| 2018-12-13 Mark Lam <mark.lam@apple.com> |
| |
| Add a missing exception check. |
| https://bugs.webkit.org/show_bug.cgi?id=192626 |
| <rdar://problem/46662163> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/regress-192626.js: Added. |
| |
| 2018-12-13 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] Add ValueDiv into DFG |
| https://bugs.webkit.org/show_bug.cgi?id=186178 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-div-jit-osr.js: Added. |
| * stress/big-int-div-jit-untyped.js: Added. |
| * stress/value-div-fixup-int32-big-int.js: Added. |
| |
| 2018-12-10 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] Optimize Object.keys by caching own keys results in StructureRareData |
| https://bugs.webkit.org/show_bug.cgi?id=190047 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/object-keys-cached-zero.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-keys-changed-attribute.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-keys-changed-index.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-keys-changed.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-keys-indexed-non-cache.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-keys-overrides-get-property-names.js: Added. |
| (shouldBe): |
| (test): |
| (noInline): |
| |
| 2018-12-12 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [DFG][FTL] Add NewSymbol |
| https://bugs.webkit.org/show_bug.cgi?id=192620 |
| |
| Reviewed by Saam Barati. |
| |
| * microbenchmarks/symbol-creation.js: Added. |
| (test): |
| * stress/symbol-description-identity.js: Added. |
| (shouldBe): |
| (test): |
| * stress/symbol-identity.js: Added. |
| (shouldBe): |
| (test): |
| * stress/symbol-with-description-throw-error.js: Added. |
| (shouldBe): |
| (shouldThrow): |
| (test): |
| (object.toString): |
| |
| 2018-12-12 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [BigInt] Implement DFG/FTL typeof for BigInt |
| https://bugs.webkit.org/show_bug.cgi?id=192619 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/big-int-boolean-proven-type.js: Added. |
| (assert): |
| (bool): |
| * stress/big-int-type-of-proven-type-non-constant-including-symbol.js: Added. |
| (assert): |
| (typeOf): |
| (i.switch): |
| * stress/big-int-type-of-proven-type-non-constant.js: Added. |
| (assert): |
| (typeOf): |
| * stress/big-int-type-of.js: |
| (typeOf): |
| (func): |
| |
| 2018-12-10 Mark Lam <mark.lam@apple.com> |
| |
| PropertyAttribute needs a CustomValue bit. |
| https://bugs.webkit.org/show_bug.cgi?id=191993 |
| <rdar://problem/46264467> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-191993.js: Added. |
| |
| 2018-12-10 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] Add ValueMul into DFG |
| https://bugs.webkit.org/show_bug.cgi?id=186175 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-mul-jit-osr.js: Added. |
| * stress/big-int-mul-jit-untyped.js: Added. |
| * stress/value-mul-fixup-int32-big-int.js: Added. |
| |
| 2018-12-06 Keith Miller <keith_miller@apple.com> |
| |
| stress/big-wasm-memory tests failing on 32-bit JSC bot |
| https://bugs.webkit.org/show_bug.cgi?id=192020 |
| |
| Reviewed by Saam Barati. |
| |
| Not every platform has WebAssembly, e.g. 32-bit, so we should exit |
| the wasm stress tests if the WebAssembly object does not exist. |
| |
| * stress/big-wasm-memory-grow-no-max.js: |
| (test.foo): |
| (test): |
| (foo): Deleted. |
| (catch): Deleted. |
| * stress/big-wasm-memory-grow.js: |
| (test.foo): |
| (test): |
| (foo): Deleted. |
| (catch): Deleted. |
| * stress/big-wasm-memory.js: |
| (test.foo): |
| (test): |
| (foo): Deleted. |
| (catch): Deleted. |
| |
| 2018-12-05 Mark Lam <mark.lam@apple.com> |
| |
| speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar. |
| https://bugs.webkit.org/show_bug.cgi?id=192441 |
| <rdar://problem/46480355> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-192441.js: Added. |
| |
| 2018-12-04 Mark Lam <mark.lam@apple.com> |
| |
| DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility. |
| https://bugs.webkit.org/show_bug.cgi?id=192386 |
| <rdar://problem/46445516> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-192386.js: Added. |
| |
| 2018-12-04 Caio Lima <ticaiolima@gmail.com> |
| |
| [ESNext][BigInt] Support logic operations |
| https://bugs.webkit.org/show_bug.cgi?id=179903 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-branch-usage.js: Added. |
| * stress/big-int-logical-and.js: Added. |
| * stress/big-int-logical-not.js: Added. |
| * stress/big-int-logical-or.js: Added. |
| |
| 2018-12-03 Ryan Haddad <ryanhaddad@apple.com> |
| |
| Unreviewed, rolling out r238833. |
| |
| Breaks macOS and iOS debug builds. |
| |
| Reverted changeset: |
| |
| "[ESNext][BigInt] Support logic operations" |
| https://bugs.webkit.org/show_bug.cgi?id=179903 |
| https://trac.webkit.org/changeset/238833 |
| |
| 2018-12-03 Caio Lima <ticaiolima@gmail.com> |
| |
| [ESNext][BigInt] Support logic operations |
| https://bugs.webkit.org/show_bug.cgi?id=179903 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-branch-usage.js: Added. |
| * stress/big-int-logical-and.js: Added. |
| * stress/big-int-logical-not.js: Added. |
| * stress/big-int-logical-or.js: Added. |
| |
| 2018-12-02 Caio Lima <ticaiolima@gmail.com> |
| |
| [ESNext][BigInt] Implement support for "<<" and ">>" |
| https://bugs.webkit.org/show_bug.cgi?id=186233 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-left-shift-general.js: Added. |
| * stress/big-int-left-shift-range-error.js: Added. |
| * stress/big-int-left-shift-type-error.js: Added. |
| * stress/big-int-left-shift-wrapped-value.js: Added. |
| * stress/big-int-right-shift-general.js: Added. |
| * stress/big-int-right-shift-type-error.js: Added. |
| * stress/big-int-right-shift-wrapped-value.js: Added. |
| * stress/left-shift-to-primitive-precedence.js: Added. |
| * stress/right-shift-to-primitive-precedence.js: Added. |
| |
| 2018-11-30 Dean Jackson <dino@apple.com> |
| |
| Add first-class support for .mjs files in jsc binary |
| https://bugs.webkit.org/show_bug.cgi?id=192190 |
| <rdar://problem/46375715> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/simple-module.mjs: Added. |
| * stress/simple-script.js: Added. |
| |
| 2018-11-30 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] Implement ValueBitXor into DFG |
| https://bugs.webkit.org/show_bug.cgi?id=190264 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-bitwise-xor-jit.js: Added. |
| * stress/big-int-bitwise-xor-memory-stress.js: Added. |
| * stress/big-int-bitwise-xor-untyped.js: Added. |
| |
| 2018-11-27 Saam barati <sbarati@apple.com> |
| |
| r238510 broke scopes of size zero |
| https://bugs.webkit.org/show_bug.cgi?id=192033 |
| <rdar://problem/46281734> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/r238510-bad-loop.js: Added. |
| (foo): |
| |
| 2018-11-27 Mark Lam <mark.lam@apple.com> |
| |
| [Re-landing] NaNs read from Wasm code needs to be be purified. |
| https://bugs.webkit.org/show_bug.cgi?id=191056 |
| <rdar://problem/45660341> |
| |
| Reviewed by Filip Pizlo. |
| |
| * wasm/regress/regress-191056.js: Added. |
| |
| 2018-11-27 Ryan Haddad <ryanhaddad@apple.com> |
| |
| Unreviewed, rolling out r238509. |
| |
| Causes JSC tests to fail on iOS. |
| |
| Reverted changeset: |
| |
| "NaNs read from Wasm code needs to be be purified." |
| https://bugs.webkit.org/show_bug.cgi?id=191056 |
| https://trac.webkit.org/changeset/238509 |
| |
| 2018-11-26 Caio Lima <ticaiolima@gmail.com> |
| |
| Re-introduce op_bitnot |
| https://bugs.webkit.org/show_bug.cgi?id=190923 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/bit-not-must-generate.js: Added. |
| * stress/bitwise-not-no-int32.js: Added. |
| |
| 2018-11-26 Saam barati <sbarati@apple.com> |
| |
| InPlaceAbstractState::endBasicBlock rule for SetLocal should filter the value based on the flush format |
| https://bugs.webkit.org/show_bug.cgi?id=191956 |
| <rdar://problem/45665806> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/end-basic-block-set-local-should-filter-type.js: Added. |
| (bar): |
| (foo): |
| |
| 2018-11-26 Saam barati <sbarati@apple.com> |
| |
| Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation |
| https://bugs.webkit.org/show_bug.cgi?id=191958 |
| <rdar://problem/46221877> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added. |
| (x): |
| (foo): |
| |
| 2018-11-26 Mark Lam <mark.lam@apple.com> |
| |
| NaNs read from Wasm code needs to be be purified. |
| https://bugs.webkit.org/show_bug.cgi?id=191056 |
| <rdar://problem/45660341> |
| |
| Reviewed by Filip Pizlo. |
| |
| * wasm/regress/regress-191056.js: Added. |
| |
| 2018-11-26 Michael Saboff <msaboff@apple.com> |
| |
| 32-bit JSC test failure: stress/regexp-compile-oom.js |
| https://bugs.webkit.org/show_bug.cgi?id=191375 |
| |
| Reviewed by Mark Lam. |
| |
| Disabled the test for 32 bit platforms. |
| |
| * stress/regexp-compile-oom.js: |
| |
| 2018-11-26 Tadeu Zagallo <tzagallo@apple.com> |
| |
| ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset) |
| https://bugs.webkit.org/show_bug.cgi?id=191716 |
| <rdar://problem/45723878> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-187373.js: Added. |
| (async.fn): |
| |
| 2018-11-21 Saam barati <sbarati@apple.com> |
| |
| DFGSpeculativeJIT should not &= exitOK with mayExit(node) |
| https://bugs.webkit.org/show_bug.cgi?id=191897 |
| <rdar://problem/45871998> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/exitok-is-not-the-same-as-mayExit.js: Added. |
| (bar): |
| (foo): |
| |
| 2018-11-21 Saam barati <sbarati@apple.com> |
| |
| Fix assertion in KnownCellUse inside SpeculativeJIT::speculate |
| https://bugs.webkit.org/show_bug.cgi?id=191895 |
| <rdar://problem/46167406> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/known-cell-use-needs-type-check-assertion.js: Added. |
| (foo): |
| (bar): |
| |
| 2018-11-21 Mark Lam <mark.lam@apple.com> |
| |
| Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError. |
| https://bugs.webkit.org/show_bug.cgi?id=191776 |
| <rdar://problem/46152851> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/big-wasm-memory-grow-no-max.js: |
| * stress/big-wasm-memory-grow.js: |
| * stress/big-wasm-memory.js: |
| - updated these to expect an OutOfMemoryError. |
| |
| * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: Added. |
| (Binary.prototype.emit_u8): |
| (Binary.prototype.emit_u32v): |
| (Binary.prototype.emit_header): |
| (Binary.prototype.emit_section): |
| (Binary): |
| (WasmModuleBuilder): |
| (WasmModuleBuilder.prototype.addMemory): |
| (WasmModuleBuilder.prototype.toArray): |
| (WasmModuleBuilder.prototype.toBuffer): |
| (WasmModuleBuilder.prototype.instantiate): |
| (catch): |
| * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Added. |
| (catch): |
| |
| 2018-11-21 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength |
| https://bugs.webkit.org/show_bug.cgi?id=190836 |
| |
| Reviewed by Saam Barati and Yusuke Suzuki. |
| |
| * stress/big-int-out-of-memory-tests.js: Added. |
| |
| 2018-11-20 Mark Lam <mark.lam@apple.com> |
| |
| Remove invalid assertion in VMTraps::SignalSender's SignalAction. |
| https://bugs.webkit.org/show_bug.cgi?id=191856 |
| <rdar://problem/46089992> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/regress-191856.js: Added. |
| - this test is skipped for now until we have a fix for webkit.org/b/191855. |
| |
| 2018-11-21 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| Enable JIT on ARM/Linux |
| https://bugs.webkit.org/show_bug.cgi?id=191548 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| Disable test on system with limited memory. Program was killed by |
| the OS before the exception was thrown. |
| |
| * slowMicrobenchmarks/function-constructor-with-huge-strings.js: |
| |
| 2018-11-20 Saam barati <sbarati@apple.com> |
| |
| Merging an IC variant may lead to the IC status containing overlapping structure sets |
| https://bugs.webkit.org/show_bug.cgi?id=191869 |
| <rdar://problem/45403453> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/merging-ic-variants-should-bail-if-structures-overlap.js: Added. |
| |
| 2018-11-19 Mark Lam <mark.lam@apple.com> |
| |
| globalFuncImportModule() should return a promise when it clears exceptions. |
| https://bugs.webkit.org/show_bug.cgi?id=191792 |
| <rdar://problem/46090763> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: Added. |
| |
| 2018-11-19 Guillaume Emont <guijemont@igalia.com> |
| |
| Skip new memory-hungry tests on memory limited devices |
| |
| Unreviewed gardening. |
| |
| * stress/big-wasm-memory-grow-no-max.js: |
| * stress/big-wasm-memory-grow.js: |
| * stress/big-wasm-memory.js: |
| |
| 2018-11-18 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| Unreviewed, rolling in the rest of r237254 |
| https://bugs.webkit.org/show_bug.cgi?id=190340 |
| |
| * ChakraCore/test/Function/FuncBodyES5.baseline-jsc: |
| * stress/function-cache-with-parameters-end-position.js: Added. |
| (shouldBe): |
| (shouldThrow): |
| (i.anonymous): |
| * stress/function-constructor-name.js: Added. |
| (shouldBe): |
| (GeneratorFunction): |
| (AsyncFunction.async): |
| (AsyncGeneratorFunction.async): |
| (anonymous): |
| (async.anonymous): |
| * test262/expectations.yaml: |
| |
| 2018-11-16 Filip Pizlo <fpizlo@apple.com> |
| |
| All users of ArrayBuffer should agree on the same max size |
| https://bugs.webkit.org/show_bug.cgi?id=191771 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/big-wasm-memory-grow-no-max.js: Added. |
| (foo): |
| (catch): |
| * stress/big-wasm-memory-grow.js: Added. |
| (foo): |
| (catch): |
| * stress/big-wasm-memory.js: Added. |
| (foo): |
| (catch): |
| |
| 2018-11-16 Filip Pizlo <fpizlo@apple.com> |
| |
| Unreviewed, make some more tests not crash my computer by only running on instance of it. These tests do not need to |
| run for each JSC config since they're regression tests for runtime bugs. |
| |
| * stress/json-stringified-overflow-2.js: |
| * stress/json-stringified-overflow.js: |
| |
| 2018-11-16 Filip Pizlo <fpizlo@apple.com> |
| |
| Unreviewed, make some tests not crash my computer by only running on instance of it. These tests do not need to run for each JSC |
| config since they're regression tests for runtime bugs. |
| |
| * stress/large-unshift-splice.js: |
| * stress/regress-185888.js: |
| |
| 2018-11-16 Saam Barati <sbarati@apple.com> |
| |
| KnownCellUse should also have SpecCellCheck as its type filter |
| https://bugs.webkit.org/show_bug.cgi?id=191729 |
| <rdar://problem/45872852> |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/known-cell-type-check-should-allow-empty-value-to-flow-through.js: Added. |
| (C): |
| |
| 2018-11-16 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Fix assertion failure on BytecodeGenerator::recordOpcode |
| https://bugs.webkit.org/show_bug.cgi?id=191724 |
| <rdar://problem/45724395> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-187373-2.js: Added. |
| (foo): |
| |
| 2018-11-15 Mark Lam <mark.lam@apple.com> |
| |
| RegExpObject's collectMatches should not be using JSArray::push to fill in its match results. |
| https://bugs.webkit.org/show_bug.cgi?id=191730 |
| <rdar://problem/46048517> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-187006.js: Removed. |
| - this test is invalid because its sole purpose is to test for the non-spec |
| compliant behavior that we just fixed. |
| |
| * stress/regress-191730.js: Added. |
| |
| 2018-11-15 Mark Lam <mark.lam@apple.com> |
| |
| RegExp operations should not take fast patch if lastIndex is not numeric. |
| https://bugs.webkit.org/show_bug.cgi?id=191731 |
| <rdar://problem/46017305> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-191731.js: Added. |
| |
| 2018-11-13 Saam Barati <sbarati@apple.com> |
| |
| TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM |
| https://bugs.webkit.org/show_bug.cgi?id=191600 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/type-profiler-log-should-defer-pending-exceptions.js: Added. |
| (foo): |
| (test): |
| (bar): |
| |
| 2018-11-13 Ryan Haddad <ryanhaddad@apple.com> |
| |
| Unreviewed, rolling out r238132. |
| |
| The test added with this change is timing out on Debug JSC |
| bots. |
| |
| Reverted changeset: |
| |
| "[BigInt] JSBigInt::createWithLength should throw when length |
| is greater than JSBigInt::maxLength" |
| https://bugs.webkit.org/show_bug.cgi?id=190836 |
| https://trac.webkit.org/changeset/238132 |
| |
| 2018-11-13 Mark Lam <mark.lam@apple.com> |
| |
| Add OOM detection to StringPrototype's substituteBackreferences(). |
| https://bugs.webkit.org/show_bug.cgi?id=191563 |
| <rdar://problem/45720428> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-191563.js: Added. |
| |
| 2018-11-13 Mark Lam <mark.lam@apple.com> |
| |
| LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame. |
| https://bugs.webkit.org/show_bug.cgi?id=191579 |
| <rdar://problem/45942472> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-191579.js: Added. |
| |
| 2018-11-13 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength |
| https://bugs.webkit.org/show_bug.cgi?id=190836 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/big-int-out-of-memory-tests.js: Added. |
| |
| 2018-11-08 Ross Kirsling <ross.kirsling@sony.com> |
| |
| U+180E is no longer a whitespace character |
| https://bugs.webkit.org/show_bug.cgi?id=191415 |
| |
| Reviewed by Saam Barati. |
| |
| * ChakraCore/test/es5/regexSpace.baseline: |
| * ChakraCore/test/es6/unicode_whitespace.js: |
| Update tests to latest version. |
| (See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.) |
| |
| * test262.yaml: |
| * test262/config.yaml: |
| * test262/expectations.yaml: |
| Update expectations. |
| |
| 2018-11-07 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] Add support to BigInt into ValueAdd |
| https://bugs.webkit.org/show_bug.cgi?id=186177 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/big-int-negate-jit.js: |
| * stress/value-add-big-int-and-string.js: Added. |
| * stress/value-add-big-int-prediction-propagation.js: Added. |
| * stress/value-add-big-int-untyped.js: Added. |
| |
| 2018-11-07 Tadeu Zagallo <tzagallo@apple.com> |
| |
| REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled |
| https://bugs.webkit.org/show_bug.cgi?id=191184 |
| |
| Reviewed by Saam Barati. |
| |
| Most tests were failing due to timeouts, since they are too slow to |
| run on CLoop. The exceptions are: |
| |
| proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop |
| dont-crash-on-stack-overflow-when-parsing-builtin.js and |
| dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had |
| to change the stack size since CLoop requires it to be page aligned. |
| |
| * microbenchmarks/array-push-1.js: |
| * microbenchmarks/array-push-2.js: |
| * microbenchmarks/elidable-new-object-dag.js: |
| * microbenchmarks/elidable-new-object-roflcopter.js: |
| * microbenchmarks/elidable-new-object-tree.js: |
| * microbenchmarks/getter-richards.js: |
| * microbenchmarks/sinkable-new-object-dag.js: |
| * microbenchmarks/string-concat-long-convert.js: |
| * microbenchmarks/typed-array-get-set-by-val-profiling.js: |
| * slowMicrobenchmarks/array-push-3.js: |
| * slowMicrobenchmarks/large-map-iteration-with-additions.js: |
| * slowMicrobenchmarks/spread-small-array.js: |
| * slowMicrobenchmarks/undefined-property-access.js: |
| * stress/activation-sink-default-value-tdz-error.js: |
| * stress/activation-sink-default-value.js: |
| * stress/activation-sink-osrexit-default-value-tdz-error.js: |
| * stress/activation-sink-osrexit-default-value.js: |
| * stress/activation-sink-osrexit.js: |
| * stress/activation-sink.js: |
| * stress/allow-math-ic-b3-code-duplication.js: |
| * stress/array-push-multiple-int32.js: |
| * stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js: |
| * stress/arrowfunction-lexical-this-activation-sink-osrexit.js: |
| * stress/arrowfunction-lexical-this-activation-sink.js: |
| * stress/dont-crash-on-stack-overflow-when-parsing-builtin.js: |
| * stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js: |
| * stress/elide-new-object-dag-then-exit.js: |
| * stress/materialize-regexp-cyclic.js: |
| * stress/new-regex-inline.js: |
| * stress/op_add.js: |
| * stress/op_bitand.js: |
| * stress/op_bitor.js: |
| * stress/op_bitxor.js: |
| * stress/op_div-ConstVar.js: |
| * stress/op_div-VarConst.js: |
| * stress/op_div-VarVar.js: |
| * stress/op_lshift-ConstVar.js: |
| * stress/op_lshift-VarConst.js: |
| * stress/op_lshift-VarVar.js: |
| * stress/op_mod-ConstVar.js: |
| * stress/op_mod-VarConst.js: |
| * stress/op_mod-VarVar.js: |
| * stress/op_mul-ConstVar.js: |
| * stress/op_mul-VarConst.js: |
| * stress/op_mul-VarVar.js: |
| * stress/op_rshift-ConstVar.js: |
| * stress/op_rshift-VarConst.js: |
| * stress/op_rshift-VarVar.js: |
| * stress/op_sub-ConstVar.js: |
| * stress/op_sub-VarConst.js: |
| * stress/op_sub-VarVar.js: |
| * stress/op_urshift-ConstVar.js: |
| * stress/op_urshift-VarConst.js: |
| * stress/op_urshift-VarVar.js: |
| * stress/proxy-get-set-correct-receiver.js: |
| * stress/regress-179562.js: |
| * stress/rest-parameter-many-arguments.js: |
| * stress/sampling-profiler-richards.js: |
| * stress/splay-flash-access-1ms.js: |
| * stress/tailCallForwardArguments.js: |
| * stress/typed-array-get-by-val-profiling.js: |
| * typeProfiler/getter-richards.js: |
| |
| 2018-11-06 Michael Saboff <msaboff@apple.com> |
| |
| Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers. |
| https://bugs.webkit.org/show_bug.cgi?id=191271 |
| |
| Reviewed by Saam Barati. |
| |
| Added more test cases and made all test cases run with the same deeply recursive stack |
| instead of finding that same point for each test case. |
| |
| * stress/regexp-compile-oom.js: |
| (prototype.runTest): |
| (recurseAndTest): |
| (testList.push.new.TestAndExpectedException): |
| |
| 2018-11-05 Michael Saboff <msaboff@apple.com> |
| |
| Unreviewed build fix for linux. |
| |
| * stress/regexp-compile-oom.js: Disabled for non-darwin OSes. |
| |
| 2018-11-02 Michael Saboff <msaboff@apple.com> |
| |
| Rolling in r237753 with unreviewed build fix. |
| |
| Fixed issues with DECLARE_THROW_SCOPE placement. |
| |
| 2018-11-02 Ryan Haddad <ryanhaddad@apple.com> |
| |
| Unreviewed, rolling out r237753. |
| |
| Introduced JSC test failures |
| |
| Reverted changeset: |
| |
| "Running out of stack space not properly handled in |
| RegExp::compile() and its callers" |
| https://bugs.webkit.org/show_bug.cgi?id=191206 |
| https://trac.webkit.org/changeset/237753 |
| |
| 2018-11-02 Michael Saboff <msaboff@apple.com> |
| |
| Running out of stack space not properly handled in RegExp::compile() and its callers |
| https://bugs.webkit.org/show_bug.cgi?id=191206 |
| |
| Reviewed by Filip Pizlo. |
| |
| New regression test. |
| |
| * stress/regexp-compile-oom.js: Added. |
| (recurseAndTest): |
| |
| 2018-11-01 Guillaume Emont <guijemont@igalia.com> |
| |
| Skip tests on arm/mips that time out now we're running on CLoop |
| |
| Unreviewed gardening. |
| |
| Since the JIT is temporarily disabled on 32-bit platforms, these tests |
| time out on the bots and need to be disabled. There's more tests |
| disabled on arm because the timeout is longer on the mips bot (as the |
| device is slower to start with), so many of the tests don't time out |
| there. |
| |
| * microbenchmarks/getter-richards.js: disable on arm and mips. |
| * stress/op_add.js: disable on arm. |
| * stress/op_bitand.js: disable on arm. |
| * stress/op_bitor.js: disable on arm. |
| * stress/op_bitxor.js: disable on arm. |
| * stress/op_lshift-ConstVar.js: disable on arm. |
| * stress/op_lshift-VarConst.js: disable on arm. |
| * stress/op_lshift-VarVar.js: disable on arm. |
| * stress/op_mod-ConstVar.js: disable on arm. |
| * stress/op_mod-VarConst.js: disable on arm. |
| * stress/op_mod-VarVar.js: disable on arm. |
| * stress/op_mul-ConstVar.js: disable on arm. |
| * stress/op_mul-VarConst.js: disable on arm. |
| * stress/op_mul-VarVar.js: disable on arm. |
| * stress/op_rshift-ConstVar.js: disable on arm. |
| * stress/op_rshift-VarConst.js: disable on arm. |
| * stress/op_rshift-VarVar.js: disable on arm. |
| * stress/op_sub-ConstVar.js: disable on arm. |
| * stress/op_sub-VarConst.js: disable on arm. |
| * stress/op_sub-VarVar.js: disable on arm. |
| * stress/op_urshift-ConstVar.js: disable on arm. |
| * stress/op_urshift-VarConst.js: disable on arm. |
| * stress/op_urshift-VarVar.js: disable on arm. |
| * stress/spread-forward-call-varargs-stack-overflow.js: disable on arm. |
| * stress/value-to-boolean.js: disable on arm and mips. |
| |
| 2018-10-31 Tadeu Zagallo <tzagallo@apple.com> |
| |
| REGRESSION(r237547): Exception handlers should be aware of wide opcodes |
| https://bugs.webkit.org/show_bug.cgi?id=191108 |
| <rdar://problem/45690700> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/wide-op_catch.js: Added. |
| (catch): |
| |
| 2018-10-29 Mark Lam <mark.lam@apple.com> |
| |
| Correctly detect string overflow when using the 'Function' constructor. |
| https://bugs.webkit.org/show_bug.cgi?id=184883 |
| <rdar://problem/36320331> |
| |
| Reviewed by Saam Barati. |
| |
| I've verified that this passes on 32-bit as well. |
| |
| * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added. |
| |
| 2018-10-29 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Add support for GetStack FlushedDouble |
| https://bugs.webkit.org/show_bug.cgi?id=191012 |
| <rdar://problem/45265141> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/get-stack-double.js: Added. |
| (bar): |
| (noInline): |
| |
| 2018-10-29 Tadeu Zagallo <tzagallo@apple.com> |
| |
| New bytecode format for JSC |
| https://bugs.webkit.org/show_bug.cgi?id=187373 |
| <rdar://problem/44186758> |
| |
| Reviewed by Filip Pizlo. |
| |
| Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255. |
| |
| * stress/maximum-inline-capacity.js: Added. |
| (test1): |
| (test3.Foo): |
| (test3): |
| |
| 2018-10-26 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r237479 and r237484. |
| https://bugs.webkit.org/show_bug.cgi?id=190978 |
| |
| broke JSC on iOS (Requested by tadeuzagallo on #webkit). |
| |
| Reverted changesets: |
| |
| "New bytecode format for JSC" |
| https://bugs.webkit.org/show_bug.cgi?id=187373 |
| https://trac.webkit.org/changeset/237479 |
| |
| "Gardening: Build fix after r237479." |
| https://bugs.webkit.org/show_bug.cgi?id=187373 |
| https://trac.webkit.org/changeset/237484 |
| |
| 2018-10-26 Tadeu Zagallo <tzagallo@apple.com> |
| |
| New bytecode format for JSC |
| https://bugs.webkit.org/show_bug.cgi?id=187373 |
| <rdar://problem/44186758> |
| |
| Reviewed by Filip Pizlo. |
| |
| Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255. |
| |
| * stress/maximum-inline-capacity.js: Added. |
| (test1): |
| (test3.Foo): |
| (test3): |
| |
| 2018-10-26 Mark Lam <mark.lam@apple.com> |
| |
| Fix missing edge cases with JSGlobalObjects having a bad time. |
| https://bugs.webkit.org/show_bug.cgi?id=189028 |
| <rdar://problem/45204939> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-189028.js: Added. |
| |
| 2018-10-22 Mark Lam <mark.lam@apple.com> |
| |
| DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType. |
| https://bugs.webkit.org/show_bug.cgi?id=190515 |
| <rdar://problem/45222379> |
| |
| Rubber-stamped by Saam Barati. |
| |
| Adding another test. |
| |
| * stress/regress-190515-2.js: Added. |
| |
| 2018-10-22 Mark Lam <mark.lam@apple.com> |
| |
| DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType. |
| https://bugs.webkit.org/show_bug.cgi?id=190515 |
| <rdar://problem/45222379> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-190515.js: Added. |
| |
| 2018-10-19 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r237254. |
| https://bugs.webkit.org/show_bug.cgi?id=190760 |
| |
| "It regresses JetStream 2 by 5% on some iOS devices" |
| (Requested by saamyjoon on #webkit). |
| |
| Reverted changeset: |
| |
| "[JSC] JSC should have "parseFunction" to optimize Function |
| constructor" |
| https://bugs.webkit.org/show_bug.cgi?id=190340 |
| https://trac.webkit.org/changeset/237254 |
| |
| 2018-10-19 Saam Barati <sbarati@apple.com> |
| |
| vmCall should check if we exit before emitting an OSR exit due to exceptions |
| https://bugs.webkit.org/show_bug.cgi?id=190740 |
| <rdar://problem/45220139> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/dont-emit-osr-exits-for-every-call-ftl.js: Added. |
| (foo): |
| |
| 2018-10-19 Caio Lima <ticaiolima@gmail.com> |
| |
| [ESNext][BigInt] Implement support for "^" |
| https://bugs.webkit.org/show_bug.cgi?id=186235 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-bitwise-xor-general.js: Added. |
| * stress/big-int-bitwise-xor-to-primitive-precedence.js: Added. |
| * stress/big-int-bitwise-xor-type-error.js: Added. |
| * stress/big-int-bitwise-xor-wrapped-value.js: Added. |
| |
| 2018-10-19 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] Add ValueSub into DFG |
| https://bugs.webkit.org/show_bug.cgi?id=186176 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-subtraction-jit.js: |
| * stress/value-sub-big-int-prediction-propagation.js: Added. |
| * stress/value-sub-big-int-untyped.js: Added. |
| * stress/value-sub-spec-none-case.js: Added. |
| |
| 2018-10-18 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] JSC should have "parseFunction" to optimize Function constructor |
| https://bugs.webkit.org/show_bug.cgi?id=190340 |
| |
| Reviewed by Mark Lam. |
| |
| This patch fixes the line number of syntax errors raised by the Function constructor, |
| since we now parse the final code only once. And we no longer use block statement |
| for Function constructor's parsing. |
| |
| * ChakraCore/test/Function/FuncBodyES5.baseline-jsc: |
| * stress/function-cache-with-parameters-end-position.js: Added. |
| (shouldBe): |
| (shouldThrow): |
| (i.anonymous): |
| * stress/function-constructor-name.js: Added. |
| (shouldBe): |
| (GeneratorFunction): |
| (AsyncFunction.async): |
| (AsyncGeneratorFunction.async): |
| (anonymous): |
| (async.anonymous): |
| * test262/expectations.yaml: |
| |
| 2018-10-18 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r237242. |
| https://bugs.webkit.org/show_bug.cgi?id=190701 |
| |
| it breaks "stress/sampling-profiler-basic.js" (Requested by |
| caiolima on #webkit). |
| |
| Reverted changeset: |
| |
| "[BigInt] Add ValueSub into DFG" |
| https://bugs.webkit.org/show_bug.cgi?id=186176 |
| https://trac.webkit.org/changeset/237242 |
| |
| 2018-10-17 Keith Miller <keith_miller@apple.com> |
| |
| AI does not clear Phantom allocation nodes. |
| https://bugs.webkit.org/show_bug.cgi?id=190694 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added. |
| (Day): |
| (DaysInYear): |
| (TimeInYear): |
| (TimeFromYear): |
| (DayFromYear): |
| (InLeapYear): |
| (YearFromTime): |
| (WeekDay): |
| (DaylightSavingTA): |
| (GetSecondSundayInMarch): |
| (TimeInMonth): |
| |
| 2018-10-17 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] Add ValueSub into DFG |
| https://bugs.webkit.org/show_bug.cgi?id=186176 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-subtraction-jit.js: |
| * stress/value-sub-big-int-prediction-propagation.js: Added. |
| * stress/value-sub-big-int-untyped.js: Added. |
| |
| 2018-10-16 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| [JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips |
| https://bugs.webkit.org/show_bug.cgi?id=190611 |
| |
| Reviewed by Saam Barati. |
| |
| Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js |
| to improve test runtime. On ARM/MIPS this test even timed out when running all |
| tests. |
| |
| * stress/array-prototype-concat-of-long-spliced-arrays2.js: |
| (test): |
| |
| 2018-10-15 Guillaume Emont <guijemont@igalia.com> |
| |
| Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux |
| |
| Unreviewed gardening. |
| |
| * stress/array-prototype-concat-of-long-spliced-arrays2.js: |
| |
| 2018-10-15 Saam barati <sbarati@apple.com> |
| |
| Emit fjcvtzs on ARM64E on Darwin |
| https://bugs.webkit.org/show_bug.cgi?id=184023 |
| |
| Reviewed by Yusuke Suzuki and Filip Pizlo. |
| |
| * stress/double-to-int32-NaN.js: Added. |
| (assert): |
| (foo): |
| |
| 2018-10-15 Saam Barati <sbarati@apple.com> |
| |
| JSArray::shiftCountWithArrayStorage is wrong when an array has holes |
| https://bugs.webkit.org/show_bug.cgi?id=190262 |
| <rdar://problem/44986241> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/array-prototype-concat-of-long-spliced-arrays.js: |
| (test): |
| * stress/slice-array-storage-with-holes.js: Added. |
| (main): |
| |
| 2018-10-15 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r237054. |
| https://bugs.webkit.org/show_bug.cgi?id=190593 |
| |
| "this regressed JetStream 2 by 6% on iOS" (Requested by |
| saamyjoon on #webkit). |
| |
| Reverted changeset: |
| |
| "[JSC] JSC should have "parseFunction" to optimize Function |
| constructor" |
| https://bugs.webkit.org/show_bug.cgi?id=190340 |
| https://trac.webkit.org/changeset/237054 |
| |
| 2018-10-13 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] JSON.stringify can accept call-with-no-arguments |
| https://bugs.webkit.org/show_bug.cgi?id=190343 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/json-stringify-no-arguments.js: Added. |
| (shouldBe): |
| |
| 2018-10-08 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] JSC should have "parseFunction" to optimize Function constructor |
| https://bugs.webkit.org/show_bug.cgi?id=190340 |
| |
| Reviewed by Mark Lam. |
| |
| This patch fixes the line number of syntax errors raised by the Function constructor, |
| since we now parse the final code only once. And we no longer use block statement |
| for Function constructor's parsing. |
| |
| * ChakraCore/test/Function/FuncBodyES5.baseline-jsc: |
| * stress/function-cache-with-parameters-end-position.js: Added. |
| (shouldBe): |
| (shouldThrow): |
| (i.anonymous): |
| * stress/function-constructor-name.js: Added. |
| (shouldBe): |
| (GeneratorFunction): |
| (AsyncFunction.async): |
| (AsyncGeneratorFunction.async): |
| (anonymous): |
| (async.anonymous): |
| * test262/expectations.yaml: |
| |
| 2018-10-10 Guillaume Emont <guijemont@igalia.com> |
| |
| Skip JSC test stress/sampling-profiler-richards.js on armv7/linux |
| https://bugs.webkit.org/show_bug.cgi?id=190426 |
| |
| Unreviewed gardening. |
| |
| * stress/sampling-profiler-richards.js: |
| |
| 2018-10-06 Caio Lima <ticaiolima@gmail.com> |
| |
| [ESNext][BigInt] Implement support for "|" |
| https://bugs.webkit.org/show_bug.cgi?id=186229 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-bitwise-and-jit.js: |
| * stress/big-int-bitwise-or-general.js: Added. |
| * stress/big-int-bitwise-or-jit-untyped.js: Added. |
| * stress/big-int-bitwise-or-jit.js: Added. |
| * stress/big-int-bitwise-or-memory-stress.js: Added. |
| * stress/big-int-bitwise-or-to-primitive-precedence.js: Added. |
| * stress/big-int-bitwise-or-type-error.js: Added. |
| * stress/big-int-bitwise-or-wrapped-value.js: Added. |
| |
| 2018-10-05 Dominik Infuehr <dominik.infuehr@gmail.com> |
| |
| Skip test on systems with limited memory |
| https://bugs.webkit.org/show_bug.cgi?id=190310 |
| |
| Invoking runDefault adds test to runlist, skipping the test in the next |
| line does not prevent the test from executing. Change order of lines such |
| that runDefault is only executed if test is not executed. |
| |
| Reviewed by Mark Lam. |
| |
| * stress/regress-190187.js: |
| |
| 2018-10-03 Saam barati <sbarati@apple.com> |
| |
| lowXYZ in FTLLower should always filter the type of the incoming edge |
| https://bugs.webkit.org/show_bug.cgi?id=189939 |
| <rdar://problem/44407030> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/ftl-should-always-filter-for-low-type-check-functions.js: Added. |
| (foo): |
| (test): |
| |
| 2018-10-03 Mark Lam <mark.lam@apple.com> |
| |
| Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX. |
| https://bugs.webkit.org/show_bug.cgi?id=190187 |
| <rdar://problem/42512909> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/regress-190187.js: Added. |
| |
| 2018-10-02 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] BigInt.proptotype.toString is broken when radix is power of 2 |
| https://bugs.webkit.org/show_bug.cgi?id=190033 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-to-string.js: |
| |
| 2018-10-01 Mark Lam <mark.lam@apple.com> |
| |
| Function.toString() should also copy the source code Functions that are class definitions. |
| https://bugs.webkit.org/show_bug.cgi?id=190186 |
| <rdar://problem/44733360> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-190186.js: Added. |
| |
| 2018-10-01 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| Split NaN-check into separate test |
| https://bugs.webkit.org/show_bug.cgi?id=190010 |
| |
| Reviewed by Saam Barati. |
| |
| DataView exposes NaN-representation, which is not necessarily the same on each |
| architecture. Therefore move the check of the NaN-representation into its own |
| file such that we can disable this test on MIPS where NaN-representation can be |
| different on older CPUs. |
| |
| * stress/dataview-jit-set-nan.js: Added. |
| (assert): |
| (test.storeLittleEndian): |
| (test.storeBigEndian): |
| (test.store): |
| (test): |
| * stress/dataview-jit-set.js: |
| (test5): |
| |
| 2018-10-01 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r236647. |
| https://bugs.webkit.org/show_bug.cgi?id=190124 |
| |
| Breaking test stress/big-int-to-string.js (Requested by |
| caiolima_ on #webkit). |
| |
| Reverted changeset: |
| |
| "[BigInt] BigInt.proptotype.toString is broken when radix is |
| power of 2" |
| https://bugs.webkit.org/show_bug.cgi?id=190033 |
| https://trac.webkit.org/changeset/236647 |
| |
| 2018-09-30 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] BigInt.proptotype.toString is broken when radix is power of 2 |
| https://bugs.webkit.org/show_bug.cgi?id=190033 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-to-string.js: |
| |
| 2018-09-28 Caio Lima <ticaiolima@gmail.com> |
| |
| [ESNext][BigInt] Implement support for "&" |
| https://bugs.webkit.org/show_bug.cgi?id=186228 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-bitwise-and-general.js: Added. |
| (assert): |
| (assert.sameValue): |
| * stress/big-int-bitwise-and-jit.js: Added. |
| (let.assert.sameValue): |
| (bigIntBitAnd): |
| * stress/big-int-bitwise-and-memory-stress.js: Added. |
| (assert): |
| * stress/big-int-bitwise-and-to-primitive-precedence.js: Added. |
| (assert.sameValue): |
| (let.o.Symbol.toPrimitive): |
| (catch): |
| * stress/big-int-bitwise-and-type-error.js: Added. |
| (assert): |
| (assertThrowTypeError): |
| (let.o.valueOf): |
| (o.valueOf): |
| (o.toString): |
| (o.Symbol.toPrimitive): |
| * stress/big-int-bitwise-and-wrapped-value.js: Added. |
| (assert.sameValue): |
| (testBitAnd): |
| (let.o.Symbol.toPrimitive): |
| (o.valueOf): |
| (o.toString): |
| |
| 2018-09-28 Ross Kirsling <ross.kirsling@sony.com> |
| |
| JSC test stress/jsc-read.js doesn't support CRLF |
| https://bugs.webkit.org/show_bug.cgi?id=190063 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| In order to run this test via Windows command prompt, we can't assume that the final newline will be LF. |
| |
| * stress/jsc-read.js: |
| (test): |
| |
| 2018-09-27 Saam barati <sbarati@apple.com> |
| |
| Verify the contents of AssemblerBuffer on arm64e |
| https://bugs.webkit.org/show_bug.cgi?id=190057 |
| <rdar://problem/38916630> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/regress-189132.js: |
| |
| 2018-09-27 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| Disable test without LLInt on ARMv7 |
| https://bugs.webkit.org/show_bug.cgi?id=190037 |
| |
| Reviewed by Mark Lam. |
| |
| Test runs out of executable memory on ARMv7, do not run |
| this test without LLInt enabled. |
| |
| * stress/regress-169445.js: |
| |
| 2018-09-26 Keith Miller <keith_miller@apple.com> |
| |
| We should zero unused property storage when rebalancing array storage. |
| https://bugs.webkit.org/show_bug.cgi?id=188151 |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/splice-should-zero-property-storage-when-rebalancing.js: Added. |
| |
| 2018-09-20 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] Optimize Array#lastIndexOf |
| https://bugs.webkit.org/show_bug.cgi?id=189780 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/array-lastindexof-array-prototype-trap.js: Added. |
| (shouldBe): |
| (AncestorArray.prototype.get 2): |
| (AncestorArray): |
| * stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added. |
| (shouldBe): |
| * stress/array-lastindexof-hole-nan.js: Added. |
| (shouldBe): |
| (throw.new.Error): |
| * stress/array-lastindexof-infinity.js: Added. |
| (shouldBe): |
| (throw.new.Error): |
| * stress/array-lastindexof-negative-zero.js: Added. |
| (shouldBe): |
| (throw.new.Error): |
| * stress/array-lastindexof-own-getter.js: Added. |
| (shouldBe): |
| (throw.new.Error.get array): |
| (get array): |
| * stress/array-lastindexof-prototype-trap.js: Added. |
| (shouldBe): |
| (DerivedArray.prototype.get 2): |
| (DerivedArray): |
| |
| 2018-09-25 Saam Barati <sbarati@apple.com> |
| |
| Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock |
| https://bugs.webkit.org/show_bug.cgi?id=189940 |
| <rdar://problem/43640987> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/use-baseline-codeblock-materialize-osr-exit.js: Added. |
| |
| 2018-09-24 Saam Barati <sbarati@apple.com> |
| |
| Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects |
| https://bugs.webkit.org/show_bug.cgi?id=189922 |
| <rdar://problem/44651275> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/array-indexof-fast-path-effects.js: Added. |
| * stress/array-indexof-cached-length.js: Added. |
| |
| 2018-09-24 Saam barati <sbarati@apple.com> |
| |
| ArgumentsEliminationPhase should snip basic blocks after proven OSR exits |
| https://bugs.webkit.org/show_bug.cgi?id=189682 |
| <rdar://problem/43557315> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/arguments-elimination-will-generate-edge-without-result.js: Added. |
| (foo): |
| |
| 2018-09-22 Saam barati <sbarati@apple.com> |
| |
| The sampling should not use Strong<CodeBlock> in its machineLocation field |
| https://bugs.webkit.org/show_bug.cgi?id=189319 |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/sampling-profiler-richards.js: Added. |
| |
| 2018-09-19 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] Optimize Array#indexOf in C++ runtime |
| https://bugs.webkit.org/show_bug.cgi?id=189507 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/array-indexof-array-prototype-trap.js: Added. |
| (shouldBe): |
| (AncestorArray.prototype.get 2): |
| (AncestorArray): |
| * stress/array-indexof-have-a-bad-time-c-runtime.js: Added. |
| (shouldBe): |
| * stress/array-indexof-hole-nan.js: Added. |
| (shouldBe): |
| (throw.new.Error): |
| * stress/array-indexof-infinity.js: Added. |
| (shouldBe): |
| (throw.new.Error): |
| * stress/array-indexof-negative-zero.js: Added. |
| (shouldBe): |
| (throw.new.Error): |
| * stress/array-indexof-own-getter.js: Added. |
| (shouldBe): |
| (throw.new.Error.get array): |
| (get array): |
| * stress/array-indexof-prototype-trap.js: Added. |
| (shouldBe): |
| (DerivedArray.prototype.get 2): |
| (DerivedArray): |
| |
| 2018-09-19 Saam barati <sbarati@apple.com> |
| |
| AI rule for MultiPutByOffset executes its effects in the wrong order |
| https://bugs.webkit.org/show_bug.cgi?id=189757 |
| <rdar://problem/43535257> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added. |
| (foo): |
| (Foo): |
| (g): |
| |
| 2018-09-17 Mark Lam <mark.lam@apple.com> |
| |
| Ensure that ForInContexts are invalidated if their loop local is over-written. |
| https://bugs.webkit.org/show_bug.cgi?id=189571 |
| <rdar://problem/44402277> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-189571.js: Added. |
| |
| 2018-09-17 Saam barati <sbarati@apple.com> |
| |
| We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure |
| https://bugs.webkit.org/show_bug.cgi?id=189676 |
| <rdar://problem/39682897> |
| |
| Reviewed by Michael Saboff. |
| |
| * typeProfiler/check-structure-or-empty-in-fixup.js: Added. |
| (A): |
| (K): |
| (i.catch): |
| |
| 2018-09-14 Saam barati <sbarati@apple.com> |
| |
| Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed |
| https://bugs.webkit.org/show_bug.cgi?id=189628 |
| <rdar://problem/39481690> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added. |
| (foo): |
| |
| 2018-09-11 Mark Lam <mark.lam@apple.com> |
| |
| Test for array initialization in arrayProtoFuncSplice. |
| https://bugs.webkit.org/show_bug.cgi?id=170253 |
| <rdar://problem/31328773> |
| |
| Rubber-stamped by Saam Barati. |
| |
| * stress/regress-170253.js: Added. |
| |
| 2018-09-11 Mark Lam <mark.lam@apple.com> |
| |
| Test for IntlObject initialization. |
| https://bugs.webkit.org/show_bug.cgi?id=170251 |
| <rdar://problem/31328419> |
| |
| Rubber-stamped by Saam Barati. |
| |
| * stress/regress-170251.js: Added. |
| |
| 2018-09-11 Mark Lam <mark.lam@apple.com> |
| |
| Test for array memcpy'ing when JSGlobalObject::haveABadTime. |
| https://bugs.webkit.org/show_bug.cgi?id=169889 |
| <rdar://problem/31155607> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-169889-array-concat.js: Added. |
| * stress/regress-169889-array-concat1.js: Added. |
| * stress/regress-169889-array-slice.js: Added. |
| |
| 2018-09-11 Mark Lam <mark.lam@apple.com> |
| |
| Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope. |
| https://bugs.webkit.org/show_bug.cgi?id=169445 |
| <rdar://problem/30957435> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-169445.js: Added. |
| (let.gun.eval.A): |
| (let.gun.eval.B.C): |
| (let.gun.eval.B.C.prototype.trigger): |
| (let.gun.eval.B.C.prototype.triggerWithRestParameters): |
| (let.gun.eval.B): |
| (let.gun.eval): |
| |
| == Rolled over to ChangeLog-2018-09-11 == |
