2018-12-13  Mark Lam  <mark.lam@apple.com>

        Add a missing exception check.
        https://bugs.webkit.org/show_bug.cgi?id=192626
        <rdar://problem/46662163>

        Reviewed by Keith Miller.

        * stress/regress-192626.js: Added.

2018-12-13  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] Add ValueDiv into DFG
        https://bugs.webkit.org/show_bug.cgi?id=186178

        Reviewed by Yusuke Suzuki.

        * stress/big-int-div-jit-osr.js: Added.
        * stress/big-int-div-jit-untyped.js: Added.
        * stress/value-div-fixup-int32-big-int.js: Added.

2018-12-10  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] Optimize Object.keys by caching own keys results in StructureRareData
        https://bugs.webkit.org/show_bug.cgi?id=190047

        Reviewed by Keith Miller.

        * stress/object-keys-cached-zero.js: Added.
        (shouldBe):
        (test):
        * stress/object-keys-changed-attribute.js: Added.
        (shouldBe):
        (test):
        * stress/object-keys-changed-index.js: Added.
        (shouldBe):
        (test):
        * stress/object-keys-changed.js: Added.
        (shouldBe):
        (test):
        * stress/object-keys-indexed-non-cache.js: Added.
        (shouldBe):
        (test):
        * stress/object-keys-overrides-get-property-names.js: Added.
        (shouldBe):
        (test):
        (noInline):

2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [DFG][FTL] Add NewSymbol
        https://bugs.webkit.org/show_bug.cgi?id=192620

        Reviewed by Saam Barati.

        * microbenchmarks/symbol-creation.js: Added.
        (test):
        * stress/symbol-description-identity.js: Added.
        (shouldBe):
        (test):
        * stress/symbol-identity.js: Added.
        (shouldBe):
        (test):
        * stress/symbol-with-description-throw-error.js: Added.
        (shouldBe):
        (shouldThrow):
        (test):
        (object.toString):

2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [BigInt] Implement DFG/FTL typeof for BigInt
        https://bugs.webkit.org/show_bug.cgi?id=192619

        Reviewed by Keith Miller.

        * stress/big-int-boolean-proven-type.js: Added.
        (assert):
        (bool):
        * stress/big-int-type-of-proven-type-non-constant-including-symbol.js: Added.
        (assert):
        (typeOf):
        (i.switch):
        * stress/big-int-type-of-proven-type-non-constant.js: Added.
        (assert):
        (typeOf):
        * stress/big-int-type-of.js:
        (typeOf):
        (func):

2018-12-10  Mark Lam  <mark.lam@apple.com>

        PropertyAttribute needs a CustomValue bit.
        https://bugs.webkit.org/show_bug.cgi?id=191993
        <rdar://problem/46264467>

        Reviewed by Saam Barati.

        * stress/regress-191993.js: Added.

2018-12-10  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] Add ValueMul into DFG
        https://bugs.webkit.org/show_bug.cgi?id=186175

        Reviewed by Yusuke Suzuki.

        * stress/big-int-mul-jit-osr.js: Added.
        * stress/big-int-mul-jit-untyped.js: Added.
        * stress/value-mul-fixup-int32-big-int.js: Added.

2018-12-06  Keith Miller  <keith_miller@apple.com>

        stress/big-wasm-memory tests failing on 32-bit JSC bot
        https://bugs.webkit.org/show_bug.cgi?id=192020

        Reviewed by Saam Barati.

        Not every platform has WebAssembly, e.g. 32-bit, so we should exit
        the wasm stress tests if the WebAssembly object does not exist.

        * stress/big-wasm-memory-grow-no-max.js:
        (test.foo):
        (test):
        (foo): Deleted.
        (catch): Deleted.
        * stress/big-wasm-memory-grow.js:
        (test.foo):
        (test):
        (foo): Deleted.
        (catch): Deleted.
        * stress/big-wasm-memory.js:
        (test.foo):
        (test):
        (foo): Deleted.
        (catch): Deleted.

2018-12-05  Mark Lam  <mark.lam@apple.com>

        speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
        https://bugs.webkit.org/show_bug.cgi?id=192441
        <rdar://problem/46480355>

        Reviewed by Saam Barati.

        * stress/regress-192441.js: Added.

2018-12-04  Mark Lam  <mark.lam@apple.com>

        DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility.
        https://bugs.webkit.org/show_bug.cgi?id=192386
        <rdar://problem/46445516>

        Reviewed by Saam Barati.

        * stress/regress-192386.js: Added.

2018-12-04  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Support logic operations
        https://bugs.webkit.org/show_bug.cgi?id=179903

        Reviewed by Yusuke Suzuki.

        * stress/big-int-branch-usage.js: Added.
        * stress/big-int-logical-and.js: Added.
        * stress/big-int-logical-not.js: Added.
        * stress/big-int-logical-or.js: Added.

2018-12-03  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r238833.

        Breaks macOS and iOS debug builds.

        Reverted changeset:

        "[ESNext][BigInt] Support logic operations"
        https://bugs.webkit.org/show_bug.cgi?id=179903
        https://trac.webkit.org/changeset/238833

2018-12-03  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Support logic operations
        https://bugs.webkit.org/show_bug.cgi?id=179903

        Reviewed by Yusuke Suzuki.

        * stress/big-int-branch-usage.js: Added.
        * stress/big-int-logical-and.js: Added.
        * stress/big-int-logical-not.js: Added.
        * stress/big-int-logical-or.js: Added.

2018-12-02  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Implement support for "<<" and ">>"
        https://bugs.webkit.org/show_bug.cgi?id=186233

        Reviewed by Yusuke Suzuki.

        * stress/big-int-left-shift-general.js: Added.
        * stress/big-int-left-shift-range-error.js: Added.
        * stress/big-int-left-shift-type-error.js: Added.
        * stress/big-int-left-shift-wrapped-value.js: Added.
        * stress/big-int-right-shift-general.js: Added.
        * stress/big-int-right-shift-type-error.js: Added.
        * stress/big-int-right-shift-wrapped-value.js: Added.
        * stress/left-shift-to-primitive-precedence.js: Added.
        * stress/right-shift-to-primitive-precedence.js: Added.

2018-11-30  Dean Jackson  <dino@apple.com>

        Add first-class support for .mjs files in jsc binary
        https://bugs.webkit.org/show_bug.cgi?id=192190
        <rdar://problem/46375715>

        Reviewed by Keith Miller.

        * stress/simple-module.mjs: Added.
        * stress/simple-script.js: Added.

2018-11-30  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] Implement ValueBitXor into DFG
        https://bugs.webkit.org/show_bug.cgi?id=190264

        Reviewed by Yusuke Suzuki.

        * stress/big-int-bitwise-xor-jit.js: Added.
        * stress/big-int-bitwise-xor-memory-stress.js: Added.
        * stress/big-int-bitwise-xor-untyped.js: Added.

2018-11-27  Saam barati  <sbarati@apple.com>

        r238510 broke scopes of size zero
        https://bugs.webkit.org/show_bug.cgi?id=192033
        <rdar://problem/46281734>

        Reviewed by Keith Miller.

        * stress/r238510-bad-loop.js: Added.
        (foo):

2018-11-27  Mark Lam  <mark.lam@apple.com>

        [Re-landing] NaNs read from Wasm code needs to be be purified.
        https://bugs.webkit.org/show_bug.cgi?id=191056
        <rdar://problem/45660341>

        Reviewed by Filip Pizlo.

        * wasm/regress/regress-191056.js: Added.

2018-11-27  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r238509.

        Causes JSC tests to fail on iOS.

        Reverted changeset:

        "NaNs read from Wasm code needs to be be purified."
        https://bugs.webkit.org/show_bug.cgi?id=191056
        https://trac.webkit.org/changeset/238509

2018-11-26  Caio Lima  <ticaiolima@gmail.com>

        Re-introduce op_bitnot
        https://bugs.webkit.org/show_bug.cgi?id=190923

        Reviewed by Yusuke Suzuki.

        * stress/bit-not-must-generate.js: Added.
        * stress/bitwise-not-no-int32.js: Added.

2018-11-26  Saam barati  <sbarati@apple.com>

        InPlaceAbstractState::endBasicBlock rule for SetLocal should filter the value based on the flush format
        https://bugs.webkit.org/show_bug.cgi?id=191956
        <rdar://problem/45665806>

        Reviewed by Yusuke Suzuki.

        * stress/end-basic-block-set-local-should-filter-type.js: Added.
        (bar):
        (foo):

2018-11-26  Saam barati  <sbarati@apple.com>

        Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation
        https://bugs.webkit.org/show_bug.cgi?id=191958
        <rdar://problem/46221877>

        Reviewed by Yusuke Suzuki.

        * stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added.
        (x):
        (foo):

2018-11-26  Mark Lam  <mark.lam@apple.com>

        NaNs read from Wasm code needs to be be purified.
        https://bugs.webkit.org/show_bug.cgi?id=191056
        <rdar://problem/45660341>

        Reviewed by Filip Pizlo.

        * wasm/regress/regress-191056.js: Added.

2018-11-26  Michael Saboff  <msaboff@apple.com>

        32-bit JSC test failure: stress/regexp-compile-oom.js
        https://bugs.webkit.org/show_bug.cgi?id=191375

        Reviewed by Mark Lam.

        Disabled the test for 32 bit platforms.

        * stress/regexp-compile-oom.js:

2018-11-26  Tadeu Zagallo  <tzagallo@apple.com>

        ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
        https://bugs.webkit.org/show_bug.cgi?id=191716
        <rdar://problem/45723878>

        Reviewed by Saam Barati.

        * stress/regress-187373.js: Added.
        (async.fn):

2018-11-21  Saam barati  <sbarati@apple.com>

        DFGSpeculativeJIT should not &= exitOK with mayExit(node)
        https://bugs.webkit.org/show_bug.cgi?id=191897
        <rdar://problem/45871998>

        Reviewed by Mark Lam.

        * stress/exitok-is-not-the-same-as-mayExit.js: Added.
        (bar):
        (foo):

2018-11-21  Saam barati  <sbarati@apple.com>

        Fix assertion in KnownCellUse inside SpeculativeJIT::speculate
        https://bugs.webkit.org/show_bug.cgi?id=191895
        <rdar://problem/46167406>

        Reviewed by Mark Lam.

        * stress/known-cell-use-needs-type-check-assertion.js: Added.
        (foo):
        (bar):

2018-11-21  Mark Lam  <mark.lam@apple.com>

        Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError.
        https://bugs.webkit.org/show_bug.cgi?id=191776
        <rdar://problem/46152851>

        Reviewed by Saam Barati.

        * stress/big-wasm-memory-grow-no-max.js:
        * stress/big-wasm-memory-grow.js:
        * stress/big-wasm-memory.js:
        - updated these to expect an OutOfMemoryError.

        * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: Added.
        (Binary.prototype.emit_u8):
        (Binary.prototype.emit_u32v):
        (Binary.prototype.emit_header):
        (Binary.prototype.emit_section):
        (Binary):
        (WasmModuleBuilder):
        (WasmModuleBuilder.prototype.addMemory):
        (WasmModuleBuilder.prototype.toArray):
        (WasmModuleBuilder.prototype.toBuffer):
        (WasmModuleBuilder.prototype.instantiate):
        (catch):
        * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Added.
        (catch):

2018-11-21  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
        https://bugs.webkit.org/show_bug.cgi?id=190836

        Reviewed by Saam Barati and Yusuke Suzuki.

        * stress/big-int-out-of-memory-tests.js: Added.

2018-11-20  Mark Lam  <mark.lam@apple.com>

        Remove invalid assertion in VMTraps::SignalSender's SignalAction.
        https://bugs.webkit.org/show_bug.cgi?id=191856
        <rdar://problem/46089992>

        Reviewed by Yusuke Suzuki.

        * stress/regress-191856.js: Added.
        - this test is skipped for now until we have a fix for webkit.org/b/191855.

2018-11-21  Dominik Infuehr  <dinfuehr@igalia.com>

        Enable JIT on ARM/Linux
        https://bugs.webkit.org/show_bug.cgi?id=191548

        Reviewed by Yusuke Suzuki.

        Disable test on system with limited memory. Program was killed by
        the OS before the exception was thrown.

        * slowMicrobenchmarks/function-constructor-with-huge-strings.js:

2018-11-20  Saam barati  <sbarati@apple.com>

        Merging an IC variant may lead to the IC status containing overlapping structure sets
        https://bugs.webkit.org/show_bug.cgi?id=191869
        <rdar://problem/45403453>

        Reviewed by Mark Lam.

        * stress/merging-ic-variants-should-bail-if-structures-overlap.js: Added.

2018-11-19  Mark Lam  <mark.lam@apple.com>

        globalFuncImportModule() should return a promise when it clears exceptions.
        https://bugs.webkit.org/show_bug.cgi?id=191792
        <rdar://problem/46090763>

        Reviewed by Michael Saboff.

        * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: Added.

2018-11-19  Guillaume Emont  <guijemont@igalia.com>

        Skip new memory-hungry tests on memory limited devices

        Unreviewed gardening.

        * stress/big-wasm-memory-grow-no-max.js:
        * stress/big-wasm-memory-grow.js:
        * stress/big-wasm-memory.js:

2018-11-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        Unreviewed, rolling in the rest of r237254
        https://bugs.webkit.org/show_bug.cgi?id=190340

        * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
        * stress/function-cache-with-parameters-end-position.js: Added.
        (shouldBe):
        (shouldThrow):
        (i.anonymous):
        * stress/function-constructor-name.js: Added.
        (shouldBe):
        (GeneratorFunction):
        (AsyncFunction.async):
        (AsyncGeneratorFunction.async):
        (anonymous):
        (async.anonymous):
        * test262/expectations.yaml:

2018-11-16  Filip Pizlo  <fpizlo@apple.com>

        All users of ArrayBuffer should agree on the same max size
        https://bugs.webkit.org/show_bug.cgi?id=191771

        Reviewed by Mark Lam.

        * stress/big-wasm-memory-grow-no-max.js: Added.
        (foo):
        (catch):
        * stress/big-wasm-memory-grow.js: Added.
        (foo):
        (catch):
        * stress/big-wasm-memory.js: Added.
        (foo):
        (catch):

2018-11-16  Filip Pizlo  <fpizlo@apple.com>

        Unreviewed, make some more tests not crash my computer by only running on instance of it. These tests do not need to
        run for each JSC config since they're regression tests for runtime bugs.

        * stress/json-stringified-overflow-2.js:
        * stress/json-stringified-overflow.js:

2018-11-16  Filip Pizlo  <fpizlo@apple.com>

        Unreviewed, make some tests not crash my computer by only running on instance of it. These tests do not need to run for each JSC
        config since they're regression tests for runtime bugs.

        * stress/large-unshift-splice.js:
        * stress/regress-185888.js:

2018-11-16  Saam Barati  <sbarati@apple.com>

        KnownCellUse should also have SpecCellCheck as its type filter
        https://bugs.webkit.org/show_bug.cgi?id=191729
        <rdar://problem/45872852>

        Reviewed by Filip Pizlo.

        * stress/known-cell-type-check-should-allow-empty-value-to-flow-through.js: Added.
        (C):

2018-11-16  Tadeu Zagallo  <tzagallo@apple.com>

        Fix assertion failure on BytecodeGenerator::recordOpcode
        https://bugs.webkit.org/show_bug.cgi?id=191724
        <rdar://problem/45724395>

        Reviewed by Saam Barati.

        * stress/regress-187373-2.js: Added.
        (foo):

2018-11-15  Mark Lam  <mark.lam@apple.com>

        RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
        https://bugs.webkit.org/show_bug.cgi?id=191730
        <rdar://problem/46048517>

        Reviewed by Saam Barati.

        * stress/regress-187006.js: Removed.
          - this test is invalid because its sole purpose is to test for the non-spec
            compliant behavior that we just fixed.

        * stress/regress-191730.js: Added.

2018-11-15  Mark Lam  <mark.lam@apple.com>

        RegExp operations should not take fast patch if lastIndex is not numeric.
        https://bugs.webkit.org/show_bug.cgi?id=191731
        <rdar://problem/46017305>

        Reviewed by Saam Barati.

        * stress/regress-191731.js: Added.

2018-11-13  Saam Barati  <sbarati@apple.com>

        TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM
        https://bugs.webkit.org/show_bug.cgi?id=191600

        Reviewed by Mark Lam.

        * stress/type-profiler-log-should-defer-pending-exceptions.js: Added.
        (foo):
        (test):
        (bar):

2018-11-13  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r238132.

        The test added with this change is timing out on Debug JSC
        bots.

        Reverted changeset:

        "[BigInt] JSBigInt::createWithLength should throw when length
        is greater than JSBigInt::maxLength"
        https://bugs.webkit.org/show_bug.cgi?id=190836
        https://trac.webkit.org/changeset/238132

2018-11-13  Mark Lam  <mark.lam@apple.com>

        Add OOM detection to StringPrototype's substituteBackreferences().
        https://bugs.webkit.org/show_bug.cgi?id=191563
        <rdar://problem/45720428>

        Reviewed by Saam Barati.

        * stress/regress-191563.js: Added.

2018-11-13  Mark Lam  <mark.lam@apple.com>

        LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame.
        https://bugs.webkit.org/show_bug.cgi?id=191579
        <rdar://problem/45942472>

        Reviewed by Saam Barati.

        * stress/regress-191579.js: Added.

2018-11-13  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
        https://bugs.webkit.org/show_bug.cgi?id=190836

        Reviewed by Saam Barati.

        * stress/big-int-out-of-memory-tests.js: Added.

2018-11-08  Ross Kirsling  <ross.kirsling@sony.com>

        U+180E is no longer a whitespace character
        https://bugs.webkit.org/show_bug.cgi?id=191415

        Reviewed by Saam Barati.

        * ChakraCore/test/es5/regexSpace.baseline:
        * ChakraCore/test/es6/unicode_whitespace.js:
        Update tests to latest version.
        (See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.)

        * test262.yaml:
        * test262/config.yaml:
        * test262/expectations.yaml:
        Update expectations.

2018-11-07  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] Add support to BigInt into ValueAdd
        https://bugs.webkit.org/show_bug.cgi?id=186177

        Reviewed by Keith Miller.

        * stress/big-int-negate-jit.js:
        * stress/value-add-big-int-and-string.js: Added.
        * stress/value-add-big-int-prediction-propagation.js: Added.
        * stress/value-add-big-int-untyped.js: Added.

2018-11-07  Tadeu Zagallo  <tzagallo@apple.com>

        REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled
        https://bugs.webkit.org/show_bug.cgi?id=191184

        Reviewed by Saam Barati.

        Most tests were failing due to timeouts, since they are too slow to
        run on CLoop. The exceptions are:

        proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop
        dont-crash-on-stack-overflow-when-parsing-builtin.js and
        dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had
        to change the stack size since CLoop requires it to be page aligned.

        * microbenchmarks/array-push-1.js:
        * microbenchmarks/array-push-2.js:
        * microbenchmarks/elidable-new-object-dag.js:
        * microbenchmarks/elidable-new-object-roflcopter.js:
        * microbenchmarks/elidable-new-object-tree.js:
        * microbenchmarks/getter-richards.js:
        * microbenchmarks/sinkable-new-object-dag.js:
        * microbenchmarks/string-concat-long-convert.js:
        * microbenchmarks/typed-array-get-set-by-val-profiling.js:
        * slowMicrobenchmarks/array-push-3.js:
        * slowMicrobenchmarks/large-map-iteration-with-additions.js:
        * slowMicrobenchmarks/spread-small-array.js:
        * slowMicrobenchmarks/undefined-property-access.js:
        * stress/activation-sink-default-value-tdz-error.js:
        * stress/activation-sink-default-value.js:
        * stress/activation-sink-osrexit-default-value-tdz-error.js:
        * stress/activation-sink-osrexit-default-value.js:
        * stress/activation-sink-osrexit.js:
        * stress/activation-sink.js:
        * stress/allow-math-ic-b3-code-duplication.js:
        * stress/array-push-multiple-int32.js:
        * stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js:
        * stress/arrowfunction-lexical-this-activation-sink-osrexit.js:
        * stress/arrowfunction-lexical-this-activation-sink.js:
        * stress/dont-crash-on-stack-overflow-when-parsing-builtin.js:
        * stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js:
        * stress/elide-new-object-dag-then-exit.js:
        * stress/materialize-regexp-cyclic.js:
        * stress/new-regex-inline.js:
        * stress/op_add.js:
        * stress/op_bitand.js:
        * stress/op_bitor.js:
        * stress/op_bitxor.js:
        * stress/op_div-ConstVar.js:
        * stress/op_div-VarConst.js:
        * stress/op_div-VarVar.js:
        * stress/op_lshift-ConstVar.js:
        * stress/op_lshift-VarConst.js:
        * stress/op_lshift-VarVar.js:
        * stress/op_mod-ConstVar.js:
        * stress/op_mod-VarConst.js:
        * stress/op_mod-VarVar.js:
        * stress/op_mul-ConstVar.js:
        * stress/op_mul-VarConst.js:
        * stress/op_mul-VarVar.js:
        * stress/op_rshift-ConstVar.js:
        * stress/op_rshift-VarConst.js:
        * stress/op_rshift-VarVar.js:
        * stress/op_sub-ConstVar.js:
        * stress/op_sub-VarConst.js:
        * stress/op_sub-VarVar.js:
        * stress/op_urshift-ConstVar.js:
        * stress/op_urshift-VarConst.js:
        * stress/op_urshift-VarVar.js:
        * stress/proxy-get-set-correct-receiver.js:
        * stress/regress-179562.js:
        * stress/rest-parameter-many-arguments.js:
        * stress/sampling-profiler-richards.js:
        * stress/splay-flash-access-1ms.js:
        * stress/tailCallForwardArguments.js:
        * stress/typed-array-get-by-val-profiling.js:
        * typeProfiler/getter-richards.js:

2018-11-06  Michael Saboff  <msaboff@apple.com>

        Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.
        https://bugs.webkit.org/show_bug.cgi?id=191271

        Reviewed by Saam Barati.

        Added more test cases and made all test cases run with the same deeply recursive stack
        instead of finding that same point for each test case.

        * stress/regexp-compile-oom.js:
        (prototype.runTest):
        (recurseAndTest):
        (testList.push.new.TestAndExpectedException):

2018-11-05  Michael Saboff  <msaboff@apple.com>

        Unreviewed build fix for linux.

        * stress/regexp-compile-oom.js: Disabled for non-darwin OSes.

2018-11-02  Michael Saboff  <msaboff@apple.com>

        Rolling in r237753 with unreviewed build fix.

        Fixed issues with DECLARE_THROW_SCOPE placement.

2018-11-02  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r237753.

        Introduced JSC test failures

        Reverted changeset:

        "Running out of stack space not properly handled in
        RegExp::compile() and its callers"
        https://bugs.webkit.org/show_bug.cgi?id=191206
        https://trac.webkit.org/changeset/237753

2018-11-02  Michael Saboff  <msaboff@apple.com>

        Running out of stack space not properly handled in RegExp::compile() and its callers
        https://bugs.webkit.org/show_bug.cgi?id=191206

        Reviewed by Filip Pizlo.

        New regression test.

        * stress/regexp-compile-oom.js: Added.
        (recurseAndTest):

2018-11-01  Guillaume Emont  <guijemont@igalia.com>

        Skip tests on arm/mips that time out now we're running on CLoop

        Unreviewed gardening.

        Since the JIT is temporarily disabled on 32-bit platforms, these tests
        time out on the bots and need to be disabled. There's more tests
        disabled on arm because the timeout is longer on the mips bot (as the
        device is slower to start with), so many of the tests don't time out
        there.

        * microbenchmarks/getter-richards.js: disable on arm and mips.
        * stress/op_add.js: disable on arm.
        * stress/op_bitand.js: disable on arm.
        * stress/op_bitor.js: disable on arm.
        * stress/op_bitxor.js: disable on arm.
        * stress/op_lshift-ConstVar.js: disable on arm.
        * stress/op_lshift-VarConst.js: disable on arm.
        * stress/op_lshift-VarVar.js: disable on arm.
        * stress/op_mod-ConstVar.js: disable on arm.
        * stress/op_mod-VarConst.js: disable on arm.
        * stress/op_mod-VarVar.js: disable on arm.
        * stress/op_mul-ConstVar.js: disable on arm.
        * stress/op_mul-VarConst.js: disable on arm.
        * stress/op_mul-VarVar.js: disable on arm.
        * stress/op_rshift-ConstVar.js: disable on arm.
        * stress/op_rshift-VarConst.js: disable on arm.
        * stress/op_rshift-VarVar.js: disable on arm.
        * stress/op_sub-ConstVar.js: disable on arm.
        * stress/op_sub-VarConst.js: disable on arm.
        * stress/op_sub-VarVar.js: disable on arm.
        * stress/op_urshift-ConstVar.js: disable on arm.
        * stress/op_urshift-VarConst.js: disable on arm.
        * stress/op_urshift-VarVar.js: disable on arm.
        * stress/spread-forward-call-varargs-stack-overflow.js: disable on arm.
        * stress/value-to-boolean.js: disable on arm and mips.

2018-10-31  Tadeu Zagallo  <tzagallo@apple.com>

        REGRESSION(r237547): Exception handlers should be aware of wide opcodes
        https://bugs.webkit.org/show_bug.cgi?id=191108
        <rdar://problem/45690700>

        Reviewed by Saam Barati.

        * stress/wide-op_catch.js: Added.
        (catch):

2018-10-29  Mark Lam  <mark.lam@apple.com>

        Correctly detect string overflow when using the 'Function' constructor.
        https://bugs.webkit.org/show_bug.cgi?id=184883
        <rdar://problem/36320331>

        Reviewed by Saam Barati.

        I've verified that this passes on 32-bit as well.

        * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.

2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>

        Add support for GetStack FlushedDouble
        https://bugs.webkit.org/show_bug.cgi?id=191012
        <rdar://problem/45265141>

        Reviewed by Saam Barati.

        * stress/get-stack-double.js: Added.
        (bar):
        (noInline):

2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>

        New bytecode format for JSC
        https://bugs.webkit.org/show_bug.cgi?id=187373
        <rdar://problem/44186758>

        Reviewed by Filip Pizlo.

        Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.

        * stress/maximum-inline-capacity.js: Added.
        (test1):
        (test3.Foo):
        (test3):

2018-10-26  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r237479 and r237484.
        https://bugs.webkit.org/show_bug.cgi?id=190978

        broke JSC on iOS (Requested by tadeuzagallo on #webkit).

        Reverted changesets:

        "New bytecode format for JSC"
        https://bugs.webkit.org/show_bug.cgi?id=187373
        https://trac.webkit.org/changeset/237479

        "Gardening: Build fix after r237479."
        https://bugs.webkit.org/show_bug.cgi?id=187373
        https://trac.webkit.org/changeset/237484

2018-10-26  Tadeu Zagallo  <tzagallo@apple.com>

        New bytecode format for JSC
        https://bugs.webkit.org/show_bug.cgi?id=187373
        <rdar://problem/44186758>

        Reviewed by Filip Pizlo.

        Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.

        * stress/maximum-inline-capacity.js: Added.
        (test1):
        (test3.Foo):
        (test3):

2018-10-26  Mark Lam  <mark.lam@apple.com>

        Fix missing edge cases with JSGlobalObjects having a bad time.
        https://bugs.webkit.org/show_bug.cgi?id=189028
        <rdar://problem/45204939>

        Reviewed by Saam Barati.

        * stress/regress-189028.js: Added.

2018-10-22  Mark Lam  <mark.lam@apple.com>

        DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
        https://bugs.webkit.org/show_bug.cgi?id=190515
        <rdar://problem/45222379>

        Rubber-stamped by Saam Barati.

        Adding another test.

        * stress/regress-190515-2.js: Added.

2018-10-22  Mark Lam  <mark.lam@apple.com>

        DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
        https://bugs.webkit.org/show_bug.cgi?id=190515
        <rdar://problem/45222379>

        Reviewed by Saam Barati.

        * stress/regress-190515.js: Added.

2018-10-19  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r237254.
        https://bugs.webkit.org/show_bug.cgi?id=190760

        "It regresses JetStream 2 by 5% on some iOS devices"
        (Requested by saamyjoon on #webkit).

        Reverted changeset:

        "[JSC] JSC should have "parseFunction" to optimize Function
        constructor"
        https://bugs.webkit.org/show_bug.cgi?id=190340
        https://trac.webkit.org/changeset/237254

2018-10-19  Saam Barati  <sbarati@apple.com>

        vmCall should check if we exit before emitting an OSR exit due to exceptions
        https://bugs.webkit.org/show_bug.cgi?id=190740
        <rdar://problem/45220139>

        Reviewed by Mark Lam.

        * stress/dont-emit-osr-exits-for-every-call-ftl.js: Added.
        (foo):

2018-10-19  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Implement support for "^"
        https://bugs.webkit.org/show_bug.cgi?id=186235

        Reviewed by Yusuke Suzuki.

        * stress/big-int-bitwise-xor-general.js: Added.
        * stress/big-int-bitwise-xor-to-primitive-precedence.js: Added.
        * stress/big-int-bitwise-xor-type-error.js: Added.
        * stress/big-int-bitwise-xor-wrapped-value.js: Added.

2018-10-19  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] Add ValueSub into DFG
        https://bugs.webkit.org/show_bug.cgi?id=186176

        Reviewed by Yusuke Suzuki.

        * stress/big-int-subtraction-jit.js:
        * stress/value-sub-big-int-prediction-propagation.js: Added.
        * stress/value-sub-big-int-untyped.js: Added.
        * stress/value-sub-spec-none-case.js: Added.

2018-10-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] JSC should have "parseFunction" to optimize Function constructor
        https://bugs.webkit.org/show_bug.cgi?id=190340

        Reviewed by Mark Lam.

        This patch fixes the line number of syntax errors raised by the Function constructor,
        since we now parse the final code only once. And we no longer use block statement
        for Function constructor's parsing.

        * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
        * stress/function-cache-with-parameters-end-position.js: Added.
        (shouldBe):
        (shouldThrow):
        (i.anonymous):
        * stress/function-constructor-name.js: Added.
        (shouldBe):
        (GeneratorFunction):
        (AsyncFunction.async):
        (AsyncGeneratorFunction.async):
        (anonymous):
        (async.anonymous):
        * test262/expectations.yaml:

2018-10-18  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r237242.
        https://bugs.webkit.org/show_bug.cgi?id=190701

        it breaks "stress/sampling-profiler-basic.js" (Requested by
        caiolima on #webkit).

        Reverted changeset:

        "[BigInt] Add ValueSub into DFG"
        https://bugs.webkit.org/show_bug.cgi?id=186176
        https://trac.webkit.org/changeset/237242

2018-10-17  Keith Miller  <keith_miller@apple.com>

        AI does not clear Phantom allocation nodes.
        https://bugs.webkit.org/show_bug.cgi?id=190694

        Reviewed by Saam Barati.

        * stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added.
        (Day):
        (DaysInYear):
        (TimeInYear):
        (TimeFromYear):
        (DayFromYear):
        (InLeapYear):
        (YearFromTime):
        (WeekDay):
        (DaylightSavingTA):
        (GetSecondSundayInMarch):
        (TimeInMonth):

2018-10-17  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] Add ValueSub into DFG
        https://bugs.webkit.org/show_bug.cgi?id=186176

        Reviewed by Yusuke Suzuki.

        * stress/big-int-subtraction-jit.js:
        * stress/value-sub-big-int-prediction-propagation.js: Added.
        * stress/value-sub-big-int-untyped.js: Added.

2018-10-16  Dominik Infuehr  <dinfuehr@igalia.com>

        [JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips
        https://bugs.webkit.org/show_bug.cgi?id=190611

        Reviewed by Saam Barati.

        Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js
        to improve test runtime. On ARM/MIPS this test even timed out when running all
        tests.

        * stress/array-prototype-concat-of-long-spliced-arrays2.js:
        (test):

2018-10-15  Guillaume Emont  <guijemont@igalia.com>

        Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux

        Unreviewed gardening.

        * stress/array-prototype-concat-of-long-spliced-arrays2.js:

2018-10-15  Saam barati  <sbarati@apple.com>

        Emit fjcvtzs on ARM64E on Darwin
        https://bugs.webkit.org/show_bug.cgi?id=184023

        Reviewed by Yusuke Suzuki and Filip Pizlo.

        * stress/double-to-int32-NaN.js: Added.
        (assert):
        (foo):

2018-10-15  Saam Barati  <sbarati@apple.com>

        JSArray::shiftCountWithArrayStorage is wrong when an array has holes
        https://bugs.webkit.org/show_bug.cgi?id=190262
        <rdar://problem/44986241>

        Reviewed by Mark Lam.

        * stress/array-prototype-concat-of-long-spliced-arrays.js:
        (test):
        * stress/slice-array-storage-with-holes.js: Added.
        (main):

2018-10-15  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r237054.
        https://bugs.webkit.org/show_bug.cgi?id=190593

        "this regressed JetStream 2 by 6% on iOS" (Requested by
        saamyjoon on #webkit).

        Reverted changeset:

        "[JSC] JSC should have "parseFunction" to optimize Function
        constructor"
        https://bugs.webkit.org/show_bug.cgi?id=190340
        https://trac.webkit.org/changeset/237054

2018-10-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] JSON.stringify can accept call-with-no-arguments
        https://bugs.webkit.org/show_bug.cgi?id=190343

        Reviewed by Mark Lam.

        * stress/json-stringify-no-arguments.js: Added.
        (shouldBe):

2018-10-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] JSC should have "parseFunction" to optimize Function constructor
        https://bugs.webkit.org/show_bug.cgi?id=190340

        Reviewed by Mark Lam.

        This patch fixes the line number of syntax errors raised by the Function constructor,
        since we now parse the final code only once. And we no longer use block statement
        for Function constructor's parsing.

        * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
        * stress/function-cache-with-parameters-end-position.js: Added.
        (shouldBe):
        (shouldThrow):
        (i.anonymous):
        * stress/function-constructor-name.js: Added.
        (shouldBe):
        (GeneratorFunction):
        (AsyncFunction.async):
        (AsyncGeneratorFunction.async):
        (anonymous):
        (async.anonymous):
        * test262/expectations.yaml:

2018-10-10  Guillaume Emont  <guijemont@igalia.com>

        Skip JSC test stress/sampling-profiler-richards.js on armv7/linux
        https://bugs.webkit.org/show_bug.cgi?id=190426

        Unreviewed gardening.

        * stress/sampling-profiler-richards.js:

2018-10-06  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Implement support for "|"
        https://bugs.webkit.org/show_bug.cgi?id=186229

        Reviewed by Yusuke Suzuki.

        * stress/big-int-bitwise-and-jit.js:
        * stress/big-int-bitwise-or-general.js: Added.
        * stress/big-int-bitwise-or-jit-untyped.js: Added.
        * stress/big-int-bitwise-or-jit.js: Added.
        * stress/big-int-bitwise-or-memory-stress.js: Added.
        * stress/big-int-bitwise-or-to-primitive-precedence.js: Added.
        * stress/big-int-bitwise-or-type-error.js: Added.
        * stress/big-int-bitwise-or-wrapped-value.js: Added.

2018-10-05  Dominik Infuehr  <dominik.infuehr@gmail.com>

        Skip test on systems with limited memory
        https://bugs.webkit.org/show_bug.cgi?id=190310

        Invoking runDefault adds test to runlist, skipping the test in the next
        line does not prevent the test from executing. Change order of lines such
        that runDefault is only executed if test is not executed.

        Reviewed by Mark Lam.

        * stress/regress-190187.js:

2018-10-03  Saam barati  <sbarati@apple.com>

        lowXYZ in FTLLower should always filter the type of the incoming edge
        https://bugs.webkit.org/show_bug.cgi?id=189939
        <rdar://problem/44407030>

        Reviewed by Michael Saboff.

        * stress/ftl-should-always-filter-for-low-type-check-functions.js: Added.
        (foo):
        (test):

2018-10-03  Mark Lam  <mark.lam@apple.com>

        Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX.
        https://bugs.webkit.org/show_bug.cgi?id=190187
        <rdar://problem/42512909>

        Reviewed by Michael Saboff.

        * stress/regress-190187.js: Added.

2018-10-02  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
        https://bugs.webkit.org/show_bug.cgi?id=190033

        Reviewed by Yusuke Suzuki.

        * stress/big-int-to-string.js:

2018-10-01  Mark Lam  <mark.lam@apple.com>

        Function.toString() should also copy the source code Functions that are class definitions.
        https://bugs.webkit.org/show_bug.cgi?id=190186
        <rdar://problem/44733360>

        Reviewed by Saam Barati.

        * stress/regress-190186.js: Added.

2018-10-01  Dominik Infuehr  <dinfuehr@igalia.com>

        Split NaN-check into separate test
        https://bugs.webkit.org/show_bug.cgi?id=190010

        Reviewed by Saam Barati.

        DataView exposes NaN-representation, which is not necessarily the same on each
        architecture. Therefore move the check of the NaN-representation into its own
        file such that we can disable this test on MIPS where NaN-representation can be
        different on older CPUs.

        * stress/dataview-jit-set-nan.js: Added.
        (assert):
        (test.storeLittleEndian):
        (test.storeBigEndian):
        (test.store):
        (test):
        * stress/dataview-jit-set.js:
        (test5):

2018-10-01  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r236647.
        https://bugs.webkit.org/show_bug.cgi?id=190124

        Breaking test stress/big-int-to-string.js (Requested by
        caiolima_ on #webkit).

        Reverted changeset:

        "[BigInt] BigInt.proptotype.toString is broken when radix is
        power of 2"
        https://bugs.webkit.org/show_bug.cgi?id=190033
        https://trac.webkit.org/changeset/236647

2018-09-30  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
        https://bugs.webkit.org/show_bug.cgi?id=190033

        Reviewed by Yusuke Suzuki.

        * stress/big-int-to-string.js:

2018-09-28  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Implement support for "&"
        https://bugs.webkit.org/show_bug.cgi?id=186228

        Reviewed by Yusuke Suzuki.

        * stress/big-int-bitwise-and-general.js: Added.
        (assert):
        (assert.sameValue):
        * stress/big-int-bitwise-and-jit.js: Added.
        (let.assert.sameValue):
        (bigIntBitAnd):
        * stress/big-int-bitwise-and-memory-stress.js: Added.
        (assert):
        * stress/big-int-bitwise-and-to-primitive-precedence.js: Added.
        (assert.sameValue):
        (let.o.Symbol.toPrimitive):
        (catch):
        * stress/big-int-bitwise-and-type-error.js: Added.
        (assert):
        (assertThrowTypeError):
        (let.o.valueOf):
        (o.valueOf):
        (o.toString):
        (o.Symbol.toPrimitive):
        * stress/big-int-bitwise-and-wrapped-value.js: Added.
        (assert.sameValue):
        (testBitAnd):
        (let.o.Symbol.toPrimitive):
        (o.valueOf):
        (o.toString):

2018-09-28  Ross Kirsling  <ross.kirsling@sony.com>

        JSC test stress/jsc-read.js doesn't support CRLF
        https://bugs.webkit.org/show_bug.cgi?id=190063

        Reviewed by Yusuke Suzuki.

        In order to run this test via Windows command prompt, we can't assume that the final newline will be LF.

        * stress/jsc-read.js:
        (test):

2018-09-27  Saam barati  <sbarati@apple.com>

        Verify the contents of AssemblerBuffer on arm64e
        https://bugs.webkit.org/show_bug.cgi?id=190057
        <rdar://problem/38916630>

        Reviewed by Mark Lam.

        * stress/regress-189132.js:

2018-09-27  Dominik Infuehr  <dinfuehr@igalia.com>

        Disable test without LLInt on ARMv7
        https://bugs.webkit.org/show_bug.cgi?id=190037

        Reviewed by Mark Lam.

        Test runs out of executable memory on ARMv7, do not run
        this test without LLInt enabled.

        * stress/regress-169445.js:

2018-09-26  Keith Miller  <keith_miller@apple.com>

        We should zero unused property storage when rebalancing array storage.
        https://bugs.webkit.org/show_bug.cgi?id=188151

        Reviewed by Michael Saboff.

        * stress/splice-should-zero-property-storage-when-rebalancing.js: Added.

2018-09-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] Optimize Array#lastIndexOf
        https://bugs.webkit.org/show_bug.cgi?id=189780

        Reviewed by Saam Barati.

        * stress/array-lastindexof-array-prototype-trap.js: Added.
        (shouldBe):
        (AncestorArray.prototype.get 2):
        (AncestorArray):
        * stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added.
        (shouldBe):
        * stress/array-lastindexof-hole-nan.js: Added.
        (shouldBe):
        (throw.new.Error):
        * stress/array-lastindexof-infinity.js: Added.
        (shouldBe):
        (throw.new.Error):
        * stress/array-lastindexof-negative-zero.js: Added.
        (shouldBe):
        (throw.new.Error):
        * stress/array-lastindexof-own-getter.js: Added.
        (shouldBe):
        (throw.new.Error.get array):
        (get array):
        * stress/array-lastindexof-prototype-trap.js: Added.
        (shouldBe):
        (DerivedArray.prototype.get 2):
        (DerivedArray):

2018-09-25  Saam Barati  <sbarati@apple.com>

        Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
        https://bugs.webkit.org/show_bug.cgi?id=189940
        <rdar://problem/43640987>

        Reviewed by Mark Lam.

        * stress/use-baseline-codeblock-materialize-osr-exit.js: Added.

2018-09-24  Saam Barati  <sbarati@apple.com>

        Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects
        https://bugs.webkit.org/show_bug.cgi?id=189922
        <rdar://problem/44651275>

        Reviewed by Mark Lam.

        * stress/array-indexof-fast-path-effects.js: Added.
        * stress/array-indexof-cached-length.js: Added.

2018-09-24  Saam barati  <sbarati@apple.com>

        ArgumentsEliminationPhase should snip basic blocks after proven OSR exits
        https://bugs.webkit.org/show_bug.cgi?id=189682
        <rdar://problem/43557315>

        Reviewed by Mark Lam.

        * stress/arguments-elimination-will-generate-edge-without-result.js: Added.
        (foo):

2018-09-22  Saam barati  <sbarati@apple.com>

        The sampling should not use Strong<CodeBlock> in its machineLocation field
        https://bugs.webkit.org/show_bug.cgi?id=189319

        Reviewed by Filip Pizlo.

        * stress/sampling-profiler-richards.js: Added.

2018-09-19  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] Optimize Array#indexOf in C++ runtime
        https://bugs.webkit.org/show_bug.cgi?id=189507

        Reviewed by Saam Barati.

        * stress/array-indexof-array-prototype-trap.js: Added.
        (shouldBe):
        (AncestorArray.prototype.get 2):
        (AncestorArray):
        * stress/array-indexof-have-a-bad-time-c-runtime.js: Added.
        (shouldBe):
        * stress/array-indexof-hole-nan.js: Added.
        (shouldBe):
        (throw.new.Error):
        * stress/array-indexof-infinity.js: Added.
        (shouldBe):
        (throw.new.Error):
        * stress/array-indexof-negative-zero.js: Added.
        (shouldBe):
        (throw.new.Error):
        * stress/array-indexof-own-getter.js: Added.
        (shouldBe):
        (throw.new.Error.get array):
        (get array):
        * stress/array-indexof-prototype-trap.js: Added.
        (shouldBe):
        (DerivedArray.prototype.get 2):
        (DerivedArray):

2018-09-19  Saam barati  <sbarati@apple.com>

        AI rule for MultiPutByOffset executes its effects in the wrong order
        https://bugs.webkit.org/show_bug.cgi?id=189757
        <rdar://problem/43535257>

        Reviewed by Michael Saboff.

        * stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
        (foo):
        (Foo):
        (g):

2018-09-17  Mark Lam  <mark.lam@apple.com>

        Ensure that ForInContexts are invalidated if their loop local is over-written.
        https://bugs.webkit.org/show_bug.cgi?id=189571
        <rdar://problem/44402277>

        Reviewed by Saam Barati.

        * stress/regress-189571.js: Added.

2018-09-17  Saam barati  <sbarati@apple.com>

        We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
        https://bugs.webkit.org/show_bug.cgi?id=189676
        <rdar://problem/39682897>

        Reviewed by Michael Saboff.

        * typeProfiler/check-structure-or-empty-in-fixup.js: Added.
        (A):
        (K):
        (i.catch):

2018-09-14  Saam barati  <sbarati@apple.com>

        Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
        https://bugs.webkit.org/show_bug.cgi?id=189628
        <rdar://problem/39481690>

        Reviewed by Mark Lam.

        * stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
        (foo):

2018-09-11  Mark Lam  <mark.lam@apple.com>

        Test for array initialization in arrayProtoFuncSplice.
        https://bugs.webkit.org/show_bug.cgi?id=170253
        <rdar://problem/31328773>

        Rubber-stamped by Saam Barati.

        * stress/regress-170253.js: Added.

2018-09-11  Mark Lam  <mark.lam@apple.com>

        Test for IntlObject initialization.
        https://bugs.webkit.org/show_bug.cgi?id=170251
        <rdar://problem/31328419>

        Rubber-stamped by Saam Barati.

        * stress/regress-170251.js: Added.

2018-09-11  Mark Lam  <mark.lam@apple.com>

        Test for array memcpy'ing when JSGlobalObject::haveABadTime.
        https://bugs.webkit.org/show_bug.cgi?id=169889
        <rdar://problem/31155607>

        Reviewed by Saam Barati.

        * stress/regress-169889-array-concat.js: Added.
        * stress/regress-169889-array-concat1.js: Added.
        * stress/regress-169889-array-slice.js: Added.

2018-09-11  Mark Lam  <mark.lam@apple.com>

        Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope.
        https://bugs.webkit.org/show_bug.cgi?id=169445
        <rdar://problem/30957435>

        Reviewed by Saam Barati.

        * stress/regress-169445.js: Added.
        (let.gun.eval.A):
        (let.gun.eval.B.C):
        (let.gun.eval.B.C.prototype.trigger):
        (let.gun.eval.B.C.prototype.triggerWithRestParameters):
        (let.gun.eval.B):
        (let.gun.eval):

== Rolled over to ChangeLog-2018-09-11 ==