| 2020-04-04 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| '\u' should throw an early SyntaxError exception, but instead evaluates to 'u' |
| https://bugs.webkit.org/show_bug.cgi?id=198790 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * mozilla/ecma/Array/15.4.5.1-1.js: |
| * mozilla/ecma/LexicalConventions/7.7.4.js: |
| * test262/expectations.yaml: Mark 4 test cases as passing. |
| |
| 2020-04-04 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Unreviewed, skip stress/typed-array-subarray-can-throw-oom-error.js on memory-limited archs, and mark it slow |
| https://bugs.webkit.org/show_bug.cgi?id=209974 |
| |
| * stress/typed-array-subarray-can-throw-oom-error.js: |
| |
| 2020-04-04 Mark Lam <mark.lam@apple.com> |
| |
| Gardening: skip test for ARMv7 and MIPS to green the bots until the failure can be investigated. |
| https://bugs.webkit.org/show_bug.cgi?id=210003 |
| |
| Not reviewed. |
| |
| * stress/typed-array-subarray-can-throw-oom-error.js: |
| |
| 2020-04-03 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Update test262 to commit 62b8fce38971 |
| https://bugs.webkit.org/show_bug.cgi?id=209979 |
| |
| Reviewed by Ross Kirsling. |
| |
| * .gitattributes: Added. |
| * test262/config.yaml: Skip "logical-assignment-operators" and "Promise.any" features. |
| * test262/expectations.yaml: |
| * test262/harness/*: Updated. |
| * test262/latest-changes-summary.txt: |
| * test262/test/*: Updated. |
| * test262/test262-Revision.txt: |
| |
| 2020-04-03 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] canonicalizeLocaleList should gracefully throw OOM error if input + error message is too large |
| https://bugs.webkit.org/show_bug.cgi?id=209971 |
| <rdar://problem/61258621> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/intl-canonicalize-locale-list-error-oom.js: Added. |
| (shouldThrow): |
| |
| 2020-04-03 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Move Intl tests from LayoutTests to JSTests |
| https://bugs.webkit.org/show_bug.cgi?id=209922 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| Intl doesn't depend on WebCore, so these tests shouldn't be layout tests. |
| (They do, however, require one method to be added to $vm.) |
| |
| Since LayoutTests/js has its own test harness, I've also migrated each test case to use simpler assertions. |
| |
| * stress/array-to-locale-string.js: Removed -- subsumed by the following test. |
| * stress/array-toLocaleString.js: Added. |
| * stress/date-toLocaleString.js: Added. |
| * stress/intl-collator.js: Added. |
| * stress/intl-datetimeformat.js: Added. |
| * stress/intl-default-locale.js: Added. |
| * stress/intl-numberformat-format-to-parts.js: Added. |
| * stress/intl-numberformat.js: Added. |
| * stress/intl-object.js: Added. |
| * stress/intl-pluralrules.js: Added. |
| * stress/number-toLocaleString.js: Added. |
| * stress/string-localeCompare.js: Added. |
| * stress/string-toLocaleLowerCase.js: Added. |
| * stress/string-toLocaleUpperCase.js: Added. |
| |
| 2020-04-03 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] TypedArray#subarray should throw OOM error gracefully |
| https://bugs.webkit.org/show_bug.cgi?id=209974 |
| <rdar://problem/61253901> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/typed-array-subarray-can-throw-oom-error.js: Added. |
| (foo): |
| (canThrow): |
| (bar): |
| (get bar): |
| |
| 2020-04-03 Paulo Matos <pmatos@igalia.com> |
| |
| Re-enable previously skipped arm tests |
| https://bugs.webkit.org/show_bug.cgi?id=209958 |
| |
| Reviewed by Adrian Perez de Castro. |
| |
| In the past year, some arm tests were skipped to keep the bots green. |
| All known issues affecting these tests were fixed and now can be unskipped. |
| |
| * stress/JSArrayBufferView-byteOffset-is-racy-from-compiler-thread.js: |
| * stress/dont-range-based-iterate-vector-that-is-mutated.js: |
| * stress/generator-cell-with-type.js: |
| * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js: |
| * stress/racy-slow-put-cloned-arguments-when-having-a-bad-time.js: |
| * stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js: |
| * stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js: |
| * stress/toctou-having-a-bad-time-new-array.js: |
| |
| 2020-04-03 Paulo Matos <pmatos@igalia.com> |
| |
| stress/ftl-gettypedarrayoffset-wasteful.js times out on arm/linux |
| https://bugs.webkit.org/show_bug.cgi?id=198754 |
| |
| Reviewed by Žan Doberšek. |
| |
| Unskip test. |
| |
| * stress/ftl-gettypedarrayoffset-wasteful.js: |
| |
| 2020-04-02 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| TypedArray's [[DefineOwnProperty]] is incorrect with partial descriptors |
| https://bugs.webkit.org/show_bug.cgi?id=188875 |
| |
| Reviewed by Ross Kirsling. |
| |
| * stress/typedarray-configure-index.js: |
| * test262/expectations.yaml: Mark 10 test cases as passing. |
| |
| 2020-04-01 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Intl.NumberFormat.prototype.format must preserve sign of -0 |
| https://bugs.webkit.org/show_bug.cgi?id=209880 |
| |
| Reviewed by Keith Miller. |
| |
| * test262/config.yaml: |
| This test was skipped as ICU version-dependent, but it shouldn't be. |
| |
| * test262/expectations.yaml: |
| Mark four test cases as passing. |
| |
| 2020-04-01 Justin Michaud <justin@justinmichaud.com> |
| |
| Delete IC incorrectly caches for proxies |
| https://bugs.webkit.org/show_bug.cgi?id=209777 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/delete-property-ic-proxy.js: Added. |
| (obj1.this.foo1): |
| (foo1.foo2): |
| (foo1): |
| (foo2.foo3): |
| (foo2): |
| * stress/delete-property-inline-cache.js: |
| |
| 2020-04-01 Paulo Matos <pmatos@igalia.com> |
| |
| [JSC] Reenable non-cloop LLint, JIT and DFG on 32-bit platforms |
| https://bugs.webkit.org/show_bug.cgi?id=191163 |
| |
| Reviewed by Adrian Perez de Castro. |
| |
| Re-enable tests for 32bits. |
| |
| * stress/op_add.js: |
| * stress/op_bitand.js: |
| * stress/op_bitor.js: |
| * stress/op_bitxor.js: |
| * stress/op_lshift-ConstVar.js: |
| * stress/op_lshift-VarConst.js: |
| * stress/op_lshift-VarVar.js: |
| * stress/op_mod-ConstVar.js: |
| * stress/op_mod-VarConst.js: |
| * stress/op_mod-VarVar.js: |
| * stress/op_mul-ConstVar.js: |
| * stress/op_mul-VarConst.js: |
| * stress/op_mul-VarVar.js: |
| * stress/op_rshift-ConstVar.js: |
| * stress/op_rshift-VarConst.js: |
| * stress/op_rshift-VarVar.js: |
| * stress/op_sub-ConstVar.js: |
| * stress/op_sub-VarConst.js: |
| * stress/op_sub-VarVar.js: |
| * stress/op_urshift-ConstVar.js: |
| * stress/op_urshift-VarConst.js: |
| * stress/op_urshift-VarVar.js: |
| * stress/spread-forward-call-varargs-stack-overflow.js: |
| * stress/value-to-boolean.js: |
| |
| 2020-03-30 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Add support in named capture group identifiers for direct surrogate pairs |
| https://bugs.webkit.org/show_bug.cgi?id=178174 |
| |
| Reviewed by Darin Adler and Michael Saboff. |
| |
| * test262/expectations.yaml: Mark 2 test cases as passing. |
| |
| 2020-03-30 Ross Kirsling <ross.kirsling@sony.com> |
| |
| RegExp.prototype.exec must always access lastIndex |
| https://bugs.webkit.org/show_bug.cgi?id=209375 |
| |
| Reviewed by Saam Barati. |
| |
| * mozilla/ecma_3/RegExp/15.10.6.2-2.js: |
| Sync test with mozilla-central's copy. |
| (https://searchfox.org/mozilla-central/source/js/src/tests/non262/RegExp/15.10.6.2-2.js) |
| |
| * stress/regexp-exec-always-accesses-lastindex.js: Added. |
| |
| * test262/expectations.yaml: |
| Mark eight test cases as passing. |
| |
| 2020-03-30 Caio Lima <ticaiolima@gmail.com> |
| |
| [JSC] Public class field should accept "static" as field name |
| https://bugs.webkit.org/show_bug.cgi?id=209703 |
| |
| Reviewed by Ross Kirsling. |
| |
| * stress/class-fields-with-special-names.js: Added. |
| |
| 2020-03-28 Caio Lima <ticaiolima@gmail.com> |
| |
| stress/test-out-of-memory.js test gaderning |
| https://bugs.webkit.org/show_bug.cgi?id=209701 |
| |
| Unreviewed test gardening. |
| |
| * stress/test-out-of-memory.js: |
| |
| 2020-03-27 Mark Lam <mark.lam@apple.com> |
| |
| Skip stress/test-out-of-memory.js on memory limited devices. |
| https://bugs.webkit.org/show_bug.cgi?id=209690 |
| <rdar://problem/60659198> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/test-out-of-memory.js: |
| |
| 2020-03-27 Paulo Matos <pmatos@igalia.com> |
| |
| Skip new memory test stress/typed-array-oom-in... in memory limited devices |
| https://bugs.webkit.org/show_bug.cgi?id=209661 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/typed-array-oom-in-buffer-accessor.js: |
| |
| 2020-03-27 Paulo Matos <pmatos@igalia.com> |
| |
| Pass hardness for test numberingSystemsForLocale-cached-... through test header |
| https://bugs.webkit.org/show_bug.cgi?id=209476 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| Improvement over change r258190. Instead of creating a new test file |
| duplicating contents where a hardness parameter is different, pass this |
| through the test header using the -e flag to jsc. |
| |
| * stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js: |
| * stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access_memory-limited.js: Removed. |
| |
| 2020-03-26 Michael Saboff <msaboff@apple.com> |
| |
| Refactor YARR Stack Overflow Checks |
| https://bugs.webkit.org/show_bug.cgi?id=209435 |
| rdar://problem/58988252 |
| |
| Reviewed by Mark Lam. |
| |
| Added a new test and removed a now obsolete test. |
| |
| * stress/regexp-compile-oom.js: Removed because the test is no longer valid. |
| Previously when therer where different stack check mechanisims we failed different. |
| This test was based on the different failure modes. With these changes, most of |
| the contain subtests no longer throw as this test expects. |
| * stress/regexp-huge-oom.js: Added. |
| (shouldBe): |
| (shouldThrow): |
| |
| 2020-03-26 Keith Miller <keith_miller@apple.com> |
| |
| TypedArrays should more gracefully handle OOM during slowDownAndWasteMemory |
| https://bugs.webkit.org/show_bug.cgi?id=209611 |
| |
| Reviewed by Tadeu Zagallo. |
| |
| * stress/typed-array-oom-in-buffer-accessor.js: Added. |
| (try.foo): |
| |
| 2020-03-25 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Unreviewed, reimport test262 once more to make bot green. |
| |
| * test262/expectations.yaml: |
| * test262/harness/assert.js: |
| * test262/harness/propertyHelper.js: |
| * test262/latest-changes-summary.txt: |
| * test262/test/built-ins/JSON/stringify/replacer-function-stack-overflow.js: Removed. |
| * test262/test/built-ins/JSON/stringify/value-tojson-stack-overflow.js: Removed. |
| * test262/test/built-ins/NativeErrors/AggregateError/newtarget-is-undefined.js: Added. |
| * test262/test/built-ins/RegExp/prototype/Symbol.replace/poisoned-stdlib.js: |
| * test262/test/harness/assert-samevalue-zeros.js: |
| * test262/test/language/expressions/class/elements/private-field-after-optional-chain.js: Added. |
| * test262/test/language/statements/class/elements/private-field-after-optional-chain.js: Added. |
| * test262/test262-Revision.txt: |
| |
| 2020-03-25 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| RegExp.prototype[@@replace] relies on globals and doesn't perform ToLength |
| https://bugs.webkit.org/show_bug.cgi?id=173867 |
| |
| Reviewed by Ross Kirsling. |
| |
| * test262/expectations.yaml: Mark 4 test cases as passing. |
| |
| 2020-03-25 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Invalid numeric and named references should be early syntax errors |
| https://bugs.webkit.org/show_bug.cgi?id=178175 |
| |
| Reviewed by Ross Kirsling. |
| |
| * test262/expectations.yaml: Mark 44 test cases as passing. |
| |
| 2020-03-25 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| \b escapes inside character classes should be valid in Unicode patterns |
| https://bugs.webkit.org/show_bug.cgi?id=209528 |
| |
| Reviewed by Darin Adler. |
| |
| * test262/expectations.yaml: Mark 2 test cases as passing. |
| |
| 2020-03-24 Tadeu Zagallo <tzagallo@apple.com> |
| |
| LLIntGenerator must link switch jumps to otherwise redundant labels |
| https://bugs.webkit.org/show_bug.cgi?id=209333 |
| <rdar://problem/60827987> |
| |
| Reviewed by Saam Barati. |
| |
| * wasm/stress/terminal-jump-switch-target.js: Added. |
| |
| 2020-03-24 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Update test262 to commit dfc7ecc6785e |
| https://bugs.webkit.org/show_bug.cgi?id=209449 |
| |
| Unreviewed test gardening. |
| |
| * test262/expectations.yaml: |
| * test262/harness/propertyHelper.js: |
| * test262/latest-changes-summary.txt: |
| * test262/test/*: Updated. |
| * test262/test262-Revision.txt: |
| |
| 2020-03-24 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Update test262 to commit 79146e5cf48d |
| https://bugs.webkit.org/show_bug.cgi?id=209449 |
| |
| Reviewed by Keith Miller. |
| |
| * test262/config.yaml: Add 3 tests that timeout. |
| * test262/expectations.yaml: |
| * test262/latest-changes-summary.txt: |
| * test262/test/*: Updated. |
| * test262/test262-Revision.txt: |
| |
| 2020-03-23 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Caller of Delete IC should emit write-barrier onto owner |
| https://bugs.webkit.org/show_bug.cgi?id=209392 |
| <rdar://problem/60683173> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/delete-ic-requires-write-barrier.js: Added. |
| (foo): |
| |
| 2020-03-23 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] DFG OSR exit cannot find StructureStubInfo for put_by_val if CodeBlock is once converved from Baseline to LLInt |
| https://bugs.webkit.org/show_bug.cgi?id=209327 |
| <rdar://problem/60631061> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/osr-exit-attempts-to-find-stubinfo-which-is-cleared-by-previous-baseline-to-llint-conversion.js: Added. |
| (setter): |
| (foo): |
| |
| 2020-03-23 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Catch parameters must not be lexically redeclared |
| https://bugs.webkit.org/show_bug.cgi?id=208976 |
| |
| Reviewed by Keith Miller. |
| |
| * test262/expectations.yaml: |
| Mark four test cases as passing. |
| |
| 2020-03-20 Ross Kirsling <ross.kirsling@sony.com> |
| |
| hasObservableSideEffectsForRegExpSplit doesn't check for @@match override |
| https://bugs.webkit.org/show_bug.cgi?id=209363 |
| |
| Reviewed by Michael Saboff. |
| |
| * test262/expectations.yaml: |
| Mark two test cases as passing. |
| |
| 2020-03-20 Ross Kirsling <ross.kirsling@sony.com> |
| |
| RegExp.prototype[@@replace] doesn't coerce result index to integer |
| https://bugs.webkit.org/show_bug.cgi?id=209323 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * test262/expectations.yaml: |
| Mark six test cases as passing. |
| |
| 2020-03-19 Tomas Popela <tpopela@redhat.com> |
| |
| [JSC][BigEndians] Several JSC stress tests failing |
| https://bugs.webkit.org/show_bug.cgi?id=194007 |
| |
| Reviewed by Michael Catanzaro. |
| |
| Adapt the DataView tests to be able to pass on little endian as well |
| as the big endian hardware. Do so by introducing method that determine |
| the endianess and based on its value it saves the expected results in |
| the right format. |
| |
| * stress/dataview-get-cse.js: |
| (getIsLittleEndian): |
| (adjustForEndianess): |
| (test3.foo): |
| (test3): |
| * stress/dataview-jit-get.js: |
| (getIsLittleEndian): |
| (test1.adjustForEndianess): |
| (test1): |
| (test2.adjustForEndianess): |
| (test2): |
| (test3.adjustForEndianess): |
| (test3): |
| (adjustForEndianessUint32): |
| (test4): |
| (test5): |
| (test6): |
| (test7): |
| (test8): |
| * stress/dataview-jit-neuter.js: |
| (getIsLittleEndian): |
| (adjustForEndianess): |
| (test): |
| (test2): |
| * stress/dataview-jit-set-nan.js: |
| (getIsLittleEndian): |
| (adjustForEndianessFloat32): |
| (test): |
| * stress/dataview-jit-set.js: |
| (getIsLittleEndian): |
| (readHex): |
| (adjustForEndianessUint16): |
| (test): |
| (test2): |
| (adjustForEndianessUint32): |
| (test3): |
| (test4): |
| (adjustForEndianessFloat32): |
| (test5): |
| (adjustForEndianessFloat64): |
| (test6): |
| (isLittleEndian): Deleted. |
| |
| 2020-03-18 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Add a way to mark a rejected promise as handled |
| https://bugs.webkit.org/show_bug.cgi?id=209241 |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/reject-as-handled.js: Added. |
| (shouldBe): |
| (set new): |
| |
| 2020-03-16 Keith Miller <keith_miller@apple.com> |
| |
| JavaScript identifier grammar supports unescaped astral symbols, but JSC doesn’t |
| https://bugs.webkit.org/show_bug.cgi?id=208998 |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/unicode-identifiers-with-surrogate-pairs.js: Added. |
| (let.c.of.chars.eval.foo): |
| (throwsSyntaxError): |
| (let.c.of.continueChars.throwsSyntaxError.foo): |
| |
| 2020-03-13 Saam Barati <sbarati@apple.com> |
| |
| skip wasm/function-tests/grow-memory-cause-gc.js on memory limited devices |
| https://bugs.webkit.org/show_bug.cgi?id=209069 |
| <rdar://problem/59954558> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * wasm/function-tests/grow-memory-cause-gc.js: |
| |
| 2020-03-13 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Bound functions should pass correct NewTarget value |
| https://bugs.webkit.org/show_bug.cgi?id=209057 |
| |
| Reviewed by Keith Miller. |
| |
| * test262/expectations.yaml: Mark 4 test cases as passing. |
| |
| 2020-03-11 Keith Miller <keith_miller@apple.com> |
| |
| Test262-runner should always consider crashes as new failures |
| https://bugs.webkit.org/show_bug.cgi?id=208943 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * test262/expectations.yaml: |
| |
| 2020-03-11 Keith Miller <keith_miller@apple.com> |
| |
| Throws incorrectly a syntax error when declaring a top level catch variable the same as a parameter |
| https://bugs.webkit.org/show_bug.cgi?id=189914 |
| |
| Reviewed by Saam Barati. |
| |
| * ChakraCore/test/es6/globalParamCatchNewTargetSyntaxError.baseline-jsc: |
| * stress/catch-destructuring-shadow-lexical-const-variable-global.js: Added. |
| (catch): |
| * stress/catch-destructuring-shadow-lexical-variable-class.js: Added. |
| (Foo): |
| (Bar): |
| (Baz): |
| * stress/catch-destructuring-shadow-lexical-variable-function.js: Added. |
| (foo): |
| (bar): |
| * stress/catch-destructuring-shadow-lexical-variable-global.js: Added. |
| (catch): |
| * stress/catch-destructuring-shadow-var-global.js: Added. |
| (catch): |
| * test262/expectations.yaml: |
| |
| 2020-03-10 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Re-import test262 to acquire DST fix |
| https://bugs.webkit.org/show_bug.cgi?id=208901 |
| |
| Reviewed by Don Olmstead. |
| |
| * test262/latest-changes-summary.txt: |
| * test262/test/built-ins/AggregateError/newtarget-proto-fallback.js: |
| * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js: |
| * test262/test/built-ins/Array/prototype/indexOf/15.4.4.14-4-4.js: |
| * test262/test/built-ins/Date/parse/without-utc-offset.js: |
| * test262/test262-Revision.txt: |
| |
| 2020-03-10 Paulo Matos <pmatos@igalia.com> |
| |
| JSC 32bits is failing on new test stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js |
| https://bugs.webkit.org/show_bug.cgi?id=206864 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| Add new test to memory limited devices - behaviour is the same as |
| numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js |
| but it creates 25 threads instead of 100. |
| |
| * stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access_memory-limited.js: Added. |
| (let.theCode): |
| |
| 2020-03-09 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| @putByValDirect does not perform [[DefineOwnProperty]] correctly |
| https://bugs.webkit.org/show_bug.cgi?id=208708 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * test262/expectations.yaml: Mark 46 test cases as passing. |
| |
| 2020-03-09 Caio Lima <ticaiolima@gmail.com> |
| |
| Tail calls are broken on ARM_THUMB2 and MIPS |
| https://bugs.webkit.org/show_bug.cgi?id=197797 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/tail-call-with-spilled-registers.js: Added. |
| |
| 2020-03-07 Mark Lam <mark.lam@apple.com> |
| |
| Remove bad assertion in FTLLowerDFGToB3's compileDelBy(). |
| https://bugs.webkit.org/show_bug.cgi?id=208764 |
| <rdar://problem/59940095> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/delete-by-val-with-base-and-subscript-using-same-cell.js: Added. |
| * stress/delete-by-val-with-base-and-subscript-using-same-non-cell.js: Added. |
| |
| 2020-03-06 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Enable public class fields |
| https://bugs.webkit.org/show_bug.cgi?id=208756 |
| |
| Reviewed by Mark Lam. |
| |
| Rename useClassFields to usePublicClassFields to keep separate from usePrivateClassFields once |
| it is implemented. |
| |
| * stress/big-int-as-property-name.js: |
| * stress/class-fields-bytecode-cache.js: |
| * stress/class-fields-computed-to-property-key.js: |
| * stress/class-fields-function-name.js: |
| * stress/class-fields-harmony.js: |
| * stress/class-fields-proxy-define-property.js: |
| * stress/class-fields-stress-instance.js: |
| * stress/class-fields-to-property-key-const-string-ftl.js: |
| * stress/class-fields-to-property-key-const-symbol-ftl.js: |
| * stress/class-fields-to-property-key-slow-object-tostring-ftl.js: |
| * stress/class-fields-to-property-key-slow-object-valueof-ftl.js: |
| * stress/class-fields-to-property-key-string-object-ftl.js: |
| * stress/class-fields-to-property-key-string-or-string-object-ftl.js: |
| * stress/generator-syntax.js: |
| * stress/method-name.js: |
| * test262/config.yaml: |
| |
| 2020-03-06 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| JSON.stringify should call replacer on deleted properties |
| https://bugs.webkit.org/show_bug.cgi?id=208725 |
| |
| Reviewed by Ross Kirsling. |
| |
| * microbenchmarks/json-stringify-many-objects-to-json.js: Added. |
| * microbenchmarks/json-stringify-many-objects.js: Added. |
| * test262/expectations.yaml: Mark 2 test cases as passing. |
| |
| 2020-03-04 Mark Lam <mark.lam@apple.com> |
| |
| Handle an out of memory error while constructing the BytecodeGenerator. |
| https://bugs.webkit.org/show_bug.cgi?id=208622 |
| <rdar://problem/59341136> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/out-of-memory-while-constructing-BytecodeGenerator.js: Added. |
| |
| 2020-03-03 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] @hasOwnLengthProperty returns wrong value if "length" is attempted to be modified |
| https://bugs.webkit.org/show_bug.cgi?id=208497 |
| <rdar://problem/59913544> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/function-length-update.js: Added. |
| (shouldBe): |
| (userFunction): |
| (userFunction2): |
| |
| 2020-03-02 Saam Barati <sbarati@apple.com> |
| |
| Don't skip tests unnecessarily on arm64 |
| https://bugs.webkit.org/show_bug.cgi?id=208470 |
| <rdar://problem/59968869> |
| |
| Reviewed by Tadeu Zagallo. |
| |
| * microbenchmarks/bit-test-constant.js: |
| * microbenchmarks/bit-test-nonconstant.js: |
| * microbenchmarks/memcpy-typed-loop-large.js: |
| * microbenchmarks/memcpy-typed-loop-small.js: |
| * microbenchmarks/mul-immediate-sub.js: |
| * stress/dont-range-based-iterate-vector-that-is-mutated.js: |
| * stress/dont-reserve-huge-capacity-lexer.js: |
| * stress/new-largeish-contiguous-array-with-size.js: |
| * stress/sampling-profiler-richards.js: |
| * typeProfiler/deltablue-for-of.js: |
| * typeProfiler/getter-richards.js: |
| * wasm/regress/llint-callee-saves-with-fast-memory.js: |
| |
| 2020-03-02 Justin Michaud <justin_michaud@apple.com> |
| |
| Delete by val caching does not keep the subscript alive |
| https://bugs.webkit.org/show_bug.cgi?id=208393 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/delete-property-ic-stress.js: Added. |
| |
| 2020-02-27 Justin Michaud <justin_michaud@apple.com> |
| |
| Poly proto should work with property delete transitions |
| https://bugs.webkit.org/show_bug.cgi?id=208261 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/delete-property-poly-proto.js: Added. |
| (A.prototype.set x): |
| (A): |
| (B): |
| |
| 2020-02-27 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Update test262 (2020.02.26) |
| https://bugs.webkit.org/show_bug.cgi?id=208280 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * test262/config.yaml: |
| * test262/expectations.yaml: |
| * test262/harness/async-gc.js: |
| * test262/latest-changes-summary.txt: |
| * test262/test/: |
| * test262/test262-Revision.txt: |
| |
| 2020-02-26 Caio Lima <ticaiolima@gmail.com> |
| |
| [JSC][MIPS] Adding support to Checkpoints |
| https://bugs.webkit.org/show_bug.cgi?id=208196 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * microbenchmarks/memcpy-typed-loop.js: |
| |
| 2020-02-25 Justin Michaud <justin_michaud@apple.com> |
| |
| Inline Cache delete by id/val |
| https://bugs.webkit.org/show_bug.cgi?id=207522 |
| |
| Reviewed by Keith Miller and Filip Pizlo. |
| |
| * microbenchmarks/delete-property-from-prototype-chain.js: |
| (delete.C.prototype.z): |
| * microbenchmarks/delete-property-inline-cache-polymorphic.js: Added. |
| (C): |
| (noInline.C.foo): |
| (noInline.foo.F): |
| (noInline.F): |
| * microbenchmarks/delete-property-inline-cache.js: Added. |
| (C): |
| (noInline.C.D): |
| (noInline.D.foo): |
| (noInline.foo.E): |
| (noInline.E.F): |
| (noInline.F): |
| * microbenchmarks/delete-property-keeps-cacheable-structure.js: |
| * stress/delete-property-check-structure-transition.js: |
| (sd): Deleted. |
| (testDeleteIsNotUncacheable): Deleted. |
| (): Deleted. |
| (testCanFlatten): Deleted. |
| (testDeleteWithInlineCache.Object.prototype.globalProperty.42.makeFoo): Deleted. |
| (testDeleteWithInlineCache.noInline.doTest): Deleted. |
| (testDeleteWithInlineCache): Deleted. |
| * stress/delete-property-inline-cache.js: Added. |
| (assert): |
| (assert_eq): |
| (assert_neq): |
| (assert_throws): |
| (noInline.assert.noInline.assert_eq.noInline.assert_neq.noInline.assert_throws.testCacheableDeleteById.makeFoo): |
| (noInline.assert.noInline.assert_eq.noInline.assert_neq.noInline.assert_throws.testCacheableDeleteById): |
| (noInline.testCacheableDeleteById.testCacheableDeleteByVal.makeFoo2): |
| (noInline.testCacheableDeleteById.testCacheableDeleteByVal): |
| (noInline.testCacheableDeleteByVal.testCacheableEmptyDeleteById.makeFoo3): |
| (noInline.testCacheableDeleteByVal.testCacheableEmptyDeleteById): |
| (noInline.testCacheableEmptyDeleteById.testCacheableDeleteByIdMiss.makeFoo4): |
| (noInline.testCacheableEmptyDeleteById.testCacheableDeleteByIdMiss): |
| (noInline.testCacheableDeleteByIdMiss.testDeleteIndex.makeFoo5): |
| (noInline.testCacheableDeleteByIdMiss.testDeleteIndex): |
| (noInline.testDeleteIndex.testPolymorphicDelByVal.makeFoo6): |
| (noInline.testDeleteIndex.testPolymorphicDelByVal): |
| (noInline.testPolymorphicDelByVal.testBigintDeleteByVal.makeFoo7): |
| (noInline.testPolymorphicDelByVal.testBigintDeleteByVal): |
| (noInline.testBigintDeleteByVal.testSymbolDeleteByVal.makeFoo8): |
| (noInline.testBigintDeleteByVal.testSymbolDeleteByVal): |
| (noInline.testSymbolDeleteByVal.testObjDeleteByVal.makeFoo9): |
| (noInline.testSymbolDeleteByVal.testObjDeleteByVal): |
| (noInline.testObjDeleteByVal.testStrict.makeFoo10): |
| (noInline.testObjDeleteByVal.testStrict): |
| (noInline.testStrict.testOverride.arr.j): |
| (noInline.testStrict.testOverride): |
| (noInline.testOverride.testNonObject.deleteIt): |
| (noInline.testOverride.testNonObject): |
| (noInline.testNonObject.testNonObjectStrict.deleteIt): |
| (noInline.testNonObject.testNonObjectStrict): |
| (noInline.testNonObjectStrict.testExceptionUnwind.mutateThem): |
| (noInline.testNonObjectStrict.testExceptionUnwind.noInline.deleteIt): |
| (noInline.testNonObjectStrict.testExceptionUnwind): |
| (noInline.testExceptionUnwind.testTDZ): |
| (noInline.testTDZ): |
| |
| 2020-02-19 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Computed Properties with increment sometimes produces incorrect results |
| https://bugs.webkit.org/show_bug.cgi?id=170934 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/computed-property-increment.js: Added. |
| * test262/expectations.yaml: Mark two test cases as passing. |
| |
| 2020-02-19 Keith Miller <keith_miller@apple.com> |
| |
| Disable Wasm reference types by default |
| https://bugs.webkit.org/show_bug.cgi?id=207952 |
| |
| Reviewed by Mark Lam. |
| |
| * wasm/stress/immutable-globals.js: |
| * wasm/stress/local-ref.js: |
| * wasm/stress/mutable-globals.js: |
| |
| 2020-02-18 Ross Kirsling <ross.kirsling@sony.com> |
| |
| [JSC] Computed function properties compute their keys twice |
| https://bugs.webkit.org/show_bug.cgi?id=207297 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/computed-property-key-side-effects.js: Added. |
| * test262/expectations.yaml: Mark 6 test cases as passing. |
| |
| 2020-02-17 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] JITThunk should be HashSet<Weak<NativeExecutable>> with appropriate GC weakness handling |
| https://bugs.webkit.org/show_bug.cgi?id=207715 |
| |
| Reviewed by Darin Adler. |
| |
| * stress/stress-jitthunks.js: Added. |
| (let.set newGlobal): |
| (set catch): |
| |
| 2020-02-17 Tadeu Zagallo <tzagallo@apple.com> |
| |
| [Wasm] REGRESSION(r256665): Wasm->JS call IC needs to save memory size register |
| https://bugs.webkit.org/show_bug.cgi?id=207849 |
| |
| Reviewed by Mark Lam. |
| |
| * wasm/regress/regress-256665.js: Added. |
| (f): |
| |
| 2020-02-14 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Unreviewed: fix broken tests added in r256665 |
| https://bugs.webkit.org/show_bug.cgi?id=207727 |
| |
| Our inline WAT doesn't seem to like named blocks/branch targets. |
| |
| * wasm/regress/llint-callee-saves-with-fast-memory.js: |
| * wasm/regress/llint-callee-saves-without-fast-memory.js: |
| |
| 2020-02-14 Tadeu Zagallo <tzagallo@apple.com> |
| |
| [WASM] Wasm interpreter's calling convention doesn't match Wasm JIT's convention. |
| https://bugs.webkit.org/show_bug.cgi?id=207727 |
| |
| Reviewed by Mark Lam. |
| |
| * wasm/regress/llint-callee-saves-with-fast-memory.js: Added. |
| * wasm/regress/llint-callee-saves-without-fast-memory.js: Added. |
| |
| 2020-02-13 Caio Lima <ticaiolima@gmail.com> |
| |
| [ESNext][BigInt] We don't support BigInt literal as PropertyName |
| https://bugs.webkit.org/show_bug.cgi?id=206888 |
| |
| Reviewed by Ross Kirsling. |
| |
| * stress/big-int-as-property-name.js: Added. |
| |
| 2020-02-10 Mark Lam <mark.lam@apple.com> |
| |
| Placate exception check validator in GenericArguments<Type>::put(). |
| https://bugs.webkit.org/show_bug.cgi?id=207485 |
| <rdar://problem/59302535> |
| |
| Reviewed by Robin Morisset. |
| |
| * stress/placate-exception-check-validator-in-GenericArguments-put.js: Added. |
| |
| 2020-02-10 Justin Michaud <justin_michaud@apple.com> |
| |
| arm64_32: microbenchmarks/delete-property-keeps-cacheable-structure.js is timing out |
| https://bugs.webkit.org/show_bug.cgi?id=207484 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * microbenchmarks/delete-property-keeps-cacheable-structure.js: |
| |
| 2020-02-10 Mark Lam <mark.lam@apple.com> |
| |
| Missing exception check in GenericArguments<Type>::deletePropertyByIndex(). |
| https://bugs.webkit.org/show_bug.cgi?id=207483 |
| <rdar://problem/59302616> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/missing-exception-check-in-GenericArguments-deletePropertyByIndex.js: Added. |
| |
| 2020-02-06 Sukolsak Sakshuwong <sukolsak@gmail.com> and Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| JavaScript string corruption using RegExp with unicode character |
| https://bugs.webkit.org/show_bug.cgi?id=187947 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| This change adds regression test for string corruption that occured after |
| non-BMP character was removed by String.prototype.replace. |
| The issue was fixed in https://trac.webkit.org/changeset/253648/webkit. |
| |
| Also, this patch brings back: |
| 1. An out-of-order character class range test. |
| 2. Dangling and combined surrogates tests (as webkit.org/b/154863 is now resolved). |
| |
| * stress/regress-187947.js: Added. |
| |
| 2020-02-05 Justin Michaud <justin_michaud@apple.com> |
| |
| Deleting a property should not turn structures into uncacheable dictionaries |
| https://bugs.webkit.org/show_bug.cgi?id=206430 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * microbenchmarks/delete-property-from-prototype-chain.js: Added. |
| (assert): |
| (noInline.assert.getZ): |
| (noInline.getZ.C): |
| (doTest): |
| (delete.C.prototype.z): |
| * microbenchmarks/delete-property-keeps-cacheable-structure.js: Added. |
| (assert): |
| (C): |
| (doTest): |
| * stress/cache-put-by-id-different-attributes.js: |
| (makePrototypeDict): |
| (set x): |
| * stress/cache-put-by-id-different-offset.js: |
| (makePrototypeDict): |
| (set x): |
| * stress/cache-put-by-id-poly-proto.js: |
| (makePrototypeDict): |
| (set _): |
| * stress/delete-property-check-structure-transition.js: Added. |
| (assert): |
| (assert_eq): |
| (assert_neq): |
| (sd): |
| (sid): |
| (testDeleteIsNotUncacheable): |
| (testCanMaterializeDeletes): |
| (testCanFlatten): |
| (testDeleteWithInlineCache.Object.prototype.globalProperty.42.makeFoo): |
| (testDeleteWithInlineCache.noInline.doTest): |
| (testDeleteWithInlineCache): |
| * stress/flatten-object-zero-unused-inline-properties.js: |
| |
| 2020-02-04 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Quantifiers after lookahead assertions should be syntax errors in Unicode patterns only |
| https://bugs.webkit.org/show_bug.cgi?id=206988 |
| |
| Reviewed by Darin Adler and Ross Kirsling. |
| |
| * test262/expectations.yaml: Mark 10 test cases as passing. |
| |
| 2020-02-03 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| \0 identity escapes should be syntax errors in Unicode patterns only |
| https://bugs.webkit.org/show_bug.cgi?id=207114 |
| |
| Reviewed by Darin Adler. |
| |
| * test262/expectations.yaml: Mark 2 test cases as passing. |
| |
| 2020-02-01 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Non-alphabetical \c escapes should be syntax errors in Unicode patterns only |
| https://bugs.webkit.org/show_bug.cgi?id=207091 |
| |
| Reviewed by Darin Adler. |
| |
| * test262/expectations.yaml: Mark 4 test cases as passing. |
| |
| 2020-01-31 Saam Barati <sbarati@apple.com> |
| |
| Unreviewed. Don't dump disassembly in test. |
| |
| * stress/get-getter-setter-by-offset-not-always-safe-to-execute.js: |
| |
| 2020-01-31 Saam Barati <sbarati@apple.com> |
| |
| GetGetterSetterByOffset and GetGetter/GetSetter are not always safe to execute |
| https://bugs.webkit.org/show_bug.cgi?id=206805 |
| <rdar://problem/58898161> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/get-getter-setter-by-offset-not-always-safe-to-execute.js: Added. |
| |
| 2020-01-31 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Unmatched ] or } brackets should be syntax errors in Unicode patterns only |
| https://bugs.webkit.org/show_bug.cgi?id=207023 |
| |
| Reviewed by Darin Adler. |
| |
| * test262/expectations.yaml: Mark 2 test cases as passing. |
| |
| 2020-01-30 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Incomplete braced quantifiers should be banned in Unicode patterns only |
| https://bugs.webkit.org/show_bug.cgi?id=206776 |
| |
| Reviewed by Darin Adler. |
| |
| Although the change does not affect Unicode property escapes, a few |
| test/built-ins/RegExp/property-escapes/non-existent-property-value*.js files |
| are now passing because they had \\p or \\P instead of CharacterClassEscape. |
| |
| * test262/expectations.yaml: Mark 18 test cases as passing. |
| |
| 2020-01-30 Keith Miller <keith_miller@apple.com> |
| |
| Parser needs to restore unary stack state when backtracking |
| https://bugs.webkit.org/show_bug.cgi?id=206972 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/parser-save-state-remove-stale-entries.js: Added. |
| * stress/parser-syntax-checker-assignments-are-not-resolve-expressions.js: Added. |
| (foo): |
| |
| 2020-01-29 Mark Lam <mark.lam@apple.com> |
| |
| Fix bad assertion in InternalFunctionAllocationProfile::createAllocationStructureFromBase(). |
| https://bugs.webkit.org/show_bug.cgi?id=206981 |
| <rdar://problem/58985736> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/InternalFunctionAllocationProfile-createAllocationStructureFromBase-should-allow-for-same-classInfo-from-different-globals.js: Added. |
| |
| 2020-01-29 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Unreviewed, update tests |
| https://bugs.webkit.org/show_bug.cgi?id=206846 |
| |
| * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-debug.js: Copied from JSTests/stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js. |
| (shouldBe): |
| (putter): |
| (not_string.toString): |
| * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js: |
| * stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten-debug.js: Copied from JSTests/stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js. |
| (shouldBe): |
| (dictionary): |
| (putter): |
| (not_string.toString): |
| * stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js: |
| |
| 2020-01-28 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Give up IC when unknown structure transition happens |
| https://bugs.webkit.org/show_bug.cgi?id=206846 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/ensure-crash.js: Added. |
| * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-bad-transition-debug.js: Added. |
| (shouldBe): |
| (putter): |
| (not_string.toString): |
| * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-bad-transition.js: Added. |
| (shouldBe): |
| (putter): |
| (not_string.toString): |
| * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js: Added. |
| (shouldBe): |
| (putter): |
| (not_string.toString): |
| * stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js: Added. |
| (shouldBe): |
| (dictionary): |
| (putter): |
| (not_string.toString): |
| |
| 2020-01-29 Paulo Matos <pmatos@igalia.com> |
| |
| Skip slow test operand-should-fit-in-abstract-heap-encoded-payload-format.js on mips and arm |
| https://bugs.webkit.org/show_bug.cgi?id=206926 |
| |
| Unreviewed test gardening. |
| |
| This test has quadratic behaviour with the size of a, and on mips and arm it just takes too |
| long to run with such high value of a. Therefore we skip. |
| |
| * stress/operand-should-fit-in-abstract-heap-encoded-payload-format.js: |
| |
| 2020-01-28 Paulo Matos <pmatos@igalia.com> |
| |
| Skip test numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js in arm and mips |
| https://bugs.webkit.org/show_bug.cgi?id=206865 |
| |
| Reviewed by Žan Doberšek. |
| |
| * stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js: |
| |
| 2020-01-26 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Invalid ranges in character classes should be banned in Unicode patterns only |
| https://bugs.webkit.org/show_bug.cgi?id=206768 |
| |
| Reviewed by Darin Adler. |
| |
| * test262/expectations.yaml: Mark 18 test cases as passing. |
| |
| 2020-01-24 Mark Lam <mark.lam@apple.com> |
| |
| IntlObject's cached strings should be immortal and safe for concurrent access. |
| https://bugs.webkit.org/show_bug.cgi?id=206779 |
| <rdar://problem/58831763> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js: Added. |
| |
| 2020-01-24 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| REGRESSION (r254964-r254970?): Catalina Debug JSC bot timing out while running tests |
| https://bugs.webkit.org/show_bug.cgi?id=206785 |
| |
| Unreviewed, skipping the test if $buildType is "debug". |
| |
| * stress/operand-should-fit-in-abstract-heap-encoded-payload-format.js: |
| |
| 2020-01-23 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] DFG OSR exit is not marking CodeBlock::m_hasLinkedOSRExit when the exit target is checkpoint |
| https://bugs.webkit.org/show_bug.cgi?id=206726 |
| <rdar://problem/58827849> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/exit-target-code-block-can-be-changed-between-llint-and-baseline.js: Added. |
| (bar): |
| (foo): |
| |
| 2020-01-22 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Bits from Operand should fit in bits reserved in AbstractHeap's Payload |
| https://bugs.webkit.org/show_bug.cgi?id=206619 |
| <rdar://problem/58270260> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/operand-should-fit-in-abstract-heap-encoded-payload-format.js: Added. |
| |
| 2020-01-22 Keith Miller <keith_miller@apple.com> |
| |
| InternalField and CheckNeutered DFG nodes are not always safe to execute |
| https://bugs.webkit.org/show_bug.cgi?id=206632 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/for-of-bad-internal-field-hoist.js: Added. |
| (foo): |
| |
| 2020-01-22 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] DateMath should accept more ISO-8601 timezone designators even if they are not included in ECMA262 to produce expected results in the wild code |
| https://bugs.webkit.org/show_bug.cgi?id=160287 |
| |
| Reviewed by Ross Kirsling. |
| |
| * stress/relaxed-timezone-designators.js: Added. |
| (shouldBe): |
| (parsedDate): |
| |
| 2020-01-22 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Add CheckArrayOrEmpty to handle the case when hoisting CheckArray for places where input can be empty |
| https://bugs.webkit.org/show_bug.cgi?id=206571 |
| <rdar://problem/58757016> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/check-array-or-empty.js: Added. |
| (C): |
| |
| 2020-01-21 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Object allocation sinking is missing PutHint for allocations unreachable in the graph |
| https://bugs.webkit.org/show_bug.cgi?id=203799 |
| <rdar://problem/56852162> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/allocation-sinking-puthint-control-flow-2.js: Added. |
| (f.handler.construct): |
| (f): |
| |
| 2020-01-20 Gus Caplan <me@gus.host> |
| |
| Remove own toString from NativeError prototype |
| https://bugs.webkit.org/show_bug.cgi?id=204629 |
| |
| Reviewed by Ross Kirsling. |
| |
| NativeError prototypes are expected to inherit toString from |
| Error.prototype. See https://github.com/tc39/ecma262/issues/1794 |
| for additional details. |
| |
| * stress/nativeerror-prototype-tostring.js: |
| |
| 2020-01-20 Caio Lima <ticaiolima@gmail.com> |
| |
| Skip tests when there is no JIT build on ARMv7 and MIPS |
| https://bugs.webkit.org/show_bug.cgi?id=206496 |
| |
| Unreviewed gardening. |
| |
| * microbenchmarks/bit-test-constant.js: |
| * microbenchmarks/bit-test-nonconstant.js: |
| * microbenchmarks/memcpy-typed-loop-large.js: |
| * microbenchmarks/memcpy-typed-loop-small.js: |
| * microbenchmarks/mul-immediate-sub.js: |
| * stress/dont-range-based-iterate-vector-that-is-mutated.js: |
| * stress/int8-repeat-in-then-out-of-bounds.js: |
| * stress/sampling-profiler-richards.js: |
| |
| 2020-01-18 Caitlin Potter <caitp@igalia.com> |
| |
| [JSC] add DFG/FTL support for op_to_property_key |
| https://bugs.webkit.org/show_bug.cgi?id=206368 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/class-fields-to-property-key-const-string-ftl.js: Added. |
| * stress/class-fields-to-property-key-const-symbol-ftl.js: Added. |
| * stress/class-fields-to-property-key-slow-object-tostring-ftl.js: Added. |
| * stress/class-fields-to-property-key-slow-object-valueof-ftl.js: Added. |
| * stress/class-fields-to-property-key-string-object-ftl.js: Added. |
| * stress/class-fields-to-property-key-string-or-string-object-ftl.js: Added. |
| |
| 2020-01-17 Saam Barati <sbarati@apple.com> |
| |
| Air O0 should have better stack allocation |
| https://bugs.webkit.org/show_bug.cgi?id=206436 |
| |
| Reviewed by Tadeu Zagallo. |
| |
| * wasm/stress/dont-stack-overflow-in-air.js: Added. |
| |
| 2020-01-17 Mark Lam <mark.lam@apple.com> |
| |
| JSModuleLoader's printableModuleKey() should never throw. |
| https://bugs.webkit.org/show_bug.cgi?id=206461 |
| <rdar://problem/58696678> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/printableModuleKey-should-never-throw.js: Added. |
| |
| 2020-01-17 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| JSON.parse should lookup prototype chains during revival |
| https://bugs.webkit.org/show_bug.cgi?id=205769 |
| |
| Reviewed by Saam Barati. |
| |
| * test262/expectations.yaml: Mark 4 test cases as passing. |
| |
| 2020-01-16 Robin Morisset <rmorisset@apple.com> |
| |
| [ESNext] Enables a way to throw an error on ByteCodeGenerator step |
| https://bugs.webkit.org/show_bug.cgi?id=180139 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/eval-huge-big-int-memory-overflow.js: Added. |
| |
| 2020-01-16 Keith Miller <keith_miller@apple.com> |
| |
| Reland bytecode checkpoints since bugs have been fixed |
| https://bugs.webkit.org/show_bug.cgi?id=206361 |
| |
| Unreviewed, reland. |
| |
| The watch bugs have been fixed by https://trac.webkit.org/changeset/254674 |
| |
| * stress/apply-osr-exit-should-get-length-once-exceptions-occasionally.js: Added. |
| (expectedArgCount): |
| (callee): |
| (test): |
| (let.array.get length): |
| * stress/apply-osr-exit-should-get-length-once.js: Added. |
| (expectedArgCount): |
| (callee): |
| (test): |
| (let.array.get length): |
| * stress/load-varargs-then-inlined-call-and-exit-strict.js: |
| (checkEqual): |
| * stress/recursive-tail-call-with-different-argument-count.js: |
| * stress/rest-varargs-osr-exit-to-checkpoint.js: Added. |
| (foo): |
| (bar): |
| |
| 2020-01-16 Keith Miller <keith_miller@apple.com> |
| |
| Revert 254725 since it breaks tests |
| https://bugs.webkit.org/show_bug.cgi?id=206391 |
| |
| Unreviewed, revert. |
| |
| * stress/allocation-sinking-puthint-control-flow-2.js: Removed. |
| |
| 2020-01-16 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Object allocation sinking is missing PutHint for allocations unreachable in the graph |
| https://bugs.webkit.org/show_bug.cgi?id=203799 |
| <rdar://problem/56852162> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/allocation-sinking-puthint-control-flow-2.js: Added. |
| (f.handler.construct): |
| (f): |
| |
| 2020-01-16 Robin Morisset <rmorisset@apple.com> |
| |
| Teach the bytecode that arithmetic operations can return bigints |
| https://bugs.webkit.org/show_bug.cgi?id=205416 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| This file crashes in debug mode without the fix. |
| |
| * stress/big-int-arithmetic-return-big-int.js: Added. |
| (fooAdd): |
| (fooSub): |
| (fooMul): |
| (fooDiv): |
| |
| 2020-01-16 Mark Lam <mark.lam@apple.com> |
| |
| operationToObject() should check for a null errorMessage. |
| https://bugs.webkit.org/show_bug.cgi?id=206339 |
| <rdar://problem/58449666> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/operationToObject-should-check-for-null-errorMessage.js: Added. |
| |
| 2020-01-15 Caitlin Potter <caitp@igalia.com> |
| |
| [JSC] Add support for public class fields |
| https://bugs.webkit.org/show_bug.cgi?id=174212 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| New syntax invalidates some test expectations: |
| |
| "async <linefeed> MethodDefinition" is no longer an unexpected "async" |
| token. It is now an instance field named "async" with no initializer, |
| and an automatic semicolon, followed by MethodDefinition. |
| |
| "get|set GeneratorMethodDefinition"'s error message has changed, due to "get" |
| being valid class field names. |
| |
| Many class-syntax tests relating to automatic semicolon insertion are |
| no longer valid, as a line containing nothing but an identifier is now |
| a valid class element. |
| |
| * stress/async-await-syntax.js: |
| * stress/class-fields-bytecode-cache.js: Added. |
| * stress/class-fields-computed-to-property-key.js: Added. |
| * stress/class-fields-function-name.js: Added. |
| * stress/class-fields-harmony.js: Added. |
| * stress/class-fields-proxy-define-property.js: Added. |
| * stress/class-fields-stress-instance.js: Added. |
| * stress/generator-syntax.js: |
| * stress/method-name.js: |
| * test262/config.yaml: |
| |
| 2020-01-15 Keith Miller <keith_miller@apple.com> |
| |
| Revert bytecode checkpoints since it breaks watch |
| https://bugs.webkit.org/show_bug.cgi?id=206301 |
| |
| Unreviewed, revert. |
| |
| 2020-01-15 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Object.preventExtensions should throw if not successful |
| https://bugs.webkit.org/show_bug.cgi?id=206131 |
| |
| Reviewed by Ross Kirsling. |
| |
| * test262/expectations.yaml: Mark 2 test cases as passing. |
| |
| 2020-01-14 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r254480, r254496, and r254517. |
| https://bugs.webkit.org/show_bug.cgi?id=206278 |
| |
| "It regressed JetStream2 and Speedometer2" (Requested by |
| saamyjoon on #webkit). |
| |
| Reverted changesets: |
| |
| "Throw away baseline code if there is an optimized |
| replacement" |
| https://bugs.webkit.org/show_bug.cgi?id=202503 |
| https://trac.webkit.org/changeset/254480 |
| |
| "Unreviewed. Change useLLInt=0 to forceBaseline=1" |
| https://trac.webkit.org/changeset/254496 |
| |
| "Add an option that enables/disables throwing away baseline |
| JIT code" |
| https://bugs.webkit.org/show_bug.cgi?id=206244 |
| https://trac.webkit.org/changeset/254517 |
| |
| 2020-01-13 Saam Barati <sbarati@apple.com> |
| |
| Unreviewed. Change useLLInt=0 to forceBaseline=1 |
| |
| * stress/racy-gc-cleanup-of-identifier-after-mutator-stops-running.js: |
| |
| 2020-01-13 Keith Miller <keith_miller@apple.com> |
| |
| scanSideState scans too much side state |
| https://bugs.webkit.org/show_bug.cgi?id=206166 |
| |
| Reviewed by Tadeu Zagallo. |
| |
| * stress/checkpoint-side-state-gc-tmps-overflow.js: Added. |
| (v8): |
| |
| 2020-01-13 Saam Barati <sbarati@apple.com> |
| |
| Throw away baseline code if there is an optimized replacement |
| https://bugs.webkit.org/show_bug.cgi?id=202503 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js: |
| * stress/getter-setter-inlining-should-emit-movhint.js: |
| * stress/make-dictionary-repatch.js: |
| * stress/merging-ic-variants-should-bail-if-structures-overlap.js: |
| * stress/proxy-getter-stack-overflow.js: |
| * stress/regress-192717.js: |
| * stress/retry-cache-later.js: |
| |
| 2020-01-13 Mark Lam <mark.lam@apple.com> |
| |
| Replace uses of Box<Identifier> with a new CacheableIdentifier class. |
| https://bugs.webkit.org/show_bug.cgi?id=205544 |
| <rdar://problem/58041800> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/racy-gc-cleanup-of-identifier-after-mutator-stops-running.js: Added. |
| |
| 2020-01-11 Keith Miller <keith_miller@apple.com> |
| |
| CheckNeutered needs to claim it reads JSType in clobberize. |
| https://bugs.webkit.org/show_bug.cgi?id=206136 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/check-neutered-clobberize-reads-jstype.js: Added. |
| (foo): |
| |
| 2020-01-12 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Use internal object field mechanism to implement JSStringIterator |
| https://bugs.webkit.org/show_bug.cgi?id=206144 |
| |
| Reviewed by Ross Kirsling. |
| |
| * stress/string-iterators.js: |
| * stress/tailCallForwardArguments.js: |
| (putFuncToPrivateName.createBuiltin): |
| (createTailCallForwardingFuncWith): |
| |
| 2020-01-10 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Flush old tables in End phase |
| https://bugs.webkit.org/show_bug.cgi?id=206120 |
| <rdar://problem/58039989> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/create-many-realms.js: Added. |
| (foo): |
| |
| 2020-01-10 Caitlin Potter <caitp@igalia.com> and Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Object.keys should throw if called on module namespace object with uninitialized binding |
| https://bugs.webkit.org/show_bug.cgi?id=205983 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * test262/expectations.yaml: Mark 2 test cases as passing. |
| |
| 2020-01-10 Saam Barati <sbarati@apple.com> |
| |
| ObjectAllocationSinkingPhase doesn't model pointers to allocations in control flow properly |
| https://bugs.webkit.org/show_bug.cgi?id=204738 |
| <rdar://problem/57553238> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/allocation-sinking-must-model-allocation-pointers-properly-2.js: Added. |
| (assert): |
| (v9): |
| * stress/allocation-sinking-must-model-allocation-pointers-properly-3.js: Added. |
| (assert): |
| (v9): |
| * stress/allocation-sinking-must-model-allocation-pointers-properly-4.js: Added. |
| (bool): |
| (effects): |
| (escape): |
| (bar): |
| * stress/allocation-sinking-must-model-allocation-pointers-properly.js: Added. |
| (alwaysFalse): |
| (sometimesZero): |
| (assert): |
| (v9): |
| |
| 2020-01-08 Keith Miller <keith_miller@apple.com> |
| |
| [JSC] Introduce JSArrayIterator |
| https://bugs.webkit.org/show_bug.cgi?id=204043 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/array-iterator-materialize-at-osr-exit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/array-iterator-materialize-one-path.js: Added. |
| (shouldBe): |
| (test): |
| * stress/array-iterator-materialize.js: Added. |
| (shouldBe): |
| (test): |
| * stress/array-iterator-sinking.js: Added. |
| (shouldBe): |
| (test): |
| * stress/array-iterators-next-error-messages.js: |
| (catch): |
| * stress/array-iterators-next-with-call.js: |
| * stress/for-of-iteration.js: Added. |
| (shouldBe): |
| (test1): |
| (test2): |
| (test3): |
| * stress/typedarray-functions-with-neutered.js: |
| (checkProtoFunc): |
| |
| 2020-01-08 Saam Barati <sbarati@apple.com> |
| |
| Unreviewed follow up on r254188. I accidentally included the same test |
| twice instead of including the two different variants. |
| |
| * stress/ai-value-mod-should-result-in-constant-int-where-possible.js: |
| |
| 2020-01-08 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Proxy's [[OwnPropertyKeys]] is correct only in PropertyNameMode::StringsAndSymbols |
| https://bugs.webkit.org/show_bug.cgi?id=205772 |
| |
| Reviewed by Ross Kirsling. |
| |
| * test262/expectations.yaml: Mark 12 test cases as passing. |
| |
| 2020-01-08 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| RegExp.prototype[Symbol.replace] does not support named capture groups |
| https://bugs.webkit.org/show_bug.cgi?id=205783 |
| |
| Reviewed by Ross Kirsling. |
| |
| * test262/expectations.yaml: Mark 6 test cases as passing. |
| |
| 2020-01-07 Saam Barati <sbarati@apple.com> |
| |
| AI rule for ValueMod/ValueDiv produce constants with the wrong format when the result can be an int32 |
| https://bugs.webkit.org/show_bug.cgi?id=205906 |
| <rdar://problem/56108519> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/ai-value-div-should-result-in-constant-int-where-possible.js: Added. |
| (foo.bar.f): |
| (foo.): |
| (foo): |
| * stress/ai-value-mod-should-result-in-constant-int-where-possible.js: Added. |
| (foo.bar.f): |
| (foo.): |
| (foo): |
| |
| 2020-01-06 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| String.prototype.replace() incorrectly handles named references on RegExp w/o named groups |
| https://bugs.webkit.org/show_bug.cgi?id=205785 |
| |
| Reviewed by Ross Kirsling. |
| |
| * test262/expectations.yaml: Mark 2 test cases as passing. |
| |
| 2020-01-06 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Proxy's [[OwnPropertyKeys]] is incorrect in DontEnumPropertiesMode::Exclude |
| https://bugs.webkit.org/show_bug.cgi?id=203818 |
| |
| Reviewed by Keith Miller. |
| |
| Stress test was failing because "ownKeys" trap didn't return non-configurable |
| "prototype" property of Proxy's target, violating an invariant. |
| |
| * stress/proxy-get-own-property-names-should-not-clear-previous-results.js: |
| * test262/expectations.yaml: Mark 8 test cases as passing. |
| |
| 2020-01-04 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| JSON.parse should initialize wrapper object with [[DefineOwnProperty]] |
| https://bugs.webkit.org/show_bug.cgi?id=205767 |
| |
| Reviewed by Darin Adler. |
| |
| * test262/expectations.yaml: Mark 2 test cases as passing. |
| |
| 2020-01-03 Keith Miller <keith_miller@apple.com> |
| |
| Update test262 tests to commit 157b18d |
| https://bugs.webkit.org/show_bug.cgi?id=205741 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * test262/expectations.yaml: |
| * test262/harness/deepEqual.js: |
| (assert.deepEqual): |
| (assert.deepEqual.format): |
| (deepEqual): |
| (compareEquality): |
| (compareIf): |
| (tryCompareStrictEquality): |
| (tryCompareTypeOfEquality): |
| (tryCompareToStringTagEquality): |
| (isOptional): |
| (compareOptionality): |
| (isPrimitiveEquatable): |
| (comparePrimitiveEquality): |
| (isNaNEquatable): |
| (compareNaNEquality): |
| (isObjectEquatable): |
| (compareObjectEquality): |
| (isBoxed): |
| (isValueOfEquatable): |
| (compareValueOfEquality): |
| (isToStringEquatable): |
| (compareToStringEquality): |
| (isArrayLikeEquatable): |
| (isStructurallyEquatable): |
| (isIterableEquatable): |
| (compareIteratorEquality): |
| (compareIterableEquality): |
| (cacheComparison): |
| (fail): |
| (setCache): |
| (getCache): |
| (assert.deepEqual._compare): |
| * test262/latest-changes-summary.txt: |
| * test262/test/built-ins/AggregateError: Added. |
| * test262/test/built-ins/AggregateError/errors-iterabletolist-failures.js: Added. |
| (case1.get Symbol): |
| (case2.get Symbol): |
| (case3.Symbol.iterator): |
| (case4.Symbol.iterator): |
| (case5.Symbol.iterator): |
| (case6.Symbol.iterator.return.get next): |
| (case6.Symbol.iterator): |
| (case7.Symbol.iterator.return.get next): |
| (case7.Symbol.iterator): |
| (case8.Symbol.iterator): |
| (case9.Symbol.iterator): |
| (case10.Symbol.iterator): |
| (case11.Symbol.iterator.return.next.return.get done): |
| (case11.Symbol.iterator): |
| * test262/test/built-ins/AggregateError/errors-iterabletolist.js: Added. |
| (case1.Symbol.iterator.return.next.return.get value): |
| (case1.Symbol.iterator): |
| * test262/test/built-ins/AggregateError/length.js: Added. |
| * test262/test/built-ins/AggregateError/message-method-prop-cast.js: Added. |
| (toString): |
| * test262/test/built-ins/AggregateError/message-method-prop.js: Added. |
| * test262/test/built-ins/AggregateError/message-tostring-abrupt-symbol.js: Added. |
| (case2.Symbol.toPrimitive): |
| (case2.toString): |
| (case2.valueOf): |
| * test262/test/built-ins/AggregateError/message-tostring-abrupt.js: Added. |
| (case1.Symbol.toPrimitive): |
| (case1.toString): |
| (case1.valueOf): |
| (case2.toString): |
| (case2.valueOf): |
| (case3.valueOf): |
| * test262/test/built-ins/AggregateError/message-undefined-no-prop.js: Added. |
| * test262/test/built-ins/AggregateError/name.js: Added. |
| * test262/test/built-ins/AggregateError/newtarget-proto-custom.js: Added. |
| (newt.new.Proxy): |
| (newt.new.Proxy.get if): |
| * test262/test/built-ins/AggregateError/newtarget-proto-fallback.js: Added. |
| (ctor): |
| (const.value.of.values.get t): |
| * test262/test/built-ins/AggregateError/newtarget-proto.js: Added. |
| * test262/test/built-ins/AggregateError/prop-desc.js: Added. |
| * test262/test/built-ins/AggregateError/proto.js: Added. |
| * test262/test/built-ins/AggregateError/prototype: Added. |
| * test262/test/built-ins/AggregateError/prototype/constructor.js: Added. |
| * test262/test/built-ins/AggregateError/prototype/errors: Added. |
| * test262/test/built-ins/AggregateError/prototype/errors/invoked-as-accessor.js: Added. |
| * test262/test/built-ins/AggregateError/prototype/errors/invoked-as-func.js: Added. |
| * test262/test/built-ins/AggregateError/prototype/errors/length.js: Added. |
| * test262/test/built-ins/AggregateError/prototype/errors/name.js: Added. |
| * test262/test/built-ins/AggregateError/prototype/errors/prop-desc.js: Added. |
| * test262/test/built-ins/AggregateError/prototype/errors/return-from-iterable-errors.js: Added. |
| (errors.Symbol.iterator.return.next.return.get value): |
| (errors.Symbol.iterator): |
| * test262/test/built-ins/AggregateError/prototype/errors/return-new-array-from-list.js: Added. |
| * test262/test/built-ins/AggregateError/prototype/errors/this-has-no-typedarrayname-internal.js: Added. |
| * test262/test/built-ins/AggregateError/prototype/errors/this-is-not-object.js: Added. |
| * test262/test/built-ins/AggregateError/prototype/message.js: Added. |
| * test262/test/built-ins/AggregateError/prototype/name.js: Added. |
| * test262/test/built-ins/AggregateError/prototype/prop-desc.js: Added. |
| * test262/test/built-ins/AggregateError/prototype/proto.js: Added. |
| * test262/test/built-ins/Array/prototype/copyWithin/coerced-values-start-change-start.js: Added. |
| (longDenseArray): |
| (shorten): |
| * test262/test/built-ins/Array/prototype/copyWithin/coerced-values-start-change-target.js: Added. |
| (longDenseArray): |
| (shorten): |
| * test262/test/built-ins/Array/prototype/flatMap/this-value-ctor-object-species-bad-throws.js: |
| * test262/test/built-ins/Atomics/add/bigint/nonshared-int-views.js: |
| (testWithBigIntTypedArrayConstructors): |
| * test262/test/built-ins/Atomics/and/bigint/nonshared-int-views.js: |
| (testWithBigIntTypedArrayConstructors): |
| * test262/test/built-ins/Atomics/compareExchange/bigint/nonshared-int-views.js: |
| (testWithBigIntTypedArrayConstructors): |
| * test262/test/built-ins/Atomics/exchange/bigint/nonshared-int-views.js: |
| (testWithBigIntTypedArrayConstructors): |
| * test262/test/built-ins/Atomics/or/bigint/nonshared-int-views.js: |
| (testWithBigIntTypedArrayConstructors): |
| * test262/test/built-ins/Atomics/store/bigint/nonshared-int-views.js: |
| (testWithBigIntTypedArrayConstructors): |
| * test262/test/built-ins/Atomics/sub/bigint/nonshared-int-views.js: |
| (testWithBigIntTypedArrayConstructors): |
| * test262/test/built-ins/Error/prototype/toString/invalid-receiver.js: Added. |
| (Symbol.forEach): |
| * test262/test/built-ins/Error/prototype/toString/undefined-props.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-prevented-with-unregister.js: |
| (emptyCells): |
| (emptyCells.then): |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-throws-in-callback.js: Added. |
| (fg.new.FinalizationGroup): |
| (callback): |
| (emptyCells): |
| (emptyCells.then): |
| * test262/test/built-ins/FinalizationGroup/prototype/register/holdings-same-as-target.js: |
| * test262/test/built-ins/FinalizationGroup/prototype/register/return-undefined-register-itself.js: |
| * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-holdings-and-target.js: |
| * test262/test/built-ins/FinalizationGroup/prototype/unregister/unregister-cleaned-up-cell.js: Added. |
| (fg.new.FinalizationGroup): |
| (emptyCells): |
| (emptyCells.then): |
| * test262/test/built-ins/FinalizationGroup/target-not-callable-throws.js: |
| * test262/test/built-ins/JSON/parse/reviver-array-get-prop-from-prototype.js: Added. |
| * test262/test/built-ins/JSON/parse/reviver-array-non-configurable-prop-create.js: Added. |
| * test262/test/built-ins/JSON/parse/reviver-array-non-configurable-prop-delete.js: Added. |
| * test262/test/built-ins/JSON/parse/reviver-call-order.js: Added. |
| * test262/test/built-ins/JSON/parse/reviver-object-get-prop-from-prototype.js: Added. |
| * test262/test/built-ins/JSON/parse/reviver-object-non-configurable-prop-create.js: Added. |
| * test262/test/built-ins/JSON/parse/reviver-object-non-configurable-prop-delete.js: Added. |
| * test262/test/built-ins/JSON/parse/reviver-wrapper.js: Added. |
| * test262/test/built-ins/JSON/stringify/property-order.js: Added. |
| * test262/test/built-ins/Object/entries/return-order.js: Added. |
| * test262/test/built-ins/Object/freeze/throws-when-false.js: Added. |
| (preventExtensions): |
| * test262/test/built-ins/Object/getOwnPropertyNames/proxy-invariant-absent-not-configurable-symbol-key.js: Added. |
| (ownKeys): |
| * test262/test/built-ins/Object/getOwnPropertyNames/proxy-invariant-duplicate-symbol-entry.js: Added. |
| (ownKeys): |
| * test262/test/built-ins/Object/getOwnPropertyNames/proxy-invariant-not-extensible-absent-symbol-key.js: Added. |
| (ownKeys): |
| * test262/test/built-ins/Object/getOwnPropertyNames/proxy-invariant-not-extensible-extra-symbol-key.js: Added. |
| (ownKeys): |
| * test262/test/built-ins/Object/getOwnPropertySymbols/length.js: |
| * test262/test/built-ins/Object/getOwnPropertySymbols/name.js: |
| * test262/test/built-ins/Object/getOwnPropertySymbols/object-contains-symbol-property-with-description.js: |
| * test262/test/built-ins/Object/getOwnPropertySymbols/object-contains-symbol-property-without-description.js: |
| * test262/test/built-ins/Object/getOwnPropertySymbols/proxy-invariant-absent-not-configurable-string-key.js: Added. |
| (ownKeys): |
| * test262/test/built-ins/Object/getOwnPropertySymbols/proxy-invariant-duplicate-string-entry.js: Added. |
| (ownKeys): |
| * test262/test/built-ins/Object/getOwnPropertySymbols/proxy-invariant-not-extensible-absent-string-key.js: Added. |
| (ownKeys): |
| * test262/test/built-ins/Object/getOwnPropertySymbols/proxy-invariant-not-extensible-extra-string-key.js: Added. |
| (ownKeys): |
| * test262/test/built-ins/Object/keys/proxy-non-enumerable-prop-invariant-2.js: |
| * test262/test/built-ins/Object/keys/proxy-non-enumerable-prop-invariant-3.js: Added. |
| (ownKeys): |
| * test262/test/built-ins/Object/keys/return-order.js: Added. |
| * test262/test/built-ins/Object/preventExtensions/throws-when-false.js: Added. |
| (preventExtensions): |
| * test262/test/built-ins/Object/prototype/isPrototypeOf/arg-is-proxy.js: Added. |
| (handler.allowProxyTraps.getPrototypeOf): |
| * test262/test/built-ins/Object/prototype/isPrototypeOf/builtin.js: Added. |
| * test262/test/built-ins/Object/prototype/isPrototypeOf/length.js: Added. |
| * test262/test/built-ins/Object/prototype/isPrototypeOf/name.js: |
| * test262/test/built-ins/Object/prototype/isPrototypeOf/null-this-and-object-arg-throws.js: Added. |
| * test262/test/built-ins/Object/prototype/isPrototypeOf/null-this-and-primitive-arg-returns-false.js: Added. |
| * test262/test/built-ins/Object/prototype/isPrototypeOf/this-value-is-in-prototype-chain-of-arg.js: Added. |
| (USER_FACTORY.this.getName): |
| (USER_FACTORY): |
| (this.getGrade): |
| (FORCEDUSER_FACTORY): |
| * test262/test/built-ins/Object/prototype/isPrototypeOf/undefined-this-and-object-arg-throws.js: Added. |
| * test262/test/built-ins/Object/prototype/isPrototypeOf/undefined-this-and-primitive-arg-returns-false.js: Added. |
| * test262/test/built-ins/Object/seal/throws-when-false.js: Added. |
| (preventExtensions): |
| * test262/test/built-ins/Object/values/return-order.js: Added. |
| * test262/test/built-ins/Proxy/has/call-in-prototype-index.js: Added. |
| (handler.allowProxyTraps.has): |
| * test262/test/built-ins/Proxy/has/call-in-prototype.js: |
| * test262/test/built-ins/Proxy/ownKeys/call-parameters-object-keys.js: |
| (handler.ownKeys): |
| * test262/test/built-ins/Proxy/set/call-parameters-prototype-index.js: Added. |
| * test262/test/built-ins/Reflect/preventExtensions/target-is-not-object-throws.js: |
| * test262/test/built-ins/RegExp/match-indices/indices-array-element.js: |
| * test262/test/built-ins/RegExp/match-indices/indices-array-matched.js: |
| * test262/test/built-ins/RegExp/match-indices/indices-array-non-unicode-match.js: |
| * test262/test/built-ins/RegExp/match-indices/indices-array-properties.js: |
| * test262/test/built-ins/RegExp/match-indices/indices-array-unicode-match.js: |
| * test262/test/built-ins/RegExp/match-indices/indices-array-unicode-property-names.js: |
| * test262/test/built-ins/RegExp/match-indices/indices-array-unmatched.js: |
| * test262/test/built-ins/RegExp/match-indices/indices-array.js: |
| * test262/test/built-ins/RegExp/match-indices/indices-groups-object-unmatched.js: |
| * test262/test/built-ins/RegExp/match-indices/indices-groups-object.js: |
| * test262/test/built-ins/RegExp/match-indices/indices-groups-properties.js: |
| * test262/test/built-ins/RegExp/match-indices/indices-property.js: |
| * test262/test/built-ins/String/prototype/replaceAll: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/getSubstitution-0x0024-0x0024.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/getSubstitution-0x0024-0x0026.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/getSubstitution-0x0024-0x0027.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/getSubstitution-0x0024-0x003C.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/getSubstitution-0x0024-0x0060.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/getSubstitution-0x0024.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/getSubstitution-0x0024N.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/getSubstitution-0x0024NN.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/length.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/name.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/replaceAll.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/replaceValue-call-abrupt.js: Added. |
| (custom): |
| * test262/test/built-ins/String/prototype/replaceAll/replaceValue-call-each-match-position.js: Added. |
| (t): |
| (replaceValue): |
| * test262/test/built-ins/String/prototype/replaceAll/replaceValue-call-matching-empty.js: Added. |
| (t): |
| (replaceValue): |
| * test262/test/built-ins/String/prototype/replaceAll/replaceValue-call-skip-no-match.js: Added. |
| (replaceValue): |
| * test262/test/built-ins/String/prototype/replaceAll/replaceValue-call-tostring-abrupt.js: Added. |
| (custom): |
| (symbol): |
| * test262/test/built-ins/String/prototype/replaceAll/replaceValue-fn-skip-toString.js: Added. |
| (replaceValue): |
| (value): |
| * test262/test/built-ins/String/prototype/replaceAll/replaceValue-tostring-abrupt.js: Added. |
| (thisValue.toString): |
| (searchValue.toString): |
| (replaceValue.toString): |
| * test262/test/built-ins/String/prototype/replaceAll/replaceValue-value-replaces-string.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/replaceValue-value-tostring.js: Added. |
| (replaceValue.Symbol.toPrimitive): |
| (replaceValue.toString): |
| (replaceValue.valueOf): |
| * test262/test/built-ins/String/prototype/replaceAll/searchValue-empty-string-this-empty-string.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/searchValue-empty-string.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/searchValue-flags-no-g-throws.js: Added. |
| (poison.toString): |
| * test262/test/built-ins/String/prototype/replaceAll/searchValue-flags-null-undefined-throws.js: Added. |
| (poison.toString): |
| (searchValue.get flags): |
| * test262/test/built-ins/String/prototype/replaceAll/searchValue-flags-toString-abrupt.js: Added. |
| (poison.toString): |
| (searchValue.toString): |
| (searchValue.flags.toString): |
| * test262/test/built-ins/String/prototype/replaceAll/searchValue-get-flags-abrupt.js: Added. |
| (searchValue.get flags): |
| (poison.toString): |
| * test262/test/built-ins/String/prototype/replaceAll/searchValue-isRegExp-abrupt.js: Added. |
| (searchValue.get Symbol): |
| (searchValue.toString): |
| (poison.toString): |
| * test262/test/built-ins/String/prototype/replaceAll/searchValue-replace-method-abrupt.js: Added. |
| (poison.toString): |
| (searchValue.get Symbol): |
| (searchValue.toString): |
| * test262/test/built-ins/String/prototype/replaceAll/searchValue-replacer-RegExp-call-fn.js: Added. |
| (RE.prototype.Symbol.replace): |
| (RE.prototype.toString): |
| (RE): |
| (const.t): |
| (getFn.return.replaceValueFn): |
| (getFn): |
| * test262/test/built-ins/String/prototype/replaceAll/searchValue-replacer-RegExp-call.js: Added. |
| (RE.prototype.Symbol.replace): |
| (RE.prototype.toString): |
| (RE): |
| * test262/test/built-ins/String/prototype/replaceAll/searchValue-replacer-before-tostring.js: Added. |
| (value): |
| (poison.toString): |
| * test262/test/built-ins/String/prototype/replaceAll/searchValue-replacer-call-abrupt.js: Added. |
| (poison.toString): |
| (searchValue.Symbol.replace): |
| (searchValue.toString): |
| * test262/test/built-ins/String/prototype/replaceAll/searchValue-replacer-call.js: Added. |
| (value): |
| * test262/test/built-ins/String/prototype/replaceAll/searchValue-tostring-abrupt.js: Added. |
| (poison.toString): |
| (thisValue.toString): |
| (searchValue.toString): |
| * test262/test/built-ins/String/prototype/replaceAll/searchValue-tostring-regexp.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/this-is-null-throws.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/this-is-undefined-throws.js: Added. |
| * test262/test/built-ins/String/prototype/replaceAll/this-tostring-abrupt.js: Added. |
| (poison.toString): |
| (thisValue.toString): |
| (searchValue.toString): |
| * test262/test/built-ins/String/prototype/replaceAll/this-tostring.js: Added. |
| (thisValue.Symbol.toPrimitive): |
| (thisValue.toString): |
| (thisValue.valueOf): |
| * test262/test/built-ins/TypedArray/from/mapfn-is-not-callable.js: |
| * test262/test/built-ins/TypedArray/prototype/slice/BigInt/speciesctor-get-species-custom-ctor-length-throws.js: |
| (testWithBigIntTypedArrayConstructors): |
| * test262/test/built-ins/TypedArray/prototype/slice/BigInt/speciesctor-get-species-custom-ctor-length.js: |
| (testWithBigIntTypedArrayConstructors): |
| * test262/test/built-ins/TypedArray/prototype/slice/speciesctor-get-species-custom-ctor-length-throws.js: |
| (testWithTypedArrayConstructors): |
| * test262/test/built-ins/TypedArray/prototype/slice/speciesctor-get-species-custom-ctor-length.js: |
| (testWithTypedArrayConstructors): |
| * test262/test/built-ins/TypedArrayConstructors/from/nan-conversion.js: |
| * test262/test/built-ins/TypedArrayConstructors/from/new-instance-from-zero.js: |
| * test262/test/built-ins/TypedArrayConstructors/of/BigInt/inherited.js: |
| (testWithBigIntTypedArrayConstructors): |
| * test262/test/built-ins/TypedArrayConstructors/of/inherited.js: |
| (testWithTypedArrayConstructors): |
| * test262/test/built-ins/WeakRef/prototype-from-newtarget-abrupt.js: |
| * test262/test/harness/deepEqual-array.js: |
| * test262/test/harness/deepEqual-circular.js: |
| * test262/test/harness/deepEqual-deep.js: |
| * test262/test/harness/deepEqual-mapset.js: |
| * test262/test/harness/deepEqual-object.js: |
| * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/hourCycle-dateStyle.js: Added. |
| * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/hourCycle-default.js: Added. |
| (locales.forEach): |
| * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/hourCycle-timeStyle.js: Added. |
| * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/hourCycle.js: |
| * test262/test/intl402/DisplayNames: Added. |
| * test262/test/intl402/DisplayNames/ctor-custom-get-prototype-poison-throws.js: Added. |
| (custom.new.Proxy.new.Function.get if): |
| (custom.new.Proxy.new.Function): |
| * test262/test/intl402/DisplayNames/ctor-custom-prototype.js: Added. |
| * test262/test/intl402/DisplayNames/ctor-default-prototype.js: Added. |
| * test262/test/intl402/DisplayNames/instance-extensible.js: Added. |
| * test262/test/intl402/DisplayNames/length.js: Added. |
| * test262/test/intl402/DisplayNames/locales-invalid-throws.js: Added. |
| * test262/test/intl402/DisplayNames/locales-length-poison-throws.js: Added. |
| * test262/test/intl402/DisplayNames/locales-length-tolength-throws.js: Added. |
| (locales.length.valueOf): |
| (locales.length.Symbol.toPrimitive): |
| (locales.length.toString): |
| * test262/test/intl402/DisplayNames/locales-symbol-length.js: Added. |
| * test262/test/intl402/DisplayNames/name.js: Added. |
| * test262/test/intl402/DisplayNames/options-fallback-abrupt-throws.js: Added. |
| * test262/test/intl402/DisplayNames/options-fallback-invalid-throws.js: Added. |
| * test262/test/intl402/DisplayNames/options-fallback-toString-abrupt-throws.js: Added. |
| (options.fallback.toString): |
| (options.fallback.valueOf): |
| (options.fallback.Symbol.toPrimitive): |
| * test262/test/intl402/DisplayNames/options-fallback-valid.js: Added. |
| * test262/test/intl402/DisplayNames/options-localeMatcher-abrupt-throws.js: Added. |
| * test262/test/intl402/DisplayNames/options-localeMatcher-invalid-throws.js: Added. |
| * test262/test/intl402/DisplayNames/options-localeMatcher-toString-abrupt-throws.js: Added. |
| (options.localeMatcher.toString): |
| (options.localeMatcher.valueOf): |
| (options.localeMatcher.Symbol.toPrimitive): |
| * test262/test/intl402/DisplayNames/options-localeMatcher-valid.js: Added. |
| * test262/test/intl402/DisplayNames/options-null-throws.js: Added. |
| * test262/test/intl402/DisplayNames/options-random-properties-unchecked.js: Added. |
| * test262/test/intl402/DisplayNames/options-style-abrupt-throws.js: Added. |
| * test262/test/intl402/DisplayNames/options-style-invalid-throws.js: Added. |
| * test262/test/intl402/DisplayNames/options-style-toString-abrupt-throws.js: Added. |
| (options.style.toString): |
| (options.style.valueOf): |
| (options.style.Symbol.toPrimitive): |
| * test262/test/intl402/DisplayNames/options-style-valid.js: Added. |
| * test262/test/intl402/DisplayNames/options-type-abrupt-throws.js: Added. |
| * test262/test/intl402/DisplayNames/options-type-invalid-throws.js: Added. |
| * test262/test/intl402/DisplayNames/options-type-toString-abrupt-throws.js: Added. |
| (options.type.toString): |
| (options.type.valueOf): |
| (options.type.Symbol.toPrimitive): |
| * test262/test/intl402/DisplayNames/options-type-valid.js: Added. |
| * test262/test/intl402/DisplayNames/prop-desc.js: Added. |
| * test262/test/intl402/DisplayNames/proto-from-ctor-realm.js: Added. |
| * test262/test/intl402/DisplayNames/proto.js: Added. |
| * test262/test/intl402/DisplayNames/prototype: Added. |
| * test262/test/intl402/DisplayNames/prototype/Symbol.toStringTag.js: Added. |
| * test262/test/intl402/DisplayNames/prototype/prop-desc.js: Added. |
| * test262/test/intl402/DisplayNames/prototype/resolvedOptions: Added. |
| * test262/test/intl402/DisplayNames/prototype/resolvedOptions/default-option-values.js: Added. |
| * test262/test/intl402/DisplayNames/prototype/resolvedOptions/length.js: Added. |
| * test262/test/intl402/DisplayNames/prototype/resolvedOptions/name.js: Added. |
| * test262/test/intl402/DisplayNames/prototype/resolvedOptions/option-fallback.js: Added. |
| * test262/test/intl402/DisplayNames/prototype/resolvedOptions/option-style.js: Added. |
| * test262/test/intl402/DisplayNames/prototype/resolvedOptions/option-type.js: Added. |
| * test262/test/intl402/DisplayNames/prototype/resolvedOptions/prop-desc.js: Added. |
| * test262/test/intl402/DisplayNames/prototype/resolvedOptions/return-object.js: Added. |
| * test262/test/intl402/DisplayNames/prototype/resolvedOptions/this-not-object-throws.js: Added. |
| * test262/test/intl402/DisplayNames/prototype/resolvedOptions/this-object-lacks-internal-throws.js: Added. |
| * test262/test/intl402/DisplayNames/undefined-newtarget-throws.js: Added. |
| * test262/test/language/destructuring/binding/syntax/property-list-single-name-bindings.js: |
| * test262/test/language/expressions/addition/bigint-and-number.js: |
| * test262/test/language/expressions/addition/bigint-arithmetic.js: |
| * test262/test/language/expressions/addition/bigint-errors.js: |
| * test262/test/language/expressions/addition/bigint-toprimitive.js: |
| * test262/test/language/expressions/addition/bigint-wrapped-values.js: |
| * test262/test/language/expressions/arrow-function/eval-var-scope-syntax-err.js: Added. |
| (f.a.eval): |
| * test262/test/language/expressions/arrow-function/scope-param-elem-var-close.js: |
| * test262/test/language/expressions/arrow-function/scope-param-elem-var-open.js: |
| * test262/test/language/expressions/arrow-function/scope-param-rest-elem-var-close.js: |
| * test262/test/language/expressions/arrow-function/scope-param-rest-elem-var-open.js: |
| * test262/test/language/expressions/async-arrow-function/eval-var-scope-syntax-err.js: Added. |
| (f.async a): |
| (SyntaxError.then): |
| * test262/test/language/expressions/async-function/named-eval-var-scope-syntax-err.js: Added. |
| (f.async f): |
| (f): |
| * test262/test/language/expressions/async-function/nameless-eval-var-scope-syntax-err.js: Added. |
| * test262/test/language/expressions/async-generator/eval-var-scope-syntax-err.js: Added. |
| * test262/test/language/expressions/async-generator/named-eval-var-scope-syntax-err.js: Added. |
| (f.async g): |
| (f): |
| * test262/test/language/expressions/bitwise-and/bigint-and-number.js: |
| * test262/test/language/expressions/bitwise-and/bigint-errors.js: |
| * test262/test/language/expressions/bitwise-and/bigint-non-primitive.js: |
| * test262/test/language/expressions/bitwise-and/bigint-toprimitive.js: |
| * test262/test/language/expressions/bitwise-and/bigint-wrapped-values.js: |
| * test262/test/language/expressions/bitwise-not/bigint-non-primitive.js: |
| * test262/test/language/expressions/bitwise-or/bigint-and-number.js: |
| * test262/test/language/expressions/bitwise-or/bigint-errors.js: |
| * test262/test/language/expressions/bitwise-or/bigint-non-primitive.js: |
| * test262/test/language/expressions/bitwise-or/bigint-toprimitive.js: |
| * test262/test/language/expressions/bitwise-or/bigint-wrapped-values.js: |
| * test262/test/language/expressions/bitwise-xor/bigint-and-number.js: |
| * test262/test/language/expressions/bitwise-xor/bigint-errors.js: |
| * test262/test/language/expressions/bitwise-xor/bigint-non-primitive.js: |
| * test262/test/language/expressions/bitwise-xor/bigint-toprimitive.js: |
| * test262/test/language/expressions/bitwise-xor/bigint-wrapped-values.js: |
| * test262/test/language/expressions/class/async-gen-method-static/eval-var-scope-syntax-err.js: Added. |
| (C): |
| * test262/test/language/expressions/class/async-gen-method/eval-var-scope-syntax-err.js: Added. |
| (C): |
| * test262/test/language/expressions/class/async-method-static/eval-var-scope-syntax-err.js: Added. |
| (C): |
| (then): |
| * test262/test/language/expressions/class/async-method/eval-var-scope-syntax-err.js: Added. |
| (C): |
| (SyntaxError.then): |
| * test262/test/language/expressions/class/elements/syntax/early-errors/grammar-private-field-optional-chaining.js: Added. |
| (C.prototype.access): |
| * test262/test/language/expressions/class/gen-method-static/eval-var-scope-syntax-err.js: Added. |
| (C): |
| * test262/test/language/expressions/class/gen-method/eval-var-scope-syntax-err.js: Added. |
| (C): |
| * test262/test/language/expressions/class/method-static/eval-var-scope-syntax-err.js: Added. |
| (C): |
| * test262/test/language/expressions/class/method/eval-var-scope-syntax-err.js: Added. |
| (C): |
| * test262/test/language/expressions/coalesce/cannot-chain-head-with-logical-and.js: |
| * test262/test/language/expressions/coalesce/cannot-chain-head-with-logical-or.js: |
| * test262/test/language/expressions/coalesce/cannot-chain-tail-with-logical-and.js: |
| * test262/test/language/expressions/coalesce/cannot-chain-tail-with-logical-or.js: |
| * test262/test/language/expressions/delete/super-property.js: |
| (C): |
| * test262/test/language/expressions/division/bigint-and-number.js: |
| * test262/test/language/expressions/division/bigint-arithmetic.js: |
| * test262/test/language/expressions/division/bigint-complex-infinity.js: |
| * test262/test/language/expressions/division/bigint-errors.js: |
| * test262/test/language/expressions/division/bigint-toprimitive.js: |
| * test262/test/language/expressions/division/bigint-wrapped-values.js: |
| * test262/test/language/expressions/does-not-equals/bigint-and-bigint.js: |
| * test262/test/language/expressions/does-not-equals/bigint-and-boolean.js: |
| * test262/test/language/expressions/does-not-equals/bigint-and-incomparable-primitive.js: |
| * test262/test/language/expressions/does-not-equals/bigint-and-non-finite.js: |
| * test262/test/language/expressions/does-not-equals/bigint-and-number-extremes.js: |
| * test262/test/language/expressions/does-not-equals/bigint-and-number.js: |
| * test262/test/language/expressions/does-not-equals/bigint-and-object.js: |
| * test262/test/language/expressions/does-not-equals/bigint-and-string.js: |
| * test262/test/language/expressions/equals/bigint-and-bigint.js: |
| * test262/test/language/expressions/equals/bigint-and-boolean.js: |
| * test262/test/language/expressions/equals/bigint-and-incomparable-primitive.js: |
| * test262/test/language/expressions/equals/bigint-and-non-finite.js: |
| * test262/test/language/expressions/equals/bigint-and-number-extremes.js: |
| * test262/test/language/expressions/equals/bigint-and-number.js: |
| * test262/test/language/expressions/equals/bigint-and-object.js: |
| * test262/test/language/expressions/equals/bigint-and-string.js: |
| * test262/test/language/expressions/exponentiation/bigint-and-number.js: |
| * test262/test/language/expressions/exponentiation/bigint-arithmetic.js: |
| * test262/test/language/expressions/exponentiation/bigint-errors.js: |
| * test262/test/language/expressions/exponentiation/bigint-negative-exponent-throws.js: |
| * test262/test/language/expressions/exponentiation/bigint-toprimitive.js: |
| * test262/test/language/expressions/exponentiation/bigint-wrapped-values.js: |
| * test262/test/language/expressions/exponentiation/bigint-zero-base-zero-exponent.js: |
| * test262/test/language/expressions/function/eval-var-scope-syntax-err.js: Added. |
| (f): |
| * test262/test/language/expressions/function/scope-param-elem-var-close.js: |
| * test262/test/language/expressions/function/scope-param-elem-var-open.js: |
| * test262/test/language/expressions/function/scope-param-rest-elem-var-close.js: |
| * test262/test/language/expressions/function/scope-param-rest-elem-var-open.js: |
| * test262/test/language/expressions/generators/eval-var-scope-syntax-err.js: Added. |
| (f): |
| * test262/test/language/expressions/generators/scope-param-elem-var-close.js: |
| * test262/test/language/expressions/generators/scope-param-elem-var-open.js: |
| * test262/test/language/expressions/generators/scope-param-rest-elem-var-close.js: |
| * test262/test/language/expressions/generators/scope-param-rest-elem-var-open.js: |
| * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: |
| * test262/test/language/expressions/greater-than-or-equal/bigint-and-incomparable-string.js: |
| * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: |
| * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: |
| * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js: |
| * test262/test/language/expressions/greater-than-or-equal/bigint-and-string.js: |
| * test262/test/language/expressions/greater-than/bigint-and-bigint.js: |
| * test262/test/language/expressions/greater-than/bigint-and-boolean.js: |
| * test262/test/language/expressions/greater-than/bigint-and-incomparable-string.js: |
| * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: |
| * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: |
| * test262/test/language/expressions/greater-than/bigint-and-number.js: |
| * test262/test/language/expressions/greater-than/bigint-and-symbol.js: |
| * test262/test/language/expressions/left-shift/bigint-and-number.js: |
| * test262/test/language/expressions/left-shift/bigint-errors.js: |
| * test262/test/language/expressions/left-shift/bigint-non-primitive.js: |
| * test262/test/language/expressions/left-shift/bigint-toprimitive.js: |
| * test262/test/language/expressions/left-shift/bigint-wrapped-values.js: |
| * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: |
| * test262/test/language/expressions/less-than-or-equal/bigint-and-incomparable-string.js: |
| * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: |
| * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: |
| * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js: |
| * test262/test/language/expressions/less-than-or-equal/bigint-and-string.js: |
| * test262/test/language/expressions/less-than/bigint-and-bigint.js: |
| * test262/test/language/expressions/less-than/bigint-and-boolean.js: |
| * test262/test/language/expressions/less-than/bigint-and-incomparable-string.js: |
| * test262/test/language/expressions/less-than/bigint-and-non-finite.js: |
| * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: |
| * test262/test/language/expressions/less-than/bigint-and-number.js: |
| * test262/test/language/expressions/modulus/bigint-and-number.js: |
| * test262/test/language/expressions/modulus/bigint-arithmetic.js: |
| * test262/test/language/expressions/modulus/bigint-errors.js: |
| * test262/test/language/expressions/modulus/bigint-modulo-zero.js: |
| * test262/test/language/expressions/modulus/bigint-toprimitive.js: |
| * test262/test/language/expressions/modulus/bigint-wrapped-values.js: |
| * test262/test/language/expressions/multiplication/bigint-and-number.js: |
| * test262/test/language/expressions/multiplication/bigint-arithmetic.js: |
| * test262/test/language/expressions/multiplication/bigint-errors.js: |
| * test262/test/language/expressions/multiplication/bigint-toprimitive.js: |
| * test262/test/language/expressions/multiplication/bigint-wrapped-values.js: |
| * test262/test/language/expressions/object/method-definition/async-gen-meth-eval-var-scope-syntax-err.js: Added. |
| (obj.async method): |
| * test262/test/language/expressions/object/method-definition/async-meth-eval-var-scope-syntax-err.js: Added. |
| (obj.async method): |
| (SyntaxError.then): |
| * test262/test/language/expressions/object/method-definition/gen-meth-eval-var-scope-syntax-err.js: Added. |
| (obj.method.a.eval): |
| * test262/test/language/expressions/object/method-definition/meth-eval-var-scope-syntax-err.js: Added. |
| (obj.method.a.eval): |
| * test262/test/language/expressions/object/scope-gen-meth-param-elem-var-close.js: |
| * test262/test/language/expressions/object/scope-gen-meth-param-elem-var-open.js: |
| * test262/test/language/expressions/object/scope-gen-meth-param-rest-elem-var-close.js: |
| * test262/test/language/expressions/object/scope-gen-meth-param-rest-elem-var-open.js: |
| * test262/test/language/expressions/object/scope-meth-param-elem-var-close.js: |
| * test262/test/language/expressions/object/scope-meth-param-elem-var-open.js: |
| * test262/test/language/expressions/object/scope-meth-param-rest-elem-var-close.js: |
| * test262/test/language/expressions/object/scope-meth-param-rest-elem-var-open.js: |
| * test262/test/language/expressions/optional-chaining/iteration-statement-do.js: Added. |
| * test262/test/language/expressions/optional-chaining/iteration-statement-for-await-of.js: Added. |
| (const.obj.iterable.Symbol.asyncIterator): |
| (async checkAssertions): |
| * test262/test/language/expressions/optional-chaining/iteration-statement-for-in.js: Added. |
| * test262/test/language/expressions/optional-chaining/iteration-statement-for-of-type-error.js: Added. |
| * test262/test/language/expressions/optional-chaining/iteration-statement-for.js: Added. |
| (const.obj3.get a): |
| * test262/test/language/expressions/optional-chaining/iteration-statement-while.js: Added. |
| * test262/test/language/expressions/optional-chaining/new-target-optional-call.js: Added. |
| (const.newTargetContext): |
| (Base): |
| (Foo): |
| * test262/test/language/expressions/optional-chaining/optional-call-preserves-this.js: Added. |
| (const.a.b): |
| * test262/test/language/expressions/optional-chaining/super-property-optional-call.js: Added. |
| (Base.prototype.method): |
| (Base): |
| (Foo.prototype.method): |
| (Foo): |
| * test262/test/language/expressions/right-shift/bigint-and-number.js: |
| * test262/test/language/expressions/right-shift/bigint-errors.js: |
| * test262/test/language/expressions/right-shift/bigint-non-primitive.js: |
| * test262/test/language/expressions/right-shift/bigint-toprimitive.js: |
| * test262/test/language/expressions/right-shift/bigint-wrapped-values.js: |
| * test262/test/language/expressions/strict-does-not-equals/bigint-and-bigint.js: |
| * test262/test/language/expressions/strict-does-not-equals/bigint-and-boolean.js: |
| * test262/test/language/expressions/strict-does-not-equals/bigint-and-incomparable-primitive.js: |
| * test262/test/language/expressions/strict-does-not-equals/bigint-and-non-finite.js: |
| * test262/test/language/expressions/strict-does-not-equals/bigint-and-number-extremes.js: |
| * test262/test/language/expressions/strict-does-not-equals/bigint-and-number.js: |
| * test262/test/language/expressions/strict-does-not-equals/bigint-and-object.js: |
| * test262/test/language/expressions/strict-does-not-equals/bigint-and-string.js: |
| * test262/test/language/expressions/strict-equals/bigint-and-bigint.js: |
| * test262/test/language/expressions/strict-equals/bigint-and-boolean.js: |
| * test262/test/language/expressions/strict-equals/bigint-and-incomparable-primitive.js: |
| * test262/test/language/expressions/strict-equals/bigint-and-non-finite.js: |
| * test262/test/language/expressions/strict-equals/bigint-and-number-extremes.js: |
| * test262/test/language/expressions/strict-equals/bigint-and-number.js: |
| * test262/test/language/expressions/strict-equals/bigint-and-object.js: |
| * test262/test/language/expressions/strict-equals/bigint-and-string.js: |
| * test262/test/language/expressions/subtraction/bigint-and-number.js: |
| * test262/test/language/expressions/subtraction/bigint-arithmetic.js: |
| * test262/test/language/expressions/subtraction/bigint-errors.js: |
| * test262/test/language/expressions/subtraction/bigint-toprimitive.js: |
| * test262/test/language/expressions/subtraction/bigint-wrapped-values.js: |
| * test262/test/language/expressions/typeof/proxy.js: Added. |
| (assert.sameValue.typeof.new.Proxy): |
| (const.rp2.Proxy.revocable): |
| * test262/test/language/expressions/unary-minus/bigint-non-primitive.js: |
| * test262/test/language/expressions/unary-plus/bigint-throws.js: |
| * test262/test/language/expressions/unsigned-right-shift/bigint-and-number.js: |
| * test262/test/language/expressions/unsigned-right-shift/bigint-errors.js: |
| * test262/test/language/expressions/unsigned-right-shift/bigint-non-primitive.js: |
| * test262/test/language/expressions/unsigned-right-shift/bigint-toprimitive.js: |
| * test262/test/language/expressions/unsigned-right-shift/bigint-wrapped-values.js: |
| * test262/test/language/function-code/eval-param-env-with-computed-key.js: |
| * test262/test/language/function-code/eval-param-env-with-prop-initializer.js: |
| * test262/test/language/statements/async-function/eval-var-scope-syntax-err.js: Added. |
| (async f): |
| (SyntaxError.then): |
| * test262/test/language/statements/async-generator/eval-var-scope-syntax-err.js: Added. |
| (async f): |
| * test262/test/language/statements/class/async-gen-method-static/eval-var-scope-syntax-err.js: Added. |
| (C.async method): |
| (C): |
| * test262/test/language/statements/class/async-gen-method/eval-var-scope-syntax-err.js: Added. |
| (C.prototype.async method): |
| (C): |
| * test262/test/language/statements/class/async-method-static/eval-var-scope-syntax-err.js: Added. |
| (C.async method): |
| (C): |
| (SyntaxError.then): |
| * test262/test/language/statements/class/async-method/eval-var-scope-syntax-err.js: Added. |
| (C.prototype.async method): |
| (C): |
| (SyntaxError.then): |
| * test262/test/language/statements/class/definition/constructable-but-no-prototype.js: |
| * test262/test/language/statements/class/definition/constructor-strict-by-default.js: |
| * test262/test/language/statements/class/definition/getters-restricted-ids.js: |
| * test262/test/language/statements/class/definition/implicit-constructor.js: |
| * test262/test/language/statements/class/definition/invalid-extends.js: |
| * test262/test/language/statements/class/definition/methods-named-eval-arguments.js: |
| * test262/test/language/statements/class/definition/prototype-getter.js: |
| * test262/test/language/statements/class/definition/prototype-property.js: |
| * test262/test/language/statements/class/definition/setters-restricted-ids.js: |
| * test262/test/language/statements/class/definition/side-effects-in-extends.js: |
| * test262/test/language/statements/class/definition/side-effects-in-property-define.js: |
| * test262/test/language/statements/class/definition/this-access-restriction-2.js: |
| * test262/test/language/statements/class/definition/this-access-restriction.js: |
| * test262/test/language/statements/class/definition/this-check-ordering.js: |
| * test262/test/language/statements/class/elements/syntax/early-errors/grammar-private-field-optional-chaining.js: Added. |
| (C.prototype.access): |
| (C): |
| * test262/test/language/statements/class/gen-method-static/eval-var-scope-syntax-err.js: Added. |
| (C.method): |
| (C): |
| * test262/test/language/statements/class/gen-method/eval-var-scope-syntax-err.js: Added. |
| (C.prototype.method): |
| (C): |
| * test262/test/language/statements/class/method-static/eval-var-scope-syntax-err.js: Added. |
| (C.method): |
| (C): |
| * test262/test/language/statements/class/method/eval-var-scope-syntax-err.js: Added. |
| (C.prototype.method): |
| (C): |
| * test262/test/language/statements/class/name-binding/basic.js: |
| * test262/test/language/statements/class/subclass/binding.js: |
| * test262/test/language/statements/class/subclass/builtin-objects/RegExp/lastIndex.js: |
| * test262/test/language/statements/class/subclass/builtin-objects/String/length.js: |
| * test262/test/language/statements/class/subclass/builtin-objects/WeakMap/regular-subclassing.js: |
| * test262/test/language/statements/class/subclass/builtin-objects/WeakMap/super-must-be-called.js: |
| * test262/test/language/statements/class/subclass/builtin-objects/WeakSet/regular-subclassing.js: |
| * test262/test/language/statements/class/subclass/builtin-objects/WeakSet/super-must-be-called.js: |
| * test262/test/language/statements/class/subclass/builtins.js: |
| * test262/test/language/statements/class/subclass/default-constructor-spread-override.js: |
| * test262/test/language/statements/for-in/identifier-let-allowed-as-lefthandside-expression-not-strict.js: |
| * test262/test/language/statements/for-in/order-enumerable-shadowed.js: Added. |
| * test262/test/language/statements/for-in/order-property-added.js: Added. |
| * test262/test/language/statements/for-in/order-property-on-prototype.js: Added. |
| * test262/test/language/statements/for-in/order-simple-object.js: Added. |
| * test262/test/language/statements/function/eval-var-scope-syntax-err.js: Added. |
| (f): |
| * test262/test/language/statements/function/scope-param-elem-var-close.js: |
| * test262/test/language/statements/function/scope-param-elem-var-open.js: |
| * test262/test/language/statements/function/scope-param-rest-elem-var-close.js: |
| * test262/test/language/statements/function/scope-param-rest-elem-var-open.js: |
| * test262/test/language/statements/generators/eval-var-scope-syntax-err.js: Added. |
| (f): |
| * test262/test/language/statements/generators/scope-param-elem-var-close.js: |
| * test262/test/language/statements/generators/scope-param-elem-var-open.js: |
| * test262/test/language/statements/generators/scope-param-rest-elem-var-close.js: |
| * test262/test/language/statements/generators/scope-param-rest-elem-var-open.js: |
| * test262/test262-Revision.txt: |
| |
| 2020-01-03 Saam Barati <sbarati@apple.com> |
| |
| B3::ReduceLoopStrength should not do range based iteration on a vector it's mutating |
| https://bugs.webkit.org/show_bug.cgi?id=205703 |
| <rdar://problem/56459483> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/dont-range-based-iterate-vector-that-is-mutated.js: Added. |
| (foo): |
| |
| 2020-01-03 Saam Barati <sbarati@apple.com> |
| |
| AI rule for PutById can only observe transitions when it watches the condition |
| https://bugs.webkit.org/show_bug.cgi?id=205697 |
| <rdar://problem/56814254> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/only-transition-structures-for-put-by-id-in-AI-if-watchable.js: Added. |
| |
| 2020-01-02 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| REGRESSION (r253867): Six test262 tests broken |
| https://bugs.webkit.org/show_bug.cgi?id=205583 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/bound-function-empty-name.js: Added. |
| (shouldBe): |
| |
| 2019-12-23 Keith Miller <keith_miller@apple.com> |
| |
| DFG/FTL should be able to exit to the middle of a bytecode |
| https://bugs.webkit.org/show_bug.cgi?id=205232 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/apply-osr-exit-should-get-length-once-exceptions-occasionally.js: Added. |
| (expectedArgCount): |
| (callee): |
| (test): |
| (let.array.get length): |
| * stress/apply-osr-exit-should-get-length-once.js: Added. |
| (expectedArgCount): |
| (callee): |
| (test): |
| (let.array.get length): |
| * stress/load-varargs-then-inlined-call-and-exit-strict.js: |
| (checkEqual): |
| * stress/recursive-tail-call-with-different-argument-count.js: |
| * stress/rest-varargs-osr-exit-to-checkpoint.js: Added. |
| (foo): |
| (bar): |
| |
| 2019-12-23 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Wasm OSR entry should capture top-most enclosing-stack |
| https://bugs.webkit.org/show_bug.cgi?id=205571 |
| |
| Reviewed by Keith Miller. |
| |
| * wasm/stress/top-most-enclosing-stack.js: Added. |
| |
| 2019-12-21 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Improve our bound function implementation |
| https://bugs.webkit.org/show_bug.cgi?id=205327 |
| |
| Reviewed by Keith Miller. |
| |
| * microbenchmarks/function-bind-no-inlining-repeat-call.js: Added. |
| (assert): |
| (test): |
| (test2): |
| (foo): |
| (let.start.Date.now): |
| * stress/bind-args.js: Added. |
| (shouldBe): |
| (test): |
| (test2): |
| |
| 2019-12-17 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] 8Bit JSRopeString can contain 16Bit string in its rope |
| https://bugs.webkit.org/show_bug.cgi?id=205323 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/8bit-resolve-can-encounter-16bit-string.js: Added. |
| (foo): |
| |
| 2019-12-13 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Remove JSFixedArray, and use JSImmutableButterfly instead |
| https://bugs.webkit.org/show_bug.cgi?id=204402 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/new-array-with-spread-cow-double.js: Added. |
| (shouldBe): |
| (shouldBeArray): |
| (test): |
| * stress/new-array-with-spread-cow-int.js: Added. |
| (shouldBe): |
| (shouldBeArray): |
| (test): |
| * stress/new-array-with-spread-cow.js: Added. |
| (shouldBe): |
| (shouldBeArray): |
| (test): |
| |
| 2019-12-13 Mark Lam <mark.lam@apple.com> |
| |
| Fix bad exception assertion in ExceptionHelpers.cpp's createError(). |
| https://bugs.webkit.org/show_bug.cgi?id=205230 |
| <rdar://problem/57875688> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/test-exception-assert-in-ExceptionHelpers-createError.js: Added. |
| |
| 2019-12-12 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Wasm init-expr should reject mutable globals |
| https://bugs.webkit.org/show_bug.cgi?id=205191 |
| |
| Reviewed by Mark Lam. |
| |
| * wasm/js-api/global-error.js: |
| (assert.throws.new.WebAssembly.Module.bin): |
| (new.WebAssembly.Module): Deleted. |
| (assert.throws): Deleted. |
| (new.Number): Deleted. |
| |
| 2019-12-12 Mark Lam <mark.lam@apple.com> |
| |
| Fix missing exception in JSValue::toWTFStringSlowCase(). |
| https://bugs.webkit.org/show_bug.cgi?id=205176 |
| <rdar://problem/57871899> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js: Added. |
| |
| 2019-12-12 Mark Lam <mark.lam@apple.com> |
| |
| Fix missing exception check in JSON Stringifier's gap function. |
| https://bugs.webkit.org/show_bug.cgi?id=205171 |
| <rdar://problem/57871842> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/missing-exception-check-in-json-stringifier-gap.js: Added. |
| |
| 2019-12-12 Mark Lam <mark.lam@apple.com> |
| |
| DFG and FTL expects String.prototype to not qualify for StringObjectUse. |
| https://bugs.webkit.org/show_bug.cgi?id=205147 |
| <rdar://problem/57748888> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/ftl-expects-string-prototype-to-not-be-StringObjectUse.js: Added. |
| |
| 2019-12-11 Keith Miller <keith_miller@apple.com> |
| |
| Add test for osr exiting with interpreter on the stack |
| https://bugs.webkit.org/show_bug.cgi?id=205124 |
| |
| Reviewed by Mark Lam. |
| |
| I forgot to add this test before. |
| |
| * stress/osr-exit-with-interpreter-on-stack.js: Added. |
| (foo): |
| |
| 2019-12-10 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Adhocly created CallLinkInfo in GetterSetterAccess should be owned by GCAwareJITStubRoutine |
| https://bugs.webkit.org/show_bug.cgi?id=204876 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/code-emitted-by-getter-setter-access-case-should-hold-ownership-of-call-link-info.js: Added. |
| (func): |
| |
| 2019-12-09 Tadeu Zagallo <tzagallo@apple.com> |
| |
| REGRESSION(r253140): WebAssembly validation should check for unmatched else before calling addElse/addElseToUnreachable |
| https://bugs.webkit.org/show_bug.cgi?id=205022 |
| <rdar://problem/57748159> |
| |
| Reviewed by Saam Barati. |
| |
| * wasm/regress/unmatched-else.js: Added. |
| (catch): |
| |
| 2019-12-08 Tadeu Zagallo <tzagallo@apple.com> |
| |
| [WebAssembly] Fix LLIntGenerator's checkConsistency contract |
| https://bugs.webkit.org/show_bug.cgi?id=204998 |
| <rdar://problem/57733405> |
| |
| Reviewed by Mark Lam. |
| |
| * wasm/regress/stack-consistency.js: Added. |
| |
| 2019-12-08 Caio Lima <ticaiolima@gmail.com> |
| |
| [ARMv7] Skip flaky stress tests |
| https://bugs.webkit.org/show_bug.cgi?id=204996 |
| |
| Unreviewed gardening. |
| |
| * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js: |
| * stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js: |
| |
| 2019-12-07 Mark Lam <mark.lam@apple.com> |
| |
| Object.prototype.isPrototypeOf() should check if the passed in value is a non-object first. |
| https://bugs.webkit.org/show_bug.cgi?id=204971 |
| <rdar://problem/57730080> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/object-prototype-isPrototypeOf-should-check-for-non-object-first.js: Added. |
| |
| 2019-12-06 Mark Lam <mark.lam@apple.com> |
| |
| The compiler thread should not adjust Identifier refCounts. |
| https://bugs.webkit.org/show_bug.cgi?id=204919 |
| <rdar://problem/57426861> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/compiler-thread-should-not-ref-identifiers.js: Added. |
| |
| 2019-12-04 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] AI should convert IsCellWithType to constant when Structure set is finite |
| https://bugs.webkit.org/show_bug.cgi?id=204141 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/generator-cell-with-type.js: Added. |
| (shouldBe): |
| (shouldThrow): |
| (test): |
| (i.shouldThrow): |
| * stress/is-cell-with-type-should-check-non-cell-cases.js: Added. |
| (getter): |
| (foo): |
| |
| 2019-12-04 Mark Lam <mark.lam@apple.com> |
| |
| Fix missing exception check in ArrayPrototype's fastJoin(). |
| https://bugs.webkit.org/show_bug.cgi?id=204868 |
| <rdar://problem/57516684> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/missing-exception-check-in-array-prototype-fastJoin.js: Added. |
| |
| 2019-12-04 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Unreviewed, rolling out r252416, vimeo does not work |
| https://bugs.webkit.org/show_bug.cgi?id=204141 |
| |
| * stress/generator-cell-with-type.js: Removed. |
| |
| 2019-12-04 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] JSWebAssemblyGlobal creation should have exception check |
| https://bugs.webkit.org/show_bug.cgi?id=204857 |
| <rdar://problem/57618579> |
| |
| Reviewed by Mark Lam. |
| |
| * wasm/regress/wasm-global-creation-can-throw-an-exception.js: Added. |
| |
| 2019-12-04 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Update Wasm spec-tests |
| https://bugs.webkit.org/show_bug.cgi?id=204844 |
| |
| Reviewed by Keith Miller. |
| |
| To get broader coverage, we update Wasm spec-tests to the latest one[1]. |
| |
| [1]: 3e5fdc6b51ca2cde537bb8ecb1ba25c1ee366833 |
| |
| * wasm.yaml: |
| * wasm/spec-tests/address.wast.js: |
| * wasm/spec-tests/align.wast.js: |
| * wasm/spec-tests/binary-leb128.wast.js: Added. |
| * wasm/spec-tests/binary.wast.js: |
| * wasm/spec-tests/block.wast.js: |
| * wasm/spec-tests/br.wast.js: |
| * wasm/spec-tests/br_if.wast.js: |
| * wasm/spec-tests/br_table.wast.js: |
| * wasm/spec-tests/call_indirect.wast.js: |
| * wasm/spec-tests/const.wast.js: |
| * wasm/spec-tests/conversions.wast.js: |
| * wasm/spec-tests/custom.wast.js: Added. |
| * wasm/spec-tests/data.wast.js: Added. |
| * wasm/spec-tests/elem.wast.js: Added. |
| * wasm/spec-tests/endianness.wast.js: |
| * wasm/spec-tests/f32.wast.js: |
| * wasm/spec-tests/f32_bitwise.wast.js: |
| * wasm/spec-tests/f32_cmp.wast.js: |
| * wasm/spec-tests/f64.wast.js: |
| * wasm/spec-tests/f64_bitwise.wast.js: |
| * wasm/spec-tests/f64_cmp.wast.js: |
| * wasm/spec-tests/fac.wast.js: |
| * wasm/spec-tests/float_exprs.wast.js: |
| * wasm/spec-tests/float_literals.wast.js: |
| * wasm/spec-tests/float_memory.wast.js: |
| * wasm/spec-tests/func.wast.js: |
| * wasm/spec-tests/func_ptrs.wast.js: |
| * wasm/spec-tests/i32.wast.js: |
| * wasm/spec-tests/i64.wast.js: |
| * wasm/spec-tests/imports.wast.js: |
| * wasm/spec-tests/int_exprs.wast.js: |
| * wasm/spec-tests/int_literals.wast.js: |
| * wasm/spec-tests/labels.wast.js: |
| * wasm/spec-tests/left-to-right.wast.js: |
| * wasm/spec-tests/load.wast.js: Added. |
| * wasm/spec-tests/local_get.wast.js: Added. |
| * wasm/spec-tests/local_set.wast.js: Added. |
| * wasm/spec-tests/local_tee.wast.js: Added. |
| * wasm/spec-tests/loop.wast.js: |
| * wasm/spec-tests/memory_grow.wast.js: Added. |
| * wasm/spec-tests/memory_size.wast.js: Added. |
| * wasm/spec-tests/memory_trap.wast.js: |
| * wasm/spec-tests/names.wast.js: |
| * wasm/spec-tests/nop.wast.js: |
| * wasm/spec-tests/return.wast.js: |
| * wasm/spec-tests/select.wast.js: |
| * wasm/spec-tests/stack.wast.js: |
| * wasm/spec-tests/start.wast.js: |
| * wasm/spec-tests/store.wast.js: Added. |
| * wasm/spec-tests/switch.wast.js: |
| * wasm/spec-tests/traps.wast.js: |
| * wasm/spec-tests/type.wast.js: |
| * wasm/spec-tests/unreachable.wast.js: |
| * wasm/spec-tests/unreached-invalid.wast.js: |
| * wasm/spec-tests/unwind.wast.js: |
| * wasm/spec-tests/utf8-custom-section-id.wast.js: |
| * wasm/spec-tests/utf8-import-field.wast.js: |
| * wasm/spec-tests/utf8-import-module.wast.js: |
| * wasm/spec-tests/utf8-invalid-encoding.wast.js: Added. |
| |
| 2019-12-03 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Adopt the new WebAssembly.Global system |
| https://bugs.webkit.org/show_bug.cgi?id=186552 |
| |
| Reviewed by Keith Miller. |
| |
| 1. Update spec-harness to accept newer tests. And we update several tests that does not work with the old harness. |
| 2. Add WebAssembly.Global tests. |
| |
| * wasm/js-api/global-error.js: |
| (assert.throws.new.WebAssembly.Module.bin): |
| (new.WebAssembly.Module): |
| (assert.throws): |
| * wasm/js-api/global-external-init-from-import.js: |
| * wasm/js-api/globals-export.js: |
| * wasm/modules/js-wasm-global-namespace.js: |
| (assert.throws): |
| * wasm/modules/js-wasm-global.js: |
| (assert.throws): |
| * wasm/modules/wasm-import-wasm-export-i64-error.js: |
| * wasm/references/anyref_globals.js: |
| * wasm/references/func_ref.js: |
| (assert.eq.instance.exports.fix): |
| * wasm/spec-harness.js: |
| (getGlobal): |
| (let.console.log): |
| * wasm/spec-harness/sync_index.js: Renamed from JSTests/wasm/spec-harness/index.js. |
| (reinitializeRegistry.let.handler.get return): |
| (module): |
| * wasm/spec-tests/call.wast.js: |
| * wasm/spec-tests/exports.wast.js: |
| * wasm/spec-tests/globals.wast.js: |
| * wasm/spec-tests/if.wast.js: |
| * wasm/spec-tests/imports.wast.js: |
| * wasm/spec-tests/linking.wast.js: |
| * wasm/spec-tests/memory.wast.js: |
| * wasm/stress/immutable-globals.js: Added. |
| (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.i.assert.eq.instance.exports.getI32): |
| (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.i.assert.eq): |
| * wasm/stress/mutable-globals-cross.js: Added. |
| (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.instance1): |
| (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.instance2): |
| * wasm/stress/mutable-globals.js: Added. |
| (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.i.instance.exports.setI32AsI64): |
| |
| 2019-12-03 Christopher Reid <chris.reid@sony.com> |
| |
| Regular expression hangs in Safari only |
| https://bugs.webkit.org/show_bug.cgi?id=202882 |
| <rdar://problem/56236654> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/regress-202882.js: Added. |
| |
| 2019-12-02 Saam Barati <sbarati@apple.com> |
| |
| PropertySlot should not have Customs have a PropertyOffset of zero |
| https://bugs.webkit.org/show_bug.cgi?id=204566 |
| <rdar://problem/57466781> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/cacheable-custom-accessor-should-not-have-property-offset.js: Added. |
| |
| 2019-12-02 Mark Lam <mark.lam@apple.com> |
| |
| mozilla-tests.yaml/js1_5/Array/regress-101964.js is frequently failing on JSC EWS bots. |
| https://bugs.webkit.org/show_bug.cgi?id=200789 |
| <rdar://problem/54361916> |
| |
| Reviewed by Keith Miller. |
| |
| The prevailing theory is that this test is being pre-empted and not getting the |
| CPU time it needs to complete. As a result, the wall clock time period for |
| running the test exceeds the expected time. This patch tests this theory by |
| changing the time measurement to use CPU time instead. |
| |
| * mozilla/js1_5/Array/regress-101964.js: |
| |
| 2019-12-01 Caio Lima <ticaiolima@gmail.com> |
| |
| [JSC][MIPS] CallFrame is being clobbered on InternalFunction execution |
| https://bugs.webkit.org/show_bug.cgi?id=203739 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/has-instance-exception-check.js: |
| * stress/regress-176485.js: |
| |
| 2019-11-30 Ross Kirsling <ross.kirsling@sony.com> |
| |
| test262-runner should dump YAML with correct encoding |
| https://bugs.webkit.org/show_bug.cgi?id=204493 |
| |
| Reviewed by Saam Barati. |
| |
| * test262/expectations.yaml: |
| Fix double-encoding of test failure output. |
| |
| 2019-11-23 Ross Kirsling <ross.kirsling@sony.com> |
| |
| [JSC] GetSubstitution is performed incorrectly via RegExp.prototype[@@replace] |
| https://bugs.webkit.org/show_bug.cgi?id=204490 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/replace-indexed-backreferences.js: Added. |
| * test262/expectations.yaml: Mark four test cases as passing. |
| |
| 2019-11-22 Tadeu Zagallo <tzagallo@apple.com> |
| |
| [WebAssembly] Improve Wasm::LLIntGenerator |
| https://bugs.webkit.org/show_bug.cgi?id=204092 |
| |
| Reviewed by Saam Barati. |
| |
| * wasm/stress/set-local-enclosed-stack.js: Added. |
| (assert.eq.instance.exports.foo): |
| (assert.eq): |
| |
| 2019-11-22 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] DFG terminal's liveness should respect caller's opcodeID |
| https://bugs.webkit.org/show_bug.cgi?id=204317 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/call-var-args-phantom-arguments-handler-strict.js: Added. |
| (shouldBe): |
| (inlined): |
| (test): |
| * stress/call-var-args-phantom-arguments-handler.js: Added. |
| (shouldBe): |
| (inlined): |
| (test): |
| * stress/call-var-args-phantom-arguments-strict.js: Added. |
| (shouldBe): |
| (inlined): |
| (test): |
| * stress/call-var-args-phantom-arguments.js: Added. |
| (shouldBe): |
| (inlined): |
| (test): |
| * stress/derived-class-construct-varargs.js: Added. |
| (shouldThrow): |
| (B): |
| * stress/tail-call-var-args-phantom-arguments-handler-strict.js: Added. |
| (shouldBe): |
| (inlined): |
| (test): |
| * stress/tail-call-var-args-phantom-arguments-handler.js: Added. |
| (shouldBe): |
| (inlined): |
| (test): |
| * stress/tail-call-var-args-phantom-arguments-strict.js: Added. |
| (shouldBe): |
| (inlined): |
| (test): |
| * stress/tail-call-var-args-phantom-arguments.js: Added. |
| (shouldBe): |
| (inlined): |
| (test): |
| |
| 2019-11-22 Guillaume Emont <guijemont@igalia.com> |
| |
| Skip tests that fail on arm and mips devices |
| https://bugs.webkit.org/show_bug.cgi?id=204522 |
| |
| Unreviewed gardening. |
| |
| |
| * stress/generator-cell-with-type.js: |
| * stress/stack-overflow-in-yarr-byteCompile.js: |
| * stress/toctou-having-a-bad-time-new-array.js: |
| |
| 2019-11-21 Mark Lam <mark.lam@apple.com> |
| |
| replaceUsingStringSearch() should not use CachedCall with host functions. |
| https://bugs.webkit.org/show_bug.cgi?id=204494 |
| <rdar://problem/57421078> |
| |
| Reviewed by Ross Kirsling. |
| |
| * stress/string-replaceAll-2.js: |
| |
| 2019-11-21 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Unreviewed test262 gardening following r252680. |
| |
| * test262/expectations.yaml: |
| Mark eight test cases as passing. |
| |
| 2019-11-21 Saam Barati <sbarati@apple.com> |
| |
| GetByStatus should not say it took the slow path for multiple identifiers and should have a way to indicate if the StructureStubInfo it saw took the slow path |
| https://bugs.webkit.org/show_bug.cgi?id=204435 |
| |
| Reviewed by Tadeu Zagallo. |
| |
| * microbenchmarks/get-by-val-polymorphic-ic-1.js: Added. |
| (assert): |
| (test1.foo): |
| (test1): |
| * microbenchmarks/get-by-val-polymorphic-ic-2.js: Added. |
| (assert): |
| (test2.foo): |
| (test2): |
| * microbenchmarks/get-by-val-polymorphic-ic-3.js: Added. |
| (assert): |
| (test3.foo): |
| (test3.args): |
| (test3): |
| * microbenchmarks/get-by-val-polymorphic-ic-4.js: Added. |
| (assert): |
| (test4.foo): |
| (test4.capture): |
| (test4.args): |
| (test4): |
| * microbenchmarks/get-by-val-polymorphic-ic-5.js: Added. |
| (assert): |
| (test5.foo): |
| (test5.capture): |
| (test5.args): |
| (test5): |
| * microbenchmarks/get-by-val-polymorphic-ic-6.js: Added. |
| (assert): |
| (test6.foo): |
| (test6.capture): |
| (test6.args): |
| (test6): |
| * microbenchmarks/get-by-val-polymorphic-ic-7.js: Added. |
| (assert): |
| (test7.foo): |
| (test7): |
| * microbenchmarks/get-by-val-polymorphic-ic-8.js: Added. |
| (assert): |
| (test7.foo): |
| (test7): |
| * microbenchmarks/get-by-val-polymorphic-ic-9.js: Added. |
| (assert): |
| (test7.foo): |
| (test7): |
| |
| 2019-11-21 Mark Lam <mark.lam@apple.com> |
| |
| Fix broken String.prototype.replace() and replaceAll(). |
| https://bugs.webkit.org/show_bug.cgi?id=204479 |
| <rdar://problem/57354854> |
| |
| Reviewed by Ross Kirsling and Yusuke Suzuki. |
| |
| * ChakraCore.yaml: |
| * ChakraCore/test/Strings/replace.baseline-jsc: Removed. |
| - We no longer need this because we've fixed the spec compliance issue in replace(). |
| * stress/string-replaceAll-2.js: Added. |
| |
| 2019-11-21 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Unreviewed, rolling in again, regression is not caused by it |
| https://bugs.webkit.org/show_bug.cgi?id=202471 |
| |
| * stress/string-replaceall.js: Added. |
| (shouldBe): |
| (shouldThrowTypeError): |
| (shouldBe.string_appeared_here.replaceAll.Symbol.match): |
| |
| 2019-11-21 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r252683 and r252721. |
| https://bugs.webkit.org/show_bug.cgi?id=204475 |
| |
| 13% regression in JetStream2/prepack-wtb (Requested by |
| yusukesuzuki on #webkit). |
| |
| Reverted changesets: |
| |
| "Implement String.prototype.replaceAll" |
| https://bugs.webkit.org/show_bug.cgi?id=202471 |
| https://trac.webkit.org/changeset/252683 |
| |
| "Unreviewed, address Darin's feedback on r252683." |
| https://trac.webkit.org/changeset/252721 |
| |
| 2019-11-20 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Unreviewed, address Darin's feedback on r252683. |
| |
| * stress/string-replaceall.js: |
| |
| 2019-11-20 Caio Lima <ticaiolima@gmail.com> |
| |
| [JSC] OSR exit to LLInt is broken on MIPS |
| https://bugs.webkit.org/show_bug.cgi?id=203737 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| Unskipping broken tests due to OSR to LLInt bug. |
| |
| * microbenchmarks/call-spread-call.js: |
| * microbenchmarks/throw.js: |
| * stress/allocation-sinking-hints-are-valid-ssa-2.js: |
| * stress/allocation-sinking-hints-are-valid-ssa.js: |
| * stress/arith-profile-for-negate-can-see-non-number-due-to-dfg-osr-exit-profiling.js: |
| * stress/arrowfunction-lexical-bind-supercall-4.js: |
| * stress/arrowfunction-tdz-3.js: |
| * stress/function-constructor-semantics.js: |
| * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: |
| * stress/stress-cleared-calllinkinfo.js: |
| * stress/typedarray-configure-index.js: |
| * stress/v8-deltablue-strict.js: |
| |
| 2019-11-20 Mark Lam <mark.lam@apple.com> |
| |
| Flaky JSC test: stress/stack-overflow-in-yarr-byteCompile.js.dfg-eager. |
| https://bugs.webkit.org/show_bug.cgi?id=204405 |
| |
| Reviewed by Alexey Proskuryakov. |
| |
| The test was timing out because it's slow. We don't really need to run this test |
| on all configurations. So, we'll change it to on run with the default |
| configuration. Also declare the test as "//@ slow!". |
| |
| * stress/stack-overflow-in-yarr-byteCompile.js: |
| |
| 2019-11-19 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Implement String.prototype.replaceAll |
| https://bugs.webkit.org/show_bug.cgi?id=202471 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/string-replaceall.js: Added. |
| |
| 2019-11-19 Robin Morisset <rmorisset@apple.com> |
| |
| [ESNext][BigInt] Add support for op_inc |
| https://bugs.webkit.org/show_bug.cgi?id=193240 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| Some parts of these tests are inspired by tests in a WIP patch by Caio Lima. |
| Thanks to him for allowing their reuse. |
| |
| * stress/inc-osr-exit-from-big-int.js: Added. |
| (let.assert.sameValue): |
| (postInc): |
| (preInc): |
| (postDec): |
| (preDec): |
| * stress/inc-osr-exit-to-big-int.js: Added. |
| (let.assert.sameValue): |
| (postInc): |
| (preInc): |
| (postDec): |
| (preDec): |
| (o.valueOf): |
| |
| 2019-11-19 Saam Barati <sbarati@apple.com> |
| |
| Remove runNullishAwareOperatorsEnabled |
| |
| Rubber-stamped by Keith Miller. |
| |
| * stress/nullish-coalescing.js: |
| * stress/optional-chaining.js: |
| * stress/tail-call-recognize.js: |
| |
| 2019-11-18 Keith Miller <keith_miller@apple.com> |
| |
| Enable Nullish operators by default |
| https://bugs.webkit.org/show_bug.cgi?id=204308 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| Remove feature -> option map. |
| |
| * test262/config.yaml: |
| |
| 2019-11-18 Caio Lima <ticaiolima@gmail.com> |
| |
| Skipping wasm-error-message-cross-threads.js on architectures without WASM support |
| https://bugs.webkit.org/show_bug.cgi?id=204293 |
| |
| Unreviewed gardening. |
| |
| * stress/ensure-code-block-is-not-precise-allocation.js: |
| |
| Skipping this test until we fix OSR to LLInt on MIPS. |
| |
| * stress/wasm-error-message-cross-threads.js: |
| |
| 2019-11-15 Ross Kirsling <ross.kirsling@sony.com> |
| |
| [JSC] Anonymous built-in functions should have empty string for a name |
| https://bugs.webkit.org/show_bug.cgi?id=204214 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * test262/expectations.yaml: |
| Mark 20 test cases as passing. |
| |
| * stress/builtin-function-name.js: |
| (shouldThrow): |
| * stress/private-name-as-anonymous-builtin.js: |
| Fix tests which are no longer accurate. |
| |
| 2019-11-15 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] DFG strength reduction should define "groups" for RegExp constant-folded result |
| https://bugs.webkit.org/show_bug.cgi?id=204264 |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/dfg-strength-reduction-for-regexp-should-include-groups-property.js: Added. |
| (shouldBe): |
| (test): |
| |
| 2019-11-15 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Wasm error message should be cross-thread-copied |
| https://bugs.webkit.org/show_bug.cgi?id=204143 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/wasm-error-message-cross-threads.js: Added. |
| (f): |
| |
| 2019-11-14 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Use toLength() and getIndexQuickly() in JSON.stringify |
| https://bugs.webkit.org/show_bug.cgi?id=204122 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * microbenchmarks/json-stringify-array-replacer.js: Added. |
| * microbenchmarks/json-stringify-empty-array.js: Added. |
| |
| 2019-11-14 Caio Lima <ticaiolima@gmail.com> |
| |
| Support or16(TrustedImm32, AbsoluteAddress) in the MIPS MacroAssembler |
| https://bugs.webkit.org/show_bug.cgi?id=204126 |
| |
| Reviewed by Mark Lam. |
| |
| Decreasing the number of iterations of test to avoid timeout into slow |
| ports. |
| |
| * stress/regress-57020338.js: |
| |
| 2019-11-13 Robin Morisset <rmorisset@apple.com> |
| |
| Split ArithProfile into a Unary and a Binary version |
| https://bugs.webkit.org/show_bug.cgi?id=202832 |
| <rdar://problem/56266847> |
| |
| Reviewed by Keith Miller. |
| |
| The new test (kindly provided by Mark Lam) catches the metadata corruption that used to happen in the previous version of this patch. |
| |
| * stress/regress-57020338.js: Added. |
| |
| 2019-11-13 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] AI should convert IsCellWithType to constant when Structure set is finite |
| https://bugs.webkit.org/show_bug.cgi?id=204141 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/generator-cell-with-type.js: Added. |
| (shouldBe): |
| (shouldThrow): |
| (test): |
| (i.shouldThrow): |
| |
| 2019-11-12 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] JSC GC relies on CodeBlock is not PreciseAllocation |
| https://bugs.webkit.org/show_bug.cgi?id=204124 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/ensure-code-block-is-not-precise-allocation.js: Added. |
| (foo): |
| (get for): |
| |
| 2019-11-12 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| RegExpBuiltinExec should create "groups" property unconditionally |
| https://bugs.webkit.org/show_bug.cgi?id=204067 |
| |
| Reviewed by Ross Kirsling. |
| |
| * test262/expectations.yaml: Mark 4 test cases as passing. |
| |
| 2019-11-11 Ross Kirsling <ross.kirsling@sony.com> |
| |
| UTC offset for Samoa is miscalculated when !HAVE(TIMEGM) |
| https://bugs.webkit.org/show_bug.cgi?id=204032 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * complex.yaml: |
| * complex/timezone-offset-apia.js: Added. |
| Add test to verify Date.prototype.getTimezoneOffset for TZ=Pacific/Apia. |
| |
| 2019-11-08 Guillaume Emont <guijemont@igalia.com> |
| |
| Temporarily skip another broken test on MIPS due to OSR exit to LLInt |
| https://bugs.webkit.org/show_bug.cgi?id=204003 |
| |
| Unreviewed gardening. |
| |
| * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: |
| |
| 2019-11-07 Mark Lam <mark.lam@apple.com> |
| |
| Add a stack overflow check in Yarr::ByteCompiler::emitDisjunction(). |
| https://bugs.webkit.org/show_bug.cgi?id=203936 |
| <rdar://problem/56624724> |
| |
| Reviewed by Saam Barati. |
| |
| This issue originally manifested as incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js |
| failing on iOS devices due to its smaller stack. We adapted the original test |
| here using $vm.callWithStackSize() to reproduce the issue on x86_64 though it |
| has a much larger physical stack to work with. This new test will crash while |
| stepping on the guard page beyond the end of the stack if the fix is not applied. |
| |
| * stress/stack-overflow-in-yarr-byteCompile.js: Added. |
| |
| 2019-11-07 Tuomas Karkkainen <tuomas.webkit@apple.com> |
| |
| didPassSomeTestsSilenty is misspelled in standalone-pre.js |
| https://bugs.webkit.org/show_bug.cgi?id=203948 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/resources/standalone-pre.js: |
| |
| 2019-11-07 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Unskip test262 tests for async-iteration |
| https://bugs.webkit.org/show_bug.cgi?id=203921 |
| |
| Reviewed by Keith Miller. |
| |
| This should have been done two years ago, it seems. |
| |
| * test262/config.yaml: |
| * test262/expectations.yaml: |
| |
| 2019-11-07 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| [[HasProperty]] result of Proxy in prototype chain is ignored |
| https://bugs.webkit.org/show_bug.cgi?id=203560 |
| |
| Reviewed by Ross Kirsling. |
| |
| * stress/proxy-get-prototype-of.js: Correct Proxy "has" trap test. |
| * test262/expectations.yaml: Mark 6 test cases as passing. |
| |
| 2019-11-06 Mark Lam <mark.lam@apple.com> |
| |
| JSGlobalObject::fireWatchpointAndMakeAllArrayStructuresSlowPut() should fire its watchpoint as the last step. |
| https://bugs.webkit.org/show_bug.cgi?id=203867 |
| <rdar://problem/56813514> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/racy-slow-put-cloned-arguments-when-having-a-bad-time.js: Added. |
| |
| 2019-11-06 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r251940. |
| https://bugs.webkit.org/show_bug.cgi?id=203920 |
| |
| "it introduced test262 failures" (Requested by rkirsling on |
| #webkit). |
| |
| Reverted changeset: |
| |
| "[[HasProperty]] result of Proxy in prototype chain is |
| ignored" |
| https://bugs.webkit.org/show_bug.cgi?id=203560 |
| https://trac.webkit.org/changeset/251940 |
| |
| 2019-11-04 Saam Barati <sbarati@apple.com> |
| |
| Don't use memmove/memcpy/memset for memory that can be scanned concurrently |
| https://bugs.webkit.org/show_bug.cgi?id=203228 |
| <rdar://problem/56401852> |
| |
| Reviewed by Robin Morisset. |
| |
| * stress/torn-js-value-concurrent-collector.js: Added. |
| (foo): |
| |
| 2019-11-03 Tadeu Zagallo <tzagallo@apple.com> |
| |
| LLIntGenerator should not allocate temporaries in between variables |
| https://bugs.webkit.org/show_bug.cgi?id=203787 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * wasm/stress/local-ref.js: Added. |
| |
| 2019-11-02 Alexey Proskuryakov <ap@apple.com> |
| |
| Revert http://trac.webkit.org/r251875 |
| Don't use memmove/memcpy/memset for memory that can be scanned concurrently |
| |
| This is suspected to have broken performance tests on iOS. |
| |
| * stress/torn-js-value-concurrent-collector.js: Removed. |
| |
| 2019-11-01 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| [[HasProperty]] result of Proxy in prototype chain is ignored |
| https://bugs.webkit.org/show_bug.cgi?id=203560 |
| |
| Reviewed by Ross Kirsling. |
| |
| * stress/proxy-get-prototype-of.js: Correct Proxy "has" trap test. |
| * test262/expectations.yaml: Mark 6 test cases as passing. |
| |
| 2019-11-01 Caio Lima <ticaiolima@gmail.com> |
| |
| [JSC][MIPS] Skip tests failing in RELEASE_ASSERT_NOT_REACHED() at CallFrame.cpp:81 |
| https://bugs.webkit.org/show_bug.cgi?id=203738 |
| |
| Unreviewed gardening. |
| |
| * stress/allocation-sinking-hints-are-valid-ssa.js: |
| * stress/has-instance-exception-check.js: |
| * stress/regress-176485.js: |
| |
| 2019-10-31 Caio Lima <ticaiolima@gmail.com> |
| |
| Temporary skip broken tests on MIPS that is broken due to OSR exit to LLInt |
| https://bugs.webkit.org/show_bug.cgi?id=203710 |
| |
| Unreviewed gardening. |
| |
| * microbenchmarks/call-spread-call.js: |
| * microbenchmarks/throw.js: |
| * stress/allocation-sinking-hints-are-valid-ssa-2.js: |
| * stress/arith-profile-for-negate-can-see-non-number-due-to-dfg-osr-exit-profiling.js: |
| * stress/arrowfunction-lexical-bind-supercall-4.js: |
| * stress/arrowfunction-tdz-3.js: |
| * stress/function-constructor-semantics.js: |
| * stress/stress-cleared-calllinkinfo.js: |
| * stress/typedarray-configure-index.js: |
| * stress/v8-deltablue-strict.js: |
| |
| 2019-10-31 Saam Barati <sbarati@apple.com> |
| |
| Don't use memmove/memcpy/memset for memory that can be scanned concurrently |
| https://bugs.webkit.org/show_bug.cgi?id=203228 |
| <rdar://problem/56401852> |
| |
| Reviewed by Robin Morisset. |
| |
| * stress/torn-js-value-concurrent-collector.js: Added. |
| (foo): |
| |
| 2019-10-30 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Date functions should have intrinsic |
| https://bugs.webkit.org/show_bug.cgi?id=202187 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/date-cse.js: Added. |
| (shouldBe): |
| (test): |
| (test2): |
| (test3): |
| * stress/date-get-date-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-day-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-full-year-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-hours-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-milliseconds-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-minutes-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-month-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-seconds-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-time-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-timezone-offset-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-utc-date-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-utc-day-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-utc-full-year-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-utc-hours-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-utc-milliseconds-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-utc-minutes-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-utc-month-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-utc-seconds-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-get-year-jit.js: Added. |
| (shouldBe): |
| (test): |
| * stress/date-value-of-jit.js: Added. |
| (shouldBe): |
| (test): |
| |
| 2019-10-30 Guillaume Emont <guijemont@igalia.com> |
| |
| Temporarily skip ChakraCore/test/Math/max.js on arm and mips |
| |
| Unreviewed gardening. |
| |
| * ChakraCore.yaml: |
| |
| 2019-10-30 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Intl.DateTimeFormat returns resolvedOptions in the wrong order |
| https://bugs.webkit.org/show_bug.cgi?id=203297 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * test262/expectations.yaml: |
| Mark two test cases as passing. |
| |
| 2019-10-30 Tadeu Zagallo <tzagallo@apple.com> |
| |
| tryCachePutToScopeGlobal should hold the lock to update metadata.m_getPutInfo |
| https://bugs.webkit.org/show_bug.cgi?id=203628 |
| <rdar://problem/56705353> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/property-move-from-global-object-to-global-lexical-environment.js: Added. |
| (foo): |
| |
| 2019-10-29 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Add fast path for String#localeCompare |
| https://bugs.webkit.org/show_bug.cgi?id=202676 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/locale-compare-bits.js: Added. |
| (shouldBe): |
| |
| 2019-10-28 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Optimize Promise runtime functions |
| https://bugs.webkit.org/show_bug.cgi?id=203454 |
| |
| Reviewed by Keith Miller. |
| |
| * microbenchmarks/promise-reject.js: Added. |
| * microbenchmarks/promise-resolve.js: Added. |
| |
| 2019-10-25 Ross Kirsling <ross.kirsling@sony.com> |
| |
| test262-runner should be able to pass JSC a feature flag |
| https://bugs.webkit.org/show_bug.cgi?id=203301 |
| |
| Reviewed by Keith Miller. |
| |
| * test262/config.yaml: |
| Add feature flag mapping. |
| Also skip a few forgotten features as well as BigInt TypedArray tests. |
| |
| * test262/expectations.yaml: |
| Regenerate expectations. |
| |
| 2019-10-23 Keith Miller <keith_miller@apple.com> |
| |
| Undo incidental change from BytecodeIndex class patch |
| https://bugs.webkit.org/show_bug.cgi?id=203339 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/error-source-location-assertion.js: Added. |
| |
| 2019-10-23 Ross Kirsling <ross.kirsling@sony.com> |
| |
| String.prototype.matchAll should throw on non-global regex |
| https://bugs.webkit.org/show_bug.cgi?id=202838 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/string-matchall.js: Added. |
| |
| * test262/expectations.yaml: |
| Mark four test cases as passing. |
| |
| 2019-10-23 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Update test262 (2019.10.11) |
| https://bugs.webkit.org/show_bug.cgi?id=202861 |
| |
| Reviewed by Keith Miller. |
| |
| * test262/config.yaml: |
| * test262/expectations.yaml: |
| * test262/harness/: |
| * test262/latest-changes-summary.txt: |
| * test262/test/: |
| * test262/test262-Revision.txt: |
| |
| 2019-10-22 Zhifei Fang <zhifei_fang@apple.com> |
| |
| [JSC tests] Skip slow tests on Watch S3 and Watch S4 |
| https://bugs.webkit.org/show_bug.cgi?id=203268 |
| |
| Reviewed by Saam Barati. |
| |
| * microbenchmarks/ArrayBuffer-DataView-alloc-large-long-lived.js: |
| * microbenchmarks/ArrayBuffer-DataView-alloc-long-lived.js: |
| * microbenchmarks/ArrayBuffer-Int32Array-byteOffset.js: |
| * microbenchmarks/ArrayBuffer-Int8Array-alloc-large-long-lived.js: |
| * microbenchmarks/ArrayBuffer-Int8Array-alloc-long-lived-buffer.js: |
| * microbenchmarks/ArrayBuffer-Int8Array-alloc-long-lived.js: |
| * microbenchmarks/ArrayBuffer-Int8Array-alloc.js: |
| * microbenchmarks/DataView-custom-properties.js: |
| * microbenchmarks/Float32Array-matrix-mult.js: |
| * microbenchmarks/Float32Array-to-Float64Array-set.js: |
| * microbenchmarks/Float64Array-alloc-long-lived.js: |
| * microbenchmarks/Float64Array-to-Int16Array-set.js: |
| * microbenchmarks/HashMap-put-get-iterate-keys.js: |
| * microbenchmarks/HashMap-put-get-iterate.js: |
| * microbenchmarks/HashMap-string-put-get-iterate.js: |
| * microbenchmarks/Int16Array-alloc-long-lived.js: |
| * microbenchmarks/Int16Array-bubble-sort-with-byteLength.js: |
| * microbenchmarks/Int16Array-bubble-sort.js: |
| * microbenchmarks/Int16Array-load-int-mul.js: |
| * microbenchmarks/Int16Array-to-Int32Array-set.js: |
| * microbenchmarks/Int32Array-Int8Array-view-alloc.js: |
| * microbenchmarks/Int32Array-alloc-large.js: |
| * microbenchmarks/Int32Array-alloc-long-lived.js: |
| * microbenchmarks/Int32Array-alloc.js: |
| * microbenchmarks/Int8Array-alloc-long-lived.js: |
| * microbenchmarks/Int8Array-load-with-byteLength.js: |
| * microbenchmarks/Int8Array-load.js: |
| * microbenchmarks/JSONP-negative-0.js: |
| * microbenchmarks/Number-isNaN.js: |
| * microbenchmarks/abc-forward-loop-equal.js: |
| * microbenchmarks/abc-postfix-backward-loop.js: |
| * microbenchmarks/abc-simple-backward-loop.js: |
| * microbenchmarks/abc-simple-forward-loop.js: |
| * microbenchmarks/abc-skippy-loop.js: |
| * microbenchmarks/abs-boolean.js: |
| * microbenchmarks/adapt-to-double-divide.js: |
| * microbenchmarks/add-tree.js: |
| * microbenchmarks/aliased-arguments-getbyval.js: |
| * microbenchmarks/allocate-big-object.js: |
| * microbenchmarks/apply-not-apply.js: |
| * microbenchmarks/arguments-named-and-reflective.js: |
| * microbenchmarks/arguments-out-of-bounds.js: |
| * microbenchmarks/arguments-strict-mode.js: |
| * microbenchmarks/arguments.js: |
| * microbenchmarks/arity-mismatch-inlining.js: |
| * microbenchmarks/array-access-polymorphic-structure.js: |
| * microbenchmarks/array-nonarray-polymorhpic-access.js: |
| * microbenchmarks/array-prototype-every.js: |
| * microbenchmarks/array-prototype-forEach.js: |
| * microbenchmarks/array-prototype-join-uninitialized.js: |
| * microbenchmarks/array-prototype-map.js: |
| * microbenchmarks/array-prototype-reduce.js: |
| * microbenchmarks/array-prototype-reduceRight.js: |
| * microbenchmarks/array-prototype-some.js: |
| * microbenchmarks/array-push-0.js: |
| * microbenchmarks/array-push-1.js: |
| * microbenchmarks/array-push-2.js: |
| * microbenchmarks/array-splice-contiguous.js: |
| * microbenchmarks/array-with-double-add.js: |
| * microbenchmarks/array-with-double-increment.js: |
| * microbenchmarks/array-with-double-mul-add.js: |
| * microbenchmarks/array-with-double-sum.js: |
| * microbenchmarks/array-with-int32-add-sub.js: |
| * microbenchmarks/array-with-int32-or-double-sum.js: |
| * microbenchmarks/arrowfunciton-direct-arguments.js: |
| * microbenchmarks/arrowfunciton-reference-arguments.js: |
| * microbenchmarks/arrowfunction-call-in-class-constructor.js: |
| * microbenchmarks/arrowfunction-call-in-class-method.js: |
| * microbenchmarks/arrowfunction-call-in-function.js: |
| * microbenchmarks/arrowfunction-call.js: |
| * microbenchmarks/asmjs_bool_bug.js: |
| * microbenchmarks/assign-custom-setter-polymorphic.js: |
| * microbenchmarks/assign-custom-setter.js: |
| * microbenchmarks/basic-set.js: |
| * microbenchmarks/big-int-mul.js: |
| * microbenchmarks/bigswitch-indirect-symbol.js: |
| * microbenchmarks/bigswitch-indirect.js: |
| * microbenchmarks/bigswitch.js: |
| * microbenchmarks/bit-or-tree.js: |
| * microbenchmarks/bit-test-constant.js: |
| * microbenchmarks/bit-test-load.js: |
| * microbenchmarks/bit-test-nonconstant.js: |
| * microbenchmarks/bit-xor-tree.js: |
| * microbenchmarks/boolean-test.js: |
| * microbenchmarks/bound-function-call.js: |
| * microbenchmarks/bound-function-construction-performance.js: |
| * microbenchmarks/branch-fold.js: |
| * microbenchmarks/branch-on-string-as-boolean.js: |
| * microbenchmarks/bug-153431.js: |
| * microbenchmarks/build-large-object.js: |
| * microbenchmarks/by-val-generic.js: |
| * microbenchmarks/cache-get-variables-under-tdz-in-bytecode-generator.js: |
| * microbenchmarks/call-or-not-call.js: |
| * microbenchmarks/call-spread-apply.js: |
| * microbenchmarks/call-spread-call.js: |
| * microbenchmarks/call-using-spread.js: |
| * microbenchmarks/captured-assignments.js: |
| * microbenchmarks/cast-int-to-double.js: |
| * microbenchmarks/cell-argument.js: |
| * microbenchmarks/cfg-simplify.js: |
| * microbenchmarks/chain-getter-access.js: |
| * microbenchmarks/check-mul-constant.js: |
| * microbenchmarks/check-mul-no-constant.js: |
| * microbenchmarks/check-mul-power-of-two.js: |
| * microbenchmarks/cmpeq-obj-to-obj-other.js: |
| * microbenchmarks/concat-append-one.js: |
| * microbenchmarks/constant-fold-check-type-info-flags.js: |
| * microbenchmarks/constant-test.js: |
| * microbenchmarks/construct-poly-proto-object.js: |
| * microbenchmarks/contiguous-array-to-string.js: |
| * microbenchmarks/create-lots-of-functions.js: |
| * microbenchmarks/create-many-weak-map.js: |
| * microbenchmarks/cse-new-array-buffer.js: |
| * microbenchmarks/cse-new-array.js: |
| * microbenchmarks/custom-accessor-materialized.js: |
| * microbenchmarks/custom-accessor-thin-air.js: |
| * microbenchmarks/custom-accessor.js: |
| * microbenchmarks/custom-setter-getter-as-put-get-by-id.js: |
| * microbenchmarks/custom-value-2.js: |
| * microbenchmarks/custom-value.js: |
| * microbenchmarks/data-view-accesses-2.js: |
| * microbenchmarks/data-view-accesses.js: |
| * microbenchmarks/dataview-cse.js: |
| * microbenchmarks/delay-tear-off-arguments-strictmode.js: |
| * microbenchmarks/delta-blue-try-catch.js: |
| * microbenchmarks/deltablue-for-of.js: |
| * microbenchmarks/deltablue-varargs.js: |
| * microbenchmarks/destructuring-arguments.js: |
| * microbenchmarks/destructuring-parameters-overridden-by-function.js: |
| * microbenchmarks/destructuring-swap.js: |
| * microbenchmarks/dfg-internal-function-call.js: |
| * microbenchmarks/dfg-internal-function-construct.js: |
| * microbenchmarks/dfg-internal-function-not-handled-call.js: |
| * microbenchmarks/dfg-internal-function-not-handled-construct.js: |
| * microbenchmarks/direct-arguments-getbyval.js: |
| * microbenchmarks/direct-arguments-length.js: |
| * microbenchmarks/direct-arguments-overridden-length.js: |
| * microbenchmarks/direct-arguments-possibly-overridden-length.js: |
| * microbenchmarks/direct-call-arity-mismatch.js: |
| * microbenchmarks/direct-call.js: |
| * microbenchmarks/direct-construct-arity-mismatch.js: |
| * microbenchmarks/direct-construct.js: |
| * microbenchmarks/direct-tail-call-arity-mismatch.js: |
| * microbenchmarks/direct-tail-call-inlined-caller-arity-mismatch.js: |
| * microbenchmarks/direct-tail-call-inlined-caller.js: |
| * microbenchmarks/direct-tail-call.js: |
| * microbenchmarks/div-boolean-double.js: |
| * microbenchmarks/div-boolean.js: |
| * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: |
| * microbenchmarks/double-array-to-string.js: |
| * microbenchmarks/double-get-by-val-out-of-bounds.js: |
| * microbenchmarks/double-pollution-getbyval.js: |
| * microbenchmarks/double-pollution-putbyoffset.js: |
| * microbenchmarks/double-real-use.js: |
| * microbenchmarks/double-to-int32-typed-array-no-inline.js: |
| * microbenchmarks/double-to-int32-typed-array.js: |
| * microbenchmarks/double-to-uint32-typed-array-no-inline.js: |
| * microbenchmarks/double-to-uint32-typed-array.js: |
| * microbenchmarks/elidable-new-object-dag.js: |
| * microbenchmarks/elidable-new-object-roflcopter.js: |
| * microbenchmarks/elidable-new-object-then-call.js: |
| * microbenchmarks/elidable-new-object-tree.js: |
| * microbenchmarks/empty-string-plus-int.js: |
| * microbenchmarks/emscripten-cube2hash.js: |
| * microbenchmarks/eval-cached.js: |
| * microbenchmarks/eval-code-ftl-reentry.js: |
| * microbenchmarks/eval-code-ftl.js: |
| * microbenchmarks/eval-compute.js: |
| * microbenchmarks/eval-not-eval-compute-args.js: |
| * microbenchmarks/eval-not-eval-compute.js: |
| * microbenchmarks/exit-length-on-plain-object.js: |
| * microbenchmarks/external-arguments-getbyval.js: |
| * microbenchmarks/external-arguments-putbyval.js: |
| * microbenchmarks/fixed-typed-array-storage-var-index.js: |
| * microbenchmarks/fixed-typed-array-storage.js: |
| * microbenchmarks/fold-double-to-int.js: |
| * microbenchmarks/fold-get-by-id-to-multi-get-by-offset-rare-int.js: |
| * microbenchmarks/fold-get-by-id-to-multi-get-by-offset.js: |
| * microbenchmarks/fold-multi-get-by-offset-to-get-by-offset.js: |
| * microbenchmarks/fold-multi-get-by-offset-to-poly-get-by-offset.js: |
| * microbenchmarks/fold-multi-put-by-offset-to-poly-put-by-offset.js: |
| * microbenchmarks/fold-multi-put-by-offset-to-put-by-offset.js: |
| * microbenchmarks/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js: |
| * microbenchmarks/fold-put-by-id-to-multi-put-by-offset.js: |
| * microbenchmarks/fold-put-by-val-with-string-to-multi-put-by-offset.js: |
| * microbenchmarks/fold-put-by-val-with-symbol-to-multi-put-by-offset.js: |
| * microbenchmarks/fold-put-structure.js: |
| * microbenchmarks/for-in-on-object-with-lazily-materialized-properties.js: |
| * microbenchmarks/for-of-array.js: |
| * microbenchmarks/for-of-iterate-array-entries.js: |
| * microbenchmarks/for-of-iterate-array-keys.js: |
| * microbenchmarks/for-of-iterate-array-values.js: |
| * microbenchmarks/forward-arguments-dont-escape-on-arguments-length.js: |
| * microbenchmarks/freeze-and-do-work.js: |
| * microbenchmarks/fround.js: |
| * microbenchmarks/ftl-library-inlining-dataview.js: |
| * microbenchmarks/ftl-library-inlining.js: |
| * microbenchmarks/ftl-polymorphic-StringFromCharCode.js: |
| * microbenchmarks/function-call.js: |
| * microbenchmarks/function-dot-apply.js: |
| * microbenchmarks/function-test.js: |
| * microbenchmarks/function-with-eval.js: |
| * microbenchmarks/gcse-poly-get-less-obvious.js: |
| * microbenchmarks/gcse-poly-get.js: |
| * microbenchmarks/gcse.js: |
| * microbenchmarks/generate-multiple-llint-entrypoints.js: |
| * microbenchmarks/generator-create.js: |
| * microbenchmarks/generator-fib.js: |
| * microbenchmarks/generator-function-create.js: |
| * microbenchmarks/generator-sunspider-access-nsieve.js: |
| * microbenchmarks/generator-with-several-types.js: |
| * microbenchmarks/get-by-id-bimorphic-check-structure-elimination-simple.js: |
| * microbenchmarks/get-by-id-bimorphic-check-structure-elimination.js: |
| * microbenchmarks/get-by-id-chain-from-try-block.js: |
| * microbenchmarks/get-by-id-check-structure-elimination.js: |
| * microbenchmarks/get-by-id-proto-or-self.js: |
| * microbenchmarks/get-by-id-quadmorphic-check-structure-elimination-simple.js: |
| * microbenchmarks/get-by-id-self-or-proto.js: |
| * microbenchmarks/get-by-val-negative-array-index.js: |
| * microbenchmarks/get-by-val-out-of-bounds.js: |
| * microbenchmarks/get-by-val-with-string-bimorphic-check-structure-elimination-simple.js: |
| * microbenchmarks/get-by-val-with-string-bimorphic-check-structure-elimination.js: |
| * microbenchmarks/get-by-val-with-string-chain-from-try-block.js: |
| * microbenchmarks/get-by-val-with-string-check-structure-elimination.js: |
| * microbenchmarks/get-by-val-with-string-proto-or-self.js: |
| * microbenchmarks/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.js: |
| * microbenchmarks/get-by-val-with-string-self-or-proto.js: |
| * microbenchmarks/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.js: |
| * microbenchmarks/get-by-val-with-symbol-bimorphic-check-structure-elimination.js: |
| * microbenchmarks/get-by-val-with-symbol-chain-from-try-block.js: |
| * microbenchmarks/get-by-val-with-symbol-check-structure-elimination.js: |
| * microbenchmarks/get-by-val-with-symbol-proto-or-self.js: |
| * microbenchmarks/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.js: |
| * microbenchmarks/get-by-val-with-symbol-self-or-proto.js: |
| * microbenchmarks/get-custom-getter.js: |
| * microbenchmarks/get_by_val-Int32Array.js: |
| * microbenchmarks/get_callee_monomorphic.js: |
| * microbenchmarks/get_callee_polymorphic.js: |
| * microbenchmarks/getter-no-activation.js: |
| * microbenchmarks/getter-prototype.js: |
| * microbenchmarks/getter-richards-try-catch.js: |
| * microbenchmarks/getter-richards.js: |
| * microbenchmarks/getter.js: |
| * microbenchmarks/global-code-ftl.js: |
| * microbenchmarks/global-isNaN.js: |
| * microbenchmarks/global-object-access-with-mutating-structure.js: |
| * microbenchmarks/global-var-const-infer-fire-from-opt.js: |
| * microbenchmarks/global-var-const-infer.js: |
| * microbenchmarks/hard-overflow-check-equal.js: |
| * microbenchmarks/hard-overflow-check.js: |
| * microbenchmarks/has-own-property-name-cache.js: |
| * microbenchmarks/hoist-get-by-offset-tower-with-inferred-types.js: |
| * microbenchmarks/hoist-make-rope.js: |
| * microbenchmarks/hoist-poly-check-structure-effectful-loop.js: |
| * microbenchmarks/hoist-poly-check-structure.js: |
| * microbenchmarks/implicit-bigswitch-indirect-symbol.js: |
| * microbenchmarks/imul-double-only.js: |
| * microbenchmarks/imul-int-only.js: |
| * microbenchmarks/imul-mixed.js: |
| * microbenchmarks/in-by-id-match.js: |
| * microbenchmarks/in-by-id-removed.js: |
| * microbenchmarks/in-four-cases.js: |
| * microbenchmarks/in-one-case-false.js: |
| * microbenchmarks/in-one-case-true.js: |
| * microbenchmarks/in-two-cases.js: |
| * microbenchmarks/indexed-properties-in-objects.js: |
| * microbenchmarks/infer-closure-const-then-mov-no-inline.js: |
| * microbenchmarks/infer-closure-const-then-mov.js: |
| * microbenchmarks/infer-closure-const-then-put-to-scope-no-inline.js: |
| * microbenchmarks/infer-closure-const-then-put-to-scope.js: |
| * microbenchmarks/infer-closure-const-then-reenter-no-inline.js: |
| * microbenchmarks/infer-closure-const-then-reenter.js: |
| * microbenchmarks/infer-constant-global-property.js: |
| * microbenchmarks/infer-constant-property.js: |
| * microbenchmarks/infer-one-time-closure-ten-vars.js: |
| * microbenchmarks/infer-one-time-closure-two-vars.js: |
| * microbenchmarks/infer-one-time-closure.js: |
| * microbenchmarks/infer-one-time-deep-closure.js: |
| * microbenchmarks/inline-arguments-access.js: |
| * microbenchmarks/inline-arguments-aliased-access.js: |
| * microbenchmarks/inline-arguments-local-escape.js: |
| * microbenchmarks/inline-get-scoped-var.js: |
| * microbenchmarks/inlined-put-by-id-transition.js: |
| * microbenchmarks/inlined-put-by-val-with-string-transition.js: |
| * microbenchmarks/inlined-put-by-val-with-symbol-transition.js: |
| * microbenchmarks/instanceof-always-hit-one.js: |
| * microbenchmarks/instanceof-always-hit-two.js: |
| * microbenchmarks/instanceof-bound.js: |
| * microbenchmarks/instanceof-dynamic.js: |
| * microbenchmarks/instanceof-sometimes-hit.js: |
| * microbenchmarks/instanceof-tricky-dynamic.js: |
| * microbenchmarks/int-or-other-abs-then-get-by-val.js: |
| * microbenchmarks/int-or-other-abs-zero-then-get-by-val.js: |
| * microbenchmarks/int-or-other-add-then-get-by-val.js: |
| * microbenchmarks/int-or-other-add.js: |
| * microbenchmarks/int-or-other-div-then-get-by-val.js: |
| * microbenchmarks/int-or-other-max-then-get-by-val.js: |
| * microbenchmarks/int-or-other-min-then-get-by-val.js: |
| * microbenchmarks/int-or-other-mod-then-get-by-val.js: |
| * microbenchmarks/int-or-other-mul-then-get-by-val.js: |
| * microbenchmarks/int-or-other-neg-then-get-by-val.js: |
| * microbenchmarks/int-or-other-neg-zero-then-get-by-val.js: |
| * microbenchmarks/int-or-other-sub-then-get-by-val.js: |
| * microbenchmarks/int-or-other-sub.js: |
| * microbenchmarks/int-overflow-local.js: |
| * microbenchmarks/int32-array-to-string.js: |
| * microbenchmarks/int52-back-and-forth.js: |
| * microbenchmarks/int52-rand-function.js: |
| * microbenchmarks/int52-spill.js: |
| * microbenchmarks/int8-out-of-bounds.js: |
| * microbenchmarks/integer-divide.js: |
| * microbenchmarks/integer-modulo.js: |
| * microbenchmarks/is-array-for-array.js: |
| * microbenchmarks/is-array-for-mixed-case.js: |
| * microbenchmarks/is-array-for-non-array-object.js: |
| * microbenchmarks/is-array-for-proxy.js: |
| * microbenchmarks/is-boolean-fold-tricky.js: |
| * microbenchmarks/is-boolean-fold.js: |
| * microbenchmarks/is-function-fold-tricky-internal-function.js: |
| * microbenchmarks/is-function-fold-tricky.js: |
| * microbenchmarks/is-function-fold.js: |
| * microbenchmarks/is-not-cell-speculation-for-empty-value.js: |
| * microbenchmarks/is-number-fold-tricky.js: |
| * microbenchmarks/is-number-fold.js: |
| * microbenchmarks/is-object-or-null-fold-functions.js: |
| * microbenchmarks/is-object-or-null-fold-less-tricky.js: |
| * microbenchmarks/is-object-or-null-fold-tricky.js: |
| * microbenchmarks/is-object-or-null-fold.js: |
| * microbenchmarks/is-object-or-null-trickier-function.js: |
| * microbenchmarks/is-object-or-null-trickier-internal-function.js: |
| * microbenchmarks/is-object-or-null-tricky-function.js: |
| * microbenchmarks/is-object-or-null-tricky-internal-function.js: |
| * microbenchmarks/is-string-fold-tricky.js: |
| * microbenchmarks/is-string-fold.js: |
| * microbenchmarks/is-symbol-mixed.js: |
| * microbenchmarks/is-symbol.js: |
| * microbenchmarks/is-undefined-fold-tricky.js: |
| * microbenchmarks/is-undefined-fold.js: |
| * microbenchmarks/json-parse-array-reviver-same-value.js: |
| * microbenchmarks/json-parse-array-reviver.js: |
| * microbenchmarks/json-parse-object-reviver-same-value.js: |
| * microbenchmarks/json-parse-object-reviver.js: |
| * microbenchmarks/large-empty-array-join-resolve-rope.js: |
| * microbenchmarks/large-empty-array-join.js: |
| * microbenchmarks/large-int-captured.js: |
| * microbenchmarks/large-int-neg.js: |
| * microbenchmarks/large-int.js: |
| * microbenchmarks/large-map-iteration.js: |
| * microbenchmarks/lazy-array-species-watchpoints.js: |
| * microbenchmarks/let-for-in.js: |
| * microbenchmarks/licm-dragons-out-of-bounds.js: |
| * microbenchmarks/licm-dragons-overflow.js: |
| * microbenchmarks/licm-dragons-two-structures.js: |
| * microbenchmarks/licm-dragons.js: |
| * microbenchmarks/load-varargs-elimination.js: |
| * microbenchmarks/locale-compare.js: |
| * microbenchmarks/logical-not-weird-types.js: |
| * microbenchmarks/logical-not.js: |
| * microbenchmarks/loop-osr-with-arity-mismatch.js: |
| * microbenchmarks/lots-of-fields.js: |
| * microbenchmarks/make-indexed-storage.js: |
| * microbenchmarks/make-rope-cse.js: |
| * microbenchmarks/make-rope.js: |
| * microbenchmarks/many-foreach-calls.js: |
| * microbenchmarks/many-repeat-stores.js: |
| * microbenchmarks/map-for-each.js: |
| * microbenchmarks/map-for-of.js: |
| * microbenchmarks/map-has-and-set.js: |
| * microbenchmarks/map-has-get-cse-opportunity.js: |
| * microbenchmarks/map-key-well-typed.js: |
| * microbenchmarks/map-rehash.js: |
| * microbenchmarks/marsaglia-larger-ints.js: |
| * microbenchmarks/marsaglia-osr-entry.js: |
| * microbenchmarks/math-random.js: |
| * microbenchmarks/math-trunc.js: |
| * microbenchmarks/math-with-out-of-bounds-array-values.js: |
| * microbenchmarks/max-boolean.js: |
| * microbenchmarks/megamorphic-load.js: |
| * microbenchmarks/memcpy-loop.js: |
| * microbenchmarks/memcpy-typed-loop-large.js: |
| * microbenchmarks/memcpy-typed-loop-small.js: |
| * microbenchmarks/memcpy-typed-loop-speculative.js: |
| * microbenchmarks/memcpy-typed-loop.js: |
| * microbenchmarks/memcpy-wasm-large.js: |
| * microbenchmarks/memcpy-wasm-medium.js: |
| * microbenchmarks/memcpy-wasm-small.js: |
| * microbenchmarks/memcpy-wasm.js: |
| * microbenchmarks/method-on-number.js: |
| * microbenchmarks/min-boolean.js: |
| * microbenchmarks/minus-boolean-double.js: |
| * microbenchmarks/minus-boolean.js: |
| * microbenchmarks/misc-strict-eq.js: |
| * microbenchmarks/mod-boolean-double.js: |
| * microbenchmarks/mod-boolean.js: |
| * microbenchmarks/mod-untyped.js: |
| * microbenchmarks/mul-boolean-double.js: |
| * microbenchmarks/mul-boolean.js: |
| * microbenchmarks/mul-immediate-sub.js: |
| * microbenchmarks/neg-boolean.js: |
| * microbenchmarks/negative-zero-divide.js: |
| * microbenchmarks/negative-zero-modulo.js: |
| * microbenchmarks/negative-zero-negate.js: |
| * microbenchmarks/new-array-buffer-dead.js: |
| * microbenchmarks/new-array-buffer-push.js: |
| * microbenchmarks/new-array-buffer-vector-profile.js: |
| * microbenchmarks/new-array-dead.js: |
| * microbenchmarks/new-array-push.js: |
| * microbenchmarks/new-error.js: |
| * microbenchmarks/no-inline-constructor.js: |
| * microbenchmarks/number-test.js: |
| * microbenchmarks/number-to-string-strength-reduction.js: |
| * microbenchmarks/number-to-string-with-add-empty.js: |
| * microbenchmarks/number-to-string-with-add-in-loop.js: |
| * microbenchmarks/number-to-string-with-add.js: |
| * microbenchmarks/number-to-string-with-radix-10.js: |
| * microbenchmarks/number-to-string-with-radix-cse.js: |
| * microbenchmarks/number-to-string-with-radix.js: |
| * microbenchmarks/object-and.js: |
| * microbenchmarks/object-closure-call.js: |
| * microbenchmarks/object-create-constant-prototype.js: |
| * microbenchmarks/object-create-null.js: |
| * microbenchmarks/object-create-unknown-object-prototype.js: |
| * microbenchmarks/object-create-untyped-prototype.js: |
| * microbenchmarks/object-entries.js: |
| * microbenchmarks/object-get-own-property-symbols-on-large-array.js: |
| * microbenchmarks/object-get-own-property-symbols.js: |
| * microbenchmarks/object-int-add-array.js: |
| * microbenchmarks/object-int-add.js: |
| * microbenchmarks/object-int-and-array.js: |
| * microbenchmarks/object-int-mul-array.js: |
| * microbenchmarks/object-int-sub-array.js: |
| * microbenchmarks/object-int-sub.js: |
| * microbenchmarks/object-is.js: |
| * microbenchmarks/object-iterate-symbols.js: |
| * microbenchmarks/object-iterate.js: |
| * microbenchmarks/object-keys-map-values.js: |
| * microbenchmarks/object-keys.js: |
| * microbenchmarks/object-lshift.js: |
| * microbenchmarks/object-or.js: |
| * microbenchmarks/object-rshift.js: |
| * microbenchmarks/object-test.js: |
| * microbenchmarks/object-urshift.js: |
| * microbenchmarks/object-values.js: |
| * microbenchmarks/object-xor.js: |
| * microbenchmarks/obvious-sink-pathology-taken.js: |
| * microbenchmarks/obvious-sink-pathology.js: |
| * microbenchmarks/obviously-elidable-new-object.js: |
| * microbenchmarks/plus-boolean-arith.js: |
| * microbenchmarks/plus-boolean-double.js: |
| * microbenchmarks/plus-boolean.js: |
| * microbenchmarks/poly-chain-access-different-prototypes-simple.js: |
| * microbenchmarks/poly-chain-access-different-prototypes.js: |
| * microbenchmarks/poly-chain-access-simpler.js: |
| * microbenchmarks/poly-chain-access.js: |
| * microbenchmarks/poly-proto-access.js: |
| * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: |
| * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: |
| * microbenchmarks/poly-proto-put-transition-speed.js: |
| * microbenchmarks/poly-proto-setter-speed.js: |
| * microbenchmarks/poly-stricteq.js: |
| * microbenchmarks/polymorphic-array-call.js: |
| * microbenchmarks/polymorphic-get-by-id.js: |
| * microbenchmarks/polymorphic-put-by-id.js: |
| * microbenchmarks/polymorphic-put-by-val-with-string.js: |
| * microbenchmarks/polymorphic-put-by-val-with-symbol.js: |
| * microbenchmarks/polymorphic-structure.js: |
| * microbenchmarks/polyvariant-get-by-id-shorter-tower.js: |
| * microbenchmarks/polyvariant-get-by-id-tower.js: |
| * microbenchmarks/polyvariant-monomorphic-get-by-id.js: |
| * microbenchmarks/prevent-extensions-and-do-work.js: |
| * microbenchmarks/promise-creation-many.js: |
| * microbenchmarks/proto-getter-access.js: |
| * microbenchmarks/prototype-access-with-mutating-prototype.js: |
| * microbenchmarks/put-by-id-replace-and-transition.js: |
| * microbenchmarks/put-by-id-slightly-polymorphic.js: |
| * microbenchmarks/put-by-id-transition-with-indexing-header.js: |
| * microbenchmarks/put-by-id.js: |
| * microbenchmarks/put-by-val-direct-large-index.js: |
| * microbenchmarks/put-by-val-direct.js: |
| * microbenchmarks/put-by-val-large-index-blank-indexing-type.js: |
| * microbenchmarks/put-by-val-machine-int.js: |
| * microbenchmarks/put-by-val-negative-array-index.js: |
| * microbenchmarks/put-by-val-with-string-replace-and-transition.js: |
| * microbenchmarks/put-by-val-with-string-slightly-polymorphic.js: |
| * microbenchmarks/put-by-val-with-string.js: |
| * microbenchmarks/put-by-val-with-symbol-replace-and-transition.js: |
| * microbenchmarks/put-by-val-with-symbol-slightly-polymorphic.js: |
| * microbenchmarks/put-by-val-with-symbol.js: |
| * microbenchmarks/rare-osr-exit-on-local.js: |
| * microbenchmarks/raytrace-with-empty-try-catch.js: |
| * microbenchmarks/raytrace-with-try-catch.js: |
| * microbenchmarks/regexp-exec.js: |
| * microbenchmarks/regexp-last-index.js: |
| * microbenchmarks/regexp-nested-nonzero-min-counted-parens.js: |
| * microbenchmarks/regexp-prototype-is-not-instance.js: |
| * microbenchmarks/regexp-prototype-search-observable-side-effects.js: |
| * microbenchmarks/regexp-prototype-search-observable-side-effects2.js: |
| * microbenchmarks/regexp-prototype-split-observable-side-effects.js: |
| * microbenchmarks/regexp-prototype-split-observable-side-effects2.js: |
| * microbenchmarks/regexp-prototype-split-observable-side-effects3-flags.js: |
| * microbenchmarks/regexp-prototype-split-observable-side-effects3-global.js: |
| * microbenchmarks/regexp-prototype-split-observable-side-effects3-ignoreCase.js: |
| * microbenchmarks/regexp-prototype-split-observable-side-effects3-multiline.js: |
| * microbenchmarks/regexp-prototype-split-observable-side-effects3-sticky.js: |
| * microbenchmarks/regexp-prototype-split-observable-side-effects3-unicode.js: |
| * microbenchmarks/regexp-prototype-split-observable-side-effects4.js: |
| * microbenchmarks/regexp-prototype-test-observable-side-effects.js: |
| * microbenchmarks/regexp-prototype-test-observable-side-effects2.js: |
| * microbenchmarks/regexp-set-last-index.js: |
| * microbenchmarks/regexp-u-global-es5.js: |
| * microbenchmarks/regexp-u-global-es6.js: |
| * microbenchmarks/register-pressure-from-osr.js: |
| * microbenchmarks/repeat-multi-get-by-offset.js: |
| * microbenchmarks/rest-parameter-construction-performance.js: |
| * microbenchmarks/richards-empty-try-catch.js: |
| * microbenchmarks/richards-try-catch.js: |
| * microbenchmarks/scoped-arguments-length.js: |
| * microbenchmarks/scoped-arguments-overridden-length.js: |
| * microbenchmarks/scoped-arguments-possibly-overridden-length.js: |
| * microbenchmarks/seal-and-do-work.js: |
| * microbenchmarks/set-for-each.js: |
| * microbenchmarks/set-for-of.js: |
| * microbenchmarks/setter-prototype.js: |
| * microbenchmarks/setter.js: |
| * microbenchmarks/simple-activation-demo.js: |
| * microbenchmarks/simple-getter-access.js: |
| * microbenchmarks/simple-poly-call-nested.js: |
| * microbenchmarks/simple-poly-call.js: |
| * microbenchmarks/simple-regexp-exec-folding-fail.js: |
| * microbenchmarks/simple-regexp-exec-folding.js: |
| * microbenchmarks/simple-regexp-test-folding-fail-with-hoisted-regexp.js: |
| * microbenchmarks/simple-regexp-test-folding-fail.js: |
| * microbenchmarks/simple-regexp-test-folding-with-hoisted-regexp.js: |
| * microbenchmarks/simple-regexp-test-folding.js: |
| * microbenchmarks/sin-boolean.js: |
| * microbenchmarks/singleton-scope.js: |
| * microbenchmarks/sink-function.js: |
| * microbenchmarks/sink-huge-activation.js: |
| * microbenchmarks/sinkable-new-object-dag.js: |
| * microbenchmarks/sinkable-new-object-taken.js: |
| * microbenchmarks/sinkable-new-object-with-builtin-constructor.js: |
| * microbenchmarks/sinkable-new-object.js: |
| * microbenchmarks/slow-array-profile-convergence.js: |
| * microbenchmarks/slow-convergence.js: |
| * microbenchmarks/slow-ternaries.js: |
| * microbenchmarks/sorting-benchmark.js: |
| * microbenchmarks/sparse-conditional.js: |
| * microbenchmarks/sparse-set.js: |
| * microbenchmarks/splice-to-remove.js: |
| * microbenchmarks/strcat-const.js: |
| * microbenchmarks/strcat-length-const.js: |
| * microbenchmarks/strict-osr-entry.js: |
| * microbenchmarks/string-char-code-at.js: |
| * microbenchmarks/string-concat-convert.js: |
| * microbenchmarks/string-concat-long-convert.js: |
| * microbenchmarks/string-concat-long.js: |
| * microbenchmarks/string-concat-object.js: |
| * microbenchmarks/string-concat-pair-object.js: |
| * microbenchmarks/string-concat-pair-simple.js: |
| * microbenchmarks/string-concat-simple.js: |
| * microbenchmarks/string-concat.js: |
| * microbenchmarks/string-cons-repeat.js: |
| * microbenchmarks/string-cons-tower.js: |
| * microbenchmarks/string-equality.js: |
| * microbenchmarks/string-from-char-code.js: |
| * microbenchmarks/string-get-by-val-big-char.js: |
| * microbenchmarks/string-get-by-val-out-of-bounds-insane.js: |
| * microbenchmarks/string-get-by-val-out-of-bounds.js: |
| * microbenchmarks/string-get-by-val.js: |
| * microbenchmarks/string-hash.js: |
| * microbenchmarks/string-long-ident-equality.js: |
| * microbenchmarks/string-object-to-string.js: |
| * microbenchmarks/string-object-value-of.js: |
| * microbenchmarks/string-out-of-bounds.js: |
| * microbenchmarks/string-prototype-search-observable-side-effects.js: |
| * microbenchmarks/string-prototype-search-observable-side-effects2.js: |
| * microbenchmarks/string-prototype-search-observable-side-effects3.js: |
| * microbenchmarks/string-prototype-search-observable-side-effects4.js: |
| * microbenchmarks/string-prototype-split-observable-side-effects.js: |
| * microbenchmarks/string-prototype-split-observable-side-effects2.js: |
| * microbenchmarks/string-prototype-split-observable-side-effects3-flags.js: |
| * microbenchmarks/string-prototype-split-observable-side-effects3-global.js: |
| * microbenchmarks/string-prototype-split-observable-side-effects3-ignoreCase.js: |
| * microbenchmarks/string-prototype-split-observable-side-effects3-multiline.js: |
| * microbenchmarks/string-prototype-split-observable-side-effects3-sticky.js: |
| * microbenchmarks/string-prototype-split-observable-side-effects3-unicode.js: |
| * microbenchmarks/string-prototype-split-observable-side-effects4.js: |
| * microbenchmarks/string-repeat-arith.js: |
| * microbenchmarks/string-repeat-not-resolving-fixed.js: |
| * microbenchmarks/string-repeat-not-resolving-no-inline.js: |
| * microbenchmarks/string-repeat-not-resolving.js: |
| * microbenchmarks/string-repeat-resolving-fixed.js: |
| * microbenchmarks/string-repeat-resolving-no-inline.js: |
| * microbenchmarks/string-repeat-resolving.js: |
| * microbenchmarks/string-repeat-single-not-resolving.js: |
| * microbenchmarks/string-repeat-single-resolving.js: |
| * microbenchmarks/string-repeat-small-not-resolving.js: |
| * microbenchmarks/string-repeat-small-resolving.js: |
| * microbenchmarks/string-replace-empty.js: |
| * microbenchmarks/string-replace-generic.js: |
| * microbenchmarks/string-replace.js: |
| * microbenchmarks/string-rope-with-object.js: |
| * microbenchmarks/string-slice-empty.js: |
| * microbenchmarks/string-slice-one-char.js: |
| * microbenchmarks/string-slice.js: |
| * microbenchmarks/string-sub.js: |
| * microbenchmarks/string-test.js: |
| * microbenchmarks/string-transcoding.js: |
| * microbenchmarks/string-var-equality.js: |
| * microbenchmarks/stringalloc.js: |
| * microbenchmarks/structure-hoist-over-transitions.js: |
| * microbenchmarks/substring-concat-weird.js: |
| * microbenchmarks/substring-concat.js: |
| * microbenchmarks/substring.js: |
| * microbenchmarks/super-get-by-id-with-this-monomorphic.js: |
| * microbenchmarks/super-get-by-id-with-this-polymorphic.js: |
| * microbenchmarks/super-get-by-val-with-this-monomorphic.js: |
| * microbenchmarks/super-get-by-val-with-this-polymorphic.js: |
| * microbenchmarks/super-getter.js: |
| * microbenchmarks/switch-char-constant.js: |
| * microbenchmarks/switch-char.js: |
| * microbenchmarks/switch-constant.js: |
| * microbenchmarks/switch-string-basic-big-var.js: |
| * microbenchmarks/switch-string-basic-big.js: |
| * microbenchmarks/switch-string-basic-var.js: |
| * microbenchmarks/switch-string-basic.js: |
| * microbenchmarks/switch-string-big-length-tower-var.js: |
| * microbenchmarks/switch-string-length-tower-var.js: |
| * microbenchmarks/switch-string-length-tower.js: |
| * microbenchmarks/switch-string-short.js: |
| * microbenchmarks/switch.js: |
| * microbenchmarks/switching-size-classes.js: |
| * microbenchmarks/symbol-creation.js: |
| * microbenchmarks/symbol-tostringtag.js: |
| * microbenchmarks/tan.js: |
| * microbenchmarks/tear-off-arguments-simple.js: |
| * microbenchmarks/tear-off-arguments.js: |
| * microbenchmarks/template-string-array.js: |
| * microbenchmarks/temporal-structure.js: |
| * microbenchmarks/throw.js: |
| * microbenchmarks/to-int32-boolean.js: |
| * microbenchmarks/to-number-boolean.js: |
| * microbenchmarks/to-number-constructor-number-string-number-string.js: |
| * microbenchmarks/to-number-constructor-only-number.js: |
| * microbenchmarks/to-number-constructor-only-string.js: |
| * microbenchmarks/to-number-constructor-string-number-string-number.js: |
| * microbenchmarks/to-number-number-string-number-string.js: |
| * microbenchmarks/to-number-only-number.js: |
| * microbenchmarks/to-number-only-string.js: |
| * microbenchmarks/to-number-string-number-string-number.js: |
| * microbenchmarks/to-string-on-cow-array.js: |
| * microbenchmarks/try-catch-get-by-val-cloned-arguments.js: |
| * microbenchmarks/try-catch-get-by-val-direct-arguments.js: |
| * microbenchmarks/try-catch-get-by-val-scoped-arguments.js: |
| * microbenchmarks/try-catch-word-count.js: |
| * microbenchmarks/try-get-by-id-basic.js: |
| * microbenchmarks/try-get-by-id-polymorphic.js: |
| * microbenchmarks/typed-array-get-set-by-val-profiling.js: |
| * microbenchmarks/typed-array-subarray.js: |
| * microbenchmarks/typed-array-sum.js: |
| * microbenchmarks/undefined-test.js: |
| * microbenchmarks/unprofiled-licm.js: |
| * microbenchmarks/untyped-string-from-char-code.js: |
| * microbenchmarks/v8-raytrace-with-empty-try-catch.js: |
| * microbenchmarks/v8-raytrace-with-try-catch.js: |
| * microbenchmarks/v8-regexp-search.js: |
| * microbenchmarks/varargs-call.js: |
| * microbenchmarks/varargs-construct-inline.js: |
| * microbenchmarks/varargs-construct.js: |
| * microbenchmarks/varargs-inline.js: |
| * microbenchmarks/varargs-strict-mode.js: |
| * microbenchmarks/varargs.js: |
| * microbenchmarks/vector-length-hint-array-constructor.js: |
| * microbenchmarks/vector-length-hint-new-array.js: |
| * microbenchmarks/weak-map-key.js: |
| * microbenchmarks/weak-set-key.js: |
| * microbenchmarks/weird-inlining-const-prop.js: |
| |
| 2019-10-22 Mark Lam <mark.lam@apple.com> |
| |
| Fix incorrect assertion in operationRegExpExecNonGlobalOrSticky(). |
| https://bugs.webkit.org/show_bug.cgi?id=203230 |
| <rdar://problem/56460749> |
| |
| Reviewed by Robin Morisset. |
| |
| * stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js: Added. |
| |
| 2019-10-21 Mark Lam <mark.lam@apple.com> |
| |
| Rolling out r251411: Fix is incorrect. |
| https://bugs.webkit.org/show_bug.cgi?id=203230 |
| |
| Not reviewed. |
| |
| * stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js: Removed. |
| |
| 2019-10-21 Mark Lam <mark.lam@apple.com> |
| |
| Fix incorrect assertion in operationRegExpExecNonGlobalOrSticky(). |
| https://bugs.webkit.org/show_bug.cgi?id=203230 |
| <rdar://problem/56460749> |
| |
| Reviewed by Robin Morisset. |
| |
| * stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js: Added. |
| |
| 2019-10-21 Saam Barati <sbarati@apple.com> |
| |
| ValuePow's constant folding rule differs from what the runtime does |
| https://bugs.webkit.org/show_bug.cgi?id=203220 |
| <rdar://problem/56181441> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * value-pow-ai-rule-should-box-the-same-way-as-the-runtime.js: Added. |
| (foo): |
| |
| 2019-10-21 Mark Lam <mark.lam@apple.com> |
| |
| Fix missing exception check in JSON Stringifier. |
| https://bugs.webkit.org/show_bug.cgi?id=203227 |
| <rdar://problem/56459854> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/missing-exception-check-in-josn-stringifier.js: Added. |
| |
| 2019-10-21 Saam Barati <sbarati@apple.com> |
| |
| JSON.parse has bad is array assert |
| https://bugs.webkit.org/show_bug.cgi?id=203207 |
| <rdar://problem/56366913> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/json-parse-array-prototype-is-array-assert.js: Added. |
| (assert): |
| |
| 2019-10-21 Robin Morisset <rmorisset@apple.com> |
| |
| Throw the right exception upon memory exhaustion in Array::slice |
| https://bugs.webkit.org/show_bug.cgi?id=202650 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/array-slice-memory-exhaustion.js: Added. |
| (foo): |
| |
| 2019-10-21 Robin Morisset <rmorisset@apple.com> |
| |
| Post increment/decrement should only call ToNumber once |
| https://bugs.webkit.org/show_bug.cgi?id=202711 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/postinc-custom-valueOf.js: Added. |
| (postInc): |
| (postDec): |
| |
| 2019-10-18 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] DFG::CommonData modification by DFG reallyAdd should be guarded by CodeBlock's lock |
| https://bugs.webkit.org/show_bug.cgi?id=203177 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/dfg-really-add-locking.js: Added. |
| |
| 2019-10-17 Mark Lam <mark.lam@apple.com> |
| |
| Add missing checks after calls to the sameValue() JSValue comparator. |
| https://bugs.webkit.org/show_bug.cgi?id=203126 |
| <rdar://problem/56366561> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/validate-exception-check-in-proxy-object-put.js: Added. |
| |
| 2019-10-17 Saam Barati <sbarati@apple.com> |
| |
| GetByVal and PutByVal on ArrayStorage need to use the same AbstractHeap |
| https://bugs.webkit.org/show_bug.cgi?id=203124 |
| <rdar://problem/55988183> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/licm-array-storage-get-and-put-by-val.js: Added. |
| (assert): |
| (foo): |
| |
| 2019-10-16 Keith Miller <keith_miller@apple.com> |
| |
| Move assert in Wasm::Plan::fail. |
| https://bugs.webkit.org/show_bug.cgi?id=203052 |
| |
| Reviewed by Mark Lam. |
| |
| * wasm/regress/wasm-plan-fail-bad-error-message-assert.js: Added. |
| (Binary): |
| (Binary.prototype.trunc_buffer): |
| (Binary.prototype.emit_leb_u): |
| (Binary.prototype.emit_u32v): |
| (Binary.prototype.emit_bytes): |
| (Binary.prototype.emit_header): |
| (__f_576): |
| (__f_587): |
| |
| 2019-10-15 Mark Lam <mark.lam@apple.com> |
| |
| operationSwitchCharWithUnknownKeyType failed to handle OOME when resolving rope string. |
| https://bugs.webkit.org/show_bug.cgi?id=202312 |
| <rdar://problem/55782280> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings.js: Added. |
| * stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings2.js: Added. |
| * stress/switch-on-char-llint-rope.js: |
| - Changed this test to make a new rope string for each iterations. Otherwise, |
| the rope will get resolved, and subsequent tiers will not be testing with a rope. |
| |
| 2019-10-14 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] GetterSetter should be JSCell, not JSObject |
| https://bugs.webkit.org/show_bug.cgi?id=202656 |
| |
| Reviewed by Tadeu Zagallo and Saam Barati. |
| |
| * stress/getter-setter-should-be-cell.js: Added. |
| (foo.with.): |
| (foo.with.get for): |
| (foo.with.bar): |
| (foo): |
| |
| 2019-10-14 Saam Barati <sbarati@apple.com> |
| |
| Canonicalize how we prepare the prototype chain for inline caching |
| https://bugs.webkit.org/show_bug.cgi?id=202827 |
| <rdar://problem/56193919> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/cache-correct-offset-after-flattening.js: Added. |
| (assert): |
| |
| 2019-10-14 Paulo Matos <pmatos@igalia.com> |
| |
| Skip memcpy-typed-loop timing out on ARMv7 pending investigation |
| https://bugs.webkit.org/show_bug.cgi?id=202923 |
| |
| Reviewed by Adrian Perez de Castro. |
| |
| * microbenchmarks/memcpy-typed-loop.js: |
| |
| 2019-10-11 Keith Miller <keith_miller@apple.com> |
| |
| Wasm B3IRGenerator should use arguments for control data. |
| https://bugs.webkit.org/show_bug.cgi?id=202855 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * wasm/stress/loop-more-args-than-results.js: Added. |
| |
| 2019-10-10 Mark Lam <mark.lam@apple.com> |
| |
| Modify JSTests/stress/string-overflow-createError-*.js tests to allow an OOME result. |
| https://bugs.webkit.org/show_bug.cgi?id=202828 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| The tests intentionally allocate a very large string. Hence, for some memory |
| limited configurations, it is perfectly reasonable for the test to throw an Out |
| Of Memory error. |
| |
| * stress/string-overflow-createError-builder.js: |
| * stress/string-overflow-createError-fit.js: |
| |
| 2019-10-09 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Unreviewed, roll out r250878 |
| https://bugs.webkit.org/show_bug.cgi?id=202656 |
| |
| Breaking vimeo page. |
| |
| * stress/getter-setter-should-be-cell.js: Removed. |
| |
| 2019-10-08 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] GetterSetter should be JSCell, not JSObject |
| https://bugs.webkit.org/show_bug.cgi?id=202656 |
| |
| Reviewed by Tadeu Zagallo and Saam Barati. |
| |
| * stress/getter-setter-should-be-cell.js: Added. |
| (foo.with.): |
| (foo.with.get for): |
| (foo.with.bar): |
| (foo): |
| |
| 2019-10-08 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| JSON.parse incorrectly handles array proxies |
| https://bugs.webkit.org/show_bug.cgi?id=199292 |
| |
| Reviewed by Saam Barati. |
| |
| * microbenchmarks/json-parse-array-reviver-same-value.js: Added. |
| * microbenchmarks/json-parse-array-reviver.js: Added. |
| * microbenchmarks/json-parse-object-reviver-same-value.js: Added. |
| * microbenchmarks/json-parse-object-reviver.js: Added. |
| * stress/json-parse-reviver-array-proxy.js: Added. |
| * stress/json-parse-reviver-revoked-proxy.js: Added. |
| * test262/expectations.yaml: Mark 6 test cases as passing. |
| |
| 2019-10-08 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Update test262 (2019.10.08). |
| |
| Rubber-stamped by Keith Miller. |
| |
| * test262/config.yaml: |
| * test262/expectations.yaml: |
| * test262/latest-changes-summary.txt: |
| * test262/test/: |
| * test262/test262-Revision.txt: |
| |
| 2019-10-07 Saam Barati <sbarati@apple.com> |
| |
| Allow OSR exit to the LLInt |
| https://bugs.webkit.org/show_bug.cgi?id=197993 |
| |
| Reviewed by Tadeu Zagallo. |
| |
| * stress/exit-from-getter-by-val.js: Added. |
| * stress/exit-from-setter-by-val.js: Added. |
| |
| 2019-10-07 Matt Lewis <jlewis3@apple.com> |
| |
| Unreviewed, rolling out r250750. |
| |
| Reverting change as this broke interal test over the weekend. |
| |
| Reverted changeset: |
| |
| "Allow OSR exit to the LLInt" |
| https://bugs.webkit.org/show_bug.cgi?id=197993 |
| https://trac.webkit.org/changeset/250750 |
| |
| 2019-10-04 Saam Barati <sbarati@apple.com> |
| |
| Allow OSR exit to the LLInt |
| https://bugs.webkit.org/show_bug.cgi?id=197993 |
| |
| Reviewed by Tadeu Zagallo. |
| |
| * stress/exit-from-getter-by-val.js: Added. |
| * stress/exit-from-setter-by-val.js: Added. |
| |
| 2019-10-04 Paulo Matos <pmatos@igalia.com> |
| |
| Revert regexp test skip on armv7l and mips |
| https://bugs.webkit.org/show_bug.cgi?id=202310 |
| |
| Reviewed by Žan Doberšek. |
| |
| Test was skipped in bug 202113 on armv7l and mips due to bug 202041. |
| Bug 202041 is fixed and change of bug 202113 can be reverted. |
| |
| * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js: |
| |
| 2019-10-02 Mark Lam <mark.lam@apple.com> |
| |
| DoubleToStringConverter::ToExponential() should null terminate its string. |
| https://bugs.webkit.org/show_bug.cgi?id=202492 |
| <rdar://problem/55907708> |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/dtoa-AddSubstring-should-uses-strnlen-in-assertion.js: Added. |
| |
| 2019-10-02 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] AsyncGenerator should have internal fields |
| https://bugs.webkit.org/show_bug.cgi?id=201498 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/async-generator-construct-failure.js: Added. |
| (shouldThrow): |
| (async.gen): |
| (TypeError): |
| * stress/async-generator-prototype-change.js: Added. |
| (shouldBe): |
| (async.gen): |
| * stress/async-generator-prototype-closure.js: Added. |
| (shouldBe): |
| (test.async.gen): |
| (test): |
| * stress/create-async-generator.js: Added. |
| (shouldBe): |
| (test.async.generator): |
| (test): |
| |
| 2019-10-01 Saam Barati <sbarati@apple.com> |
| |
| ObjectAllocationSinkingPhase shouldn't insert hints for allocations which are no longer valid |
| https://bugs.webkit.org/show_bug.cgi?id=199361 |
| <rdar://problem/52454940> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/allocation-sinking-hints-are-valid-ssa-2.js: Added. |
| (main.fn): |
| (main.executor): |
| (main): |
| * stress/allocation-sinking-hints-are-valid-ssa.js: Added. |
| (main.fn): |
| (main.executor): |
| (main): |
| |
| 2019-10-01 Keith Miller <keith_miller@apple.com> |
| |
| skip test until we figure out why it's timing out |
| https://bugs.webkit.org/show_bug.cgi?id=202423 |
| |
| Reviewed by Mark Lam. |
| |
| new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js consistently times out on the bots. |
| Let's skip it until we figure out what's going on. |
| |
| * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: |
| |
| 2019-10-01 Keith Miller <keith_miller@apple.com> |
| |
| Mark toctou test as skipped on debug builds |
| https://bugs.webkit.org/show_bug.cgi?id=202420 |
| |
| Reviewed by Saam Barati. |
| |
| Keeps timing out... Let's just skip it. |
| |
| * stress/toctou-having-a-bad-time-new-array.js: |
| |
| 2019-10-01 Keith Miller <keith_miller@apple.com> |
| |
| Test262 update |
| |
| Rubber-stamped by Michael Saboff. |
| |
| Note, this was too big to effectivetly put on bugzilla as it's a 10MB patch... |
| |
| * test262/*: |
| |
| 2019-10-01 Michael Saboff <msaboff@apple.com> and Paulo Matos <pmatos@igalia.com> |
| |
| [YARR] Properly handle surrogates when matching back references |
| https://bugs.webkit.org/show_bug.cgi?id=202041 |
| |
| Reviewed by Keith Miller. |
| |
| Unchanged from the workin progress patch posted by Paulo Matos <pmatos@igalia.com>. |
| |
| Updated test. |
| |
| * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js: |
| (testRegExpNotMatch): |
| |
| 2019-10-01 Keith Miller <keith_miller@apple.com> |
| |
| Add support for the Wasm multi-value proposal |
| https://bugs.webkit.org/show_bug.cgi?id=202250 |
| |
| Reviewed by Saam Barati. |
| |
| This patch adds a new way to run stress tests via the .wat text |
| format. By attaching an asm.js compiled version of the wabt tool |
| we can easily create wat files programatically and convert them |
| into a wasm blob to compile. To make this easy there is a |
| wabt-wrapper.js module file that exports two useful functions that |
| correspond to WebAssembly.compile and WebAssembly.instantiate. |
| |
| * wasm.yaml: |
| * wasm/function-tests/if-no-else-non-void.js: |
| * wasm/js-api/web-assembly-instantiate.js: |
| (assert.asyncTest.async.test): |
| (assert.asyncTest): |
| * wasm/libwabt.js: Added. |
| (WabtModule): |
| (set get if): |
| * wasm/references/func_ref.js: |
| * wasm/references/validation.js: |
| (assert.throws): |
| * wasm/spec-harness/index.js: |
| * wasm/spec-tests/block.wast.js: |
| * wasm/spec-tests/br.wast.js: |
| * wasm/spec-tests/br_if.wast.js: |
| * wasm/spec-tests/call.wast.js: |
| * wasm/spec-tests/call_indirect.wast.js: |
| * wasm/spec-tests/func.wast.js: |
| * wasm/spec-tests/if.wast.js: |
| * wasm/spec-tests/loop.wast.js: |
| * wasm/spec-tests/type.wast.js: |
| * wasm/stress/js-wasm-call-many-return-types-on-stack-no-args.js: Added. |
| (buildWat): |
| * wasm/stress/js-wasm-js-varying-arities.js: Added. |
| (paramForwarder): |
| * wasm/stress/wasm-js-call-many-return-types-on-stack-no-args.js: Added. |
| (buildWat): |
| * wasm/stress/wasm-js-multi-value-exception-in-iterator.js: Added. |
| (buildWat.throwError): |
| (buildWat.throwErrorInIterator): |
| (buildWat.tooManyValues): |
| (buildWat.tooFewValues): |
| (buildWat): |
| * wasm/stress/wasm-wasm-call-indirect-many-return-types-on-stack.js: Added. |
| (buildWat): |
| * wasm/stress/wasm-wasm-call-many-return-types-on-stack-no-args.js: Added. |
| (buildWat): |
| * wasm/wabt-wrapper.js: Added. |
| (export.compile): |
| * wasm/wast-tests/br-if-at-end-of-block.wasm: Added. |
| * wasm/wast-tests/br-if-at-end-of-block.wast: Added. |
| * wasm/wast-tests/harness.js: |
| (async.runWasmFile): |
| * wasm/wast-tests/single-param-loop-signature.wasm: Added. |
| * wasm/wast-tests/single-param-loop-signature.wast: Added. |
| |
| 2019-09-30 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Make assertion in JSObject::putOwnDataProperty more precise |
| https://bugs.webkit.org/show_bug.cgi?id=202379 |
| <rdar://problem/49515980> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/object-assign-target-proto-setter.js: Added. |
| (get Object): |
| |
| 2019-09-30 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] HeapSnapshotBuilder m_rootData should be protected with a lock too |
| https://bugs.webkit.org/show_bug.cgi?id=202389 |
| <rdar://problem/50717564> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/heap-analyzer-taking-lock.js: Added. |
| |
| 2019-09-30 Saam Barati <sbarati@apple.com> |
| |
| Inline caching is wrong for custom accessors and custom values |
| https://bugs.webkit.org/show_bug.cgi?id=201994 |
| <rdar://problem/50850326> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * microbenchmarks/custom-accessor-materialized.js: Added. |
| (assert): |
| (test4.get const): |
| * microbenchmarks/custom-accessor-thin-air.js: Added. |
| (assert): |
| (test5.get const): |
| (test5.get proto): |
| * microbenchmarks/custom-accessor.js: Added. |
| (assert): |
| (test3.get const): |
| * microbenchmarks/custom-value-2.js: Added. |
| (assert): |
| (test1.getMultiline): |
| (test1): |
| * microbenchmarks/custom-value.js: Added. |
| (assert): |
| (test1.getMultiline): |
| (test1): |
| * stress/custom-accessor-delete-1.js: Added. |
| (assert): |
| (test3.get const): |
| * stress/custom-accessor-delete-2.js: Added. |
| (assert): |
| (test4.get const): |
| * stress/custom-accessor-delete-3.js: Added. |
| (assert): |
| (test5.get const): |
| (test5.get proto): |
| * stress/custom-value-delete-property-1.js: Added. |
| (assert): |
| (test1.getMultiline): |
| (test1): |
| * stress/custom-value-delete-property-2.js: Added. |
| (test2.foo): |
| (test2): |
| * stress/custom-value-delete-property-3.js: Added. |
| (test6.foo): |
| (test6): |
| |
| 2019-09-30 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] AI folds CompareEq wrongly when it sees proven Boolean and Number |
| https://bugs.webkit.org/show_bug.cgi?id=202382 |
| <rdar://problem/52669112> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/compare-eq-bool-number-folding.js: Added. |
| (test): |
| |
| 2019-09-27 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Keep JSString::value(ExecState*)'s result as String instead of `const String&` |
| https://bugs.webkit.org/show_bug.cgi?id=202330 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/to-lower-case-gc-stress.js: Added. |
| |
| 2019-09-27 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Non-standard Error properties should not be enumerable |
| https://bugs.webkit.org/show_bug.cgi?id=198975 |
| |
| Reviewed by Ross Kirsling. |
| |
| * ChakraCore/test/Error/NativeErrors_v4.baseline-jsc: Adjust expectations. |
| * microbenchmarks/let-for-in.js: Adjust test. |
| * test262/expectations.yaml: Mark 6 test cases as passing. |
| |
| 2019-09-26 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] DFG recursive-tail-call optimization should not emit jump to call-frame with varargs |
| https://bugs.webkit.org/show_bug.cgi?id=202299 |
| <rdar://problem/52669116> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/recursive-tail-call-optimization-should-not-jump-into-call-frame-with-varargs-simple.js: Added. |
| (foo): |
| (test): |
| * stress/recursive-tail-call-optimization-should-not-jump-into-call-frame-with-varargs.js: Added. |
| (foo): |
| (C1.prototype.baz): |
| (C1): |
| (bar): |
| (noInline.bar.goo): |
| (C2.prototype.baz): |
| (C2): |
| (test): |
| |
| 2019-09-26 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| toExponential, toFixed, and toPrecision should allow arguments up to 100 |
| https://bugs.webkit.org/show_bug.cgi?id=199163 |
| |
| Reviewed by Ross Kirsling. |
| |
| * ChakraCore/test/Number/toString_3.baseline-jsc: |
| * ChakraCore/test/es5/exceptions3.baseline-jsc: |
| * test262/expectations.yaml: Mark 6 test cases as passing. |
| |
| 2019-09-24 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| [ES6] Come up with a test for Proxy.[[GetOwnProperty]] that tests the isExtensible error when the result of the trap is undefined |
| https://bugs.webkit.org/show_bug.cgi?id=154376 |
| |
| Reviewed by Ross Kirsling. |
| |
| Adds 2 test cases: |
| 1. If [[GetOwnProperty]] trap result is `undefined` and Proxy's target is non-extensible, TypeError is thrown. |
| 2. If [[GetOwnProperty]] trap result is `undefined` and Proxy's target is another Proxy, its "isExtensible" trap is called. |
| |
| * stress/proxy-get-own-property.js: |
| |
| 2019-09-24 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] Add ValueBitRShift into DFG |
| https://bugs.webkit.org/show_bug.cgi?id=192663 |
| |
| Reviewed by Robin Morisset. |
| |
| * stress/big-int-right-shift-jit-osr.js: Added. |
| * stress/big-int-right-shift-jit-untyped.js: Added. |
| * stress/big-int-right-shift-jit.js: Added. |
| * stress/value-rshift-ai-rule.js: Added. |
| |
| 2019-09-23 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Array methods should throw TypeError upon attempting to modify a string |
| https://bugs.webkit.org/show_bug.cgi?id=201910 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/array-methods-should-not-modify-string.js: Added. |
| |
| * mozilla/js1_6/Array/regress-304828.js: |
| Fix test. Original copy was changed similarly seven years ago: |
| https://searchfox.org/mozilla-central/source/js/src/tests/non262/Array/regress-304828.js |
| |
| * stress/phantom-insertion-live-range-should-agree-with-arguments-forwarding.js: |
| Fix test. `Object.__proto__ = []; Object.shift();` shouldn't be valid JS. |
| |
| 2019-09-23 Mark Lam <mark.lam@apple.com> |
| |
| Lazy JSGlobalObject property materialization should not use putDirectWithoutTransition. |
| https://bugs.webkit.org/show_bug.cgi?id=202122 |
| <rdar://problem/55535249> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/lazy-global-object-property-materialization-should-not-putDirectWithoutTransition.js: Added. |
| |
| 2019-09-23 Caio Lima <ticaiolima@gmail.com> |
| |
| Skip stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js into ARMv7 and MIPS |
| https://bugs.webkit.org/show_bug.cgi?id=202113 |
| |
| Unreviewed test gardening, skipped test in ARMv7 and MIPS. |
| |
| It is going to be fixed in |
| https://bugs.webkit.org/show_bug.cgi?id=202041 |
| |
| * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js: |
| |
| 2019-09-22 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Int52Rep(DoubleRepAnyIntUse) should not call operation function |
| https://bugs.webkit.org/show_bug.cgi?id=202072 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/int52rep-with-double-checks-int52-range.js: Added. |
| (shouldBe): |
| (test): |
| |
| 2019-09-21 Caio Lima <ticaiolima@gmail.com> |
| |
| stress/test-out-of-memory.js is not throwing OOM into ARMv7 and MIPS |
| https://bugs.webkit.org/show_bug.cgi?id=202011 |
| |
| Reviewed by Mark Lam. |
| |
| We are skipping this test into MIPS and ARMv7 because some of its assumptions |
| are not valid for them. The current behavior of the test in those architectures |
| is that it does not throw during `new ArrayBuffer(1000)` allocation site, |
| because eden collection keeps happening between iterations. The collection |
| is triggered on those architectures because the amount of stress |
| `new Promise` generates into GC limits is not enough to avoid them |
| while loop is executing. |
| |
| Changing the size of `UInt8Array` from `80000000` to `160000000` can |
| be an alternative fix to avoid collection happening during `ArrayBuffer` |
| allocation loop, but we can't guarantee this test is always going to execute |
| without error when Gigacage is disabled, given we can reach an OOM state in |
| some allocations that need to succeed, making this test flaky for those |
| architectures. |
| |
| * stress/test-out-of-memory.js: |
| |
| 2019-09-21 Tadeu Zagallo <tzagallo@apple.com> |
| |
| AccessCase should strongly visit its dependencies while on stack |
| https://bugs.webkit.org/show_bug.cgi?id=201986 |
| <rdar://problem/55521953> |
| |
| Reviewed by Saam Barati and Yusuke Suzuki. |
| |
| * stress/ftl-put-by-id-setter-exception-interesting-live-state-2.js: Added. |
| (foo): |
| (warmup): |
| |
| 2019-09-20 Saam Barati <sbarati@apple.com> |
| |
| Unreviewed. Make toctou-having-a-bad-time-new-array.js run for less time because it's timing out on the debug bots. |
| |
| * stress/toctou-having-a-bad-time-new-array.js: |
| |
| 2019-09-19 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] DFG op_call_varargs should not assume that one-previous-local of freeReg is usable |
| https://bugs.webkit.org/show_bug.cgi?id=202014 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/call-varargs-inlining-should-not-clobber-previous-to-free-register.js: Added. |
| (__v0): |
| |
| 2019-09-19 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Syntax checker should report duplicate __proto__ properties |
| https://bugs.webkit.org/show_bug.cgi?id=201897 |
| <rdar://problem/53201788> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/syntax-checker-duplicate-underscore-proto.js: Added. |
| (catch): |
| |
| 2019-09-18 Saam Barati <sbarati@apple.com> |
| |
| TOCTOU bug in havingABadTime related assertion in DFGSpeculativeJIT |
| https://bugs.webkit.org/show_bug.cgi?id=201953 |
| <rdar://problem/53803524> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/toctou-having-a-bad-time-new-array.js: Added. |
| (let.code): |
| |
| 2019-09-18 Saam Barati <sbarati@apple.com> |
| |
| Phantom insertion phase may disagree with arguments forwarding about live ranges |
| https://bugs.webkit.org/show_bug.cgi?id=200715 |
| <rdar://problem/54301717> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/phantom-insertion-live-range-should-agree-with-arguments-forwarding.js: Added. |
| (main.v23): |
| (main.try.v43): |
| (main.): |
| (main): |
| |
| 2019-09-17 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Generator should have internal fields |
| https://bugs.webkit.org/show_bug.cgi?id=201159 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/create-generator.js: Added. |
| (shouldBe): |
| (test.generator): |
| (test): |
| * stress/generator-construct-failure.js: Added. |
| (shouldThrow): |
| (TypeError): |
| * stress/generator-prototype-change.js: Added. |
| (shouldBe): |
| (gen): |
| * stress/generator-prototype-closure.js: Added. |
| (shouldBe): |
| (test.gen): |
| (test): |
| * stress/object-assign-fast-path.js: |
| |
| 2019-09-17 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Follow-up after String.codePointAt optimization |
| https://bugs.webkit.org/show_bug.cgi?id=201889 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/string-char-at-bad-type.js: Added. |
| (shouldBe): |
| (object.toString): |
| (test): |
| * stress/string-char-code-at-bad-type.js: Added. |
| (shouldBe): |
| (object.toString): |
| (test): |
| * stress/string-code-point-at-bad-type.js: Added. |
| (shouldBe): |
| (object.toString): |
| (test): |
| |
| 2019-09-17 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] CheckArray+NonArray is not filtering out Array in AI |
| https://bugs.webkit.org/show_bug.cgi?id=201857 |
| <rdar://problem/54194820> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/check-array-with-non-array-does-not-filter-arrays.js: Added. |
| (foo): |
| |
| 2019-09-17 Saam Barati <sbarati@apple.com> |
| |
| CheckArray on DirectArguments/ScopedArguments does not filter out slow put array storage |
| https://bugs.webkit.org/show_bug.cgi?id=201853 |
| <rdar://problem/53805461> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/direct-arguments-check-array-filter-type.js: Added. |
| (foo): |
| |
| 2019-09-16 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Wasm StreamingParser should validate that number of functions matches number of declarations |
| https://bugs.webkit.org/show_bug.cgi?id=201850 |
| <rdar://problem/55290186> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * wasm/regress/validate-number-of-functions-match-declarations.js: Added. |
| (catch): |
| |
| 2019-09-16 Michael Saboff <msaboff@apple.com> |
| |
| [JSC] Perform check again when we found non-BMP characters |
| https://bugs.webkit.org/show_bug.cgi?id=201647 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js: Added. |
| * stress/regexp-unicode-within-string.js: Updated test to eliminate the bogus print(). |
| (testRegExpInbounds): |
| |
| 2019-09-16 Ross Kirsling <ross.kirsling@sony.com> |
| |
| [JSC] Add missing syntax errors for await in function parameter default expressions |
| https://bugs.webkit.org/show_bug.cgi?id=201615 |
| |
| Reviewed by Darin Adler. |
| |
| * stress/async-await-reserved-word.js: |
| * stress/async-await-syntax.js: |
| Add test cases. |
| |
| * test262/expectations.yaml: |
| Mark newly-passing test cases. |
| |
| 2019-09-16 Saam Barati <sbarati@apple.com> |
| |
| JSObject::putInlineSlow should not ignore "__proto__" for Proxy |
| https://bugs.webkit.org/show_bug.cgi?id=200386 |
| <rdar://problem/53854946> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/proxy-__proto__-in-prototype-chain.js: Added. |
| * stress/proxy-property-replace-structure-transition.js: Added. |
| |
| 2019-09-13 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Date.prototype.toJSON does not execute steps 1-2 |
| https://bugs.webkit.org/show_bug.cgi?id=105282 |
| |
| Reviewed by Ross Kirsling. |
| |
| * test262/expectations.yaml: Mark 2 test cases as passing. |
| |
| 2019-09-12 Mark Lam <mark.lam@apple.com> |
| |
| Harden JSC against the abuse of runtime options. |
| https://bugs.webkit.org/show_bug.cgi?id=201597 |
| <rdar://problem/55167068> |
| |
| Reviewed by Filip Pizlo. |
| |
| Remove the call to forceGCSlowPaths(). This utility function will be removed. |
| The modern way to set the required option is to use //@ requireOptions. |
| |
| * stress/ftl-try-catch-oom-error-lazy-slow-path.js: |
| |
| 2019-09-11 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Add StringCodePointAt intrinsic |
| https://bugs.webkit.org/show_bug.cgi?id=201673 |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/string-char-at-constant-index-out-of-range.js: Added. |
| (shouldBe): |
| (test): |
| * stress/string-char-code-at-constant-index-out-of-range.js: Added. |
| (shouldBe): |
| (test): |
| * stress/string-code-point-at--out-of-range.js: Added. |
| (shouldBe): |
| (test): |
| * stress/string-code-point-at-basic.js: Added. |
| (test): |
| * stress/string-code-point-at-constant-index-out-of-range.js: Added. |
| (shouldBe): |
| (test): |
| * stress/string-code-point-at-constant-int32-max-index-out-of-range.js: Added. |
| (shouldBe): |
| (test): |
| * stress/string-code-point-at-constant-surrogate-pair.js: Added. |
| (shouldBe): |
| (test): |
| (breaking): |
| * stress/string-code-point-at-surrogate-pair.js: Added. |
| (shouldBe): |
| * stress/string-code-point-at.js: Added. |
| (shouldBe): |
| |
| 2019-09-10 Michael Saboff <msaboff@apple.com> |
| |
| JSC crashes due to stack overflow while building RegExp |
| https://bugs.webkit.org/show_bug.cgi?id=201649 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| New regression test. |
| |
| * stress/regexp-bol-optimize-out-of-stack.js: Added. |
| (test): |
| (catch): |
| |
| 2019-09-10 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [WebAssembly] Use StreamingParser in existing Wasm::BBQPlan |
| https://bugs.webkit.org/show_bug.cgi?id=189043 |
| |
| Reviewed by Keith Miller. |
| |
| The offset performing the validation becomes a bit different. |
| The offset 0 is nice since it is the starting offset of the Module header signature compared to the offset 8. |
| |
| * wasm/js-api/version.js: |
| |
| 2019-09-07 Keith Miller <keith_miller@apple.com> |
| |
| OSR entry into wasm misses some contexts |
| https://bugs.webkit.org/show_bug.cgi?id=201569 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| Add a new harness and wast and the generated wasm file for |
| testing. The idea long term is to make it easy to test by creating |
| a C file and converting it to a wast then modify that to produce a |
| test. |
| |
| * wasm.yaml: |
| * wasm/wast-tests/harness.js: Added. |
| (async.runWasmFile): |
| * wasm/wast-tests/osr-entry-inner-loop-branch-above-no-consts.wasm: Added. |
| * wasm/wast-tests/osr-entry-inner-loop-branch-above-no-consts.wast: Added. |
| * wasm/wast-tests/osr-entry-inner-loop-branch-above.wasm: Added. |
| * wasm/wast-tests/osr-entry-inner-loop-branch-above.wast: Added. |
| * wasm/wast-tests/osr-entry-inner-loop.wasm: Added. |
| * wasm/wast-tests/osr-entry-inner-loop.wast: Added. |
| * wasm/wast-tests/osr-entry-multiple-enclosed-contexts.wasm: Added. |
| * wasm/wast-tests/osr-entry-multiple-enclosed-contexts.wast: Added. |
| |
| 2019-09-09 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Promise resolve/reject functions should be created more efficiently |
| https://bugs.webkit.org/show_bug.cgi?id=201488 |
| |
| Reviewed by Mark Lam. |
| |
| * microbenchmarks/promise-creation-many.js: Added. |
| (executor): |
| |
| 2019-09-09 Zan Dobersek <zdobersek@igalia.com> |
| |
| Unreviewed JSC test gardening. |
| |
| * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: |
| This test allocates a 2GB string before it goes out and tests |
| out-of-memory exception when appending other strings to it. As such, |
| skip the test on memory-limited platforms. |
| |
| 2019-09-07 Mark Lam <mark.lam@apple.com> |
| |
| The jsc shell should allow disabling of the Gigacage for testing purposes. |
| https://bugs.webkit.org/show_bug.cgi?id=201579 |
| |
| Reviewed by Michael Saboff. |
| |
| Unskip the tests now. |
| |
| * stress/disable-gigacage-arrays.js: |
| * stress/disable-gigacage-strings.js: |
| * stress/disable-gigacage-typed-arrays.js: |
| |
| 2019-09-07 Mark Lam <mark.lam@apple.com> |
| |
| Gardening: temporarily skipping these tests until the fix can be reviewed and landed. |
| |
| Not reviewed. |
| |
| See https://bugs.webkit.org/show_bug.cgi?id=201579 for the fix. |
| |
| * stress/disable-gigacage-arrays.js: |
| * stress/disable-gigacage-strings.js: |
| * stress/disable-gigacage-typed-arrays.js: |
| |
| 2019-09-07 Mark Lam <mark.lam@apple.com> |
| |
| Gardening: speculative test fix to green bots [attempt #2]. |
| https://bugs.webkit.org/show_bug.cgi?id=201529 |
| <rdar://problem/53935772> |
| |
| Not reviewed. |
| |
| * stress/test-out-of-memory.js: |
| |
| 2019-09-06 Mark Lam <mark.lam@apple.com> |
| |
| Gardening: speculative test fix to green bots. |
| https://bugs.webkit.org/show_bug.cgi?id=201529 |
| <rdar://problem/53935772> |
| |
| Not reviewed. |
| |
| * stress/test-out-of-memory.js: |
| |
| 2019-09-06 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Math.round() produces wrong result for value prior to 0.5 |
| https://bugs.webkit.org/show_bug.cgi?id=185115 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/math-round-basics.js: |
| Add positive/negative test cases. |
| |
| * test262/expectations.yaml: |
| Mark test passing. |
| |
| 2019-09-06 Mark Lam <mark.lam@apple.com> |
| |
| Move web-assembly-constructors-should-not-override-global-object-property.js below JSTests/wasm/stress. |
| https://bugs.webkit.org/show_bug.cgi?id=201551 |
| |
| Reviewed by Tadeu Zagallo. |
| |
| Ports that don't support WASM will always fail this test if it stays in JSTests/stress. |
| |
| * stress/web-assembly-constructors-should-not-override-global-object-property.js: Removed. |
| * wasm/stress/web-assembly-constructors-should-not-override-global-object-property.js: Copied from JSTests/stress/web-assembly-constructors-should-not-override-global-object-property.js. |
| |
| 2019-09-06 Mark Lam <mark.lam@apple.com> |
| |
| Fix bmalloc::Allocator:tryAllocate() to return null on failure to allocate. |
| https://bugs.webkit.org/show_bug.cgi?id=201529 |
| <rdar://problem/53935772> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/test-out-of-memory.js: Added. |
| |
| 2019-09-05 Tadeu Zagallo <tzagallo@apple.com> |
| |
| LazyClassStructure::setConstructor should not store the constructor to the global object |
| https://bugs.webkit.org/show_bug.cgi?id=201484 |
| <rdar://problem/50400451> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/web-assembly-constructors-should-not-override-global-object-property.js: Added. |
| |
| 2019-09-05 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Do not use FTLOutput::weakPointer directly |
| https://bugs.webkit.org/show_bug.cgi?id=201495 |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/create-promise-weak-pointer.js: Added. |
| (foo): |
| |
| 2019-09-04 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Make Promise implementation faster |
| https://bugs.webkit.org/show_bug.cgi?id=200898 |
| |
| Reviewed by Saam Barati. |
| |
| * ChakraCore/test/UnitTestFramework/UnitTestFramework.js: |
| (assert.assert.return.throws): |
| * modules/breaking-builtin-promise-then-does-not-break-internal-promise.js: Added. |
| * modules/breaking-builtin-promise-then-does-not-break-internal-promise/test.js: Added. |
| * stress/constructor-kind-naked-should-not-be-applied-to-inner-functions.js: Added. |
| (shouldThrow): |
| (new.Promise): |
| (shouldThrow.Promise): |
| * stress/create-promise-should-respect-promise-realm.js: Added. |
| (shouldBe): |
| (other.new.OtherPromise): |
| (DerivedOtherPromise): |
| (i.promise.new.DerivedOtherPromise): |
| (createPromise): |
| * stress/derived-promise-constructor-class-syntax-prototype-replace-attempt.js: Added. |
| (shouldBe): |
| (DerivedPromise): |
| (i.array.push.new.DerivedPromise): |
| (promise.new.DerivedPromise): |
| * stress/derived-promise-constructor-inlined.js: Added. |
| (shouldBe): |
| (DerivedPromise): |
| (i.array.push.new.DerivedPromise): |
| (DerivedPromise.all.array.then): |
| * stress/derived-promise-prototype-replaced.js: Added. |
| (shouldBe): |
| (DerivedPromise): |
| (i.array.push.new.DerivedPromise): |
| (promise.new.DerivedPromise): |
| * stress/internal-promise-constructor-not-confusing.js: Added. |
| (shouldBe): |
| (InternalPromise.vm.createBuiltin): |
| (DerivedPromise): |
| * stress/internal-promise-is-not-exposed.js: Added. |
| (shouldBe): |
| * stress/new-promise-should-respect-promise-realm.js: Added. |
| (shouldBe): |
| (other.new.OtherPromise): |
| (createPromise): |
| * stress/promise-cannot-be-called.js: |
| (shouldThrow): |
| * stress/promise-capability-fast-path.js: Added. |
| (shouldBe): |
| (i.array.push.new.Promise): |
| (i.array.i.then): |
| * stress/promise-capability-slow-path.js: Added. |
| (shouldBe): |
| (Promise.prototype.then): |
| (i.array.push.new.Promise): |
| (i.array.i.then): |
| * stress/promise-capability-then-slow-path.js: Added. |
| (shouldBe): |
| (DerivedPromise): |
| (DerivedPromise.prototype.then): |
| (i.array.push.new.DerivedPromise): |
| (i.array.i.then): |
| * stress/promise-constructor-inlined.js: Added. |
| (shouldBe): |
| (i.array.push.new.Promise): |
| (Promise.all.array.then): |
| * stress/promise-constructor-transition-from-new-promise-to-create-promise.js: Added. |
| (shouldBe): |
| (DerivedPromise): |
| (DerivedPromise2): |
| (i.array.push.new.DerivedPromise): |
| (i.array2.push.new.DerivedPromise2): |
| * stress/without-promise-functions.js: Added. |
| (shouldBe): |
| (async): |
| |
| 2019-09-03 Mark Lam <mark.lam@apple.com> |
| |
| Assertions in JSArrayBufferView::byteOffset() are only valid for the mutator thread. |
| https://bugs.webkit.org/show_bug.cgi?id=201309 |
| <rdar://problem/54832121> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/JSArrayBufferView-byteOffset-is-racy-from-compiler-thread.js: Added. |
| |
| 2019-08-30 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Generate new.target register only when it is used |
| https://bugs.webkit.org/show_bug.cgi?id=201335 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/ensure-new-register-allocated.js: Added. |
| (shouldBe): |
| (basic): |
| (arrow): |
| (Base): |
| (Derived): |
| (evaluate): |
| |
| 2019-08-30 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] DFG ByteCodeParser should not copy JIT-related part of SimpleJumpTable |
| https://bugs.webkit.org/show_bug.cgi?id=201331 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/simple-jump-table-copy.js: Added. |
| (let.code): |
| (g2): |
| |
| 2019-08-30 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] DFG inlining CheckBadCell slow path does not assume result VirtualRegister can be invalid |
| https://bugs.webkit.org/show_bug.cgi?id=201332 |
| |
| Reviewed by Mark Lam. |
| |
| This test is very flaky, it is hard to reproduce. |
| |
| * stress/setter-inlining-resulting-bad-cell-result-virtual-register-should-be-invalid.js: Added. |
| (code): |
| |
| 2019-08-29 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Repatch should construct CallCases and CasesValue at the same time |
| https://bugs.webkit.org/show_bug.cgi?id=201325 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/repatch-switch.js: Added. |
| (main.f2.f0): |
| (main.f2.f3): |
| (main.f2.f1): |
| (main.f2): |
| (main): |
| |
| 2019-08-29 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] ObjectAllocationSinkingPhase wrongly deals with always-taken branches during interpretation |
| https://bugs.webkit.org/show_bug.cgi?id=198650 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/object-allocation-sinking-interpretation-can-interpret-edges-that-can-be-proven-unreachable-in-ai.js: |
| (main.v0): |
| (main): |
| |
| 2019-08-28 Mark Lam <mark.lam@apple.com> |
| |
| DFG/FTL: We should prefetch structures and do a loadLoadFence before doing PrototypeChainIsSane checks. |
| https://bugs.webkit.org/show_bug.cgi?id=201281 |
| <rdar://problem/54028228> |
| |
| Reviewed by Yusuke Suzuki and Saam Barati. |
| |
| * stress/structure-storedPrototype-should-only-assert-on-the-mutator-thread.js: Added. |
| |
| 2019-08-28 Mark Lam <mark.lam@apple.com> |
| |
| Placate exception check validation in DFG's operationHasGenericProperty(). |
| https://bugs.webkit.org/show_bug.cgi?id=201245 |
| <rdar://problem/54777512> |
| |
| Reviewed by Robin Morisset. |
| |
| * stress/missing-exception-check-in-operationHasGenericProperty.js: Added. |
| |
| 2019-08-27 Mark Lam <mark.lam@apple.com> |
| |
| constructFunctionSkippingEvalEnabledCheck() should use tryMakeString() and check for OOM. |
| https://bugs.webkit.org/show_bug.cgi?id=201196 |
| <rdar://problem/54703775> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: Added. |
| |
| 2019-08-26 Ross Kirsling <ross.kirsling@sony.com> |
| |
| [JSC] Ensure x?.y ?? z is fast |
| https://bugs.webkit.org/show_bug.cgi?id=200875 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/nullish-coalescing.js: |
| |
| 2019-08-23 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Remove MaximalFlushInsertionPhase |
| https://bugs.webkit.org/show_bug.cgi?id=201036 |
| |
| Reviewed by Saam Barati. |
| |
| Remove all the references to maximal flush |
| |
| * stress/arith-ceil-on-various-types.js: |
| (checkCompileCountForUselessNegativeZero): |
| * stress/arith-floor-on-various-types.js: |
| (checkCompileCountForUselessNegativeZero): |
| * stress/arith-negate-on-various-types.js: |
| (checkCompileCountForUselessNegativeZero): |
| * stress/arith-round-on-various-types.js: |
| (checkCompileCountForUselessNegativeZero): |
| * stress/arith-trunc-on-various-types.js: |
| (checkCompileCountForUselessNegativeZero): |
| * stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js: |
| * stress/has-indexed-property-should-accept-non-int32.js: |
| * stress/has-indexed-property-with-worsening-array-mode.js: |
| * stress/known-int32-cant-be-used-across-bytecode-boundary.js: |
| * stress/read-dead-bytecode-locals-in-must-handle-values1.js: |
| * stress/read-dead-bytecode-locals-in-must-handle-values2.js: |
| * stress/rest-parameter-many-arguments.js: |
| * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness-2.js: |
| * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness.js: |
| * stress/to-index-string-should-not-assume-incoming-value-is-uint32.js: |
| |
| 2019-08-23 Justin Michaud <justin_michaud@apple.com> |
| |
| [WASM-References] Do not overwrite argument registers in jsCallEntrypoint |
| https://bugs.webkit.org/show_bug.cgi?id=200952 |
| |
| Reviewed by Saam Barati. |
| |
| * wasm/references/func_ref.js: |
| (assert.throws): |
| |
| 2019-08-22 Justin Michaud <justin_michaud@apple.com> |
| |
| Add missing exception check in canonicalizeLocaleList |
| https://bugs.webkit.org/show_bug.cgi?id=201021 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/missing-exception-check-in-canonicalizeLocaleList.js: Added. |
| (catch): |
| |
| 2019-08-21 Mark Lam <mark.lam@apple.com> |
| |
| Wasm::FunctionParser is failing to enforce maxFunctionLocals. |
| https://bugs.webkit.org/show_bug.cgi?id=201016 |
| <rdar://problem/54579911> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * wasm/stress/too-many-locals.js: Added. |
| (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.catch): |
| |
| 2019-08-21 Ross Kirsling <ross.kirsling@sony.com> |
| |
| JSTests/stress/optional-chaining should not call shouldThrowTypeError in a loop |
| https://bugs.webkit.org/show_bug.cgi?id=200965 |
| |
| Reviewed by Saam Barati. |
| |
| This has nothing to do with ?. in particular, but throwing >1M type errors takes 100s in Debug on my machine. |
| The main idea here was to JITify the simple success cases, so let's not run the simple failures so many times. |
| |
| * stress/optional-chaining.js: |
| |
| 2019-08-21 Michael Saboff <msaboff@apple.com> |
| |
| [JSC] incorrent JIT lead to StackOverflow |
| https://bugs.webkit.org/show_bug.cgi?id=197823 |
| |
| Reviewed by Tadeu Zagallo. |
| |
| New test. |
| |
| * stress/bound-function-stack-overflow.js: Added. |
| (foo): |
| (catch): |
| |
| 2019-08-20 Justin Michaud <justin_michaud@apple.com> |
| |
| Identify memcpy loops in b3 |
| https://bugs.webkit.org/show_bug.cgi?id=200181 |
| |
| Reviewed by Saam Barati. |
| |
| * microbenchmarks/memcpy-loop.js: Added. |
| (doTest): |
| (let.arr1): |
| * microbenchmarks/memcpy-typed-loop-large.js: Added. |
| (doTest): |
| (let.arr1.new.Int32Array.1000000.let.arr2.new.Int32Array.1000000): |
| (arr2): |
| * microbenchmarks/memcpy-typed-loop-small.js: Added. |
| (doTest): |
| (16.let.arr1.new.Int32Array.size.let.arr2.new.Int32Array.size): |
| (16.arr2): |
| * microbenchmarks/memcpy-typed-loop-speculative.js: Added. |
| (doTest): |
| (let.arr1.new.Int32Array.10.let.arr2.new.Int32Array.10): |
| (arr2): |
| * microbenchmarks/memcpy-wasm-large.js: Added. |
| (typeof.WebAssembly.string_appeared_here.eq): |
| (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array): |
| * microbenchmarks/memcpy-wasm-medium.js: Added. |
| (typeof.WebAssembly.string_appeared_here.eq): |
| (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array): |
| * microbenchmarks/memcpy-wasm-small.js: Added. |
| (typeof.WebAssembly.string_appeared_here.eq): |
| (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array): |
| * microbenchmarks/memcpy-wasm.js: Added. |
| (typeof.WebAssembly.string_appeared_here.eq): |
| (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array): |
| * stress/memcpy-typed-loops.js: Added. |
| (noLoop): |
| (invalidStart): |
| (const.size.10.let.arr1.new.Int32Array.size.let.arr2.new.Int32Array.size): |
| (arr2): |
| * wasm/function-tests/memcpy-wasm-loop.js: Added. |
| (0.GetLocal.3.I32Const.1.I32Add.SetLocal.3.Br.1.End.End.End.WebAssembly): |
| (string_appeared_here): |
| |
| 2019-08-20 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Array.prototype.toString should not get "join" function each time |
| https://bugs.webkit.org/show_bug.cgi?id=200905 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/array-prototype-join-change.js: Added. |
| (shouldBe): |
| (array2.join): |
| (DerivedArray): |
| (DerivedArray.prototype.join): |
| (array3.__proto__.join): |
| (Array.prototype.join): |
| |
| 2019-08-20 Justin Michaud <justin_michaud@apple.com> |
| |
| Fix InBounds speculation of typed array PutByVal and add extra step to integer range optimization to search for equality relationships on the RHS value |
| https://bugs.webkit.org/show_bug.cgi?id=200782 |
| |
| Reviewed by Saam Barati. |
| |
| Skip long memcpy test on debug, and try to fix flakiness for recompilation count tests by disabling cjit. |
| |
| * microbenchmarks/memcpy-typed-loop.js: |
| * stress/int8-repeat-in-then-out-of-bounds.js: |
| |
| 2019-08-19 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Proxy constructor should throw if handler is revoked Proxy |
| https://bugs.webkit.org/show_bug.cgi?id=198755 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/proxy-revoke.js: Adjust error message. |
| * test262/expectations.yaml: Mark 2 test cases as passing. |
| |
| 2019-08-19 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] OSR entry to Wasm OMG |
| https://bugs.webkit.org/show_bug.cgi?id=200362 |
| |
| Reviewed by Michael Saboff. |
| |
| * wasm/stress/osr-entry-basic.js: Added. |
| (instance.exports.loop): |
| * wasm/stress/osr-entry-many-locals-f32.js: Added. |
| * wasm/stress/osr-entry-many-locals-f64.js: Added. |
| * wasm/stress/osr-entry-many-locals-i32.js: Added. |
| * wasm/stress/osr-entry-many-locals-i64.js: Added. |
| * wasm/stress/osr-entry-many-stacks-f32.js: Added. |
| * wasm/stress/osr-entry-many-stacks-f64.js: Added. |
| * wasm/stress/osr-entry-many-stacks-i32.js: Added. |
| * wasm/stress/osr-entry-many-stacks-i64.js: Added. |
| |
| 2019-08-19 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Date.prototype.toJSON throws if toISOString returns an object |
| https://bugs.webkit.org/show_bug.cgi?id=198495 |
| |
| Reviewed by Ross Kirsling. |
| |
| * test262/expectations.yaml: Mark 6 test cases as passing. |
| |
| 2019-08-19 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] DFG DataView get/set optimization should take care of the case little-endian flag is JSEmpty |
| https://bugs.webkit.org/show_bug.cgi?id=200899 |
| <rdar://problem/54073341> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/data-view-get-dfg-should-handle-empty-constant.js: Added. |
| (i.new.Promise): |
| * stress/data-view-set-dfg-should-handle-empty-constant.js: Added. |
| (i.new.Promise): |
| |
| 2019-08-19 Michael Saboff <msaboff@apple.com> |
| |
| Webkit jsc Crash in RegExp::matchInline (this=<optimized out> |
| https://bugs.webkit.org/show_bug.cgi?id=197090 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| New test. |
| |
| * stress/regexp-nonconsuming-counted-parens.js: Added. |
| |
| 2019-08-18 Ross Kirsling <ross.kirsling@sony.com> |
| |
| [JSC] Correct a->an in error messages and API docblocks |
| https://bugs.webkit.org/show_bug.cgi?id=200833 |
| |
| Reviewed by Don Olmstead. |
| |
| * ChakraCore/test/UnitTestFramework/UnitTestFramework.js: |
| (assert.assert.return.throws): |
| * stress/promise-finally-should-accept-non-promise-objects.js: |
| * wasm/js-api/table.js: |
| (assert.throws): |
| |
| 2019-08-17 Ross Kirsling <ross.kirsling@sony.com> |
| |
| [ESNext] Implement optional chaining |
| https://bugs.webkit.org/show_bug.cgi?id=200199 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/nullish-coalescing.js: |
| * stress/optional-chaining.js: Added. |
| * stress/tail-call-recognize.js: |
| |
| 2019-08-17 Ross Kirsling <ross.kirsling@sony.com> |
| |
| [ESNext] Support hashbang. |
| https://bugs.webkit.org/show_bug.cgi?id=200865 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/hashbang.js: Added. |
| * test262/expectations.yaml: Mark 6 cases as passing. |
| |
| 2019-08-17 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] DFG ToNumber should support Boolean in fixup |
| https://bugs.webkit.org/show_bug.cgi?id=200864 |
| |
| Reviewed by Mark Lam. |
| |
| * microbenchmarks/to-number-boolean.js: Added. |
| (test): |
| * stress/to-number-boolean-int32.js: Added. |
| (shouldBe): |
| (test): |
| (check): |
| * stress/to-number-boolean.js: Added. |
| (shouldBe): |
| (test): |
| (check): |
| * stress/to-number-int32.js: Added. |
| (shouldBe): |
| (test): |
| (check): |
| |
| 2019-08-16 Mark Lam <mark.lam@apple.com> |
| |
| More missing exception checks in string comparison operators. |
| https://bugs.webkit.org/show_bug.cgi?id=200844 |
| <rdar://problem/54378684> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/missing-exception-check-in-string-greater-than-compare.js: Added. |
| * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: Added. |
| * stress/missing-exception-check-in-string-less-than-compare.js: Added. |
| * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: Added. |
| |
| 2019-08-16 Mark Lam <mark.lam@apple.com> |
| |
| CodeBlock destructor should clear all of its watchpoints. |
| https://bugs.webkit.org/show_bug.cgi?id=200792 |
| <rdar://problem/53947800> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/codeblock-should-clear-watchpoints-on-destruction.js: Added. |
| |
| 2019-08-16 Justin Michaud <justin_michaud@apple.com> |
| |
| Fix InBounds speculation of typed array PutByVal and add extra step to integer range optimization to search for equality relationships on the RHS value |
| https://bugs.webkit.org/show_bug.cgi?id=200782 |
| |
| Reviewed by Saam Barati. |
| |
| * microbenchmarks/int8-out-of-bounds.js: Added. |
| (foo): |
| * microbenchmarks/memcpy-typed-loop.js: Added. |
| (doTest): |
| (let.arr1.new.Int32Array.1000.let.arr2.new.Int32Array.1000): |
| (arr2): |
| * stress/int8-repeat-in-then-out-of-bounds.js: Added. |
| (foo): |
| |
| 2019-08-16 Mark Lam <mark.lam@apple.com> |
| |
| [Re-land] ProxyObject should not be allow to access its target's private properties. |
| https://bugs.webkit.org/show_bug.cgi?id=200739 |
| <rdar://problem/53972768> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js: Copied from JSTests/stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js. |
| * stress/proxy-with-private-symbols.js: |
| |
| 2019-08-16 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Promise.prototype.finally should accept non-promise objects |
| https://bugs.webkit.org/show_bug.cgi?id=200829 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/promise-finally-should-accept-non-promise-objects.js: Added. |
| (shouldBe): |
| (Thenable): |
| (Thenable.prototype.then): |
| |
| 2019-08-16 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Promise constructor should check argument before [[Construct]] |
| https://bugs.webkit.org/show_bug.cgi?id=198976 |
| |
| Reviewed by Ross Kirsling. |
| |
| * stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js: Fix test. |
| * stress/create-subclass-structure-might-throw.js: Fix test. |
| * test262/expectations.yaml: Mark 2 test cases as passing. |
| |
| 2019-08-16 Ryan Haddad <ryanhaddad@apple.com> |
| |
| Unreviewed, rolling out r248709. |
| |
| Caused test/built-ins/Promise/prototype/finally/this-value- |
| non-promise.js to fail on test262 bot |
| |
| Reverted changeset: |
| |
| "ProxyObject should not be allow to access its target's |
| private properties." |
| https://bugs.webkit.org/show_bug.cgi?id=200739 |
| https://trac.webkit.org/changeset/248709 |
| |
| 2019-08-15 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| DateConversion::formatDateTime incorrectly formats negative years |
| https://bugs.webkit.org/show_bug.cgi?id=199964 |
| |
| Reviewed by Ross Kirsling. |
| |
| * test262/expectations.yaml: Mark 6 test cases as passing. |
| |
| 2019-08-15 Mark Lam <mark.lam@apple.com> |
| |
| More missing exception checks in String.prototype. |
| https://bugs.webkit.org/show_bug.cgi?id=200762 |
| <rdar://problem/54333896> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/missing-exception-check-in-string-lastIndexOf.js: Added. |
| * stress/missing-exception-check-in-string-toLower.js: Added. |
| * stress/missing-exception-check-in-string-toUpper.js: Added. |
| |
| 2019-08-14 Mark Lam <mark.lam@apple.com> |
| |
| ProxyObject should not be allow to access its target's private properties. |
| https://bugs.webkit.org/show_bug.cgi?id=200739 |
| <rdar://problem/53972768> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js: Added. |
| * stress/proxy-with-private-symbols.js: Rebased. |
| |
| 2019-08-14 Mark Lam <mark.lam@apple.com> |
| |
| Missing exception check in string compare. |
| https://bugs.webkit.org/show_bug.cgi?id=200743 |
| <rdar://problem/53975356> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/missing-exception-check-in-string-compare.js: Added. |
| |
| 2019-08-08 Ross Kirsling <ross.kirsling@sony.com> |
| |
| [JSC] Add "jump if (not) undefined or null" bytecode ops |
| https://bugs.webkit.org/show_bug.cgi?id=200480 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/destructuring-assignment-require-object-coercible.js: |
| * stress/nullish-coalescing.js: |
| |
| 2019-08-05 Michael Saboff <msaboff@apple.com> |
| |
| JSC: assertion failure in SpeculativeJIT::compileGetByValOnIntTypedArray |
| https://bugs.webkit.org/show_bug.cgi?id=199997 |
| |
| Reviewed by Saam Barati. |
| |
| New test. |
| |
| * stress/typedarray-no-alreadyChecked-assert.js: Added. |
| (checkIntArray): |
| (checkFloatArray): |
| |
| 2019-08-02 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Support WebAssembly in SamplingProfiler |
| https://bugs.webkit.org/show_bug.cgi?id=200329 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/sampling-profiler-wasm-name-section.js: Added. |
| (const.compile): |
| (platformSupportsSamplingProfiler.vm.isWasmSupported.wasmEntry): |
| (platformSupportsSamplingProfiler.vm.isWasmSupported): |
| * stress/sampling-profiler-wasm.js: Added. |
| (platformSupportsSamplingProfiler.vm.isWasmSupported.wasmEntry): |
| (platformSupportsSamplingProfiler.vm.isWasmSupported): |
| * stress/sampling-profiler/loop.wasm: Added. |
| * stress/sampling-profiler/loop.wast: Added. |
| * stress/sampling-profiler/nameSection.wasm: Added. |
| |
| 2019-08-02 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] LazyJSValue should be robust for empty JSValue |
| https://bugs.webkit.org/show_bug.cgi?id=200388 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/switch-constant-child-becomes-empty.js: Added. |
| (foo): |
| |
| 2019-08-01 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| GetterSetter type confusion during DFG compilation |
| https://bugs.webkit.org/show_bug.cgi?id=199903 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/cse-propagated-constant-may-not-follow-structure-restrictions.js: Added. |
| |
| 2019-08-01 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Update Test262 (2019.08.01) |
| https://bugs.webkit.org/show_bug.cgi?id=200351 |
| |
| Reviewed by Keith Miller. |
| |
| * test262/expectations.yaml: |
| * test262/harness/testIntl.js: |
| * test262/latest-changes-summary.txt: |
| * test262/test/: |
| * test262/test262-Revision.txt: |
| |
| 2019-07-30 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Make StructureChain less-tricky by using Auxiliary Buffer |
| https://bugs.webkit.org/show_bug.cgi?id=200192 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/structure-chain-stress.js: Added. |
| (keys): |
| |
| 2019-07-29 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Increment bytecode age only when SlotVisitor is first-visit |
| https://bugs.webkit.org/show_bug.cgi?id=200196 |
| |
| Reviewed by Robin Morisset. |
| |
| * stress/reparsing-unlinked-codeblock.js: |
| |
| 2019-07-29 Justin Michaud <justin_michaud@apple.com> |
| |
| [X86] Emit BT instruction for shift + mask in B3 |
| https://bugs.webkit.org/show_bug.cgi?id=199891 |
| |
| Reviewed by Robin Morisset. |
| |
| Lower the number of iterations to fix debug timeouts. |
| |
| * microbenchmarks/bit-test-load.js: |
| (i): |
| |
| 2019-07-27 Justin Michaud <justin_michaud@apple.com> |
| |
| [X86] Emit BT instruction for shift + mask in B3 |
| https://bugs.webkit.org/show_bug.cgi?id=199891 |
| |
| Reviewed by Keith Miller. |
| |
| * microbenchmarks/bit-test-constant.js: Added. |
| (let.glob.0.doTest): |
| * microbenchmarks/bit-test-load.js: Added. |
| (let.glob.0.let.arr.new.Int32Array.8.doTest): |
| (i): |
| * microbenchmarks/bit-test-nonconstant.js: Added. |
| (let.glob.0.doTest): |
| |
| 2019-07-26 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Potential GC fix for JSPropertyNameEnumerator |
| https://bugs.webkit.org/show_bug.cgi?id=200151 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/for-in-stress.js: Added. |
| (keys): |
| |
| 2019-07-25 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Legacy numeric literals should not permit separators or BigInt |
| https://bugs.webkit.org/show_bug.cgi?id=199984 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/big-int-literals.js: |
| * stress/numeric-literal-separators.js: |
| |
| 2019-07-25 Ross Kirsling <ross.kirsling@sony.com> |
| |
| [ESNext] Implement nullish coalescing |
| https://bugs.webkit.org/show_bug.cgi?id=200072 |
| |
| Reviewed by Darin Adler. |
| |
| * stress/nullish-coalescing.js: Added. |
| |
| 2019-07-24 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Three checks are missing in Proxy internal methods |
| https://bugs.webkit.org/show_bug.cgi?id=198630 |
| |
| Reviewed by Darin Adler. |
| |
| * stress/proxy-delete.js: Assert isExtensible is called in correct order. |
| * test262/expectations.yaml: Mark 6 test cases as passing. |
| |
| 2019-07-23 Justin Michaud <justin_michaud@apple.com> |
| |
| Sometimes we miss removable CheckInBounds |
| https://bugs.webkit.org/show_bug.cgi?id=200018 |
| |
| Reviewed by Saam Barati. |
| |
| * microbenchmarks/typed-array-sum.js: Added. |
| (doTest): |
| |
| 2019-07-16 Mark Lam <mark.lam@apple.com> |
| |
| ArgumentsEliminationPhase should insert KillStack nodes before PutStack nodes that it adds. |
| https://bugs.webkit.org/show_bug.cgi?id=199821 |
| <rdar://problem/52452328> |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/arguments-elimination-should-insert-KillStacks-before-added-PutStacks.js: Added. |
| |
| 2019-07-16 Keith Miller <keith_miller@apple.com> |
| |
| Unreviewed, test262 gardening. |
| |
| * test262/expectations.yaml: |
| |
| 2019-07-15 Keith Miller <keith_miller@apple.com> |
| |
| A Possible Issue of Object.create method |
| https://bugs.webkit.org/show_bug.cgi?id=199744 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/object-create-non-object-properties-parameter.js: Added. |
| (catch): |
| |
| 2019-07-15 Keith Miller <keith_miller@apple.com> |
| |
| Update test262 |
| https://bugs.webkit.org/show_bug.cgi?id=199801 |
| |
| Rubber-stamped by Yusuke Suzuki. |
| |
| * test262/expectations.yaml: |
| * test262/latest-changes-summary.txt: |
| * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/Symbol.toStringTag.js: Added. |
| (fg.new.FinalizationGroup): |
| (callback): |
| * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-job-not-active-throws.js: Added. |
| (fg.new.FinalizationGroup): |
| (callback): |
| * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-length.js: Added. |
| (fg.new.FinalizationGroup): |
| (callback): |
| * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-missing-internal-throws.js: Added. |
| (fg.new.FinalizationGroup): |
| (callback): |
| * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-name.js: Added. |
| (fg.new.FinalizationGroup): |
| (callback): |
| * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-not-object-throws.js: Added. |
| (fg.new.FinalizationGroup): |
| (callback): |
| * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-prop-desc.js: Added. |
| (fg.new.FinalizationGroup): |
| (callback): |
| * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/proto.js: Added. |
| (callback): |
| (fg.new.FinalizationGroup): |
| * test262/test/built-ins/FinalizationGroup/constructor.js: Added. |
| * test262/test/built-ins/FinalizationGroup/gc-has-one-chance-to-call-cleanupCallback.js: Added. |
| (cb): |
| (fg.new.FinalizationGroup): |
| (emptyCells): |
| (async.fn): |
| (fn.then.async): |
| * test262/test/built-ins/FinalizationGroup/instance-extensible.js: Added. |
| (fg.new.FinalizationGroup): |
| * test262/test/built-ins/FinalizationGroup/length.js: Added. |
| * test262/test/built-ins/FinalizationGroup/name.js: Added. |
| * test262/test/built-ins/FinalizationGroup/newtarget-prototype-is-not-object.js: Added. |
| (newTarget): |
| (fn): |
| * test262/test/built-ins/FinalizationGroup/prop-desc.js: Added. |
| * test262/test/built-ins/FinalizationGroup/proto-from-ctor-realm.js: Added. |
| (fn): |
| * test262/test/built-ins/FinalizationGroup/proto.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype-from-newtarget-abrupt.js: Added. |
| (newTarget): |
| * test262/test/built-ins/FinalizationGroup/prototype-from-newtarget-custom.js: Added. |
| (newTarget): |
| * test262/test/built-ins/FinalizationGroup/prototype-from-newtarget.js: Added. |
| (fg.new.FinalizationGroup): |
| * test262/test/built-ins/FinalizationGroup/prototype/Symbol.toStringTag.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/callback-iterator-proto.js: Added. |
| (callback): |
| (fg.new.FinalizationGroup): |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/callback-not-callable-throws.js: Added. |
| (fg.new.FinalizationGroup): |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-prevented-with-reference.js: Added. |
| (cb): |
| (fg.new.FinalizationGroup): |
| (emptyCells): |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-prevented-with-unregister.js: Added. |
| (fg.new.FinalizationGroup): |
| (fg.cleanupSome.cb): |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanupcallback-iterator-proto.js: Added. |
| (callback): |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/custom-this.js: Added. |
| (fn): |
| (cb): |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/gc-cleanup-not-prevented-with-wr-deref.js: Added. |
| (cb): |
| (fg.new.FinalizationGroup): |
| (emptyCells): |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/iterator-dynamic.js: Added. |
| (fg.new.FinalizationGroup): |
| (callback): |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/iterator-holdings-multiple-values.js: Added. |
| (fg.new.FinalizationGroup): |
| (callback): |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/length.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/name.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/poisoned-callback-throws.js: Added. |
| (poisoned): |
| (fg.new.FinalizationGroup): |
| (emptyCells): |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/poisoned-cleanup-callback-throws.js: Added. |
| (poisoned): |
| (emptyCells): |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/prop-desc.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/return-undefined-with-gc.js: Added. |
| (fn): |
| (cb): |
| (emptyCells): |
| (prototype.assert.sameValue.fg.cleanupSome): |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/return-undefined.js: Added. |
| (fn): |
| (cb): |
| (poisoned): |
| (assert.sameValue.fg.cleanupSome): |
| (prototype.assert.sameValue.fg.cleanupSome): |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/this-does-not-have-internal-cells-throws.js: Added. |
| (cb): |
| * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/this-not-object-throws.js: Added. |
| (cb): |
| * test262/test/built-ins/FinalizationGroup/prototype/constructor.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/prop-desc.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/proto.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/register/custom-this.js: Added. |
| (fn): |
| * test262/test/built-ins/FinalizationGroup/prototype/register/holdings-any-value-type.js: Added. |
| (fn): |
| * test262/test/built-ins/FinalizationGroup/prototype/register/holdings-same-as-target.js: Added. |
| (fg.new.FinalizationGroup): |
| * test262/test/built-ins/FinalizationGroup/prototype/register/length.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/register/name.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/register/prop-desc.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/register/return-undefined-register-itself.js: Added. |
| (fn): |
| * test262/test/built-ins/FinalizationGroup/prototype/register/return-undefined.js: Added. |
| (fn): |
| * test262/test/built-ins/FinalizationGroup/prototype/register/target-not-object-throws.js: Added. |
| (fg.new.FinalizationGroup): |
| * test262/test/built-ins/FinalizationGroup/prototype/register/this-does-not-have-internal-target-throws.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/register/this-not-object-throws.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-not-object-or-undefined-throws.js: Added. |
| (fg.new.FinalizationGroup): |
| * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-holdings-and-target.js: Added. |
| (fg.new.FinalizationGroup): |
| * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-holdings.js: Added. |
| (fg.new.FinalizationGroup): |
| * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-target.js: Added. |
| (fg.new.FinalizationGroup): |
| * test262/test/built-ins/FinalizationGroup/prototype/unregister/custom-this.js: Added. |
| (fn): |
| * test262/test/built-ins/FinalizationGroup/prototype/unregister/length.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/unregister/name.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/unregister/prop-desc.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/unregister/this-does-not-have-internal-cells-throws.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/unregister/this-not-object-throws.js: Added. |
| * test262/test/built-ins/FinalizationGroup/prototype/unregister/unregister.js: Added. |
| (fn): |
| * test262/test/built-ins/FinalizationGroup/prototype/unregister/unregisterToken-not-object-throws.js: Added. |
| (fg.new.FinalizationGroup): |
| * test262/test/built-ins/FinalizationGroup/returns-new-object-from-constructor.js: Added. |
| (cleanupCallback): |
| (let.key.of.Object.getOwnPropertyNames): |
| (set for): |
| * test262/test/built-ins/FinalizationGroup/target-not-callable-throws.js: Added. |
| * test262/test/built-ins/FinalizationGroup/undefined-newtarget-throws.js: Added. |
| (FinalizationGroup): |
| * test262/test/built-ins/FinalizationGroup/unnaffected-by-poisoned-cleanupCallback.js: Added. |
| (cleanupCallback): |
| (let.key.of.Object.getOwnPropertyNames): |
| (set for): |
| * test262/test/built-ins/Function/StrictFunction_restricted-properties.js: |
| * test262/test/built-ins/Function/prototype/bind/BoundFunction_restricted-properties.js: |
| * test262/test/built-ins/Function/prototype/restricted-property-arguments.js: |
| * test262/test/built-ins/Function/prototype/restricted-property-caller.js: |
| * test262/test/built-ins/Object/prototype/toString/proxy-function-async.js: Added. |
| (asyncProxy.new.Proxy.async): |
| * test262/test/built-ins/Object/prototype/toString/proxy-function.js: |
| (asyncProxy.new.Proxy.async): |
| * test262/test/built-ins/Object/prototype/toString/symbol-tag-non-str-builtin.js: Added. |
| (setIter.set Symbol): |
| (set defaultTag): |
| (gen): |
| (get return): |
| (set new): |
| * test262/test/built-ins/Object/prototype/toString/symbol-tag-non-str-proxy-function.js: Added. |
| (generatorProxy.new.Proxy): |
| (asyncProxy.new.Proxy.async): |
| * test262/test/built-ins/Object/subclass-object-arg.js: |
| * test262/test/built-ins/Promise/all/invoke-resolve-get-error-close.js: |
| * test262/test/built-ins/Promise/all/resolve-element-function-name.js: |
| * test262/test/built-ins/Promise/allSettled/invoke-resolve-get-error-close.js: |
| * test262/test/built-ins/Promise/allSettled/reject-element-function-name.js: |
| * test262/test/built-ins/Promise/allSettled/resolve-element-function-name.js: |
| * test262/test/built-ins/Promise/executor-function-name.js: |
| * test262/test/built-ins/Promise/race/invoke-resolve-get-error-close.js: |
| * test262/test/built-ins/Promise/reject-function-name.js: |
| * test262/test/built-ins/Promise/resolve-function-name.js: |
| * test262/test/built-ins/Set/prototype/values/does-not-have-setdata-internal-slot-weakset.js: |
| * test262/test/built-ins/WeakRef/constructor.js: Added. |
| * test262/test/built-ins/WeakRef/instance-extensible.js: Added. |
| * test262/test/built-ins/WeakRef/length.js: Added. |
| * test262/test/built-ins/WeakRef/name.js: Added. |
| * test262/test/built-ins/WeakRef/newtarget-prototype-is-not-object.js: Added. |
| (newTarget): |
| * test262/test/built-ins/WeakRef/prop-desc.js: Added. |
| * test262/test/built-ins/WeakRef/proto-from-ctor-realm.js: Added. |
| * test262/test/built-ins/WeakRef/proto.js: Added. |
| * test262/test/built-ins/WeakRef/prototype-from-newtarget-abrupt.js: Added. |
| (newTarget): |
| * test262/test/built-ins/WeakRef/prototype-from-newtarget-custom.js: Added. |
| (newTarget): |
| * test262/test/built-ins/WeakRef/prototype-from-newtarget.js: Added. |
| * test262/test/built-ins/WeakRef/prototype/Symbol.toStringTag.js: Added. |
| * test262/test/built-ins/WeakRef/prototype/constructor.js: Added. |
| * test262/test/built-ins/WeakRef/prototype/deref/custom-this.js: Added. |
| * test262/test/built-ins/WeakRef/prototype/deref/gc-cleanup-not-prevented-with-wr-deref.js: Added. |
| (emptyCells): |
| * test262/test/built-ins/WeakRef/prototype/deref/length.js: Added. |
| * test262/test/built-ins/WeakRef/prototype/deref/name.js: Added. |
| * test262/test/built-ins/WeakRef/prototype/deref/prop-desc.js: Added. |
| * test262/test/built-ins/WeakRef/prototype/deref/return-target.js: Added. |
| * test262/test/built-ins/WeakRef/prototype/deref/this-does-not-have-internal-target-throws.js: Added. |
| (fg.new.FinalizationGroup): |
| * test262/test/built-ins/WeakRef/prototype/deref/this-not-object-throws.js: Added. |
| * test262/test/built-ins/WeakRef/prototype/prop-desc.js: Added. |
| * test262/test/built-ins/WeakRef/prototype/proto.js: Added. |
| * test262/test/built-ins/WeakRef/returns-new-object-from-constructor.js: Added. |
| (let.key.of.Object.getOwnPropertyNames): |
| (set for): |
| * test262/test/built-ins/WeakRef/target-not-object-throws.js: Added. |
| * test262/test/built-ins/WeakRef/undefined-newtarget-throws.js: Added. |
| * test262/test/intl402/BigInt/prototype/toLocaleString/builtin.js: |
| * test262/test/intl402/BigInt/prototype/toLocaleString/default-options-object-prototype.js: |
| * test262/test/intl402/BigInt/prototype/toLocaleString/length.js: |
| * test262/test/intl402/BigInt/prototype/toLocaleString/returns-same-results-as-NumberFormat.js: |
| * test262/test/intl402/BigInt/prototype/toLocaleString/taint-Intl-NumberFormat.js: |
| * test262/test/intl402/BigInt/prototype/toLocaleString/this-value-invalid.js: |
| * test262/test/intl402/BigInt/prototype/toLocaleString/throws-same-exceptions-as-NumberFormat.js: |
| * test262/test/intl402/DateTimeFormat/constructor-options-order-quarter.js: Removed. |
| * test262/test/intl402/DateTimeFormat/constructor-options-quarter-invalid.js: Removed. |
| * test262/test/intl402/DateTimeFormat/constructor-options-quarter-valid.js: Removed. |
| * test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-long-en.js: Added. |
| * test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-narrow-en.js: Added. |
| * test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-short-en.js: Added. |
| * test262/test/intl402/DateTimeFormat/prototype/format/fractionalSecondDigits.js: Added. |
| * test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-date-string.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-near-time-boundaries.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-to-integer.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRange/builtin.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRange/prop-desc.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-date-string.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-near-time-boundaries.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-to-integer.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/builtin.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/prop-desc.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-long-en.js: Added. |
| (assertParts): |
| (assertPartsNumeric): |
| * test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-narrow-en.js: Added. |
| (assertParts): |
| (assertPartsNumeric): |
| * test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-short-en.js: Added. |
| (assertParts): |
| (assertPartsNumeric): |
| * test262/test/intl402/DateTimeFormat/prototype/formatToParts/fractionalSecondDigits.js: Added. |
| (assertParts): |
| * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/order-quarter.js: Removed. |
| * test262/test/intl402/DateTimeFormat/taint-Object-prototype-quarter.js: Removed. |
| * test262/test/intl402/RelativeTimeFormat/prototype/format/en-us-numeric-auto.js: |
| * test262/test/intl402/RelativeTimeFormat/prototype/formatToParts/en-us-numeric-auto.js: |
| * test262/test/language/expressions/arrow-function/ArrowFunction_restricted-properties.js: |
| * test262/test/language/expressions/class/elements/private-field-access-on-inner-arrow-function.js: Added. |
| (C.prototype.method): |
| * test262/test/language/expressions/class/elements/private-field-access-on-inner-function.js: Added. |
| (C.prototype.method.innerFunction): |
| (C.prototype.method): |
| * test262/test/language/expressions/class/elements/private-getter-access-on-inner-arrow-function.js: Added. |
| (C): |
| (C.method): |
| * test262/test/language/expressions/class/elements/private-getter-access-on-inner-function.js: Added. |
| (C): |
| (C.method.innerFunction): |
| (C.method): |
| * test262/test/language/expressions/class/elements/private-getter-is-not-a-own-property.js: Added. |
| (C): |
| (C.checkPrivateGetter): |
| * test262/test/language/expressions/class/elements/private-method-access-on-inner-arrow-function.js: Added. |
| (C): |
| (C.method): |
| * test262/test/language/expressions/class/elements/private-method-access-on-inner-function.js: Added. |
| (C): |
| (C.method.innerFunction): |
| (C.method): |
| * test262/test/language/expressions/class/elements/private-method-is-not-a-own-property.js: Added. |
| (C): |
| (C.checkPrivateMethod): |
| * test262/test/language/expressions/class/elements/private-setter-access-on-inner-arrow-function.js: Added. |
| (C): |
| (C.method): |
| * test262/test/language/expressions/class/elements/private-setter-access-on-inner-function.js: Added. |
| (C): |
| (C.method.innerFunction): |
| (C.method): |
| * test262/test/language/expressions/class/elements/private-setter-is-not-a-own-property.js: Added. |
| (C): |
| (C.checkPrivateSetter): |
| * test262/test/language/expressions/class/elements/prod-private-getter-before-super-return-in-field-initializer.js: |
| * test262/test/language/expressions/class/elements/prod-private-method-before-super-return-in-field-initializer.js: |
| * test262/test/language/expressions/class/elements/prod-private-setter-before-super-return-in-field-initializer.js: |
| * test262/test/language/expressions/class/poisoned-underscore-proto.js: Added. |
| * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (let.classStringExpression): |
| (let.classStringExpression.access): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (let.classStringExpression): |
| (let.classStringExpression.access): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (const.C): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (let.classStringExpression.return.prototype.m): |
| (let.classStringExpression.return.prototype.access): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (let.classStringExpression.return.prototype.m): |
| (let.classStringExpression.return.prototype.access): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (let.classStringExpression): |
| (let.classStringExpression.access): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (let.classStringExpression.prototype.m): |
| (let.classStringExpression.prototype.access): |
| (let.classStringExpression): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (let.classStringExpression.prototype.m): |
| (let.classStringExpression.prototype.access): |
| (let.classStringExpression): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (const.C): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (let.classStringExpression.return.C.prototype.m): |
| (let.classStringExpression.return.C.prototype.access): |
| (let.classStringExpression.return.C): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (let.classStringExpression.return.C.prototype.m): |
| (let.classStringExpression.return.C.prototype.access): |
| (let.classStringExpression.return.C): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (let.classStringExpression): |
| (let.classStringExpression.access): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (let.classStringExpression): |
| (let.classStringExpression.access): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (let.classStringExpression): |
| (let.classStringExpression.access): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (const.C): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (let.classStringExpression.return.prototype.m): |
| (let.classStringExpression.return.prototype.access): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (let.classStringExpression.return.prototype.m): |
| (let.classStringExpression.return.prototype.access): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js. |
| (let.classStringExpression): |
| (let.classStringExpression.access): |
| (let.createAndInstantiateClass): |
| * test262/test/language/expressions/new.target/unary-expr.js: Added. |
| (new): |
| (async): |
| * test262/test/language/expressions/super/call-poisoned-underscore-proto.js: Added. |
| (A): |
| * test262/test/language/expressions/super/prop-poisoned-underscore-proto.js: Added. |
| * test262/test/language/identifiers/vals-cjk-escaped.js: Added. |
| * test262/test/language/identifiers/vals-cjk.js: Added. |
| * test262/test/language/statements/class/elements/private-class-field-on-frozen-objects.js: |
| * test262/test/language/statements/class/elements/private-field-access-on-inner-arrow-function.js: Added. |
| (C.prototype.method): |
| (C): |
| * test262/test/language/statements/class/elements/private-field-access-on-inner-function.js: Added. |
| (C.prototype.method.innerFunction): |
| (C.prototype.method): |
| (C): |
| * test262/test/language/statements/class/elements/private-field-is-not-clobbered-by-computed-property.js: Added. |
| (C.prototype.checkPrivateField): |
| (C): |
| * test262/test/language/statements/class/elements/private-field-visible-to-direct-eval-on-initializer.js: Added. |
| (C): |
| * test262/test/language/statements/class/elements/private-field-visible-to-direct-eval.js: Added. |
| (C.prototype.getWithEval): |
| (C): |
| (D): |
| * test262/test/language/statements/class/elements/private-getter-access-on-inner-arrow-function.js: Added. |
| (C.prototype.get m): |
| (C.prototype.method): |
| (C): |
| * test262/test/language/statements/class/elements/private-getter-access-on-inner-function.js: Added. |
| (C.prototype.get m): |
| (C.prototype.method.innerFunction): |
| (C.prototype.method): |
| (C): |
| * test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js: |
| (let.createAndInstantiateClass): |
| * test262/test/language/statements/class/elements/private-getter-is-not-a-own-property.js: Added. |
| (C.prototype.get m): |
| (C.prototype.checkPrivateGetter): |
| (C): |
| * test262/test/language/statements/class/elements/private-getter-is-not-clobbered-by-computed-property.js: Added. |
| (C.prototype.get m): |
| (C.prototype.checkPrivateGetter): |
| (C): |
| * test262/test/language/statements/class/elements/private-getter-visible-to-direct-eval-on-initializer.js: Added. |
| (C.prototype.get m): |
| (C): |
| * test262/test/language/statements/class/elements/private-getter-visible-to-direct-eval.js: Added. |
| (C.prototype.get m): |
| (C.prototype.getWithEval): |
| (C): |
| (D.prototype.get m): |
| (D): |
| * test262/test/language/statements/class/elements/private-method-access-on-inner-arrow-function.js: Added. |
| (C.prototype.m): |
| (C.prototype.method): |
| (C): |
| * test262/test/language/statements/class/elements/private-method-access-on-inner-function.js: Added. |
| (C.prototype.m): |
| (C.prototype.method.innerFunction): |
| (C.prototype.method): |
| (C): |
| * test262/test/language/statements/class/elements/private-method-is-not-a-own-property.js: Added. |
| (C.prototype.m): |
| (C.prototype.checkPrivateMethod): |
| (C): |
| * test262/test/language/statements/class/elements/private-method-is-not-clobbered-by-computed-property.js: Added. |
| (C.prototype.m): |
| (C.prototype.checkPrivateMethod): |
| (C): |
| * test262/test/language/statements/class/elements/private-method-visible-to-direct-eval-on-initializer.js: Added. |
| (C.prototype.m): |
| (C): |
| * test262/test/language/statements/class/elements/private-method-visible-to-direct-eval.js: Added. |
| (C.prototype.m): |
| (C.prototype.getWithEval): |
| (C): |
| (D.prototype.m): |
| (D): |
| * test262/test/language/statements/class/elements/private-setter-access-on-inner-arrow-function.js: Added. |
| (C.prototype.set m): |
| (C.prototype.method): |
| (C): |
| * test262/test/language/statements/class/elements/private-setter-access-on-inner-function.js: Added. |
| (C.prototype.set m): |
| (C.prototype.method.innerFunction): |
| (C.prototype.method): |
| (C): |
| * test262/test/language/statements/class/elements/private-setter-is-not-a-own-property.js: Added. |
| (C.prototype.set m): |
| (C.prototype.checkPrivateSetter): |
| (C): |
| * test262/test/language/statements/class/elements/private-setter-is-not-clobbered-by-computed-property.js: Added. |
| (C.prototype.set m): |
| (C.prototype.checkPrivateSetter): |
| (C): |
| * test262/test/language/statements/class/elements/private-setter-visible-to-direct-eval-on-initializer.js: Added. |
| (C.prototype.set m): |
| (C): |
| * test262/test/language/statements/class/elements/private-setter-visible-to-direct-eval.js: Added. |
| (C.prototype.set m): |
| (C.prototype.setWithEval): |
| (C): |
| (D.prototype.set m): |
| (D): |
| * test262/test/language/statements/class/elements/prod-private-getter-before-super-return-in-field-initializer.js: |
| * test262/test/language/statements/class/elements/prod-private-method-before-super-return-in-field-initializer.js: |
| * test262/test/language/statements/class/elements/prod-private-setter-before-super-return-in-field-initializer.js: |
| * test262/test/language/statements/class/elements/super-access-inside-a-private-getter.js: Added. |
| (A.prototype.method): |
| (A): |
| (C.prototype.get m): |
| (C.prototype.access): |
| (C): |
| * test262/test/language/statements/class/elements/super-access-inside-a-private-method.js: Added. |
| (A.prototype.method): |
| (A): |
| (C.prototype.m): |
| (C.prototype.access): |
| (C): |
| * test262/test/language/statements/class/elements/super-access-inside-a-private-setter.js: Added. |
| (A.prototype.method): |
| (A): |
| (C.prototype.set m): |
| (C.prototype.access): |
| (C): |
| * test262/test/language/statements/class/poisoned-underscore-proto.js: Added. |
| (A): |
| * test262/test/language/statements/function/13.2-30-s.js: |
| * test262/test262-Revision.txt: |
| |
| 2019-07-15 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Improve wasm wpt test results by fixing miscellaneous issues |
| https://bugs.webkit.org/show_bug.cgi?id=199783 |
| |
| Reviewed by Mark Lam. |
| |
| Fix our spec tests. |
| |
| * wasm/js-api/Module-compile.js: |
| * wasm/js-api/test_basic_api.js: |
| (const.c.in.constructorProperties.switch): |
| * wasm/js-api/validate.js: |
| * wasm/js-api/web-assembly-instantiate.js: |
| * wasm/spec-tests/jsapi.js: |
| (testJSAPI.get test): |
| (testJSAPI.set test): |
| |
| 2019-07-15 Michael Catanzaro <mcatanzaro@igalia.com> |
| |
| Unreviewed, rolling out r247440. |
| |
| Broke builds |
| |
| Reverted changeset: |
| |
| "[JSC] Improve wasm wpt test results by fixing miscellaneous |
| issues" |
| https://bugs.webkit.org/show_bug.cgi?id=199783 |
| https://trac.webkit.org/changeset/247440 |
| |
| 2019-07-15 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Improve wasm wpt test results by fixing miscellaneous issues |
| https://bugs.webkit.org/show_bug.cgi?id=199783 |
| |
| Reviewed by Mark Lam. |
| |
| Fix our spec tests. |
| |
| * wasm/js-api/Module-compile.js: |
| * wasm/js-api/test_basic_api.js: |
| (const.c.in.constructorProperties.switch): |
| * wasm/js-api/validate.js: |
| * wasm/js-api/web-assembly-instantiate.js: |
| * wasm/spec-tests/jsapi.js: |
| (testJSAPI.get test): |
| (testJSAPI.set test): |
| |
| 2019-07-12 Justin Michaud <justin_michaud@apple.com> |
| |
| B3 should reduce (integer) Sub(Neg(x), y) to Neg(Add(x, y)) |
| https://bugs.webkit.org/show_bug.cgi?id=196371 |
| |
| Reviewed by Keith Miller. |
| |
| * microbenchmarks/mul-immediate-sub.js: Added. |
| (doTest): |
| |
| 2019-07-12 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] Add ValueBitLShift into DFG |
| https://bugs.webkit.org/show_bug.cgi?id=192664 |
| |
| Reviewed by Saam Barati. |
| |
| We are adding tests to cover ValueBitwise operations AI changes. |
| |
| * stress/big-int-left-shift-untyped.js: Added. |
| * stress/bit-op-with-object-returning-int32.js: |
| * stress/value-bit-and-ai-rule.js: Added. |
| * stress/value-bit-lshift-ai-rule.js: Added. |
| * stress/value-bit-or-ai-rule.js: Added. |
| * stress/value-bit-xor-ai-rule.js: Added. |
| |
| 2019-07-11 Justin Michaud <justin_michaud@apple.com> |
| |
| Add b3 macro lowering for CheckMul on arm64 |
| https://bugs.webkit.org/show_bug.cgi?id=199251 |
| |
| Reviewed by Robin Morisset. |
| |
| * microbenchmarks/check-mul-constant.js: Added. |
| (doTest): |
| * microbenchmarks/check-mul-no-constant.js: Added. |
| (doTest): |
| * microbenchmarks/check-mul-power-of-two.js: Added. |
| (doTest): |
| |
| 2019-07-10 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Optimize join of large empty arrays |
| https://bugs.webkit.org/show_bug.cgi?id=199636 |
| |
| Reviewed by Mark Lam. |
| |
| * microbenchmarks/large-empty-array-join.js: Added. |
| * microbenchmarks/large-empty-array-join-resolve-rope.js: Added. |
| |
| 2019-07-06 Michael Saboff <msaboff@apple.com> |
| |
| switch(String) needs to check for exceptions when resolving the string |
| https://bugs.webkit.org/show_bug.cgi?id=199541 |
| |
| Reviewed by Mark Lam. |
| |
| New tests. |
| |
| * stress/switch-string-oom.js: Added. |
| (test): |
| (testLowerTiers): |
| (testFTL): |
| |
| 2019-07-05 Mark Lam <mark.lam@apple.com> |
| |
| ArgumentsEliminationPhase::eliminateCandidatesThatInterfere() should not decrement nodeIndex pass zero. |
| https://bugs.webkit.org/show_bug.cgi?id=199533 |
| <rdar://problem/52669111> |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/ArgumentsEliminationPhase-eliminateCandidatesThatEscape-should-not-decrement-nodeIndex-pass-zero.js: Added. |
| |
| 2019-07-05 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| [JSC] Clean up ArraySpeciesCreate |
| https://bugs.webkit.org/show_bug.cgi?id=182434 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| Adjusts error message expectations in stress tests. |
| |
| * stress/array-flatmap.js: |
| * stress/array-flatten.js: |
| * stress/array-species-create-should-handle-masquerader.js: |
| * test262/expectations.yaml: Mark 4 test cases as passing. |
| |
| 2019-07-02 Michael Saboff <msaboff@apple.com> |
| |
| Exception from For..of loop assignment eliminates TDZ checks in subsequent code |
| https://bugs.webkit.org/show_bug.cgi?id=199395 |
| |
| Reviewed by Filip Pizlo. |
| |
| New regession test. |
| |
| * stress/for-of-tdz-with-try-catch.js: Added. |
| (test): |
| (i.catch): |
| |
| 2019-07-02 Keith Miller <keith_miller@apple.com> |
| |
| Frozen Arrays length assignment should throw in strict mode |
| https://bugs.webkit.org/show_bug.cgi?id=199365 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/frozen-array-length-should-throw-strict.js: Added. |
| (test): |
| |
| 2019-07-01 Justin Michaud <justin_michaud@apple.com> |
| |
| [Wasm-References] Disable references by default |
| https://bugs.webkit.org/show_bug.cgi?id=199390 |
| |
| Reviewed by Saam Barati. |
| |
| * wasm/references-spec-tests/ref_is_null.js: |
| * wasm/references-spec-tests/ref_null.js: |
| * wasm/references/anyref_globals.js: |
| * wasm/references/anyref_modules.js: |
| * wasm/references/anyref_table.js: |
| * wasm/references/anyref_table_import.js: |
| * wasm/references/element_parsing.js: |
| * wasm/references/func_ref.js: |
| * wasm/references/is_null.js: |
| * wasm/references/multitable.js: |
| * wasm/references/table_misc.js: |
| * wasm/references/validation.js: |
| |
| 2019-07-01 Ryan Haddad <ryanhaddad@apple.com> |
| |
| Unreviewed, rolling out r246946. |
| |
| Caused JSC test crashes on arm64 |
| |
| Reverted changeset: |
| |
| "Add b3 macro lowering for CheckMul on arm64" |
| https://bugs.webkit.org/show_bug.cgi?id=199251 |
| https://trac.webkit.org/changeset/246946 |
| |
| 2019-06-28 Justin Michaud <justin_michaud@apple.com> |
| |
| Add b3 macro lowering for CheckMul on arm64 |
| https://bugs.webkit.org/show_bug.cgi?id=199251 |
| |
| Reviewed by Robin Morisset. |
| |
| * microbenchmarks/check-mul-constant.js: Added. |
| (doTest): |
| * microbenchmarks/check-mul-no-constant.js: Added. |
| (doTest): |
| * microbenchmarks/check-mul-power-of-two.js: Added. |
| (doTest): |
| |
| 2019-06-26 Keith Miller <keith_miller@apple.com> |
| |
| speciesConstruct needs to throw if the result is a DataView |
| https://bugs.webkit.org/show_bug.cgi?id=199231 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/typedarray-filter.js: |
| (subclasses.forEach): |
| * stress/typedarray-map.js: |
| (subclasses.forEach): |
| * stress/typedarray-slice.js: |
| (typedArrays.forEach): |
| * stress/typedarray-subarray.js: |
| (subclasses.forEach): |
| |
| 2019-06-24 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r246714. |
| https://bugs.webkit.org/show_bug.cgi?id=199179 |
| |
| revert to do patch in a different way. (Requested by keith_mi_ |
| on #webkit). |
| |
| Reverted changeset: |
| |
| "All prototypes should call didBecomePrototype()" |
| https://bugs.webkit.org/show_bug.cgi?id=196315 |
| https://trac.webkit.org/changeset/246714 |
| |
| 2019-06-24 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Add Array.prototype.{flat,flatMap} to unscopables |
| https://bugs.webkit.org/show_bug.cgi?id=194322 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/unscopables.js: Fix test. |
| * test262/expectations.yaml: Mark 2 test cases as passing. |
| |
| 2019-06-21 Mark Lam <mark.lam@apple.com> |
| |
| ArraySlice needs to keep the source array alive. |
| https://bugs.webkit.org/show_bug.cgi?id=197374 |
| <rdar://problem/50304429> |
| |
| Reviewed by Michael Saboff and Filip Pizlo. |
| |
| * stress/array-slice-must-keep-source-array-alive.js: Added. |
| |
| 2019-06-22 Robin Morisset <rmorisset@apple.com> and Yusuke Suzuki <ysuzuki@apple.com> |
| |
| All prototypes should call didBecomePrototype() |
| https://bugs.webkit.org/show_bug.cgi?id=196315 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/function-prototype-indexed-accessor.js: Added. |
| |
| 2019-06-22 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Strict, Sloppy and Arrow functions should have different classInfo |
| https://bugs.webkit.org/show_bug.cgi?id=197631 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/has-own-property-arguments.js: Added. |
| (shouldBe): |
| (A): |
| |
| 2019-06-22 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] ClassExpr should not store result in the middle of evaluation |
| https://bugs.webkit.org/show_bug.cgi?id=199106 |
| |
| Reviewed by Tadeu Zagallo. |
| |
| * stress/class-expression-should-store-result-at-last.js: Added. |
| (shouldThrow): |
| (shouldThrow.let.a): |
| |
| 2019-06-20 Justin Michaud <justin_michaud@apple.com> |
| |
| [WASM-References] Add extra tests for Wasm references + fix element parsing and subtyping bugs |
| https://bugs.webkit.org/show_bug.cgi?id=199044 |
| |
| Reviewed by Saam Barati. |
| |
| Add wasm references spec tests as well as a worker test. |
| |
| * wasm.yaml: |
| * wasm/Builder_WebAssemblyBinary.js: |
| (const.emitters.Element): |
| * wasm/js-api/element.js: |
| (assert.throws.new.WebAssembly.Module.builder.WebAssembly): |
| * wasm/references-spec-tests/ref_is_null.js: Added. |
| (hostref): |
| (is_hostref): |
| (is_funcref): |
| (eq_ref): |
| (let.handler.get target): |
| (register): |
| (module): |
| (instance): |
| (call): |
| (get instance): |
| (exports): |
| (run): |
| (assert_malformed): |
| (assert_invalid): |
| (assert_unlinkable): |
| (assert_uninstantiable): |
| (assert_trap): |
| (try.f): |
| (catch): |
| (assert_exhaustion): |
| (assert_return): |
| (assert_return_canonical_nan): |
| (assert_return_arithmetic_nan): |
| (assert_return_ref): |
| (assert_return_func): |
| * wasm/references-spec-tests/ref_null.js: Added. |
| (hostref): |
| (is_hostref): |
| (is_funcref): |
| (eq_ref): |
| (let.handler.get target): |
| (register): |
| (module): |
| (instance): |
| (call): |
| (get instance): |
| (exports): |
| (run): |
| (assert_malformed): |
| (assert_invalid): |
| (assert_unlinkable): |
| (assert_uninstantiable): |
| (assert_trap): |
| (try.f): |
| (catch): |
| (assert_exhaustion): |
| (assert_return): |
| (assert_return_canonical_nan): |
| (assert_return_arithmetic_nan): |
| (assert_return_ref): |
| (assert_return_func): |
| * wasm/references/element_parsing.js: Added. |
| (module): |
| * wasm/references/func_ref.js: |
| * wasm/references/multitable.js: |
| * wasm/references/table_misc.js: |
| (TableSize.0.End.End.WebAssembly): |
| * wasm/references/validation.js: |
| (assert.throws): |
| |
| 2019-06-19 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Optimize `resolve` method lookup in Promise static methods |
| https://bugs.webkit.org/show_bug.cgi?id=198864 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * test262/expectations.yaml: Mark 18 test cases as passing. |
| |
| 2019-06-19 Justin Michaud <justin_michaud@apple.com> |
| |
| [WASM-References] Rename anyfunc to funcref |
| https://bugs.webkit.org/show_bug.cgi?id=198983 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * wasm/function-tests/basic-element.js: |
| * wasm/function-tests/context-switch.js: |
| (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance): |
| (makeInstance): |
| (assert.eq.makeInstance): |
| * wasm/function-tests/exceptions.js: |
| (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance): |
| * wasm/function-tests/grow-memory-2.js: |
| (assert.eq.instance.exports.foo): |
| * wasm/function-tests/nameSection.js: |
| (const.compile): |
| * wasm/function-tests/stack-overflow.js: |
| (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance): |
| (assertOverflows.makeInstance): |
| * wasm/function-tests/table-basic-2.js: |
| (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance): |
| * wasm/function-tests/table-basic.js: |
| (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance): |
| * wasm/function-tests/trap-from-start-async.js: |
| * wasm/function-tests/trap-from-start.js: |
| * wasm/js-api/Module.exports.js: |
| (assert.truthy): |
| * wasm/js-api/Module.imports.js: |
| (assert.truthy): |
| * wasm/js-api/call-indirect.js: |
| (const.oneTable): |
| (const.multiTable): |
| (multiTable.const.makeTable): |
| (multiTable): |
| (multiTable.Polyphic2Import): |
| (multiTable.VirtualImport): |
| * wasm/js-api/element-data.js: |
| * wasm/js-api/element.js: |
| (assert.throws.new.WebAssembly.Module.builder.WebAssembly): |
| (assert.throws): |
| (badInstantiation.makeModule): |
| (badInstantiation.test): |
| (badInstantiation): |
| * wasm/js-api/extension-MemoryMode.js: |
| * wasm/js-api/table.js: |
| (new.WebAssembly.Module): |
| (assert.throws): |
| (assertBadTableImport): |
| (assert.throws.WebAssembly.Table.prototype.grow): |
| (new.WebAssembly.Table): |
| (assertBadTable): |
| (assert.truthy): |
| * wasm/js-api/test_basic_api.js: |
| (const.c.in.constructorProperties.switch): |
| * wasm/js-api/unique-signature.js: |
| (CallIndirectWithDuplicateSignatures): |
| * wasm/js-api/wrapper-function.js: |
| * wasm/modules/table.wat: |
| * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat: |
| * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat: |
| * wasm/modules/wasm-imports-wasm-exports/imports.wat: |
| * wasm/modules/wasm-imports-wasm-exports/sum.wat: |
| * wasm/references/anyref_table.js: |
| * wasm/references/anyref_table_import.js: |
| (doSet): |
| (assert.throws): |
| * wasm/references/func_ref.js: |
| (makeFuncrefIdent): |
| (assert.eq.instance.exports.fix): |
| (GetLocal.0.I32Const.0.TableSet.0.End.End.WebAssembly.assert.throws): |
| (GetLocal.0.I32Const.0.TableSet.0.End.End.WebAssembly): |
| (let.importedFun.of): |
| (makeAnyfuncIdent): Deleted. |
| (makeAnyfuncIdent.fun): Deleted. |
| * wasm/references/multitable.js: |
| (assert.eq): |
| (assert.throws): |
| * wasm/references/table_misc.js: |
| (GetLocal.0.TableFill.0.End.End.WebAssembly): |
| * wasm/references/validation.js: |
| (assert.throws.new.WebAssembly.Module.bin): |
| (assert.throws): |
| * wasm/spec-harness/index.js: |
| * wasm/spec-harness/wasm-constants.js: |
| * wasm/spec-harness/wasm-module-builder.js: |
| (WasmModuleBuilder.prototype.toArray): |
| * wasm/spec-harness/wast.js: |
| (elem_type): |
| (string_of_elem_type): |
| (string_of_table_type): |
| * wasm/spec-tests/jsapi.js: |
| * wasm/stress/wasm-table-grow-initialize.js: |
| * wasm/wasm.json: |
| |
| 2019-06-18 Justin Michaud <justin_michaud@apple.com> |
| |
| [WASM-References] Add support for Table.size, grow and fill instructions |
| https://bugs.webkit.org/show_bug.cgi?id=198761 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * wasm/Builder_WebAssemblyBinary.js: |
| (const.putOp): |
| * wasm/references/table_misc.js: Added. |
| (TableSize.End.End.WebAssembly): |
| (GetLocal.0.GetLocal.1.TableGrow.End.End.WebAssembly): |
| * wasm/wasm.json: |
| |
| 2019-06-18 Justin Michaud <justin_michaud@apple.com> |
| |
| [WASM-References] Add support for multiple tables |
| https://bugs.webkit.org/show_bug.cgi?id=198760 |
| |
| Reviewed by Saam Barati. |
| |
| * wasm/Builder.js: |
| * wasm/js-api/call-indirect.js: |
| (const.oneTable): |
| (const.multiTable): |
| (multiTable): |
| (multiTable.Polyphic2Import): |
| (multiTable.VirtualImport): |
| (const.wasmModuleWhichImportJS): Deleted. |
| (const.makeTable): Deleted. |
| (): Deleted. |
| (Polyphic2Import): Deleted. |
| (VirtualImport): Deleted. |
| * wasm/js-api/table.js: |
| (new.WebAssembly.Module): |
| (assert.throws): |
| (assertBadTableImport): |
| (assert.truthy): |
| (assert.throws.new.WebAssembly.Module.builder.WebAssembly): Deleted. |
| * wasm/references/anyref_table.js: |
| * wasm/references/anyref_table_import.js: |
| (makeImport): |
| (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport): |
| (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl): |
| * wasm/references/multitable.js: Added. |
| (assert.throws.1.exports.set_tbl0): |
| (assert.throws): |
| (assert.eq): |
| * wasm/references/validation.js: |
| (assert.throws.new.WebAssembly.Module.bin): |
| (assert.throws): |
| * wasm/spec-tests/imports.wast.js: |
| * wasm/wasm.json: |
| |
| * wasm/Builder.js: |
| * wasm/js-api/call-indirect.js: |
| (const.oneTable): |
| (const.multiTable): |
| (multiTable): |
| (multiTable.Polyphic2Import): |
| (multiTable.VirtualImport): |
| (const.wasmModuleWhichImportJS): Deleted. |
| (const.makeTable): Deleted. |
| (): Deleted. |
| (Polyphic2Import): Deleted. |
| (VirtualImport): Deleted. |
| * wasm/js-api/table.js: |
| (new.WebAssembly.Module): |
| (assert.throws): |
| (assertBadTableImport): |
| (assert.truthy): |
| (assert.throws.new.WebAssembly.Module.builder.WebAssembly): Deleted. |
| * wasm/references/anyref_table.js: |
| * wasm/references/anyref_table_import.js: |
| (makeImport): |
| (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport): |
| (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl): |
| * wasm/references/func_ref.js: |
| (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.fun): Deleted. |
| (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.assert.throws): Deleted. |
| (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly): Deleted. |
| * wasm/references/multitable.js: Added. |
| (assert.throws.1.exports.set_tbl0): |
| (assert.throws): |
| (assert.eq): |
| (string_appeared_here.tableInsanity): |
| (I32Const.0.GetLocal.0.TableSet.1.End.End.WebAssembly.): |
| (I32Const.0.GetLocal.0.TableSet.1.End.End.WebAssembly): |
| * wasm/references/validation.js: |
| (assert.throws.new.WebAssembly.Module.bin): |
| (assert.throws): |
| * wasm/spec-tests/imports.wast.js: |
| * wasm/wasm.json: |
| |
| 2019-06-18 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| [ESNExt] String.prototype.matchAll |
| https://bugs.webkit.org/show_bug.cgi?id=186694 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| Implement String.prototype.matchAll. |
| (https://tc39.es/ecma262/#sec-string.prototype.matchall) |
| |
| * test262/config.yaml: |
| |
| 2019-06-18 Tadeu Zagallo <tzagallo@apple.com> |
| |
| DFG code should not reify the names of builtin functions with private names |
| https://bugs.webkit.org/show_bug.cgi?id=198849 |
| <rdar://problem/51733890> |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/builtin-private-function-name.js: Added. |
| (then): |
| (PromiseLike): |
| |
| 2019-06-18 Keith Miller <keith_miller@apple.com> |
| |
| MaybeParseAsGeneratorForScope sometimes loses track of its scope ref |
| https://bugs.webkit.org/show_bug.cgi?id=198969 |
| <rdar://problem/51620714> |
| |
| Reviewed by Tadeu Zagallo. |
| |
| * stress/nested-yield-in-arrow-function-should-be-a-syntax-error.js: Added. |
| (catch): |
| |
| 2019-06-17 Justin Michaud <justin_michaud@apple.com> |
| |
| Validate that table element type is funcref if using an element section |
| https://bugs.webkit.org/show_bug.cgi?id=198910 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * wasm/references/anyref_table.js: |
| |
| 2019-06-17 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Introduce DisposableCallSiteIndex to enforce type-safety |
| https://bugs.webkit.org/show_bug.cgi?id=197378 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/disposable-call-site-index-with-call-and-this.js: Added. |
| (foo): |
| (bar): |
| * stress/disposable-call-site-index.js: Added. |
| (foo): |
| (bar): |
| |
| 2019-06-17 Justin Michaud <justin_michaud@apple.com> |
| |
| [WASM-References] Add support for Funcref in parameters and return types |
| https://bugs.webkit.org/show_bug.cgi?id=198157 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * wasm/Builder.js: |
| (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section): |
| * wasm/references/anyref_globals.js: |
| * wasm/references/func_ref.js: Added. |
| (fullGC.gc.makeExportedFunction): |
| (makeExportedIdent): |
| (makeAnyfuncIdent): |
| (fun): |
| (assert.eq.instance.exports.fix.fun): |
| (assert.eq.instance.exports.fix): |
| (string_appeared_here.End.End.Function.End.Code.End.WebAssembly.imp.ref): |
| (string_appeared_here.End.End.Function.End.Code.End.WebAssembly): |
| (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.fun): |
| (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.assert.throws): |
| (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly): |
| (assert.throws): |
| (assert.throws.doTest): |
| (let.importedFun.of): |
| (makeAnyfuncIdent.fun): |
| * wasm/references/validation.js: |
| (assert.throws): |
| * wasm/wasm.json: |
| |
| 2019-06-17 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Update test262 tests (2019.06.13) |
| https://bugs.webkit.org/show_bug.cgi?id=198821 |
| |
| Reviewed by Konstantin Tokarev. |
| |
| * test262/expectations.yaml: |
| * test262/harness/: |
| * test262/latest-changes-summary.txt: |
| * test262/test/: |
| * test262/test262-Revision.txt: |
| |
| 2019-06-16 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Grown region of WasmTable should be initialized with null |
| https://bugs.webkit.org/show_bug.cgi?id=198903 |
| |
| Reviewed by Saam Barati. |
| |
| * wasm/stress/wasm-table-grow-initialize.js: Added. |
| (shouldBe): |
| |
| 2019-06-13 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Yarr bytecode compilation failure should be gracefully handled |
| https://bugs.webkit.org/show_bug.cgi?id=198700 |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/regexp-bytecode-compilation-fail.js: Added. |
| (shouldThrow): |
| |
| 2019-06-12 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Polymorphic call stub's slow path should restore callee saves before performing tail call |
| https://bugs.webkit.org/show_bug.cgi?id=198770 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/poly-call-stub-slow-path-should-restore-callee-saves-when-doing-tail-call.js: Added. |
| (test): |
| |
| 2019-06-11 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| JSC should throw if proxy set returns falsish in strict mode context |
| https://bugs.webkit.org/show_bug.cgi?id=177398 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| 1. Add coverage for Proxy `set` trap returning falsy value in strict mode. |
| 2. RegExp methods throw unless [[Set]] succeeds. Return `true` from Proxy `set` traps to fix the tests. |
| |
| * stress/proxy-set.js: Add 2 test cases. |
| * stress/regexp-match-proxy.js: Fix test. |
| * stress/regexp-replace-proxy.js: Fix test. |
| |
| 2019-06-11 Alexey Shvayka <shvaikalesh@gmail.com> |
| |
| Error message for non-callable Proxy `construct` trap is misleading |
| https://bugs.webkit.org/show_bug.cgi?id=198637 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/proxy-construct.js: |
| |
| 2019-06-10 Tadeu Zagallo <tzagallo@apple.com> |
| |
| AI BitURShift's result should not be unsigned |
| https://bugs.webkit.org/show_bug.cgi?id=198689 |
| <rdar://problem/51550063> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/urshift-int32-overflow.js: Added. |
| (foo.): |
| (foo): |
| |
| 2019-06-11 Guillaume Emont <guijemont@igalia.com> |
| |
| Skip stress/ftl-gettypedarrayoffset-wasteful.js on Arm/Linux |
| |
| Unreviewed gardening. |
| |
| * stress/ftl-gettypedarrayoffset-wasteful.js: |
| Skipped on arm/linux as it always times out on the bot since a change |
| between r246270 and r246278 inclusive. |
| |
| 2019-06-10 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] UnlinkedCodeBlock should be eventually jettisoned in VM mini mode |
| https://bugs.webkit.org/show_bug.cgi?id=198023 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/reparsing-unlinked-codeblock.js: Added. |
| (shouldBe): |
| (hello): |
| |
| 2019-06-09 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Use mergePrediction in ValuePow prediction propagation |
| https://bugs.webkit.org/show_bug.cgi?id=198648 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js: Added. |
| |
| 2019-06-07 Tadeu Zagallo <tzagallo@apple.com> |
| |
| AI should get GetterSetter structure from the base's GlobalObject for GetGetterSetterByOffset |
| https://bugs.webkit.org/show_bug.cgi?id=198581 |
| <rdar://problem/51099753> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/global-object-proto-getter.js: Added. |
| (f): |
| (test): |
| |
| 2019-06-05 Justin Michaud <justin_michaud@apple.com> |
| |
| [WASM-References] Add support for Anyref tables, Table.get and Table.set (for Anyref only). |
| https://bugs.webkit.org/show_bug.cgi?id=198398 |
| |
| Reviewed by Saam Barati. |
| |
| * wasm/references/anyref_table.js: Added. |
| (string_appeared_here.doGCSet): |
| (doGCTest): |
| (doGCSet.doGCTest.let.count.0.doBarrierSet): |
| * wasm/references/anyref_table_import.js: Added. |
| (makeImport): |
| (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport): |
| (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl): |
| * wasm/references/is_null_error.js: Removed. |
| * wasm/references/validation.js: Added. |
| (assert.throws.new.WebAssembly.Module.bin): |
| (assert.throws): |
| * wasm/wasm.json: |
| |
| 2019-06-05 Justin Michaud <justin_michaud@apple.com> |
| |
| WebAssembly: pow functions returns 0 when exponent 1.0 or -1.0 |
| https://bugs.webkit.org/show_bug.cgi?id=198106 |
| |
| Reviewed by Saam Barati. |
| |
| * wasm/regress/selectf64.js: Added. |
| * wasm/regress/selectf64.wasm: Added. |
| * wasm/regress/selectf64.wat: Added. |
| |
| 2019-06-04 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Argument elimination should check transitive dependents for interference |
| https://bugs.webkit.org/show_bug.cgi?id=198520 |
| <rdar://problem/50863343> |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/argument-elimination-inline-rest-past-kill.js: Added. |
| (f2): |
| (f3): |
| |
| 2019-06-04 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Argument elimination should check for negative indices in GetByVal |
| https://bugs.webkit.org/show_bug.cgi?id=198302 |
| <rdar://problem/51188095> |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/eliminate-arguments-negative-rest-access.js: Added. |
| (inlinee): |
| (opt): |
| |
| 2019-06-03 Caio Lima <ticaiolima@gmail.com> |
| |
| [ESNext][BigInt] Implement support for "**" |
| https://bugs.webkit.org/show_bug.cgi?id=190799 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/big-int-exp-basic.js: Added. |
| * stress/big-int-exp-jit-osr.js: Added. |
| * stress/big-int-exp-jit-untyped.js: Added. |
| * stress/big-int-exp-jit.js: Added. |
| * stress/big-int-exp-negative-exponent.js: Added. |
| * stress/big-int-exp-to-primitive.js: Added. |
| * stress/big-int-exp-type-error.js: Added. |
| * stress/big-int-exp-wrapped-value.js: Added. |
| * stress/value-pow-ai-rule.js: Added. |
| |
| 2019-05-30 Tadeu Zagallo <tzagallo@apple.com> and Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Implement op_wide16 / op_wide32 and introduce 16bit version bytecode |
| https://bugs.webkit.org/show_bug.cgi?id=197979 |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/16bit-code.js: Added. |
| (shouldBe): |
| * stress/32bit-code.js: Added. |
| (shouldBe): |
| |
| 2019-05-30 Justin Michaud <justin_michaud@apple.com> |
| |
| oss-fuzz: jsc: Issue 15016: jsc: Abrt in JSC::Wasm::AirIRGenerator::addLocal (15016) |
| https://bugs.webkit.org/show_bug.cgi?id=198355 |
| |
| Reviewed by Saam Barati. |
| |
| * wasm/references/is_null.js: |
| |
| 2019-05-30 Stephan Szabo <stephan.szabo@sony.com> |
| |
| [PlayStation] Skip additional tests on PlayStation |
| https://bugs.webkit.org/show_bug.cgi?id=198352 |
| |
| Reviewed by Don Olmstead. |
| |
| Skip pow test on PlayStation due to behavior difference in standard library. |
| Skip incremental marking test due to OOM on PlayStation systems. |
| |
| * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js: |
| * stress/math-pow-with-constants.js: |
| * stress/pow-with-constants.js: |
| |
| 2019-05-28 Dean Jackson <dino@apple.com> |
| |
| Implement Promise.allSettled |
| https://bugs.webkit.org/show_bug.cgi?id=197600 |
| <rdar://problem/50483885> |
| |
| Reviewed by Keith Miller. |
| |
| Start testing Promise.allSettled. We pass most of the tests. |
| The ones that fail are similar to the Promise.all tests we already fail. |
| |
| * test262/config.yaml: Remove Promise.allSettled from skipped tests. |
| * test262/expectations.yaml: Add new expectations for allSettled tests. |
| |
| 2019-05-28 Michael Saboff <msaboff@apple.com> |
| |
| [YARR] Properly handle RegExp's that require large ParenContext space |
| https://bugs.webkit.org/show_bug.cgi?id=198065 |
| |
| Reviewed by Keith Miller. |
| |
| New test. |
| |
| * stress/regexp-large-paren-context.js: Added. |
| (testLargeRegExp): |
| |
| 2019-05-28 Tadeu Zagallo <tzagallo@apple.com> |
| |
| JITOperations putByVal should mark negative array indices as out-of-bounds |
| https://bugs.webkit.org/show_bug.cgi?id=198271 |
| |
| Reviewed by Saam Barati. |
| |
| * microbenchmarks/get-by-val-negative-array-index.js: |
| (foo): |
| Update the getByVal microbenchmark added in r245769. This now shows that r245769 |
| is 4.2x faster than the previous commit. |
| |
| * microbenchmarks/put-by-val-negative-array-index.js: Added. |
| (foo): |
| |
| 2019-05-25 Tadeu Zagallo <tzagallo@apple.com> |
| |
| JITOperations getByVal should mark negative array indices as out-of-bounds |
| https://bugs.webkit.org/show_bug.cgi?id=198229 |
| |
| Reviewed by Saam Barati. |
| |
| * microbenchmarks/get-by-val-negative-array-index.js: Added. |
| (foo): |
| |
| 2019-05-24 Justin Michaud <justin_michaud@apple.com> |
| |
| [WASM-References] Support Anyref in globals |
| https://bugs.webkit.org/show_bug.cgi?id=198102 |
| |
| Reviewed by Saam Barati. |
| |
| Add test for anyrefs in globals, as well as adding a new RefNull initExpr for Builder. |
| |
| * wasm/Builder.js: |
| (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section): |
| * wasm/Builder_WebAssemblyBinary.js: |
| (const.putInitExpr): |
| * wasm/references/anyref_globals.js: Added. |
| (GetGlobal.0.End.End.WebAssembly): |
| (5.doGCSet): |
| (doGCTest): |
| (doGCSet.doGCTest.let.count.0.doBarrierSet): |
| |
| 2019-05-23 Tadeu Zagallo <tzagallo@apple.com> |
| |
| DFG::OSREntry should not perform arity check |
| https://bugs.webkit.org/show_bug.cgi?id=198189 |
| |
| Reviewed by Saam Barati. |
| |
| * microbenchmarks/loop-osr-with-arity-mismatch.js: Added. |
| (foo): |
| |
| 2019-05-23 Stephan Szabo <stephan.szabo@sony.com> |
| |
| [PlayStation] Skip additional tests on PlayStation |
| https://bugs.webkit.org/show_bug.cgi?id=198145 |
| |
| Reviewed by Ross Kirsling. |
| |
| * exceptionFuzz.yaml: |
| Add skip on hostOS playstation |
| * executableAllocationFuzz.yaml: |
| Add skip on hostOS playstation |
| |
| 2019-05-23 Tadeu Zagallo <tzagallo@apple.com> |
| |
| createListFromArrayLike should throw if value is not an object |
| https://bugs.webkit.org/show_bug.cgi?id=198138 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/create-list-from-array-like-not-object.js: Added. |
| (testValid): |
| (testInvalid): |
| * stress/proxy-get-own-property-names-should-not-clear-previous-results.js: |
| (opt): |
| * stress/proxy-proto-enumerator.js: Added. |
| (main): |
| * stress/proxy-proto-own-keys.js: Added. |
| (assert): |
| (ownKeys): |
| |
| 2019-05-22 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] ArrayAllocationProfile should not access to butterfly in concurrent compiler |
| https://bugs.webkit.org/show_bug.cgi?id=197809 |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/array-allocation-profile-should-not-update-itself-in-concurrent-compiler.js: Added. |
| (foo): |
| |
| 2019-05-22 Ross Kirsling <ross.kirsling@sony.com> |
| |
| [ESNext] Implement support for Numeric Separators |
| https://bugs.webkit.org/show_bug.cgi?id=196351 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/numeric-literal-separators.js: Added. |
| Add tests for feature. |
| |
| * test262/expectations.yaml: |
| Mark 60 test cases as passing. |
| |
| 2019-05-22 Tadeu Zagallo <tzagallo@apple.com> |
| |
| llint_slow_path_get_by_id needs to hold the CodeBlock's to update the metadata's mode |
| https://bugs.webkit.org/show_bug.cgi?id=198120 |
| <rdar://problem/49668795> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/get-array-length-concurrently-change-mode.js: Added. |
| (main): |
| |
| 2019-05-22 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r245634. |
| https://bugs.webkit.org/show_bug.cgi?id=198140 |
| |
| 'This patch makes JSC crash on launch in debug builds' |
| (Requested by tadeuzagallo on #webkit). |
| |
| Reverted changeset: |
| |
| "[ESNext] Implement support for Numeric Separators" |
| https://bugs.webkit.org/show_bug.cgi?id=196351 |
| https://trac.webkit.org/changeset/245634 |
| |
| 2019-05-22 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Stack-buffer-overflow in decodeURIComponent |
| https://bugs.webkit.org/show_bug.cgi?id=198109 |
| <rdar://problem/50397550> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/decode-uri-icu-count-trail-bytes.js: Added. |
| (i.j.try.i.toString): |
| (i.j.catch): |
| |
| 2019-05-22 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Don't clear PropertyNameArray in Proxy code |
| https://bugs.webkit.org/show_bug.cgi?id=197691 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/proxy-get-own-property-names-should-not-clear-previous-results.js: Added. |
| (shouldBe): |
| (opt): |
| |
| 2019-05-22 Ross Kirsling <ross.kirsling@sony.com> |
| |
| [ESNext] Implement support for Numeric Separators |
| https://bugs.webkit.org/show_bug.cgi?id=196351 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/numeric-literal-separators.js: Added. |
| Add tests for feature. |
| |
| * test262/expectations.yaml: |
| Mark 60 test cases as passing. |
| |
| 2019-05-22 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] ArrayBufferContents::tryAllocate signs the pointer with allocation size and authenticates it with sizeInBytes |
| https://bugs.webkit.org/show_bug.cgi?id=198101 |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/zero-sized-array-buffer-pointer-should-be-signed-with-zero.js: Added. |
| (shouldBe): |
| |
| 2019-05-20 Keith Miller <keith_miller@apple.com> |
| |
| Cleanup Yarr regexp code around paren contexts. |
| https://bugs.webkit.org/show_bug.cgi?id=198063 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/regexp-many-named-sequential-capture-groups.js: Added. |
| (i.s): |
| * stress/regexp-many-unnamed-sequential-capture-groups.js: Added. |
| |
| 2019-05-17 Justin Michaud <justin_michaud@apple.com> |
| |
| [WASM-References] Add support for Anyref in parameters and return types, Ref.null and Ref.is_null for Anyref values. |
| https://bugs.webkit.org/show_bug.cgi?id=197969 |
| |
| Reviewed by Keith Miller. |
| |
| Support the anyref type in Builder.js, plus add some extra error logging. |
| Add new folder for wasm references tests. |
| |
| * wasm.yaml: |
| * wasm/Builder.js: |
| (const._isValidValue): |
| * wasm/references/anyref_modules.js: Added. |
| (Call.3.RefIsNull.End.End.WebAssembly.js.ident): |
| (Call.3.RefIsNull.End.End.WebAssembly.js.make_null): |
| (Call.3.RefIsNull.End.End.WebAssembly): |
| (undefined): |
| * wasm/references/is_null.js: Added. |
| * wasm/references/is_null_error.js: Added. |
| * wasm/spec-harness/index.js: |
| * wasm/wasm.json: |
| |
| 2019-05-16 Ross Kirsling <ross.kirsling@sony.com> |
| |
| [JSC] Invalid AssignmentTargetType should be an early error. |
| https://bugs.webkit.org/show_bug.cgi?id=197603 |
| |
| Reviewed by Keith Miller. |
| |
| * test262/expectations.yaml: |
| Update expectations to reflect new SyntaxErrors. |
| (Ideally, these should all be viewed as passing in the near future.) |
| |
| * stress/async-await-basic.js: |
| * stress/big-int-literals.js: |
| Update tests to reflect new SyntaxErrors. |
| |
| * ChakraCore.yaml: |
| * ChakraCore/test/EH/try6.baseline-jsc: |
| * ChakraCore/test/Error/variousErrors3.baseline-jsc: Added. |
| Update baselines to reflect new SyntaxErrors. |
| |
| 2019-05-15 Saam Barati <sbarati@apple.com> |
| |
| Bound liveness of SetArgumentMaybe nodes when maximal flush insertion phase is enabled |
| https://bugs.webkit.org/show_bug.cgi?id=197855 |
| <rdar://problem/50236506> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness-2.js: Added. |
| (f0): |
| (bar): |
| (foo): |
| * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness.js: Added. |
| (f1): |
| (f2): |
| (foo): |
| |
| 2019-05-14 Keith Miller <keith_miller@apple.com> |
| |
| Fix issue with byteOffset on ARM64E |
| https://bugs.webkit.org/show_bug.cgi?id=197884 |
| |
| Reviewed by Saam Barati. |
| |
| We didn't have any tests that run with non-byte/non-zero offset |
| typed arrays. |
| |
| * stress/ftl-gettypedarrayoffset-wasteful.js: |
| |
| 2019-05-14 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Shrink sizeof(UnlinkedFunctionExecutable) more |
| https://bugs.webkit.org/show_bug.cgi?id=197833 |
| |
| Reviewed by Darin Adler. |
| |
| * stress/generator-name.js: Added. |
| (shouldBe): |
| (gen): |
| (catch): |
| |
| 2019-05-13 Tadeu Zagallo <tzagallo@apple.com> |
| |
| JSObject::getOwnPropertyDescriptor is missing an exception check |
| https://bugs.webkit.org/show_bug.cgi?id=197693 |
| <rdar://problem/50441784> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/proxy-spread.js: Added. |
| (foo): |
| |
| 2019-05-10 Saam barati <sbarati@apple.com> |
| |
| Call to JSToWasmICCallee::createStructure passes in wrong prototype value |
| https://bugs.webkit.org/show_bug.cgi?id=197807 |
| <rdar://problem/50530400> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/js-to-wasm-callee-has-correct-prototype.js: Added. |
| (test.getInstance): |
| (test): |
| |
| 2019-05-10 Ross Kirsling <ross.kirsling@sony.com> |
| |
| [Test262] Unreviewed expectations update following r245188. |
| |
| * test262/config.yaml: |
| * test262/expectations.yaml: |
| |
| * test262/test/intl402/DateTimeFormat/prototype/formatRange/date-is-infinity-throws.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRange/date-is-nan-throws.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRange/date-undefined-throws.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRange/date-x-greater-than-y-throws.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRange/this-is-not-object-throws.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-is-infinity-throws.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-is-nan-throws.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-undefined-throws.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-x-greater-than-y-throws.js: |
| * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/this-is-not-object-throws.js: |
| These files have invalid YAML comments. Will also submit corrections back to Test262. |
| |
| 2019-05-10 Keith Miller <keith_miller@apple.com> |
| |
| Update test262 tests. |
| |
| Rubber-stamped by Yusuke Suzuki. |
| |
| * test262/*: mega-patch too many things to list individually. |
| |
| 2019-05-09 Keith Miller <keith_miller@apple.com> |
| |
| Unreview, fix test to have a try-catch. |
| |
| * stress/many-nested-functions-parser-stack-overflow.js: |
| (catch): |
| |
| 2019-05-09 Keith Miller <keith_miller@apple.com> |
| |
| parseStatementListItem needs a stack overflow check |
| https://bugs.webkit.org/show_bug.cgi?id=197749 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/many-nested-functions-parser-stack-overflow.js: Added. |
| |
| 2019-05-08 Saam barati <sbarati@apple.com> |
| |
| AccessGenerationState::emitExplicitExceptionHandler can clobber an in use register |
| https://bugs.webkit.org/show_bug.cgi?id=197715 |
| <rdar://problem/50399252> |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/polymorphic-access-exception-handler-should-not-clobber-used-register.js: Added. |
| (foo): |
| (bar): |
| |
| 2019-05-08 Ryan Haddad <ryanhaddad@apple.com> |
| |
| Unreviewed, rolling out r245068. |
| |
| Caused debug layout tests to exit early due to an assertion |
| failure. |
| |
| Reverted changeset: |
| |
| "All prototypes should call didBecomePrototype()" |
| https://bugs.webkit.org/show_bug.cgi?id=196315 |
| https://trac.webkit.org/changeset/245068 |
| |
| 2019-05-08 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Invalid DFG JIT genereation in high CPU usage state |
| https://bugs.webkit.org/show_bug.cgi?id=197453 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/string-ident-use-clears-abstract-value-if-rope-string-constant-is-held.js: Added. |
| (trigger): |
| (main): |
| |
| 2019-05-08 Robin Morisset <rmorisset@apple.com> |
| |
| All prototypes should call didBecomePrototype() |
| https://bugs.webkit.org/show_bug.cgi?id=196315 |
| |
| Reviewed by Saam Barati. |
| |
| This changelog already landed, but the commit was missing the actual changes. |
| |
| * stress/function-prototype-indexed-accessor.js: Added. |
| |
| 2019-05-08 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] Add ValueMod into DFG |
| https://bugs.webkit.org/show_bug.cgi?id=186174 |
| |
| Reviewed by Saam Barati. |
| |
| * microbenchmarks/mod-untyped.js: Added. |
| * stress/big-int-mod-osr.js: Added. |
| * stress/value-div-ai-rule.js: Added. |
| * stress/value-mod-ai-rule.js: Added. |
| |
| 2019-05-07 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] DFG_ASSERT failed in lowInt52 |
| https://bugs.webkit.org/show_bug.cgi?id=197569 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/getstack-int52.js: Added. |
| (opt): |
| (main): |
| |
| 2019-05-07 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| JSC: A bug in BytecodeGenerator::emitEqualityOpImpl |
| https://bugs.webkit.org/show_bug.cgi?id=197479 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/do-not-perform-bytecode-peephole-optimization-in-jump-target.js: Added. |
| (shouldBe): |
| |
| 2019-05-07 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| TemplateObject passed to template literal tags are not always identical for the same source location. |
| https://bugs.webkit.org/show_bug.cgi?id=190756 |
| |
| Reviewed by Saam Barati. |
| |
| * complex.yaml: |
| * complex/tagged-template-regeneration-after.js: Added. |
| (shouldBe): |
| * complex/tagged-template-regeneration.js: Added. |
| (call): |
| (test): |
| * modules/tagged-template-inside-module.js: Added. |
| (from.string_appeared_here.call): |
| * modules/tagged-template-inside-module/other-tagged-templates.js: Added. |
| (call): |
| (export.otherTaggedTemplates): |
| * stress/call-and-construct-should-return-same-tagged-templates.js: Added. |
| (shouldBe): |
| (call): |
| (poly): |
| * stress/tagged-templates-in-direct-eval-should-not-produce-same-site-object.js: Added. |
| (shouldBe): |
| (call): |
| * stress/tagged-templates-in-function-in-direct-eval.js: Added. |
| (shouldBe): |
| (call): |
| (test): |
| * stress/tagged-templates-in-global-function-should-not-produce-same-site-object.js: Added. |
| (shouldBe): |
| (call): |
| * stress/tagged-templates-in-indirect-eval-should-not-produce-same-site-object.js: Added. |
| (shouldBe): |
| (call): |
| * stress/tagged-templates-in-multiple-functions.js: Added. |
| (shouldBe): |
| (call): |
| (a): |
| (b): |
| (c): |
| * stress/tagged-templates-with-same-start-offset.js: Added. |
| (shouldBe): |
| |
| 2019-05-07 Robin Morisset <rmorisset@apple.com> |
| |
| All prototypes should call didBecomePrototype() |
| https://bugs.webkit.org/show_bug.cgi?id=196315 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/function-prototype-indexed-accessor.js: Added. |
| |
| 2019-05-07 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r244978. |
| https://bugs.webkit.org/show_bug.cgi?id=197671 |
| |
| TemplateObject map should use start/end offsets (Requested by |
| yusukesuzuki on #webkit). |
| |
| Reverted changeset: |
| |
| "TemplateObject passed to template literal tags are not always |
| identical for the same source location." |
| https://bugs.webkit.org/show_bug.cgi?id=190756 |
| https://trac.webkit.org/changeset/244978 |
| |
| 2019-05-07 Tadeu Zagallo <tzagallo@apple.com> |
| |
| tryCachePutByID should not crash if target offset changes |
| https://bugs.webkit.org/show_bug.cgi?id=197311 |
| <rdar://problem/48033612> |
| |
| Reviewed by Filip Pizlo. |
| |
| Add a series of tests related tryCachePutByID. Two of these tests used to crash and were fixed |
| by this patch: `cache-put-by-id-different-attributes.js` and `cache-put-by-id-different-offset.js` |
| |
| * stress/cache-put-by-id-delete-prototype.js: Added. |
| (A.prototype.set y): |
| (A): |
| (B.prototype.set y): |
| (B): |
| (C): |
| * stress/cache-put-by-id-different-__proto__.js: Added. |
| (A.prototype.set y): |
| (A): |
| (B1): |
| (B2.prototype.set y): |
| (B2): |
| (C): |
| (D): |
| * stress/cache-put-by-id-different-attributes.js: Added. |
| (Foo): |
| (set x): |
| * stress/cache-put-by-id-different-offset.js: Added. |
| (Foo): |
| (set x): |
| * stress/cache-put-by-id-insert-prototype.js: Added. |
| (A.prototype.set y): |
| (A): |
| (C): |
| * stress/cache-put-by-id-poly-proto.js: Added. |
| (Foo): |
| (set _): |
| (createBar.Bar): |
| (createBar): |
| |
| 2019-05-07 Saam Barati <sbarati@apple.com> |
| |
| Don't OSR enter into an FTL CodeBlock that has been jettisoned |
| https://bugs.webkit.org/show_bug.cgi?id=197531 |
| <rdar://problem/50162379> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/dont-osr-enter-into-jettisoned-ftl-code-block.js: Added. |
| |
| 2019-05-06 Dean Jackson <dino@apple.com> |
| |
| Update test262 expectations for Proxy passes |
| https://bugs.webkit.org/show_bug.cgi?id=197628 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| There are two consistent passes in Proxy.ownKeys. |
| |
| * test262/expectations.yaml: |
| |
| 2019-05-06 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] We should check OOM for description string of Symbol |
| https://bugs.webkit.org/show_bug.cgi?id=197634 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/check-symbol-description-oom.js: Added. |
| (shouldThrow): |
| |
| 2019-05-06 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Unreviewed, land one more test |
| https://bugs.webkit.org/show_bug.cgi?id=197587 |
| |
| * stress/setter-frame-flush.js: Added. |
| (setter): |
| (foo): |
| (bar): |
| |
| 2019-05-06 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| TemplateObject passed to template literal tags are not always identical for the same source location. |
| https://bugs.webkit.org/show_bug.cgi?id=190756 |
| |
| Reviewed by Saam Barati. |
| |
| * complex.yaml: |
| * complex/tagged-template-regeneration-after.js: Added. |
| (shouldBe): |
| * complex/tagged-template-regeneration.js: Added. |
| (call): |
| (test): |
| * modules/tagged-template-inside-module.js: Added. |
| (from.string_appeared_here.call): |
| * modules/tagged-template-inside-module/other-tagged-templates.js: Added. |
| (call): |
| (export.otherTaggedTemplates): |
| * stress/call-and-construct-should-return-same-tagged-templates.js: Added. |
| (shouldBe): |
| (call): |
| (poly): |
| * stress/tagged-templates-in-direct-eval-should-not-produce-same-site-object.js: Added. |
| (shouldBe): |
| (call): |
| * stress/tagged-templates-in-global-function-should-not-produce-same-site-object.js: Added. |
| (shouldBe): |
| (call): |
| * stress/tagged-templates-in-indirect-eval-should-not-produce-same-site-object.js: Added. |
| (shouldBe): |
| (call): |
| * stress/tagged-templates-in-multiple-functions.js: Added. |
| (shouldBe): |
| (call): |
| (a): |
| (b): |
| (c): |
| |
| 2019-05-06 Stephan Szabo <stephan.szabo@sony.com> |
| |
| [PlayStation] JSC Stress tests failing due to timezone printing |
| https://bugs.webkit.org/show_bug.cgi?id=197615 |
| |
| PlayStation's strftime does not give timezone strings, which |
| results in time strings like "Wed Oct 23 1974 11:45:01 GMT-0700" |
| rather than "Wed Oct 23 1974 11:45:01 GMT-0700 (Pacific Daylight Time)" |
| which causes diff failures with the expectations. Add expectations |
| without the timezone string and use those on playstation. |
| |
| Reviewed by Ross Kirsling. |
| |
| * ChakraCore.yaml: Update these tests to use alternate expectation file on PlayStation |
| * ChakraCore/test/GlobalFunctions/InternalToString.baseline-jsc-playstation: Added. |
| * ChakraCore/test/Operators/equals.baseline-jsc-playstation: Added. |
| * ChakraCore/test/fieldopts/objtypespec-newobj.2.baseline-jsc-playstation: Added. |
| |
| 2019-05-06 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Add more tests for DFG SetLocal emission for adhoc SetterCall frame |
| https://bugs.webkit.org/show_bug.cgi?id=197587 |
| |
| Reviewed by Sam Weinig. |
| |
| This patch adds more tests to r244939. It also inlines setter calls, and eventually see that no PutStack is emitted because MovHint's KillStack kills it. |
| |
| * stress/adhoc-setter-frame-should-not-be-killed.js: Added. |
| |
| 2019-05-04 Tadeu Zagallo <tzagallo@apple.com> |
| |
| TypedArrays should not store properties that are canonical numeric indices |
| https://bugs.webkit.org/show_bug.cgi?id=197228 |
| <rdar://problem/49557381> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/array-species-config-array-constructor.js: |
| (test): |
| * stress/put-direct-index-broken-2.js: |
| * stress/typed-array-canonical-numeric-index-string.js: Added. |
| (makeTest.assert): |
| (makeTest): |
| (const.testInvalidIndices.makeTest.set assert): |
| (const.testInvalidIndices.makeTest): |
| (const.makeTestValidIndex.configurable.set assert): |
| (const.makeTestValidIndex.configurable): |
| * stress/typedarray-access-monomorphic-neutered.js: |
| (checkNoException): |
| (testNoException): |
| (testFTLNoException): |
| * stress/typedarray-access-neutered.js: |
| (testNoException): |
| * stress/typedarray-getownproperty-not-configurable.js: |
| (foo): |
| * test262/expectations.yaml: |
| |
| 2019-05-03 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Need to emit SetLocal if we emit MovHint in DFGByteCodeParser |
| https://bugs.webkit.org/show_bug.cgi?id=197584 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/adhoc-setter-frame-should-emit-setlocal-again.js: Added. |
| (X): |
| (foo): |
| |
| 2019-05-03 Michael Saboff <msaboff@apple.com> |
| |
| iOS JSC tests frequently exiting with execption after stress/json-stringify-string-builder-overflow.js.no-cjit-validate-phases |
| https://bugs.webkit.org/show_bug.cgi?id=197586 |
| |
| Reviewed by Keith Miller. |
| |
| We should only run one config of this test and only when we think we'll have the memory. |
| |
| * stress/json-stringify-string-builder-overflow.js: |
| |
| 2019-05-03 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Generator CodeBlock generation should be idempotent |
| https://bugs.webkit.org/show_bug.cgi?id=197552 |
| |
| Reviewed by Keith Miller. |
| |
| Add complex.yaml, which controls how to run JSC shell more. |
| We split test files into two to run macro task between them which allows debugger to be attached to VM. |
| |
| * complex.yaml: Added. |
| * complex/generator-regeneration-after.js: Added. |
| * complex/generator-regeneration.js: Added. |
| (gen): |
| |
| 2019-05-02 Michael Saboff <msaboff@apple.com> |
| |
| Unreviewed rollout of r244862. |
| |
| * stress/proxy-getOwnPropertySlots-exceptionChecks.js: |
| |
| 2019-05-01 Saam barati <sbarati@apple.com> |
| |
| Baseline JIT should do argument value profiling after checking for stack overflow |
| https://bugs.webkit.org/show_bug.cgi?id=197052 |
| <rdar://problem/50009602> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/check-stack-overflow-before-value-profiling-arguments.js: Added. |
| |
| 2019-05-01 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Inlining Getter/Setter should care availability of ad-hocly constructed frame |
| https://bugs.webkit.org/show_bug.cgi?id=197405 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/getter-setter-inlining-should-emit-movhint.js: Added. |
| (foo): |
| (test): |
| (i.o.get f): |
| (i.o.set f): |
| |
| 2019-05-01 Michael Saboff <msaboff@apple.com> |
| |
| ASSERTION FAILED: !m_needExceptionCheck with --validateExceptionChecks=1; ProxyObject.getOwnPropertySlotCommon/JSFunction.callerGetter |
| https://bugs.webkit.org/show_bug.cgi?id=197485 |
| |
| Reviewed by Saam Barati. |
| |
| New test. |
| |
| * stress/proxy-getOwnPropertySlots-exceptionChecks.js: Added. |
| (foo): |
| |
| 2019-05-01 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Unreviewed correction to Test262 expectations following r244828. |
| |
| * test262/expectations.yaml: |
| |
| 2019-05-01 Stephan Szabo <stephan.szabo@sony.com> |
| |
| Add memory-limited skipping to some tests generating very large strings |
| https://bugs.webkit.org/show_bug.cgi?id=197437 |
| |
| Reviewed by Ross Kirsling. |
| |
| * stress/StringObject-define-length-getter-rope-string-oom.js: |
| * stress/create-error-out-of-memory-rope-string.js: |
| * stress/string-16bit-repeat-overflow.js: |
| |
| 2019-04-30 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r244806. |
| https://bugs.webkit.org/show_bug.cgi?id=197446 |
| |
| Causing Test262 and JSC test failures on multiple builds |
| (Requested by ShawnRoberts on #webkit). |
| |
| Reverted changeset: |
| |
| "TypeArrays should not store properties that are canonical |
| numeric indices" |
| https://bugs.webkit.org/show_bug.cgi?id=197228 |
| https://trac.webkit.org/changeset/244806 |
| |
| 2019-04-30 Tadeu Zagallo <tzagallo@apple.com> |
| |
| TypeArrays should not store properties that are canonical numeric indices |
| https://bugs.webkit.org/show_bug.cgi?id=197228 |
| <rdar://problem/49557381> |
| |
| Reviewed by Darin Adler. |
| |
| * stress/typed-array-canonical-numeric-index-string.js: Added. |
| (makeTest.assert): |
| (makeTest): |
| (const.testInvalidIndices.makeTest.set assert): |
| (const.testInvalidIndices.makeTest): |
| (const.testValidIndices.makeTest.set assert): |
| (const.testValidIndices.makeTest): |
| |
| 2019-04-29 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| normalizeMapKey should normalize NaN to one PureNaN bit pattern to make MapHash same |
| https://bugs.webkit.org/show_bug.cgi?id=197362 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/map-with-nan.js: Added. |
| (shouldBe): |
| (div): |
| (NaN1): |
| (NaN2): |
| (NaN3): |
| (NaN4): |
| (NaN1NoInline): |
| (NaN2NoInline): |
| (NaN3NoInline): |
| (NaN4NoInline): |
| (test1): |
| (test2): |
| (test3): |
| (test4): |
| * stress/set-with-nan.js: Added. |
| (shouldBe): |
| (div): |
| (NaN1): |
| (NaN2): |
| (NaN3): |
| (NaN4): |
| (NaN1NoInline): |
| (NaN2NoInline): |
| (NaN3NoInline): |
| (NaN4NoInline): |
| (test2): |
| (test4): |
| |
| 2019-04-26 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r244708. |
| https://bugs.webkit.org/show_bug.cgi?id=197334 |
| |
| "Broke the debug build" (Requested by rmorisset on #webkit). |
| |
| Reverted changeset: |
| |
| "All prototypes should call didBecomePrototype()" |
| https://bugs.webkit.org/show_bug.cgi?id=196315 |
| https://trac.webkit.org/changeset/244708 |
| |
| 2019-04-25 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] linkPolymorphicCall now does GC |
| https://bugs.webkit.org/show_bug.cgi?id=197306 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/link-polymorphic-call-can-gc.js: Added. |
| (module): |
| (instance): |
| |
| 2019-04-26 Robin Morisset <rmorisset@apple.com> |
| |
| All prototypes should call didBecomePrototype() |
| https://bugs.webkit.org/show_bug.cgi?id=196315 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/function-prototype-indexed-accessor.js: Added. |
| |
| 2019-04-23 Saam Barati <sbarati@apple.com> |
| |
| LICM incorrectly assumes it'll never insert a node which provably OSR exits |
| https://bugs.webkit.org/show_bug.cgi?id=196721 |
| <rdar://problem/49556479> |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/licm-should-handle-if-a-hoist-causes-a-provable-osr-exit.js: Added. |
| (foo): |
| |
| 2019-04-19 Saam Barati <sbarati@apple.com> |
| |
| AbstractValue can represent more than int52 |
| https://bugs.webkit.org/show_bug.cgi?id=197118 |
| <rdar://problem/49969960> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/abstract-value-can-include-int52.js: Added. |
| (foo): |
| (index.index.8.index.60.index.65.index.1234.index.1234.parseInt.string_appeared_here.String.fromCharCode): |
| |
| 2019-04-18 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [WTF] StringBuilder should set correct m_is8Bit flag when merging |
| https://bugs.webkit.org/show_bug.cgi?id=197053 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/merge-string-builder-in-dfg.js: Added. |
| (foo): |
| |
| 2019-04-16 Caitlin Potter <caitp@igalia.com> |
| |
| [JSC] Filter DontEnum properties in ProxyObject::getOwnPropertyNames() |
| https://bugs.webkit.org/show_bug.cgi?id=176810 |
| |
| Reviewed by Saam Barati. |
| |
| Add tests for the DontEnum filtering, and variations of other tests |
| take the DontEnum-filtering path. |
| |
| * stress/proxy-own-keys.js: |
| (i.catch): |
| (set assert): |
| (set add): |
| (let.set new): |
| (get let): |
| |
| 2019-04-15 Saam barati <sbarati@apple.com> |
| |
| Modify how we do SetArgument when we inline varargs calls |
| https://bugs.webkit.org/show_bug.cgi?id=196712 |
| <rdar://problem/49605012> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/get-stack-wrong-type-when-inline-varargs.js: Added. |
| (foo): |
| |
| 2019-04-15 Saam barati <sbarati@apple.com> |
| |
| SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base |
| https://bugs.webkit.org/show_bug.cgi?id=196945 |
| <rdar://problem/49802750> |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/get-by-offset-should-use-correct-child.js: Added. |
| (foo.bar): |
| (foo): |
| |
| 2019-04-15 Robin Morisset <rmorisset@apple.com> |
| |
| DFG should be able to constant fold Object.create() with a constant prototype operand |
| https://bugs.webkit.org/show_bug.cgi?id=196886 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| Note that this new benchmark does not currently see a speedup with inlining removed. |
| The reason is that we do not yet have inline caching for Object.create(), we only optimize it when the DFG can see statically the prototype being passed. |
| |
| * microbenchmarks/object-create-constant-prototype.js: Added. |
| (test): |
| |
| 2019-04-15 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Incremental bytecode cache should not append function updates when loaded from memory |
| https://bugs.webkit.org/show_bug.cgi?id=196865 |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/bytecode-cache-shared-code-block.js: Added. |
| (b): |
| (program): |
| |
| 2019-04-13 Tadeu Zagallo <tzagallo@apple.com> |
| |
| CodeCache should check that the UnlinkedCodeBlock was successfully created before caching it |
| https://bugs.webkit.org/show_bug.cgi?id=196880 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/bytecode-cache-syntax-error.js: Added. |
| (catch): |
| |
| 2019-04-12 Saam barati <sbarati@apple.com> |
| |
| r244079 logically broke shouldSpeculateInt52 |
| https://bugs.webkit.org/show_bug.cgi?id=196884 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * microbenchmarks/int52-rand-function.js: Added. |
| (Math.random): |
| |
| 2019-04-11 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] op_has_indexed_property should not assume subscript part is Uint32 |
| https://bugs.webkit.org/show_bug.cgi?id=196850 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/has-indexed-property-should-accept-non-int32.js: Added. |
| (foo): |
| |
| 2019-04-11 Saam barati <sbarati@apple.com> |
| |
| Remove invalid assertion in operationInstanceOfCustom |
| https://bugs.webkit.org/show_bug.cgi?id=196842 |
| <rdar://problem/49725493> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/operationInstanceOfCustom-bad-assertion.js: Added. |
| |
| 2019-04-10 Saam Barati <sbarati@apple.com> |
| |
| AbstractValue::validateOSREntryValue is wrong for Int52 constants |
| https://bugs.webkit.org/show_bug.cgi?id=196801 |
| <rdar://problem/49771122> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/abstract-value-int52-constant-validation-should-not-care-about-representation.js: Added. |
| |
| 2019-04-10 Robin Morisset <rmorisset@apple.com> |
| |
| We should clear m_needsOverflowCheck when hitting an exception in defineProperties in ObjectConstructor.cpp |
| https://bugs.webkit.org/show_bug.cgi?id=196746 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/cyclic-define-properties.js: Added. |
| (foo): |
| |
| 2019-04-09 Saam barati <sbarati@apple.com> |
| |
| Clean up Int52 code and some bugs in it |
| https://bugs.webkit.org/show_bug.cgi?id=196639 |
| <rdar://problem/49515757> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/spec-any-int-as-double-produces-any-int52-from-int52-rep.js: Added. |
| |
| 2019-04-09 Tadeu Zagallo <tzagallo@apple.com> |
| |
| ASSERTION FAILED: !scope.exception() || !hasProperty in JSObject::get |
| https://bugs.webkit.org/show_bug.cgi?id=196708 |
| <rdar://problem/49556803> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/proxy-getter-stack-overflow.js: Added. |
| (const.handler.get target): |
| (const.handler.has): |
| (try.with): |
| (catch): |
| |
| 2019-04-08 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] DFG should respect node's strict flag |
| https://bugs.webkit.org/show_bug.cgi?id=196617 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/put-by-val-direct-should-respect-strict-mode-of-inlining-codeblock.js: Added. |
| (shouldEqual): |
| (makeUnwriteableUnconfigurableObject): |
| (runTest): |
| * stress/put-dynamic-var-strict-and-sloppy.js: Added. |
| (shouldBe): |
| (shouldThrow): |
| (with.result): |
| (with.putValueStrict): |
| (with.putValueSloppy): |
| |
| 2019-04-08 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] isRope jump in StringSlice should not jump over register allocations |
| https://bugs.webkit.org/show_bug.cgi?id=196716 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/is-rope-check-in-string-slice-should-not-jump-over-register-allocations.js: Added. |
| (foo.bar): |
| (foo): |
| |
| 2019-04-08 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] to_index_string should not assume incoming value is Uint32 |
| https://bugs.webkit.org/show_bug.cgi?id=196713 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/to-index-string-should-not-assume-incoming-value-is-uint32.js: Added. |
| (foo): |
| |
| 2019-04-08 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Add more tests for r243966 |
| https://bugs.webkit.org/show_bug.cgi?id=196711 |
| |
| Reviewed by Saam Barati. |
| |
| Adding one more test for r243966 fix. The added test will not crash after r243966. |
| |
| * stress/stress-cleared-calllinkinfo.js: Added. |
| (runNearStackLimit.t): |
| (runNearStackLimit): |
| (repeat): |
| (cls): |
| (let.item.of.array.runNearStackLimit): |
| |
| 2019-04-08 Saam Barati <sbarati@apple.com> |
| |
| WebAssembly.RuntimeError missing exception check |
| https://bugs.webkit.org/show_bug.cgi?id=196700 |
| <rdar://problem/49693932> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * wasm/js-api/runtime-error-should-exception-check.js: Added. |
| |
| 2019-04-08 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Unreviewed, rolling in r243948 with test fix |
| https://bugs.webkit.org/show_bug.cgi?id=196486 |
| |
| * stress/arrow-function-and-use-strict-directive.js: Added. |
| * stress/arrow-function-syntax.js: Added. |
| (checkSyntax): |
| (checkSyntaxError): |
| |
| 2019-04-08 Ryan Haddad <ryanhaddad@apple.com> |
| |
| Unreviewed, rolling out r243948. |
| |
| Caused inspector/runtime/parse.html to fail |
| |
| Reverted changeset: |
| |
| "SIGSEGV in JSC::BytecodeGenerator::addStringConstant" |
| https://bugs.webkit.org/show_bug.cgi?id=196486 |
| https://trac.webkit.org/changeset/243948 |
| |
| 2019-04-08 Ryan Haddad <ryanhaddad@apple.com> |
| |
| Unreviewed, rolling out r243943. |
| |
| Caused test262 failures. |
| |
| Reverted changeset: |
| |
| "[JSC] Filter DontEnum properties in |
| ProxyObject::getOwnPropertyNames()" |
| https://bugs.webkit.org/show_bug.cgi?id=176810 |
| https://trac.webkit.org/changeset/243943 |
| |
| 2019-04-07 Michael Saboff <msaboff@apple.com> |
| |
| REGRESSION (r243642): Crash in reddit.com page |
| https://bugs.webkit.org/show_bug.cgi?id=196684 |
| |
| Reviewed by Geoffrey Garen. |
| |
| New regression test. |
| |
| * stress/regexp-nongreedy-charclass-backtracks.js: Added. |
| |
| 2019-04-07 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] CallLinkInfo should clear Callee or CodeBlock even if it is unlinked by jettison |
| https://bugs.webkit.org/show_bug.cgi?id=196683 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/clear-callee-or-codeblock-in-calllinkinfo-even-cleared-by-jettison.js: Added. |
| (foo): |
| |
| 2019-04-05 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] OSRExit recovery for SpeculativeAdd does not consier "A = A + A" pattern |
| https://bugs.webkit.org/show_bug.cgi?id=196582 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/add-overflow-check-with-three-same-registers.js: Added. |
| (foo): |
| (Number.prototype.valueOf): |
| (runWithNumber): |
| |
| 2019-04-05 Ryan Haddad <ryanhaddad@apple.com> |
| |
| Unreviewed, rolling out r243665. |
| |
| Caused iOS JSC tests to exit with an exception. |
| |
| Reverted changeset: |
| |
| "Assertion failed in JSC::createError" |
| https://bugs.webkit.org/show_bug.cgi?id=196305 |
| https://trac.webkit.org/changeset/243665 |
| |
| 2019-04-05 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| SIGSEGV in JSC::BytecodeGenerator::addStringConstant |
| https://bugs.webkit.org/show_bug.cgi?id=196486 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/arrow-function-and-use-strict-directive.js: Added. |
| * stress/arrow-function-syntax.js: Added. Checking EOF token handling. |
| (checkSyntax): |
| (checkSyntaxError): Currently not using it. But it is useful for testing more things related to arrow function syntax. |
| |
| 2019-04-05 Caitlin Potter <caitp@igalia.com> |
| |
| [JSC] Filter DontEnum properties in ProxyObject::getOwnPropertyNames() |
| https://bugs.webkit.org/show_bug.cgi?id=176810 |
| |
| Reviewed by Saam Barati. |
| |
| Add tests for the DontEnum filtering, and variations of other tests |
| take the DontEnum-filtering path. |
| |
| * stress/proxy-own-keys.js: |
| (i.catch): |
| (set assert): |
| (set add): |
| (let.set new): |
| (get let): |
| |
| 2019-04-05 Caitlin Potter <caitp@igalia.com> |
| |
| [JSC] throw if 'ownKeys' Proxy trap result contains duplicate keys |
| https://bugs.webkit.org/show_bug.cgi?id=185211 |
| |
| Reviewed by Saam Barati. |
| |
| This is for the normative spec change in https://github.com/tc39/ecma262/pull/833 |
| |
| This changes several assertions to expect a TypeError to be thrown (in some cases, |
| changing thee expected message). |
| |
| * es6/Proxy_ownKeys_duplicates.js: |
| (handler): |
| (shouldThrow): |
| (test): |
| * stress/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js: |
| (shouldThrow): |
| * stress/proxy-own-keys.js: |
| (i.catch): |
| (assert): |
| |
| 2019-04-04 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] makeBoundFunction should not assume incoming "length" value is Int32 because it performs some calculation in bytecode |
| https://bugs.webkit.org/show_bug.cgi?id=196631 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/make-bound-function-should-not-assume-int32-length.js: Added. |
| (assert): |
| (test): |
| (foo): |
| |
| 2019-04-04 Saam Barati <sbarati@apple.com> |
| |
| Unreviewed. Make the test from r243906 catch the thrown exceptions. |
| |
| * stress/inferred-types-regex-matches-array.js: |
| |
| 2019-04-04 Saam Barati <sbarati@apple.com> |
| |
| createRegExpMatchesArray does not respect inferred types |
| https://bugs.webkit.org/show_bug.cgi?id=193287 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| This checks in the test case for 193287. This issue was discovered by |
| Samuel Groß of Google Project Zero. |
| |
| * stress/inferred-types-regex-matches-array.js: Added. |
| |
| 2019-04-04 Saam barati <sbarati@apple.com> |
| |
| Teach Call ICs how to call Wasm |
| https://bugs.webkit.org/show_bug.cgi?id=196387 |
| |
| Reviewed by Filip Pizlo. |
| |
| * wasm/function-tests/stack-trace.js: |
| |
| 2019-04-04 Caio Lima <ticaiolima@gmail.com> |
| |
| [JSC] We should consider moving UnlinkedFunctionExecutable::m_parentScopeTDZVariables to RareData |
| https://bugs.webkit.org/show_bug.cgi?id=194944 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/verify-bytecode-generator-cached-variables-under-tdz.js: Added. |
| |
| 2019-04-04 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Cache bytecode for jsc.cpp helpers and fix CachedStringImpl |
| https://bugs.webkit.org/show_bug.cgi?id=196409 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/bytecode-cache-cached-string-impl.js: Added. |
| (f): |
| (g): |
| * stress/bytecode-cache-run-string.js: Added. |
| |
| 2019-04-03 Robin Morisset <rmorisset@apple.com> |
| |
| B3 should use associativity to optimize expression trees |
| https://bugs.webkit.org/show_bug.cgi?id=194081 |
| |
| Reviewed by Filip Pizlo. |
| |
| Added three microbenchmarks: |
| - add-tree should be the ideal case, but there is no speedup because we are currently unable to prove that the CheckAdd won't overflow |
| - bit-xor-tree most closely matches the situation where the optimization triggers on the JetStream2 subtests where it triggers: |
| an unbalanced expression tree of size 8 that can be balanced, with no other optimizations being unlocked. 16% speedup |
| - bit-or-tree is an ideal case, where the reassociation also enables a ton of further simplifications. 42% speedup |
| |
| * microbenchmarks/add-tree.js: Added. |
| * microbenchmarks/bit-or-tree.js: Added. |
| * microbenchmarks/bit-xor-tree.js: Added. |
| |
| 2019-04-03 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Exception verification crash on operationArrayIndexOfValueInt32OrContiguous |
| https://bugs.webkit.org/show_bug.cgi?id=196574 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/string-index-of-exception-check.js: Added. |
| (blurType): |
| (1.forEach): |
| |
| 2019-03-29 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Assertion failed in JSC::createError |
| https://bugs.webkit.org/show_bug.cgi?id=196305 |
| <rdar://problem/49387382> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/create-error-out-of-memory-rope-string-2.js: Added. |
| (assert): |
| (catch): |
| |
| 2019-03-28 Saam Barati <sbarati@apple.com> |
| |
| BackwardsGraph needs to consider back edges as the backward's root successor |
| https://bugs.webkit.org/show_bug.cgi?id=195991 |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/map-b3-licm-infinite-loop.js: Added. |
| |
| 2019-03-28 Tadeu Zagallo <tzagallo@apple.com> |
| |
| CodeBlock::jettison() should disallow repatching its own calls |
| https://bugs.webkit.org/show_bug.cgi?id=196359 |
| <rdar://problem/48973663> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/call-link-info-osrexit-repatch.js: Added. |
| (foo): |
| |
| 2019-03-28 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] imports-oom.js intermittently fails |
| https://bugs.webkit.org/show_bug.cgi?id=196373 |
| |
| Reviewed by Saam Barati. |
| |
| imports-oom.js ensures that a wasm module compilation / instantiation throws an OOM error instead of crashing when compiling / instantiating their entry points |
| with extremely low executable memory amount. And this test expects we at least once successfully compile, instantiate, and execute a wasm module to test that |
| wasm implementation is always throwing an OOM error. However, maybe due to wasm changes, the amount of executable memory consumed by wasm compilation is changed, |
| and now we may encounter an OOM error at the first compilation. Since imports-oom.js randomize the amount of executable memory used by the generated wasm module, |
| imports-oom.js intermittently fails when it first generates large wasm module which cannot be compiled. |
| |
| This patch reduces the maxParams from 32 to 8 to reduce the size of randomly generated wasm module. Since we repeatedly generate wasm modules, this test soon encounter |
| an expected OOM error. But this avoids the situation that we get an OOM error when we compile a first wasm module. |
| |
| * wasm/lowExecutableMemory/imports-oom.js: |
| |
| 2019-03-27 Saam Barati <sbarati@apple.com> |
| |
| validateOSREntryValue with Int52 should box the value being checked into double format |
| https://bugs.webkit.org/show_bug.cgi?id=196313 |
| <rdar://problem/49306703> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/validate-int-52-ai-state.js: Added. |
| |
| 2019-03-27 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Owner of watchpoints should validate at GC finalizing phase |
| https://bugs.webkit.org/show_bug.cgi?id=195827 |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/gc-should-reap-dead-watchpoints.js: Added. |
| (foo): |
| (A.prototype.y): |
| (A): |
| |
| 2019-03-26 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| Skip WebAssembly test on 32-bit systems |
| https://bugs.webkit.org/show_bug.cgi?id=196206 |
| |
| Reviewed by Saam Barati. |
| |
| Invoking runDefault executes test immediately even though |
| that test should be skipped due to missing WASM support. |
| Therefore remove runDefault. |
| |
| * wasm/regress/web-assembly-link-error-exception-check.js: |
| |
| 2019-03-26 Tadeu Zagallo <tzagallo@apple.com> |
| |
| WebAssembly: Fix f32.min, f64.min and f64.max operations on NaN |
| https://bugs.webkit.org/show_bug.cgi?id=196217 |
| |
| Reviewed by Saam Barati. |
| |
| Re-enable all NaN tests for f32.min, f64.min and f64.max. |
| |
| * wasm/spec-tests/f32.wast.js: |
| * wasm/spec-tests/f64.wast.js: |
| * wasm/wasm.json: |
| |
| 2019-03-25 Keith Miller <keith_miller@apple.com> |
| |
| ASSERTION FAILED: m_op == CompareStrictEq in JSC::DFG::Node::convertToCompareEqPtr(JSC::DFG::FrozenValue *, JSC::DFG::Edge) |
| https://bugs.webkit.org/show_bug.cgi?id=196176 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/object-is-fold-to-compare-eq-ptr.js: Added. |
| (main.v10): |
| (main): |
| |
| 2019-03-25 Tadeu Zagallo <tzagallo@apple.com> |
| |
| WebAssembly: f32.max with NaN generates incorrect result |
| https://bugs.webkit.org/show_bug.cgi?id=175691 |
| <rdar://problem/33952228> |
| |
| Reviewed by Saam Barati. |
| |
| Enable all f32.max NaN tests |
| |
| * wasm/spec-tests/f32.wast.js: |
| * wasm/wasm.json: |
| |
| 2019-03-24 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| [JSC] Move test into directory for WASM tests |
| https://bugs.webkit.org/show_bug.cgi?id=196187 |
| |
| Reviewed by Mark Lam. |
| |
| Move Test into wasm-directory. Otherwise this test |
| is also executed on systems without WASM support. |
| |
| * wasm/regress/web-assembly-link-error-exception-check.js: Renamed from JSTests/stress/web-assembly-link-error-exception-check.js. |
| |
| 2019-03-23 Mark Lam <mark.lam@apple.com> |
| |
| Rolling out r243032 and r243071 because the fix is incorrect. |
| https://bugs.webkit.org/show_bug.cgi?id=195892 |
| <rdar://problem/48981239> |
| |
| Not reviewed. |
| |
| * stress/check-object-property-condition-liveness-before-accessing-it-when-watchpoints-fire.js: Removed. |
| |
| 2019-03-22 Mark Lam <mark.lam@apple.com> |
| |
| Placate exception check validation in genericTypedArrayViewProtoFuncLastIndexOf(). |
| https://bugs.webkit.org/show_bug.cgi?id=196154 |
| <rdar://problem/49145307> |
| |
| Reviewed by Filip Pizlo. |
| |
| Also added //@ runDefault constraint to web-assembly-link-error-exception-check.js. |
| There's no need to run this test on more than 1 test configuration. |
| |
| * stress/typed-array-lastIndexOf-exception-check.js: Added. |
| * stress/web-assembly-link-error-exception-check.js: |
| |
| 2019-03-22 Mark Lam <mark.lam@apple.com> |
| |
| Placate exception check validation in constructJSWebAssemblyLinkError(). |
| https://bugs.webkit.org/show_bug.cgi?id=196152 |
| <rdar://problem/49145257> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/web-assembly-link-error-exception-check.js: Added. |
| |
| 2019-03-22 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| Skip tests running out of memory on ARM/MIPS |
| https://bugs.webkit.org/show_bug.cgi?id=196131 |
| |
| Unreviewed. Skip test if memory is limited. |
| |
| * microbenchmarks/put-by-val-direct-large-index.js: |
| |
| 2019-03-21 Mark Lam <mark.lam@apple.com> |
| |
| Remove an invalid assertion in DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined(). |
| https://bugs.webkit.org/show_bug.cgi?id=196116 |
| <rdar://problem/48976951> |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js: Added. |
| |
| 2019-03-21 Tadeu Zagallo <tzagallo@apple.com> |
| |
| JSObject::putDirectIndexSlowOrBeyondVectorLength should check if indexIsSufficientlyBeyondLengthForSparseMap |
| https://bugs.webkit.org/show_bug.cgi?id=196078 |
| <rdar://problem/35925380> |
| |
| Reviewed by Mark Lam. |
| |
| Add a new benchmark that allocates several objects and invokes put_by_val_direct |
| with a large index. run-jsc-benchmarks says "definitely 1.6178x faster". |
| |
| * microbenchmarks/put-by-val-direct-large-index.js: Added. |
| |
| 2019-03-21 Mark Lam <mark.lam@apple.com> |
| |
| Placate exception check validation in operationArrayIndexOfString(). |
| https://bugs.webkit.org/show_bug.cgi?id=196067 |
| <rdar://problem/49056572> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/string-equal-exception-check.js: Added. |
| |
| 2019-03-21 Mark Lam <mark.lam@apple.com> |
| |
| Cap length of an array with spread to MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH. |
| https://bugs.webkit.org/show_bug.cgi?id=196055 |
| <rdar://problem/49067448> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: Added. |
| |
| 2019-03-20 Saam Barati <sbarati@apple.com> |
| |
| typeOfDoubleSum is wrong for when NaN can be produced |
| https://bugs.webkit.org/show_bug.cgi?id=196030 |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/double-add-sub-mul-can-produce-nan.js: Added. |
| (assert): |
| (noInline.sub): |
| (noInline): |
| (assert.mul): |
| (assert.add): |
| |
| 2019-03-20 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Update the test to ensure OutOfMemoryError is thrown as intended |
| https://bugs.webkit.org/show_bug.cgi?id=196032 |
| <rdar://problem/46842740> |
| |
| Rubber stamped by Saam Barati. |
| |
| * stress/create-error-out-of-memory-rope-string.js: |
| (assert): |
| (catch): |
| |
| 2019-03-20 Tadeu Zagallo <tzagallo@apple.com> |
| |
| JSC::createError needs to check for OOM in errorDescriptionForValue |
| https://bugs.webkit.org/show_bug.cgi?id=196032 |
| <rdar://problem/46842740> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/create-error-out-of-memory-rope-string.js: Added. |
| |
| 2019-03-19 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Unreviewed, reduce # of iterations to avoid timing out after r242991 |
| https://bugs.webkit.org/show_bug.cgi?id=195791 |
| |
| To avoid timing out, this patch reduces it from 3e7 to 1e7. 1e7 iteration counts still reproduce the issue at 60%. |
| |
| * stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js: |
| |
| 2019-03-19 Caio Lima <ticaiolima@gmail.com> |
| |
| [JSC] microbenchmarks/generate-multiple-llint-entrypoints.js is running out of executable memory on ARMv7 |
| https://bugs.webkit.org/show_bug.cgi?id=195950 |
| |
| Unreviewed, reducing the amount of memory used on this test to avoid |
| OOM on devices with memory restrictions. |
| |
| * microbenchmarks/generate-multiple-llint-entrypoints.js: |
| |
| 2019-03-19 Caio Lima <ticaiolima@gmail.com> |
| |
| [JSC] LLIntEntryPoint creates same DirectJITCode for all functions |
| https://bugs.webkit.org/show_bug.cgi?id=194648 |
| |
| Reviewed by Keith Miller. |
| |
| * microbenchmarks/generate-multiple-llint-entrypoints.js: Added. |
| |
| 2019-03-18 Mark Lam <mark.lam@apple.com> |
| |
| Missing a ThrowScope release in JSObject::toString(). |
| https://bugs.webkit.org/show_bug.cgi?id=195893 |
| <rdar://problem/48970986> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/to-string-exception-check-release.js: Added. |
| |
| 2019-03-18 Mark Lam <mark.lam@apple.com> |
| |
| Structure::flattenDictionary() should clear unused property slots. |
| https://bugs.webkit.org/show_bug.cgi?id=195871 |
| <rdar://problem/48959497> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/structure-flattenDictionary-should-clear-unused-property-slots.js: Added. |
| |
| 2019-03-15 Mark Lam <mark.lam@apple.com> |
| |
| Need to check ObjectPropertyCondition liveness before accessing it when firing watchpoints. |
| https://bugs.webkit.org/show_bug.cgi?id=195827 |
| <rdar://problem/48845513> |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/check-object-property-condition-liveness-before-accessing-it-when-watchpoints-fire.js: Added. |
| |
| 2019-03-15 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| [ARM,MIPS] Skip slow tests |
| https://bugs.webkit.org/show_bug.cgi?id=195799 |
| |
| Unreviewed, test does not finish on ARM and MIPS within the |
| timeout limit. |
| |
| * stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js: |
| |
| 2019-03-14 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Retain PrivateName of Symbol before passing it to operations potentially incurring GC |
| https://bugs.webkit.org/show_bug.cgi?id=195791 |
| <rdar://problem/48806130> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js: Added. |
| (foo): |
| |
| 2019-03-14 Saam barati <sbarati@apple.com> |
| |
| We can't remove code after ForceOSRExit until after FixupPhase |
| https://bugs.webkit.org/show_bug.cgi?id=186916 |
| <rdar://problem/41396612> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/movhint-backwards-propagation-must-merge-use-as-value-add.js: Added. |
| (foo): |
| * stress/movhint-backwards-propagation-must-merge-use-as-value.js: Added. |
| (foo): |
| |
| 2019-03-13 Michael Saboff <msaboff@apple.com> |
| |
| ASSERTION FAILED: regexp->isValid() or ASSERTION FAILED: !isCompilationThread() |
| https://bugs.webkit.org/show_bug.cgi?id=195735 |
| |
| Reviewed by Mark Lam. |
| |
| New regression test. |
| |
| * stress/dont-strength-reduce-regexp-with-compile-error.js: Added. |
| (foo): |
| (bar): |
| |
| 2019-03-14 Saam barati <sbarati@apple.com> |
| |
| Fixup uses KnownInt32 incorrectly in some nodes |
| https://bugs.webkit.org/show_bug.cgi?id=195279 |
| <rdar://problem/47915654> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/known-int32-cant-be-used-across-bytecode-boundary.js: Added. |
| (foo): |
| |
| 2019-03-14 Keith Miller <keith_miller@apple.com> |
| |
| DFG liveness can't skip tail caller inline frames |
| https://bugs.webkit.org/show_bug.cgi?id=195715 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/dfg-scan-inlined-tail-caller-frames-liveness.js: |
| (i.foo): |
| |
| 2019-03-13 Mark Lam <mark.lam@apple.com> |
| |
| Gardening: reducing the variants on 2 tests to avoid timing out on JSC Debug queue. |
| https://bugs.webkit.org/show_bug.cgi?id=195415 |
| |
| Not reviewed. |
| |
| Changed these tests to only run the default configuration. |
| The ftl-no-cjit-validate-sampling-profiler variant was timing out. |
| There's no strong need to run this test on that variant. |
| |
| * stress/dfg-to-string-on-int-does-gc.js: |
| * stress/dfg-to-string-on-string-or-string-object-does-not-gc.js: |
| |
| 2019-03-13 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| String overflow when using StringBuilder in JSC::createError |
| https://bugs.webkit.org/show_bug.cgi?id=194957 |
| |
| Reviewed by Mark Lam. |
| |
| Add test string-overflow-createError-bulder.js that overflows |
| StringBuilder in notAFunctionSourceAppender. The second new test |
| string-overflow-createError-fit.js has an error message that doesn't |
| overflow, it still failed since the String's capacity can't be doubled. |
| Run test string-overflow-createError.js only in the default |
| configuration to reduce memory consumption when running the test |
| in all configurations on multiple CPUs in parallel. |
| |
| * stress/string-overflow-createError-builder.js: Copied from JSTests/stress/string-overflow-createError.js. |
| (catch): |
| * stress/string-overflow-createError-fit.js: Copied from JSTests/stress/string-overflow-createError.js. |
| (catch): |
| * stress/string-overflow-createError.js: |
| |
| 2019-03-12 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] OSR entry should respect abstract values in addition to flush formats |
| https://bugs.webkit.org/show_bug.cgi?id=195653 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/osr-entry-locals-none.js: Added. |
| |
| 2019-03-12 Michael Saboff <msaboff@apple.com> |
| |
| REGRESSION (iOS 12.2): Webpage using CoffeeScript crashes |
| https://bugs.webkit.org/show_bug.cgi?id=195613 |
| |
| Reviewed by Mark Lam. |
| |
| New regression test. |
| |
| * stress/regexp-backref-inbounds.js: Added. |
| (testRegExp): |
| |
| 2019-03-12 Mark Lam <mark.lam@apple.com> |
| |
| The HasIndexedProperty node does GC. |
| https://bugs.webkit.org/show_bug.cgi?id=195559 |
| <rdar://problem/48767923> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/HasIndexedProperty-does-gc.js: Added. |
| |
| 2019-03-11 Caio Lima <ticaiolima@gmail.com> |
| |
| [ESNext][BigInt] Implement "~" unary operation |
| https://bugs.webkit.org/show_bug.cgi?id=182216 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/big-int-bit-not-general.js: Added. |
| * stress/big-int-bitwise-not-jit.js: Added. |
| * stress/big-int-bitwise-not-wrapped-value.js: Added. |
| * stress/bit-op-with-object-returning-int32.js: |
| * stress/bitwise-not-fixup-rules.js: Added. |
| * stress/value-bit-not-ai-rule.js: Added. |
| |
| 2019-03-10 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Invalid flags in a RegExp literal should be an early SyntaxError |
| https://bugs.webkit.org/show_bug.cgi?id=195514 |
| |
| Reviewed by Darin Adler. |
| |
| * test262/expectations.yaml: |
| Mark 4 test cases as passing. |
| |
| * stress/regexp-syntax-error-invalid-flags.js: |
| * stress/regress-161995.js: Removed. |
| Update existing test, merging in an older test for the same behavior. |
| |
| 2019-03-08 Mark Lam <mark.lam@apple.com> |
| |
| Stack overflow crash in JSC::JSObject::hasInstance. |
| https://bugs.webkit.org/show_bug.cgi?id=195458 |
| <rdar://problem/48710195> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/stack-overflow-in-custom-hasInstance.js: Added. |
| |
| 2019-03-08 Tadeu Zagallo <tzagallo@apple.com> |
| |
| op_check_tdz does not def its argument |
| https://bugs.webkit.org/show_bug.cgi?id=192880 |
| <rdar://problem/46221598> |
| |
| Reviewed by Saam Barati. |
| |
| * microbenchmarks/let-for-in.js: Added. |
| (foo): |
| |
| 2019-03-07 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] StringFromCharCode fast path should accept 0xff in DFG and FTL |
| https://bugs.webkit.org/show_bug.cgi?id=195429 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/must-handled-values-should-not-be-used-as-proven-constants-in-cfa.js: Added. |
| (foo): |
| * stress/string-from-char-code-255.js: Added. |
| |
| 2019-03-06 Mark Lam <mark.lam@apple.com> |
| |
| Fix incorrect handling of try-finally completion values. |
| https://bugs.webkit.org/show_bug.cgi?id=195131 |
| <rdar://problem/46222079> |
| |
| Reviewed by Saam Barati and Yusuke Suzuki. |
| |
| Added many permutations of new test case to test-finally.js. test-finally.js has |
| been run on Chrome and Firefox as a sanity check, and we confirmed that all the |
| tests passes there as well. |
| |
| * stress/test-finally.js: |
| |
| 2019-03-06 Saam Barati <sbarati@apple.com> |
| |
| Air::reportUsedRegisters must padInterference |
| https://bugs.webkit.org/show_bug.cgi?id=195303 |
| <rdar://problem/48270343> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/optional-def-arg-width-should-be-both-early-and-late-use.js: Added. |
| |
| 2019-03-06 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] AI should not propagate AbstractValue relying on constant folding phase |
| https://bugs.webkit.org/show_bug.cgi?id=195375 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/make-rope-should-not-propagate-constant-folded-value-in-ai.js: Added. |
| (let.array): |
| |
| 2019-03-05 Saam barati <sbarati@apple.com> |
| |
| op_switch_char broken for rope strings after JSRopeString layout rewrite |
| https://bugs.webkit.org/show_bug.cgi?id=195339 |
| <rdar://problem/48592545> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/switch-on-char-llint-rope.js: Added. |
| |
| 2019-03-04 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Store bits for JSRopeString in 3 stores |
| https://bugs.webkit.org/show_bug.cgi?id=195234 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/null-rope-and-collectors.js: Added. |
| |
| 2019-03-01 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| Unskip test read-dead-bytecode-locals-in-must-have-handle-values2.js on ARM/MIPS |
| https://bugs.webkit.org/show_bug.cgi?id=195207 |
| |
| Unreviewed. After test runtime was reduced in r242213, test can be |
| run again on ARM/MIPS. |
| |
| * stress/read-dead-bytecode-locals-in-must-handle-values2.js: |
| |
| 2019-02-28 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] sizeof(JSString) should be 16 |
| https://bugs.webkit.org/show_bug.cgi?id=194375 |
| |
| Reviewed by Saam Barati. |
| |
| * microbenchmarks/make-rope.js: Added. |
| (makeRope): |
| * stress/to-lower-case-intrinsic-on-empty-rope.js: We no longer allow 0 length JSString except for jsEmptyString singleton per VM. |
| (returnRope.helper): Deleted. |
| (returnRope): Deleted. |
| |
| 2019-02-28 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Unreviewed, reduce the count in the stress/read-dead-bytecode-locals-in-must-handle-values2.js |
| https://bugs.webkit.org/show_bug.cgi?id=195144 |
| |
| 1e8 takes too much time in the Debug build. I tried 1e5 with the old Debug build and it successfully reproduced the issue. |
| Change the number from 1e8 to 1e5. |
| |
| * stress/read-dead-bytecode-locals-in-must-handle-values2.js: |
| (foo): |
| |
| 2019-02-28 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| Test times out on ARM/MIPS |
| https://bugs.webkit.org/show_bug.cgi?id=195168 |
| |
| Unreviewed. Skip test on ARM/MIPS. |
| |
| * stress/read-dead-bytecode-locals-in-must-handle-values2.js: |
| |
| 2019-02-27 Mark Lam <mark.lam@apple.com> |
| |
| The parser is failing to record the token location of new in new.target. |
| https://bugs.webkit.org/show_bug.cgi?id=195127 |
| <rdar://problem/39645578> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/parser-should-record-token-location-of-new-dot-target.js: Added. |
| |
| 2019-02-27 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] mustHandleValues for dead bytecode locals should be ignored in DFG phases |
| https://bugs.webkit.org/show_bug.cgi?id=195144 |
| <rdar://problem/47595961> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/read-dead-bytecode-locals-in-must-handle-values1.js: Added. |
| (bar): |
| (foo): |
| * stress/read-dead-bytecode-locals-in-must-handle-values2.js: Added. |
| (bar): |
| (foo): |
| |
| 2019-02-27 Robin Morisset <rmorisset@apple.com> |
| |
| DFG: Loop-invariant code motion (LICM) should not hoist dead code |
| https://bugs.webkit.org/show_bug.cgi?id=194945 |
| <rdar://problem/48311657> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/licm-dead-code.js: Added. |
| |
| 2019-02-26 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| REGRESSION: stress/regress-178386.js is timing out on JSC debug bot |
| https://bugs.webkit.org/show_bug.cgi?id=194677 |
| <rdar://problem/48112492> |
| |
| Reviewed by Mark Lam. |
| |
| Before r241233, String.fromCharCode (except for an empty string) always returns 16bit string. |
| This makes the rope generated by padEnd 16bit. When we resolve the rope inside JSON.stringify, |
| it immediately fails due the large size. |
| |
| After r241233, String.fromCharCode starts returning 8bit string if possible. So the rope becomes |
| 8bit, and we successfully resolve the rope in this case. Resolving such a large rope takes long |
| time and that is why stress/regress-178386.js starts timing out. Note that, the test fails with |
| OOM error anyway because JSON.stringify's builder overflows with such a large string input. |
| |
| This patch changes the test to produce 16bit string from String.fromCharCode. |
| |
| * stress/regress-178386.js: |
| |
| 2019-02-26 Mark Lam <mark.lam@apple.com> |
| |
| wasmToJS() should purify incoming NaNs. |
| https://bugs.webkit.org/show_bug.cgi?id=194807 |
| <rdar://problem/48189132> |
| |
| Reviewed by Saam Barati. |
| |
| * wasm/regress/wasmToJS-should-purify-NaNs.js: Added. |
| |
| 2019-02-26 Guillaume Emont <guijemont@igalia.com> |
| |
| [JSC] Repeat string created from Array.prototype.join() take too much memory |
| https://bugs.webkit.org/show_bug.cgi?id=193912 |
| |
| Reviewed by Saam Barati. |
| |
| Added a test and a microbenchmark for corner cases of |
| Array.prototype.join() with an uninitialized array. |
| |
| * microbenchmarks/array-prototype-join-uninitialized.js: Added. |
| * stress/array-prototype-join-uninitialized.js: Added. |
| (testArray): |
| (testABC): |
| (B): |
| (C): |
| |
| 2019-02-22 Robin Morisset <rmorisset@apple.com> |
| |
| DFGBytecodeParser should not declare that a node won't clobberExit if DFGFixupPhase can later declare it does clobberExit |
| https://bugs.webkit.org/show_bug.cgi?id=194953 |
| <rdar://problem/47595253> |
| |
| Reviewed by Saam Barati. |
| |
| I could not make this work without the infinite loop, so I am using a watchdog to be able to use it as a regression test. |
| |
| * stress/has-indexed-property-with-worsening-array-mode.js: Added. |
| |
| 2019-02-19 Joseph Pecoraro <pecoraro@apple.com> |
| |
| Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view |
| https://bugs.webkit.org/show_bug.cgi?id=172848 |
| <rdar://problem/25709212> |
| |
| Reviewed by Mark Lam. |
| |
| * typeProfiler/inheritance.js: |
| Rewrite the test slightly for clarity. The hoisting was confusing. |
| |
| * heapProfiler/class-names.js: Added. |
| (MyES5Class): |
| (MyES6Class): |
| (MyES6Subclass): |
| Test object types and improved class names. |
| |
| * heapProfiler/driver/driver.js: |
| (CheapHeapSnapshotNode): |
| (CheapHeapSnapshot): |
| (createCheapHeapSnapshot): |
| (HeapSnapshot): |
| (createHeapSnapshot): |
| Update snapshot parsing from version 1 to version 2. |
| |
| 2019-02-19 Truitt Savell <tsavell@apple.com> |
| |
| Unreviewed, rolling out r241784. |
| |
| Broke all OpenSource builds. |
| |
| Reverted changeset: |
| |
| "Web Inspector: Improve ES6 Class instances in Heap Snapshot |
| instances view" |
| https://bugs.webkit.org/show_bug.cgi?id=172848 |
| https://trac.webkit.org/changeset/241784 |
| |
| 2019-02-19 Joseph Pecoraro <pecoraro@apple.com> |
| |
| Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view |
| https://bugs.webkit.org/show_bug.cgi?id=172848 |
| <rdar://problem/25709212> |
| |
| Reviewed by Mark Lam. |
| |
| * typeProfiler/inheritance.js: |
| Rewrite the test slightly for clarity. The hoisting was confusing. |
| |
| * heapProfiler/class-names.js: Added. |
| (MyES5Class): |
| (MyES6Class): |
| (MyES6Subclass): |
| Test object types and improved class names. |
| |
| * heapProfiler/driver/driver.js: |
| (CheapHeapSnapshotNode): |
| (CheapHeapSnapshot): |
| (createCheapHeapSnapshot): |
| (HeapSnapshot): |
| (createHeapSnapshot): |
| Update snapshot parsing from version 1 to version 2. |
| |
| 2019-02-18 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| [ARM] Fix crash with sampling profiler |
| https://bugs.webkit.org/show_bug.cgi?id=194772 |
| |
| Reviewed by Mark Lam. |
| |
| Do not skip test since crash with sampling profiler is now fixed. |
| |
| * stress/sampling-profiler-richards.js: |
| |
| 2019-02-18 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Add LazyClassStructure::getInitializedOnMainThread |
| https://bugs.webkit.org/show_bug.cgi?id=194784 |
| <rdar://problem/48154820> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/lazy-initialization-done-a-priori-if-jit-enabled.js: Added. |
| (getProperties): |
| (getRandomProperty): |
| (i.catch): |
| |
| 2019-02-18 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| [ARM] Test gardening: Test running out of executable memory |
| https://bugs.webkit.org/show_bug.cgi?id=194771 |
| |
| Unreviewed. Do not run test without LLInt, test is running out of executable |
| memory on ARM otherwise. |
| |
| * stress/tagged-template-object-collect.js: |
| |
| 2019-02-18 Tomas Popela <tpopela@redhat.com> |
| |
| Unreviewed, skip the test on platforms without sampling profiler |
| |
| * stress/sampling-profiler-stack-trace-with-double-quote-in-function-name.js: |
| (platformSupportsSamplingProfiler.foo): |
| (platformSupportsSamplingProfiler.test): |
| (platformSupportsSamplingProfiler): |
| (foo): Deleted. |
| (test): Deleted. |
| |
| 2019-02-17 Saam Barati <sbarati@apple.com> |
| |
| Deadlock when adding a Structure property transition and then doing incremental marking |
| https://bugs.webkit.org/show_bug.cgi?id=194767 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js: Added. |
| |
| 2019-02-15 Michael Saboff <msaboff@apple.com> |
| |
| RELEASE_ASSERT at com.apple.JavaScriptCore: JSC::jsSubstringOfResolved |
| https://bugs.webkit.org/show_bug.cgi?id=194558 |
| |
| Reviewed by Saam Barati. |
| |
| New regression test. |
| |
| * stress/regexp-unicode-within-string.js: Added. |
| |
| 2019-02-15 Mark Lam <mark.lam@apple.com> |
| |
| SamplingProfiler::stackTracesAsJSON() should escape strings. |
| https://bugs.webkit.org/show_bug.cgi?id=194649 |
| <rdar://problem/48072386> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/sampling-profiler-stack-trace-with-double-quote-in-function-name.js: Added. |
| * stress/type-profiler-with-double-quote-in-constructor-name.js: Added. |
| * stress/type-profiler-with-double-quote-in-field-name.js: Added. |
| * stress/type-profiler-with-double-quote-in-optional-field-name.js: Added. |
| |
| 2019-02-15 Robin Morisset <rmorisset@apple.com> |
| CodeBlock::jettison should clear related watchpoints |
| https://bugs.webkit.org/show_bug.cgi?id=194544 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/regexp-replace-double-watchpoint.js: Added. |
| (foo): |
| |
| 2019-02-15 Saam barati <sbarati@apple.com> |
| |
| [WebAssembly] Write a new register allocator for Air O0 and make BBQ use it |
| https://bugs.webkit.org/show_bug.cgi?id=194036 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/tail-call-many-arguments.js: Added. |
| (foo): |
| (bar): |
| |
| 2019-02-14 Saam Barati <sbarati@apple.com> |
| |
| Cache the results of BytecodeGenerator::getVariablesUnderTDZ |
| https://bugs.webkit.org/show_bug.cgi?id=194583 |
| <rdar://problem/48028140> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * microbenchmarks/cache-get-variables-under-tdz-in-bytecode-generator.js: Added. |
| |
| 2019-02-08 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] String.fromCharCode's slow path always generates 16bit string |
| https://bugs.webkit.org/show_bug.cgi?id=194466 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/string-from-char-code-slow-path.js: Added. |
| (shouldBe): |
| (testWithLength): |
| |
| 2019-02-08 Saam barati <sbarati@apple.com> |
| |
| Nodes that rely on being dominated by CheckInBounds should have a child edge to it |
| https://bugs.webkit.org/show_bug.cgi?id=194334 |
| <rdar://problem/47844327> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/check-in-bounds-should-be-a-child-use.js: Added. |
| (func): |
| |
| 2019-02-06 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] InitializeEntrypointArguments should produce SpecCellCheck if FlushFormat is FlushedCell |
| https://bugs.webkit.org/show_bug.cgi?id=194369 |
| <rdar://problem/47813087> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/initialize-entrypoint-arguments-with-tdz.js: Added. |
| (A): |
| |
| 2019-02-06 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] PrivateName to PublicName hash table is wasteful |
| https://bugs.webkit.org/show_bug.cgi?id=194277 |
| |
| Reviewed by Michael Saboff. |
| |
| This test depends on the order of JSSegmentedVariableObjects' variables, which is not guaranteed in JSC. Skipped. |
| |
| * ChakraCore.yaml: |
| |
| 2019-02-05 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| [ARM] Test running out of executable memory |
| https://bugs.webkit.org/show_bug.cgi?id=194285 |
| |
| Unreviewed. Do no execute test with LLInt disabled, test runs out of |
| executable memory otherwise. |
| |
| * stress/class-subclassing-function.js: |
| |
| 2019-02-04 Robin Morisset <rmorisset@apple.com> |
| |
| when lowering AssertNotEmpty, create the value before creating the patchpoint |
| https://bugs.webkit.org/show_bug.cgi?id=194231 |
| |
| Reviewed by Saam Barati. |
| |
| This test is painfully fragile: it tries to test that AssertNotEmpty on a constant produces valid B3 IR. |
| The problem is that AssertNotEmpty is only created by DFGConstantFolding when it can simplify a CheckStructure, and constant folding is a bit capricious (https://bugs.webkit.org/show_bug.cgi?id=133947) |
| So even tiny changes to this test can change the path code taken. |
| |
| * stress/assert-not-empty.js: Added. |
| (foo): |
| |
| 2019-02-01 Mark Lam <mark.lam@apple.com> |
| |
| Remove invalid assertion in DFG's compileDoubleRep(). |
| https://bugs.webkit.org/show_bug.cgi?id=194130 |
| <rdar://problem/47699474> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/constant-fold-double-rep-into-double-constant.js: Added. |
| |
| 2019-01-30 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Import latest Test262 updates. |
| |
| Rubber-stamped by Keith Miller. |
| |
| * test262.yaml: Deleted. |
| * test262/config.yaml: |
| * test262/expectations.yaml: |
| * test262/latest-changes-summary.txt: |
| * test262/test/: |
| * test262/test262-Revision.txt: |
| |
| 2019-01-30 Robin Morisset <rmorisset@apple.com> |
| |
| Object.keys can now lead to a PhantomNewArrayBuffer, OSR exit from the FTL should know how to materialize a NewArrayBuffer in that case |
| https://bugs.webkit.org/show_bug.cgi?id=194050 |
| <rdar://problem/47595592> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/object-keys-osr-exit.js: Added. |
| (foo): |
| (catch): |
| |
| 2019-01-29 Mark Lam <mark.lam@apple.com> |
| |
| ValueRecovery::recover() should purify NaN values it recovers. |
| https://bugs.webkit.org/show_bug.cgi?id=193978 |
| <rdar://problem/47625488> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/value-recovery-of-double-displaced-in-jsstack-should-be-purified.js: Added. |
| |
| 2019-01-28 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Unreviewed, fix the test after r240543 not to use @Error / Error in builtins |
| https://bugs.webkit.org/show_bug.cgi?id=193713 |
| |
| * stress/try-get-by-id-should-spill-registers-dfg.js: |
| (let.f.createBuiltin): |
| |
| 2019-01-28 Mark Lam <mark.lam@apple.com> |
| |
| ToString node actually does GC. |
| https://bugs.webkit.org/show_bug.cgi?id=193920 |
| <rdar://problem/46695900> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/dfg-to-string-on-int-does-gc.js: Added. |
| * stress/dfg-to-string-on-string-object-does-not-gc.js: Added. |
| * stress/dfg-to-string-on-string-or-string-object-does-not-gc.js: Added. |
| |
| 2019-01-25 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] NativeErrorConstructor should not have own IsoSubspace |
| https://bugs.webkit.org/show_bug.cgi?id=193713 |
| |
| Reviewed by Saam Barati. |
| |
| Remove @Error use. |
| |
| * stress/try-get-by-id-should-spill-registers-dfg.js: |
| (let.f.createBuiltin): |
| |
| 2019-01-24 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| stress/const-semantics.js fails a dfg-eager / ftl-eager run with an ASAN release build. |
| https://bugs.webkit.org/show_bug.cgi?id=190693 |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/regress-190693.js: Added. |
| (truth): |
| (assert): |
| (shouldThrowInvalidConstAssignment): |
| (taz): |
| |
| 2019-01-24 Saam Barati <sbarati@apple.com> |
| |
| Object Allocation Sinking phase can move a node that walks the stack into a place where the InlineCallFrame is no longer valid |
| https://bugs.webkit.org/show_bug.cgi?id=193751 |
| <rdar://problem/47280215> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/object-allocation-sinking-phase-must-only-move-allocations-if-stack-trace-is-still-valid.js: Added. |
| (let.thing): |
| (foo.let.hello): |
| (foo): |
| |
| 2019-01-24 Guillaume Emont <guijemont@igalia.com> |
| |
| [JSC] Reenable baseline JIT on mips |
| https://bugs.webkit.org/show_bug.cgi?id=192983 |
| |
| Reviewed by Mark Lam. |
| |
| Added a new test for a case that was triggering a RELEASE_ASSERT when |
| testing. |
| Disable some slow tests that were already disabled for arm and x86. |
| |
| * stress/json-parse-big-object.js: Added. |
| * stress/new-largeish-contiguous-array-with-size.js: |
| * stress/op_add.js: |
| * stress/op_bitand.js: |
| * stress/op_bitor.js: |
| * stress/op_bitxor.js: |
| * stress/op_lshift-ConstVar.js: |
| * stress/op_lshift-VarConst.js: |
| * stress/op_lshift-VarVar.js: |
| * stress/op_mod-ConstVar.js: |
| * stress/op_mod-VarConst.js: |
| * stress/op_mod-VarVar.js: |
| * stress/op_mul-ConstVar.js: |
| * stress/op_mul-VarConst.js: |
| * stress/op_mul-VarVar.js: |
| * stress/op_rshift-ConstVar.js: |
| * stress/op_rshift-VarConst.js: |
| * stress/op_rshift-VarVar.js: |
| * stress/op_sub-ConstVar.js: |
| * stress/op_sub-VarConst.js: |
| * stress/op_sub-VarVar.js: |
| * stress/op_urshift-ConstVar.js: |
| * stress/op_urshift-VarConst.js: |
| * stress/op_urshift-VarVar.js: |
| * stress/sampling-profiler-richards.js: |
| * stress/spread-forward-call-varargs-stack-overflow.js: |
| |
| 2019-01-23 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [DFG] AvailabilityMap::pruneByLiveness should make non-live operands Availability::unavailable instead of Availability() |
| https://bugs.webkit.org/show_bug.cgi?id=193711 |
| <rdar://problem/47250262> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/availability-was-cleared-when-locals-are-not-live.js: Added. |
| (shouldBe): |
| (foo): |
| (bar): |
| (baz): |
| |
| 2019-01-22 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Unreviewed, fix initial global lexical binding epoch |
| https://bugs.webkit.org/show_bug.cgi?id=193603 |
| <rdar://problem/47380869> |
| |
| * stress/global-lexical-binding-epoch-should-be-correct-one.js: Added. |
| (f1.f2.f3.f4): |
| (f1.f2.f3): |
| (f1.f2): |
| (f1): |
| |
| 2019-01-22 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| REGRESSION(r239612) Crash at runtime due to broken DFG assumption |
| https://bugs.webkit.org/show_bug.cgi?id=193709 |
| <rdar://problem/47363838> |
| |
| Unreviewed, rollout to watch the tests. |
| |
| * stress/object-tostring-changed-proto.js: Removed. |
| * stress/object-tostring-changed.js: Removed. |
| * stress/object-tostring-misc.js: Removed. |
| * stress/object-tostring-other.js: Removed. |
| * stress/object-tostring-untyped.js: Removed. |
| |
| 2019-01-22 Saam Barati <sbarati@apple.com> |
| |
| Unreviewed. Rollout r240223. It regressed JetStream2 by 1%. |
| |
| * stress/arith-abs-to-arith-negate-range-optimizaton.js: |
| (testUncheckedBetweenIntMinInclusiveAndZeroExclusive): |
| (testUncheckedLessThanZero): |
| (testUncheckedLessThanOrEqualZero): |
| * stress/movhint-backwards-propagation-must-merge-use-as-value-add.js: Removed. |
| * stress/movhint-backwards-propagation-must-merge-use-as-value.js: Removed. |
| |
| 2019-01-22 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Invalidate old scope operations using global lexical binding epoch |
| https://bugs.webkit.org/show_bug.cgi?id=193603 |
| <rdar://problem/47380869> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/let-lexical-binding-shadow-existing-global-property-ftl.js: |
| * stress/scope-operation-cache-global-property-before-deleting.js: Added. |
| (shouldThrow): |
| (bar): |
| * stress/scope-operation-cache-global-property-bump-counter.js: Added. |
| (shouldBe): |
| (get1): |
| (get2): |
| (get1If): |
| (get2If): |
| * stress/scope-operation-cache-global-property-even-if-it-fails.js: Added. |
| (shouldThrow): |
| (foo): |
| |
| 2019-01-21 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| Unreviewed, roll out r240220 due to date-format-xparb regression |
| https://bugs.webkit.org/show_bug.cgi?id=193603 |
| |
| * stress/let-lexical-binding-shadow-existing-global-property-ftl.js: |
| * stress/scope-operation-cache-global-property-before-deleting.js: Removed. |
| * stress/scope-operation-cache-global-property-bump-counter.js: Removed. |
| * stress/scope-operation-cache-global-property-even-if-it-fails.js: Removed. |
| |
| 2019-01-21 Caio Lima <ticaiolima@gmail.com> |
| |
| DoesGC rule is wrong for nodes with BigIntUse |
| https://bugs.webkit.org/show_bug.cgi?id=193652 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/big-int-value-op-update-gc-rules.js: Added. |
| (assert): |
| (doesGCAdd): |
| (doesGCSub): |
| (doesGCDiv): |
| (doesGCMul): |
| (doesGCBitAnd): |
| (doesGCBitOr): |
| (doesGCBitXor): |
| |
| 2019-01-20 Saam Barati <sbarati@apple.com> |
| |
| DFG: When inlining DataView set* intrinsics we need to set undefined as our result |
| https://bugs.webkit.org/show_bug.cgi?id=193644 |
| <rdar://problem/46209745> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/data-view-set-intrinsic-undefined-result-2.js: Added. |
| (foo): |
| * stress/data-view-set-intrinsic-undefined-result.js: Added. |
| (foo): |
| (bar): |
| |
| 2019-01-20 Saam Barati <sbarati@apple.com> |
| |
| MovHint must merge NodeBytecodeUsesAsValue for its child |
| https://bugs.webkit.org/show_bug.cgi?id=186916 |
| <rdar://problem/41396612> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/arith-abs-to-arith-negate-range-optimizaton.js: |
| * stress/movhint-backwards-propagation-must-merge-use-as-value.js: Added. |
| |
| 2019-01-20 Yusuke Suzuki <ysuzuki@apple.com> |
| |
| [JSC] Invalidate old scope operations using global lexical binding epoch |
| https://bugs.webkit.org/show_bug.cgi?id=193603 |
| <rdar://problem/47380869> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/let-lexical-binding-shadow-existing-global-property-ftl.js: |
| * stress/scope-operation-cache-global-property-before-deleting.js: Added. |
| (shouldThrow): |
| (bar): |
| * stress/scope-operation-cache-global-property-bump-counter.js: Added. |
| (shouldBe): |
| (get1): |
| (get2): |
| (get1If): |
| (get2If): |
| * stress/scope-operation-cache-global-property-even-if-it-fails.js: Added. |
| (shouldThrow): |
| (foo): |
| |
| 2019-01-17 Saam barati <sbarati@apple.com> |
| |
| StringObjectUse should not be a structure check for the original string object structure |
| https://bugs.webkit.org/show_bug.cgi?id=193483 |
| <rdar://problem/47280522> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/cant-eliminate-string-object-structure-check-when-string-object-is-proven.js: Added. |
| (foo): |
| (a.valueOf.0): |
| |
| 2019-01-17 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] ToThis omission in DFGByteCodeParser is wrong |
| https://bugs.webkit.org/show_bug.cgi?id=193513 |
| <rdar://problem/45842236> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/to-this-omission-with-different-strict-modes.js: Added. |
| (thisA): |
| (thisAStrictWrapper): |
| |
| 2019-01-15 Mark Lam <mark.lam@apple.com> |
| |
| JSFunction::canUseAllocationProfile() should account for builtin functions with no own prototypes. |
| https://bugs.webkit.org/show_bug.cgi?id=193423 |
| <rdar://problem/46209355> |
| |
| Reviewed by Saam Barati. |
| |
| * microbenchmarks/sinkable-new-object-with-builtin-constructor.js: Added. |
| * stress/constructing-builtin-functions-with-getter-prototype-should-only-call-getter-once-per-new-1.js: Added. |
| * stress/constructing-builtin-functions-with-getter-prototype-should-only-call-getter-once-per-new-2.js: Added. |
| * stress/jsfunction-cannot-use-allocation-profile-with-builtin-functions-with-no-prototype.js: Added. |
| |
| 2019-01-15 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] Use KnownStringUse for GetByVal(Array::String) since AI would offer wider type information and offer non-string type after removing Check(String) |
| https://bugs.webkit.org/show_bug.cgi?id=193438 |
| <rdar://problem/45581249> |
| |
| Reviewed by Saam Barati and Keith Miller. |
| |
| Under the heavy load (like, compiling WebKit), AI in this code can broaden type information after the 1st run. |
| Then, GetByVal(String) crashed. |
| |
| * stress/string-get-by-val-lowering.js: Added. |
| (shouldBe): |
| (test): |
| * stress/type-for-get-by-val-can-be-widen-after-ai.js: Added. |
| (Hello): |
| (foo): |
| |
| 2019-01-15 Tomas Popela <tpopela@redhat.com> |
| |
| Unreviewed, skip JIT tests if it's not enabled |
| |
| * stress/bit-op-with-object-returning-int32.js: |
| |
| 2019-01-15 Caio Lima <ticaiolima@gmail.com> |
| |
| DFGByteCodeParser rules for bitwise operations should consider type of their operands |
| https://bugs.webkit.org/show_bug.cgi?id=192966 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/bit-op-with-object-returning-int32.js: Added. |
| |
| 2019-01-15 Guillaume Emont <guijemont@igalia.com> |
| |
| Skip a slow test and a flakey test on arm |
| |
| Unreviewed gardening. |
| |
| * typeProfiler/getter-richards.js: |
| this test always times out, it used to be always skipped on arm and |
| mips, but got accidentally enabled by r237919 now that we have DFG on |
| arm. Also skipping on mips as we plan to soon enable DFG for it too. |
| |
| 2019-01-14 Keith Miller <keith_miller@apple.com> |
| |
| Skip type-check-hoisting-phase-hoist... with no jit |
| https://bugs.webkit.org/show_bug.cgi?id=193421 |
| |
| Reviewed by Mark Lam. |
| |
| It's timing out the 32-bit bots and takes 330 seconds |
| on my machine when run by itself. |
| |
| * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: |
| |
| 2019-01-14 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] AI should check the given constant's array type when folding GetByVal into constant |
| https://bugs.webkit.org/show_bug.cgi?id=193413 |
| <rdar://problem/46092389> |
| |
| Reviewed by Keith Miller. |
| |
| This test is super flaky. It causes crash in r238109, but it does not crash with `--useConcurrentJIT=false`. |
| It does not cause any crashes on the latest revision too. Basically, it highly depends on the timing, and |
| without this patch, the root cause is not fixed yet. If GetLocal is turned into JSConstant in AI, |
| but GetByVal does not have appropriate ArrayModes, JSC crashes. |
| |
| * stress/ai-should-perform-array-check-on-get-by-val-constant-folding.js: Added. |
| (compareArray): |
| |
| 2019-01-14 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] Literal parsing is crashing when used inside a Object Literal |
| https://bugs.webkit.org/show_bug.cgi?id=193404 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-literal-inside-literal-object.js: Added. |
| |
| 2019-01-14 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] Do not use asArrayModes() with Structures because it discards TypedArray information |
| https://bugs.webkit.org/show_bug.cgi?id=193372 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/typed-array-array-modes-profile.js: Added. |
| (foo): |
| |
| 2019-01-14 Mark Lam <mark.lam@apple.com> |
| |
| Fix all CLoop JSC test failures (including some LLInt bugs due to recent bytecode format change). |
| https://bugs.webkit.org/show_bug.cgi?id=193402 |
| <rdar://problem/46012309> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/regexp-compile-oom.js: |
| - Skip this test for !$jitTests because it is tuned for stack usage when the JIT |
| is enabled. As a result, it will fail on cloop builds though there is no bug. |
| |
| 2019-01-11 Saam barati <sbarati@apple.com> |
| |
| DFG combined liveness can be wrong for terminal basic blocks |
| https://bugs.webkit.org/show_bug.cgi?id=193304 |
| <rdar://problem/45268632> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/dfg-combined-liveness-consider-terminal-blocks-bytecode-liveness.js: Added. |
| |
| 2019-01-11 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] Global lexical bindings can shadow global variables if it is `configurable = true` |
| https://bugs.webkit.org/show_bug.cgi?id=193308 |
| <rdar://problem/45546542> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/const-lexical-binding-shadow-existing-global-property-ftl.js: Added. |
| (shouldThrow): |
| (shouldBe): |
| (foo): |
| (get shouldThrow): |
| * stress/const-lexical-binding-shadow-existing-global-property-tdz-ftl.js: Added. |
| (shouldThrow): |
| (shouldBe): |
| (foo): |
| (get shouldBe): |
| (get shouldThrow): |
| (get return): |
| * stress/const-lexical-binding-shadow-existing-global-property-tdz.js: Added. |
| (shouldThrow): |
| (shouldBe): |
| (foo): |
| (get shouldBe): |
| (get shouldThrow): |
| * stress/const-lexical-binding-shadow-existing-global-property.js: Added. |
| (shouldThrow): |
| (shouldBe): |
| (foo): |
| * stress/const-lexical-binding-shadowing-global-properties-and-eval-injection.js: Added. |
| (shouldThrow): |
| (shouldBe): |
| (foo): |
| * stress/global-add-function-should-not-be-shadowed-by-lexical-bindings.js: Added. |
| (shouldThrow): |
| * stress/global-static-variables-should-not-be-shadowed-by-lexical-bindings.js: Added. |
| (shouldThrow): |
| * stress/let-lexical-binding-shadow-existing-global-property-ftl.js: Added. |
| (shouldThrow): |
| (shouldBe): |
| (foo): |
| * stress/let-lexical-binding-shadow-existing-global-property-tdz-ftl.js: Added. |
| (shouldThrow): |
| (shouldBe): |
| (foo): |
| (get shouldBe): |
| (get shouldThrow): |
| (get return): |
| * stress/let-lexical-binding-shadow-existing-global-property-tdz.js: Added. |
| (shouldThrow): |
| (shouldBe): |
| (foo): |
| (get shouldBe): |
| (get shouldThrow): |
| * stress/let-lexical-binding-shadow-existing-global-property.js: Added. |
| (shouldThrow): |
| (shouldBe): |
| (foo): |
| * stress/let-lexical-binding-shadowing-global-properties-and-eval-injection.js: Added. |
| (shouldThrow): |
| (shouldBe): |
| (foo): |
| |
| 2019-01-11 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| Enable DFG on ARM/Linux again |
| https://bugs.webkit.org/show_bug.cgi?id=192496 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| Test wasn't really skipped before moving the line with skip |
| to the top. |
| |
| * stress/regress-192717.js: |
| |
| 2019-01-10 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r239825. |
| https://bugs.webkit.org/show_bug.cgi?id=193330 |
| |
| Broke tests on armv7/linux bots (Requested by guijemont on |
| #webkit). |
| |
| Reverted changeset: |
| |
| "Enable DFG on ARM/Linux again" |
| https://bugs.webkit.org/show_bug.cgi?id=192496 |
| https://trac.webkit.org/changeset/239825 |
| |
| 2019-01-10 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| Enable DFG on ARM/Linux again |
| https://bugs.webkit.org/show_bug.cgi?id=192496 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| Test wasn't really skipped before moving the line with skip |
| to the top. |
| |
| * stress/regress-192717.js: |
| |
| 2019-01-08 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| Array.prototype.flat/flatMap have a minor bug in ArraySpeciesCreate |
| https://bugs.webkit.org/show_bug.cgi?id=193127 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/array-species-create-should-handle-masquerader.js: Added. |
| (shouldThrow): |
| * stress/is-undefined-or-null-builtin.js: Added. |
| (shouldBe): |
| (isUndefinedOrNull.vm.createBuiltin): |
| |
| 2019-01-08 Tadeu Zagallo <tzagallo@apple.com> |
| |
| LLInt put_by_id uses the wrong load instruction for loading flags from the metadata |
| https://bugs.webkit.org/show_bug.cgi?id=193221 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/put-by-id-flags.js: Added. |
| (f): |
| (g): |
| (numberOfDFGCompiles): |
| |
| 2019-01-04 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Baseline version of get_by_id may corrupt metadata |
| https://bugs.webkit.org/show_bug.cgi?id=193085 |
| <rdar://problem/23453006> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/get-by-id-change-mode.js: Added. |
| (forEach): |
| |
| 2019-01-02 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] Optimize Object.prototype.toString |
| https://bugs.webkit.org/show_bug.cgi?id=193031 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/object-tostring-changed-proto.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-tostring-changed.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-tostring-misc.js: Added. |
| (shouldBe): |
| (test): |
| (i.switch): |
| * stress/object-tostring-other.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-tostring-untyped.js: Added. |
| (shouldBe): |
| (test): |
| (i.switch): |
| |
| 2019-01-03 Ross Kirsling <ross.kirsling@sony.com> |
| |
| test262-runner misbehaves when test file YAML has a trailing space |
| https://bugs.webkit.org/show_bug.cgi?id=193053 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * test262/expectations.yaml: |
| Mark two dozen tests as passing (and correct the output of another). |
| |
| 2018-12-30 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| Unreviewed, JSTests gardening with memoryLimited |
| |
| * stress/string-overflow-createError.js: |
| |
| 2018-12-30 Ross Kirsling <ross.kirsling@sony.com> |
| |
| [JSC] Identifier validity should be based on ID_Start / ID_Continue properties |
| https://bugs.webkit.org/show_bug.cgi?id=193050 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * test262.yaml: |
| * test262/expectations.yaml: |
| Mark 16 tests as passing. |
| |
| 2018-12-13 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [BigInt] Support BigInt in JSON.stringify |
| https://bugs.webkit.org/show_bug.cgi?id=192624 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/big-int-json-stringify-to-json.js: Added. |
| (shouldBe): |
| (shouldThrow): |
| (BigInt.prototype.toJSON): |
| (shouldBe.JSON.stringify): |
| * stress/big-int-json-stringify.js: Added. |
| (shouldBe): |
| (shouldThrow): |
| |
| 2018-12-20 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] Implement "well-formed JSON.stringify" proposal |
| https://bugs.webkit.org/show_bug.cgi?id=191677 |
| |
| Reviewed by Darin Adler. |
| |
| * stress/json-surrogate-pair.js: Added. |
| (shouldBe): |
| * test262/expectations.yaml: |
| |
| 2018-12-20 Keith Miller <keith_miller@apple.com> |
| |
| Add support for globalThis |
| https://bugs.webkit.org/show_bug.cgi?id=165171 |
| |
| Reviewed by Mark Lam. |
| |
| * test262/config.yaml: |
| |
| 2018-12-19 Keith Miller <keith_miller@apple.com> |
| |
| Update test262 configuration to not run tests dependent on ICU version. |
| https://bugs.webkit.org/show_bug.cgi?id=192920 |
| |
| Reviewed by Saam Barati. |
| |
| * test262/expectations.yaml: |
| |
| 2018-12-20 Mark Lam <mark.lam@apple.com> |
| |
| Fix a typo in slow_path_construct_arityCheck and operationConstructArityCheck. |
| https://bugs.webkit.org/show_bug.cgi?id=192939 |
| <rdar://problem/46869516> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/stack-overflow-frame-for-construct-arityCheck-should-use-construct-codeBlock.js: Added. |
| |
| 2018-12-20 Tadeu Zagallo <tzagallo@apple.com> |
| |
| WTF::String and StringImpl overflow MaxLength |
| https://bugs.webkit.org/show_bug.cgi?id=192853 |
| <rdar://problem/45726906> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/string-16bit-repeat-overflow.js: Added. |
| (catch): |
| |
| 2018-12-19 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Unreviewed follow-up to r192914. |
| |
| * test262/expectations.yaml: |
| Add the last 20 missing expectations. |
| |
| 2018-12-19 Keith Miller <keith_miller@apple.com> |
| |
| Fix test262 expectations |
| https://bugs.webkit.org/show_bug.cgi?id=192914 |
| |
| Unreviewed, when I imported the latest round of test262 tests I must have failed to update the test expectations. |
| |
| * test262/expectations.yaml: |
| |
| 2018-12-19 Keith Miller <keith_miller@apple.com> |
| |
| Update test262 tests. |
| https://bugs.webkit.org/show_bug.cgi?id=192907 |
| |
| Rubber stamped by Mark Lam. |
| |
| * test262/*: Omitted because prepare-changelog crashes. |
| |
| 2018-12-19 Mark Lam <mark.lam@apple.com> |
| |
| JSPropertyNameEnumerator should cache the iterated object's structure only after getting its property names. |
| https://bugs.webkit.org/show_bug.cgi?id=192464 |
| <rdar://problem/46519455> |
| |
| Reviewed by Saam Barati. |
| |
| This patch is about a 10% speed up on the new for-in-on-object-with-lazily-materialized-properties.js |
| microbenchmark. |
| |
| * microbenchmarks/for-in-on-object-with-lazily-materialized-properties.js: Added. |
| * stress/property-name-enumerator-should-cache-structure-after-getting-property-names.js: Added. |
| |
| 2018-12-19 Tadeu Zagallo <tzagallo@apple.com> |
| |
| String overflow in JSC::createError results in ASSERT in WTF::makeString |
| https://bugs.webkit.org/show_bug.cgi?id=192833 |
| <rdar://problem/45706868> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/string-overflow-createError.js: Added. |
| |
| 2018-12-18 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Error message for `-x ** y` contains a typo. |
| https://bugs.webkit.org/show_bug.cgi?id=192832 |
| |
| Reviewed by Saam Barati. |
| |
| * ChakraCore/test/UnitTestFramework/UnitTestFramework.js: |
| (assert.assert.return.throws): |
| * stress/pow-expects-update-expression-on-lhs.js: |
| (throw.new.Error): |
| Update test expectations which match against the exact error message. |
| |
| 2018-12-18 Mark Lam <mark.lam@apple.com> |
| |
| Gardening: test options fix. |
| https://bugs.webkit.org/show_bug.cgi?id=192822 |
| |
| Unreviewed. |
| |
| * stress/json-stringify-string-builder-overflow.js: |
| |
| 2018-12-18 Mark Lam <mark.lam@apple.com> |
| |
| JSON.stringify() should throw OOM on StringBuilder overflows. |
| https://bugs.webkit.org/show_bug.cgi?id=192822 |
| <rdar://problem/46670577> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/json-stringify-string-builder-overflow.js: Added. |
| |
| 2018-12-18 Ross Kirsling <ross.kirsling@sony.com> |
| |
| Redeclaration of var over let/const/class should be a syntax error. |
| https://bugs.webkit.org/show_bug.cgi?id=192298 |
| |
| Reviewed by Keith Miller. |
| |
| * test262.yaml: |
| * test262/expectations.yaml: |
| Mark 46 tests as passing. |
| |
| * stress/block-scope-redeclarations.js: |
| Add some new tests. |
| |
| * stress/for-in-invalidate-context-weird-assignments.js: |
| * stress/for-in-tests.js: |
| Replace tests for outdated behavior with tests for SyntaxError. |
| |
| * ChakraCore/test/LetConst/defer3.baseline-jsc: |
| * ChakraCore/test/LetConst/letvar.baseline-jsc: |
| Update expectations. |
| |
| 2018-12-18 Mark Lam <mark.lam@apple.com> |
| |
| Skip the stress/elidable-new-object-roflcopter-then-exit.js test on 32-bit. |
| https://bugs.webkit.org/show_bug.cgi?id=191374 |
| <rdar://problem/46525447> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| This test runs too slow on 32-bit, and is not relevant for non-JIT builds. |
| |
| * stress/elidable-new-object-roflcopter-then-exit.js: |
| |
| 2018-12-17 Mark Lam <mark.lam@apple.com> |
| |
| Skip the stress/materialized-regexp-has-correct-last-index-set-by-match.js test on 32-bit. |
| https://bugs.webkit.org/show_bug.cgi?id=192019 |
| <rdar://problem/46525456> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| The test runs too slow on 32-bit. |
| |
| * stress/materialized-regexp-has-correct-last-index-set-by-match.js: |
| |
| 2018-12-17 Mark Lam <mark.lam@apple.com> |
| |
| Skip the stress/materialize-regexp-cyclic-regexp.js test on 32-bit. |
| https://bugs.webkit.org/show_bug.cgi?id=191373 |
| <rdar://problem/46525458> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| The test is already slow running with a JIT on 64-bit. It will always timeout |
| on 32-bit without a JIT. |
| |
| * stress/materialize-regexp-cyclic-regexp.js: |
| |
| 2018-12-17 Mark Lam <mark.lam@apple.com> |
| |
| Array unshift/shift should not race against the AI in the compiler thread. |
| https://bugs.webkit.org/show_bug.cgi?id=192795 |
| <rdar://problem/46724263> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/array-unshift-should-not-race-against-compiler-thread.js: Added. |
| |
| 2018-12-16 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] Optimize Object.keys by caching own keys results in StructureRareData |
| https://bugs.webkit.org/show_bug.cgi?id=190047 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/object-keys-cached-zero.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-keys-changed-attribute.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-keys-changed-index.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-keys-changed.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-keys-indexed-non-cache.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-keys-overrides-get-property-names.js: Added. |
| (shouldBe): |
| (test): |
| (noInline): |
| |
| 2018-12-17 Mark Lam <mark.lam@apple.com> |
| |
| SamplingProfiler's isValidFramePointer() should reject address at stack origin. |
| https://bugs.webkit.org/show_bug.cgi?id=192779 |
| <rdar://problem/46775869> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js: Added. |
| |
| 2018-12-17 Ryan Haddad <ryanhaddad@apple.com> |
| |
| Unreviewed test gardening, address a syntax error in a new test. |
| |
| * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js: |
| |
| 2018-12-17 Mark Lam <mark.lam@apple.com> |
| |
| Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit(). |
| https://bugs.webkit.org/show_bug.cgi?id=192776 |
| <rdar://problem/46772368> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js: Added. |
| |
| 2018-12-17 Mark Lam <mark.lam@apple.com> |
| |
| Fix stale assertion in attemptToForceStringArrayModeByToStringConversion(). |
| https://bugs.webkit.org/show_bug.cgi?id=192770 |
| <rdar://problem/46449037> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/force-string-arrayMode-on-originalNonArray-array-class.js: Added. |
| |
| 2018-12-14 Mark Lam <mark.lam@apple.com> |
| |
| CallFrame::convertToStackOverflowFrame() needs to keep the top CodeBlock alive. |
| https://bugs.webkit.org/show_bug.cgi?id=192717 |
| <rdar://problem/46660677> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-192717.js: Added. |
| |
| 2018-12-14 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r239153, r239154, and r239155. |
| https://bugs.webkit.org/show_bug.cgi?id=192715 |
| |
| Caused flaky GC-related crashes seen with layout tests |
| (Requested by ryanhaddad on #webkit). |
| |
| Reverted changesets: |
| |
| "[JSC] Optimize Object.keys by caching own keys results in |
| StructureRareData" |
| https://bugs.webkit.org/show_bug.cgi?id=190047 |
| https://trac.webkit.org/changeset/239153 |
| |
| "Unreviewed, build fix after r239153" |
| https://bugs.webkit.org/show_bug.cgi?id=190047 |
| https://trac.webkit.org/changeset/239154 |
| |
| "Unreviewed, build fix after r239153, part 2" |
| https://bugs.webkit.org/show_bug.cgi?id=190047 |
| https://trac.webkit.org/changeset/239155 |
| |
| 2018-12-14 Keith Miller <keith_miller@apple.com> |
| |
| Callers of JSString::getIndex should check for OOM exceptions |
| https://bugs.webkit.org/show_bug.cgi?id=192709 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/StringObject-define-length-getter-rope-string-oom.js: Added. |
| |
| 2018-12-13 Mark Lam <mark.lam@apple.com> |
| |
| Add a missing exception check. |
| https://bugs.webkit.org/show_bug.cgi?id=192626 |
| <rdar://problem/46662163> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/regress-192626.js: Added. |
| |
| 2018-12-13 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] Add ValueDiv into DFG |
| https://bugs.webkit.org/show_bug.cgi?id=186178 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-div-jit-osr.js: Added. |
| * stress/big-int-div-jit-untyped.js: Added. |
| * stress/value-div-fixup-int32-big-int.js: Added. |
| |
| 2018-12-10 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] Optimize Object.keys by caching own keys results in StructureRareData |
| https://bugs.webkit.org/show_bug.cgi?id=190047 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/object-keys-cached-zero.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-keys-changed-attribute.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-keys-changed-index.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-keys-changed.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-keys-indexed-non-cache.js: Added. |
| (shouldBe): |
| (test): |
| * stress/object-keys-overrides-get-property-names.js: Added. |
| (shouldBe): |
| (test): |
| (noInline): |
| |
| 2018-12-12 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [DFG][FTL] Add NewSymbol |
| https://bugs.webkit.org/show_bug.cgi?id=192620 |
| |
| Reviewed by Saam Barati. |
| |
| * microbenchmarks/symbol-creation.js: Added. |
| (test): |
| * stress/symbol-description-identity.js: Added. |
| (shouldBe): |
| (test): |
| * stress/symbol-identity.js: Added. |
| (shouldBe): |
| (test): |
| * stress/symbol-with-description-throw-error.js: Added. |
| (shouldBe): |
| (shouldThrow): |
| (test): |
| (object.toString): |
| |
| 2018-12-12 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [BigInt] Implement DFG/FTL typeof for BigInt |
| https://bugs.webkit.org/show_bug.cgi?id=192619 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/big-int-boolean-proven-type.js: Added. |
| (assert): |
| (bool): |
| * stress/big-int-type-of-proven-type-non-constant-including-symbol.js: Added. |
| (assert): |
| (typeOf): |
| (i.switch): |
| * stress/big-int-type-of-proven-type-non-constant.js: Added. |
| (assert): |
| (typeOf): |
| * stress/big-int-type-of.js: |
| (typeOf): |
| (func): |
| |
| 2018-12-10 Mark Lam <mark.lam@apple.com> |
| |
| PropertyAttribute needs a CustomValue bit. |
| https://bugs.webkit.org/show_bug.cgi?id=191993 |
| <rdar://problem/46264467> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-191993.js: Added. |
| |
| 2018-12-10 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] Add ValueMul into DFG |
| https://bugs.webkit.org/show_bug.cgi?id=186175 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-mul-jit-osr.js: Added. |
| * stress/big-int-mul-jit-untyped.js: Added. |
| * stress/value-mul-fixup-int32-big-int.js: Added. |
| |
| 2018-12-06 Keith Miller <keith_miller@apple.com> |
| |
| stress/big-wasm-memory tests failing on 32-bit JSC bot |
| https://bugs.webkit.org/show_bug.cgi?id=192020 |
| |
| Reviewed by Saam Barati. |
| |
| Not every platform has WebAssembly, e.g. 32-bit, so we should exit |
| the wasm stress tests if the WebAssembly object does not exist. |
| |
| * stress/big-wasm-memory-grow-no-max.js: |
| (test.foo): |
| (test): |
| (foo): Deleted. |
| (catch): Deleted. |
| * stress/big-wasm-memory-grow.js: |
| (test.foo): |
| (test): |
| (foo): Deleted. |
| (catch): Deleted. |
| * stress/big-wasm-memory.js: |
| (test.foo): |
| (test): |
| (foo): Deleted. |
| (catch): Deleted. |
| |
| 2018-12-05 Mark Lam <mark.lam@apple.com> |
| |
| speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar. |
| https://bugs.webkit.org/show_bug.cgi?id=192441 |
| <rdar://problem/46480355> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-192441.js: Added. |
| |
| 2018-12-04 Mark Lam <mark.lam@apple.com> |
| |
| DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility. |
| https://bugs.webkit.org/show_bug.cgi?id=192386 |
| <rdar://problem/46445516> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-192386.js: Added. |
| |
| 2018-12-04 Caio Lima <ticaiolima@gmail.com> |
| |
| [ESNext][BigInt] Support logic operations |
| https://bugs.webkit.org/show_bug.cgi?id=179903 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-branch-usage.js: Added. |
| * stress/big-int-logical-and.js: Added. |
| * stress/big-int-logical-not.js: Added. |
| * stress/big-int-logical-or.js: Added. |
| |
| 2018-12-03 Ryan Haddad <ryanhaddad@apple.com> |
| |
| Unreviewed, rolling out r238833. |
| |
| Breaks macOS and iOS debug builds. |
| |
| Reverted changeset: |
| |
| "[ESNext][BigInt] Support logic operations" |
| https://bugs.webkit.org/show_bug.cgi?id=179903 |
| https://trac.webkit.org/changeset/238833 |
| |
| 2018-12-03 Caio Lima <ticaiolima@gmail.com> |
| |
| [ESNext][BigInt] Support logic operations |
| https://bugs.webkit.org/show_bug.cgi?id=179903 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-branch-usage.js: Added. |
| * stress/big-int-logical-and.js: Added. |
| * stress/big-int-logical-not.js: Added. |
| * stress/big-int-logical-or.js: Added. |
| |
| 2018-12-02 Caio Lima <ticaiolima@gmail.com> |
| |
| [ESNext][BigInt] Implement support for "<<" and ">>" |
| https://bugs.webkit.org/show_bug.cgi?id=186233 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-left-shift-general.js: Added. |
| * stress/big-int-left-shift-range-error.js: Added. |
| * stress/big-int-left-shift-type-error.js: Added. |
| * stress/big-int-left-shift-wrapped-value.js: Added. |
| * stress/big-int-right-shift-general.js: Added. |
| * stress/big-int-right-shift-type-error.js: Added. |
| * stress/big-int-right-shift-wrapped-value.js: Added. |
| * stress/left-shift-to-primitive-precedence.js: Added. |
| * stress/right-shift-to-primitive-precedence.js: Added. |
| |
| 2018-11-30 Dean Jackson <dino@apple.com> |
| |
| Add first-class support for .mjs files in jsc binary |
| https://bugs.webkit.org/show_bug.cgi?id=192190 |
| <rdar://problem/46375715> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/simple-module.mjs: Added. |
| * stress/simple-script.js: Added. |
| |
| 2018-11-30 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] Implement ValueBitXor into DFG |
| https://bugs.webkit.org/show_bug.cgi?id=190264 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-bitwise-xor-jit.js: Added. |
| * stress/big-int-bitwise-xor-memory-stress.js: Added. |
| * stress/big-int-bitwise-xor-untyped.js: Added. |
| |
| 2018-11-27 Saam barati <sbarati@apple.com> |
| |
| r238510 broke scopes of size zero |
| https://bugs.webkit.org/show_bug.cgi?id=192033 |
| <rdar://problem/46281734> |
| |
| Reviewed by Keith Miller. |
| |
| * stress/r238510-bad-loop.js: Added. |
| (foo): |
| |
| 2018-11-27 Mark Lam <mark.lam@apple.com> |
| |
| [Re-landing] NaNs read from Wasm code needs to be be purified. |
| https://bugs.webkit.org/show_bug.cgi?id=191056 |
| <rdar://problem/45660341> |
| |
| Reviewed by Filip Pizlo. |
| |
| * wasm/regress/regress-191056.js: Added. |
| |
| 2018-11-27 Ryan Haddad <ryanhaddad@apple.com> |
| |
| Unreviewed, rolling out r238509. |
| |
| Causes JSC tests to fail on iOS. |
| |
| Reverted changeset: |
| |
| "NaNs read from Wasm code needs to be be purified." |
| https://bugs.webkit.org/show_bug.cgi?id=191056 |
| https://trac.webkit.org/changeset/238509 |
| |
| 2018-11-26 Caio Lima <ticaiolima@gmail.com> |
| |
| Re-introduce op_bitnot |
| https://bugs.webkit.org/show_bug.cgi?id=190923 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/bit-not-must-generate.js: Added. |
| * stress/bitwise-not-no-int32.js: Added. |
| |
| 2018-11-26 Saam barati <sbarati@apple.com> |
| |
| InPlaceAbstractState::endBasicBlock rule for SetLocal should filter the value based on the flush format |
| https://bugs.webkit.org/show_bug.cgi?id=191956 |
| <rdar://problem/45665806> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/end-basic-block-set-local-should-filter-type.js: Added. |
| (bar): |
| (foo): |
| |
| 2018-11-26 Saam barati <sbarati@apple.com> |
| |
| Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation |
| https://bugs.webkit.org/show_bug.cgi?id=191958 |
| <rdar://problem/46221877> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added. |
| (x): |
| (foo): |
| |
| 2018-11-26 Mark Lam <mark.lam@apple.com> |
| |
| NaNs read from Wasm code needs to be be purified. |
| https://bugs.webkit.org/show_bug.cgi?id=191056 |
| <rdar://problem/45660341> |
| |
| Reviewed by Filip Pizlo. |
| |
| * wasm/regress/regress-191056.js: Added. |
| |
| 2018-11-26 Michael Saboff <msaboff@apple.com> |
| |
| 32-bit JSC test failure: stress/regexp-compile-oom.js |
| https://bugs.webkit.org/show_bug.cgi?id=191375 |
| |
| Reviewed by Mark Lam. |
| |
| Disabled the test for 32 bit platforms. |
| |
| * stress/regexp-compile-oom.js: |
| |
| 2018-11-26 Tadeu Zagallo <tzagallo@apple.com> |
| |
| ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset) |
| https://bugs.webkit.org/show_bug.cgi?id=191716 |
| <rdar://problem/45723878> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-187373.js: Added. |
| (async.fn): |
| |
| 2018-11-21 Saam barati <sbarati@apple.com> |
| |
| DFGSpeculativeJIT should not &= exitOK with mayExit(node) |
| https://bugs.webkit.org/show_bug.cgi?id=191897 |
| <rdar://problem/45871998> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/exitok-is-not-the-same-as-mayExit.js: Added. |
| (bar): |
| (foo): |
| |
| 2018-11-21 Saam barati <sbarati@apple.com> |
| |
| Fix assertion in KnownCellUse inside SpeculativeJIT::speculate |
| https://bugs.webkit.org/show_bug.cgi?id=191895 |
| <rdar://problem/46167406> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/known-cell-use-needs-type-check-assertion.js: Added. |
| (foo): |
| (bar): |
| |
| 2018-11-21 Mark Lam <mark.lam@apple.com> |
| |
| Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError. |
| https://bugs.webkit.org/show_bug.cgi?id=191776 |
| <rdar://problem/46152851> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/big-wasm-memory-grow-no-max.js: |
| * stress/big-wasm-memory-grow.js: |
| * stress/big-wasm-memory.js: |
| - updated these to expect an OutOfMemoryError. |
| |
| * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: Added. |
| (Binary.prototype.emit_u8): |
| (Binary.prototype.emit_u32v): |
| (Binary.prototype.emit_header): |
| (Binary.prototype.emit_section): |
| (Binary): |
| (WasmModuleBuilder): |
| (WasmModuleBuilder.prototype.addMemory): |
| (WasmModuleBuilder.prototype.toArray): |
| (WasmModuleBuilder.prototype.toBuffer): |
| (WasmModuleBuilder.prototype.instantiate): |
| (catch): |
| * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Added. |
| (catch): |
| |
| 2018-11-21 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength |
| https://bugs.webkit.org/show_bug.cgi?id=190836 |
| |
| Reviewed by Saam Barati and Yusuke Suzuki. |
| |
| * stress/big-int-out-of-memory-tests.js: Added. |
| |
| 2018-11-20 Mark Lam <mark.lam@apple.com> |
| |
| Remove invalid assertion in VMTraps::SignalSender's SignalAction. |
| https://bugs.webkit.org/show_bug.cgi?id=191856 |
| <rdar://problem/46089992> |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/regress-191856.js: Added. |
| - this test is skipped for now until we have a fix for webkit.org/b/191855. |
| |
| 2018-11-21 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| Enable JIT on ARM/Linux |
| https://bugs.webkit.org/show_bug.cgi?id=191548 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| Disable test on system with limited memory. Program was killed by |
| the OS before the exception was thrown. |
| |
| * slowMicrobenchmarks/function-constructor-with-huge-strings.js: |
| |
| 2018-11-20 Saam barati <sbarati@apple.com> |
| |
| Merging an IC variant may lead to the IC status containing overlapping structure sets |
| https://bugs.webkit.org/show_bug.cgi?id=191869 |
| <rdar://problem/45403453> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/merging-ic-variants-should-bail-if-structures-overlap.js: Added. |
| |
| 2018-11-19 Mark Lam <mark.lam@apple.com> |
| |
| globalFuncImportModule() should return a promise when it clears exceptions. |
| https://bugs.webkit.org/show_bug.cgi?id=191792 |
| <rdar://problem/46090763> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: Added. |
| |
| 2018-11-19 Guillaume Emont <guijemont@igalia.com> |
| |
| Skip new memory-hungry tests on memory limited devices |
| |
| Unreviewed gardening. |
| |
| * stress/big-wasm-memory-grow-no-max.js: |
| * stress/big-wasm-memory-grow.js: |
| * stress/big-wasm-memory.js: |
| |
| 2018-11-18 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| Unreviewed, rolling in the rest of r237254 |
| https://bugs.webkit.org/show_bug.cgi?id=190340 |
| |
| * ChakraCore/test/Function/FuncBodyES5.baseline-jsc: |
| * stress/function-cache-with-parameters-end-position.js: Added. |
| (shouldBe): |
| (shouldThrow): |
| (i.anonymous): |
| * stress/function-constructor-name.js: Added. |
| (shouldBe): |
| (GeneratorFunction): |
| (AsyncFunction.async): |
| (AsyncGeneratorFunction.async): |
| (anonymous): |
| (async.anonymous): |
| * test262/expectations.yaml: |
| |
| 2018-11-16 Filip Pizlo <fpizlo@apple.com> |
| |
| All users of ArrayBuffer should agree on the same max size |
| https://bugs.webkit.org/show_bug.cgi?id=191771 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/big-wasm-memory-grow-no-max.js: Added. |
| (foo): |
| (catch): |
| * stress/big-wasm-memory-grow.js: Added. |
| (foo): |
| (catch): |
| * stress/big-wasm-memory.js: Added. |
| (foo): |
| (catch): |
| |
| 2018-11-16 Filip Pizlo <fpizlo@apple.com> |
| |
| Unreviewed, make some more tests not crash my computer by only running on instance of it. These tests do not need to |
| run for each JSC config since they're regression tests for runtime bugs. |
| |
| * stress/json-stringified-overflow-2.js: |
| * stress/json-stringified-overflow.js: |
| |
| 2018-11-16 Filip Pizlo <fpizlo@apple.com> |
| |
| Unreviewed, make some tests not crash my computer by only running on instance of it. These tests do not need to run for each JSC |
| config since they're regression tests for runtime bugs. |
| |
| * stress/large-unshift-splice.js: |
| * stress/regress-185888.js: |
| |
| 2018-11-16 Saam Barati <sbarati@apple.com> |
| |
| KnownCellUse should also have SpecCellCheck as its type filter |
| https://bugs.webkit.org/show_bug.cgi?id=191729 |
| <rdar://problem/45872852> |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/known-cell-type-check-should-allow-empty-value-to-flow-through.js: Added. |
| (C): |
| |
| 2018-11-16 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Fix assertion failure on BytecodeGenerator::recordOpcode |
| https://bugs.webkit.org/show_bug.cgi?id=191724 |
| <rdar://problem/45724395> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-187373-2.js: Added. |
| (foo): |
| |
| 2018-11-15 Mark Lam <mark.lam@apple.com> |
| |
| RegExpObject's collectMatches should not be using JSArray::push to fill in its match results. |
| https://bugs.webkit.org/show_bug.cgi?id=191730 |
| <rdar://problem/46048517> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-187006.js: Removed. |
| - this test is invalid because its sole purpose is to test for the non-spec |
| compliant behavior that we just fixed. |
| |
| * stress/regress-191730.js: Added. |
| |
| 2018-11-15 Mark Lam <mark.lam@apple.com> |
| |
| RegExp operations should not take fast patch if lastIndex is not numeric. |
| https://bugs.webkit.org/show_bug.cgi?id=191731 |
| <rdar://problem/46017305> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-191731.js: Added. |
| |
| 2018-11-13 Saam Barati <sbarati@apple.com> |
| |
| TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM |
| https://bugs.webkit.org/show_bug.cgi?id=191600 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/type-profiler-log-should-defer-pending-exceptions.js: Added. |
| (foo): |
| (test): |
| (bar): |
| |
| 2018-11-13 Ryan Haddad <ryanhaddad@apple.com> |
| |
| Unreviewed, rolling out r238132. |
| |
| The test added with this change is timing out on Debug JSC |
| bots. |
| |
| Reverted changeset: |
| |
| "[BigInt] JSBigInt::createWithLength should throw when length |
| is greater than JSBigInt::maxLength" |
| https://bugs.webkit.org/show_bug.cgi?id=190836 |
| https://trac.webkit.org/changeset/238132 |
| |
| 2018-11-13 Mark Lam <mark.lam@apple.com> |
| |
| Add OOM detection to StringPrototype's substituteBackreferences(). |
| https://bugs.webkit.org/show_bug.cgi?id=191563 |
| <rdar://problem/45720428> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-191563.js: Added. |
| |
| 2018-11-13 Mark Lam <mark.lam@apple.com> |
| |
| LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame. |
| https://bugs.webkit.org/show_bug.cgi?id=191579 |
| <rdar://problem/45942472> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-191579.js: Added. |
| |
| 2018-11-13 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength |
| https://bugs.webkit.org/show_bug.cgi?id=190836 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/big-int-out-of-memory-tests.js: Added. |
| |
| 2018-11-08 Ross Kirsling <ross.kirsling@sony.com> |
| |
| U+180E is no longer a whitespace character |
| https://bugs.webkit.org/show_bug.cgi?id=191415 |
| |
| Reviewed by Saam Barati. |
| |
| * ChakraCore/test/es5/regexSpace.baseline: |
| * ChakraCore/test/es6/unicode_whitespace.js: |
| Update tests to latest version. |
| (See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.) |
| |
| * test262.yaml: |
| * test262/config.yaml: |
| * test262/expectations.yaml: |
| Update expectations. |
| |
| 2018-11-07 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] Add support to BigInt into ValueAdd |
| https://bugs.webkit.org/show_bug.cgi?id=186177 |
| |
| Reviewed by Keith Miller. |
| |
| * stress/big-int-negate-jit.js: |
| * stress/value-add-big-int-and-string.js: Added. |
| * stress/value-add-big-int-prediction-propagation.js: Added. |
| * stress/value-add-big-int-untyped.js: Added. |
| |
| 2018-11-07 Tadeu Zagallo <tzagallo@apple.com> |
| |
| REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled |
| https://bugs.webkit.org/show_bug.cgi?id=191184 |
| |
| Reviewed by Saam Barati. |
| |
| Most tests were failing due to timeouts, since they are too slow to |
| run on CLoop. The exceptions are: |
| |
| proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop |
| dont-crash-on-stack-overflow-when-parsing-builtin.js and |
| dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had |
| to change the stack size since CLoop requires it to be page aligned. |
| |
| * microbenchmarks/array-push-1.js: |
| * microbenchmarks/array-push-2.js: |
| * microbenchmarks/elidable-new-object-dag.js: |
| * microbenchmarks/elidable-new-object-roflcopter.js: |
| * microbenchmarks/elidable-new-object-tree.js: |
| * microbenchmarks/getter-richards.js: |
| * microbenchmarks/sinkable-new-object-dag.js: |
| * microbenchmarks/string-concat-long-convert.js: |
| * microbenchmarks/typed-array-get-set-by-val-profiling.js: |
| * slowMicrobenchmarks/array-push-3.js: |
| * slowMicrobenchmarks/large-map-iteration-with-additions.js: |
| * slowMicrobenchmarks/spread-small-array.js: |
| * slowMicrobenchmarks/undefined-property-access.js: |
| * stress/activation-sink-default-value-tdz-error.js: |
| * stress/activation-sink-default-value.js: |
| * stress/activation-sink-osrexit-default-value-tdz-error.js: |
| * stress/activation-sink-osrexit-default-value.js: |
| * stress/activation-sink-osrexit.js: |
| * stress/activation-sink.js: |
| * stress/allow-math-ic-b3-code-duplication.js: |
| * stress/array-push-multiple-int32.js: |
| * stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js: |
| * stress/arrowfunction-lexical-this-activation-sink-osrexit.js: |
| * stress/arrowfunction-lexical-this-activation-sink.js: |
| * stress/dont-crash-on-stack-overflow-when-parsing-builtin.js: |
| * stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js: |
| * stress/elide-new-object-dag-then-exit.js: |
| * stress/materialize-regexp-cyclic.js: |
| * stress/new-regex-inline.js: |
| * stress/op_add.js: |
| * stress/op_bitand.js: |
| * stress/op_bitor.js: |
| * stress/op_bitxor.js: |
| * stress/op_div-ConstVar.js: |
| * stress/op_div-VarConst.js: |
| * stress/op_div-VarVar.js: |
| * stress/op_lshift-ConstVar.js: |
| * stress/op_lshift-VarConst.js: |
| * stress/op_lshift-VarVar.js: |
| * stress/op_mod-ConstVar.js: |
| * stress/op_mod-VarConst.js: |
| * stress/op_mod-VarVar.js: |
| * stress/op_mul-ConstVar.js: |
| * stress/op_mul-VarConst.js: |
| * stress/op_mul-VarVar.js: |
| * stress/op_rshift-ConstVar.js: |
| * stress/op_rshift-VarConst.js: |
| * stress/op_rshift-VarVar.js: |
| * stress/op_sub-ConstVar.js: |
| * stress/op_sub-VarConst.js: |
| * stress/op_sub-VarVar.js: |
| * stress/op_urshift-ConstVar.js: |
| * stress/op_urshift-VarConst.js: |
| * stress/op_urshift-VarVar.js: |
| * stress/proxy-get-set-correct-receiver.js: |
| * stress/regress-179562.js: |
| * stress/rest-parameter-many-arguments.js: |
| * stress/sampling-profiler-richards.js: |
| * stress/splay-flash-access-1ms.js: |
| * stress/tailCallForwardArguments.js: |
| * stress/typed-array-get-by-val-profiling.js: |
| * typeProfiler/getter-richards.js: |
| |
| 2018-11-06 Michael Saboff <msaboff@apple.com> |
| |
| Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers. |
| https://bugs.webkit.org/show_bug.cgi?id=191271 |
| |
| Reviewed by Saam Barati. |
| |
| Added more test cases and made all test cases run with the same deeply recursive stack |
| instead of finding that same point for each test case. |
| |
| * stress/regexp-compile-oom.js: |
| (prototype.runTest): |
| (recurseAndTest): |
| (testList.push.new.TestAndExpectedException): |
| |
| 2018-11-05 Michael Saboff <msaboff@apple.com> |
| |
| Unreviewed build fix for linux. |
| |
| * stress/regexp-compile-oom.js: Disabled for non-darwin OSes. |
| |
| 2018-11-02 Michael Saboff <msaboff@apple.com> |
| |
| Rolling in r237753 with unreviewed build fix. |
| |
| Fixed issues with DECLARE_THROW_SCOPE placement. |
| |
| 2018-11-02 Ryan Haddad <ryanhaddad@apple.com> |
| |
| Unreviewed, rolling out r237753. |
| |
| Introduced JSC test failures |
| |
| Reverted changeset: |
| |
| "Running out of stack space not properly handled in |
| RegExp::compile() and its callers" |
| https://bugs.webkit.org/show_bug.cgi?id=191206 |
| https://trac.webkit.org/changeset/237753 |
| |
| 2018-11-02 Michael Saboff <msaboff@apple.com> |
| |
| Running out of stack space not properly handled in RegExp::compile() and its callers |
| https://bugs.webkit.org/show_bug.cgi?id=191206 |
| |
| Reviewed by Filip Pizlo. |
| |
| New regression test. |
| |
| * stress/regexp-compile-oom.js: Added. |
| (recurseAndTest): |
| |
| 2018-11-01 Guillaume Emont <guijemont@igalia.com> |
| |
| Skip tests on arm/mips that time out now we're running on CLoop |
| |
| Unreviewed gardening. |
| |
| Since the JIT is temporarily disabled on 32-bit platforms, these tests |
| time out on the bots and need to be disabled. There's more tests |
| disabled on arm because the timeout is longer on the mips bot (as the |
| device is slower to start with), so many of the tests don't time out |
| there. |
| |
| * microbenchmarks/getter-richards.js: disable on arm and mips. |
| * stress/op_add.js: disable on arm. |
| * stress/op_bitand.js: disable on arm. |
| * stress/op_bitor.js: disable on arm. |
| * stress/op_bitxor.js: disable on arm. |
| * stress/op_lshift-ConstVar.js: disable on arm. |
| * stress/op_lshift-VarConst.js: disable on arm. |
| * stress/op_lshift-VarVar.js: disable on arm. |
| * stress/op_mod-ConstVar.js: disable on arm. |
| * stress/op_mod-VarConst.js: disable on arm. |
| * stress/op_mod-VarVar.js: disable on arm. |
| * stress/op_mul-ConstVar.js: disable on arm. |
| * stress/op_mul-VarConst.js: disable on arm. |
| * stress/op_mul-VarVar.js: disable on arm. |
| * stress/op_rshift-ConstVar.js: disable on arm. |
| * stress/op_rshift-VarConst.js: disable on arm. |
| * stress/op_rshift-VarVar.js: disable on arm. |
| * stress/op_sub-ConstVar.js: disable on arm. |
| * stress/op_sub-VarConst.js: disable on arm. |
| * stress/op_sub-VarVar.js: disable on arm. |
| * stress/op_urshift-ConstVar.js: disable on arm. |
| * stress/op_urshift-VarConst.js: disable on arm. |
| * stress/op_urshift-VarVar.js: disable on arm. |
| * stress/spread-forward-call-varargs-stack-overflow.js: disable on arm. |
| * stress/value-to-boolean.js: disable on arm and mips. |
| |
| 2018-10-31 Tadeu Zagallo <tzagallo@apple.com> |
| |
| REGRESSION(r237547): Exception handlers should be aware of wide opcodes |
| https://bugs.webkit.org/show_bug.cgi?id=191108 |
| <rdar://problem/45690700> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/wide-op_catch.js: Added. |
| (catch): |
| |
| 2018-10-29 Mark Lam <mark.lam@apple.com> |
| |
| Correctly detect string overflow when using the 'Function' constructor. |
| https://bugs.webkit.org/show_bug.cgi?id=184883 |
| <rdar://problem/36320331> |
| |
| Reviewed by Saam Barati. |
| |
| I've verified that this passes on 32-bit as well. |
| |
| * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added. |
| |
| 2018-10-29 Tadeu Zagallo <tzagallo@apple.com> |
| |
| Add support for GetStack FlushedDouble |
| https://bugs.webkit.org/show_bug.cgi?id=191012 |
| <rdar://problem/45265141> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/get-stack-double.js: Added. |
| (bar): |
| (noInline): |
| |
| 2018-10-29 Tadeu Zagallo <tzagallo@apple.com> |
| |
| New bytecode format for JSC |
| https://bugs.webkit.org/show_bug.cgi?id=187373 |
| <rdar://problem/44186758> |
| |
| Reviewed by Filip Pizlo. |
| |
| Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255. |
| |
| * stress/maximum-inline-capacity.js: Added. |
| (test1): |
| (test3.Foo): |
| (test3): |
| |
| 2018-10-26 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r237479 and r237484. |
| https://bugs.webkit.org/show_bug.cgi?id=190978 |
| |
| broke JSC on iOS (Requested by tadeuzagallo on #webkit). |
| |
| Reverted changesets: |
| |
| "New bytecode format for JSC" |
| https://bugs.webkit.org/show_bug.cgi?id=187373 |
| https://trac.webkit.org/changeset/237479 |
| |
| "Gardening: Build fix after r237479." |
| https://bugs.webkit.org/show_bug.cgi?id=187373 |
| https://trac.webkit.org/changeset/237484 |
| |
| 2018-10-26 Tadeu Zagallo <tzagallo@apple.com> |
| |
| New bytecode format for JSC |
| https://bugs.webkit.org/show_bug.cgi?id=187373 |
| <rdar://problem/44186758> |
| |
| Reviewed by Filip Pizlo. |
| |
| Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255. |
| |
| * stress/maximum-inline-capacity.js: Added. |
| (test1): |
| (test3.Foo): |
| (test3): |
| |
| 2018-10-26 Mark Lam <mark.lam@apple.com> |
| |
| Fix missing edge cases with JSGlobalObjects having a bad time. |
| https://bugs.webkit.org/show_bug.cgi?id=189028 |
| <rdar://problem/45204939> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-189028.js: Added. |
| |
| 2018-10-22 Mark Lam <mark.lam@apple.com> |
| |
| DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType. |
| https://bugs.webkit.org/show_bug.cgi?id=190515 |
| <rdar://problem/45222379> |
| |
| Rubber-stamped by Saam Barati. |
| |
| Adding another test. |
| |
| * stress/regress-190515-2.js: Added. |
| |
| 2018-10-22 Mark Lam <mark.lam@apple.com> |
| |
| DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType. |
| https://bugs.webkit.org/show_bug.cgi?id=190515 |
| <rdar://problem/45222379> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-190515.js: Added. |
| |
| 2018-10-19 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r237254. |
| https://bugs.webkit.org/show_bug.cgi?id=190760 |
| |
| "It regresses JetStream 2 by 5% on some iOS devices" |
| (Requested by saamyjoon on #webkit). |
| |
| Reverted changeset: |
| |
| "[JSC] JSC should have "parseFunction" to optimize Function |
| constructor" |
| https://bugs.webkit.org/show_bug.cgi?id=190340 |
| https://trac.webkit.org/changeset/237254 |
| |
| 2018-10-19 Saam Barati <sbarati@apple.com> |
| |
| vmCall should check if we exit before emitting an OSR exit due to exceptions |
| https://bugs.webkit.org/show_bug.cgi?id=190740 |
| <rdar://problem/45220139> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/dont-emit-osr-exits-for-every-call-ftl.js: Added. |
| (foo): |
| |
| 2018-10-19 Caio Lima <ticaiolima@gmail.com> |
| |
| [ESNext][BigInt] Implement support for "^" |
| https://bugs.webkit.org/show_bug.cgi?id=186235 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-bitwise-xor-general.js: Added. |
| * stress/big-int-bitwise-xor-to-primitive-precedence.js: Added. |
| * stress/big-int-bitwise-xor-type-error.js: Added. |
| * stress/big-int-bitwise-xor-wrapped-value.js: Added. |
| |
| 2018-10-19 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] Add ValueSub into DFG |
| https://bugs.webkit.org/show_bug.cgi?id=186176 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-subtraction-jit.js: |
| * stress/value-sub-big-int-prediction-propagation.js: Added. |
| * stress/value-sub-big-int-untyped.js: Added. |
| * stress/value-sub-spec-none-case.js: Added. |
| |
| 2018-10-18 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] JSC should have "parseFunction" to optimize Function constructor |
| https://bugs.webkit.org/show_bug.cgi?id=190340 |
| |
| Reviewed by Mark Lam. |
| |
| This patch fixes the line number of syntax errors raised by the Function constructor, |
| since we now parse the final code only once. And we no longer use block statement |
| for Function constructor's parsing. |
| |
| * ChakraCore/test/Function/FuncBodyES5.baseline-jsc: |
| * stress/function-cache-with-parameters-end-position.js: Added. |
| (shouldBe): |
| (shouldThrow): |
| (i.anonymous): |
| * stress/function-constructor-name.js: Added. |
| (shouldBe): |
| (GeneratorFunction): |
| (AsyncFunction.async): |
| (AsyncGeneratorFunction.async): |
| (anonymous): |
| (async.anonymous): |
| * test262/expectations.yaml: |
| |
| 2018-10-18 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r237242. |
| https://bugs.webkit.org/show_bug.cgi?id=190701 |
| |
| it breaks "stress/sampling-profiler-basic.js" (Requested by |
| caiolima on #webkit). |
| |
| Reverted changeset: |
| |
| "[BigInt] Add ValueSub into DFG" |
| https://bugs.webkit.org/show_bug.cgi?id=186176 |
| https://trac.webkit.org/changeset/237242 |
| |
| 2018-10-17 Keith Miller <keith_miller@apple.com> |
| |
| AI does not clear Phantom allocation nodes. |
| https://bugs.webkit.org/show_bug.cgi?id=190694 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added. |
| (Day): |
| (DaysInYear): |
| (TimeInYear): |
| (TimeFromYear): |
| (DayFromYear): |
| (InLeapYear): |
| (YearFromTime): |
| (WeekDay): |
| (DaylightSavingTA): |
| (GetSecondSundayInMarch): |
| (TimeInMonth): |
| |
| 2018-10-17 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] Add ValueSub into DFG |
| https://bugs.webkit.org/show_bug.cgi?id=186176 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-subtraction-jit.js: |
| * stress/value-sub-big-int-prediction-propagation.js: Added. |
| * stress/value-sub-big-int-untyped.js: Added. |
| |
| 2018-10-16 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| [JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips |
| https://bugs.webkit.org/show_bug.cgi?id=190611 |
| |
| Reviewed by Saam Barati. |
| |
| Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js |
| to improve test runtime. On ARM/MIPS this test even timed out when running all |
| tests. |
| |
| * stress/array-prototype-concat-of-long-spliced-arrays2.js: |
| (test): |
| |
| 2018-10-15 Guillaume Emont <guijemont@igalia.com> |
| |
| Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux |
| |
| Unreviewed gardening. |
| |
| * stress/array-prototype-concat-of-long-spliced-arrays2.js: |
| |
| 2018-10-15 Saam barati <sbarati@apple.com> |
| |
| Emit fjcvtzs on ARM64E on Darwin |
| https://bugs.webkit.org/show_bug.cgi?id=184023 |
| |
| Reviewed by Yusuke Suzuki and Filip Pizlo. |
| |
| * stress/double-to-int32-NaN.js: Added. |
| (assert): |
| (foo): |
| |
| 2018-10-15 Saam Barati <sbarati@apple.com> |
| |
| JSArray::shiftCountWithArrayStorage is wrong when an array has holes |
| https://bugs.webkit.org/show_bug.cgi?id=190262 |
| <rdar://problem/44986241> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/array-prototype-concat-of-long-spliced-arrays.js: |
| (test): |
| * stress/slice-array-storage-with-holes.js: Added. |
| (main): |
| |
| 2018-10-15 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r237054. |
| https://bugs.webkit.org/show_bug.cgi?id=190593 |
| |
| "this regressed JetStream 2 by 6% on iOS" (Requested by |
| saamyjoon on #webkit). |
| |
| Reverted changeset: |
| |
| "[JSC] JSC should have "parseFunction" to optimize Function |
| constructor" |
| https://bugs.webkit.org/show_bug.cgi?id=190340 |
| https://trac.webkit.org/changeset/237054 |
| |
| 2018-10-13 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] JSON.stringify can accept call-with-no-arguments |
| https://bugs.webkit.org/show_bug.cgi?id=190343 |
| |
| Reviewed by Mark Lam. |
| |
| * stress/json-stringify-no-arguments.js: Added. |
| (shouldBe): |
| |
| 2018-10-08 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] JSC should have "parseFunction" to optimize Function constructor |
| https://bugs.webkit.org/show_bug.cgi?id=190340 |
| |
| Reviewed by Mark Lam. |
| |
| This patch fixes the line number of syntax errors raised by the Function constructor, |
| since we now parse the final code only once. And we no longer use block statement |
| for Function constructor's parsing. |
| |
| * ChakraCore/test/Function/FuncBodyES5.baseline-jsc: |
| * stress/function-cache-with-parameters-end-position.js: Added. |
| (shouldBe): |
| (shouldThrow): |
| (i.anonymous): |
| * stress/function-constructor-name.js: Added. |
| (shouldBe): |
| (GeneratorFunction): |
| (AsyncFunction.async): |
| (AsyncGeneratorFunction.async): |
| (anonymous): |
| (async.anonymous): |
| * test262/expectations.yaml: |
| |
| 2018-10-10 Guillaume Emont <guijemont@igalia.com> |
| |
| Skip JSC test stress/sampling-profiler-richards.js on armv7/linux |
| https://bugs.webkit.org/show_bug.cgi?id=190426 |
| |
| Unreviewed gardening. |
| |
| * stress/sampling-profiler-richards.js: |
| |
| 2018-10-06 Caio Lima <ticaiolima@gmail.com> |
| |
| [ESNext][BigInt] Implement support for "|" |
| https://bugs.webkit.org/show_bug.cgi?id=186229 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-bitwise-and-jit.js: |
| * stress/big-int-bitwise-or-general.js: Added. |
| * stress/big-int-bitwise-or-jit-untyped.js: Added. |
| * stress/big-int-bitwise-or-jit.js: Added. |
| * stress/big-int-bitwise-or-memory-stress.js: Added. |
| * stress/big-int-bitwise-or-to-primitive-precedence.js: Added. |
| * stress/big-int-bitwise-or-type-error.js: Added. |
| * stress/big-int-bitwise-or-wrapped-value.js: Added. |
| |
| 2018-10-05 Dominik Infuehr <dominik.infuehr@gmail.com> |
| |
| Skip test on systems with limited memory |
| https://bugs.webkit.org/show_bug.cgi?id=190310 |
| |
| Invoking runDefault adds test to runlist, skipping the test in the next |
| line does not prevent the test from executing. Change order of lines such |
| that runDefault is only executed if test is not executed. |
| |
| Reviewed by Mark Lam. |
| |
| * stress/regress-190187.js: |
| |
| 2018-10-03 Saam barati <sbarati@apple.com> |
| |
| lowXYZ in FTLLower should always filter the type of the incoming edge |
| https://bugs.webkit.org/show_bug.cgi?id=189939 |
| <rdar://problem/44407030> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/ftl-should-always-filter-for-low-type-check-functions.js: Added. |
| (foo): |
| (test): |
| |
| 2018-10-03 Mark Lam <mark.lam@apple.com> |
| |
| Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX. |
| https://bugs.webkit.org/show_bug.cgi?id=190187 |
| <rdar://problem/42512909> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/regress-190187.js: Added. |
| |
| 2018-10-02 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] BigInt.proptotype.toString is broken when radix is power of 2 |
| https://bugs.webkit.org/show_bug.cgi?id=190033 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-to-string.js: |
| |
| 2018-10-01 Mark Lam <mark.lam@apple.com> |
| |
| Function.toString() should also copy the source code Functions that are class definitions. |
| https://bugs.webkit.org/show_bug.cgi?id=190186 |
| <rdar://problem/44733360> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-190186.js: Added. |
| |
| 2018-10-01 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| Split NaN-check into separate test |
| https://bugs.webkit.org/show_bug.cgi?id=190010 |
| |
| Reviewed by Saam Barati. |
| |
| DataView exposes NaN-representation, which is not necessarily the same on each |
| architecture. Therefore move the check of the NaN-representation into its own |
| file such that we can disable this test on MIPS where NaN-representation can be |
| different on older CPUs. |
| |
| * stress/dataview-jit-set-nan.js: Added. |
| (assert): |
| (test.storeLittleEndian): |
| (test.storeBigEndian): |
| (test.store): |
| (test): |
| * stress/dataview-jit-set.js: |
| (test5): |
| |
| 2018-10-01 Commit Queue <commit-queue@webkit.org> |
| |
| Unreviewed, rolling out r236647. |
| https://bugs.webkit.org/show_bug.cgi?id=190124 |
| |
| Breaking test stress/big-int-to-string.js (Requested by |
| caiolima_ on #webkit). |
| |
| Reverted changeset: |
| |
| "[BigInt] BigInt.proptotype.toString is broken when radix is |
| power of 2" |
| https://bugs.webkit.org/show_bug.cgi?id=190033 |
| https://trac.webkit.org/changeset/236647 |
| |
| 2018-09-30 Caio Lima <ticaiolima@gmail.com> |
| |
| [BigInt] BigInt.proptotype.toString is broken when radix is power of 2 |
| https://bugs.webkit.org/show_bug.cgi?id=190033 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-to-string.js: |
| |
| 2018-09-28 Caio Lima <ticaiolima@gmail.com> |
| |
| [ESNext][BigInt] Implement support for "&" |
| https://bugs.webkit.org/show_bug.cgi?id=186228 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| * stress/big-int-bitwise-and-general.js: Added. |
| (assert): |
| (assert.sameValue): |
| * stress/big-int-bitwise-and-jit.js: Added. |
| (let.assert.sameValue): |
| (bigIntBitAnd): |
| * stress/big-int-bitwise-and-memory-stress.js: Added. |
| (assert): |
| * stress/big-int-bitwise-and-to-primitive-precedence.js: Added. |
| (assert.sameValue): |
| (let.o.Symbol.toPrimitive): |
| (catch): |
| * stress/big-int-bitwise-and-type-error.js: Added. |
| (assert): |
| (assertThrowTypeError): |
| (let.o.valueOf): |
| (o.valueOf): |
| (o.toString): |
| (o.Symbol.toPrimitive): |
| * stress/big-int-bitwise-and-wrapped-value.js: Added. |
| (assert.sameValue): |
| (testBitAnd): |
| (let.o.Symbol.toPrimitive): |
| (o.valueOf): |
| (o.toString): |
| |
| 2018-09-28 Ross Kirsling <ross.kirsling@sony.com> |
| |
| JSC test stress/jsc-read.js doesn't support CRLF |
| https://bugs.webkit.org/show_bug.cgi?id=190063 |
| |
| Reviewed by Yusuke Suzuki. |
| |
| In order to run this test via Windows command prompt, we can't assume that the final newline will be LF. |
| |
| * stress/jsc-read.js: |
| (test): |
| |
| 2018-09-27 Saam barati <sbarati@apple.com> |
| |
| Verify the contents of AssemblerBuffer on arm64e |
| https://bugs.webkit.org/show_bug.cgi?id=190057 |
| <rdar://problem/38916630> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/regress-189132.js: |
| |
| 2018-09-27 Dominik Infuehr <dinfuehr@igalia.com> |
| |
| Disable test without LLInt on ARMv7 |
| https://bugs.webkit.org/show_bug.cgi?id=190037 |
| |
| Reviewed by Mark Lam. |
| |
| Test runs out of executable memory on ARMv7, do not run |
| this test without LLInt enabled. |
| |
| * stress/regress-169445.js: |
| |
| 2018-09-26 Keith Miller <keith_miller@apple.com> |
| |
| We should zero unused property storage when rebalancing array storage. |
| https://bugs.webkit.org/show_bug.cgi?id=188151 |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/splice-should-zero-property-storage-when-rebalancing.js: Added. |
| |
| 2018-09-20 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] Optimize Array#lastIndexOf |
| https://bugs.webkit.org/show_bug.cgi?id=189780 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/array-lastindexof-array-prototype-trap.js: Added. |
| (shouldBe): |
| (AncestorArray.prototype.get 2): |
| (AncestorArray): |
| * stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added. |
| (shouldBe): |
| * stress/array-lastindexof-hole-nan.js: Added. |
| (shouldBe): |
| (throw.new.Error): |
| * stress/array-lastindexof-infinity.js: Added. |
| (shouldBe): |
| (throw.new.Error): |
| * stress/array-lastindexof-negative-zero.js: Added. |
| (shouldBe): |
| (throw.new.Error): |
| * stress/array-lastindexof-own-getter.js: Added. |
| (shouldBe): |
| (throw.new.Error.get array): |
| (get array): |
| * stress/array-lastindexof-prototype-trap.js: Added. |
| (shouldBe): |
| (DerivedArray.prototype.get 2): |
| (DerivedArray): |
| |
| 2018-09-25 Saam Barati <sbarati@apple.com> |
| |
| Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock |
| https://bugs.webkit.org/show_bug.cgi?id=189940 |
| <rdar://problem/43640987> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/use-baseline-codeblock-materialize-osr-exit.js: Added. |
| |
| 2018-09-24 Saam Barati <sbarati@apple.com> |
| |
| Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects |
| https://bugs.webkit.org/show_bug.cgi?id=189922 |
| <rdar://problem/44651275> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/array-indexof-fast-path-effects.js: Added. |
| * stress/array-indexof-cached-length.js: Added. |
| |
| 2018-09-24 Saam barati <sbarati@apple.com> |
| |
| ArgumentsEliminationPhase should snip basic blocks after proven OSR exits |
| https://bugs.webkit.org/show_bug.cgi?id=189682 |
| <rdar://problem/43557315> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/arguments-elimination-will-generate-edge-without-result.js: Added. |
| (foo): |
| |
| 2018-09-22 Saam barati <sbarati@apple.com> |
| |
| The sampling should not use Strong<CodeBlock> in its machineLocation field |
| https://bugs.webkit.org/show_bug.cgi?id=189319 |
| |
| Reviewed by Filip Pizlo. |
| |
| * stress/sampling-profiler-richards.js: Added. |
| |
| 2018-09-19 Yusuke Suzuki <yusukesuzuki@slowstart.org> |
| |
| [JSC] Optimize Array#indexOf in C++ runtime |
| https://bugs.webkit.org/show_bug.cgi?id=189507 |
| |
| Reviewed by Saam Barati. |
| |
| * stress/array-indexof-array-prototype-trap.js: Added. |
| (shouldBe): |
| (AncestorArray.prototype.get 2): |
| (AncestorArray): |
| * stress/array-indexof-have-a-bad-time-c-runtime.js: Added. |
| (shouldBe): |
| * stress/array-indexof-hole-nan.js: Added. |
| (shouldBe): |
| (throw.new.Error): |
| * stress/array-indexof-infinity.js: Added. |
| (shouldBe): |
| (throw.new.Error): |
| * stress/array-indexof-negative-zero.js: Added. |
| (shouldBe): |
| (throw.new.Error): |
| * stress/array-indexof-own-getter.js: Added. |
| (shouldBe): |
| (throw.new.Error.get array): |
| (get array): |
| * stress/array-indexof-prototype-trap.js: Added. |
| (shouldBe): |
| (DerivedArray.prototype.get 2): |
| (DerivedArray): |
| |
| 2018-09-19 Saam barati <sbarati@apple.com> |
| |
| AI rule for MultiPutByOffset executes its effects in the wrong order |
| https://bugs.webkit.org/show_bug.cgi?id=189757 |
| <rdar://problem/43535257> |
| |
| Reviewed by Michael Saboff. |
| |
| * stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added. |
| (foo): |
| (Foo): |
| (g): |
| |
| 2018-09-17 Mark Lam <mark.lam@apple.com> |
| |
| Ensure that ForInContexts are invalidated if their loop local is over-written. |
| https://bugs.webkit.org/show_bug.cgi?id=189571 |
| <rdar://problem/44402277> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-189571.js: Added. |
| |
| 2018-09-17 Saam barati <sbarati@apple.com> |
| |
| We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure |
| https://bugs.webkit.org/show_bug.cgi?id=189676 |
| <rdar://problem/39682897> |
| |
| Reviewed by Michael Saboff. |
| |
| * typeProfiler/check-structure-or-empty-in-fixup.js: Added. |
| (A): |
| (K): |
| (i.catch): |
| |
| 2018-09-14 Saam barati <sbarati@apple.com> |
| |
| Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed |
| https://bugs.webkit.org/show_bug.cgi?id=189628 |
| <rdar://problem/39481690> |
| |
| Reviewed by Mark Lam. |
| |
| * stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added. |
| (foo): |
| |
| 2018-09-11 Mark Lam <mark.lam@apple.com> |
| |
| Test for array initialization in arrayProtoFuncSplice. |
| https://bugs.webkit.org/show_bug.cgi?id=170253 |
| <rdar://problem/31328773> |
| |
| Rubber-stamped by Saam Barati. |
| |
| * stress/regress-170253.js: Added. |
| |
| 2018-09-11 Mark Lam <mark.lam@apple.com> |
| |
| Test for IntlObject initialization. |
| https://bugs.webkit.org/show_bug.cgi?id=170251 |
| <rdar://problem/31328419> |
| |
| Rubber-stamped by Saam Barati. |
| |
| * stress/regress-170251.js: Added. |
| |
| 2018-09-11 Mark Lam <mark.lam@apple.com> |
| |
| Test for array memcpy'ing when JSGlobalObject::haveABadTime. |
| https://bugs.webkit.org/show_bug.cgi?id=169889 |
| <rdar://problem/31155607> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-169889-array-concat.js: Added. |
| * stress/regress-169889-array-concat1.js: Added. |
| * stress/regress-169889-array-slice.js: Added. |
| |
| 2018-09-11 Mark Lam <mark.lam@apple.com> |
| |
| Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope. |
| https://bugs.webkit.org/show_bug.cgi?id=169445 |
| <rdar://problem/30957435> |
| |
| Reviewed by Saam Barati. |
| |
| * stress/regress-169445.js: Added. |
| (let.gun.eval.A): |
| (let.gun.eval.B.C): |
| (let.gun.eval.B.C.prototype.trigger): |
| (let.gun.eval.B.C.prototype.triggerWithRestParameters): |
| (let.gun.eval.B): |
| (let.gun.eval): |
| |
| == Rolled over to ChangeLog-2018-09-11 == |
