Google Git
Sign in
webkit / WebKit / 44b1bcefcada71e27ed921241486e99683b28207 / . / JSTests / ChangeLog
blob: 05fdb767cc4ef307e530d6f9bd5e9d6c69c93347 [file] [log] [blame]
2019-02-15 Robin Morisset <rmorisset@apple.com>
CodeBlock::jettison should clear related watchpoints
https://bugs.webkit.org/show_bug.cgi?id=194544
Reviewed by Mark Lam.
* stress/regexp-replace-double-watchpoint.js: Added.
(foo):
2019-02-15 Saam barati <sbarati@apple.com>
[WebAssembly] Write a new register allocator for Air O0 and make BBQ use it
https://bugs.webkit.org/show_bug.cgi?id=194036
Reviewed by Yusuke Suzuki.
* stress/tail-call-many-arguments.js: Added.
(foo):
(bar):
2019-02-14 Saam Barati <sbarati@apple.com>
Cache the results of BytecodeGenerator::getVariablesUnderTDZ
https://bugs.webkit.org/show_bug.cgi?id=194583
<rdar://problem/48028140>
Reviewed by Yusuke Suzuki.
* microbenchmarks/cache-get-variables-under-tdz-in-bytecode-generator.js: Added.
2019-02-08 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] String.fromCharCode's slow path always generates 16bit string
https://bugs.webkit.org/show_bug.cgi?id=194466
Reviewed by Keith Miller.
* stress/string-from-char-code-slow-path.js: Added.
(shouldBe):
(testWithLength):
2019-02-08 Saam barati <sbarati@apple.com>
Nodes that rely on being dominated by CheckInBounds should have a child edge to it
https://bugs.webkit.org/show_bug.cgi?id=194334
<rdar://problem/47844327>
Reviewed by Mark Lam.
* stress/check-in-bounds-should-be-a-child-use.js: Added.
(func):
2019-02-06 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] InitializeEntrypointArguments should produce SpecCellCheck if FlushFormat is FlushedCell
https://bugs.webkit.org/show_bug.cgi?id=194369
<rdar://problem/47813087>
Reviewed by Saam Barati.
* stress/initialize-entrypoint-arguments-with-tdz.js: Added.
(A):
2019-02-06 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] PrivateName to PublicName hash table is wasteful
https://bugs.webkit.org/show_bug.cgi?id=194277
Reviewed by Michael Saboff.
This test depends on the order of JSSegmentedVariableObjects' variables, which is not guaranteed in JSC. Skipped.
* ChakraCore.yaml:
2019-02-05 Dominik Infuehr <dinfuehr@igalia.com>
[ARM] Test running out of executable memory
https://bugs.webkit.org/show_bug.cgi?id=194285
Unreviewed. Do no execute test with LLInt disabled, test runs out of
executable memory otherwise.
* stress/class-subclassing-function.js:
2019-02-04 Robin Morisset <rmorisset@apple.com>
when lowering AssertNotEmpty, create the value before creating the patchpoint
https://bugs.webkit.org/show_bug.cgi?id=194231
Reviewed by Saam Barati.
This test is painfully fragile: it tries to test that AssertNotEmpty on a constant produces valid B3 IR.
The problem is that AssertNotEmpty is only created by DFGConstantFolding when it can simplify a CheckStructure, and constant folding is a bit capricious (https://bugs.webkit.org/show_bug.cgi?id=133947)
So even tiny changes to this test can change the path code taken.
* stress/assert-not-empty.js: Added.
(foo):
2019-02-01 Mark Lam <mark.lam@apple.com>
Remove invalid assertion in DFG's compileDoubleRep().
https://bugs.webkit.org/show_bug.cgi?id=194130
<rdar://problem/47699474>
Reviewed by Saam Barati.
* stress/constant-fold-double-rep-into-double-constant.js: Added.
2019-01-30 Ross Kirsling <ross.kirsling@sony.com>
Import latest Test262 updates.
Rubber-stamped by Keith Miller.
* test262.yaml: Deleted.
* test262/config.yaml:
* test262/expectations.yaml:
* test262/latest-changes-summary.txt:
* test262/test/:
* test262/test262-Revision.txt:
2019-01-30 Robin Morisset <rmorisset@apple.com>
Object.keys can now lead to a PhantomNewArrayBuffer, OSR exit from the FTL should know how to materialize a NewArrayBuffer in that case
https://bugs.webkit.org/show_bug.cgi?id=194050
<rdar://problem/47595592>
Reviewed by Yusuke Suzuki.
* stress/object-keys-osr-exit.js: Added.
(foo):
(catch):
2019-01-29 Mark Lam <mark.lam@apple.com>
ValueRecovery::recover() should purify NaN values it recovers.
https://bugs.webkit.org/show_bug.cgi?id=193978
<rdar://problem/47625488>
Reviewed by Saam Barati.
* stress/value-recovery-of-double-displaced-in-jsstack-should-be-purified.js: Added.
2019-01-28 Yusuke Suzuki <ysuzuki@apple.com>
Unreviewed, fix the test after r240543 not to use @Error / Error in builtins
https://bugs.webkit.org/show_bug.cgi?id=193713
* stress/try-get-by-id-should-spill-registers-dfg.js:
(let.f.createBuiltin):
2019-01-28 Mark Lam <mark.lam@apple.com>
ToString node actually does GC.
https://bugs.webkit.org/show_bug.cgi?id=193920
<rdar://problem/46695900>
Reviewed by Yusuke Suzuki.
* stress/dfg-to-string-on-int-does-gc.js: Added.
* stress/dfg-to-string-on-string-object-does-not-gc.js: Added.
* stress/dfg-to-string-on-string-or-string-object-does-not-gc.js: Added.
2019-01-25 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] NativeErrorConstructor should not have own IsoSubspace
https://bugs.webkit.org/show_bug.cgi?id=193713
Reviewed by Saam Barati.
Remove @Error use.
* stress/try-get-by-id-should-spill-registers-dfg.js:
(let.f.createBuiltin):
2019-01-24 Yusuke Suzuki <ysuzuki@apple.com>
stress/const-semantics.js fails a dfg-eager / ftl-eager run with an ASAN release build.
https://bugs.webkit.org/show_bug.cgi?id=190693
Reviewed by Michael Saboff.
* stress/regress-190693.js: Added.
(truth):
(assert):
(shouldThrowInvalidConstAssignment):
(taz):
2019-01-24 Saam Barati <sbarati@apple.com>
Object Allocation Sinking phase can move a node that walks the stack into a place where the InlineCallFrame is no longer valid
https://bugs.webkit.org/show_bug.cgi?id=193751
<rdar://problem/47280215>
Reviewed by Michael Saboff.
* stress/object-allocation-sinking-phase-must-only-move-allocations-if-stack-trace-is-still-valid.js: Added.
(let.thing):
(foo.let.hello):
(foo):
2019-01-24 Guillaume Emont <guijemont@igalia.com>
[JSC] Reenable baseline JIT on mips
https://bugs.webkit.org/show_bug.cgi?id=192983
Reviewed by Mark Lam.
Added a new test for a case that was triggering a RELEASE_ASSERT when
testing.
Disable some slow tests that were already disabled for arm and x86.
* stress/json-parse-big-object.js: Added.
* stress/new-largeish-contiguous-array-with-size.js:
* stress/op_add.js:
* stress/op_bitand.js:
* stress/op_bitor.js:
* stress/op_bitxor.js:
* stress/op_lshift-ConstVar.js:
* stress/op_lshift-VarConst.js:
* stress/op_lshift-VarVar.js:
* stress/op_mod-ConstVar.js:
* stress/op_mod-VarConst.js:
* stress/op_mod-VarVar.js:
* stress/op_mul-ConstVar.js:
* stress/op_mul-VarConst.js:
* stress/op_mul-VarVar.js:
* stress/op_rshift-ConstVar.js:
* stress/op_rshift-VarConst.js:
* stress/op_rshift-VarVar.js:
* stress/op_sub-ConstVar.js:
* stress/op_sub-VarConst.js:
* stress/op_sub-VarVar.js:
* stress/op_urshift-ConstVar.js:
* stress/op_urshift-VarConst.js:
* stress/op_urshift-VarVar.js:
* stress/sampling-profiler-richards.js:
* stress/spread-forward-call-varargs-stack-overflow.js:
2019-01-23 Yusuke Suzuki <ysuzuki@apple.com>
[DFG] AvailabilityMap::pruneByLiveness should make non-live operands Availability::unavailable instead of Availability()
https://bugs.webkit.org/show_bug.cgi?id=193711
<rdar://problem/47250262>
Reviewed by Saam Barati.
* stress/availability-was-cleared-when-locals-are-not-live.js: Added.
(shouldBe):
(foo):
(bar):
(baz):
2019-01-22 Yusuke Suzuki <ysuzuki@apple.com>
Unreviewed, fix initial global lexical binding epoch
https://bugs.webkit.org/show_bug.cgi?id=193603
<rdar://problem/47380869>
* stress/global-lexical-binding-epoch-should-be-correct-one.js: Added.
(f1.f2.f3.f4):
(f1.f2.f3):
(f1.f2):
(f1):
2019-01-22 Yusuke Suzuki <ysuzuki@apple.com>
REGRESSION(r239612) Crash at runtime due to broken DFG assumption
https://bugs.webkit.org/show_bug.cgi?id=193709
<rdar://problem/47363838>
Unreviewed, rollout to watch the tests.
* stress/object-tostring-changed-proto.js: Removed.
* stress/object-tostring-changed.js: Removed.
* stress/object-tostring-misc.js: Removed.
* stress/object-tostring-other.js: Removed.
* stress/object-tostring-untyped.js: Removed.
2019-01-22 Saam Barati <sbarati@apple.com>
Unreviewed. Rollout r240223. It regressed JetStream2 by 1%.
* stress/arith-abs-to-arith-negate-range-optimizaton.js:
(testUncheckedBetweenIntMinInclusiveAndZeroExclusive):
(testUncheckedLessThanZero):
(testUncheckedLessThanOrEqualZero):
* stress/movhint-backwards-propagation-must-merge-use-as-value-add.js: Removed.
* stress/movhint-backwards-propagation-must-merge-use-as-value.js: Removed.
2019-01-22 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Invalidate old scope operations using global lexical binding epoch
https://bugs.webkit.org/show_bug.cgi?id=193603
<rdar://problem/47380869>
Reviewed by Saam Barati.
* stress/let-lexical-binding-shadow-existing-global-property-ftl.js:
* stress/scope-operation-cache-global-property-before-deleting.js: Added.
(shouldThrow):
(bar):
* stress/scope-operation-cache-global-property-bump-counter.js: Added.
(shouldBe):
(get1):
(get2):
(get1If):
(get2If):
* stress/scope-operation-cache-global-property-even-if-it-fails.js: Added.
(shouldThrow):
(foo):
2019-01-21 Yusuke Suzuki <ysuzuki@apple.com>
Unreviewed, roll out r240220 due to date-format-xparb regression
https://bugs.webkit.org/show_bug.cgi?id=193603
* stress/let-lexical-binding-shadow-existing-global-property-ftl.js:
* stress/scope-operation-cache-global-property-before-deleting.js: Removed.
* stress/scope-operation-cache-global-property-bump-counter.js: Removed.
* stress/scope-operation-cache-global-property-even-if-it-fails.js: Removed.
2019-01-21 Caio Lima <ticaiolima@gmail.com>
DoesGC rule is wrong for nodes with BigIntUse
https://bugs.webkit.org/show_bug.cgi?id=193652
Reviewed by Saam Barati.
* stress/big-int-value-op-update-gc-rules.js: Added.
(assert):
(doesGCAdd):
(doesGCSub):
(doesGCDiv):
(doesGCMul):
(doesGCBitAnd):
(doesGCBitOr):
(doesGCBitXor):
2019-01-20 Saam Barati <sbarati@apple.com>
DFG: When inlining DataView set* intrinsics we need to set undefined as our result
https://bugs.webkit.org/show_bug.cgi?id=193644
<rdar://problem/46209745>
Reviewed by Yusuke Suzuki.
* stress/data-view-set-intrinsic-undefined-result-2.js: Added.
(foo):
* stress/data-view-set-intrinsic-undefined-result.js: Added.
(foo):
(bar):
2019-01-20 Saam Barati <sbarati@apple.com>
MovHint must merge NodeBytecodeUsesAsValue for its child
https://bugs.webkit.org/show_bug.cgi?id=186916
<rdar://problem/41396612>
Reviewed by Yusuke Suzuki.
* stress/arith-abs-to-arith-negate-range-optimizaton.js:
* stress/movhint-backwards-propagation-must-merge-use-as-value.js: Added.
2019-01-20 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Invalidate old scope operations using global lexical binding epoch
https://bugs.webkit.org/show_bug.cgi?id=193603
<rdar://problem/47380869>
Reviewed by Saam Barati.
* stress/let-lexical-binding-shadow-existing-global-property-ftl.js:
* stress/scope-operation-cache-global-property-before-deleting.js: Added.
(shouldThrow):
(bar):
* stress/scope-operation-cache-global-property-bump-counter.js: Added.
(shouldBe):
(get1):
(get2):
(get1If):
(get2If):
* stress/scope-operation-cache-global-property-even-if-it-fails.js: Added.
(shouldThrow):
(foo):
2019-01-17 Saam barati <sbarati@apple.com>
StringObjectUse should not be a structure check for the original string object structure
https://bugs.webkit.org/show_bug.cgi?id=193483
<rdar://problem/47280522>
Reviewed by Yusuke Suzuki.
* stress/cant-eliminate-string-object-structure-check-when-string-object-is-proven.js: Added.
(foo):
(a.valueOf.0):
2019-01-17 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[JSC] ToThis omission in DFGByteCodeParser is wrong
https://bugs.webkit.org/show_bug.cgi?id=193513
<rdar://problem/45842236>
Reviewed by Saam Barati.
* stress/to-this-omission-with-different-strict-modes.js: Added.
(thisA):
(thisAStrictWrapper):
2019-01-15 Mark Lam <mark.lam@apple.com>
JSFunction::canUseAllocationProfile() should account for builtin functions with no own prototypes.
https://bugs.webkit.org/show_bug.cgi?id=193423
<rdar://problem/46209355>
Reviewed by Saam Barati.
* microbenchmarks/sinkable-new-object-with-builtin-constructor.js: Added.
* stress/constructing-builtin-functions-with-getter-prototype-should-only-call-getter-once-per-new-1.js: Added.
* stress/constructing-builtin-functions-with-getter-prototype-should-only-call-getter-once-per-new-2.js: Added.
* stress/jsfunction-cannot-use-allocation-profile-with-builtin-functions-with-no-prototype.js: Added.
2019-01-15 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[JSC] Use KnownStringUse for GetByVal(Array::String) since AI would offer wider type information and offer non-string type after removing Check(String)
https://bugs.webkit.org/show_bug.cgi?id=193438
<rdar://problem/45581249>
Reviewed by Saam Barati and Keith Miller.
Under the heavy load (like, compiling WebKit), AI in this code can broaden type information after the 1st run.
Then, GetByVal(String) crashed.
* stress/string-get-by-val-lowering.js: Added.
(shouldBe):
(test):
* stress/type-for-get-by-val-can-be-widen-after-ai.js: Added.
(Hello):
(foo):
2019-01-15 Tomas Popela <tpopela@redhat.com>
Unreviewed, skip JIT tests if it's not enabled
* stress/bit-op-with-object-returning-int32.js:
2019-01-15 Caio Lima <ticaiolima@gmail.com>
DFGByteCodeParser rules for bitwise operations should consider type of their operands
https://bugs.webkit.org/show_bug.cgi?id=192966
Reviewed by Yusuke Suzuki.
* stress/bit-op-with-object-returning-int32.js: Added.
2019-01-15 Guillaume Emont <guijemont@igalia.com>
Skip a slow test and a flakey test on arm
Unreviewed gardening.
* typeProfiler/getter-richards.js:
this test always times out, it used to be always skipped on arm and
mips, but got accidentally enabled by r237919 now that we have DFG on
arm. Also skipping on mips as we plan to soon enable DFG for it too.
2019-01-14 Keith Miller <keith_miller@apple.com>
Skip type-check-hoisting-phase-hoist... with no jit
https://bugs.webkit.org/show_bug.cgi?id=193421
Reviewed by Mark Lam.
It's timing out the 32-bit bots and takes 330 seconds
on my machine when run by itself.
* stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js:
2019-01-14 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[JSC] AI should check the given constant's array type when folding GetByVal into constant
https://bugs.webkit.org/show_bug.cgi?id=193413
<rdar://problem/46092389>
Reviewed by Keith Miller.
This test is super flaky. It causes crash in r238109, but it does not crash with `--useConcurrentJIT=false`.
It does not cause any crashes on the latest revision too. Basically, it highly depends on the timing, and
without this patch, the root cause is not fixed yet. If GetLocal is turned into JSConstant in AI,
but GetByVal does not have appropriate ArrayModes, JSC crashes.
* stress/ai-should-perform-array-check-on-get-by-val-constant-folding.js: Added.
(compareArray):
2019-01-14 Caio Lima <ticaiolima@gmail.com>
[BigInt] Literal parsing is crashing when used inside a Object Literal
https://bugs.webkit.org/show_bug.cgi?id=193404
Reviewed by Yusuke Suzuki.
* stress/big-int-literal-inside-literal-object.js: Added.
2019-01-14 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[JSC] Do not use asArrayModes() with Structures because it discards TypedArray information
https://bugs.webkit.org/show_bug.cgi?id=193372
Reviewed by Saam Barati.
* stress/typed-array-array-modes-profile.js: Added.
(foo):
2019-01-14 Mark Lam <mark.lam@apple.com>
Fix all CLoop JSC test failures (including some LLInt bugs due to recent bytecode format change).
https://bugs.webkit.org/show_bug.cgi?id=193402
<rdar://problem/46012309>
Reviewed by Keith Miller.
* stress/regexp-compile-oom.js:
- Skip this test for !$jitTests because it is tuned for stack usage when the JIT
is enabled. As a result, it will fail on cloop builds though there is no bug.
2019-01-11 Saam barati <sbarati@apple.com>
DFG combined liveness can be wrong for terminal basic blocks
https://bugs.webkit.org/show_bug.cgi?id=193304
<rdar://problem/45268632>
Reviewed by Yusuke Suzuki.
* stress/dfg-combined-liveness-consider-terminal-blocks-bytecode-liveness.js: Added.
2019-01-11 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[JSC] Global lexical bindings can shadow global variables if it is `configurable = true`
https://bugs.webkit.org/show_bug.cgi?id=193308
<rdar://problem/45546542>
Reviewed by Saam Barati.
* stress/const-lexical-binding-shadow-existing-global-property-ftl.js: Added.
(shouldThrow):
(shouldBe):
(foo):
(get shouldThrow):
* stress/const-lexical-binding-shadow-existing-global-property-tdz-ftl.js: Added.
(shouldThrow):
(shouldBe):
(foo):
(get shouldBe):
(get shouldThrow):
(get return):
* stress/const-lexical-binding-shadow-existing-global-property-tdz.js: Added.
(shouldThrow):
(shouldBe):
(foo):
(get shouldBe):
(get shouldThrow):
* stress/const-lexical-binding-shadow-existing-global-property.js: Added.
(shouldThrow):
(shouldBe):
(foo):
* stress/const-lexical-binding-shadowing-global-properties-and-eval-injection.js: Added.
(shouldThrow):
(shouldBe):
(foo):
* stress/global-add-function-should-not-be-shadowed-by-lexical-bindings.js: Added.
(shouldThrow):
* stress/global-static-variables-should-not-be-shadowed-by-lexical-bindings.js: Added.
(shouldThrow):
* stress/let-lexical-binding-shadow-existing-global-property-ftl.js: Added.
(shouldThrow):
(shouldBe):
(foo):
* stress/let-lexical-binding-shadow-existing-global-property-tdz-ftl.js: Added.
(shouldThrow):
(shouldBe):
(foo):
(get shouldBe):
(get shouldThrow):
(get return):
* stress/let-lexical-binding-shadow-existing-global-property-tdz.js: Added.
(shouldThrow):
(shouldBe):
(foo):
(get shouldBe):
(get shouldThrow):
* stress/let-lexical-binding-shadow-existing-global-property.js: Added.
(shouldThrow):
(shouldBe):
(foo):
* stress/let-lexical-binding-shadowing-global-properties-and-eval-injection.js: Added.
(shouldThrow):
(shouldBe):
(foo):
2019-01-11 Dominik Infuehr <dinfuehr@igalia.com>
Enable DFG on ARM/Linux again
https://bugs.webkit.org/show_bug.cgi?id=192496
Reviewed by Yusuke Suzuki.
Test wasn't really skipped before moving the line with skip
to the top.
* stress/regress-192717.js:
2019-01-10 Commit Queue <commit-queue@webkit.org>
Unreviewed, rolling out r239825.
https://bugs.webkit.org/show_bug.cgi?id=193330
Broke tests on armv7/linux bots (Requested by guijemont on
#webkit).
Reverted changeset:
"Enable DFG on ARM/Linux again"
https://bugs.webkit.org/show_bug.cgi?id=192496
https://trac.webkit.org/changeset/239825
2019-01-10 Dominik Infuehr <dinfuehr@igalia.com>
Enable DFG on ARM/Linux again
https://bugs.webkit.org/show_bug.cgi?id=192496
Reviewed by Yusuke Suzuki.
Test wasn't really skipped before moving the line with skip
to the top.
* stress/regress-192717.js:
2019-01-08 Yusuke Suzuki <yusukesuzuki@slowstart.org>
Array.prototype.flat/flatMap have a minor bug in ArraySpeciesCreate
https://bugs.webkit.org/show_bug.cgi?id=193127
Reviewed by Saam Barati.
* stress/array-species-create-should-handle-masquerader.js: Added.
(shouldThrow):
* stress/is-undefined-or-null-builtin.js: Added.
(shouldBe):
(isUndefinedOrNull.vm.createBuiltin):
2019-01-08 Tadeu Zagallo <tzagallo@apple.com>
LLInt put_by_id uses the wrong load instruction for loading flags from the metadata
https://bugs.webkit.org/show_bug.cgi?id=193221
Reviewed by Mark Lam.
* stress/put-by-id-flags.js: Added.
(f):
(g):
(numberOfDFGCompiles):
2019-01-04 Tadeu Zagallo <tzagallo@apple.com>
Baseline version of get_by_id may corrupt metadata
https://bugs.webkit.org/show_bug.cgi?id=193085
<rdar://problem/23453006>
Reviewed by Saam Barati.
* stress/get-by-id-change-mode.js: Added.
(forEach):
2019-01-02 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[JSC] Optimize Object.prototype.toString
https://bugs.webkit.org/show_bug.cgi?id=193031
Reviewed by Saam Barati.
* stress/object-tostring-changed-proto.js: Added.
(shouldBe):
(test):
* stress/object-tostring-changed.js: Added.
(shouldBe):
(test):
* stress/object-tostring-misc.js: Added.
(shouldBe):
(test):
(i.switch):
* stress/object-tostring-other.js: Added.
(shouldBe):
(test):
* stress/object-tostring-untyped.js: Added.
(shouldBe):
(test):
(i.switch):
2019-01-03 Ross Kirsling <ross.kirsling@sony.com>
test262-runner misbehaves when test file YAML has a trailing space
https://bugs.webkit.org/show_bug.cgi?id=193053
Reviewed by Yusuke Suzuki.
* test262/expectations.yaml:
Mark two dozen tests as passing (and correct the output of another).
2018-12-30 Yusuke Suzuki <yusukesuzuki@slowstart.org>
Unreviewed, JSTests gardening with memoryLimited
* stress/string-overflow-createError.js:
2018-12-30 Ross Kirsling <ross.kirsling@sony.com>
[JSC] Identifier validity should be based on ID_Start / ID_Continue properties
https://bugs.webkit.org/show_bug.cgi?id=193050
Reviewed by Yusuke Suzuki.
* test262.yaml:
* test262/expectations.yaml:
Mark 16 tests as passing.
2018-12-13 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[BigInt] Support BigInt in JSON.stringify
https://bugs.webkit.org/show_bug.cgi?id=192624
Reviewed by Saam Barati.
* stress/big-int-json-stringify-to-json.js: Added.
(shouldBe):
(shouldThrow):
(BigInt.prototype.toJSON):
(shouldBe.JSON.stringify):
* stress/big-int-json-stringify.js: Added.
(shouldBe):
(shouldThrow):
2018-12-20 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[JSC] Implement "well-formed JSON.stringify" proposal
https://bugs.webkit.org/show_bug.cgi?id=191677
Reviewed by Darin Adler.
* stress/json-surrogate-pair.js: Added.
(shouldBe):
* test262/expectations.yaml:
2018-12-20 Keith Miller <keith_miller@apple.com>
Add support for globalThis
https://bugs.webkit.org/show_bug.cgi?id=165171
Reviewed by Mark Lam.
* test262/config.yaml:
2018-12-19 Keith Miller <keith_miller@apple.com>
Update test262 configuration to not run tests dependent on ICU version.
https://bugs.webkit.org/show_bug.cgi?id=192920
Reviewed by Saam Barati.
* test262/expectations.yaml:
2018-12-20 Mark Lam <mark.lam@apple.com>
Fix a typo in slow_path_construct_arityCheck and operationConstructArityCheck.
https://bugs.webkit.org/show_bug.cgi?id=192939
<rdar://problem/46869516>
Reviewed by Keith Miller.
* stress/stack-overflow-frame-for-construct-arityCheck-should-use-construct-codeBlock.js: Added.
2018-12-20 Tadeu Zagallo <tzagallo@apple.com>
WTF::String and StringImpl overflow MaxLength
https://bugs.webkit.org/show_bug.cgi?id=192853
<rdar://problem/45726906>
Reviewed by Mark Lam.
* stress/string-16bit-repeat-overflow.js: Added.
(catch):
2018-12-19 Ross Kirsling <ross.kirsling@sony.com>
Unreviewed follow-up to r192914.
* test262/expectations.yaml:
Add the last 20 missing expectations.
2018-12-19 Keith Miller <keith_miller@apple.com>
Fix test262 expectations
https://bugs.webkit.org/show_bug.cgi?id=192914
Unreviewed, when I imported the latest round of test262 tests I must have failed to update the test expectations.
* test262/expectations.yaml:
2018-12-19 Keith Miller <keith_miller@apple.com>
Update test262 tests.
https://bugs.webkit.org/show_bug.cgi?id=192907
Rubber stamped by Mark Lam.
* test262/*: Omitted because prepare-changelog crashes.
2018-12-19 Mark Lam <mark.lam@apple.com>
JSPropertyNameEnumerator should cache the iterated object's structure only after getting its property names.
https://bugs.webkit.org/show_bug.cgi?id=192464
<rdar://problem/46519455>
Reviewed by Saam Barati.
This patch is about a 10% speed up on the new for-in-on-object-with-lazily-materialized-properties.js
microbenchmark.
* microbenchmarks/for-in-on-object-with-lazily-materialized-properties.js: Added.
* stress/property-name-enumerator-should-cache-structure-after-getting-property-names.js: Added.
2018-12-19 Tadeu Zagallo <tzagallo@apple.com>
String overflow in JSC::createError results in ASSERT in WTF::makeString
https://bugs.webkit.org/show_bug.cgi?id=192833
<rdar://problem/45706868>
Reviewed by Mark Lam.
* stress/string-overflow-createError.js: Added.
2018-12-18 Ross Kirsling <ross.kirsling@sony.com>
Error message for `-x ** y` contains a typo.
https://bugs.webkit.org/show_bug.cgi?id=192832
Reviewed by Saam Barati.
* ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
(assert.assert.return.throws):
* stress/pow-expects-update-expression-on-lhs.js:
(throw.new.Error):
Update test expectations which match against the exact error message.
2018-12-18 Mark Lam <mark.lam@apple.com>
Gardening: test options fix.
https://bugs.webkit.org/show_bug.cgi?id=192822
Unreviewed.
* stress/json-stringify-string-builder-overflow.js:
2018-12-18 Mark Lam <mark.lam@apple.com>
JSON.stringify() should throw OOM on StringBuilder overflows.
https://bugs.webkit.org/show_bug.cgi?id=192822
<rdar://problem/46670577>
Reviewed by Saam Barati.
* stress/json-stringify-string-builder-overflow.js: Added.
2018-12-18 Ross Kirsling <ross.kirsling@sony.com>
Redeclaration of var over let/const/class should be a syntax error.
https://bugs.webkit.org/show_bug.cgi?id=192298
Reviewed by Keith Miller.
* test262.yaml:
* test262/expectations.yaml:
Mark 46 tests as passing.
* stress/block-scope-redeclarations.js:
Add some new tests.
* stress/for-in-invalidate-context-weird-assignments.js:
* stress/for-in-tests.js:
Replace tests for outdated behavior with tests for SyntaxError.
* ChakraCore/test/LetConst/defer3.baseline-jsc:
* ChakraCore/test/LetConst/letvar.baseline-jsc:
Update expectations.
2018-12-18 Mark Lam <mark.lam@apple.com>
Skip the stress/elidable-new-object-roflcopter-then-exit.js test on 32-bit.
https://bugs.webkit.org/show_bug.cgi?id=191374
<rdar://problem/46525447>
Reviewed by Yusuke Suzuki.
This test runs too slow on 32-bit, and is not relevant for non-JIT builds.
* stress/elidable-new-object-roflcopter-then-exit.js:
2018-12-17 Mark Lam <mark.lam@apple.com>
Skip the stress/materialized-regexp-has-correct-last-index-set-by-match.js test on 32-bit.
https://bugs.webkit.org/show_bug.cgi?id=192019
<rdar://problem/46525456>
Reviewed by Yusuke Suzuki.
The test runs too slow on 32-bit.
* stress/materialized-regexp-has-correct-last-index-set-by-match.js:
2018-12-17 Mark Lam <mark.lam@apple.com>
Skip the stress/materialize-regexp-cyclic-regexp.js test on 32-bit.
https://bugs.webkit.org/show_bug.cgi?id=191373
<rdar://problem/46525458>
Reviewed by Yusuke Suzuki.
The test is already slow running with a JIT on 64-bit. It will always timeout
on 32-bit without a JIT.
* stress/materialize-regexp-cyclic-regexp.js:
2018-12-17 Mark Lam <mark.lam@apple.com>
Array unshift/shift should not race against the AI in the compiler thread.
https://bugs.webkit.org/show_bug.cgi?id=192795
<rdar://problem/46724263>
Reviewed by Saam Barati.
* stress/array-unshift-should-not-race-against-compiler-thread.js: Added.
2018-12-16 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[JSC] Optimize Object.keys by caching own keys results in StructureRareData
https://bugs.webkit.org/show_bug.cgi?id=190047
Reviewed by Saam Barati.
* stress/object-keys-cached-zero.js: Added.
(shouldBe):
(test):
* stress/object-keys-changed-attribute.js: Added.
(shouldBe):
(test):
* stress/object-keys-changed-index.js: Added.
(shouldBe):
(test):
* stress/object-keys-changed.js: Added.
(shouldBe):
(test):
* stress/object-keys-indexed-non-cache.js: Added.
(shouldBe):
(test):
* stress/object-keys-overrides-get-property-names.js: Added.
(shouldBe):
(test):
(noInline):
2018-12-17 Mark Lam <mark.lam@apple.com>
SamplingProfiler's isValidFramePointer() should reject address at stack origin.
https://bugs.webkit.org/show_bug.cgi?id=192779
<rdar://problem/46775869>
Reviewed by Saam Barati.
* stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js: Added.
2018-12-17 Ryan Haddad <ryanhaddad@apple.com>
Unreviewed test gardening, address a syntax error in a new test.
* stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js:
2018-12-17 Mark Lam <mark.lam@apple.com>
Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit().
https://bugs.webkit.org/show_bug.cgi?id=192776
<rdar://problem/46772368>
Reviewed by Keith Miller.
* stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js: Added.
2018-12-17 Mark Lam <mark.lam@apple.com>
Fix stale assertion in attemptToForceStringArrayModeByToStringConversion().
https://bugs.webkit.org/show_bug.cgi?id=192770
<rdar://problem/46449037>
Reviewed by Keith Miller.
* stress/force-string-arrayMode-on-originalNonArray-array-class.js: Added.
2018-12-14 Mark Lam <mark.lam@apple.com>
CallFrame::convertToStackOverflowFrame() needs to keep the top CodeBlock alive.
https://bugs.webkit.org/show_bug.cgi?id=192717
<rdar://problem/46660677>
Reviewed by Saam Barati.
* stress/regress-192717.js: Added.
2018-12-14 Commit Queue <commit-queue@webkit.org>
Unreviewed, rolling out r239153, r239154, and r239155.
https://bugs.webkit.org/show_bug.cgi?id=192715
Caused flaky GC-related crashes seen with layout tests
(Requested by ryanhaddad on #webkit).
Reverted changesets:
"[JSC] Optimize Object.keys by caching own keys results in
StructureRareData"
https://bugs.webkit.org/show_bug.cgi?id=190047
https://trac.webkit.org/changeset/239153
"Unreviewed, build fix after r239153"
https://bugs.webkit.org/show_bug.cgi?id=190047
https://trac.webkit.org/changeset/239154
"Unreviewed, build fix after r239153, part 2"
https://bugs.webkit.org/show_bug.cgi?id=190047
https://trac.webkit.org/changeset/239155
2018-12-14 Keith Miller <keith_miller@apple.com>
Callers of JSString::getIndex should check for OOM exceptions
https://bugs.webkit.org/show_bug.cgi?id=192709
Reviewed by Mark Lam.
* stress/StringObject-define-length-getter-rope-string-oom.js: Added.
2018-12-13 Mark Lam <mark.lam@apple.com>
Add a missing exception check.
https://bugs.webkit.org/show_bug.cgi?id=192626
<rdar://problem/46662163>
Reviewed by Keith Miller.
* stress/regress-192626.js: Added.
2018-12-13 Caio Lima <ticaiolima@gmail.com>
[BigInt] Add ValueDiv into DFG
https://bugs.webkit.org/show_bug.cgi?id=186178
Reviewed by Yusuke Suzuki.
* stress/big-int-div-jit-osr.js: Added.
* stress/big-int-div-jit-untyped.js: Added.
* stress/value-div-fixup-int32-big-int.js: Added.
2018-12-10 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[JSC] Optimize Object.keys by caching own keys results in StructureRareData
https://bugs.webkit.org/show_bug.cgi?id=190047
Reviewed by Keith Miller.
* stress/object-keys-cached-zero.js: Added.
(shouldBe):
(test):
* stress/object-keys-changed-attribute.js: Added.
(shouldBe):
(test):
* stress/object-keys-changed-index.js: Added.
(shouldBe):
(test):
* stress/object-keys-changed.js: Added.
(shouldBe):
(test):
* stress/object-keys-indexed-non-cache.js: Added.
(shouldBe):
(test):
* stress/object-keys-overrides-get-property-names.js: Added.
(shouldBe):
(test):
(noInline):
2018-12-12 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[DFG][FTL] Add NewSymbol
https://bugs.webkit.org/show_bug.cgi?id=192620
Reviewed by Saam Barati.
* microbenchmarks/symbol-creation.js: Added.
(test):
* stress/symbol-description-identity.js: Added.
(shouldBe):
(test):
* stress/symbol-identity.js: Added.
(shouldBe):
(test):
* stress/symbol-with-description-throw-error.js: Added.
(shouldBe):
(shouldThrow):
(test):
(object.toString):
2018-12-12 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[BigInt] Implement DFG/FTL typeof for BigInt
https://bugs.webkit.org/show_bug.cgi?id=192619
Reviewed by Keith Miller.
* stress/big-int-boolean-proven-type.js: Added.
(assert):
(bool):
* stress/big-int-type-of-proven-type-non-constant-including-symbol.js: Added.
(assert):
(typeOf):
(i.switch):
* stress/big-int-type-of-proven-type-non-constant.js: Added.
(assert):
(typeOf):
* stress/big-int-type-of.js:
(typeOf):
(func):
2018-12-10 Mark Lam <mark.lam@apple.com>
PropertyAttribute needs a CustomValue bit.
https://bugs.webkit.org/show_bug.cgi?id=191993
<rdar://problem/46264467>
Reviewed by Saam Barati.
* stress/regress-191993.js: Added.
2018-12-10 Caio Lima <ticaiolima@gmail.com>
[BigInt] Add ValueMul into DFG
https://bugs.webkit.org/show_bug.cgi?id=186175
Reviewed by Yusuke Suzuki.
* stress/big-int-mul-jit-osr.js: Added.
* stress/big-int-mul-jit-untyped.js: Added.
* stress/value-mul-fixup-int32-big-int.js: Added.
2018-12-06 Keith Miller <keith_miller@apple.com>
stress/big-wasm-memory tests failing on 32-bit JSC bot
https://bugs.webkit.org/show_bug.cgi?id=192020
Reviewed by Saam Barati.
Not every platform has WebAssembly, e.g. 32-bit, so we should exit
the wasm stress tests if the WebAssembly object does not exist.
* stress/big-wasm-memory-grow-no-max.js:
(test.foo):
(test):
(foo): Deleted.
(catch): Deleted.
* stress/big-wasm-memory-grow.js:
(test.foo):
(test):
(foo): Deleted.
(catch): Deleted.
* stress/big-wasm-memory.js:
(test.foo):
(test):
(foo): Deleted.
(catch): Deleted.
2018-12-05 Mark Lam <mark.lam@apple.com>
speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
https://bugs.webkit.org/show_bug.cgi?id=192441
<rdar://problem/46480355>
Reviewed by Saam Barati.
* stress/regress-192441.js: Added.
2018-12-04 Mark Lam <mark.lam@apple.com>
DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility.
https://bugs.webkit.org/show_bug.cgi?id=192386
<rdar://problem/46445516>
Reviewed by Saam Barati.
* stress/regress-192386.js: Added.
2018-12-04 Caio Lima <ticaiolima@gmail.com>
[ESNext][BigInt] Support logic operations
https://bugs.webkit.org/show_bug.cgi?id=179903
Reviewed by Yusuke Suzuki.
* stress/big-int-branch-usage.js: Added.
* stress/big-int-logical-and.js: Added.
* stress/big-int-logical-not.js: Added.
* stress/big-int-logical-or.js: Added.
2018-12-03 Ryan Haddad <ryanhaddad@apple.com>
Unreviewed, rolling out r238833.
Breaks macOS and iOS debug builds.
Reverted changeset:
"[ESNext][BigInt] Support logic operations"
https://bugs.webkit.org/show_bug.cgi?id=179903
https://trac.webkit.org/changeset/238833
2018-12-03 Caio Lima <ticaiolima@gmail.com>
[ESNext][BigInt] Support logic operations
https://bugs.webkit.org/show_bug.cgi?id=179903
Reviewed by Yusuke Suzuki.
* stress/big-int-branch-usage.js: Added.
* stress/big-int-logical-and.js: Added.
* stress/big-int-logical-not.js: Added.
* stress/big-int-logical-or.js: Added.
2018-12-02 Caio Lima <ticaiolima@gmail.com>
[ESNext][BigInt] Implement support for "<<" and ">>"
https://bugs.webkit.org/show_bug.cgi?id=186233
Reviewed by Yusuke Suzuki.
* stress/big-int-left-shift-general.js: Added.
* stress/big-int-left-shift-range-error.js: Added.
* stress/big-int-left-shift-type-error.js: Added.
* stress/big-int-left-shift-wrapped-value.js: Added.
* stress/big-int-right-shift-general.js: Added.
* stress/big-int-right-shift-type-error.js: Added.
* stress/big-int-right-shift-wrapped-value.js: Added.
* stress/left-shift-to-primitive-precedence.js: Added.
* stress/right-shift-to-primitive-precedence.js: Added.
2018-11-30 Dean Jackson <dino@apple.com>
Add first-class support for .mjs files in jsc binary
https://bugs.webkit.org/show_bug.cgi?id=192190
<rdar://problem/46375715>
Reviewed by Keith Miller.
* stress/simple-module.mjs: Added.
* stress/simple-script.js: Added.
2018-11-30 Caio Lima <ticaiolima@gmail.com>
[BigInt] Implement ValueBitXor into DFG
https://bugs.webkit.org/show_bug.cgi?id=190264
Reviewed by Yusuke Suzuki.
* stress/big-int-bitwise-xor-jit.js: Added.
* stress/big-int-bitwise-xor-memory-stress.js: Added.
* stress/big-int-bitwise-xor-untyped.js: Added.
2018-11-27 Saam barati <sbarati@apple.com>
r238510 broke scopes of size zero
https://bugs.webkit.org/show_bug.cgi?id=192033
<rdar://problem/46281734>
Reviewed by Keith Miller.
* stress/r238510-bad-loop.js: Added.
(foo):
2018-11-27 Mark Lam <mark.lam@apple.com>
[Re-landing] NaNs read from Wasm code needs to be be purified.
https://bugs.webkit.org/show_bug.cgi?id=191056
<rdar://problem/45660341>
Reviewed by Filip Pizlo.
* wasm/regress/regress-191056.js: Added.
2018-11-27 Ryan Haddad <ryanhaddad@apple.com>
Unreviewed, rolling out r238509.
Causes JSC tests to fail on iOS.
Reverted changeset:
"NaNs read from Wasm code needs to be be purified."
https://bugs.webkit.org/show_bug.cgi?id=191056
https://trac.webkit.org/changeset/238509
2018-11-26 Caio Lima <ticaiolima@gmail.com>
Re-introduce op_bitnot
https://bugs.webkit.org/show_bug.cgi?id=190923
Reviewed by Yusuke Suzuki.
* stress/bit-not-must-generate.js: Added.
* stress/bitwise-not-no-int32.js: Added.
2018-11-26 Saam barati <sbarati@apple.com>
InPlaceAbstractState::endBasicBlock rule for SetLocal should filter the value based on the flush format
https://bugs.webkit.org/show_bug.cgi?id=191956
<rdar://problem/45665806>
Reviewed by Yusuke Suzuki.
* stress/end-basic-block-set-local-should-filter-type.js: Added.
(bar):
(foo):
2018-11-26 Saam barati <sbarati@apple.com>
Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation
https://bugs.webkit.org/show_bug.cgi?id=191958
<rdar://problem/46221877>
Reviewed by Yusuke Suzuki.
* stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added.
(x):
(foo):
2018-11-26 Mark Lam <mark.lam@apple.com>
NaNs read from Wasm code needs to be be purified.
https://bugs.webkit.org/show_bug.cgi?id=191056
<rdar://problem/45660341>
Reviewed by Filip Pizlo.
* wasm/regress/regress-191056.js: Added.
2018-11-26 Michael Saboff <msaboff@apple.com>
32-bit JSC test failure: stress/regexp-compile-oom.js
https://bugs.webkit.org/show_bug.cgi?id=191375
Reviewed by Mark Lam.
Disabled the test for 32 bit platforms.
* stress/regexp-compile-oom.js:
2018-11-26 Tadeu Zagallo <tzagallo@apple.com>
ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
https://bugs.webkit.org/show_bug.cgi?id=191716
<rdar://problem/45723878>
Reviewed by Saam Barati.
* stress/regress-187373.js: Added.
(async.fn):
2018-11-21 Saam barati <sbarati@apple.com>
DFGSpeculativeJIT should not &= exitOK with mayExit(node)
https://bugs.webkit.org/show_bug.cgi?id=191897
<rdar://problem/45871998>
Reviewed by Mark Lam.
* stress/exitok-is-not-the-same-as-mayExit.js: Added.
(bar):
(foo):
2018-11-21 Saam barati <sbarati@apple.com>
Fix assertion in KnownCellUse inside SpeculativeJIT::speculate
https://bugs.webkit.org/show_bug.cgi?id=191895
<rdar://problem/46167406>
Reviewed by Mark Lam.
* stress/known-cell-use-needs-type-check-assertion.js: Added.
(foo):
(bar):
2018-11-21 Mark Lam <mark.lam@apple.com>
Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError.
https://bugs.webkit.org/show_bug.cgi?id=191776
<rdar://problem/46152851>
Reviewed by Saam Barati.
* stress/big-wasm-memory-grow-no-max.js:
* stress/big-wasm-memory-grow.js:
* stress/big-wasm-memory.js:
- updated these to expect an OutOfMemoryError.
* wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: Added.
(Binary.prototype.emit_u8):
(Binary.prototype.emit_u32v):
(Binary.prototype.emit_header):
(Binary.prototype.emit_section):
(Binary):
(WasmModuleBuilder):
(WasmModuleBuilder.prototype.addMemory):
(WasmModuleBuilder.prototype.toArray):
(WasmModuleBuilder.prototype.toBuffer):
(WasmModuleBuilder.prototype.instantiate):
(catch):
* wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Added.
(catch):
2018-11-21 Caio Lima <ticaiolima@gmail.com>
[BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
https://bugs.webkit.org/show_bug.cgi?id=190836
Reviewed by Saam Barati and Yusuke Suzuki.
* stress/big-int-out-of-memory-tests.js: Added.
2018-11-20 Mark Lam <mark.lam@apple.com>
Remove invalid assertion in VMTraps::SignalSender's SignalAction.
https://bugs.webkit.org/show_bug.cgi?id=191856
<rdar://problem/46089992>
Reviewed by Yusuke Suzuki.
* stress/regress-191856.js: Added.
- this test is skipped for now until we have a fix for webkit.org/b/191855.
2018-11-21 Dominik Infuehr <dinfuehr@igalia.com>
Enable JIT on ARM/Linux
https://bugs.webkit.org/show_bug.cgi?id=191548
Reviewed by Yusuke Suzuki.
Disable test on system with limited memory. Program was killed by
the OS before the exception was thrown.
* slowMicrobenchmarks/function-constructor-with-huge-strings.js:
2018-11-20 Saam barati <sbarati@apple.com>
Merging an IC variant may lead to the IC status containing overlapping structure sets
https://bugs.webkit.org/show_bug.cgi?id=191869
<rdar://problem/45403453>
Reviewed by Mark Lam.
* stress/merging-ic-variants-should-bail-if-structures-overlap.js: Added.
2018-11-19 Mark Lam <mark.lam@apple.com>
globalFuncImportModule() should return a promise when it clears exceptions.
https://bugs.webkit.org/show_bug.cgi?id=191792
<rdar://problem/46090763>
Reviewed by Michael Saboff.
* stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: Added.
2018-11-19 Guillaume Emont <guijemont@igalia.com>
Skip new memory-hungry tests on memory limited devices
Unreviewed gardening.
* stress/big-wasm-memory-grow-no-max.js:
* stress/big-wasm-memory-grow.js:
* stress/big-wasm-memory.js:
2018-11-18 Yusuke Suzuki <yusukesuzuki@slowstart.org>
Unreviewed, rolling in the rest of r237254
https://bugs.webkit.org/show_bug.cgi?id=190340
* ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
* stress/function-cache-with-parameters-end-position.js: Added.
(shouldBe):
(shouldThrow):
(i.anonymous):
* stress/function-constructor-name.js: Added.
(shouldBe):
(GeneratorFunction):
(AsyncFunction.async):
(AsyncGeneratorFunction.async):
(anonymous):
(async.anonymous):
* test262/expectations.yaml:
2018-11-16 Filip Pizlo <fpizlo@apple.com>
All users of ArrayBuffer should agree on the same max size
https://bugs.webkit.org/show_bug.cgi?id=191771
Reviewed by Mark Lam.
* stress/big-wasm-memory-grow-no-max.js: Added.
(foo):
(catch):
* stress/big-wasm-memory-grow.js: Added.
(foo):
(catch):
* stress/big-wasm-memory.js: Added.
(foo):
(catch):
2018-11-16 Filip Pizlo <fpizlo@apple.com>
Unreviewed, make some more tests not crash my computer by only running on instance of it. These tests do not need to
run for each JSC config since they're regression tests for runtime bugs.
* stress/json-stringified-overflow-2.js:
* stress/json-stringified-overflow.js:
2018-11-16 Filip Pizlo <fpizlo@apple.com>
Unreviewed, make some tests not crash my computer by only running on instance of it. These tests do not need to run for each JSC
config since they're regression tests for runtime bugs.
* stress/large-unshift-splice.js:
* stress/regress-185888.js:
2018-11-16 Saam Barati <sbarati@apple.com>
KnownCellUse should also have SpecCellCheck as its type filter
https://bugs.webkit.org/show_bug.cgi?id=191729
<rdar://problem/45872852>
Reviewed by Filip Pizlo.
* stress/known-cell-type-check-should-allow-empty-value-to-flow-through.js: Added.
(C):
2018-11-16 Tadeu Zagallo <tzagallo@apple.com>
Fix assertion failure on BytecodeGenerator::recordOpcode
https://bugs.webkit.org/show_bug.cgi?id=191724
<rdar://problem/45724395>
Reviewed by Saam Barati.
* stress/regress-187373-2.js: Added.
(foo):
2018-11-15 Mark Lam <mark.lam@apple.com>
RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
https://bugs.webkit.org/show_bug.cgi?id=191730
<rdar://problem/46048517>
Reviewed by Saam Barati.
* stress/regress-187006.js: Removed.
- this test is invalid because its sole purpose is to test for the non-spec
compliant behavior that we just fixed.
* stress/regress-191730.js: Added.
2018-11-15 Mark Lam <mark.lam@apple.com>
RegExp operations should not take fast patch if lastIndex is not numeric.
https://bugs.webkit.org/show_bug.cgi?id=191731
<rdar://problem/46017305>
Reviewed by Saam Barati.
* stress/regress-191731.js: Added.
2018-11-13 Saam Barati <sbarati@apple.com>
TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM
https://bugs.webkit.org/show_bug.cgi?id=191600
Reviewed by Mark Lam.
* stress/type-profiler-log-should-defer-pending-exceptions.js: Added.
(foo):
(test):
(bar):
2018-11-13 Ryan Haddad <ryanhaddad@apple.com>
Unreviewed, rolling out r238132.
The test added with this change is timing out on Debug JSC
bots.
Reverted changeset:
"[BigInt] JSBigInt::createWithLength should throw when length
is greater than JSBigInt::maxLength"
https://bugs.webkit.org/show_bug.cgi?id=190836
https://trac.webkit.org/changeset/238132
2018-11-13 Mark Lam <mark.lam@apple.com>
Add OOM detection to StringPrototype's substituteBackreferences().
https://bugs.webkit.org/show_bug.cgi?id=191563
<rdar://problem/45720428>
Reviewed by Saam Barati.
* stress/regress-191563.js: Added.
2018-11-13 Mark Lam <mark.lam@apple.com>
LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame.
https://bugs.webkit.org/show_bug.cgi?id=191579
<rdar://problem/45942472>
Reviewed by Saam Barati.
* stress/regress-191579.js: Added.
2018-11-13 Caio Lima <ticaiolima@gmail.com>
[BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
https://bugs.webkit.org/show_bug.cgi?id=190836
Reviewed by Saam Barati.
* stress/big-int-out-of-memory-tests.js: Added.
2018-11-08 Ross Kirsling <ross.kirsling@sony.com>
U+180E is no longer a whitespace character
https://bugs.webkit.org/show_bug.cgi?id=191415
Reviewed by Saam Barati.
* ChakraCore/test/es5/regexSpace.baseline:
* ChakraCore/test/es6/unicode_whitespace.js:
Update tests to latest version.
(See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.)
* test262.yaml:
* test262/config.yaml:
* test262/expectations.yaml:
Update expectations.
2018-11-07 Caio Lima <ticaiolima@gmail.com>
[BigInt] Add support to BigInt into ValueAdd
https://bugs.webkit.org/show_bug.cgi?id=186177
Reviewed by Keith Miller.
* stress/big-int-negate-jit.js:
* stress/value-add-big-int-and-string.js: Added.
* stress/value-add-big-int-prediction-propagation.js: Added.
* stress/value-add-big-int-untyped.js: Added.
2018-11-07 Tadeu Zagallo <tzagallo@apple.com>
REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled
https://bugs.webkit.org/show_bug.cgi?id=191184
Reviewed by Saam Barati.
Most tests were failing due to timeouts, since they are too slow to
run on CLoop. The exceptions are:
proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop
dont-crash-on-stack-overflow-when-parsing-builtin.js and
dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had
to change the stack size since CLoop requires it to be page aligned.
* microbenchmarks/array-push-1.js:
* microbenchmarks/array-push-2.js:
* microbenchmarks/elidable-new-object-dag.js:
* microbenchmarks/elidable-new-object-roflcopter.js:
* microbenchmarks/elidable-new-object-tree.js:
* microbenchmarks/getter-richards.js:
* microbenchmarks/sinkable-new-object-dag.js:
* microbenchmarks/string-concat-long-convert.js:
* microbenchmarks/typed-array-get-set-by-val-profiling.js:
* slowMicrobenchmarks/array-push-3.js:
* slowMicrobenchmarks/large-map-iteration-with-additions.js:
* slowMicrobenchmarks/spread-small-array.js:
* slowMicrobenchmarks/undefined-property-access.js:
* stress/activation-sink-default-value-tdz-error.js:
* stress/activation-sink-default-value.js:
* stress/activation-sink-osrexit-default-value-tdz-error.js:
* stress/activation-sink-osrexit-default-value.js:
* stress/activation-sink-osrexit.js:
* stress/activation-sink.js:
* stress/allow-math-ic-b3-code-duplication.js:
* stress/array-push-multiple-int32.js:
* stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js:
* stress/arrowfunction-lexical-this-activation-sink-osrexit.js:
* stress/arrowfunction-lexical-this-activation-sink.js:
* stress/dont-crash-on-stack-overflow-when-parsing-builtin.js:
* stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js:
* stress/elide-new-object-dag-then-exit.js:
* stress/materialize-regexp-cyclic.js:
* stress/new-regex-inline.js:
* stress/op_add.js:
* stress/op_bitand.js:
* stress/op_bitor.js:
* stress/op_bitxor.js:
* stress/op_div-ConstVar.js:
* stress/op_div-VarConst.js:
* stress/op_div-VarVar.js:
* stress/op_lshift-ConstVar.js:
* stress/op_lshift-VarConst.js:
* stress/op_lshift-VarVar.js:
* stress/op_mod-ConstVar.js:
* stress/op_mod-VarConst.js:
* stress/op_mod-VarVar.js:
* stress/op_mul-ConstVar.js:
* stress/op_mul-VarConst.js:
* stress/op_mul-VarVar.js:
* stress/op_rshift-ConstVar.js:
* stress/op_rshift-VarConst.js:
* stress/op_rshift-VarVar.js:
* stress/op_sub-ConstVar.js:
* stress/op_sub-VarConst.js:
* stress/op_sub-VarVar.js:
* stress/op_urshift-ConstVar.js:
* stress/op_urshift-VarConst.js:
* stress/op_urshift-VarVar.js:
* stress/proxy-get-set-correct-receiver.js:
* stress/regress-179562.js:
* stress/rest-parameter-many-arguments.js:
* stress/sampling-profiler-richards.js:
* stress/splay-flash-access-1ms.js:
* stress/tailCallForwardArguments.js:
* stress/typed-array-get-by-val-profiling.js:
* typeProfiler/getter-richards.js:
2018-11-06 Michael Saboff <msaboff@apple.com>
Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.
https://bugs.webkit.org/show_bug.cgi?id=191271
Reviewed by Saam Barati.
Added more test cases and made all test cases run with the same deeply recursive stack
instead of finding that same point for each test case.
* stress/regexp-compile-oom.js:
(prototype.runTest):
(recurseAndTest):
(testList.push.new.TestAndExpectedException):
2018-11-05 Michael Saboff <msaboff@apple.com>
Unreviewed build fix for linux.
* stress/regexp-compile-oom.js: Disabled for non-darwin OSes.
2018-11-02 Michael Saboff <msaboff@apple.com>
Rolling in r237753 with unreviewed build fix.
Fixed issues with DECLARE_THROW_SCOPE placement.
2018-11-02 Ryan Haddad <ryanhaddad@apple.com>
Unreviewed, rolling out r237753.
Introduced JSC test failures
Reverted changeset:
"Running out of stack space not properly handled in
RegExp::compile() and its callers"
https://bugs.webkit.org/show_bug.cgi?id=191206
https://trac.webkit.org/changeset/237753
2018-11-02 Michael Saboff <msaboff@apple.com>
Running out of stack space not properly handled in RegExp::compile() and its callers
https://bugs.webkit.org/show_bug.cgi?id=191206
Reviewed by Filip Pizlo.
New regression test.
* stress/regexp-compile-oom.js: Added.
(recurseAndTest):
2018-11-01 Guillaume Emont <guijemont@igalia.com>
Skip tests on arm/mips that time out now we're running on CLoop
Unreviewed gardening.
Since the JIT is temporarily disabled on 32-bit platforms, these tests
time out on the bots and need to be disabled. There's more tests
disabled on arm because the timeout is longer on the mips bot (as the
device is slower to start with), so many of the tests don't time out
there.
* microbenchmarks/getter-richards.js: disable on arm and mips.
* stress/op_add.js: disable on arm.
* stress/op_bitand.js: disable on arm.
* stress/op_bitor.js: disable on arm.
* stress/op_bitxor.js: disable on arm.
* stress/op_lshift-ConstVar.js: disable on arm.
* stress/op_lshift-VarConst.js: disable on arm.
* stress/op_lshift-VarVar.js: disable on arm.
* stress/op_mod-ConstVar.js: disable on arm.
* stress/op_mod-VarConst.js: disable on arm.
* stress/op_mod-VarVar.js: disable on arm.
* stress/op_mul-ConstVar.js: disable on arm.
* stress/op_mul-VarConst.js: disable on arm.
* stress/op_mul-VarVar.js: disable on arm.
* stress/op_rshift-ConstVar.js: disable on arm.
* stress/op_rshift-VarConst.js: disable on arm.
* stress/op_rshift-VarVar.js: disable on arm.
* stress/op_sub-ConstVar.js: disable on arm.
* stress/op_sub-VarConst.js: disable on arm.
* stress/op_sub-VarVar.js: disable on arm.
* stress/op_urshift-ConstVar.js: disable on arm.
* stress/op_urshift-VarConst.js: disable on arm.
* stress/op_urshift-VarVar.js: disable on arm.
* stress/spread-forward-call-varargs-stack-overflow.js: disable on arm.
* stress/value-to-boolean.js: disable on arm and mips.
2018-10-31 Tadeu Zagallo <tzagallo@apple.com>
REGRESSION(r237547): Exception handlers should be aware of wide opcodes
https://bugs.webkit.org/show_bug.cgi?id=191108
<rdar://problem/45690700>
Reviewed by Saam Barati.
* stress/wide-op_catch.js: Added.
(catch):
2018-10-29 Mark Lam <mark.lam@apple.com>
Correctly detect string overflow when using the 'Function' constructor.
https://bugs.webkit.org/show_bug.cgi?id=184883
<rdar://problem/36320331>
Reviewed by Saam Barati.
I've verified that this passes on 32-bit as well.
* slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
2018-10-29 Tadeu Zagallo <tzagallo@apple.com>
Add support for GetStack FlushedDouble
https://bugs.webkit.org/show_bug.cgi?id=191012
<rdar://problem/45265141>
Reviewed by Saam Barati.
* stress/get-stack-double.js: Added.
(bar):
(noInline):
2018-10-29 Tadeu Zagallo <tzagallo@apple.com>
New bytecode format for JSC
https://bugs.webkit.org/show_bug.cgi?id=187373
<rdar://problem/44186758>
Reviewed by Filip Pizlo.
Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
* stress/maximum-inline-capacity.js: Added.
(test1):
(test3.Foo):
(test3):
2018-10-26 Commit Queue <commit-queue@webkit.org>
Unreviewed, rolling out r237479 and r237484.
https://bugs.webkit.org/show_bug.cgi?id=190978
broke JSC on iOS (Requested by tadeuzagallo on #webkit).
Reverted changesets:
"New bytecode format for JSC"
https://bugs.webkit.org/show_bug.cgi?id=187373
https://trac.webkit.org/changeset/237479
"Gardening: Build fix after r237479."
https://bugs.webkit.org/show_bug.cgi?id=187373
https://trac.webkit.org/changeset/237484
2018-10-26 Tadeu Zagallo <tzagallo@apple.com>
New bytecode format for JSC
https://bugs.webkit.org/show_bug.cgi?id=187373
<rdar://problem/44186758>
Reviewed by Filip Pizlo.
Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
* stress/maximum-inline-capacity.js: Added.
(test1):
(test3.Foo):
(test3):
2018-10-26 Mark Lam <mark.lam@apple.com>
Fix missing edge cases with JSGlobalObjects having a bad time.
https://bugs.webkit.org/show_bug.cgi?id=189028
<rdar://problem/45204939>
Reviewed by Saam Barati.
* stress/regress-189028.js: Added.
2018-10-22 Mark Lam <mark.lam@apple.com>
DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
https://bugs.webkit.org/show_bug.cgi?id=190515
<rdar://problem/45222379>
Rubber-stamped by Saam Barati.
Adding another test.
* stress/regress-190515-2.js: Added.
2018-10-22 Mark Lam <mark.lam@apple.com>
DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
https://bugs.webkit.org/show_bug.cgi?id=190515
<rdar://problem/45222379>
Reviewed by Saam Barati.
* stress/regress-190515.js: Added.
2018-10-19 Commit Queue <commit-queue@webkit.org>
Unreviewed, rolling out r237254.
https://bugs.webkit.org/show_bug.cgi?id=190760
"It regresses JetStream 2 by 5% on some iOS devices"
(Requested by saamyjoon on #webkit).
Reverted changeset:
"[JSC] JSC should have "parseFunction" to optimize Function
constructor"
https://bugs.webkit.org/show_bug.cgi?id=190340
https://trac.webkit.org/changeset/237254
2018-10-19 Saam Barati <sbarati@apple.com>
vmCall should check if we exit before emitting an OSR exit due to exceptions
https://bugs.webkit.org/show_bug.cgi?id=190740
<rdar://problem/45220139>
Reviewed by Mark Lam.
* stress/dont-emit-osr-exits-for-every-call-ftl.js: Added.
(foo):
2018-10-19 Caio Lima <ticaiolima@gmail.com>
[ESNext][BigInt] Implement support for "^"
https://bugs.webkit.org/show_bug.cgi?id=186235
Reviewed by Yusuke Suzuki.
* stress/big-int-bitwise-xor-general.js: Added.
* stress/big-int-bitwise-xor-to-primitive-precedence.js: Added.
* stress/big-int-bitwise-xor-type-error.js: Added.
* stress/big-int-bitwise-xor-wrapped-value.js: Added.
2018-10-19 Caio Lima <ticaiolima@gmail.com>
[BigInt] Add ValueSub into DFG
https://bugs.webkit.org/show_bug.cgi?id=186176
Reviewed by Yusuke Suzuki.
* stress/big-int-subtraction-jit.js:
* stress/value-sub-big-int-prediction-propagation.js: Added.
* stress/value-sub-big-int-untyped.js: Added.
* stress/value-sub-spec-none-case.js: Added.
2018-10-18 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[JSC] JSC should have "parseFunction" to optimize Function constructor
https://bugs.webkit.org/show_bug.cgi?id=190340
Reviewed by Mark Lam.
This patch fixes the line number of syntax errors raised by the Function constructor,
since we now parse the final code only once. And we no longer use block statement
for Function constructor's parsing.
* ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
* stress/function-cache-with-parameters-end-position.js: Added.
(shouldBe):
(shouldThrow):
(i.anonymous):
* stress/function-constructor-name.js: Added.
(shouldBe):
(GeneratorFunction):
(AsyncFunction.async):
(AsyncGeneratorFunction.async):
(anonymous):
(async.anonymous):
* test262/expectations.yaml:
2018-10-18 Commit Queue <commit-queue@webkit.org>
Unreviewed, rolling out r237242.
https://bugs.webkit.org/show_bug.cgi?id=190701
it breaks "stress/sampling-profiler-basic.js" (Requested by
caiolima on #webkit).
Reverted changeset:
"[BigInt] Add ValueSub into DFG"
https://bugs.webkit.org/show_bug.cgi?id=186176
https://trac.webkit.org/changeset/237242
2018-10-17 Keith Miller <keith_miller@apple.com>
AI does not clear Phantom allocation nodes.
https://bugs.webkit.org/show_bug.cgi?id=190694
Reviewed by Saam Barati.
* stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added.
(Day):
(DaysInYear):
(TimeInYear):
(TimeFromYear):
(DayFromYear):
(InLeapYear):
(YearFromTime):
(WeekDay):
(DaylightSavingTA):
(GetSecondSundayInMarch):
(TimeInMonth):
2018-10-17 Caio Lima <ticaiolima@gmail.com>
[BigInt] Add ValueSub into DFG
https://bugs.webkit.org/show_bug.cgi?id=186176
Reviewed by Yusuke Suzuki.
* stress/big-int-subtraction-jit.js:
* stress/value-sub-big-int-prediction-propagation.js: Added.
* stress/value-sub-big-int-untyped.js: Added.
2018-10-16 Dominik Infuehr <dinfuehr@igalia.com>
[JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips
https://bugs.webkit.org/show_bug.cgi?id=190611
Reviewed by Saam Barati.
Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js
to improve test runtime. On ARM/MIPS this test even timed out when running all
tests.
* stress/array-prototype-concat-of-long-spliced-arrays2.js:
(test):
2018-10-15 Guillaume Emont <guijemont@igalia.com>
Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux
Unreviewed gardening.
* stress/array-prototype-concat-of-long-spliced-arrays2.js:
2018-10-15 Saam barati <sbarati@apple.com>
Emit fjcvtzs on ARM64E on Darwin
https://bugs.webkit.org/show_bug.cgi?id=184023
Reviewed by Yusuke Suzuki and Filip Pizlo.
* stress/double-to-int32-NaN.js: Added.
(assert):
(foo):
2018-10-15 Saam Barati <sbarati@apple.com>
JSArray::shiftCountWithArrayStorage is wrong when an array has holes
https://bugs.webkit.org/show_bug.cgi?id=190262
<rdar://problem/44986241>
Reviewed by Mark Lam.
* stress/array-prototype-concat-of-long-spliced-arrays.js:
(test):
* stress/slice-array-storage-with-holes.js: Added.
(main):
2018-10-15 Commit Queue <commit-queue@webkit.org>
Unreviewed, rolling out r237054.
https://bugs.webkit.org/show_bug.cgi?id=190593
"this regressed JetStream 2 by 6% on iOS" (Requested by
saamyjoon on #webkit).
Reverted changeset:
"[JSC] JSC should have "parseFunction" to optimize Function
constructor"
https://bugs.webkit.org/show_bug.cgi?id=190340
https://trac.webkit.org/changeset/237054
2018-10-13 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[JSC] JSON.stringify can accept call-with-no-arguments
https://bugs.webkit.org/show_bug.cgi?id=190343
Reviewed by Mark Lam.
* stress/json-stringify-no-arguments.js: Added.
(shouldBe):
2018-10-08 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[JSC] JSC should have "parseFunction" to optimize Function constructor
https://bugs.webkit.org/show_bug.cgi?id=190340
Reviewed by Mark Lam.
This patch fixes the line number of syntax errors raised by the Function constructor,
since we now parse the final code only once. And we no longer use block statement
for Function constructor's parsing.
* ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
* stress/function-cache-with-parameters-end-position.js: Added.
(shouldBe):
(shouldThrow):
(i.anonymous):
* stress/function-constructor-name.js: Added.
(shouldBe):
(GeneratorFunction):
(AsyncFunction.async):
(AsyncGeneratorFunction.async):
(anonymous):
(async.anonymous):
* test262/expectations.yaml:
2018-10-10 Guillaume Emont <guijemont@igalia.com>
Skip JSC test stress/sampling-profiler-richards.js on armv7/linux
https://bugs.webkit.org/show_bug.cgi?id=190426
Unreviewed gardening.
* stress/sampling-profiler-richards.js:
2018-10-06 Caio Lima <ticaiolima@gmail.com>
[ESNext][BigInt] Implement support for "|"
https://bugs.webkit.org/show_bug.cgi?id=186229
Reviewed by Yusuke Suzuki.
* stress/big-int-bitwise-and-jit.js:
* stress/big-int-bitwise-or-general.js: Added.
* stress/big-int-bitwise-or-jit-untyped.js: Added.
* stress/big-int-bitwise-or-jit.js: Added.
* stress/big-int-bitwise-or-memory-stress.js: Added.
* stress/big-int-bitwise-or-to-primitive-precedence.js: Added.
* stress/big-int-bitwise-or-type-error.js: Added.
* stress/big-int-bitwise-or-wrapped-value.js: Added.
2018-10-05 Dominik Infuehr <dominik.infuehr@gmail.com>
Skip test on systems with limited memory
https://bugs.webkit.org/show_bug.cgi?id=190310
Invoking runDefault adds test to runlist, skipping the test in the next
line does not prevent the test from executing. Change order of lines such
that runDefault is only executed if test is not executed.
Reviewed by Mark Lam.
* stress/regress-190187.js:
2018-10-03 Saam barati <sbarati@apple.com>
lowXYZ in FTLLower should always filter the type of the incoming edge
https://bugs.webkit.org/show_bug.cgi?id=189939
<rdar://problem/44407030>
Reviewed by Michael Saboff.
* stress/ftl-should-always-filter-for-low-type-check-functions.js: Added.
(foo):
(test):
2018-10-03 Mark Lam <mark.lam@apple.com>
Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX.
https://bugs.webkit.org/show_bug.cgi?id=190187
<rdar://problem/42512909>
Reviewed by Michael Saboff.
* stress/regress-190187.js: Added.
2018-10-02 Caio Lima <ticaiolima@gmail.com>
[BigInt] BigInt.proptotype.toString is broken when radix is power of 2
https://bugs.webkit.org/show_bug.cgi?id=190033
Reviewed by Yusuke Suzuki.
* stress/big-int-to-string.js:
2018-10-01 Mark Lam <mark.lam@apple.com>
Function.toString() should also copy the source code Functions that are class definitions.
https://bugs.webkit.org/show_bug.cgi?id=190186
<rdar://problem/44733360>
Reviewed by Saam Barati.
* stress/regress-190186.js: Added.
2018-10-01 Dominik Infuehr <dinfuehr@igalia.com>
Split NaN-check into separate test
https://bugs.webkit.org/show_bug.cgi?id=190010
Reviewed by Saam Barati.
DataView exposes NaN-representation, which is not necessarily the same on each
architecture. Therefore move the check of the NaN-representation into its own
file such that we can disable this test on MIPS where NaN-representation can be
different on older CPUs.
* stress/dataview-jit-set-nan.js: Added.
(assert):
(test.storeLittleEndian):
(test.storeBigEndian):
(test.store):
(test):
* stress/dataview-jit-set.js:
(test5):
2018-10-01 Commit Queue <commit-queue@webkit.org>
Unreviewed, rolling out r236647.
https://bugs.webkit.org/show_bug.cgi?id=190124
Breaking test stress/big-int-to-string.js (Requested by
caiolima_ on #webkit).
Reverted changeset:
"[BigInt] BigInt.proptotype.toString is broken when radix is
power of 2"
https://bugs.webkit.org/show_bug.cgi?id=190033
https://trac.webkit.org/changeset/236647
2018-09-30 Caio Lima <ticaiolima@gmail.com>
[BigInt] BigInt.proptotype.toString is broken when radix is power of 2
https://bugs.webkit.org/show_bug.cgi?id=190033
Reviewed by Yusuke Suzuki.
* stress/big-int-to-string.js:
2018-09-28 Caio Lima <ticaiolima@gmail.com>
[ESNext][BigInt] Implement support for "&"
https://bugs.webkit.org/show_bug.cgi?id=186228
Reviewed by Yusuke Suzuki.
* stress/big-int-bitwise-and-general.js: Added.
(assert):
(assert.sameValue):
* stress/big-int-bitwise-and-jit.js: Added.
(let.assert.sameValue):
(bigIntBitAnd):
* stress/big-int-bitwise-and-memory-stress.js: Added.
(assert):
* stress/big-int-bitwise-and-to-primitive-precedence.js: Added.
(assert.sameValue):
(let.o.Symbol.toPrimitive):
(catch):
* stress/big-int-bitwise-and-type-error.js: Added.
(assert):
(assertThrowTypeError):
(let.o.valueOf):
(o.valueOf):
(o.toString):
(o.Symbol.toPrimitive):
* stress/big-int-bitwise-and-wrapped-value.js: Added.
(assert.sameValue):
(testBitAnd):
(let.o.Symbol.toPrimitive):
(o.valueOf):
(o.toString):
2018-09-28 Ross Kirsling <ross.kirsling@sony.com>
JSC test stress/jsc-read.js doesn't support CRLF
https://bugs.webkit.org/show_bug.cgi?id=190063
Reviewed by Yusuke Suzuki.
In order to run this test via Windows command prompt, we can't assume that the final newline will be LF.
* stress/jsc-read.js:
(test):
2018-09-27 Saam barati <sbarati@apple.com>
Verify the contents of AssemblerBuffer on arm64e
https://bugs.webkit.org/show_bug.cgi?id=190057
<rdar://problem/38916630>
Reviewed by Mark Lam.
* stress/regress-189132.js:
2018-09-27 Dominik Infuehr <dinfuehr@igalia.com>
Disable test without LLInt on ARMv7
https://bugs.webkit.org/show_bug.cgi?id=190037
Reviewed by Mark Lam.
Test runs out of executable memory on ARMv7, do not run
this test without LLInt enabled.
* stress/regress-169445.js:
2018-09-26 Keith Miller <keith_miller@apple.com>
We should zero unused property storage when rebalancing array storage.
https://bugs.webkit.org/show_bug.cgi?id=188151
Reviewed by Michael Saboff.
* stress/splice-should-zero-property-storage-when-rebalancing.js: Added.
2018-09-20 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[JSC] Optimize Array#lastIndexOf
https://bugs.webkit.org/show_bug.cgi?id=189780
Reviewed by Saam Barati.
* stress/array-lastindexof-array-prototype-trap.js: Added.
(shouldBe):
(AncestorArray.prototype.get 2):
(AncestorArray):
* stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added.
(shouldBe):
* stress/array-lastindexof-hole-nan.js: Added.
(shouldBe):
(throw.new.Error):
* stress/array-lastindexof-infinity.js: Added.
(shouldBe):
(throw.new.Error):
* stress/array-lastindexof-negative-zero.js: Added.
(shouldBe):
(throw.new.Error):
* stress/array-lastindexof-own-getter.js: Added.
(shouldBe):
(throw.new.Error.get array):
(get array):
* stress/array-lastindexof-prototype-trap.js: Added.
(shouldBe):
(DerivedArray.prototype.get 2):
(DerivedArray):
2018-09-25 Saam Barati <sbarati@apple.com>
Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
https://bugs.webkit.org/show_bug.cgi?id=189940
<rdar://problem/43640987>
Reviewed by Mark Lam.
* stress/use-baseline-codeblock-materialize-osr-exit.js: Added.
2018-09-24 Saam Barati <sbarati@apple.com>
Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects
https://bugs.webkit.org/show_bug.cgi?id=189922
<rdar://problem/44651275>
Reviewed by Mark Lam.
* stress/array-indexof-fast-path-effects.js: Added.
* stress/array-indexof-cached-length.js: Added.
2018-09-24 Saam barati <sbarati@apple.com>
ArgumentsEliminationPhase should snip basic blocks after proven OSR exits
https://bugs.webkit.org/show_bug.cgi?id=189682
<rdar://problem/43557315>
Reviewed by Mark Lam.
* stress/arguments-elimination-will-generate-edge-without-result.js: Added.
(foo):
2018-09-22 Saam barati <sbarati@apple.com>
The sampling should not use Strong<CodeBlock> in its machineLocation field
https://bugs.webkit.org/show_bug.cgi?id=189319
Reviewed by Filip Pizlo.
* stress/sampling-profiler-richards.js: Added.
2018-09-19 Yusuke Suzuki <yusukesuzuki@slowstart.org>
[JSC] Optimize Array#indexOf in C++ runtime
https://bugs.webkit.org/show_bug.cgi?id=189507
Reviewed by Saam Barati.
* stress/array-indexof-array-prototype-trap.js: Added.
(shouldBe):
(AncestorArray.prototype.get 2):
(AncestorArray):
* stress/array-indexof-have-a-bad-time-c-runtime.js: Added.
(shouldBe):
* stress/array-indexof-hole-nan.js: Added.
(shouldBe):
(throw.new.Error):
* stress/array-indexof-infinity.js: Added.
(shouldBe):
(throw.new.Error):
* stress/array-indexof-negative-zero.js: Added.
(shouldBe):
(throw.new.Error):
* stress/array-indexof-own-getter.js: Added.
(shouldBe):
(throw.new.Error.get array):
(get array):
* stress/array-indexof-prototype-trap.js: Added.
(shouldBe):
(DerivedArray.prototype.get 2):
(DerivedArray):
2018-09-19 Saam barati <sbarati@apple.com>
AI rule for MultiPutByOffset executes its effects in the wrong order
https://bugs.webkit.org/show_bug.cgi?id=189757
<rdar://problem/43535257>
Reviewed by Michael Saboff.
* stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
(foo):
(Foo):
(g):
2018-09-17 Mark Lam <mark.lam@apple.com>
Ensure that ForInContexts are invalidated if their loop local is over-written.
https://bugs.webkit.org/show_bug.cgi?id=189571
<rdar://problem/44402277>
Reviewed by Saam Barati.
* stress/regress-189571.js: Added.
2018-09-17 Saam barati <sbarati@apple.com>
We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
https://bugs.webkit.org/show_bug.cgi?id=189676
<rdar://problem/39682897>
Reviewed by Michael Saboff.
* typeProfiler/check-structure-or-empty-in-fixup.js: Added.
(A):
(K):
(i.catch):
2018-09-14 Saam barati <sbarati@apple.com>
Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
https://bugs.webkit.org/show_bug.cgi?id=189628
<rdar://problem/39481690>
Reviewed by Mark Lam.
* stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
(foo):
2018-09-11 Mark Lam <mark.lam@apple.com>
Test for array initialization in arrayProtoFuncSplice.
https://bugs.webkit.org/show_bug.cgi?id=170253
<rdar://problem/31328773>
Rubber-stamped by Saam Barati.
* stress/regress-170253.js: Added.
2018-09-11 Mark Lam <mark.lam@apple.com>
Test for IntlObject initialization.
https://bugs.webkit.org/show_bug.cgi?id=170251
<rdar://problem/31328419>
Rubber-stamped by Saam Barati.
* stress/regress-170251.js: Added.
2018-09-11 Mark Lam <mark.lam@apple.com>
Test for array memcpy'ing when JSGlobalObject::haveABadTime.
https://bugs.webkit.org/show_bug.cgi?id=169889
<rdar://problem/31155607>
Reviewed by Saam Barati.
* stress/regress-169889-array-concat.js: Added.
* stress/regress-169889-array-concat1.js: Added.
* stress/regress-169889-array-slice.js: Added.
2018-09-11 Mark Lam <mark.lam@apple.com>
Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope.
https://bugs.webkit.org/show_bug.cgi?id=169445
<rdar://problem/30957435>
Reviewed by Saam Barati.
* stress/regress-169445.js: Added.
(let.gun.eval.A):
(let.gun.eval.B.C):
(let.gun.eval.B.C.prototype.trigger):
(let.gun.eval.B.C.prototype.triggerWithRestParameters):
(let.gun.eval.B):
(let.gun.eval):
== Rolled over to ChangeLog-2018-09-11 ==