrow):
* stress/proxy-own-keys.js:
(i.catch):
(assert):
2019-04-04 Yusuke Suzuki <[email protected]>
[JSC] makeBoundFunction should not assume incoming "length" value is Int32 because it performs some calculation in bytecode
https://bugs.webkit.org/show_bug.cgi?id=196631
Reviewed by Saam Barati.
* stress/make-bound-function-should-not-assume-int32-length.js: Added.
(assert):
(test):
(foo):
2019-04-04 Saam Barati <[email protected]>
Unreviewed. Make the test from r243906 catch the thrown exceptions.
* stress/inferred-types-regex-matches-array.js:
2019-04-04 Saam Barati <[email protected]>
createRegExpMatchesArray does not respect inferred types
https://bugs.webkit.org/show_bug.cgi?id=193287
Reviewed by Yusuke Suzuki.
This checks in the test case for 193287. This issue was discovered by
Samuel Groß of Google Project Zero.
* stress/inferred-types-regex-matches-array.js: Added.
2019-04-04 Saam barati <[email protected]>
Teach Call ICs how to call Wasm
https://bugs.webkit.org/show_bug.cgi?id=196387
Reviewed by Filip Pizlo.
* wasm/function-tests/stack-trace.js:
2019-04-04 Caio Lima <[email protected]>
[JSC] We should consider moving UnlinkedFunctionExecutable::m_parentScopeTDZVariables to RareData
https://bugs.webkit.org/show_bug.cgi?id=194944
Reviewed by Keith Miller.
* stress/verify-bytecode-generator-cached-variables-under-tdz.js: Added.
2019-04-04 Tadeu Zagallo <[email protected]>
Cache bytecode for jsc.cpp helpers and fix CachedStringImpl
https://bugs.webkit.org/show_bug.cgi?id=196409
Reviewed by Saam Barati.
* stress/bytecode-cache-cached-string-impl.js: Added.
(f):
(g):
* stress/bytecode-cache-run-string.js: Added.
2019-04-03 Robin Morisset <[email protected]>
B3 should use associativity to optimize expression trees
https://bugs.webkit.org/show_bug.cgi?id=194081
Reviewed by Filip Pizlo.
Added three microbenchmarks:
- add-tree should be the ideal case, but there is no speedup because we are currently unable to prove that the CheckAdd won't overflow
- bit-xor-tree most closely matches the situation where the optimization triggers on the JetStream2 subtests where it triggers:
an unbalanced expression tree of size 8 that can be balanced, with no other optimizations being unlocked. 16% speedup
- bit-or-tree is an ideal case, where the reassociation also enables a ton of further simplifications. 42% speedup
* microbenchmarks/add-tree.js: Added.
* microbenchmarks/bit-or-tree.js: Added.
* microbenchmarks/bit-xor-tree.js: Added.
2019-04-03 Yusuke Suzuki <[email protected]>
[JSC] Exception verification crash on operationArrayIndexOfValueInt32OrContiguous
https://bugs.webkit.org/show_bug.cgi?id=196574
Reviewed by Saam Barati.
* stress/string-index-of-exception-check.js: Added.
(blurType):
(1.forEach):
2019-03-29 Tadeu Zagallo <[email protected]>
Assertion failed in JSC::createError
https://bugs.webkit.org/show_bug.cgi?id=196305
<rdar://problem/49387382>
Reviewed by Saam Barati.
* stress/create-error-out-of-memory-rope-string-2.js: Added.
(assert):
(catch):
2019-03-28 Saam Barati <[email protected]>
BackwardsGraph needs to consider back edges as the backward's root successor
https://bugs.webkit.org/show_bug.cgi?id=195991
Reviewed by Filip Pizlo.
* stress/map-b3-licm-infinite-loop.js: Added.
2019-03-28 Tadeu Zagallo <[email protected]>
CodeBlock::jettison() should disallow repatching its own calls
https://bugs.webkit.org/show_bug.cgi?id=196359
<rdar://problem/48973663>
Reviewed by Saam Barati.
* stress/call-link-info-osrexit-repatch.js: Added.
(foo):
2019-03-28 Yusuke Suzuki <[email protected]>
[JSC] imports-oom.js intermittently fails
https://bugs.webkit.org/show_bug.cgi?id=196373
Reviewed by Saam Barati.
imports-oom.js ensures that a wasm module compilation / instantiation throws an OOM error instead of crashing when compiling / instantiating their entry points
with extremely low executable memory amount. And this test expects we at least once successfully compile, instantiate, and execute a wasm module to test that
wasm implementation is always throwing an OOM error. However, maybe due to wasm changes, the amount of executable memory consumed by wasm compilation is changed,
and now we may encounter an OOM error at the first compilation. Since imports-oom.js randomize the amount of executable memory used by the generated wasm module,
imports-oom.js intermittently fails when it first generates large wasm module which cannot be compiled.
This patch reduces the maxParams from 32 to 8 to reduce the size of randomly generated wasm module. Since we repeatedly generate wasm modules, this test soon encounter
an expected OOM error. But this avoids the situation that we get an OOM error when we compile a first wasm module.
* wasm/lowExecutableMemory/imports-oom.js:
2019-03-27 Saam Barati <[email protected]>
validateOSREntryValue with Int52 should box the value being checked into double format
https://bugs.webkit.org/show_bug.cgi?id=196313
<rdar://problem/49306703>
Reviewed by Yusuke Suzuki.
* stress/validate-int-52-ai-state.js: Added.
2019-03-27 Yusuke Suzuki <[email protected]>
[JSC] Owner of watchpoints should validate at GC finalizing phase
https://bugs.webkit.org/show_bug.cgi?id=195827
Reviewed by Filip Pizlo.
* stress/gc-should-reap-dead-watchpoints.js: Added.
(foo):
(A.prototype.y):
(A):
2019-03-26 Dominik Infuehr <[email protected]>
Skip WebAssembly test on 32-bit systems
https://bugs.webkit.org/show_bug.cgi?id=196206
Reviewed by Saam Barati.
Invoking runDefault executes test immediately even though
that test should be skipped due to missing WASM support.
Therefore remove runDefault.
* wasm/regress/web-assembly-link-error-exception-check.js:
2019-03-26 Tadeu Zagallo <[email protected]>
WebAssembly: Fix f32.min, f64.min and f64.max operations on NaN
https://bugs.webkit.org/show_bug.cgi?id=196217
Reviewed by Saam Barati.
Re-enable all NaN tests for f32.min, f64.min and f64.max.
* wasm/spec-tests/f32.wast.js:
* wasm/spec-tests/f64.wast.js:
* wasm/wasm.json:
2019-03-25 Keith Miller <[email protected]>
ASSERTION FAILED: m_op == CompareStrictEq in JSC::DFG::Node::convertToCompareEqPtr(JSC::DFG::FrozenValue *, JSC::DFG::Edge)
https://bugs.webkit.org/show_bug.cgi?id=196176
Reviewed by Saam Barati.
* stress/object-is-fold-to-compare-eq-ptr.js: Added.
(main.v10):
(main):
2019-03-25 Tadeu Zagallo <[email protected]>
WebAssembly: f32.max with NaN generates incorrect result
https://bugs.webkit.org/show_bug.cgi?id=175691
<rdar://problem/33952228>
Reviewed by Saam Barati.
Enable all f32.max NaN tests
* wasm/spec-tests/f32.wast.js:
* wasm/wasm.json:
2019-03-24 Dominik Infuehr <[email protected]>
[JSC] Move test into directory for WASM tests
https://bugs.webkit.org/show_bug.cgi?id=196187
Reviewed by Mark Lam.
Move Test into wasm-directory. Otherwise this test
is also executed on systems without WASM support.
* wasm/regress/web-assembly-link-error-exception-check.js: Renamed from JSTests/stress/web-assembly-link-error-exception-check.js.
2019-03-23 Mark Lam <[email protected]>
Rolling out r243032 and r243071 because the fix is incorrect.
https://bugs.webkit.org/show_bug.cgi?id=195892
<rdar://problem/48981239>
Not reviewed.
* stress/check-object-property-condition-liveness-before-accessing-it-when-watchpoints-fire.js: Removed.
2019-03-22 Mark Lam <[email protected]>
Placate exception check validation in genericTypedArrayViewProtoFuncLastIndexOf().
https://bugs.webkit.org/show_bug.cgi?id=196154
<rdar://problem/49145307>
Reviewed by Filip Pizlo.
Also added //@ runDefault constraint to web-assembly-link-error-exception-check.js.
There's no need to run this test on more than 1 test configuration.
* stress/typed-array-lastIndexOf-exception-check.js: Added.
* stress/web-assembly-link-error-exception-check.js:
2019-03-22 Mark Lam <[email protected]>
Placate exception check validation in constructJSWebAssemblyLinkError().
https://bugs.webkit.org/show_bug.cgi?id=196152
<rdar://problem/49145257>
Reviewed by Michael Saboff.
* stress/web-assembly-link-error-exception-check.js: Added.
2019-03-22 Dominik Infuehr <[email protected]>
Skip tests running out of memory on ARM/MIPS
https://bugs.webkit.org/show_bug.cgi?id=196131
Unreviewed. Skip test if memory is limited.
* microbenchmarks/put-by-val-direct-large-index.js:
2019-03-21 Mark Lam <[email protected]>
Remove an invalid assertion in DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined().
https://bugs.webkit.org/show_bug.cgi?id=196116
<rdar://problem/48976951>
Reviewed by Filip Pizlo.
* stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js: Added.
2019-03-21 Tadeu Zagallo <[email protected]>
JSObject::putDirectIndexSlowOrBeyondVectorLength should check if indexIsSufficientlyBeyondLengthForSparseMap
https://bugs.webkit.org/show_bug.cgi?id=196078
<rdar://problem/35925380>
Reviewed by Mark Lam.
Add a new benchmark that allocates several objects and invokes put_by_val_direct
with a large index. run-jsc-benchmarks says "definitely 1.6178x faster".
* microbenchmarks/put-by-val-direct-large-index.js: Added.
2019-03-21 Mark Lam <[email protected]>
Placate exception check validation in operationArrayIndexOfString().
https://bugs.webkit.org/show_bug.cgi?id=196067
<rdar://problem/49056572>
Reviewed by Michael Saboff.
* stress/string-equal-exception-check.js: Added.
2019-03-21 Mark Lam <[email protected]>
Cap length of an array with spread to MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.
https://bugs.webkit.org/show_bug.cgi?id=196055
<rdar://problem/49067448>
Reviewed by Yusuke Suzuki.
* stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: Added.
2019-03-20 Saam Barati <[email protected]>
typeOfDoubleSum is wrong for when NaN can be produced
https://bugs.webkit.org/show_bug.cgi?id=196030
Reviewed by Filip Pizlo.
* stress/double-add-sub-mul-can-produce-nan.js: Added.
(assert):
(noInline.sub):
(noInline):
(assert.mul):
(assert.add):
2019-03-20 Yusuke Suzuki <[email protected]>
Update the test to ensure OutOfMemoryError is thrown as intended
https://bugs.webkit.org/show_bug.cgi?id=196032
<rdar://problem/46842740>
Rubber stamped by Saam Barati.
* stress/create-error-out-of-memory-rope-string.js:
(assert):
(catch):
2019-03-20 Tadeu Zagallo <[email protected]>
JSC::createError needs to check for OOM in errorDescriptionForValue
https://bugs.webkit.org/show_bug.cgi?id=196032
<rdar://problem/46842740>
Reviewed by Mark Lam.
* stress/create-error-out-of-memory-rope-string.js: Added.
2019-03-19 Yusuke Suzuki <[email protected]>
Unreviewed, reduce # of iterations to avoid timing out after r242991
https://bugs.webkit.org/show_bug.cgi?id=195791
To avoid timing out, this patch reduces it from 3e7 to 1e7. 1e7 iteration counts still reproduce the issue at 60%.
* stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js:
2019-03-19 Caio Lima <[email protected]>
[JSC] microbenchmarks/generate-multiple-llint-entrypoints.js is running out of executable memory on ARMv7
https://bugs.webkit.org/show_bug.cgi?id=195950
Unreviewed, reducing the amount of memory used on this test to avoid
OOM on devices with memory restrictions.
* microbenchmarks/generate-multiple-llint-entrypoints.js:
2019-03-19 Caio Lima <[email protected]>
[JSC] LLIntEntryPoint creates same DirectJITCode for all functions
https://bugs.webkit.org/show_bug.cgi?id=194648
Reviewed by Keith Miller.
* microbenchmarks/generate-multiple-llint-entrypoints.js: Added.
2019-03-18 Mark Lam <[email protected]>
Missing a ThrowScope release in JSObject::toString().
https://bugs.webkit.org/show_bug.cgi?id=195893
<rdar://problem/48970986>
Reviewed by Michael Saboff.
* stress/to-string-exception-check-release.js: Added.
2019-03-18 Mark Lam <[email protected]>
Structure::flattenDictionary() should clear unused property slots.
https://bugs.webkit.org/show_bug.cgi?id=195871
<rdar://problem/48959497>
Reviewed by Michael Saboff.
* stress/structure-flattenDictionary-should-clear-unused-property-slots.js: Added.
2019-03-15 Mark Lam <[email protected]>
Need to check ObjectPropertyCondition liveness before accessing it when firing watchpoints.
https://bugs.webkit.org/show_bug.cgi?id=195827
<rdar://problem/48845513>
Reviewed by Filip Pizlo.
* stress/check-object-property-condition-liveness-before-accessing-it-when-watchpoints-fire.js: Added.
2019-03-15 Dominik Infuehr <[email protected]>
[ARM,MIPS] Skip slow tests
https://bugs.webkit.org/show_bug.cgi?id=195799
Unreviewed, test does not finish on ARM and MIPS within the
timeout limit.
* stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js:
2019-03-14 Yusuke Suzuki <[email protected]>
[JSC] Retain PrivateName of Symbol before passing it to operations potentially incurring GC
https://bugs.webkit.org/show_bug.cgi?id=195791
<rdar://problem/48806130>
Reviewed by Mark Lam.
* stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js: Added.
(foo):
2019-03-14 Saam barati <[email protected]>
We can't remove code after ForceOSRExit until after FixupPhase
https://bugs.webkit.org/show_bug.cgi?id=186916
<rdar://problem/41396612>
Reviewed by Yusuke Suzuki.
* stress/movhint-backwards-propagation-must-merge-use-as-value-add.js: Added.
(foo):
* stress/movhint-backwards-propagation-must-merge-use-as-value.js: Added.
(foo):
2019-03-13 Michael Saboff <[email protected]>
ASSERTION FAILED: regexp->isValid() or ASSERTION FAILED: !isCompilationThread()
https://bugs.webkit.org/show_bug.cgi?id=195735
Reviewed by Mark Lam.
New regression test.
* stress/dont-strength-reduce-regexp-with-compile-error.js: Added.
(foo):
(bar):
2019-03-14 Saam barati <[email protected]>
Fixup uses KnownInt32 incorrectly in some nodes
https://bugs.webkit.org/show_bug.cgi?id=195279
<rdar://problem/47915654>
Reviewed by Yusuke Suzuki.
* stress/known-int32-cant-be-used-across-bytecode-boundary.js: Added.
(foo):
2019-03-14 Keith Miller <[email protected]>
DFG liveness can't skip tail caller inline frames
https://bugs.webkit.org/show_bug.cgi?id=195715
Reviewed by Saam Barati.
* stress/dfg-scan-inlined-tail-caller-frames-liveness.js:
(i.foo):
2019-03-13 Mark Lam <[email protected]>
Gardening: reducing the variants on 2 tests to avoid timing out on JSC Debug queue.
https://bugs.webkit.org/show_bug.cgi?id=195415
Not reviewed.
Changed these tests to only run the default configuration.
The ftl-no-cjit-validate-sampling-profiler variant was timing out.
There's no strong need to run this test on that variant.
* stress/dfg-to-string-on-int-does-gc.js:
* stress/dfg-to-string-on-string-or-string-object-does-not-gc.js:
2019-03-13 Dominik Infuehr <[email protected]>
String overflow when using StringBuilder in JSC::createError
https://bugs.webkit.org/show_bug.cgi?id=194957
Reviewed by Mark Lam.
Add test string-overflow-createError-bulder.js that overflows
StringBuilder in notAFunctionSourceAppender. The second new test
string-overflow-createError-fit.js has an error message that doesn't
overflow, it still failed since the String's capacity can't be doubled.
Run test string-overflow-createError.js only in the default
configuration to reduce memory consumption when running the test
in all configurations on multiple CPUs in parallel.
* stress/string-overflow-createError-builder.js: Copied from JSTests/stress/string-overflow-createError.js.
(catch):
* stress/string-overflow-createError-fit.js: Copied from JSTests/stress/string-overflow-createError.js.
(catch):
* stress/string-overflow-createError.js:
2019-03-12 Yusuke Suzuki <[email protected]>
[JSC] OSR entry should respect abstract values in addition to flush formats
https://bugs.webkit.org/show_bug.cgi?id=195653
Reviewed by Mark Lam.
* stress/osr-entry-locals-none.js: Added.
2019-03-12 Michael Saboff <[email protected]>
REGRESSION (iOS 12.2): Webpage using CoffeeScript crashes
https://bugs.webkit.org/show_bug.cgi?id=195613
Reviewed by Mark Lam.
New regression test.
* stress/regexp-backref-inbounds.js: Added.
(testRegExp):
2019-03-12 Mark Lam <[email protected]>
The HasIndexedProperty node does GC.
https://bugs.webkit.org/show_bug.cgi?id=195559
<rdar://problem/48767923>
Reviewed by Yusuke Suzuki.
* stress/HasIndexedProperty-does-gc.js: Added.
2019-03-11 Caio Lima <[email protected]>
[ESNext][BigInt] Implement "~" unary operation
https://bugs.webkit.org/show_bug.cgi?id=182216
Reviewed by Keith Miller.
* stress/big-int-bit-not-general.js: Added.
* stress/big-int-bitwise-not-jit.js: Added.
* stress/big-int-bitwise-not-wrapped-value.js: Added.
* stress/bit-op-with-object-returning-int32.js:
* stress/bitwise-not-fixup-rules.js: Added.
* stress/value-bit-not-ai-rule.js: Added.
2019-03-10 Ross Kirsling <[email protected]>
Invalid flags in a RegExp literal should be an early SyntaxError
https://bugs.webkit.org/show_bug.cgi?id=195514
Reviewed by Darin Adler.
* test262/expectations.yaml:
Mark 4 test cases as passing.
* stress/regexp-syntax-error-invalid-flags.js:
* stress/regress-161995.js: Removed.
Update existing test, merging in an older test for the same behavior.
2019-03-08 Mark Lam <[email protected]>
Stack overflow crash in JSC::JSObject::hasInstance.
https://bugs.webkit.org/show_bug.cgi?id=195458
<rdar://problem/48710195>
Reviewed by Yusuke Suzuki.
* stress/stack-overflow-in-custom-hasInstance.js: Added.
2019-03-08 Tadeu Zagallo <[email protected]>
op_check_tdz does not def its argument
https://bugs.webkit.org/show_bug.cgi?id=192880
<rdar://problem/46221598>
Reviewed by Saam Barati.
* microbenchmarks/let-for-in.js: Added.
(foo):
2019-03-07 Yusuke Suzuki <[email protected]>
[JSC] StringFromCharCode fast path should accept 0xff in DFG and FTL
https://bugs.webkit.org/show_bug.cgi?id=195429
Reviewed by Saam Barati.
* stress/must-handled-values-should-not-be-used-as-proven-constants-in-cfa.js: Added.
(foo):
* stress/string-from-char-code-255.js: Added.
2019-03-06 Mark Lam <[email protected]>
Fix incorrect handling of try-finally completion values.
https://bugs.webkit.org/show_bug.cgi?id=195131
<rdar://problem/46222079>
Reviewed by Saam Barati and Yusuke Suzuki.
Added many permutations of new test case to test-finally.js. test-finally.js has
been run on Chrome and Firefox as a sanity check, and we confirmed that all the
tests passes there as well.
* stress/test-finally.js:
2019-03-06 Saam Barati <[email protected]>
Air::reportUsedRegisters must padInterference
https://bugs.webkit.org/show_bug.cgi?id=195303
<rdar://problem/48270343>
Reviewed by Keith Miller.
* stress/optional-def-arg-width-should-be-both-early-and-late-use.js: Added.
2019-03-06 Yusuke Suzuki <[email protected]>
[JSC] AI should not propagate AbstractValue relying on constant folding phase
https://bugs.webkit.org/show_bug.cgi?id=195375
Reviewed by Saam Barati.
* stress/make-rope-should-not-propagate-constant-folded-value-in-ai.js: Added.
(let.array):
2019-03-05 Saam barati <[email protected]>
op_switch_char broken for rope strings after JSRopeString layout rewrite
https://bugs.webkit.org/show_bug.cgi?id=195339
<rdar://problem/48592545>
Reviewed by Yusuke Suzuki.
* stress/switch-on-char-llint-rope.js: Added.
2019-03-04 Yusuke Suzuki <[email protected]>
[JSC] Store bits for JSRopeString in 3 stores
https://bugs.webkit.org/show_bug.cgi?id=195234
Reviewed by Saam Barati.
* stress/null-rope-and-collectors.js: Added.
2019-03-01 Dominik Infuehr <[email protected]>
Unskip test read-dead-bytecode-locals-in-must-have-handle-values2.js on ARM/MIPS
https://bugs.webkit.org/show_bug.cgi?id=195207
Unreviewed. After test runtime was reduced in r242213, test can be
run again on ARM/MIPS.
* stress/read-dead-bytecode-locals-in-must-handle-values2.js:
2019-02-28 Yusuke Suzuki <[email protected]>
[JSC] sizeof(JSString) should be 16
https://bugs.webkit.org/show_bug.cgi?id=194375
Reviewed by Saam Barati.
* microbenchmarks/make-rope.js: Added.
(makeRope):
* stress/to-lower-case-intrinsic-on-empty-rope.js: We no longer allow 0 length JSString except for jsEmptyString singleton per VM.
(returnRope.helper): Deleted.
(returnRope): Deleted.
2019-02-28 Yusuke Suzuki <[email protected]>
Unreviewed, reduce the count in the stress/read-dead-bytecode-locals-in-must-handle-values2.js
https://bugs.webkit.org/show_bug.cgi?id=195144
1e8 takes too much time in the Debug build. I tried 1e5 with the old Debug build and it successfully reproduced the issue.
Change the number from 1e8 to 1e5.
* stress/read-dead-bytecode-locals-in-must-handle-values2.js:
(foo):
2019-02-28 Dominik Infuehr <[email protected]>
Test times out on ARM/MIPS
https://bugs.webkit.org/show_bug.cgi?id=195168
Unreviewed. Skip test on ARM/MIPS.
* stress/read-dead-bytecode-locals-in-must-handle-values2.js:
2019-02-27 Mark Lam <[email protected]>
The parser is failing to record the token location of new in new.target.
https://bugs.webkit.org/show_bug.cgi?id=195127
<rdar://problem/39645578>
Reviewed by Yusuke Suzuki.
* stress/parser-should-record-token-location-of-new-dot-target.js: Added.
2019-02-27 Yusuke Suzuki <[email protected]>
[JSC] mustHandleValues for dead bytecode locals should be ignored in DFG phases
https://bugs.webkit.org/show_bug.cgi?id=195144
<rdar://problem/47595961>
Reviewed by Mark Lam.
* stress/read-dead-bytecode-locals-in-must-handle-values1.js: Added.
(bar):
(foo):
* stress/read-dead-bytecode-locals-in-must-handle-values2.js: Added.
(bar):
(foo):
2019-02-27 Robin Morisset <[email protected]>
DFG: Loop-invariant code motion (LICM) should not hoist dead code
https://bugs.webkit.org/show_bug.cgi?id=194945
<rdar://problem/48311657>
Reviewed by Mark Lam.
* stress/licm-dead-code.js: Added.
2019-02-26 Yusuke Suzuki <[email protected]>
REGRESSION: stress/regress-178386.js is timing out on JSC debug bot
https://bugs.webkit.org/show_bug.cgi?id=194677
<rdar://problem/48112492>
Reviewed by Mark Lam.
Before r241233, String.fromCharCode (except for an empty string) always returns 16bit string.
This makes the rope generated by padEnd 16bit. When we resolve the rope inside JSON.stringify,
it immediately fails due the large size.
After r241233, String.fromCharCode starts returning 8bit string if possible. So the rope becomes
8bit, and we successfully resolve the rope in this case. Resolving such a large rope takes long
time and that is why stress/regress-178386.js starts timing out. Note that, the test fails with
OOM error anyway because JSON.stringify's builder overflows with such a large string input.
This patch changes the test to produce 16bit string from String.fromCharCode.
* stress/regress-178386.js:
2019-02-26 Mark Lam <[email protected]>
wasmToJS() should purify incoming NaNs.
https://bugs.webkit.org/show_bug.cgi?id=194807
<rdar://problem/48189132>
Reviewed by Saam Barati.
* wasm/regress/wasmToJS-should-purify-NaNs.js: Added.
2019-02-26 Guillaume Emont <[email protected]>
[JSC] Repeat string created from Array.prototype.join() take too much memory
https://bugs.webkit.org/show_bug.cgi?id=193912
Reviewed by Saam Barati.
Added a test and a microbenchmark for corner cases of
Array.prototype.join() with an uninitialized array.
* microbenchmarks/array-prototype-join-uninitialized.js: Added.
* stress/array-prototype-join-uninitialized.js: Added.
(testArray):
(testABC):
(B):
(C):
2019-02-22 Robin Morisset <[email protected]>
DFGBytecodeParser should not declare that a node won't clobberExit if DFGFixupPhase can later declare it does clobberExit
https://bugs.webkit.org/show_bug.cgi?id=194953
<rdar://problem/47595253>
Reviewed by Saam Barati.
I could not make this work without the infinite loop, so I am using a watchdog to be able to use it as a regression test.
* stress/has-indexed-property-with-worsening-array-mode.js: Added.
2019-02-19 Joseph Pecoraro <[email protected]>
Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
https://bugs.webkit.org/show_bug.cgi?id=172848
<rdar://problem/25709212>
Reviewed by Mark Lam.
* typeProfiler/inheritance.js:
Rewrite the test slightly for clarity. The hoisting was confusing.
* heapProfiler/class-names.js: Added.
(MyES5Class):
(MyES6Class):
(MyES6Subclass):
Test object types and improved class names.
* heapProfiler/driver/driver.js:
(CheapHeapSnapshotNode):
(CheapHeapSnapshot):
(createCheapHeapSnapshot):
(HeapSnapshot):
(createHeapSnapshot):
Update snapshot parsing from version 1 to version 2.
2019-02-19 Truitt Savell <[email protected]>
Unreviewed, rolling out r241784.
Broke all OpenSource builds.
Reverted changeset:
"Web Inspector: Improve ES6 Class instances in Heap Snapshot
instances view"
https://bugs.webkit.org/show_bug.cgi?id=172848
https://trac.webkit.org/changeset/241784
2019-02-19 Joseph Pecoraro <[email protected]>
Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
https://bugs.webkit.org/show_bug.cgi?id=172848
<rdar://problem/25709212>
Reviewed by Mark Lam.
* typeProfiler/inheritance.js:
Rewrite the test slightly for clarity. The hoisting was confusing.
* heapProfiler/class-names.js: Added.
(MyES5Class):
(MyES6Class):
(MyES6Subclass):
Test object types and improved class names.
* heapProfiler/driver/driver.js:
(CheapHeapSnapshotNode):
(CheapHeapSnapshot):
(createCheapHeapSnapshot):
(HeapSnapshot):
(createHeapSnapshot):
Update snapshot parsing from version 1 to version 2.
2019-02-18 Dominik Infuehr <[email protected]>
[ARM] Fix crash with sampling profiler
https://bugs.webkit.org/show_bug.cgi?id=194772
Reviewed by Mark Lam.
Do not skip test since crash with sampling profiler is now fixed.
* stress/sampling-profiler-richards.js:
2019-02-18 Yusuke Suzuki <[email protected]>
[JSC] Add LazyClassStructure::getInitializedOnMainThread
https://bugs.webkit.org/show_bug.cgi?id=194784
<rdar://problem/48154820>
Reviewed by Mark Lam.
* stress/lazy-initialization-done-a-priori-if-jit-enabled.js: Added.
(getProperties):
(getRandomProperty):
(i.catch):
2019-02-18 Dominik Infuehr <[email protected]>
[ARM] Test gardening: Test running out of executable memory
https://bugs.webkit.org/show_bug.cgi?id=194771
Unreviewed. Do not run test without LLInt, test is running out of executable
memory on ARM otherwise.
* stress/tagged-template-object-collect.js:
2019-02-18 Tomas Popela <[email protected]>
Unreviewed, skip the test on platforms without sampling profiler
* stress/sampling-profiler-stack-trace-with-double-quote-in-function-name.js:
(platformSupportsSamplingProfiler.foo):
(platformSupportsSamplingProfiler.test):
(platformSupportsSamplingProfiler):
(foo): Deleted.
(test): Deleted.
2019-02-17 Saam Barati <[email protected]>
Deadlock when adding a Structure property transition and then doing incremental marking
https://bugs.webkit.org/show_bug.cgi?id=194767
Reviewed by Mark Lam.
* stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js: Added.
2019-02-15 Michael Saboff <[email protected]>
RELEASE_ASSERT at com.apple.JavaScriptCore: JSC::jsSubstringOfResolved
https://bugs.webkit.org/show_bug.cgi?id=194558
Reviewed by Saam Barati.
New regression test.
* stress/regexp-unicode-within-string.js: Added.
2019-02-15 Mark Lam <[email protected]>
SamplingProfiler::stackTracesAsJSON() should escape strings.
https://bugs.webkit.org/show_bug.cgi?id=194649
<rdar://problem/48072386>
Reviewed by Saam Barati.
* stress/sampling-profiler-stack-trace-with-double-quote-in-function-name.js: Added.
* stress/type-profiler-with-double-quote-in-constructor-name.js: Added.
* stress/type-profiler-with-double-quote-in-field-name.js: Added.
* stress/type-profiler-with-double-quote-in-optional-field-name.js: Added.
2019-02-15 Robin Morisset <[email protected]>
CodeBlock::jettison should clear related watchpoints
https://bugs.webkit.org/show_bug.cgi?id=194544
Reviewed by Mark Lam.
* stress/regexp-replace-double-watchpoint.js: Added.
(foo):
2019-02-15 Saam barati <[email protected]>
[WebAssembly] Write a new register allocator for Air O0 and make BBQ use it
https://bugs.webkit.org/show_bug.cgi?id=194036
Reviewed by Yusuke Suzuki.
* stress/tail-call-many-arguments.js: Added.
(foo):
(bar):
2019-02-14 Saam Barati <[email protected]>
Cache the results of BytecodeGenerator::getVariablesUnderTDZ
https://bugs.webkit.org/show_bug.cgi?id=194583
<rdar://problem/48028140>
Reviewed by Yusuke Suzuki.
* microbenchmarks/cache-get-variables-under-tdz-in-bytecode-generator.js: Added.
2019-02-08 Yusuke Suzuki <[email protected]>
[JSC] String.fromCharCode's slow path always generates 16bit string
https://bugs.webkit.org/show_bug.cgi?id=194466
Reviewed by Keith Miller.
* stress/string-from-char-code-slow-path.js: Added.
(shouldBe):
(testWithLength):
2019-02-08 Saam barati <[email protected]>
Nodes that rely on being dominated by CheckInBounds should have a child edge to it
https://bugs.webkit.org/show_bug.cgi?id=194334
<rdar://problem/47844327>
Reviewed by Mark Lam.
* stress/check-in-bounds-should-be-a-child-use.js: Added.
(func):
2019-02-06 Yusuke Suzuki <[email protected]>
[JSC] InitializeEntrypointArguments should produce SpecCellCheck if FlushFormat is FlushedCell
https://bugs.webkit.org/show_bug.cgi?id=194369
<rdar://problem/47813087>
Reviewed by Saam Barati.
* stress/initialize-entrypoint-arguments-with-tdz.js: Added.
(A):
2019-02-06 Yusuke Suzuki <[email protected]>
[JSC] PrivateName to PublicName hash table is wasteful
https://bugs.webkit.org/show_bug.cgi?id=194277
Reviewed by Michael Saboff.
This test depends on the order of JSSegmentedVariableObjects' variables, which is not guaranteed in JSC. Skipped.
* ChakraCore.yaml:
2019-02-05 Dominik Infuehr <[email protected]>
[ARM] Test running out of executable memory
https://bugs.webkit.org/show_bug.cgi?id=194285
Unreviewed. Do no execute test with LLInt disabled, test runs out of
executable memory otherwise.
* stress/class-subclassing-function.js:
2019-02-04 Robin Morisset <[email protected]>
when lowering AssertNotEmpty, create the value before creating the patchpoint
https://bugs.webkit.org/show_bug.cgi?id=194231
Reviewed by Saam Barati.
This test is painfully fragile: it tries to test that AssertNotEmpty on a constant produces valid B3 IR.
The problem is that AssertNotEmpty is only created by DFGConstantFolding when it can simplify a CheckStructure, and constant folding is a bit capricious (https://bugs.webkit.org/show_bug.cgi?id=133947)
So even tiny changes to this test can change the path code taken.
* stress/assert-not-empty.js: Added.
(foo):
2019-02-01 Mark Lam <[email protected]>
Remove invalid assertion in DFG's compileDoubleRep().
https://bugs.webkit.org/show_bug.cgi?id=194130
<rdar://problem/47699474>
Reviewed by Saam Barati.
* stress/constant-fold-double-rep-into-double-constant.js: Added.
2019-01-30 Ross Kirsling <[email protected]>
Import latest Test262 updates.
Rubber-stamped by Keith Miller.
* test262.yaml: Deleted.
* test262/config.yaml:
* test262/expectations.yaml:
* test262/latest-changes-summary.txt:
* test262/test/:
* test262/test262-Revision.txt:
2019-01-30 Robin Morisset <[email protected]>
Object.keys can now lead to a PhantomNewArrayBuffer, OSR exit from the FTL should know how to materialize a NewArrayBuffer in that case
https://bugs.webkit.org/show_bug.cgi?id=194050
<rdar://problem/47595592>
Reviewed by Yusuke Suzuki.
* stress/object-keys-osr-exit.js: Added.
(foo):
(catch):
2019-01-29 Mark Lam <[email protected]>
ValueRecovery::recover() should purify NaN values it recovers.
https://bugs.webkit.org/show_bug.cgi?id=193978
<rdar://problem/47625488>
Reviewed by Saam Barati.
* stress/value-recovery-of-double-displaced-in-jsstack-should-be-purified.js: Added.
2019-01-28 Yusuke Suzuki <[email protected]>
Unreviewed, fix the test after r240543 not to use @Error / Error in builtins
https://bugs.webkit.org/show_bug.cgi?id=193713
* stress/try-get-by-id-should-spill-registers-dfg.js:
(let.f.createBuiltin):
2019-01-28 Mark Lam <[email protected]>
ToString node actually does GC.
https://bugs.webkit.org/show_bug.cgi?id=193920
<rdar://problem/46695900>
Reviewed by Yusuke Suzuki.
* stress/dfg-to-string-on-int-does-gc.js: Added.
* stress/dfg-to-string-on-string-object-does-not-gc.js: Added.
* stress/dfg-to-string-on-string-or-string-object-does-not-gc.js: Added.
2019-01-25 Yusuke Suzuki <[email protected]>
[JSC] NativeErrorConstructor should not have own IsoSubspace
https://bugs.webkit.org/show_bug.cgi?id=193713
Reviewed by Saam Barati.
Remove @Error use.
* stress/try-get-by-id-should-spill-registers-dfg.js:
(let.f.createBuiltin):
2019-01-24 Yusuke Suzuki <[email protected]>
stress/const-semantics.js fails a dfg-eager / ftl-eager run with an ASAN release build.
https://bugs.webkit.org/show_bug.cgi?id=190693
Reviewed by Michael Saboff.
* stress/regress-190693.js: Added.
(truth):
(assert):
(shouldThrowInvalidConstAssignment):
(taz):
2019-01-24 Saam Barati <[email protected]>
Object Allocation Sinking phase can move a node that walks the stack into a place where the InlineCallFrame is no longer valid
https://bugs.webkit.org/show_bug.cgi?id=193751
<rdar://problem/47280215>
Reviewed by Michael Saboff.
* stress/object-allocation-sinking-phase-must-only-move-allocations-if-stack-trace-is-still-valid.js: Added.
(let.thing):
(foo.let.hello):
(foo):
2019-01-24 Guillaume Emont <[email protected]>
[JSC] Reenable baseline JIT on mips
https://bugs.webkit.org/show_bug.cgi?id=192983
Reviewed by Mark Lam.
Added a new test for a case that was triggering a RELEASE_ASSERT when
testing.
Disable some slow tests that were already disabled for arm and x86.
* stress/json-parse-big-object.js: Added.
* stress/new-largeish-contiguous-array-with-size.js:
* stress/op_add.js:
* stress/op_bitand.js:
* stress/op_bitor.js:
* stress/op_bitxor.js:
* stress/op_lshift-ConstVar.js:
* stress/op_lshift-VarConst.js:
* stress/op_lshift-VarVar.js:
* stress/op_mod-ConstVar.js:
* stress/op_mod-VarConst.js:
* stress/op_mod-VarVar.js:
* stress/op_mul-ConstVar.js:
* stress/op_mul-VarConst.js:
* stress/op_mul-VarVar.js:
* stress/op_rshift-ConstVar.js:
* stress/op_rshift-VarConst.js:
* stress/op_rshift-VarVar.js:
* stress/op_sub-ConstVar.js:
* stress/op_sub-VarConst.js:
* stress/op_sub-VarVar.js:
* stress/op_urshift-ConstVar.js:
* stress/op_urshift-VarConst.js:
* stress/op_urshift-VarVar.js:
* stress/sampling-profiler-richards.js:
* stress/spread-forward-call-varargs-stack-overflow.js:
2019-01-23 Yusuke Suzuki <[email protected]>
[DFG] AvailabilityMap::pruneByLiveness should make non-live operands Availability::unavailable instead of Availability()
https://bugs.webkit.org/show_bug.cgi?id=193711
<rdar://problem/47250262>
Reviewed by Saam Barati.
* stress/availability-was-cleared-when-locals-are-not-live.js: Added.
(shouldBe):
(foo):
(bar):
(baz):
2019-01-22 Yusuke Suzuki <[email protected]>
Unreviewed, fix initial global lexical binding epoch
https://bugs.webkit.org/show_bug.cgi?id=193603
<rdar://problem/47380869>
* stress/global-lexical-binding-epoch-should-be-correct-one.js: Added.
(f1.f2.f3.f4):
(f1.f2.f3):
(f1.f2):
(f1):
2019-01-22 Yusuke Suzuki <[email protected]>
REGRESSION(r239612) Crash at runtime due to broken DFG assumption
https://bugs.webkit.org/show_bug.cgi?id=193709
<rdar://problem/47363838>
Unreviewed, rollout to watch the tests.
* stress/object-tostring-changed-proto.js: Removed.
* stress/object-tostring-changed.js: Removed.
* stress/object-tostring-misc.js: Removed.
* stress/object-tostring-other.js: Removed.
* stress/object-tostring-untyped.js: Removed.
2019-01-22 Saam Barati <[email protected]>
Unreviewed. Rollout r240223. It regressed JetStream2 by 1%.
* stress/arith-abs-to-arith-negate-range-optimizaton.js:
(testUncheckedBetweenIntMinInclusiveAndZeroExclusive):
(testUncheckedLessThanZero):
(testUncheckedLessThanOrEqualZero):
* stress/movhint-backwards-propagation-must-merge-use-as-value-add.js: Removed.
* stress/movhint-backwards-propagation-must-merge-use-as-value.js: Removed.
2019-01-22 Yusuke Suzuki <[email protected]>
[JSC] Invalidate old scope operations using global lexical binding epoch
https://bugs.webkit.org/show_bug.cgi?id=193603
<rdar://problem/47380869>
Reviewed by Saam Barati.
* stress/let-lexical-binding-shadow-existing-global-property-ftl.js:
* stress/scope-operation-cache-global-property-before-deleting.js: Added.
(shouldThrow):
(bar):
* stress/scope-operation-cache-global-property-bump-counter.js: Added.
(shouldBe):
(get1):
(get2):
(get1If):
(get2If):
* stress/scope-operation-cache-global-property-even-if-it-fails.js: Added.
(shouldThrow):
(foo):
2019-01-21 Yusuke Suzuki <[email protected]>
Unreviewed, roll out r240220 due to date-format-xparb regression
https://bugs.webkit.org/show_bug.cgi?id=193603
* stress/let-lexical-binding-shadow-existing-global-property-ftl.js:
* stress/scope-operation-cache-global-property-before-deleting.js: Removed.
* stress/scope-operation-cache-global-property-bump-counter.js: Removed.
* stress/scope-operation-cache-global-property-even-if-it-fails.js: Removed.
2019-01-21 Caio Lima <[email protected]>
DoesGC rule is wrong for nodes with BigIntUse
https://bugs.webkit.org/show_bug.cgi?id=193652
Reviewed by Saam Barati.
* stress/big-int-value-op-update-gc-rules.js: Added.
(assert):
(doesGCAdd):
(doesGCSub):
(doesGCDiv):
(doesGCMul):
(doesGCBitAnd):
(doesGCBitOr):
(doesGCBitXor):
2019-01-20 Saam Barati <[email protected]>
DFG: When inlining DataView set* intrinsics we need to set undefined as our result
https://bugs.webkit.org/show_bug.cgi?id=193644
<rdar://problem/46209745>
Reviewed by Yusuke Suzuki.
* stress/data-view-set-intrinsic-undefined-result-2.js: Added.
(foo):
* stress/data-view-set-intrinsic-undefined-result.js: Added.
(foo):
(bar):
2019-01-20 Saam Barati <[email protected]>
MovHint must merge NodeBytecodeUsesAsValue for its child
https://bugs.webkit.org/show_bug.cgi?id=186916
<rdar://problem/41396612>
Reviewed by Yusuke Suzuki.
* stress/arith-abs-to-arith-negate-range-optimizaton.js:
* stress/movhint-backwards-propagation-must-merge-use-as-value.js: Added.
2019-01-20 Yusuke Suzuki <[email protected]>
[JSC] Invalidate old scope operations using global lexical binding epoch
https://bugs.webkit.org/show_bug.cgi?id=193603
<rdar://problem/47380869>
Reviewed by Saam Barati.
* stress/let-lexical-binding-shadow-existing-global-property-ftl.js:
* stress/scope-operation-cache-global-property-before-deleting.js: Added.
(shouldThrow):
(bar):
* stress/scope-operation-cache-global-property-bump-counter.js: Added.
(shouldBe):
(get1):
(get2):
(get1If):
(get2If):
* stress/scope-operation-cache-global-property-even-if-it-fails.js: Added.
(shouldThrow):
(foo):
2019-01-17 Saam barati <[email protected]>
StringObjectUse should not be a structure check for the original string object structure
https://bugs.webkit.org/show_bug.cgi?id=193483
<rdar://problem/47280522>
Reviewed by Yusuke Suzuki.
* stress/cant-eliminate-string-object-structure-check-when-string-object-is-proven.js: Added.
(foo):
(a.valueOf.0):
2019-01-17 Yusuke Suzuki <[email protected]>
[JSC] ToThis omission in DFGByteCodeParser is wrong
https://bugs.webkit.org/show_bug.cgi?id=193513
<rdar://problem/45842236>
Reviewed by Saam Barati.
* stress/to-this-omission-with-different-strict-modes.js: Added.
(thisA):
(thisAStrictWrapper):
2019-01-15 Mark Lam <[email protected]>
JSFunction::canUseAllocationProfile() should account for builtin functions with no own prototypes.
https://bugs.webkit.org/show_bug.cgi?id=193423
<rdar://problem/46209355>
Reviewed by Saam Barati.
* microbenchmarks/sinkable-new-object-with-builtin-constructor.js: Added.
* stress/constructing-builtin-functions-with-getter-prototype-should-only-call-getter-once-per-new-1.js: Added.
* stress/constructing-builtin-functions-with-getter-prototype-should-only-call-getter-once-per-new-2.js: Added.
* stress/jsfunction-cannot-use-allocation-profile-with-builtin-functions-with-no-prototype.js: Added.
2019-01-15 Yusuke Suzuki <[email protected]>
[JSC] Use KnownStringUse for GetByVal(Array::String) since AI would offer wider type information and offer non-string type after removing Check(String)
https://bugs.webkit.org/show_bug.cgi?id=193438
<rdar://problem/45581249>
Reviewed by Saam Barati and Keith Miller.
Under the heavy load (like, compiling WebKit), AI in this code can broaden type information after the 1st run.
Then, GetByVal(String) crashed.
* stress/string-get-by-val-lowering.js: Added.
(shouldBe):
(test):
* stress/type-for-get-by-val-can-be-widen-after-ai.js: Added.
(Hello):
(foo):
2019-01-15 Tomas Popela <[email protected]>
Unreviewed, skip JIT tests if it's not enabled
* stress/bit-op-with-object-returning-int32.js:
2019-01-15 Caio Lima <[email protected]>
DFGByteCodeParser rules for bitwise operations should consider type of their operands
https://bugs.webkit.org/show_bug.cgi?id=192966
Reviewed by Yusuke Suzuki.
* stress/bit-op-with-object-returning-int32.js: Added.
2019-01-15 Guillaume Emont <[email protected]>
Skip a slow test and a flakey test on arm
Unreviewed gardening.
* typeProfiler/getter-richards.js:
this test always times out, it used to be always skipped on arm and
mips, but got accidentally enabled by r237919 now that we have DFG on
arm. Also skipping on mips as we plan to soon enable DFG for it too.
2019-01-14 Keith Miller <[email protected]>
Skip type-check-hoisting-phase-hoist... with no jit
https://bugs.webkit.org/show_bug.cgi?id=193421
Reviewed by Mark Lam.
It's timing out the 32-bit bots and takes 330 seconds
on my machine when run by itself.
* stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js:
2019-01-14 Yusuke Suzuki <[email protected]>
[JSC] AI should check the given constant's array type when folding GetByVal into constant
https://bugs.webkit.org/show_bug.cgi?id=193413
<rdar://problem/46092389>
Reviewed by Keith Miller.
This test is super flaky. It causes crash in r238109, but it does not crash with `--useConcurrentJIT=false`.
It does not cause any crashes on the latest revision too. Basically, it highly depends on the timing, and
without this patch, the root cause is not fixed yet. If GetLocal is turned into JSConstant in AI,
but GetByVal does not have appropriate ArrayModes, JSC crashes.
* stress/ai-should-perform-array-check-on-get-by-val-constant-folding.js: Added.
(compareArray):
2019-01-14 Caio Lima <[email protected]>
[BigInt] Literal parsing is crashing when used inside a Object Literal
https://bugs.webkit.org/show_bug.cgi?id=193404
Reviewed by Yusuke Suzuki.
* stress/big-int-literal-inside-literal-object.js: Added.
2019-01-14 Yusuke Suzuki <[email protected]>
[JSC] Do not use asArrayModes() with Structures because it discards TypedArray information
https://bugs.webkit.org/show_bug.cgi?id=193372
Reviewed by Saam Barati.
* stress/typed-array-array-modes-profile.js: Added.
(foo):
2019-01-14 Mark Lam <[email protected]>
Fix all CLoop JSC test failures (including some LLInt bugs due to recent bytecode format change).
https://bugs.webkit.org/show_bug.cgi?id=193402
<rdar://problem/46012309>
Reviewed by Keith Miller.
* stress/regexp-compile-oom.js:
- Skip this test for !$jitTests because it is tuned for stack usage when the JIT
is enabled. As a result, it will fail on cloop builds though there is no bug.
2019-01-11 Saam barati <[email protected]>
DFG combined liveness can be wrong for terminal basic blocks
https://bugs.webkit.org/show_bug.cgi?id=193304
<rdar://problem/45268632>
Reviewed by Yusuke Suzuki.
* stress/dfg-combined-liveness-consider-terminal-blocks-bytecode-liveness.js: Added.
2019-01-11 Yusuke Suzuki <[email protected]>
[JSC] Global lexical bindings can shadow global variables if it is `configurable = true`
https://bugs.webkit.org/show_bug.cgi?id=193308
<rdar://problem/45546542>
Reviewed by Saam Barati.
* stress/const-lexical-binding-shadow-existing-global-property-ftl.js: Added.
(shouldThrow):
(shouldBe):
(foo):
(get shouldThrow):
* stress/const-lexical-binding-shadow-existing-global-property-tdz-ftl.js: Added.
(shouldThrow):
(shouldBe):
(foo):
(get shouldBe):
(get shouldThrow):
(get return):
* stress/const-lexical-binding-shadow-existing-global-property-tdz.js: Added.
(shouldThrow):
(shouldBe):
(foo):
(get shouldBe):
(get shouldThrow):
* stress/const-lexical-binding-shadow-existing-global-property.js: Added.
(shouldThrow):
(shouldBe):
(foo):
* stress/const-lexical-binding-shadowing-global-properties-and-eval-injection.js: Added.
(shouldThrow):
(shouldBe):
(foo):
* stress/global-add-function-should-not-be-shadowed-by-lexical-bindings.js: Added.
(shouldThrow):
* stress/global-static-variables-should-not-be-shadowed-by-lexical-bindings.js: Added.
(shouldThrow):
* stress/let-lexical-binding-shadow-existing-global-property-ftl.js: Added.
(shouldThrow):
(shouldBe):
(foo):
* stress/let-lexical-binding-shadow-existing-global-property-tdz-ftl.js: Added.
(shouldThrow):
(shouldBe):
(foo):
(get shouldBe):
(get shouldThrow):
(get return):
* stress/let-lexical-binding-shadow-existing-global-property-tdz.js: Added.
(shouldThrow):
(shouldBe):
(foo):
(get shouldBe):
(get shouldThrow):
* stress/let-lexical-binding-shadow-existing-global-property.js: Added.
(shouldThrow):
(shouldBe):
(foo):
* stress/let-lexical-binding-shadowing-global-properties-and-eval-injection.js: Added.
(shouldThrow):
(shouldBe):
(foo):
2019-01-11 Dominik Infuehr <[email protected]>
Enable DFG on ARM/Linux again
https://bugs.webkit.org/show_bug.cgi?id=192496
Reviewed by Yusuke Suzuki.
Test wasn't really skipped before moving the line with skip
to the top.
* stress/regress-192717.js:
2019-01-10 Commit Queue <[email protected]>
Unreviewed, rolling out r239825.
https://bugs.webkit.org/show_bug.cgi?id=193330
Broke tests on armv7/linux bots (Requested by guijemont on
#webkit).
Reverted changeset:
"Enable DFG on ARM/Linux again"
https://bugs.webkit.org/show_bug.cgi?id=192496
https://trac.webkit.org/changeset/239825
2019-01-10 Dominik Infuehr <[email protected]>
Enable DFG on ARM/Linux again
https://bugs.webkit.org/show_bug.cgi?id=192496
Reviewed by Yusuke Suzuki.
Test wasn't really skipped before moving the line with skip
to the top.
* stress/regress-192717.js:
2019-01-08 Yusuke Suzuki <[email protected]>
Array.prototype.flat/flatMap have a minor bug in ArraySpeciesCreate
https://bugs.webkit.org/show_bug.cgi?id=193127
Reviewed by Saam Barati.
* stress/array-species-create-should-handle-masquerader.js: Added.
(shouldThrow):
* stress/is-undefined-or-null-builtin.js: Added.
(shouldBe):
(isUndefinedOrNull.vm.createBuiltin):
2019-01-08 Tadeu Zagallo <[email protected]>
LLInt put_by_id uses the wrong load instruction for loading flags from the metadata
https://bugs.webkit.org/show_bug.cgi?id=193221
Reviewed by Mark Lam.
* stress/put-by-id-flags.js: Added.
(f):
(g):
(numberOfDFGCompiles):
2019-01-04 Tadeu Zagallo <[email protected]>
Baseline version of get_by_id may corrupt metadata
https://bugs.webkit.org/show_bug.cgi?id=193085
<rdar://problem/23453006>
Reviewed by Saam Barati.
* stress/get-by-id-change-mode.js: Added.
(forEach):
2019-01-02 Yusuke Suzuki <[email protected]>
[JSC] Optimize Object.prototype.toString
https://bugs.webkit.org/show_bug.cgi?id=193031
Reviewed by Saam Barati.
* stress/object-tostring-changed-proto.js: Added.
(shouldBe):
(test):
* stress/object-tostring-changed.js: Added.
(shouldBe):
(test):
* stress/object-tostring-misc.js: Added.
(shouldBe):
(test):
(i.switch):
* stress/object-tostring-other.js: Added.
(shouldBe):
(test):
* stress/object-tostring-untyped.js: Added.
(shouldBe):
(test):
(i.switch):
2019-01-03 Ross Kirsling <[email protected]>
test262-runner misbehaves when test file YAML has a trailing space
https://bugs.webkit.org/show_bug.cgi?id=193053
Reviewed by Yusuke Suzuki.
* test262/expectations.yaml:
Mark two dozen tests as passing (and correct the output of another).
2018-12-30 Yusuke Suzuki <[email protected]>
Unreviewed, JSTests gardening with memoryLimited
* stress/string-overflow-createError.js:
2018-12-30 Ross Kirsling <[email protected]>
[JSC] Identifier validity should be based on ID_Start / ID_Continue properties
https://bugs.webkit.org/show_bug.cgi?id=193050
Reviewed by Yusuke Suzuki.
* test262.yaml:
* test262/expectations.yaml:
Mark 16 tests as passing.
2018-12-13 Yusuke Suzuki <[email protected]>
[BigInt] Support BigInt in JSON.stringify
https://bugs.webkit.org/show_bug.cgi?id=192624
Reviewed by Saam Barati.
* stress/big-int-json-stringify-to-json.js: Added.
(shouldBe):
(shouldThrow):
(BigInt.prototype.toJSON):
(shouldBe.JSON.stringify):
* stress/big-int-json-stringify.js: Added.
(shouldBe):
(shouldThrow):
2018-12-20 Yusuke Suzuki <[email protected]>
[JSC] Implement "well-formed JSON.stringify" proposal
https://bugs.webkit.org/show_bug.cgi?id=191677
Reviewed by Darin Adler.
* stress/json-surrogate-pair.js: Added.
(shouldBe):
* test262/expectations.yaml:
2018-12-20 Keith Miller <[email protected]>
Add support for globalThis
https://bugs.webkit.org/show_bug.cgi?id=165171
Reviewed by Mark Lam.
* test262/config.yaml:
2018-12-19 Keith Miller <[email protected]>
Update test262 configuration to not run tests dependent on ICU version.
https://bugs.webkit.org/show_bug.cgi?id=192920
Reviewed by Saam Barati.
* test262/expectations.yaml:
2018-12-20 Mark Lam <[email protected]>
Fix a typo in slow_path_construct_arityCheck and operationConstructArityCheck.
https://bugs.webkit.org/show_bug.cgi?id=192939
<rdar://problem/46869516>
Reviewed by Keith Miller.
* stress/stack-overflow-frame-for-construct-arityCheck-should-use-construct-codeBlock.js: Added.
2018-12-20 Tadeu Zagallo <[email protected]>
WTF::String and StringImpl overflow MaxLength
https://bugs.webkit.org/show_bug.cgi?id=192853
<rdar://problem/45726906>
Reviewed by Mark Lam.
* stress/string-16bit-repeat-overflow.js: Added.
(catch):
2018-12-19 Ross Kirsling <[email protected]>
Unreviewed follow-up to r192914.
* test262/expectations.yaml:
Add the last 20 missing expectations.
2018-12-19 Keith Miller <[email protected]>
Fix test262 expectations
https://bugs.webkit.org/show_bug.cgi?id=192914
Unreviewed, when I imported the latest round of test262 tests I must have failed to update the test expectations.
* test262/expectations.yaml:
2018-12-19 Keith Miller <[email protected]>
Update test262 tests.
https://bugs.webkit.org/show_bug.cgi?id=192907
Rubber stamped by Mark Lam.
* test262/*: Omitted because prepare-changelog crashes.
2018-12-19 Mark Lam <[email protected]>
JSPropertyNameEnumerator should cache the iterated object's structure only after getting its property names.
https://bugs.webkit.org/show_bug.cgi?id=192464
<rdar://problem/46519455>
Reviewed by Saam Barati.
This patch is about a 10% speed up on the new for-in-on-object-with-lazily-materialized-properties.js
microbenchmark.
* microbenchmarks/for-in-on-object-with-lazily-materialized-properties.js: Added.
* stress/property-name-enumerator-should-cache-structure-after-getting-property-names.js: Added.
2018-12-19 Tadeu Zagallo <[email protected]>
String overflow in JSC::createError results in ASSERT in WTF::makeString
https://bugs.webkit.org/show_bug.cgi?id=192833
<rdar://problem/45706868>
Reviewed by Mark Lam.
* stress/string-overflow-createError.js: Added.
2018-12-18 Ross Kirsling <[email protected]>
Error message for `-x ** y` contains a typo.
https://bugs.webkit.org/show_bug.cgi?id=192832
Reviewed by Saam Barati.
* ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
(assert.assert.return.throws):
* stress/pow-expects-update-expression-on-lhs.js:
(throw.new.Error):
Update test expectations which match against the exact error message.
2018-12-18 Mark Lam <[email protected]>
Gardening: test options fix.
https://bugs.webkit.org/show_bug.cgi?id=192822
Unreviewed.
* stress/json-stringify-string-builder-overflow.js:
2018-12-18 Mark Lam <[email protected]>
JSON.stringify() should throw OOM on StringBuilder overflows.
https://bugs.webkit.org/show_bug.cgi?id=192822
<rdar://problem/46670577>
Reviewed by Saam Barati.
* stress/json-stringify-string-builder-overflow.js: Added.
2018-12-18 Ross Kirsling <[email protected]>
Redeclaration of var over let/const/class should be a syntax error.
https://bugs.webkit.org/show_bug.cgi?id=192298
Reviewed by Keith Miller.
* test262.yaml:
* test262/expectations.yaml:
Mark 46 tests as passing.
* stress/block-scope-redeclarations.js:
Add some new tests.
* stress/for-in-invalidate-context-weird-assignments.js:
* stress/for-in-tests.js:
Replace tests for outdated behavior with tests for SyntaxError.
* ChakraCore/test/LetConst/defer3.baseline-jsc:
* ChakraCore/test/LetConst/letvar.baseline-jsc:
Update expectations.
2018-12-18 Mark Lam <[email protected]>
Skip the stress/elidable-new-object-roflcopter-then-exit.js test on 32-bit.
https://bugs.webkit.org/show_bug.cgi?id=191374
<rdar://problem/46525447>
Reviewed by Yusuke Suzuki.
This test runs too slow on 32-bit, and is not relevant for non-JIT builds.
* stress/elidable-new-object-roflcopter-then-exit.js:
2018-12-17 Mark Lam <[email protected]>
Skip the stress/materialized-regexp-has-correct-last-index-set-by-match.js test on 32-bit.
https://bugs.webkit.org/show_bug.cgi?id=192019
<rdar://problem/46525456>
Reviewed by Yusuke Suzuki.
The test runs too slow on 32-bit.
* stress/materialized-regexp-has-correct-last-index-set-by-match.js:
2018-12-17 Mark Lam <[email protected]>
Skip the stress/materialize-regexp-cyclic-regexp.js test on 32-bit.
https://bugs.webkit.org/show_bug.cgi?id=191373
<rdar://problem/46525458>
Reviewed by Yusuke Suzuki.
The test is already slow running with a JIT on 64-bit. It will always timeout
on 32-bit without a JIT.
* stress/materialize-regexp-cyclic-regexp.js:
2018-12-17 Mark Lam <[email protected]>
Array unshift/shift should not race against the AI in the compiler thread.
https://bugs.webkit.org/show_bug.cgi?id=192795
<rdar://problem/46724263>
Reviewed by Saam Barati.
* stress/array-unshift-should-not-race-against-compiler-thread.js: Added.
2018-12-16 Yusuke Suzuki <[email protected]>
[JSC] Optimize Object.keys by caching own keys results in StructureRareData
https://bugs.webkit.org/show_bug.cgi?id=190047
Reviewed by Saam Barati.
* stress/object-keys-cached-zero.js: Added.
(shouldBe):
(test):
* stress/object-keys-changed-attribute.js: Added.
(shouldBe):
(test):
* stress/object-keys-changed-index.js: Added.
(shouldBe):
(test):
* stress/object-keys-changed.js: Added.
(shouldBe):
(test):
* stress/object-keys-indexed-non-cache.js: Added.
(shouldBe):
(test):
* stress/object-keys-overrides-get-property-names.js: Added.
(shouldBe):
(test):
(noInline):
2018-12-17 Mark Lam <[email protected]>
SamplingProfiler's isValidFramePointer() should reject address at stack origin.
https://bugs.webkit.org/show_bug.cgi?id=192779
<rdar://problem/46775869>
Reviewed by Saam Barati.
* stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js: Added.
2018-12-17 Ryan Haddad <[email protected]>
Unreviewed test gardening, address a syntax error in a new test.
* stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js:
2018-12-17 Mark Lam <[email protected]>
Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit().
https://bugs.webkit.org/show_bug.cgi?id=192776
<rdar://problem/46772368>
Reviewed by Keith Miller.
* stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js: Added.
2018-12-17 Mark Lam <[email protected]>
Fix stale assertion in attemptToForceStringArrayModeByToStringConversion().
https://bugs.webkit.org/show_bug.cgi?id=192770
<rdar://problem/46449037>
Reviewed by Keith Miller.
* stress/force-string-arrayMode-on-originalNonArray-array-class.js: Added.
2018-12-14 Mark Lam <[email protected]>
CallFrame::convertToStackOverflowFrame() needs to keep the top CodeBlock alive.
https://bugs.webkit.org/show_bug.cgi?id=192717
<rdar://problem/46660677>
Reviewed by Saam Barati.
* stress/regress-192717.js: Added.
2018-12-14 Commit Queue <[email protected]>
Unreviewed, rolling out r239153, r239154, and r239155.
https://bugs.webkit.org/show_bug.cgi?id=192715
Caused flaky GC-related crashes seen with layout tests
(Requested by ryanhaddad on #webkit).
Reverted changesets:
"[JSC] Optimize Object.keys by caching own keys results in
StructureRareData"
https://bugs.webkit.org/show_bug.cgi?id=190047
https://trac.webkit.org/changeset/239153
"Unreviewed, build fix after r239153"
https://bugs.webkit.org/show_bug.cgi?id=190047
https://trac.webkit.org/changeset/239154
"Unreviewed, build fix after r239153, part 2"
https://bugs.webkit.org/show_bug.cgi?id=190047
https://trac.webkit.org/changeset/239155
2018-12-14 Keith Miller <[email protected]>
Callers of JSString::getIndex should check for OOM exceptions
https://bugs.webkit.org/show_bug.cgi?id=192709
Reviewed by Mark Lam.
* stress/StringObject-define-length-getter-rope-string-oom.js: Added.
2018-12-13 Mark Lam <[email protected]>
Add a missing exception check.
https://bugs.webkit.org/show_bug.cgi?id=192626
<rdar://problem/46662163>
Reviewed by Keith Miller.
* stress/regress-192626.js: Added.
2018-12-13 Caio Lima <[email protected]>
[BigInt] Add ValueDiv into DFG
https://bugs.webkit.org/show_bug.cgi?id=186178
Reviewed by Yusuke Suzuki.
* stress/big-int-div-jit-osr.js: Added.
* stress/big-int-div-jit-untyped.js: Added.
* stress/value-div-fixup-int32-big-int.js: Added.
2018-12-10 Yusuke Suzuki <[email protected]>
[JSC] Optimize Object.keys by caching own keys results in StructureRareData
https://bugs.webkit.org/show_bug.cgi?id=190047
Reviewed by Keith Miller.
* stress/object-keys-cached-zero.js: Added.
(shouldBe):
(test):
* stress/object-keys-changed-attribute.js: Added.
(shouldBe):
(test):
* stress/object-keys-changed-index.js: Added.
(shouldBe):
(test):
* stress/object-keys-changed.js: Added.
(shouldBe):
(test):
* stress/object-keys-indexed-non-cache.js: Added.
(shouldBe):
(test):
* stress/object-keys-overrides-get-property-names.js: Added.
(shouldBe):
(test):
(noInline):
2018-12-12 Yusuke Suzuki <[email protected]>
[DFG][FTL] Add NewSymbol
https://bugs.webkit.org/show_bug.cgi?id=192620
Reviewed by Saam Barati.
* microbenchmarks/symbol-creation.js: Added.
(test):
* stress/symbol-description-identity.js: Added.
(shouldBe):
(test):
* stress/symbol-identity.js: Added.
(shouldBe):
(test):
* stress/symbol-with-description-throw-error.js: Added.
(shouldBe):
(shouldThrow):
(test):
(object.toString):
2018-12-12 Yusuke Suzuki <[email protected]>
[BigInt] Implement DFG/FTL typeof for BigInt
https://bugs.webkit.org/show_bug.cgi?id=192619
Reviewed by Keith Miller.
* stress/big-int-boolean-proven-type.js: Added.
(assert):
(bool):
* stress/big-int-type-of-proven-type-non-constant-including-symbol.js: Added.
(assert):
(typeOf):
(i.switch):
* stress/big-int-type-of-proven-type-non-constant.js: Added.
(assert):
(typeOf):
* stress/big-int-type-of.js:
(typeOf):
(func):
2018-12-10 Mark Lam <[email protected]>
PropertyAttribute needs a CustomValue bit.
https://bugs.webkit.org/show_bug.cgi?id=191993
<rdar://problem/46264467>
Reviewed by Saam Barati.
* stress/regress-191993.js: Added.
2018-12-10 Caio Lima <[email protected]>
[BigInt] Add ValueMul into DFG
https://bugs.webkit.org/show_bug.cgi?id=186175
Reviewed by Yusuke Suzuki.
* stress/big-int-mul-jit-osr.js: Added.
* stress/big-int-mul-jit-untyped.js: Added.
* stress/value-mul-fixup-int32-big-int.js: Added.
2018-12-06 Keith Miller <[email protected]>
stress/big-wasm-memory tests failing on 32-bit JSC bot
https://bugs.webkit.org/show_bug.cgi?id=192020
Reviewed by Saam Barati.
Not every platform has WebAssembly, e.g. 32-bit, so we should exit
the wasm stress tests if the WebAssembly object does not exist.
* stress/big-wasm-memory-grow-no-max.js:
(test.foo):
(test):
(foo): Deleted.
(catch): Deleted.
* stress/big-wasm-memory-grow.js:
(test.foo):
(test):
(foo): Deleted.
(catch): Deleted.
* stress/big-wasm-memory.js:
(test.foo):
(test):
(foo): Deleted.
(catch): Deleted.
2018-12-05 Mark Lam <[email protected]>
speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
https://bugs.webkit.org/show_bug.cgi?id=192441
<rdar://problem/46480355>
Reviewed by Saam Barati.
* stress/regress-192441.js: Added.
2018-12-04 Mark Lam <[email protected]>
DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility.
https://bugs.webkit.org/show_bug.cgi?id=192386
<rdar://problem/46445516>
Reviewed by Saam Barati.
* stress/regress-192386.js: Added.
2018-12-04 Caio Lima <[email protected]>
[ESNext][BigInt] Support logic operations
https://bugs.webkit.org/show_bug.cgi?id=179903
Reviewed by Yusuke Suzuki.
* stress/big-int-branch-usage.js: Added.
* stress/big-int-logical-and.js: Added.
* stress/big-int-logical-not.js: Added.
* stress/big-int-logical-or.js: Added.
2018-12-03 Ryan Haddad <[email protected]>
Unreviewed, rolling out r238833.
Breaks macOS and iOS debug builds.
Reverted changeset:
"[ESNext][BigInt] Support logic operations"
https://bugs.webkit.org/show_bug.cgi?id=179903
https://trac.webkit.org/changeset/238833
2018-12-03 Caio Lima <[email protected]>
[ESNext][BigInt] Support logic operations
https://bugs.webkit.org/show_bug.cgi?id=179903
Reviewed by Yusuke Suzuki.
* stress/big-int-branch-usage.js: Added.
* stress/big-int-logical-and.js: Added.
* stress/big-int-logical-not.js: Added.
* stress/big-int-logical-or.js: Added.
2018-12-02 Caio Lima <[email protected]>
[ESNext][BigInt] Implement support for "<<" and ">>"
https://bugs.webkit.org/show_bug.cgi?id=186233
Reviewed by Yusuke Suzuki.
* stress/big-int-left-shift-general.js: Added.
* stress/big-int-left-shift-range-error.js: Added.
* stress/big-int-left-shift-type-error.js: Added.
* stress/big-int-left-shift-wrapped-value.js: Added.
* stress/big-int-right-shift-general.js: Added.
* stress/big-int-right-shift-type-error.js: Added.
* stress/big-int-right-shift-wrapped-value.js: Added.
* stress/left-shift-to-primitive-precedence.js: Added.
* stress/right-shift-to-primitive-precedence.js: Added.
2018-11-30 Dean Jackson <[email protected]>
Add first-class support for .mjs files in jsc binary
https://bugs.webkit.org/show_bug.cgi?id=192190
<rdar://problem/46375715>
Reviewed by Keith Miller.
* stress/simple-module.mjs: Added.
* stress/simple-script.js: Added.
2018-11-30 Caio Lima <[email protected]>
[BigInt] Implement ValueBitXor into DFG
https://bugs.webkit.org/show_bug.cgi?id=190264
Reviewed by Yusuke Suzuki.
* stress/big-int-bitwise-xor-jit.js: Added.
* stress/big-int-bitwise-xor-memory-stress.js: Added.
* stress/big-int-bitwise-xor-untyped.js: Added.
2018-11-27 Saam barati <[email protected]>
r238510 broke scopes of size zero
https://bugs.webkit.org/show_bug.cgi?id=192033
<rdar://problem/46281734>
Reviewed by Keith Miller.
* stress/r238510-bad-loop.js: Added.
(foo):
2018-11-27 Mark Lam <[email protected]>
[Re-landing] NaNs read from Wasm code needs to be be purified.
https://bugs.webkit.org/show_bug.cgi?id=191056
<rdar://problem/45660341>
Reviewed by Filip Pizlo.
* wasm/regress/regress-191056.js: Added.
2018-11-27 Ryan Haddad <[email protected]>
Unreviewed, rolling out r238509.
Causes JSC tests to fail on iOS.
Reverted changeset:
"NaNs read from Wasm code needs to be be purified."
https://bugs.webkit.org/show_bug.cgi?id=191056
https://trac.webkit.org/changeset/238509
2018-11-26 Caio Lima <[email protected]>
Re-introduce op_bitnot
https://bugs.webkit.org/show_bug.cgi?id=190923
Reviewed by Yusuke Suzuki.
* stress/bit-not-must-generate.js: Added.
* stress/bitwise-not-no-int32.js: Added.
2018-11-26 Saam barati <[email protected]>
InPlaceAbstractState::endBasicBlock rule for SetLocal should filter the value based on the flush format
https://bugs.webkit.org/show_bug.cgi?id=191956
<rdar://problem/45665806>
Reviewed by Yusuke Suzuki.
* stress/end-basic-block-set-local-should-filter-type.js: Added.
(bar):
(foo):
2018-11-26 Saam barati <[email protected]>
Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation
https://bugs.webkit.org/show_bug.cgi?id=191958
<rdar://problem/46221877>
Reviewed by Yusuke Suzuki.
* stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added.
(x):
(foo):
2018-11-26 Mark Lam <[email protected]>
NaNs read from Wasm code needs to be be purified.
https://bugs.webkit.org/show_bug.cgi?id=191056
<rdar://problem/45660341>
Reviewed by Filip Pizlo.
* wasm/regress/regress-191056.js: Added.
2018-11-26 Michael Saboff <[email protected]>
32-bit JSC test failure: stress/regexp-compile-oom.js
https://bugs.webkit.org/show_bug.cgi?id=191375
Reviewed by Mark Lam.
Disabled the test for 32 bit platforms.
* stress/regexp-compile-oom.js:
2018-11-26 Tadeu Zagallo <[email protected]>
ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
https://bugs.webkit.org/show_bug.cgi?id=191716
<rdar://problem/45723878>
Reviewed by Saam Barati.
* stress/regress-187373.js: Added.
(async.fn):
2018-11-21 Saam barati <[email protected]>
DFGSpeculativeJIT should not &= exitOK with mayExit(node)
https://bugs.webkit.org/show_bug.cgi?id=191897
<rdar://problem/45871998>
Reviewed by Mark Lam.
* stress/exitok-is-not-the-same-as-mayExit.js: Added.
(bar):
(foo):
2018-11-21 Saam barati <[email protected]>
Fix assertion in KnownCellUse inside SpeculativeJIT::speculate
https://bugs.webkit.org/show_bug.cgi?id=191895
<rdar://problem/46167406>
Reviewed by Mark Lam.
* stress/known-cell-use-needs-type-check-assertion.js: Added.
(foo):
(bar):
2018-11-21 Mark Lam <[email protected]>
Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError.
https://bugs.webkit.org/show_bug.cgi?id=191776
<rdar://problem/46152851>
Reviewed by Saam Barati.
* stress/big-wasm-memory-grow-no-max.js:
* stress/big-wasm-memory-grow.js:
* stress/big-wasm-memory.js:
- updated these to expect an OutOfMemoryError.
* wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: Added.
(Binary.prototype.emit_u8):
(Binary.prototype.emit_u32v):
(Binary.prototype.emit_header):
(Binary.prototype.emit_section):
(Binary):
(WasmModuleBuilder):
(WasmModuleBuilder.prototype.addMemory):
(WasmModuleBuilder.prototype.toArray):
(WasmModuleBuilder.prototype.toBuffer):
(WasmModuleBuilder.prototype.instantiate):
(catch):
* wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Added.
(catch):
2018-11-21 Caio Lima <[email protected]>
[BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
https://bugs.webkit.org/show_bug.cgi?id=190836
Reviewed by Saam Barati and Yusuke Suzuki.
* stress/big-int-out-of-memory-tests.js: Added.
2018-11-20 Mark Lam <[email protected]>
Remove invalid assertion in VMTraps::SignalSender's SignalAction.
https://bugs.webkit.org/show_bug.cgi?id=191856
<rdar://problem/46089992>
Reviewed by Yusuke Suzuki.
* stress/regress-191856.js: Added.
- this test is skipped for now until we have a fix for webkit.org/b/191855.
2018-11-21 Dominik Infuehr <[email protected]>
Enable JIT on ARM/Linux
https://bugs.webkit.org/show_bug.cgi?id=191548
Reviewed by Yusuke Suzuki.
Disable test on system with limited memory. Program was killed by
the OS before the exception was thrown.
* slowMicrobenchmarks/function-constructor-with-huge-strings.js:
2018-11-20 Saam barati <[email protected]>
Merging an IC variant may lead to the IC status containing overlapping structure sets
https://bugs.webkit.org/show_bug.cgi?id=191869
<rdar://problem/45403453>
Reviewed by Mark Lam.
* stress/merging-ic-variants-should-bail-if-structures-overlap.js: Added.
2018-11-19 Mark Lam <[email protected]>
globalFuncImportModule() should return a promise when it clears exceptions.
https://bugs.webkit.org/show_bug.cgi?id=191792
<rdar://problem/46090763>
Reviewed by Michael Saboff.
* stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: Added.
2018-11-19 Guillaume Emont <[email protected]>
Skip new memory-hungry tests on memory limited devices
Unreviewed gardening.
* stress/big-wasm-memory-grow-no-max.js:
* stress/big-wasm-memory-grow.js:
* stress/big-wasm-memory.js:
2018-11-18 Yusuke Suzuki <[email protected]>
Unreviewed, rolling in the rest of r237254
https://bugs.webkit.org/show_bug.cgi?id=190340
* ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
* stress/function-cache-with-parameters-end-position.js: Added.
(shouldBe):
(shouldThrow):
(i.anonymous):
* stress/function-constructor-name.js: Added.
(shouldBe):
(GeneratorFunction):
(AsyncFunction.async):
(AsyncGeneratorFunction.async):
(anonymous):
(async.anonymous):
* test262/expectations.yaml:
2018-11-16 Filip Pizlo <[email protected]>
All users of ArrayBuffer should agree on the same max size
https://bugs.webkit.org/show_bug.cgi?id=191771
Reviewed by Mark Lam.
* stress/big-wasm-memory-grow-no-max.js: Added.
(foo):
(catch):
* stress/big-wasm-memory-grow.js: Added.
(foo):
(catch):
* stress/big-wasm-memory.js: Added.
(foo):
(catch):
2018-11-16 Filip Pizlo <[email protected]>
Unreviewed, make some more tests not crash my computer by only running on instance of it. These tests do not need to
run for each JSC config since they're regression tests for runtime bugs.
* stress/json-stringified-overflow-2.js:
* stress/json-stringified-overflow.js:
2018-11-16 Filip Pizlo <[email protected]>
Unreviewed, make some tests not crash my computer by only running on instance of it. These tests do not need to run for each JSC
config since they're regression tests for runtime bugs.
* stress/large-unshift-splice.js:
* stress/regress-185888.js:
2018-11-16 Saam Barati <[email protected]>
KnownCellUse should also have SpecCellCheck as its type filter
https://bugs.webkit.org/show_bug.cgi?id=191729
<rdar://problem/45872852>
Reviewed by Filip Pizlo.
* stress/known-cell-type-check-should-allow-empty-value-to-flow-through.js: Added.
(C):
2018-11-16 Tadeu Zagallo <[email protected]>
Fix assertion failure on BytecodeGenerator::recordOpcode
https://bugs.webkit.org/show_bug.cgi?id=191724
<rdar://problem/45724395>
Reviewed by Saam Barati.
* stress/regress-187373-2.js: Added.
(foo):
2018-11-15 Mark Lam <[email protected]>
RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
https://bugs.webkit.org/show_bug.cgi?id=191730
<rdar://problem/46048517>
Reviewed by Saam Barati.
* stress/regress-187006.js: Removed.
- this test is invalid because its sole purpose is to test for the non-spec
compliant behavior that we just fixed.
* stress/regress-191730.js: Added.
2018-11-15 Mark Lam <[email protected]>
RegExp operations should not take fast patch if lastIndex is not numeric.
https://bugs.webkit.org/show_bug.cgi?id=191731
<rdar://problem/46017305>
Reviewed by Saam Barati.
* stress/regress-191731.js: Added.
2018-11-13 Saam Barati <[email protected]>
TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM
https://bugs.webkit.org/show_bug.cgi?id=191600
Reviewed by Mark Lam.
* stress/type-profiler-log-should-defer-pending-exceptions.js: Added.
(foo):
(test):
(bar):
2018-11-13 Ryan Haddad <[email protected]>
Unreviewed, rolling out r238132.
The test added with this change is timing out on Debug JSC
bots.
Reverted changeset:
"[BigInt] JSBigInt::createWithLength should throw when length
is greater than JSBigInt::maxLength"
https://bugs.webkit.org/show_bug.cgi?id=190836
https://trac.webkit.org/changeset/238132
2018-11-13 Mark Lam <[email protected]>
Add OOM detection to StringPrototype's substituteBackreferences().
https://bugs.webkit.org/show_bug.cgi?id=191563
<rdar://problem/45720428>
Reviewed by Saam Barati.
* stress/regress-191563.js: Added.
2018-11-13 Mark Lam <[email protected]>
LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame.
https://bugs.webkit.org/show_bug.cgi?id=191579
<rdar://problem/45942472>
Reviewed by Saam Barati.
* stress/regress-191579.js: Added.
2018-11-13 Caio Lima <[email protected]>
[BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
https://bugs.webkit.org/show_bug.cgi?id=190836
Reviewed by Saam Barati.
* stress/big-int-out-of-memory-tests.js: Added.
2018-11-08 Ross Kirsling <[email protected]>
U+180E is no longer a whitespace character
https://bugs.webkit.org/show_bug.cgi?id=191415
Reviewed by Saam Barati.
* ChakraCore/test/es5/regexSpace.baseline:
* ChakraCore/test/es6/unicode_whitespace.js:
Update tests to latest version.
(See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.)
* test262.yaml:
* test262/config.yaml:
* test262/expectations.yaml:
Update expectations.
2018-11-07 Caio Lima <[email protected]>
[BigInt] Add support to BigInt into ValueAdd
https://bugs.webkit.org/show_bug.cgi?id=186177
Reviewed by Keith Miller.
* stress/big-int-negate-jit.js:
* stress/value-add-big-int-and-string.js: Added.
* stress/value-add-big-int-prediction-propagation.js: Added.
* stress/value-add-big-int-untyped.js: Added.
2018-11-07 Tadeu Zagallo <[email protected]>
REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled
https://bugs.webkit.org/show_bug.cgi?id=191184
Reviewed by Saam Barati.
Most tests were failing due to timeouts, since they are too slow to
run on CLoop. The exceptions are:
proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop
dont-crash-on-stack-overflow-when-parsing-builtin.js and
dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had
to change the stack size since CLoop requires it to be page aligned.
* microbenchmarks/array-push-1.js:
* microbenchmarks/array-push-2.js:
* microbenchmarks/elidable-new-object-dag.js:
* microbenchmarks/elidable-new-object-roflcopter.js:
* microbenchmarks/elidable-new-object-tree.js:
* microbenchmarks/getter-richards.js:
* microbenchmarks/sinkable-new-object-dag.js:
* microbenchmarks/string-concat-long-convert.js:
* microbenchmarks/typed-array-get-set-by-val-profiling.js:
* slowMicrobenchmarks/array-push-3.js:
* slowMicrobenchmarks/large-map-iteration-with-additions.js:
* slowMicrobenchmarks/spread-small-array.js:
* slowMicrobenchmarks/undefined-property-access.js:
* stress/activation-sink-default-value-tdz-error.js:
* stress/activation-sink-default-value.js:
* stress/activation-sink-osrexit-default-value-tdz-error.js:
* stress/activation-sink-osrexit-default-value.js:
* stress/activation-sink-osrexit.js:
* stress/activation-sink.js:
* stress/allow-math-ic-b3-code-duplication.js:
* stress/array-push-multiple-int32.js:
* stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js:
* stress/arrowfunction-lexical-this-activation-sink-osrexit.js:
* stress/arrowfunction-lexical-this-activation-sink.js:
* stress/dont-crash-on-stack-overflow-when-parsing-builtin.js:
* stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js:
* stress/elide-new-object-dag-then-exit.js:
* stress/materialize-regexp-cyclic.js:
* stress/new-regex-inline.js:
* stress/op_add.js:
* stress/op_bitand.js:
* stress/op_bitor.js:
* stress/op_bitxor.js:
* stress/op_div-ConstVar.js:
* stress/op_div-VarConst.js:
* stress/op_div-VarVar.js:
* stress/op_lshift-ConstVar.js:
* stress/op_lshift-VarConst.js:
* stress/op_lshift-VarVar.js:
* stress/op_mod-ConstVar.js:
* stress/op_mod-VarConst.js:
* stress/op_mod-VarVar.js:
* stress/op_mul-ConstVar.js:
* stress/op_mul-VarConst.js:
* stress/op_mul-VarVar.js:
* stress/op_rshift-ConstVar.js:
* stress/op_rshift-VarConst.js:
* stress/op_rshift-VarVar.js:
* stress/op_sub-ConstVar.js:
* stress/op_sub-VarConst.js:
* stress/op_sub-VarVar.js:
* stress/op_urshift-ConstVar.js:
* stress/op_urshift-VarConst.js:
* stress/op_urshift-VarVar.js:
* stress/proxy-get-set-correct-receiver.js:
* stress/regress-179562.js:
* stress/rest-parameter-many-arguments.js:
* stress/sampling-profiler-richards.js:
* stress/splay-flash-access-1ms.js:
* stress/tailCallForwardArguments.js:
* stress/typed-array-get-by-val-profiling.js:
* typeProfiler/getter-richards.js:
2018-11-06 Michael Saboff <[email protected]>
Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.
https://bugs.webkit.org/show_bug.cgi?id=191271
Reviewed by Saam Barati.
Added more test cases and made all test cases run with the same deeply recursive stack
instead of finding that same point for each test case.
* stress/regexp-compile-oom.js:
(prototype.runTest):
(recurseAndTest):
(testList.push.new.TestAndExpectedException):
2018-11-05 Michael Saboff <[email protected]>
Unreviewed build fix for linux.
* stress/regexp-compile-oom.js: Disabled for non-darwin OSes.
2018-11-02 Michael Saboff <[email protected]>
Rolling in r237753 with unreviewed build fix.
Fixed issues with DECLARE_THROW_SCOPE placement.
2018-11-02 Ryan Haddad <[email protected]>
Unreviewed, rolling out r237753.
Introduced JSC test failures
Reverted changeset:
"Running out of stack space not properly handled in
RegExp::compile() and its callers"
https://bugs.webkit.org/show_bug.cgi?id=191206
https://trac.webkit.org/changeset/237753
2018-11-02 Michael Saboff <[email protected]>
Running out of stack space not properly handled in RegExp::compile() and its callers
https://bugs.webkit.org/show_bug.cgi?id=191206
Reviewed by Filip Pizlo.
New regression test.
* stress/regexp-compile-oom.js: Added.
(recurseAndTest):
2018-11-01 Guillaume Emont <[email protected]>
Skip tests on arm/mips that time out now we're running on CLoop
Unreviewed gardening.
Since the JIT is temporarily disabled on 32-bit platforms, these tests
time out on the bots and need to be disabled. There's more tests
disabled on arm because the timeout is longer on the mips bot (as the
device is slower to start with), so many of the tests don't time out
there.
* microbenchmarks/getter-richards.js: disable on arm and mips.
* stress/op_add.js: disable on arm.
* stress/op_bitand.js: disable on arm.
* stress/op_bitor.js: disable on arm.
* stress/op_bitxor.js: disable on arm.
* stress/op_lshift-ConstVar.js: disable on arm.
* stress/op_lshift-VarConst.js: disable on arm.
* stress/op_lshift-VarVar.js: disable on arm.
* stress/op_mod-ConstVar.js: disable on arm.
* stress/op_mod-VarConst.js: disable on arm.
* stress/op_mod-VarVar.js: disable on arm.
* stress/op_mul-ConstVar.js: disable on arm.
* stress/op_mul-VarConst.js: disable on arm.
* stress/op_mul-VarVar.js: disable on arm.
* stress/op_rshift-ConstVar.js: disable on arm.
* stress/op_rshift-VarConst.js: disable on arm.
* stress/op_rshift-VarVar.js: disable on arm.
* stress/op_sub-ConstVar.js: disable on arm.
* stress/op_sub-VarConst.js: disable on arm.
* stress/op_sub-VarVar.js: disable on arm.
* stress/op_urshift-ConstVar.js: disable on arm.
* stress/op_urshift-VarConst.js: disable on arm.
* stress/op_urshift-VarVar.js: disable on arm.
* stress/spread-forward-call-varargs-stack-overflow.js: disable on arm.
* stress/value-to-boolean.js: disable on arm and mips.
2018-10-31 Tadeu Zagallo <[email protected]>
REGRESSION(r237547): Exception handlers should be aware of wide opcodes
https://bugs.webkit.org/show_bug.cgi?id=191108
<rdar://problem/45690700>
Reviewed by Saam Barati.
* stress/wide-op_catch.js: Added.
(catch):
2018-10-29 Mark Lam <[email protected]>
Correctly detect string overflow when using the 'Function' constructor.
https://bugs.webkit.org/show_bug.cgi?id=184883
<rdar://problem/36320331>
Reviewed by Saam Barati.
I've verified that this passes on 32-bit as well.
* slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
2018-10-29 Tadeu Zagallo <[email protected]>
Add support for GetStack FlushedDouble
https://bugs.webkit.org/show_bug.cgi?id=191012
<rdar://problem/45265141>
Reviewed by Saam Barati.
* stress/get-stack-double.js: Added.
(bar):
(noInline):
2018-10-29 Tadeu Zagallo <[email protected]>
New bytecode format for JSC
https://bugs.webkit.org/show_bug.cgi?id=187373
<rdar://problem/44186758>
Reviewed by Filip Pizlo.
Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
* stress/maximum-inline-capacity.js: Added.
(test1):
(test3.Foo):
(test3):
2018-10-26 Commit Queue <[email protected]>
Unreviewed, rolling out r237479 and r237484.
https://bugs.webkit.org/show_bug.cgi?id=190978
broke JSC on iOS (Requested by tadeuzagallo on #webkit).
Reverted changesets:
"New bytecode format for JSC"
https://bugs.webkit.org/show_bug.cgi?id=187373
https://trac.webkit.org/changeset/237479
"Gardening: Build fix after r237479."
https://bugs.webkit.org/show_bug.cgi?id=187373
https://trac.webkit.org/changeset/237484
2018-10-26 Tadeu Zagallo <[email protected]>
New bytecode format for JSC
https://bugs.webkit.org/show_bug.cgi?id=187373
<rdar://problem/44186758>
Reviewed by Filip Pizlo.
Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
* stress/maximum-inline-capacity.js: Added.
(test1):
(test3.Foo):
(test3):
2018-10-26 Mark Lam <[email protected]>
Fix missing edge cases with JSGlobalObjects having a bad time.
https://bugs.webkit.org/show_bug.cgi?id=189028
<rdar://problem/45204939>
Reviewed by Saam Barati.
* stress/regress-189028.js: Added.
2018-10-22 Mark Lam <[email protected]>
DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
https://bugs.webkit.org/show_bug.cgi?id=190515
<rdar://problem/45222379>
Rubber-stamped by Saam Barati.
Adding another test.
* stress/regress-190515-2.js: Added.
2018-10-22 Mark Lam <[email protected]>
DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
https://bugs.webkit.org/show_bug.cgi?id=190515
<rdar://problem/45222379>
Reviewed by Saam Barati.
* stress/regress-190515.js: Added.
2018-10-19 Commit Queue <[email protected]>
Unreviewed, rolling out r237254.
https://bugs.webkit.org/show_bug.cgi?id=190760
"It regresses JetStream 2 by 5% on some iOS devices"
(Requested by saamyjoon on #webkit).
Reverted changeset:
"[JSC] JSC should have "parseFunction" to optimize Function
constructor"
https://bugs.webkit.org/show_bug.cgi?id=190340
https://trac.webkit.org/changeset/237254
2018-10-19 Saam Barati <[email protected]>
vmCall should check if we exit before emitting an OSR exit due to exceptions
https://bugs.webkit.org/show_bug.cgi?id=190740
<rdar://problem/45220139>
Reviewed by Mark Lam.
* stress/dont-emit-osr-exits-for-every-call-ftl.js: Added.
(foo):
2018-10-19 Caio Lima <[email protected]>
[ESNext][BigInt] Implement support for "^"
https://bugs.webkit.org/show_bug.cgi?id=186235
Reviewed by Yusuke Suzuki.
* stress/big-int-bitwise-xor-general.js: Added.
* stress/big-int-bitwise-xor-to-primitive-precedence.js: Added.
* stress/big-int-bitwise-xor-type-error.js: Added.
* stress/big-int-bitwise-xor-wrapped-value.js: Added.
2018-10-19 Caio Lima <[email protected]>
[BigInt] Add ValueSub into DFG
https://bugs.webkit.org/show_bug.cgi?id=186176
Reviewed by Yusuke Suzuki.
* stress/big-int-subtraction-jit.js:
* stress/value-sub-big-int-prediction-propagation.js: Added.
* stress/value-sub-big-int-untyped.js: Added.
* stress/value-sub-spec-none-case.js: Added.
2018-10-18 Yusuke Suzuki <[email protected]>
[JSC] JSC should have "parseFunction" to optimize Function constructor
https://bugs.webkit.org/show_bug.cgi?id=190340
Reviewed by Mark Lam.
This patch fixes the line number of syntax errors raised by the Function constructor,
since we now parse the final code only once. And we no longer use block statement
for Function constructor's parsing.
* ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
* stress/function-cache-with-parameters-end-position.js: Added.
(shouldBe):
(shouldThrow):
(i.anonymous):
* stress/function-constructor-name.js: Added.
(shouldBe):
(GeneratorFunction):
(AsyncFunction.async):
(AsyncGeneratorFunction.async):
(anonymous):
(async.anonymous):
* test262/expectations.yaml:
2018-10-18 Commit Queue <[email protected]>
Unreviewed, rolling out r237242.
https://bugs.webkit.org/show_bug.cgi?id=190701
it breaks "stress/sampling-profiler-basic.js" (Requested by
caiolima on #webkit).
Reverted changeset:
"[BigInt] Add ValueSub into DFG"
https://bugs.webkit.org/show_bug.cgi?id=186176
https://trac.webkit.org/changeset/237242
2018-10-17 Keith Miller <[email protected]>
AI does not clear Phantom allocation nodes.
https://bugs.webkit.org/show_bug.cgi?id=190694
Reviewed by Saam Barati.
* stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added.
(Day):
(DaysInYear):
(TimeInYear):
(TimeFromYear):
(DayFromYear):
(InLeapYear):
(YearFromTime):
(WeekDay):
(DaylightSavingTA):
(GetSecondSundayInMarch):
(TimeInMonth):
2018-10-17 Caio Lima <[email protected]>
[BigInt] Add ValueSub into DFG
https://bugs.webkit.org/show_bug.cgi?id=186176
Reviewed by Yusuke Suzuki.
* stress/big-int-subtraction-jit.js:
* stress/value-sub-big-int-prediction-propagation.js: Added.
* stress/value-sub-big-int-untyped.js: Added.
2018-10-16 Dominik Infuehr <[email protected]>
[JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips
https://bugs.webkit.org/show_bug.cgi?id=190611
Reviewed by Saam Barati.
Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js
to improve test runtime. On ARM/MIPS this test even timed out when running all
tests.
* stress/array-prototype-concat-of-long-spliced-arrays2.js:
(test):
2018-10-15 Guillaume Emont <[email protected]>
Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux
Unreviewed gardening.
* stress/array-prototype-concat-of-long-spliced-arrays2.js:
2018-10-15 Saam barati <[email protected]>
Emit fjcvtzs on ARM64E on Darwin
https://bugs.webkit.org/show_bug.cgi?id=184023
Reviewed by Yusuke Suzuki and Filip Pizlo.
* stress/double-to-int32-NaN.js: Added.
(assert):
(foo):
2018-10-15 Saam Barati <[email protected]>
JSArray::shiftCountWithArrayStorage is wrong when an array has holes
https://bugs.webkit.org/show_bug.cgi?id=190262
<rdar://problem/44986241>
Reviewed by Mark Lam.
* stress/array-prototype-concat-of-long-spliced-arrays.js:
(test):
* stress/slice-array-storage-with-holes.js: Added.
(main):
2018-10-15 Commit Queue <[email protected]>
Unreviewed, rolling out r237054.
https://bugs.webkit.org/show_bug.cgi?id=190593
"this regressed JetStream 2 by 6% on iOS" (Requested by
saamyjoon on #webkit).
Reverted changeset:
"[JSC] JSC should have "parseFunction" to optimize Function
constructor"
https://bugs.webkit.org/show_bug.cgi?id=190340
https://trac.webkit.org/changeset/237054
2018-10-13 Yusuke Suzuki <[email protected]>
[JSC] JSON.stringify can accept call-with-no-arguments
https://bugs.webkit.org/show_bug.cgi?id=190343
Reviewed by Mark Lam.
* stress/json-stringify-no-arguments.js: Added.
(shouldBe):
2018-10-08 Yusuke Suzuki <[email protected]>
[JSC] JSC should have "parseFunction" to optimize Function constructor
https://bugs.webkit.org/show_bug.cgi?id=190340
Reviewed by Mark Lam.
This patch fixes the line number of syntax errors raised by the Function constructor,
since we now parse the final code only once. And we no longer use block statement
for Function constructor's parsing.
* ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
* stress/function-cache-with-parameters-end-position.js: Added.
(shouldBe):
(shouldThrow):
(i.anonymous):
* stress/function-constructor-name.js: Added.
(shouldBe):
(GeneratorFunction):
(AsyncFunction.async):
(AsyncGeneratorFunction.async):
(anonymous):
(async.anonymous):
* test262/expectations.yaml:
2018-10-10 Guillaume Emont <[email protected]>
Skip JSC test stress/sampling-profiler-richards.js on armv7/linux
https://bugs.webkit.org/show_bug.cgi?id=190426
Unreviewed gardening.
* stress/sampling-profiler-richards.js:
2018-10-06 Caio Lima <[email protected]>
[ESNext][BigInt] Implement support for "|"
https://bugs.webkit.org/show_bug.cgi?id=186229
Reviewed by Yusuke Suzuki.
* stress/big-int-bitwise-and-jit.js:
* stress/big-int-bitwise-or-general.js: Added.
* stress/big-int-bitwise-or-jit-untyped.js: Added.
* stress/big-int-bitwise-or-jit.js: Added.
* stress/big-int-bitwise-or-memory-stress.js: Added.
* stress/big-int-bitwise-or-to-primitive-precedence.js: Added.
* stress/big-int-bitwise-or-type-error.js: Added.
* stress/big-int-bitwise-or-wrapped-value.js: Added.
2018-10-05 Dominik Infuehr <[email protected]>
Skip test on systems with limited memory
https://bugs.webkit.org/show_bug.cgi?id=190310
Invoking runDefault adds test to runlist, skipping the test in the next
line does not prevent the test from executing. Change order of lines such
that runDefault is only executed if test is not executed.
Reviewed by Mark Lam.
* stress/regress-190187.js:
2018-10-03 Saam barati <[email protected]>
lowXYZ in FTLLower should always filter the type of the incoming edge
https://bugs.webkit.org/show_bug.cgi?id=189939
<rdar://problem/44407030>
Reviewed by Michael Saboff.
* stress/ftl-should-always-filter-for-low-type-check-functions.js: Added.
(foo):
(test):
2018-10-03 Mark Lam <[email protected]>
Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX.
https://bugs.webkit.org/show_bug.cgi?id=190187
<rdar://problem/42512909>
Reviewed by Michael Saboff.
* stress/regress-190187.js: Added.
2018-10-02 Caio Lima <[email protected]>
[BigInt] BigInt.proptotype.toString is broken when radix is power of 2
https://bugs.webkit.org/show_bug.cgi?id=190033
Reviewed by Yusuke Suzuki.
* stress/big-int-to-string.js:
2018-10-01 Mark Lam <[email protected]>
Function.toString() should also copy the source code Functions that are class definitions.
https://bugs.webkit.org/show_bug.cgi?id=190186
<rdar://problem/44733360>
Reviewed by Saam Barati.
* stress/regress-190186.js: Added.
2018-10-01 Dominik Infuehr <[email protected]>
Split NaN-check into separate test
https://bugs.webkit.org/show_bug.cgi?id=190010
Reviewed by Saam Barati.
DataView exposes NaN-representation, which is not necessarily the same on each
architecture. Therefore move the check of the NaN-representation into its own
file such that we can disable this test on MIPS where NaN-representation can be
different on older CPUs.
* stress/dataview-jit-set-nan.js: Added.
(assert):
(test.storeLittleEndian):
(test.storeBigEndian):
(test.store):
(test):
* stress/dataview-jit-set.js:
(test5):
2018-10-01 Commit Queue <[email protected]>
Unreviewed, rolling out r236647.
https://bugs.webkit.org/show_bug.cgi?id=190124
Breaking test stress/big-int-to-string.js (Requested by
caiolima_ on #webkit).
Reverted changeset:
"[BigInt] BigInt.proptotype.toString is broken when radix is
power of 2"
https://bugs.webkit.org/show_bug.cgi?id=190033
https://trac.webkit.org/changeset/236647
2018-09-30 Caio Lima <[email protected]>
[BigInt] BigInt.proptotype.toString is broken when radix is power of 2
https://bugs.webkit.org/show_bug.cgi?id=190033
Reviewed by Yusuke Suzuki.
* stress/big-int-to-string.js:
2018-09-28 Caio Lima <[email protected]>
[ESNext][BigInt] Implement support for "&"
https://bugs.webkit.org/show_bug.cgi?id=186228
Reviewed by Yusuke Suzuki.
* stress/big-int-bitwise-and-general.js: Added.
(assert):
(assert.sameValue):
* stress/big-int-bitwise-and-jit.js: Added.
(let.assert.sameValue):
(bigIntBitAnd):
* stress/big-int-bitwise-and-memory-stress.js: Added.
(assert):
* stress/big-int-bitwise-and-to-primitive-precedence.js: Added.
(assert.sameValue):
(let.o.Symbol.toPrimitive):
(catch):
* stress/big-int-bitwise-and-type-error.js: Added.
(assert):
(assertThrowTypeError):
(let.o.valueOf):
(o.valueOf):
(o.toString):
(o.Symbol.toPrimitive):
* stress/big-int-bitwise-and-wrapped-value.js: Added.
(assert.sameValue):
(testBitAnd):
(let.o.Symbol.toPrimitive):
(o.valueOf):
(o.toString):
2018-09-28 Ross Kirsling <[email protected]>
JSC test stress/jsc-read.js doesn't support CRLF
https://bugs.webkit.org/show_bug.cgi?id=190063
Reviewed by Yusuke Suzuki.
In order to run this test via Windows command prompt, we can't assume that the final newline will be LF.
* stress/jsc-read.js:
(test):
2018-09-27 Saam barati <[email protected]>
Verify the contents of AssemblerBuffer on arm64e
https://bugs.webkit.org/show_bug.cgi?id=190057
<rdar://problem/38916630>
Reviewed by Mark Lam.
* stress/regress-189132.js:
2018-09-27 Dominik Infuehr <[email protected]>
Disable test without LLInt on ARMv7
https://bugs.webkit.org/show_bug.cgi?id=190037
Reviewed by Mark Lam.
Test runs out of executable memory on ARMv7, do not run
this test without LLInt enabled.
* stress/regress-169445.js:
2018-09-26 Keith Miller <[email protected]>
We should zero unused property storage when rebalancing array storage.
https://bugs.webkit.org/show_bug.cgi?id=188151
Reviewed by Michael Saboff.
* stress/splice-should-zero-property-storage-when-rebalancing.js: Added.
2018-09-20 Yusuke Suzuki <[email protected]>
[JSC] Optimize Array#lastIndexOf
https://bugs.webkit.org/show_bug.cgi?id=189780
Reviewed by Saam Barati.
* stress/array-lastindexof-array-prototype-trap.js: Added.
(shouldBe):
(AncestorArray.prototype.get 2):
(AncestorArray):
* stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added.
(shouldBe):
* stress/array-lastindexof-hole-nan.js: Added.
(shouldBe):
(throw.new.Error):
* stress/array-lastindexof-infinity.js: Added.
(shouldBe):
(throw.new.Error):
* stress/array-lastindexof-negative-zero.js: Added.
(shouldBe):
(throw.new.Error):
* stress/array-lastindexof-own-getter.js: Added.
(shouldBe):
(throw.new.Error.get array):
(get array):
* stress/array-lastindexof-prototype-trap.js: Added.
(shouldBe):
(DerivedArray.prototype.get 2):
(DerivedArray):
2018-09-25 Saam Barati <[email protected]>
Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
https://bugs.webkit.org/show_bug.cgi?id=189940
<rdar://problem/43640987>
Reviewed by Mark Lam.
* stress/use-baseline-codeblock-materialize-osr-exit.js: Added.
2018-09-24 Saam Barati <[email protected]>
Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects
https://bugs.webkit.org/show_bug.cgi?id=189922
<rdar://problem/44651275>
Reviewed by Mark Lam.
* stress/array-indexof-fast-path-effects.js: Added.
* stress/array-indexof-cached-length.js: Added.
2018-09-24 Saam barati <[email protected]>
ArgumentsEliminationPhase should snip basic blocks after proven OSR exits
https://bugs.webkit.org/show_bug.cgi?id=189682
<rdar://problem/43557315>
Reviewed by Mark Lam.
* stress/arguments-elimination-will-generate-edge-without-result.js: Added.
(foo):
2018-09-22 Saam barati <[email protected]>
The sampling should not use Strong<CodeBlock> in its machineLocation field
https://bugs.webkit.org/show_bug.cgi?id=189319
Reviewed by Filip Pizlo.
* stress/sampling-profiler-richards.js: Added.
2018-09-19 Yusuke Suzuki <[email protected]>
[JSC] Optimize Array#indexOf in C++ runtime
https://bugs.webkit.org/show_bug.cgi?id=189507
Reviewed by Saam Barati.
* stress/array-indexof-array-prototype-trap.js: Added.
(shouldBe):
(AncestorArray.prototype.get 2):
(AncestorArray):
* stress/array-indexof-have-a-bad-time-c-runtime.js: Added.
(shouldBe):
* stress/array-indexof-hole-nan.js: Added.
(shouldBe):
(throw.new.Error):
* stress/array-indexof-infinity.js: Added.
(shouldBe):
(throw.new.Error):
* stress/array-indexof-negative-zero.js: Added.
(shouldBe):
(throw.new.Error):
* stress/array-indexof-own-getter.js: Added.
(shouldBe):
(throw.new.Error.get array):
(get array):
* stress/array-indexof-prototype-trap.js: Added.
(shouldBe):
(DerivedArray.prototype.get 2):
(DerivedArray):
2018-09-19 Saam barati <[email protected]>
AI rule for MultiPutByOffset executes its effects in the wrong order
https://bugs.webkit.org/show_bug.cgi?id=189757
<rdar://problem/43535257>
Reviewed by Michael Saboff.
* stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
(foo):
(Foo):
(g):
2018-09-17 Mark Lam <[email protected]>
Ensure that ForInContexts are invalidated if their loop local is over-written.
https://bugs.webkit.org/show_bug.cgi?id=189571
<rdar://problem/44402277>
Reviewed by Saam Barati.
* stress/regress-189571.js: Added.
2018-09-17 Saam barati <[email protected]>
We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
https://bugs.webkit.org/show_bug.cgi?id=189676
<rdar://problem/39682897>
Reviewed by Michael Saboff.
* typeProfiler/check-structure-or-empty-in-fixup.js: Added.
(A):
(K):
(i.catch):
2018-09-14 Saam barati <[email protected]>
Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
https://bugs.webkit.org/show_bug.cgi?id=189628
<rdar://problem/39481690>
Reviewed by Mark Lam.
* stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
(foo):
2018-09-11 Mark Lam <[email protected]>
Test for array initialization in arrayProtoFuncSplice.
https://bugs.webkit.org/show_bug.cgi?id=170253
<rdar://problem/31328773>
Rubber-stamped by Saam Barati.
* stress/regress-170253.js: Added.
2018-09-11 Mark Lam <[email protected]>
Test for IntlObject initialization.
https://bugs.webkit.org/show_bug.cgi?id=170251
<rdar://problem/31328419>
Rubber-stamped by Saam Barati.
* stress/regress-170251.js: Added.
2018-09-11 Mark Lam <[email protected]>
Test for array memcpy'ing when JSGlobalObject::haveABadTime.
https://bugs.webkit.org/show_bug.cgi?id=169889
<rdar://problem/31155607>
Reviewed by Saam Barati.
* stress/regress-169889-array-concat.js: Added.
* stress/regress-169889-array-concat1.js: Added.
* stress/regress-169889-array-slice.js: Added.
2018-09-11 Mark Lam <[email protected]>
Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope.
https://bugs.webkit.org/show_bug.cgi?id=169445
<rdar://problem/30957435>
Reviewed by Saam Barati.
* stress/regress-169445.js: Added.
(let.gun.eval.A):
(let.gun.eval.B.C):
(let.gun.eval.B.C.prototype.trigger):
(let.gun.eval.B.C.prototype.triggerWithRestParameters):
(let.gun.eval.B):
(let.gun.eval):
== Rolled over to ChangeLog-2018-09-11 ==