2019-10-21  Mark Lam  <mark.lam@apple.com>

        Fix missing exception check in JSON Stringifier.
        https://bugs.webkit.org/show_bug.cgi?id=203227
        <rdar://problem/56459854>

        Reviewed by Keith Miller.

        * stress/missing-exception-check-in-josn-stringifier.js: Added.

2019-10-21  Saam Barati  <sbarati@apple.com>

        JSON.parse has bad is array assert
        https://bugs.webkit.org/show_bug.cgi?id=203207
        <rdar://problem/56366913>

        Reviewed by Yusuke Suzuki.

        * stress/json-parse-array-prototype-is-array-assert.js: Added.
        (assert):

2019-10-21  Robin Morisset  <rmorisset@apple.com>

        Throw the right exception upon memory exhaustion in Array::slice
        https://bugs.webkit.org/show_bug.cgi?id=202650

        Reviewed by Saam Barati.

        * stress/array-slice-memory-exhaustion.js: Added.
        (foo):

2019-10-21  Robin Morisset  <rmorisset@apple.com>

        Post increment/decrement should only call ToNumber once
        https://bugs.webkit.org/show_bug.cgi?id=202711

        Reviewed by Saam Barati.

        * stress/postinc-custom-valueOf.js: Added.
        (postInc):
        (postDec):

2019-10-18  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] DFG::CommonData modification by DFG reallyAdd should be guarded by CodeBlock's lock
        https://bugs.webkit.org/show_bug.cgi?id=203177

        Reviewed by Mark Lam.

        * stress/dfg-really-add-locking.js: Added.

2019-10-17  Mark Lam  <mark.lam@apple.com>

        Add missing checks after calls to the sameValue() JSValue comparator.
        https://bugs.webkit.org/show_bug.cgi?id=203126
        <rdar://problem/56366561>

        Reviewed by Saam Barati.

        * stress/validate-exception-check-in-proxy-object-put.js: Added.

2019-10-17  Saam Barati  <sbarati@apple.com>

        GetByVal and PutByVal on ArrayStorage need to use the same AbstractHeap
        https://bugs.webkit.org/show_bug.cgi?id=203124
        <rdar://problem/55988183>

        Reviewed by Yusuke Suzuki.

        * stress/licm-array-storage-get-and-put-by-val.js: Added.
        (assert):
        (foo):

2019-10-16  Keith Miller  <keith_miller@apple.com>

        Move assert in Wasm::Plan::fail.
        https://bugs.webkit.org/show_bug.cgi?id=203052

        Reviewed by Mark Lam.

        * wasm/regress/wasm-plan-fail-bad-error-message-assert.js: Added.
        (Binary):
        (Binary.prototype.trunc_buffer):
        (Binary.prototype.emit_leb_u):
        (Binary.prototype.emit_u32v):
        (Binary.prototype.emit_bytes):
        (Binary.prototype.emit_header):
        (__f_576):
        (__f_587):

2019-10-15  Mark Lam  <mark.lam@apple.com>

        operationSwitchCharWithUnknownKeyType failed to handle OOME when resolving rope string.
        https://bugs.webkit.org/show_bug.cgi?id=202312
        <rdar://problem/55782280>

        Reviewed by Yusuke Suzuki.

        * stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings.js: Added.
        * stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings2.js: Added.
        * stress/switch-on-char-llint-rope.js:
        - Changed this test to make a new rope string for each iterations.  Otherwise,
          the rope will get resolved, and subsequent tiers will not be testing with a rope.

2019-10-14  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] GetterSetter should be JSCell, not JSObject
        https://bugs.webkit.org/show_bug.cgi?id=202656

        Reviewed by Tadeu Zagallo and Saam Barati.

        * stress/getter-setter-should-be-cell.js: Added.
        (foo.with.):
        (foo.with.get for):
        (foo.with.bar):
        (foo):

2019-10-14  Saam Barati  <sbarati@apple.com>

        Canonicalize how we prepare the prototype chain for inline caching
        https://bugs.webkit.org/show_bug.cgi?id=202827
        <rdar://problem/56193919>

        Reviewed by Yusuke Suzuki.

        * stress/cache-correct-offset-after-flattening.js: Added.
        (assert):

2019-10-14  Paulo Matos  <pmatos@igalia.com>

        Skip memcpy-typed-loop timing out on ARMv7 pending investigation
        https://bugs.webkit.org/show_bug.cgi?id=202923

        Reviewed by Adrian Perez de Castro.

        * microbenchmarks/memcpy-typed-loop.js:

2019-10-11  Keith Miller  <keith_miller@apple.com>

        Wasm B3IRGenerator should use arguments for control data.
        https://bugs.webkit.org/show_bug.cgi?id=202855

        Reviewed by Yusuke Suzuki.

        * wasm/stress/loop-more-args-than-results.js: Added.

2019-10-10  Mark Lam  <mark.lam@apple.com>

        Modify JSTests/stress/string-overflow-createError-*.js tests to allow an OOME result.
        https://bugs.webkit.org/show_bug.cgi?id=202828

        Reviewed by Yusuke Suzuki.

        The tests intentionally allocate a very large string.  Hence, for some memory
        limited configurations, it is perfectly reasonable for the test to throw an Out
        Of Memory error.

        * stress/string-overflow-createError-builder.js:
        * stress/string-overflow-createError-fit.js:

2019-10-09  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, roll out r250878
        https://bugs.webkit.org/show_bug.cgi?id=202656

        Breaking vimeo page.

        * stress/getter-setter-should-be-cell.js: Removed.

2019-10-08  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] GetterSetter should be JSCell, not JSObject
        https://bugs.webkit.org/show_bug.cgi?id=202656

        Reviewed by Tadeu Zagallo and Saam Barati.

        * stress/getter-setter-should-be-cell.js: Added.
        (foo.with.):
        (foo.with.get for):
        (foo.with.bar):
        (foo):

2019-10-08  Alexey Shvayka  <shvaikalesh@gmail.com>

        JSON.parse incorrectly handles array proxies
        https://bugs.webkit.org/show_bug.cgi?id=199292

        Reviewed by Saam Barati.

        * microbenchmarks/json-parse-array-reviver-same-value.js: Added.
        * microbenchmarks/json-parse-array-reviver.js: Added.
        * microbenchmarks/json-parse-object-reviver-same-value.js: Added.
        * microbenchmarks/json-parse-object-reviver.js: Added.
        * stress/json-parse-reviver-array-proxy.js: Added.
        * stress/json-parse-reviver-revoked-proxy.js: Added.
        * test262/expectations.yaml: Mark 6 test cases as passing.

2019-10-08  Ross Kirsling  <ross.kirsling@sony.com>

        Update test262 (2019.10.08).

        Rubber-stamped by Keith Miller.

        * test262/config.yaml:
        * test262/expectations.yaml:
        * test262/latest-changes-summary.txt:
        * test262/test/:
        * test262/test262-Revision.txt:

2019-10-07  Saam Barati  <sbarati@apple.com>

        Allow OSR exit to the LLInt
        https://bugs.webkit.org/show_bug.cgi?id=197993

        Reviewed by Tadeu Zagallo.

        * stress/exit-from-getter-by-val.js: Added.
        * stress/exit-from-setter-by-val.js: Added.

2019-10-07  Matt Lewis  <jlewis3@apple.com>

        Unreviewed, rolling out r250750.

        Reverting change as this broke interal test over the weekend.

        Reverted changeset:

        "Allow OSR exit to the LLInt"
        https://bugs.webkit.org/show_bug.cgi?id=197993
        https://trac.webkit.org/changeset/250750

2019-10-04  Saam Barati  <sbarati@apple.com>

        Allow OSR exit to the LLInt
        https://bugs.webkit.org/show_bug.cgi?id=197993

        Reviewed by Tadeu Zagallo.

        * stress/exit-from-getter-by-val.js: Added.
        * stress/exit-from-setter-by-val.js: Added.

2019-10-04  Paulo Matos  <pmatos@igalia.com>

        Revert regexp test skip on armv7l and mips
        https://bugs.webkit.org/show_bug.cgi?id=202310

        Reviewed by Žan Doberšek.

        Test was skipped in bug 202113 on armv7l and mips due to bug 202041.
        Bug 202041 is fixed and change of bug 202113 can be reverted.

        * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js:

2019-10-02  Mark Lam  <mark.lam@apple.com>

        DoubleToStringConverter::ToExponential() should null terminate its string.
        https://bugs.webkit.org/show_bug.cgi?id=202492
        <rdar://problem/55907708>

        Reviewed by Filip Pizlo.

        * stress/dtoa-AddSubstring-should-uses-strnlen-in-assertion.js: Added.

2019-10-02  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] AsyncGenerator should have internal fields
        https://bugs.webkit.org/show_bug.cgi?id=201498

        Reviewed by Saam Barati.

        * stress/async-generator-construct-failure.js: Added.
        (shouldThrow):
        (async.gen):
        (TypeError):
        * stress/async-generator-prototype-change.js: Added.
        (shouldBe):
        (async.gen):
        * stress/async-generator-prototype-closure.js: Added.
        (shouldBe):
        (test.async.gen):
        (test):
        * stress/create-async-generator.js: Added.
        (shouldBe):
        (test.async.generator):
        (test):

2019-10-01  Saam Barati  <sbarati@apple.com>

        ObjectAllocationSinkingPhase shouldn't insert hints for allocations which are no longer valid
        https://bugs.webkit.org/show_bug.cgi?id=199361
        <rdar://problem/52454940>

        Reviewed by Yusuke Suzuki.

        * stress/allocation-sinking-hints-are-valid-ssa-2.js: Added.
        (main.fn):
        (main.executor):
        (main):
        * stress/allocation-sinking-hints-are-valid-ssa.js: Added.
        (main.fn):
        (main.executor):
        (main):

2019-10-01  Keith Miller  <keith_miller@apple.com>

        skip test until we figure out why it's timing out
        https://bugs.webkit.org/show_bug.cgi?id=202423

        Reviewed by Mark Lam.

        new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js consistently times out on the bots.
        Let's skip it until we figure out what's going on.

        * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js:

2019-10-01  Keith Miller  <keith_miller@apple.com>

        Mark toctou test as skipped on debug builds
        https://bugs.webkit.org/show_bug.cgi?id=202420

        Reviewed by Saam Barati.

        Keeps timing out... Let's just skip it.

        * stress/toctou-having-a-bad-time-new-array.js:

2019-10-01  Keith Miller  <keith_miller@apple.com>

        Test262 update

        Rubber-stamped by Michael Saboff.

        Note, this was too big to effectivetly put on bugzilla as it's a 10MB patch...

        * test262/*:

2019-10-01  Michael Saboff  <msaboff@apple.com> and Paulo Matos  <pmatos@igalia.com>

        [YARR] Properly handle surrogates when matching back references
        https://bugs.webkit.org/show_bug.cgi?id=202041

        Reviewed by Keith Miller.

        Unchanged from the workin progress patch posted by Paulo Matos <pmatos@igalia.com>.

        Updated test.

        * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js:
        (testRegExpNotMatch):

2019-10-01  Keith Miller  <keith_miller@apple.com>

        Add support for the Wasm multi-value proposal
        https://bugs.webkit.org/show_bug.cgi?id=202250

        Reviewed by Saam Barati.

        This patch adds a new way to run stress tests via the .wat text
        format. By attaching an asm.js compiled version of the wabt tool
        we can easily create wat files programatically and convert them
        into a wasm blob to compile. To make this easy there is a
        wabt-wrapper.js module file that exports two useful functions that
        correspond to WebAssembly.compile and WebAssembly.instantiate.

        * wasm.yaml:
        * wasm/function-tests/if-no-else-non-void.js:
        * wasm/js-api/web-assembly-instantiate.js:
        (assert.asyncTest.async.test):
        (assert.asyncTest):
        * wasm/libwabt.js: Added.
        (WabtModule):
        (set get if):
        * wasm/references/func_ref.js:
        * wasm/references/validation.js:
        (assert.throws):
        * wasm/spec-harness/index.js:
        * wasm/spec-tests/block.wast.js:
        * wasm/spec-tests/br.wast.js:
        * wasm/spec-tests/br_if.wast.js:
        * wasm/spec-tests/call.wast.js:
        * wasm/spec-tests/call_indirect.wast.js:
        * wasm/spec-tests/func.wast.js:
        * wasm/spec-tests/if.wast.js:
        * wasm/spec-tests/loop.wast.js:
        * wasm/spec-tests/type.wast.js:
        * wasm/stress/js-wasm-call-many-return-types-on-stack-no-args.js: Added.
        (buildWat):
        * wasm/stress/js-wasm-js-varying-arities.js: Added.
        (paramForwarder):
        * wasm/stress/wasm-js-call-many-return-types-on-stack-no-args.js: Added.
        (buildWat):
        * wasm/stress/wasm-js-multi-value-exception-in-iterator.js: Added.
        (buildWat.throwError):
        (buildWat.throwErrorInIterator):
        (buildWat.tooManyValues):
        (buildWat.tooFewValues):
        (buildWat):
        * wasm/stress/wasm-wasm-call-indirect-many-return-types-on-stack.js: Added.
        (buildWat):
        * wasm/stress/wasm-wasm-call-many-return-types-on-stack-no-args.js: Added.
        (buildWat):
        * wasm/wabt-wrapper.js: Added.
        (export.compile):
        * wasm/wast-tests/br-if-at-end-of-block.wasm: Added.
        * wasm/wast-tests/br-if-at-end-of-block.wast: Added.
        * wasm/wast-tests/harness.js:
        (async.runWasmFile):
        * wasm/wast-tests/single-param-loop-signature.wasm: Added.
        * wasm/wast-tests/single-param-loop-signature.wast: Added.

2019-09-30  Tadeu Zagallo  <tzagallo@apple.com>

        Make assertion in JSObject::putOwnDataProperty more precise
        https://bugs.webkit.org/show_bug.cgi?id=202379
        <rdar://problem/49515980>

        Reviewed by Yusuke Suzuki.

        * stress/object-assign-target-proto-setter.js: Added.
        (get Object):

2019-09-30  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] HeapSnapshotBuilder m_rootData should be protected with a lock too
        https://bugs.webkit.org/show_bug.cgi?id=202389
        <rdar://problem/50717564>

        Reviewed by Mark Lam.

        * stress/heap-analyzer-taking-lock.js: Added.

2019-09-30  Saam Barati  <sbarati@apple.com>

        Inline caching is wrong for custom accessors and custom values
        https://bugs.webkit.org/show_bug.cgi?id=201994
        <rdar://problem/50850326>

        Reviewed by Yusuke Suzuki.

        * microbenchmarks/custom-accessor-materialized.js: Added.
        (assert):
        (test4.get const):
        * microbenchmarks/custom-accessor-thin-air.js: Added.
        (assert):
        (test5.get const):
        (test5.get proto):
        * microbenchmarks/custom-accessor.js: Added.
        (assert):
        (test3.get const):
        * microbenchmarks/custom-value-2.js: Added.
        (assert):
        (test1.getMultiline):
        (test1):
        * microbenchmarks/custom-value.js: Added.
        (assert):
        (test1.getMultiline):
        (test1):
        * stress/custom-accessor-delete-1.js: Added.
        (assert):
        (test3.get const):
        * stress/custom-accessor-delete-2.js: Added.
        (assert):
        (test4.get const):
        * stress/custom-accessor-delete-3.js: Added.
        (assert):
        (test5.get const):
        (test5.get proto):
        * stress/custom-value-delete-property-1.js: Added.
        (assert):
        (test1.getMultiline):
        (test1):
        * stress/custom-value-delete-property-2.js: Added.
        (test2.foo):
        (test2):
        * stress/custom-value-delete-property-3.js: Added.
        (test6.foo):
        (test6):

2019-09-30  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] AI folds CompareEq wrongly when it sees proven Boolean and Number
        https://bugs.webkit.org/show_bug.cgi?id=202382
        <rdar://problem/52669112>

        Reviewed by Saam Barati.

        * stress/compare-eq-bool-number-folding.js: Added.
        (test):

2019-09-27  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Keep JSString::value(ExecState*)'s result as String instead of `const String&`
        https://bugs.webkit.org/show_bug.cgi?id=202330

        Reviewed by Saam Barati.

        * stress/to-lower-case-gc-stress.js: Added.

2019-09-27  Alexey Shvayka  <shvaikalesh@gmail.com>

        Non-standard Error properties should not be enumerable
        https://bugs.webkit.org/show_bug.cgi?id=198975

        Reviewed by Ross Kirsling.

        * ChakraCore/test/Error/NativeErrors_v4.baseline-jsc: Adjust expectations.
        * microbenchmarks/let-for-in.js: Adjust test.
        * test262/expectations.yaml: Mark 6 test cases as passing.

2019-09-26  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] DFG recursive-tail-call optimization should not emit jump to call-frame with varargs
        https://bugs.webkit.org/show_bug.cgi?id=202299
        <rdar://problem/52669116>

        Reviewed by Saam Barati.

        * stress/recursive-tail-call-optimization-should-not-jump-into-call-frame-with-varargs-simple.js: Added.
        (foo):
        (test):
        * stress/recursive-tail-call-optimization-should-not-jump-into-call-frame-with-varargs.js: Added.
        (foo):
        (C1.prototype.baz):
        (C1):
        (bar):
        (noInline.bar.goo):
        (C2.prototype.baz):
        (C2):
        (test):

2019-09-26  Alexey Shvayka  <shvaikalesh@gmail.com>

        toExponential, toFixed, and toPrecision should allow arguments up to 100
        https://bugs.webkit.org/show_bug.cgi?id=199163

        Reviewed by Ross Kirsling.

        * ChakraCore/test/Number/toString_3.baseline-jsc:
        * ChakraCore/test/es5/exceptions3.baseline-jsc:
        * test262/expectations.yaml: Mark 6 test cases as passing.

2019-09-24  Alexey Shvayka  <shvaikalesh@gmail.com>

        [ES6] Come up with a test for Proxy.[[GetOwnProperty]] that tests the isExtensible error when the  result of the trap is undefined
        https://bugs.webkit.org/show_bug.cgi?id=154376

        Reviewed by Ross Kirsling.

        Adds 2 test cases:
        1. If [[GetOwnProperty]] trap result is `undefined` and Proxy's target is non-extensible, TypeError is thrown.
        2. If [[GetOwnProperty]] trap result is `undefined` and Proxy's target is another Proxy, its "isExtensible" trap is called.

        * stress/proxy-get-own-property.js:

2019-09-24  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] Add ValueBitRShift into DFG
        https://bugs.webkit.org/show_bug.cgi?id=192663

        Reviewed by Robin Morisset.

        * stress/big-int-right-shift-jit-osr.js: Added.
        * stress/big-int-right-shift-jit-untyped.js: Added.
        * stress/big-int-right-shift-jit.js: Added.
        * stress/value-rshift-ai-rule.js: Added.

2019-09-23  Ross Kirsling  <ross.kirsling@sony.com>

        Array methods should throw TypeError upon attempting to modify a string
        https://bugs.webkit.org/show_bug.cgi?id=201910

        Reviewed by Keith Miller.

        * stress/array-methods-should-not-modify-string.js: Added.

        * mozilla/js1_6/Array/regress-304828.js:
        Fix test. Original copy was changed similarly seven years ago:
        https://searchfox.org/mozilla-central/source/js/src/tests/non262/Array/regress-304828.js

        * stress/phantom-insertion-live-range-should-agree-with-arguments-forwarding.js:
        Fix test. `Object.__proto__ = []; Object.shift();` shouldn't be valid JS.

2019-09-23  Mark Lam  <mark.lam@apple.com>

        Lazy JSGlobalObject property materialization should not use putDirectWithoutTransition.
        https://bugs.webkit.org/show_bug.cgi?id=202122
        <rdar://problem/55535249>

        Reviewed by Yusuke Suzuki.

        * stress/lazy-global-object-property-materialization-should-not-putDirectWithoutTransition.js: Added.

2019-09-23  Caio Lima  <ticaiolima@gmail.com>

        Skip stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js into ARMv7 and MIPS
        https://bugs.webkit.org/show_bug.cgi?id=202113

        Unreviewed test gardening, skipped test in ARMv7 and MIPS.

        It is going to be fixed in
        https://bugs.webkit.org/show_bug.cgi?id=202041

        * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js:

2019-09-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Int52Rep(DoubleRepAnyIntUse) should not call operation function
        https://bugs.webkit.org/show_bug.cgi?id=202072

        Reviewed by Mark Lam.

        * stress/int52rep-with-double-checks-int52-range.js: Added.
        (shouldBe):
        (test):

2019-09-21  Caio Lima  <ticaiolima@gmail.com>

        stress/test-out-of-memory.js is not throwing OOM into ARMv7 and MIPS
        https://bugs.webkit.org/show_bug.cgi?id=202011

        Reviewed by Mark Lam.

        We are skipping this test into MIPS and ARMv7 because some of its assumptions
        are not valid for them. The current behavior of the test in those architectures
        is that it does not throw during `new ArrayBuffer(1000)` allocation site,
        because eden collection keeps happening between iterations. The collection
        is triggered on those architectures because the amount of stress 
        `new Promise` generates into GC limits is not enough to avoid them
        while loop is executing.

        Changing the size of `UInt8Array` from `80000000` to `160000000` can
        be an alternative fix to avoid collection happening during `ArrayBuffer`
        allocation loop, but we can't guarantee this test is always going to execute
        without error when Gigacage is disabled, given we can reach an OOM state in
        some allocations that need to succeed, making this test flaky for those
        architectures.

        * stress/test-out-of-memory.js:

2019-09-21  Tadeu Zagallo  <tzagallo@apple.com>

        AccessCase should strongly visit its dependencies while on stack
        https://bugs.webkit.org/show_bug.cgi?id=201986
        <rdar://problem/55521953>

        Reviewed by Saam Barati and Yusuke Suzuki.

        * stress/ftl-put-by-id-setter-exception-interesting-live-state-2.js: Added.
        (foo):
        (warmup):

2019-09-20  Saam Barati  <sbarati@apple.com>

        Unreviewed. Make toctou-having-a-bad-time-new-array.js run for less time because it's timing out on the debug bots.

        * stress/toctou-having-a-bad-time-new-array.js:

2019-09-19  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] DFG op_call_varargs should not assume that one-previous-local of freeReg is usable
        https://bugs.webkit.org/show_bug.cgi?id=202014

        Reviewed by Saam Barati.

        * stress/call-varargs-inlining-should-not-clobber-previous-to-free-register.js: Added.
        (__v0):

2019-09-19  Tadeu Zagallo  <tzagallo@apple.com>

        Syntax checker should report duplicate __proto__ properties
        https://bugs.webkit.org/show_bug.cgi?id=201897
        <rdar://problem/53201788>

        Reviewed by Mark Lam.

        * stress/syntax-checker-duplicate-underscore-proto.js: Added.
        (catch):

2019-09-18  Saam Barati  <sbarati@apple.com>

        TOCTOU bug in havingABadTime related assertion in DFGSpeculativeJIT
        https://bugs.webkit.org/show_bug.cgi?id=201953
        <rdar://problem/53803524>

        Reviewed by Yusuke Suzuki.

        * stress/toctou-having-a-bad-time-new-array.js: Added.
        (let.code):

2019-09-18  Saam Barati  <sbarati@apple.com>

        Phantom insertion phase may disagree with arguments forwarding about live ranges
        https://bugs.webkit.org/show_bug.cgi?id=200715
        <rdar://problem/54301717>

        Reviewed by Yusuke Suzuki.

        * stress/phantom-insertion-live-range-should-agree-with-arguments-forwarding.js: Added.
        (main.v23):
        (main.try.v43):
        (main.):
        (main):

2019-09-17  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Generator should have internal fields
        https://bugs.webkit.org/show_bug.cgi?id=201159

        Reviewed by Keith Miller.

        * stress/create-generator.js: Added.
        (shouldBe):
        (test.generator):
        (test):
        * stress/generator-construct-failure.js: Added.
        (shouldThrow):
        (TypeError):
        * stress/generator-prototype-change.js: Added.
        (shouldBe):
        (gen):
        * stress/generator-prototype-closure.js: Added.
        (shouldBe):
        (test.gen):
        (test):
        * stress/object-assign-fast-path.js:

2019-09-17  Yusuke Suzuki  <ysuzuki@apple.com>

        Follow-up after String.codePointAt optimization
        https://bugs.webkit.org/show_bug.cgi?id=201889

        Reviewed by Saam Barati.

        * stress/string-char-at-bad-type.js: Added.
        (shouldBe):
        (object.toString):
        (test):
        * stress/string-char-code-at-bad-type.js: Added.
        (shouldBe):
        (object.toString):
        (test):
        * stress/string-code-point-at-bad-type.js: Added.
        (shouldBe):
        (object.toString):
        (test):

2019-09-17  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] CheckArray+NonArray is not filtering out Array in AI
        https://bugs.webkit.org/show_bug.cgi?id=201857
        <rdar://problem/54194820>

        Reviewed by Keith Miller.

        * stress/check-array-with-non-array-does-not-filter-arrays.js: Added.
        (foo):

2019-09-17  Saam Barati  <sbarati@apple.com>

        CheckArray on DirectArguments/ScopedArguments does not filter out slow put array storage
        https://bugs.webkit.org/show_bug.cgi?id=201853
        <rdar://problem/53805461>

        Reviewed by Yusuke Suzuki.

        * stress/direct-arguments-check-array-filter-type.js: Added.
        (foo):

2019-09-16  Tadeu Zagallo  <tzagallo@apple.com>

        Wasm StreamingParser should validate that number of functions matches number of declarations
        https://bugs.webkit.org/show_bug.cgi?id=201850
        <rdar://problem/55290186>

        Reviewed by Yusuke Suzuki.

        * wasm/regress/validate-number-of-functions-match-declarations.js: Added.
        (catch):

2019-09-16  Michael Saboff  <msaboff@apple.com>

        [JSC] Perform check again when we found non-BMP characters
        https://bugs.webkit.org/show_bug.cgi?id=201647

        Reviewed by Yusuke Suzuki.

        * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js: Added.
        * stress/regexp-unicode-within-string.js: Updated test to eliminate the bogus print().
        (testRegExpInbounds):

2019-09-16  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Add missing syntax errors for await in function parameter default expressions
        https://bugs.webkit.org/show_bug.cgi?id=201615

        Reviewed by Darin Adler.

        * stress/async-await-reserved-word.js:
        * stress/async-await-syntax.js:
        Add test cases.

        * test262/expectations.yaml:
        Mark newly-passing test cases.

2019-09-16  Saam Barati  <sbarati@apple.com>

        JSObject::putInlineSlow should not ignore "__proto__" for Proxy
        https://bugs.webkit.org/show_bug.cgi?id=200386
        <rdar://problem/53854946>

        Reviewed by Yusuke Suzuki.

        * stress/proxy-__proto__-in-prototype-chain.js: Added.
        * stress/proxy-property-replace-structure-transition.js: Added.

2019-09-13  Alexey Shvayka  <shvaikalesh@gmail.com>

        Date.prototype.toJSON does not execute steps 1-2
        https://bugs.webkit.org/show_bug.cgi?id=105282

        Reviewed by Ross Kirsling.

        * test262/expectations.yaml: Mark 2 test cases as passing.

2019-09-12  Mark Lam  <mark.lam@apple.com>

        Harden JSC against the abuse of runtime options.
        https://bugs.webkit.org/show_bug.cgi?id=201597
        <rdar://problem/55167068>

        Reviewed by Filip Pizlo.

        Remove the call to forceGCSlowPaths().  This utility function will be removed.
        The modern way to set the required option is to use //@ requireOptions.

        * stress/ftl-try-catch-oom-error-lazy-slow-path.js:

2019-09-11  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Add StringCodePointAt intrinsic
        https://bugs.webkit.org/show_bug.cgi?id=201673

        Reviewed by Michael Saboff.

        * stress/string-char-at-constant-index-out-of-range.js: Added.
        (shouldBe):
        (test):
        * stress/string-char-code-at-constant-index-out-of-range.js: Added.
        (shouldBe):
        (test):
        * stress/string-code-point-at--out-of-range.js: Added.
        (shouldBe):
        (test):
        * stress/string-code-point-at-basic.js: Added.
        (test):
        * stress/string-code-point-at-constant-index-out-of-range.js: Added.
        (shouldBe):
        (test):
        * stress/string-code-point-at-constant-int32-max-index-out-of-range.js: Added.
        (shouldBe):
        (test):
        * stress/string-code-point-at-constant-surrogate-pair.js: Added.
        (shouldBe):
        (test):
        (breaking):
        * stress/string-code-point-at-surrogate-pair.js: Added.
        (shouldBe):
        * stress/string-code-point-at.js: Added.
        (shouldBe):

2019-09-10  Michael Saboff  <msaboff@apple.com>

        JSC crashes due to stack overflow while building RegExp
        https://bugs.webkit.org/show_bug.cgi?id=201649

        Reviewed by Yusuke Suzuki.

        New regression test.

        * stress/regexp-bol-optimize-out-of-stack.js: Added.
        (test):
        (catch):

2019-09-10  Yusuke Suzuki  <ysuzuki@apple.com>

        [WebAssembly] Use StreamingParser in existing Wasm::BBQPlan
        https://bugs.webkit.org/show_bug.cgi?id=189043

        Reviewed by Keith Miller.

        The offset performing the validation becomes a bit different.
        The offset 0 is nice since it is the starting offset of the Module header signature compared to the offset 8.

        * wasm/js-api/version.js:

2019-09-07  Keith Miller  <keith_miller@apple.com>

        OSR entry into wasm misses some contexts
        https://bugs.webkit.org/show_bug.cgi?id=201569

        Reviewed by Yusuke Suzuki.

        Add a new harness and wast and the generated wasm file for
        testing. The idea long term is to make it easy to test by creating
        a C file and converting it to a wast then modify that to produce a
        test.

        * wasm.yaml:
        * wasm/wast-tests/harness.js: Added.
        (async.runWasmFile):
        * wasm/wast-tests/osr-entry-inner-loop-branch-above-no-consts.wasm: Added.
        * wasm/wast-tests/osr-entry-inner-loop-branch-above-no-consts.wast: Added.
        * wasm/wast-tests/osr-entry-inner-loop-branch-above.wasm: Added.
        * wasm/wast-tests/osr-entry-inner-loop-branch-above.wast: Added.
        * wasm/wast-tests/osr-entry-inner-loop.wasm: Added.
        * wasm/wast-tests/osr-entry-inner-loop.wast: Added.
        * wasm/wast-tests/osr-entry-multiple-enclosed-contexts.wasm: Added.
        * wasm/wast-tests/osr-entry-multiple-enclosed-contexts.wast: Added.

2019-09-09  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Promise resolve/reject functions should be created more efficiently
        https://bugs.webkit.org/show_bug.cgi?id=201488

        Reviewed by Mark Lam.

        * microbenchmarks/promise-creation-many.js: Added.
        (executor):

2019-09-09  Zan Dobersek  <zdobersek@igalia.com>

        Unreviewed JSC test gardening.

        * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js:
        This test allocates a 2GB string before it goes out and tests
        out-of-memory exception when appending other strings to it. As such,
        skip the test on memory-limited platforms.

2019-09-07  Mark Lam  <mark.lam@apple.com>

        The jsc shell should allow disabling of the Gigacage for testing purposes.
        https://bugs.webkit.org/show_bug.cgi?id=201579

        Reviewed by Michael Saboff.

        Unskip the tests now.

        * stress/disable-gigacage-arrays.js:
        * stress/disable-gigacage-strings.js:
        * stress/disable-gigacage-typed-arrays.js:

2019-09-07  Mark Lam  <mark.lam@apple.com>

        Gardening: temporarily skipping these tests until the fix can be reviewed and landed.

        Not reviewed.

        See https://bugs.webkit.org/show_bug.cgi?id=201579 for the fix.

        * stress/disable-gigacage-arrays.js:
        * stress/disable-gigacage-strings.js:
        * stress/disable-gigacage-typed-arrays.js:

2019-09-07  Mark Lam  <mark.lam@apple.com>

        Gardening: speculative test fix to green bots [attempt #2].
        https://bugs.webkit.org/show_bug.cgi?id=201529
        <rdar://problem/53935772>

        Not reviewed.

        * stress/test-out-of-memory.js:

2019-09-06  Mark Lam  <mark.lam@apple.com>

        Gardening: speculative test fix to green bots.
        https://bugs.webkit.org/show_bug.cgi?id=201529
        <rdar://problem/53935772>

        Not reviewed.

        * stress/test-out-of-memory.js:

2019-09-06  Ross Kirsling  <ross.kirsling@sony.com>

        Math.round() produces wrong result for value prior to 0.5
        https://bugs.webkit.org/show_bug.cgi?id=185115

        Reviewed by Saam Barati.

        * stress/math-round-basics.js:
        Add positive/negative test cases.

        * test262/expectations.yaml:
        Mark test passing.

2019-09-06  Mark Lam  <mark.lam@apple.com>

        Move web-assembly-constructors-should-not-override-global-object-property.js below JSTests/wasm/stress.
        https://bugs.webkit.org/show_bug.cgi?id=201551

        Reviewed by Tadeu Zagallo.

        Ports that don't support WASM will always fail this test if it stays in JSTests/stress.

        * stress/web-assembly-constructors-should-not-override-global-object-property.js: Removed.
        * wasm/stress/web-assembly-constructors-should-not-override-global-object-property.js: Copied from JSTests/stress/web-assembly-constructors-should-not-override-global-object-property.js.

2019-09-06  Mark Lam  <mark.lam@apple.com>

        Fix bmalloc::Allocator:tryAllocate() to return null on failure to allocate.
        https://bugs.webkit.org/show_bug.cgi?id=201529
        <rdar://problem/53935772>

        Reviewed by Yusuke Suzuki.

        * stress/test-out-of-memory.js: Added.

2019-09-05  Tadeu Zagallo  <tzagallo@apple.com>

        LazyClassStructure::setConstructor should not store the constructor to the global object
        https://bugs.webkit.org/show_bug.cgi?id=201484
        <rdar://problem/50400451>

        Reviewed by Yusuke Suzuki.

        * stress/web-assembly-constructors-should-not-override-global-object-property.js: Added.

2019-09-05  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Do not use FTLOutput::weakPointer directly
        https://bugs.webkit.org/show_bug.cgi?id=201495

        Reviewed by Filip Pizlo.

        * stress/create-promise-weak-pointer.js: Added.
        (foo):

2019-09-04  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Make Promise implementation faster
        https://bugs.webkit.org/show_bug.cgi?id=200898

        Reviewed by Saam Barati.

        * ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
        (assert.assert.return.throws):
        * modules/breaking-builtin-promise-then-does-not-break-internal-promise.js: Added.
        * modules/breaking-builtin-promise-then-does-not-break-internal-promise/test.js: Added.
        * stress/constructor-kind-naked-should-not-be-applied-to-inner-functions.js: Added.
        (shouldThrow):
        (new.Promise):
        (shouldThrow.Promise):
        * stress/create-promise-should-respect-promise-realm.js: Added.
        (shouldBe):
        (other.new.OtherPromise):
        (DerivedOtherPromise):
        (i.promise.new.DerivedOtherPromise):
        (createPromise):
        * stress/derived-promise-constructor-class-syntax-prototype-replace-attempt.js: Added.
        (shouldBe):
        (DerivedPromise):
        (i.array.push.new.DerivedPromise):
        (promise.new.DerivedPromise):
        * stress/derived-promise-constructor-inlined.js: Added.
        (shouldBe):
        (DerivedPromise):
        (i.array.push.new.DerivedPromise):
        (DerivedPromise.all.array.then):
        * stress/derived-promise-prototype-replaced.js: Added.
        (shouldBe):
        (DerivedPromise):
        (i.array.push.new.DerivedPromise):
        (promise.new.DerivedPromise):
        * stress/internal-promise-constructor-not-confusing.js: Added.
        (shouldBe):
        (InternalPromise.vm.createBuiltin):
        (DerivedPromise):
        * stress/internal-promise-is-not-exposed.js: Added.
        (shouldBe):
        * stress/new-promise-should-respect-promise-realm.js: Added.
        (shouldBe):
        (other.new.OtherPromise):
        (createPromise):
        * stress/promise-cannot-be-called.js:
        (shouldThrow):
        * stress/promise-capability-fast-path.js: Added.
        (shouldBe):
        (i.array.push.new.Promise):
        (i.array.i.then):
        * stress/promise-capability-slow-path.js: Added.
        (shouldBe):
        (Promise.prototype.then):
        (i.array.push.new.Promise):
        (i.array.i.then):
        * stress/promise-capability-then-slow-path.js: Added.
        (shouldBe):
        (DerivedPromise):
        (DerivedPromise.prototype.then):
        (i.array.push.new.DerivedPromise):
        (i.array.i.then):
        * stress/promise-constructor-inlined.js: Added.
        (shouldBe):
        (i.array.push.new.Promise):
        (Promise.all.array.then):
        * stress/promise-constructor-transition-from-new-promise-to-create-promise.js: Added.
        (shouldBe):
        (DerivedPromise):
        (DerivedPromise2):
        (i.array.push.new.DerivedPromise):
        (i.array2.push.new.DerivedPromise2):
        * stress/without-promise-functions.js: Added.
        (shouldBe):
        (async):

2019-09-03  Mark Lam  <mark.lam@apple.com>

        Assertions in JSArrayBufferView::byteOffset() are only valid for the mutator thread.
        https://bugs.webkit.org/show_bug.cgi?id=201309
        <rdar://problem/54832121>

        Reviewed by Yusuke Suzuki.

        * stress/JSArrayBufferView-byteOffset-is-racy-from-compiler-thread.js: Added.

2019-08-30  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Generate new.target register only when it is used
        https://bugs.webkit.org/show_bug.cgi?id=201335

        Reviewed by Mark Lam.

        * stress/ensure-new-register-allocated.js: Added.
        (shouldBe):
        (basic):
        (arrow):
        (Base):
        (Derived):
        (evaluate):

2019-08-30  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] DFG ByteCodeParser should not copy JIT-related part of SimpleJumpTable
        https://bugs.webkit.org/show_bug.cgi?id=201331

        Reviewed by Mark Lam.

        * stress/simple-jump-table-copy.js: Added.
        (let.code):
        (g2):

2019-08-30  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] DFG inlining CheckBadCell slow path does not assume result VirtualRegister can be invalid
        https://bugs.webkit.org/show_bug.cgi?id=201332

        Reviewed by Mark Lam.

        This test is very flaky, it is hard to reproduce.

        * stress/setter-inlining-resulting-bad-cell-result-virtual-register-should-be-invalid.js: Added.
        (code):

2019-08-29  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Repatch should construct CallCases and CasesValue at the same time
        https://bugs.webkit.org/show_bug.cgi?id=201325

        Reviewed by Saam Barati.

        * stress/repatch-switch.js: Added.
        (main.f2.f0):
        (main.f2.f3):
        (main.f2.f1):
        (main.f2):
        (main):

2019-08-29  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] ObjectAllocationSinkingPhase wrongly deals with always-taken branches during interpretation
        https://bugs.webkit.org/show_bug.cgi?id=198650

        Reviewed by Saam Barati.

        * stress/object-allocation-sinking-interpretation-can-interpret-edges-that-can-be-proven-unreachable-in-ai.js:
        (main.v0):
        (main):

2019-08-28  Mark Lam  <mark.lam@apple.com>

        DFG/FTL: We should prefetch structures and do a loadLoadFence before doing PrototypeChainIsSane checks.
        https://bugs.webkit.org/show_bug.cgi?id=201281
        <rdar://problem/54028228>

        Reviewed by Yusuke Suzuki and Saam Barati.

        * stress/structure-storedPrototype-should-only-assert-on-the-mutator-thread.js: Added.

2019-08-28  Mark Lam  <mark.lam@apple.com>

        Placate exception check validation in DFG's operationHasGenericProperty().
        https://bugs.webkit.org/show_bug.cgi?id=201245
        <rdar://problem/54777512>

        Reviewed by Robin Morisset.

        * stress/missing-exception-check-in-operationHasGenericProperty.js: Added.

2019-08-27  Mark Lam  <mark.lam@apple.com>

        constructFunctionSkippingEvalEnabledCheck() should use tryMakeString() and check for OOM.
        https://bugs.webkit.org/show_bug.cgi?id=201196
        <rdar://problem/54703775>

        Reviewed by Yusuke Suzuki.

        * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: Added.

2019-08-26  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Ensure x?.y ?? z is fast
        https://bugs.webkit.org/show_bug.cgi?id=200875

        Reviewed by Yusuke Suzuki.

        * stress/nullish-coalescing.js:

2019-08-23  Tadeu Zagallo  <tzagallo@apple.com>

        Remove MaximalFlushInsertionPhase
        https://bugs.webkit.org/show_bug.cgi?id=201036

        Reviewed by Saam Barati.

        Remove all the references to maximal flush

        * stress/arith-ceil-on-various-types.js:
        (checkCompileCountForUselessNegativeZero):
        * stress/arith-floor-on-various-types.js:
        (checkCompileCountForUselessNegativeZero):
        * stress/arith-negate-on-various-types.js:
        (checkCompileCountForUselessNegativeZero):
        * stress/arith-round-on-various-types.js:
        (checkCompileCountForUselessNegativeZero):
        * stress/arith-trunc-on-various-types.js:
        (checkCompileCountForUselessNegativeZero):
        * stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js:
        * stress/has-indexed-property-should-accept-non-int32.js:
        * stress/has-indexed-property-with-worsening-array-mode.js:
        * stress/known-int32-cant-be-used-across-bytecode-boundary.js:
        * stress/read-dead-bytecode-locals-in-must-handle-values1.js:
        * stress/read-dead-bytecode-locals-in-must-handle-values2.js:
        * stress/rest-parameter-many-arguments.js:
        * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness-2.js:
        * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness.js:
        * stress/to-index-string-should-not-assume-incoming-value-is-uint32.js:

2019-08-23  Justin Michaud  <justin_michaud@apple.com>

        [WASM-References] Do not overwrite argument registers in jsCallEntrypoint
        https://bugs.webkit.org/show_bug.cgi?id=200952

        Reviewed by Saam Barati.

        * wasm/references/func_ref.js:
        (assert.throws):

2019-08-22  Justin Michaud  <justin_michaud@apple.com>

        Add missing exception check in canonicalizeLocaleList
        https://bugs.webkit.org/show_bug.cgi?id=201021

        Reviewed by Mark Lam.

        * stress/missing-exception-check-in-canonicalizeLocaleList.js: Added.
        (catch):

2019-08-21  Mark Lam  <mark.lam@apple.com>

        Wasm::FunctionParser is failing to enforce maxFunctionLocals.
        https://bugs.webkit.org/show_bug.cgi?id=201016
        <rdar://problem/54579911>

        Reviewed by Yusuke Suzuki.

        * wasm/stress/too-many-locals.js: Added.
        (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.catch):

2019-08-21  Ross Kirsling  <ross.kirsling@sony.com>

        JSTests/stress/optional-chaining should not call shouldThrowTypeError in a loop
        https://bugs.webkit.org/show_bug.cgi?id=200965

        Reviewed by Saam Barati.

        This has nothing to do with ?. in particular, but throwing >1M type errors takes 100s in Debug on my machine.
        The main idea here was to JITify the simple success cases, so let's not run the simple failures so many times.

        * stress/optional-chaining.js:

2019-08-21  Michael Saboff  <msaboff@apple.com>

        [JSC] incorrent JIT lead to StackOverflow
        https://bugs.webkit.org/show_bug.cgi?id=197823

        Reviewed by Tadeu Zagallo.

        New test.

        * stress/bound-function-stack-overflow.js: Added.
        (foo):
        (catch):

2019-08-20  Justin Michaud  <justin_michaud@apple.com>

        Identify memcpy loops in b3
        https://bugs.webkit.org/show_bug.cgi?id=200181

        Reviewed by Saam Barati.

        * microbenchmarks/memcpy-loop.js: Added.
        (doTest):
        (let.arr1):
        * microbenchmarks/memcpy-typed-loop-large.js: Added.
        (doTest):
        (let.arr1.new.Int32Array.1000000.let.arr2.new.Int32Array.1000000):
        (arr2):
        * microbenchmarks/memcpy-typed-loop-small.js: Added.
        (doTest):
        (16.let.arr1.new.Int32Array.size.let.arr2.new.Int32Array.size):
        (16.arr2):
        * microbenchmarks/memcpy-typed-loop-speculative.js: Added.
        (doTest):
        (let.arr1.new.Int32Array.10.let.arr2.new.Int32Array.10):
        (arr2):
        * microbenchmarks/memcpy-wasm-large.js: Added.
        (typeof.WebAssembly.string_appeared_here.eq):
        (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
        * microbenchmarks/memcpy-wasm-medium.js: Added.
        (typeof.WebAssembly.string_appeared_here.eq):
        (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
        * microbenchmarks/memcpy-wasm-small.js: Added.
        (typeof.WebAssembly.string_appeared_here.eq):
        (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
        * microbenchmarks/memcpy-wasm.js: Added.
        (typeof.WebAssembly.string_appeared_here.eq):
        (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
        * stress/memcpy-typed-loops.js: Added.
        (noLoop):
        (invalidStart):
        (const.size.10.let.arr1.new.Int32Array.size.let.arr2.new.Int32Array.size):
        (arr2):
        * wasm/function-tests/memcpy-wasm-loop.js: Added.
        (0.GetLocal.3.I32Const.1.I32Add.SetLocal.3.Br.1.End.End.End.WebAssembly):
        (string_appeared_here):

2019-08-20  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Array.prototype.toString should not get "join" function each time
        https://bugs.webkit.org/show_bug.cgi?id=200905

        Reviewed by Mark Lam.

        * stress/array-prototype-join-change.js: Added.
        (shouldBe):
        (array2.join):
        (DerivedArray):
        (DerivedArray.prototype.join):
        (array3.__proto__.join):
        (Array.prototype.join):

2019-08-20  Justin Michaud  <justin_michaud@apple.com>

        Fix InBounds speculation of typed array PutByVal and add extra step to integer range optimization to search for equality relationships on the RHS value
        https://bugs.webkit.org/show_bug.cgi?id=200782

        Reviewed by Saam Barati.

        Skip long memcpy test on debug, and try to fix flakiness for recompilation count tests by disabling cjit.

        * microbenchmarks/memcpy-typed-loop.js:
        * stress/int8-repeat-in-then-out-of-bounds.js:

2019-08-19  Alexey Shvayka  <shvaikalesh@gmail.com>

        Proxy constructor should throw if handler is revoked Proxy
        https://bugs.webkit.org/show_bug.cgi?id=198755

        Reviewed by Saam Barati.

        * stress/proxy-revoke.js: Adjust error message.
        * test262/expectations.yaml: Mark 2 test cases as passing.

2019-08-19  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] OSR entry to Wasm OMG
        https://bugs.webkit.org/show_bug.cgi?id=200362

        Reviewed by Michael Saboff.

        * wasm/stress/osr-entry-basic.js: Added.
        (instance.exports.loop):
        * wasm/stress/osr-entry-many-locals-f32.js: Added.
        * wasm/stress/osr-entry-many-locals-f64.js: Added.
        * wasm/stress/osr-entry-many-locals-i32.js: Added.
        * wasm/stress/osr-entry-many-locals-i64.js: Added.
        * wasm/stress/osr-entry-many-stacks-f32.js: Added.
        * wasm/stress/osr-entry-many-stacks-f64.js: Added.
        * wasm/stress/osr-entry-many-stacks-i32.js: Added.
        * wasm/stress/osr-entry-many-stacks-i64.js: Added.

2019-08-19  Alexey Shvayka  <shvaikalesh@gmail.com>

        Date.prototype.toJSON throws if toISOString returns an object
        https://bugs.webkit.org/show_bug.cgi?id=198495

        Reviewed by Ross Kirsling.

        * test262/expectations.yaml: Mark 6 test cases as passing.

2019-08-19  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] DFG DataView get/set optimization should take care of the case little-endian flag is JSEmpty
        https://bugs.webkit.org/show_bug.cgi?id=200899
        <rdar://problem/54073341>

        Reviewed by Mark Lam.

        * stress/data-view-get-dfg-should-handle-empty-constant.js: Added.
        (i.new.Promise):
        * stress/data-view-set-dfg-should-handle-empty-constant.js: Added.
        (i.new.Promise):

2019-08-19  Michael Saboff  <msaboff@apple.com>

        Webkit jsc Crash in RegExp::matchInline (this=<optimized out>
        https://bugs.webkit.org/show_bug.cgi?id=197090

        Reviewed by Yusuke Suzuki.

        New test.

        * stress/regexp-nonconsuming-counted-parens.js: Added.

2019-08-18  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Correct a->an in error messages and API docblocks
        https://bugs.webkit.org/show_bug.cgi?id=200833

        Reviewed by Don Olmstead.

        * ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
        (assert.assert.return.throws):
        * stress/promise-finally-should-accept-non-promise-objects.js:
        * wasm/js-api/table.js:
        (assert.throws):

2019-08-17  Ross Kirsling  <ross.kirsling@sony.com>

        [ESNext] Implement optional chaining
        https://bugs.webkit.org/show_bug.cgi?id=200199

        Reviewed by Yusuke Suzuki.

        * stress/nullish-coalescing.js:
        * stress/optional-chaining.js: Added.
        * stress/tail-call-recognize.js:

2019-08-17  Ross Kirsling  <ross.kirsling@sony.com>

        [ESNext] Support hashbang.
        https://bugs.webkit.org/show_bug.cgi?id=200865

        Reviewed by Mark Lam.

        * stress/hashbang.js: Added.
        * test262/expectations.yaml: Mark 6 cases as passing.

2019-08-17  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] DFG ToNumber should support Boolean in fixup
        https://bugs.webkit.org/show_bug.cgi?id=200864

        Reviewed by Mark Lam.

        * microbenchmarks/to-number-boolean.js: Added.
        (test):
        * stress/to-number-boolean-int32.js: Added.
        (shouldBe):
        (test):
        (check):
        * stress/to-number-boolean.js: Added.
        (shouldBe):
        (test):
        (check):
        * stress/to-number-int32.js: Added.
        (shouldBe):
        (test):
        (check):

2019-08-16  Mark Lam  <mark.lam@apple.com>

        More missing exception checks in string comparison operators.
        https://bugs.webkit.org/show_bug.cgi?id=200844
        <rdar://problem/54378684>

        Reviewed by Saam Barati.

        * stress/missing-exception-check-in-string-greater-than-compare.js: Added.
        * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: Added.
        * stress/missing-exception-check-in-string-less-than-compare.js: Added.
        * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: Added.

2019-08-16  Mark Lam  <mark.lam@apple.com>

        CodeBlock destructor should clear all of its watchpoints.
        https://bugs.webkit.org/show_bug.cgi?id=200792
        <rdar://problem/53947800>

        Reviewed by Yusuke Suzuki.

        * stress/codeblock-should-clear-watchpoints-on-destruction.js: Added.

2019-08-16  Justin Michaud  <justin_michaud@apple.com>

        Fix InBounds speculation of typed array PutByVal and add extra step to integer range optimization to search for equality relationships on the RHS value
        https://bugs.webkit.org/show_bug.cgi?id=200782

        Reviewed by Saam Barati.

        * microbenchmarks/int8-out-of-bounds.js: Added.
        (foo):
        * microbenchmarks/memcpy-typed-loop.js: Added.
        (doTest):
        (let.arr1.new.Int32Array.1000.let.arr2.new.Int32Array.1000):
        (arr2):
        * stress/int8-repeat-in-then-out-of-bounds.js: Added.
        (foo):

2019-08-16  Mark Lam  <mark.lam@apple.com>

        [Re-land] ProxyObject should not be allow to access its target's private properties.
        https://bugs.webkit.org/show_bug.cgi?id=200739
        <rdar://problem/53972768>

        Reviewed by Yusuke Suzuki.

        * stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js: Copied from JSTests/stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js.
        * stress/proxy-with-private-symbols.js:

2019-08-16  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Promise.prototype.finally should accept non-promise objects
        https://bugs.webkit.org/show_bug.cgi?id=200829

        Reviewed by Mark Lam.

        * stress/promise-finally-should-accept-non-promise-objects.js: Added.
        (shouldBe):
        (Thenable):
        (Thenable.prototype.then):

2019-08-16  Alexey Shvayka  <shvaikalesh@gmail.com>

        Promise constructor should check argument before [[Construct]]
        https://bugs.webkit.org/show_bug.cgi?id=198976

        Reviewed by Ross Kirsling.

        * stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js: Fix test.
        * stress/create-subclass-structure-might-throw.js: Fix test.
        * test262/expectations.yaml: Mark 2 test cases as passing.

2019-08-16  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r248709.

        Caused test/built-ins/Promise/prototype/finally/this-value-
        non-promise.js to fail on test262 bot

        Reverted changeset:

        "ProxyObject should not be allow to access its target's
        private properties."
        https://bugs.webkit.org/show_bug.cgi?id=200739
        https://trac.webkit.org/changeset/248709

2019-08-15  Alexey Shvayka  <shvaikalesh@gmail.com>

        DateConversion::formatDateTime incorrectly formats negative years
        https://bugs.webkit.org/show_bug.cgi?id=199964

        Reviewed by Ross Kirsling.

        * test262/expectations.yaml: Mark 6 test cases as passing.

2019-08-15  Mark Lam  <mark.lam@apple.com>

        More missing exception checks in String.prototype.
        https://bugs.webkit.org/show_bug.cgi?id=200762
        <rdar://problem/54333896>

        Reviewed by Michael Saboff.

        * stress/missing-exception-check-in-string-lastIndexOf.js: Added.
        * stress/missing-exception-check-in-string-toLower.js: Added.
        * stress/missing-exception-check-in-string-toUpper.js: Added.

2019-08-14  Mark Lam  <mark.lam@apple.com>

        ProxyObject should not be allow to access its target's private properties.
        https://bugs.webkit.org/show_bug.cgi?id=200739
        <rdar://problem/53972768>

        Reviewed by Yusuke Suzuki.

        * stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js: Added.
        * stress/proxy-with-private-symbols.js: Rebased.

2019-08-14  Mark Lam  <mark.lam@apple.com>

        Missing exception check in string compare.
        https://bugs.webkit.org/show_bug.cgi?id=200743
        <rdar://problem/53975356>

        Reviewed by Michael Saboff.

        * stress/missing-exception-check-in-string-compare.js: Added.

2019-08-08  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Add "jump if (not) undefined or null" bytecode ops
        https://bugs.webkit.org/show_bug.cgi?id=200480

        Reviewed by Saam Barati.

        * stress/destructuring-assignment-require-object-coercible.js:
        * stress/nullish-coalescing.js:

2019-08-05  Michael Saboff  <msaboff@apple.com>

        JSC: assertion failure in SpeculativeJIT::compileGetByValOnIntTypedArray
        https://bugs.webkit.org/show_bug.cgi?id=199997

        Reviewed by Saam Barati.

        New test.

        * stress/typedarray-no-alreadyChecked-assert.js: Added.
        (checkIntArray):
        (checkFloatArray):

2019-08-02  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Support WebAssembly in SamplingProfiler
        https://bugs.webkit.org/show_bug.cgi?id=200329

        Reviewed by Saam Barati.

        * stress/sampling-profiler-wasm-name-section.js: Added.
        (const.compile):
        (platformSupportsSamplingProfiler.vm.isWasmSupported.wasmEntry):
        (platformSupportsSamplingProfiler.vm.isWasmSupported):
        * stress/sampling-profiler-wasm.js: Added.
        (platformSupportsSamplingProfiler.vm.isWasmSupported.wasmEntry):
        (platformSupportsSamplingProfiler.vm.isWasmSupported):
        * stress/sampling-profiler/loop.wasm: Added.
        * stress/sampling-profiler/loop.wast: Added.
        * stress/sampling-profiler/nameSection.wasm: Added.

2019-08-02  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] LazyJSValue should be robust for empty JSValue
        https://bugs.webkit.org/show_bug.cgi?id=200388

        Reviewed by Saam Barati.

        * stress/switch-constant-child-becomes-empty.js: Added.
        (foo):

2019-08-01  Yusuke Suzuki  <ysuzuki@apple.com>

        GetterSetter type confusion during DFG compilation
        https://bugs.webkit.org/show_bug.cgi?id=199903

        Reviewed by Mark Lam.

        * stress/cse-propagated-constant-may-not-follow-structure-restrictions.js: Added.

2019-08-01  Ross Kirsling  <ross.kirsling@sony.com>

        Update Test262 (2019.08.01)
        https://bugs.webkit.org/show_bug.cgi?id=200351

        Reviewed by Keith Miller.

        * test262/expectations.yaml:
        * test262/harness/testIntl.js:
        * test262/latest-changes-summary.txt:
        * test262/test/:
        * test262/test262-Revision.txt:

2019-07-30  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Make StructureChain less-tricky by using Auxiliary Buffer
        https://bugs.webkit.org/show_bug.cgi?id=200192

        Reviewed by Saam Barati.

        * stress/structure-chain-stress.js: Added.
        (keys):

2019-07-29  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Increment bytecode age only when SlotVisitor is first-visit
        https://bugs.webkit.org/show_bug.cgi?id=200196

        Reviewed by Robin Morisset.

        * stress/reparsing-unlinked-codeblock.js:

2019-07-29  Justin Michaud  <justin_michaud@apple.com>

        [X86] Emit BT instruction for shift + mask in B3
        https://bugs.webkit.org/show_bug.cgi?id=199891

        Reviewed by Robin Morisset.

        Lower the number of iterations to fix debug timeouts.

        * microbenchmarks/bit-test-load.js:
        (i):

2019-07-27  Justin Michaud  <justin_michaud@apple.com>

        [X86] Emit BT instruction for shift + mask in B3
        https://bugs.webkit.org/show_bug.cgi?id=199891

        Reviewed by Keith Miller.

        * microbenchmarks/bit-test-constant.js: Added.
        (let.glob.0.doTest):
        * microbenchmarks/bit-test-load.js: Added.
        (let.glob.0.let.arr.new.Int32Array.8.doTest):
        (i):
        * microbenchmarks/bit-test-nonconstant.js: Added.
        (let.glob.0.doTest):

2019-07-26  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Potential GC fix for JSPropertyNameEnumerator
        https://bugs.webkit.org/show_bug.cgi?id=200151

        Reviewed by Mark Lam.

        * stress/for-in-stress.js: Added.
        (keys):

2019-07-25  Ross Kirsling  <ross.kirsling@sony.com>

        Legacy numeric literals should not permit separators or BigInt
        https://bugs.webkit.org/show_bug.cgi?id=199984

        Reviewed by Keith Miller.

        * stress/big-int-literals.js:
        * stress/numeric-literal-separators.js:

2019-07-25  Ross Kirsling  <ross.kirsling@sony.com>

        [ESNext] Implement nullish coalescing
        https://bugs.webkit.org/show_bug.cgi?id=200072

        Reviewed by Darin Adler.

        * stress/nullish-coalescing.js: Added.

2019-07-24  Alexey Shvayka  <shvaikalesh@gmail.com>

        Three checks are missing in Proxy internal methods
        https://bugs.webkit.org/show_bug.cgi?id=198630

        Reviewed by Darin Adler.

        * stress/proxy-delete.js: Assert isExtensible is called in correct order.
        * test262/expectations.yaml: Mark 6 test cases as passing.

2019-07-23  Justin Michaud  <justin_michaud@apple.com>

        Sometimes we miss removable CheckInBounds
        https://bugs.webkit.org/show_bug.cgi?id=200018

        Reviewed by Saam Barati.

        * microbenchmarks/typed-array-sum.js: Added.
        (doTest):

2019-07-16  Mark Lam  <mark.lam@apple.com>

        ArgumentsEliminationPhase should insert KillStack nodes before PutStack nodes that it adds.
        https://bugs.webkit.org/show_bug.cgi?id=199821
        <rdar://problem/52452328>

        Reviewed by Filip Pizlo.

        * stress/arguments-elimination-should-insert-KillStacks-before-added-PutStacks.js: Added.

2019-07-16  Keith Miller  <keith_miller@apple.com>

        Unreviewed, test262 gardening.

        * test262/expectations.yaml:

2019-07-15  Keith Miller  <keith_miller@apple.com>

        A Possible Issue of Object.create method
        https://bugs.webkit.org/show_bug.cgi?id=199744

        Reviewed by Yusuke Suzuki.

        * stress/object-create-non-object-properties-parameter.js: Added.
        (catch):

2019-07-15  Keith Miller  <keith_miller@apple.com>

        Update test262
        https://bugs.webkit.org/show_bug.cgi?id=199801

        Rubber-stamped by Yusuke Suzuki.

        * test262/expectations.yaml:
        * test262/latest-changes-summary.txt:
        * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/Symbol.toStringTag.js: Added.
        (fg.new.FinalizationGroup):
        (callback):
        * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-job-not-active-throws.js: Added.
        (fg.new.FinalizationGroup):
        (callback):
        * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-length.js: Added.
        (fg.new.FinalizationGroup):
        (callback):
        * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-missing-internal-throws.js: Added.
        (fg.new.FinalizationGroup):
        (callback):
        * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-name.js: Added.
        (fg.new.FinalizationGroup):
        (callback):
        * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-not-object-throws.js: Added.
        (fg.new.FinalizationGroup):
        (callback):
        * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-prop-desc.js: Added.
        (fg.new.FinalizationGroup):
        (callback):
        * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/proto.js: Added.
        (callback):
        (fg.new.FinalizationGroup):
        * test262/test/built-ins/FinalizationGroup/constructor.js: Added.
        * test262/test/built-ins/FinalizationGroup/gc-has-one-chance-to-call-cleanupCallback.js: Added.
        (cb):
        (fg.new.FinalizationGroup):
        (emptyCells):
        (async.fn):
        (fn.then.async):
        * test262/test/built-ins/FinalizationGroup/instance-extensible.js: Added.
        (fg.new.FinalizationGroup):
        * test262/test/built-ins/FinalizationGroup/length.js: Added.
        * test262/test/built-ins/FinalizationGroup/name.js: Added.
        * test262/test/built-ins/FinalizationGroup/newtarget-prototype-is-not-object.js: Added.
        (newTarget):
        (fn):
        * test262/test/built-ins/FinalizationGroup/prop-desc.js: Added.
        * test262/test/built-ins/FinalizationGroup/proto-from-ctor-realm.js: Added.
        (fn):
        * test262/test/built-ins/FinalizationGroup/proto.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype-from-newtarget-abrupt.js: Added.
        (newTarget):
        * test262/test/built-ins/FinalizationGroup/prototype-from-newtarget-custom.js: Added.
        (newTarget):
        * test262/test/built-ins/FinalizationGroup/prototype-from-newtarget.js: Added.
        (fg.new.FinalizationGroup):
        * test262/test/built-ins/FinalizationGroup/prototype/Symbol.toStringTag.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/callback-iterator-proto.js: Added.
        (callback):
        (fg.new.FinalizationGroup):
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/callback-not-callable-throws.js: Added.
        (fg.new.FinalizationGroup):
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-prevented-with-reference.js: Added.
        (cb):
        (fg.new.FinalizationGroup):
        (emptyCells):
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-prevented-with-unregister.js: Added.
        (fg.new.FinalizationGroup):
        (fg.cleanupSome.cb):
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanupcallback-iterator-proto.js: Added.
        (callback):
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/custom-this.js: Added.
        (fn):
        (cb):
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/gc-cleanup-not-prevented-with-wr-deref.js: Added.
        (cb):
        (fg.new.FinalizationGroup):
        (emptyCells):
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/iterator-dynamic.js: Added.
        (fg.new.FinalizationGroup):
        (callback):
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/iterator-holdings-multiple-values.js: Added.
        (fg.new.FinalizationGroup):
        (callback):
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/length.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/name.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/poisoned-callback-throws.js: Added.
        (poisoned):
        (fg.new.FinalizationGroup):
        (emptyCells):
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/poisoned-cleanup-callback-throws.js: Added.
        (poisoned):
        (emptyCells):
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/prop-desc.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/return-undefined-with-gc.js: Added.
        (fn):
        (cb):
        (emptyCells):
        (prototype.assert.sameValue.fg.cleanupSome):
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/return-undefined.js: Added.
        (fn):
        (cb):
        (poisoned):
        (assert.sameValue.fg.cleanupSome):
        (prototype.assert.sameValue.fg.cleanupSome):
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/this-does-not-have-internal-cells-throws.js: Added.
        (cb):
        * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/this-not-object-throws.js: Added.
        (cb):
        * test262/test/built-ins/FinalizationGroup/prototype/constructor.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/prop-desc.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/proto.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/register/custom-this.js: Added.
        (fn):
        * test262/test/built-ins/FinalizationGroup/prototype/register/holdings-any-value-type.js: Added.
        (fn):
        * test262/test/built-ins/FinalizationGroup/prototype/register/holdings-same-as-target.js: Added.
        (fg.new.FinalizationGroup):
        * test262/test/built-ins/FinalizationGroup/prototype/register/length.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/register/name.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/register/prop-desc.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/register/return-undefined-register-itself.js: Added.
        (fn):
        * test262/test/built-ins/FinalizationGroup/prototype/register/return-undefined.js: Added.
        (fn):
        * test262/test/built-ins/FinalizationGroup/prototype/register/target-not-object-throws.js: Added.
        (fg.new.FinalizationGroup):
        * test262/test/built-ins/FinalizationGroup/prototype/register/this-does-not-have-internal-target-throws.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/register/this-not-object-throws.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-not-object-or-undefined-throws.js: Added.
        (fg.new.FinalizationGroup):
        * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-holdings-and-target.js: Added.
        (fg.new.FinalizationGroup):
        * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-holdings.js: Added.
        (fg.new.FinalizationGroup):
        * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-target.js: Added.
        (fg.new.FinalizationGroup):
        * test262/test/built-ins/FinalizationGroup/prototype/unregister/custom-this.js: Added.
        (fn):
        * test262/test/built-ins/FinalizationGroup/prototype/unregister/length.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/unregister/name.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/unregister/prop-desc.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/unregister/this-does-not-have-internal-cells-throws.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/unregister/this-not-object-throws.js: Added.
        * test262/test/built-ins/FinalizationGroup/prototype/unregister/unregister.js: Added.
        (fn):
        * test262/test/built-ins/FinalizationGroup/prototype/unregister/unregisterToken-not-object-throws.js: Added.
        (fg.new.FinalizationGroup):
        * test262/test/built-ins/FinalizationGroup/returns-new-object-from-constructor.js: Added.
        (cleanupCallback):
        (let.key.of.Object.getOwnPropertyNames):
        (set for):
        * test262/test/built-ins/FinalizationGroup/target-not-callable-throws.js: Added.
        * test262/test/built-ins/FinalizationGroup/undefined-newtarget-throws.js: Added.
        (FinalizationGroup):
        * test262/test/built-ins/FinalizationGroup/unnaffected-by-poisoned-cleanupCallback.js: Added.
        (cleanupCallback):
        (let.key.of.Object.getOwnPropertyNames):
        (set for):
        * test262/test/built-ins/Function/StrictFunction_restricted-properties.js:
        * test262/test/built-ins/Function/prototype/bind/BoundFunction_restricted-properties.js:
        * test262/test/built-ins/Function/prototype/restricted-property-arguments.js:
        * test262/test/built-ins/Function/prototype/restricted-property-caller.js:
        * test262/test/built-ins/Object/prototype/toString/proxy-function-async.js: Added.
        (asyncProxy.new.Proxy.async):
        * test262/test/built-ins/Object/prototype/toString/proxy-function.js:
        (asyncProxy.new.Proxy.async):
        * test262/test/built-ins/Object/prototype/toString/symbol-tag-non-str-builtin.js: Added.
        (setIter.set Symbol):
        (set defaultTag):
        (gen):
        (get return):
        (set new):
        * test262/test/built-ins/Object/prototype/toString/symbol-tag-non-str-proxy-function.js: Added.
        (generatorProxy.new.Proxy):
        (asyncProxy.new.Proxy.async):
        * test262/test/built-ins/Object/subclass-object-arg.js:
        * test262/test/built-ins/Promise/all/invoke-resolve-get-error-close.js:
        * test262/test/built-ins/Promise/all/resolve-element-function-name.js:
        * test262/test/built-ins/Promise/allSettled/invoke-resolve-get-error-close.js:
        * test262/test/built-ins/Promise/allSettled/reject-element-function-name.js:
        * test262/test/built-ins/Promise/allSettled/resolve-element-function-name.js:
        * test262/test/built-ins/Promise/executor-function-name.js:
        * test262/test/built-ins/Promise/race/invoke-resolve-get-error-close.js:
        * test262/test/built-ins/Promise/reject-function-name.js:
        * test262/test/built-ins/Promise/resolve-function-name.js:
        * test262/test/built-ins/Set/prototype/values/does-not-have-setdata-internal-slot-weakset.js:
        * test262/test/built-ins/WeakRef/constructor.js: Added.
        * test262/test/built-ins/WeakRef/instance-extensible.js: Added.
        * test262/test/built-ins/WeakRef/length.js: Added.
        * test262/test/built-ins/WeakRef/name.js: Added.
        * test262/test/built-ins/WeakRef/newtarget-prototype-is-not-object.js: Added.
        (newTarget):
        * test262/test/built-ins/WeakRef/prop-desc.js: Added.
        * test262/test/built-ins/WeakRef/proto-from-ctor-realm.js: Added.
        * test262/test/built-ins/WeakRef/proto.js: Added.
        * test262/test/built-ins/WeakRef/prototype-from-newtarget-abrupt.js: Added.
        (newTarget):
        * test262/test/built-ins/WeakRef/prototype-from-newtarget-custom.js: Added.
        (newTarget):
        * test262/test/built-ins/WeakRef/prototype-from-newtarget.js: Added.
        * test262/test/built-ins/WeakRef/prototype/Symbol.toStringTag.js: Added.
        * test262/test/built-ins/WeakRef/prototype/constructor.js: Added.
        * test262/test/built-ins/WeakRef/prototype/deref/custom-this.js: Added.
        * test262/test/built-ins/WeakRef/prototype/deref/gc-cleanup-not-prevented-with-wr-deref.js: Added.
        (emptyCells):
        * test262/test/built-ins/WeakRef/prototype/deref/length.js: Added.
        * test262/test/built-ins/WeakRef/prototype/deref/name.js: Added.
        * test262/test/built-ins/WeakRef/prototype/deref/prop-desc.js: Added.
        * test262/test/built-ins/WeakRef/prototype/deref/return-target.js: Added.
        * test262/test/built-ins/WeakRef/prototype/deref/this-does-not-have-internal-target-throws.js: Added.
        (fg.new.FinalizationGroup):
        * test262/test/built-ins/WeakRef/prototype/deref/this-not-object-throws.js: Added.
        * test262/test/built-ins/WeakRef/prototype/prop-desc.js: Added.
        * test262/test/built-ins/WeakRef/prototype/proto.js: Added.
        * test262/test/built-ins/WeakRef/returns-new-object-from-constructor.js: Added.
        (let.key.of.Object.getOwnPropertyNames):
        (set for):
        * test262/test/built-ins/WeakRef/target-not-object-throws.js: Added.
        * test262/test/built-ins/WeakRef/undefined-newtarget-throws.js: Added.
        * test262/test/intl402/BigInt/prototype/toLocaleString/builtin.js:
        * test262/test/intl402/BigInt/prototype/toLocaleString/default-options-object-prototype.js:
        * test262/test/intl402/BigInt/prototype/toLocaleString/length.js:
        * test262/test/intl402/BigInt/prototype/toLocaleString/returns-same-results-as-NumberFormat.js:
        * test262/test/intl402/BigInt/prototype/toLocaleString/taint-Intl-NumberFormat.js:
        * test262/test/intl402/BigInt/prototype/toLocaleString/this-value-invalid.js:
        * test262/test/intl402/BigInt/prototype/toLocaleString/throws-same-exceptions-as-NumberFormat.js:
        * test262/test/intl402/DateTimeFormat/constructor-options-order-quarter.js: Removed.
        * test262/test/intl402/DateTimeFormat/constructor-options-quarter-invalid.js: Removed.
        * test262/test/intl402/DateTimeFormat/constructor-options-quarter-valid.js: Removed.
        * test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-long-en.js: Added.
        * test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-narrow-en.js: Added.
        * test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-short-en.js: Added.
        * test262/test/intl402/DateTimeFormat/prototype/format/fractionalSecondDigits.js: Added.
        * test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-date-string.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-near-time-boundaries.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-to-integer.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRange/builtin.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRange/prop-desc.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-date-string.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-near-time-boundaries.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-to-integer.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/builtin.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/prop-desc.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-long-en.js: Added.
        (assertParts):
        (assertPartsNumeric):
        * test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-narrow-en.js: Added.
        (assertParts):
        (assertPartsNumeric):
        * test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-short-en.js: Added.
        (assertParts):
        (assertPartsNumeric):
        * test262/test/intl402/DateTimeFormat/prototype/formatToParts/fractionalSecondDigits.js: Added.
        (assertParts):
        * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/order-quarter.js: Removed.
        * test262/test/intl402/DateTimeFormat/taint-Object-prototype-quarter.js: Removed.
        * test262/test/intl402/RelativeTimeFormat/prototype/format/en-us-numeric-auto.js:
        * test262/test/intl402/RelativeTimeFormat/prototype/formatToParts/en-us-numeric-auto.js:
        * test262/test/language/expressions/arrow-function/ArrowFunction_restricted-properties.js:
        * test262/test/language/expressions/class/elements/private-field-access-on-inner-arrow-function.js: Added.
        (C.prototype.method):
        * test262/test/language/expressions/class/elements/private-field-access-on-inner-function.js: Added.
        (C.prototype.method.innerFunction):
        (C.prototype.method):
        * test262/test/language/expressions/class/elements/private-getter-access-on-inner-arrow-function.js: Added.
        (C):
        (C.method):
        * test262/test/language/expressions/class/elements/private-getter-access-on-inner-function.js: Added.
        (C):
        (C.method.innerFunction):
        (C.method):
        * test262/test/language/expressions/class/elements/private-getter-is-not-a-own-property.js: Added.
        (C):
        (C.checkPrivateGetter):
        * test262/test/language/expressions/class/elements/private-method-access-on-inner-arrow-function.js: Added.
        (C):
        (C.method):
        * test262/test/language/expressions/class/elements/private-method-access-on-inner-function.js: Added.
        (C):
        (C.method.innerFunction):
        (C.method):
        * test262/test/language/expressions/class/elements/private-method-is-not-a-own-property.js: Added.
        (C):
        (C.checkPrivateMethod):
        * test262/test/language/expressions/class/elements/private-setter-access-on-inner-arrow-function.js: Added.
        (C):
        (C.method):
        * test262/test/language/expressions/class/elements/private-setter-access-on-inner-function.js: Added.
        (C):
        (C.method.innerFunction):
        (C.method):
        * test262/test/language/expressions/class/elements/private-setter-is-not-a-own-property.js: Added.
        (C):
        (C.checkPrivateSetter):
        * test262/test/language/expressions/class/elements/prod-private-getter-before-super-return-in-field-initializer.js:
        * test262/test/language/expressions/class/elements/prod-private-method-before-super-return-in-field-initializer.js:
        * test262/test/language/expressions/class/elements/prod-private-setter-before-super-return-in-field-initializer.js:
        * test262/test/language/expressions/class/poisoned-underscore-proto.js: Added.
        * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (let.classStringExpression):
        (let.classStringExpression.access):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (let.classStringExpression):
        (let.classStringExpression.access):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (const.C):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (let.classStringExpression.return.prototype.m):
        (let.classStringExpression.return.prototype.access):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (let.classStringExpression.return.prototype.m):
        (let.classStringExpression.return.prototype.access):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (let.classStringExpression):
        (let.classStringExpression.access):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (let.classStringExpression.prototype.m):
        (let.classStringExpression.prototype.access):
        (let.classStringExpression):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (let.classStringExpression.prototype.m):
        (let.classStringExpression.prototype.access):
        (let.classStringExpression):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (const.C):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (let.classStringExpression.return.C.prototype.m):
        (let.classStringExpression.return.C.prototype.access):
        (let.classStringExpression.return.C):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (let.classStringExpression.return.C.prototype.m):
        (let.classStringExpression.return.C.prototype.access):
        (let.classStringExpression.return.C):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (let.classStringExpression):
        (let.classStringExpression.access):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (let.classStringExpression):
        (let.classStringExpression.access):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (let.classStringExpression):
        (let.classStringExpression.access):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (const.C):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (let.classStringExpression.return.prototype.m):
        (let.classStringExpression.return.prototype.access):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (let.classStringExpression.return.prototype.m):
        (let.classStringExpression.return.prototype.access):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
        (let.classStringExpression):
        (let.classStringExpression.access):
        (let.createAndInstantiateClass):
        * test262/test/language/expressions/new.target/unary-expr.js: Added.
        (new):
        (async):
        * test262/test/language/expressions/super/call-poisoned-underscore-proto.js: Added.
        (A):
        * test262/test/language/expressions/super/prop-poisoned-underscore-proto.js: Added.
        * test262/test/language/identifiers/vals-cjk-escaped.js: Added.
        * test262/test/language/identifiers/vals-cjk.js: Added.
        * test262/test/language/statements/class/elements/private-class-field-on-frozen-objects.js:
        * test262/test/language/statements/class/elements/private-field-access-on-inner-arrow-function.js: Added.
        (C.prototype.method):
        (C):
        * test262/test/language/statements/class/elements/private-field-access-on-inner-function.js: Added.
        (C.prototype.method.innerFunction):
        (C.prototype.method):
        (C):
        * test262/test/language/statements/class/elements/private-field-is-not-clobbered-by-computed-property.js: Added.
        (C.prototype.checkPrivateField):
        (C):
        * test262/test/language/statements/class/elements/private-field-visible-to-direct-eval-on-initializer.js: Added.
        (C):
        * test262/test/language/statements/class/elements/private-field-visible-to-direct-eval.js: Added.
        (C.prototype.getWithEval):
        (C):
        (D):
        * test262/test/language/statements/class/elements/private-getter-access-on-inner-arrow-function.js: Added.
        (C.prototype.get m):
        (C.prototype.method):
        (C):
        * test262/test/language/statements/class/elements/private-getter-access-on-inner-function.js: Added.
        (C.prototype.get m):
        (C.prototype.method.innerFunction):
        (C.prototype.method):
        (C):
        * test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js:
        (let.createAndInstantiateClass):
        * test262/test/language/statements/class/elements/private-getter-is-not-a-own-property.js: Added.
        (C.prototype.get m):
        (C.prototype.checkPrivateGetter):
        (C):
        * test262/test/language/statements/class/elements/private-getter-is-not-clobbered-by-computed-property.js: Added.
        (C.prototype.get m):
        (C.prototype.checkPrivateGetter):
        (C):
        * test262/test/language/statements/class/elements/private-getter-visible-to-direct-eval-on-initializer.js: Added.
        (C.prototype.get m):
        (C):
        * test262/test/language/statements/class/elements/private-getter-visible-to-direct-eval.js: Added.
        (C.prototype.get m):
        (C.prototype.getWithEval):
        (C):
        (D.prototype.get m):
        (D):
        * test262/test/language/statements/class/elements/private-method-access-on-inner-arrow-function.js: Added.
        (C.prototype.m):
        (C.prototype.method):
        (C):
        * test262/test/language/statements/class/elements/private-method-access-on-inner-function.js: Added.
        (C.prototype.m):
        (C.prototype.method.innerFunction):
        (C.prototype.method):
        (C):
        * test262/test/language/statements/class/elements/private-method-is-not-a-own-property.js: Added.
        (C.prototype.m):
        (C.prototype.checkPrivateMethod):
        (C):
        * test262/test/language/statements/class/elements/private-method-is-not-clobbered-by-computed-property.js: Added.
        (C.prototype.m):
        (C.prototype.checkPrivateMethod):
        (C):
        * test262/test/language/statements/class/elements/private-method-visible-to-direct-eval-on-initializer.js: Added.
        (C.prototype.m):
        (C):
        * test262/test/language/statements/class/elements/private-method-visible-to-direct-eval.js: Added.
        (C.prototype.m):
        (C.prototype.getWithEval):
        (C):
        (D.prototype.m):
        (D):
        * test262/test/language/statements/class/elements/private-setter-access-on-inner-arrow-function.js: Added.
        (C.prototype.set m):
        (C.prototype.method):
        (C):
        * test262/test/language/statements/class/elements/private-setter-access-on-inner-function.js: Added.
        (C.prototype.set m):
        (C.prototype.method.innerFunction):
        (C.prototype.method):
        (C):
        * test262/test/language/statements/class/elements/private-setter-is-not-a-own-property.js: Added.
        (C.prototype.set m):
        (C.prototype.checkPrivateSetter):
        (C):
        * test262/test/language/statements/class/elements/private-setter-is-not-clobbered-by-computed-property.js: Added.
        (C.prototype.set m):
        (C.prototype.checkPrivateSetter):
        (C):
        * test262/test/language/statements/class/elements/private-setter-visible-to-direct-eval-on-initializer.js: Added.
        (C.prototype.set m):
        (C):
        * test262/test/language/statements/class/elements/private-setter-visible-to-direct-eval.js: Added.
        (C.prototype.set m):
        (C.prototype.setWithEval):
        (C):
        (D.prototype.set m):
        (D):
        * test262/test/language/statements/class/elements/prod-private-getter-before-super-return-in-field-initializer.js:
        * test262/test/language/statements/class/elements/prod-private-method-before-super-return-in-field-initializer.js:
        * test262/test/language/statements/class/elements/prod-private-setter-before-super-return-in-field-initializer.js:
        * test262/test/language/statements/class/elements/super-access-inside-a-private-getter.js: Added.
        (A.prototype.method):
        (A):
        (C.prototype.get m):
        (C.prototype.access):
        (C):
        * test262/test/language/statements/class/elements/super-access-inside-a-private-method.js: Added.
        (A.prototype.method):
        (A):
        (C.prototype.m):
        (C.prototype.access):
        (C):
        * test262/test/language/statements/class/elements/super-access-inside-a-private-setter.js: Added.
        (A.prototype.method):
        (A):
        (C.prototype.set m):
        (C.prototype.access):
        (C):
        * test262/test/language/statements/class/poisoned-underscore-proto.js: Added.
        (A):
        * test262/test/language/statements/function/13.2-30-s.js:
        * test262/test262-Revision.txt:

2019-07-15  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Improve wasm wpt test results by fixing miscellaneous issues
        https://bugs.webkit.org/show_bug.cgi?id=199783

        Reviewed by Mark Lam.

        Fix our spec tests.

        * wasm/js-api/Module-compile.js:
        * wasm/js-api/test_basic_api.js:
        (const.c.in.constructorProperties.switch):
        * wasm/js-api/validate.js:
        * wasm/js-api/web-assembly-instantiate.js:
        * wasm/spec-tests/jsapi.js:
        (testJSAPI.get test):
        (testJSAPI.set test):

2019-07-15  Michael Catanzaro  <mcatanzaro@igalia.com>

        Unreviewed, rolling out r247440.

        Broke builds

        Reverted changeset:

        "[JSC] Improve wasm wpt test results by fixing miscellaneous
        issues"
        https://bugs.webkit.org/show_bug.cgi?id=199783
        https://trac.webkit.org/changeset/247440

2019-07-15  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Improve wasm wpt test results by fixing miscellaneous issues
        https://bugs.webkit.org/show_bug.cgi?id=199783

        Reviewed by Mark Lam.

        Fix our spec tests.

        * wasm/js-api/Module-compile.js:
        * wasm/js-api/test_basic_api.js:
        (const.c.in.constructorProperties.switch):
        * wasm/js-api/validate.js:
        * wasm/js-api/web-assembly-instantiate.js:
        * wasm/spec-tests/jsapi.js:
        (testJSAPI.get test):
        (testJSAPI.set test):

2019-07-12  Justin Michaud  <justin_michaud@apple.com>

        B3 should reduce (integer) Sub(Neg(x), y) to Neg(Add(x, y))
        https://bugs.webkit.org/show_bug.cgi?id=196371

        Reviewed by Keith Miller.

        * microbenchmarks/mul-immediate-sub.js: Added.
        (doTest):

2019-07-12  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] Add ValueBitLShift into DFG
        https://bugs.webkit.org/show_bug.cgi?id=192664

        Reviewed by Saam Barati.

        We are adding tests to cover ValueBitwise operations AI changes.

        * stress/big-int-left-shift-untyped.js: Added.
        * stress/bit-op-with-object-returning-int32.js:
        * stress/value-bit-and-ai-rule.js: Added.
        * stress/value-bit-lshift-ai-rule.js: Added.
        * stress/value-bit-or-ai-rule.js: Added.
        * stress/value-bit-xor-ai-rule.js: Added.

2019-07-11  Justin Michaud  <justin_michaud@apple.com>

        Add b3 macro lowering for CheckMul on arm64
        https://bugs.webkit.org/show_bug.cgi?id=199251

        Reviewed by Robin Morisset.

        * microbenchmarks/check-mul-constant.js: Added.
        (doTest):
        * microbenchmarks/check-mul-no-constant.js: Added.
        (doTest):
        * microbenchmarks/check-mul-power-of-two.js: Added.
        (doTest):

2019-07-10  Tadeu Zagallo  <tzagallo@apple.com>

        Optimize join of large empty arrays
        https://bugs.webkit.org/show_bug.cgi?id=199636

        Reviewed by Mark Lam.

        * microbenchmarks/large-empty-array-join.js: Added.
        * microbenchmarks/large-empty-array-join-resolve-rope.js: Added.

2019-07-06  Michael Saboff  <msaboff@apple.com>

        switch(String) needs to check for exceptions when resolving the string
        https://bugs.webkit.org/show_bug.cgi?id=199541

        Reviewed by Mark Lam.

        New tests.

        * stress/switch-string-oom.js: Added.
        (test):
        (testLowerTiers):
        (testFTL):

2019-07-05  Mark Lam  <mark.lam@apple.com>

        ArgumentsEliminationPhase::eliminateCandidatesThatInterfere() should not decrement nodeIndex pass zero.
        https://bugs.webkit.org/show_bug.cgi?id=199533
        <rdar://problem/52669111>

        Reviewed by Filip Pizlo.

        * stress/ArgumentsEliminationPhase-eliminateCandidatesThatEscape-should-not-decrement-nodeIndex-pass-zero.js: Added.

2019-07-05  Alexey Shvayka  <shvaikalesh@gmail.com>

        [JSC] Clean up ArraySpeciesCreate
        https://bugs.webkit.org/show_bug.cgi?id=182434

        Reviewed by Yusuke Suzuki.

        Adjusts error message expectations in stress tests.

        * stress/array-flatmap.js:
        * stress/array-flatten.js:
        * stress/array-species-create-should-handle-masquerader.js:
        * test262/expectations.yaml: Mark 4 test cases as passing.

2019-07-02  Michael Saboff  <msaboff@apple.com>

        Exception from For..of loop assignment eliminates TDZ checks in subsequent code
        https://bugs.webkit.org/show_bug.cgi?id=199395

        Reviewed by Filip Pizlo.

        New regession test.

        * stress/for-of-tdz-with-try-catch.js: Added.
        (test):
        (i.catch):

2019-07-02  Keith Miller  <keith_miller@apple.com>

        Frozen Arrays length assignment should throw in strict mode
        https://bugs.webkit.org/show_bug.cgi?id=199365

        Reviewed by Yusuke Suzuki.

        * stress/frozen-array-length-should-throw-strict.js: Added.
        (test):

2019-07-01  Justin Michaud  <justin_michaud@apple.com>

        [Wasm-References] Disable references by default
        https://bugs.webkit.org/show_bug.cgi?id=199390

        Reviewed by Saam Barati.

        * wasm/references-spec-tests/ref_is_null.js:
        * wasm/references-spec-tests/ref_null.js:
        * wasm/references/anyref_globals.js:
        * wasm/references/anyref_modules.js:
        * wasm/references/anyref_table.js:
        * wasm/references/anyref_table_import.js:
        * wasm/references/element_parsing.js:
        * wasm/references/func_ref.js:
        * wasm/references/is_null.js:
        * wasm/references/multitable.js:
        * wasm/references/table_misc.js:
        * wasm/references/validation.js:

2019-07-01  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r246946.

        Caused JSC test crashes on arm64

        Reverted changeset:

        "Add b3 macro lowering for CheckMul on arm64"
        https://bugs.webkit.org/show_bug.cgi?id=199251
        https://trac.webkit.org/changeset/246946

2019-06-28  Justin Michaud  <justin_michaud@apple.com>

        Add b3 macro lowering for CheckMul on arm64
        https://bugs.webkit.org/show_bug.cgi?id=199251

        Reviewed by Robin Morisset.

        * microbenchmarks/check-mul-constant.js: Added.
        (doTest):
        * microbenchmarks/check-mul-no-constant.js: Added.
        (doTest):
        * microbenchmarks/check-mul-power-of-two.js: Added.
        (doTest):

2019-06-26  Keith Miller  <keith_miller@apple.com>

        speciesConstruct needs to throw if the result is a DataView
        https://bugs.webkit.org/show_bug.cgi?id=199231

        Reviewed by Mark Lam.

        * stress/typedarray-filter.js:
        (subclasses.forEach):
        * stress/typedarray-map.js:
        (subclasses.forEach):
        * stress/typedarray-slice.js:
        (typedArrays.forEach):
        * stress/typedarray-subarray.js:
        (subclasses.forEach):

2019-06-24  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r246714.
        https://bugs.webkit.org/show_bug.cgi?id=199179

        revert to do patch in a different way. (Requested by keith_mi_
        on #webkit).

        Reverted changeset:

        "All prototypes should call didBecomePrototype()"
        https://bugs.webkit.org/show_bug.cgi?id=196315
        https://trac.webkit.org/changeset/246714

2019-06-24  Alexey Shvayka  <shvaikalesh@gmail.com>

        Add Array.prototype.{flat,flatMap} to unscopables
        https://bugs.webkit.org/show_bug.cgi?id=194322

        Reviewed by Keith Miller.

        * stress/unscopables.js: Fix test.
        * test262/expectations.yaml: Mark 2 test cases as passing.

2019-06-21  Mark Lam  <mark.lam@apple.com>

        ArraySlice needs to keep the source array alive.
        https://bugs.webkit.org/show_bug.cgi?id=197374
        <rdar://problem/50304429>

        Reviewed by Michael Saboff and Filip Pizlo.

        * stress/array-slice-must-keep-source-array-alive.js: Added.

2019-06-22  Robin Morisset  <rmorisset@apple.com> and Yusuke Suzuki  <ysuzuki@apple.com>

        All prototypes should call didBecomePrototype()
        https://bugs.webkit.org/show_bug.cgi?id=196315

        Reviewed by Saam Barati.

        * stress/function-prototype-indexed-accessor.js: Added.

2019-06-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Strict, Sloppy and Arrow functions should have different classInfo
        https://bugs.webkit.org/show_bug.cgi?id=197631

        Reviewed by Saam Barati.

        * stress/has-own-property-arguments.js: Added.
        (shouldBe):
        (A):

2019-06-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] ClassExpr should not store result in the middle of evaluation
        https://bugs.webkit.org/show_bug.cgi?id=199106

        Reviewed by Tadeu Zagallo.

        * stress/class-expression-should-store-result-at-last.js: Added.
        (shouldThrow):
        (shouldThrow.let.a):

2019-06-20  Justin Michaud  <justin_michaud@apple.com>

        [WASM-References] Add extra tests for Wasm references + fix element parsing and subtyping bugs
        https://bugs.webkit.org/show_bug.cgi?id=199044

        Reviewed by Saam Barati.

        Add wasm references spec tests as well as a worker test.

        * wasm.yaml:
        * wasm/Builder_WebAssemblyBinary.js:
        (const.emitters.Element):
        * wasm/js-api/element.js:
        (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
        * wasm/references-spec-tests/ref_is_null.js: Added.
        (hostref):
        (is_hostref):
        (is_funcref):
        (eq_ref):
        (let.handler.get target):
        (register):
        (module):
        (instance):
        (call):
        (get instance):
        (exports):
        (run):
        (assert_malformed):
        (assert_invalid):
        (assert_unlinkable):
        (assert_uninstantiable):
        (assert_trap):
        (try.f):
        (catch):
        (assert_exhaustion):
        (assert_return):
        (assert_return_canonical_nan):
        (assert_return_arithmetic_nan):
        (assert_return_ref):
        (assert_return_func):
        * wasm/references-spec-tests/ref_null.js: Added.
        (hostref):
        (is_hostref):
        (is_funcref):
        (eq_ref):
        (let.handler.get target):
        (register):
        (module):
        (instance):
        (call):
        (get instance):
        (exports):
        (run):
        (assert_malformed):
        (assert_invalid):
        (assert_unlinkable):
        (assert_uninstantiable):
        (assert_trap):
        (try.f):
        (catch):
        (assert_exhaustion):
        (assert_return):
        (assert_return_canonical_nan):
        (assert_return_arithmetic_nan):
        (assert_return_ref):
        (assert_return_func):
        * wasm/references/element_parsing.js: Added.
        (module):
        * wasm/references/func_ref.js:
        * wasm/references/multitable.js:
        * wasm/references/table_misc.js:
        (TableSize.0.End.End.WebAssembly):
        * wasm/references/validation.js:
        (assert.throws):

2019-06-19  Alexey Shvayka  <shvaikalesh@gmail.com>

        Optimize `resolve` method lookup in Promise static methods
        https://bugs.webkit.org/show_bug.cgi?id=198864

        Reviewed by Yusuke Suzuki.

        * test262/expectations.yaml: Mark 18 test cases as passing.

2019-06-19  Justin Michaud  <justin_michaud@apple.com>

        [WASM-References] Rename anyfunc to funcref
        https://bugs.webkit.org/show_bug.cgi?id=198983

        Reviewed by Yusuke Suzuki.

        * wasm/function-tests/basic-element.js:
        * wasm/function-tests/context-switch.js:
        (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
        (makeInstance):
        (assert.eq.makeInstance):
        * wasm/function-tests/exceptions.js:
        (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
        * wasm/function-tests/grow-memory-2.js:
        (assert.eq.instance.exports.foo):
        * wasm/function-tests/nameSection.js:
        (const.compile):
        * wasm/function-tests/stack-overflow.js:
        (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
        (assertOverflows.makeInstance):
        * wasm/function-tests/table-basic-2.js:
        (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
        * wasm/function-tests/table-basic.js:
        (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
        * wasm/function-tests/trap-from-start-async.js:
        * wasm/function-tests/trap-from-start.js:
        * wasm/js-api/Module.exports.js:
        (assert.truthy):
        * wasm/js-api/Module.imports.js:
        (assert.truthy):
        * wasm/js-api/call-indirect.js:
        (const.oneTable):
        (const.multiTable):
        (multiTable.const.makeTable):
        (multiTable):
        (multiTable.Polyphic2Import):
        (multiTable.VirtualImport):
        * wasm/js-api/element-data.js:
        * wasm/js-api/element.js:
        (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
        (assert.throws):
        (badInstantiation.makeModule):
        (badInstantiation.test):
        (badInstantiation):
        * wasm/js-api/extension-MemoryMode.js:
        * wasm/js-api/table.js:
        (new.WebAssembly.Module):
        (assert.throws):
        (assertBadTableImport):
        (assert.throws.WebAssembly.Table.prototype.grow):
        (new.WebAssembly.Table):
        (assertBadTable):
        (assert.truthy):
        * wasm/js-api/test_basic_api.js:
        (const.c.in.constructorProperties.switch):
        * wasm/js-api/unique-signature.js:
        (CallIndirectWithDuplicateSignatures):
        * wasm/js-api/wrapper-function.js:
        * wasm/modules/table.wat:
        * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat:
        * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat:
        * wasm/modules/wasm-imports-wasm-exports/imports.wat:
        * wasm/modules/wasm-imports-wasm-exports/sum.wat:
        * wasm/references/anyref_table.js:
        * wasm/references/anyref_table_import.js:
        (doSet):
        (assert.throws):
        * wasm/references/func_ref.js:
        (makeFuncrefIdent):
        (assert.eq.instance.exports.fix):
        (GetLocal.0.I32Const.0.TableSet.0.End.End.WebAssembly.assert.throws):
        (GetLocal.0.I32Const.0.TableSet.0.End.End.WebAssembly):
        (let.importedFun.of):
        (makeAnyfuncIdent): Deleted.
        (makeAnyfuncIdent.fun): Deleted.
        * wasm/references/multitable.js:
        (assert.eq):
        (assert.throws):
        * wasm/references/table_misc.js:
        (GetLocal.0.TableFill.0.End.End.WebAssembly):
        * wasm/references/validation.js:
        (assert.throws.new.WebAssembly.Module.bin):
        (assert.throws):
        * wasm/spec-harness/index.js:
        * wasm/spec-harness/wasm-constants.js:
        * wasm/spec-harness/wasm-module-builder.js:
        (WasmModuleBuilder.prototype.toArray):
        * wasm/spec-harness/wast.js:
        (elem_type):
        (string_of_elem_type):
        (string_of_table_type):
        * wasm/spec-tests/jsapi.js:
        * wasm/stress/wasm-table-grow-initialize.js:
        * wasm/wasm.json:

2019-06-18  Justin Michaud  <justin_michaud@apple.com>

        [WASM-References] Add support for Table.size, grow and fill instructions
        https://bugs.webkit.org/show_bug.cgi?id=198761

        Reviewed by Yusuke Suzuki.

        * wasm/Builder_WebAssemblyBinary.js:
        (const.putOp):
        * wasm/references/table_misc.js: Added.
        (TableSize.End.End.WebAssembly):
        (GetLocal.0.GetLocal.1.TableGrow.End.End.WebAssembly):
        * wasm/wasm.json:

2019-06-18  Justin Michaud  <justin_michaud@apple.com>

        [WASM-References] Add support for multiple tables
        https://bugs.webkit.org/show_bug.cgi?id=198760

        Reviewed by Saam Barati.

        * wasm/Builder.js:
        * wasm/js-api/call-indirect.js:
        (const.oneTable):
        (const.multiTable):
        (multiTable):
        (multiTable.Polyphic2Import):
        (multiTable.VirtualImport):
        (const.wasmModuleWhichImportJS): Deleted.
        (const.makeTable): Deleted.
        (): Deleted.
        (Polyphic2Import): Deleted.
        (VirtualImport): Deleted.
        * wasm/js-api/table.js:
        (new.WebAssembly.Module):
        (assert.throws):
        (assertBadTableImport):
        (assert.truthy):
        (assert.throws.new.WebAssembly.Module.builder.WebAssembly): Deleted.
        * wasm/references/anyref_table.js:
        * wasm/references/anyref_table_import.js:
        (makeImport):
        (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport):
        (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl):
        * wasm/references/multitable.js: Added.
        (assert.throws.1.exports.set_tbl0):
        (assert.throws):
        (assert.eq):
        * wasm/references/validation.js:
        (assert.throws.new.WebAssembly.Module.bin):
        (assert.throws):
        * wasm/spec-tests/imports.wast.js:
        * wasm/wasm.json:

        * wasm/Builder.js:
        * wasm/js-api/call-indirect.js:
        (const.oneTable):
        (const.multiTable):
        (multiTable):
        (multiTable.Polyphic2Import):
        (multiTable.VirtualImport):
        (const.wasmModuleWhichImportJS): Deleted.
        (const.makeTable): Deleted.
        (): Deleted.
        (Polyphic2Import): Deleted.
        (VirtualImport): Deleted.
        * wasm/js-api/table.js:
        (new.WebAssembly.Module):
        (assert.throws):
        (assertBadTableImport):
        (assert.truthy):
        (assert.throws.new.WebAssembly.Module.builder.WebAssembly): Deleted.
        * wasm/references/anyref_table.js:
        * wasm/references/anyref_table_import.js:
        (makeImport):
        (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport):
        (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl):
        * wasm/references/func_ref.js:
        (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.fun): Deleted.
        (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.assert.throws): Deleted.
        (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly): Deleted.
        * wasm/references/multitable.js: Added.
        (assert.throws.1.exports.set_tbl0):
        (assert.throws):
        (assert.eq):
        (string_appeared_here.tableInsanity):
        (I32Const.0.GetLocal.0.TableSet.1.End.End.WebAssembly.):
        (I32Const.0.GetLocal.0.TableSet.1.End.End.WebAssembly):
        * wasm/references/validation.js:
        (assert.throws.new.WebAssembly.Module.bin):
        (assert.throws):
        * wasm/spec-tests/imports.wast.js:
        * wasm/wasm.json:

2019-06-18  Alexey Shvayka  <shvaikalesh@gmail.com>

        [ESNExt] String.prototype.matchAll
        https://bugs.webkit.org/show_bug.cgi?id=186694

        Reviewed by Yusuke Suzuki.

        Implement String.prototype.matchAll.
        (https://tc39.es/ecma262/#sec-string.prototype.matchall)

        * test262/config.yaml:

2019-06-18  Tadeu Zagallo  <tzagallo@apple.com>

        DFG code should not reify the names of builtin functions with private names
        https://bugs.webkit.org/show_bug.cgi?id=198849
        <rdar://problem/51733890>

        Reviewed by Filip Pizlo.

        * stress/builtin-private-function-name.js: Added.
        (then):
        (PromiseLike):

2019-06-18  Keith Miller  <keith_miller@apple.com>

        MaybeParseAsGeneratorForScope sometimes loses track of its scope ref
        https://bugs.webkit.org/show_bug.cgi?id=198969
        <rdar://problem/51620714>

        Reviewed by Tadeu Zagallo.

        * stress/nested-yield-in-arrow-function-should-be-a-syntax-error.js: Added.
        (catch):

2019-06-17  Justin Michaud  <justin_michaud@apple.com>

        Validate that table element type is funcref if using an element section
        https://bugs.webkit.org/show_bug.cgi?id=198910

        Reviewed by Yusuke Suzuki.

        * wasm/references/anyref_table.js:

2019-06-17  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Introduce DisposableCallSiteIndex to enforce type-safety
        https://bugs.webkit.org/show_bug.cgi?id=197378

        Reviewed by Saam Barati.

        * stress/disposable-call-site-index-with-call-and-this.js: Added.
        (foo):
        (bar):
        * stress/disposable-call-site-index.js: Added.
        (foo):
        (bar):

2019-06-17  Justin Michaud  <justin_michaud@apple.com>

        [WASM-References] Add support for Funcref in parameters and return types
        https://bugs.webkit.org/show_bug.cgi?id=198157

        Reviewed by Yusuke Suzuki.

        * wasm/Builder.js:
        (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
        * wasm/references/anyref_globals.js:
        * wasm/references/func_ref.js: Added.
        (fullGC.gc.makeExportedFunction):
        (makeExportedIdent):
        (makeAnyfuncIdent):
        (fun):
        (assert.eq.instance.exports.fix.fun):
        (assert.eq.instance.exports.fix):
        (string_appeared_here.End.End.Function.End.Code.End.WebAssembly.imp.ref):
        (string_appeared_here.End.End.Function.End.Code.End.WebAssembly):
        (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.fun):
        (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.assert.throws):
        (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly):
        (assert.throws):
        (assert.throws.doTest):
        (let.importedFun.of):
        (makeAnyfuncIdent.fun):
        * wasm/references/validation.js:
        (assert.throws):
        * wasm/wasm.json:

2019-06-17  Ross Kirsling  <ross.kirsling@sony.com>

        Update test262 tests (2019.06.13)
        https://bugs.webkit.org/show_bug.cgi?id=198821

        Reviewed by Konstantin Tokarev.

        * test262/expectations.yaml:
        * test262/harness/:
        * test262/latest-changes-summary.txt:
        * test262/test/:
        * test262/test262-Revision.txt:

2019-06-16  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Grown region of WasmTable should be initialized with null
        https://bugs.webkit.org/show_bug.cgi?id=198903

        Reviewed by Saam Barati.

        * wasm/stress/wasm-table-grow-initialize.js: Added.
        (shouldBe):

2019-06-13  Yusuke Suzuki  <ysuzuki@apple.com>

        Yarr bytecode compilation failure should be gracefully handled
        https://bugs.webkit.org/show_bug.cgi?id=198700

        Reviewed by Michael Saboff.

        * stress/regexp-bytecode-compilation-fail.js: Added.
        (shouldThrow):

2019-06-12  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Polymorphic call stub's slow path should restore callee saves before performing tail call
        https://bugs.webkit.org/show_bug.cgi?id=198770

        Reviewed by Saam Barati.

        * stress/poly-call-stub-slow-path-should-restore-callee-saves-when-doing-tail-call.js: Added.
        (test):

2019-06-11  Alexey Shvayka  <shvaikalesh@gmail.com>

        JSC should throw if proxy set returns falsish in strict mode context
        https://bugs.webkit.org/show_bug.cgi?id=177398

        Reviewed by Yusuke Suzuki.

        1. Add coverage for Proxy `set` trap returning falsy value in strict mode.
        2. RegExp methods throw unless [[Set]] succeeds. Return `true` from Proxy `set` traps to fix the tests.

        * stress/proxy-set.js: Add 2 test cases.
        * stress/regexp-match-proxy.js: Fix test.
        * stress/regexp-replace-proxy.js: Fix test.

2019-06-11  Alexey Shvayka  <shvaikalesh@gmail.com>

        Error message for non-callable Proxy `construct` trap is misleading
        https://bugs.webkit.org/show_bug.cgi?id=198637

        Reviewed by Saam Barati.

        * stress/proxy-construct.js:

2019-06-10  Tadeu Zagallo  <tzagallo@apple.com>

        AI BitURShift's result should not be unsigned
        https://bugs.webkit.org/show_bug.cgi?id=198689
        <rdar://problem/51550063>

        Reviewed by Saam Barati.

        * stress/urshift-int32-overflow.js: Added.
        (foo.):
        (foo):

2019-06-11  Guillaume Emont  <guijemont@igalia.com>

        Skip stress/ftl-gettypedarrayoffset-wasteful.js on Arm/Linux

        Unreviewed gardening.

        * stress/ftl-gettypedarrayoffset-wasteful.js:
        Skipped on arm/linux as it always times out on the bot since a change
        between r246270 and r246278 inclusive.

2019-06-10  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] UnlinkedCodeBlock should be eventually jettisoned in VM mini mode
        https://bugs.webkit.org/show_bug.cgi?id=198023

        Reviewed by Saam Barati.

        * stress/reparsing-unlinked-codeblock.js: Added.
        (shouldBe):
        (hello):

2019-06-09  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use mergePrediction in ValuePow prediction propagation
        https://bugs.webkit.org/show_bug.cgi?id=198648

        Reviewed by Saam Barati.

        * stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js: Added.

2019-06-07  Tadeu Zagallo  <tzagallo@apple.com>

        AI should get GetterSetter structure from the base's GlobalObject for GetGetterSetterByOffset
        https://bugs.webkit.org/show_bug.cgi?id=198581
        <rdar://problem/51099753>

        Reviewed by Saam Barati.

        * stress/global-object-proto-getter.js: Added.
        (f):
        (test):

2019-06-05  Justin Michaud  <justin_michaud@apple.com>

        [WASM-References] Add support for Anyref tables, Table.get and Table.set (for Anyref only).
        https://bugs.webkit.org/show_bug.cgi?id=198398

        Reviewed by Saam Barati.

        * wasm/references/anyref_table.js: Added.
        (string_appeared_here.doGCSet):
        (doGCTest):
        (doGCSet.doGCTest.let.count.0.doBarrierSet):
        * wasm/references/anyref_table_import.js: Added.
        (makeImport):
        (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport):
        (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl):
        * wasm/references/is_null_error.js: Removed.
        * wasm/references/validation.js: Added.
        (assert.throws.new.WebAssembly.Module.bin):
        (assert.throws):
        * wasm/wasm.json:

2019-06-05  Justin Michaud  <justin_michaud@apple.com>

        WebAssembly: pow functions returns 0 when exponent 1.0 or -1.0
        https://bugs.webkit.org/show_bug.cgi?id=198106

        Reviewed by Saam Barati.

        * wasm/regress/selectf64.js: Added.
        * wasm/regress/selectf64.wasm: Added.
        * wasm/regress/selectf64.wat: Added.

2019-06-04  Tadeu Zagallo  <tzagallo@apple.com>

        Argument elimination should check transitive dependents for interference
        https://bugs.webkit.org/show_bug.cgi?id=198520
        <rdar://problem/50863343>

        Reviewed by Filip Pizlo.

        * stress/argument-elimination-inline-rest-past-kill.js: Added.
        (f2):
        (f3):

2019-06-04  Tadeu Zagallo  <tzagallo@apple.com>

        Argument elimination should check for negative indices in GetByVal
        https://bugs.webkit.org/show_bug.cgi?id=198302
        <rdar://problem/51188095>

        Reviewed by Filip Pizlo.

        * stress/eliminate-arguments-negative-rest-access.js: Added.
        (inlinee):
        (opt):

2019-06-03  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Implement support for "**"
        https://bugs.webkit.org/show_bug.cgi?id=190799

        Reviewed by Saam Barati.

        * stress/big-int-exp-basic.js: Added.
        * stress/big-int-exp-jit-osr.js: Added.
        * stress/big-int-exp-jit-untyped.js: Added.
        * stress/big-int-exp-jit.js: Added.
        * stress/big-int-exp-negative-exponent.js: Added.
        * stress/big-int-exp-to-primitive.js: Added.
        * stress/big-int-exp-type-error.js: Added.
        * stress/big-int-exp-wrapped-value.js: Added.
        * stress/value-pow-ai-rule.js: Added.

2019-05-30  Tadeu Zagallo  <tzagallo@apple.com> and Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Implement op_wide16 / op_wide32 and introduce 16bit version bytecode
        https://bugs.webkit.org/show_bug.cgi?id=197979

        Reviewed by Filip Pizlo.

        * stress/16bit-code.js: Added.
        (shouldBe):
        * stress/32bit-code.js: Added.
        (shouldBe):

2019-05-30  Justin Michaud  <justin_michaud@apple.com>

        oss-fuzz: jsc: Issue 15016: jsc: Abrt in JSC::Wasm::AirIRGenerator::addLocal (15016)
        https://bugs.webkit.org/show_bug.cgi?id=198355

        Reviewed by Saam Barati.

        * wasm/references/is_null.js:

2019-05-30  Stephan Szabo  <stephan.szabo@sony.com>

        [PlayStation] Skip additional tests on PlayStation
        https://bugs.webkit.org/show_bug.cgi?id=198352

        Reviewed by Don Olmstead.

        Skip pow test on PlayStation due to behavior difference in standard library.
        Skip incremental marking test due to OOM on PlayStation systems.

        * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js:
        * stress/math-pow-with-constants.js:
        * stress/pow-with-constants.js:

2019-05-28  Dean Jackson  <dino@apple.com>

        Implement Promise.allSettled
        https://bugs.webkit.org/show_bug.cgi?id=197600
        <rdar://problem/50483885>

        Reviewed by Keith Miller.

        Start testing Promise.allSettled. We pass most of the tests.
        The ones that fail are similar to the Promise.all tests we already fail.

        * test262/config.yaml: Remove Promise.allSettled from skipped tests.
        * test262/expectations.yaml: Add new expectations for allSettled tests.

2019-05-28  Michael Saboff  <msaboff@apple.com>

        [YARR] Properly handle RegExp's that require large ParenContext space
        https://bugs.webkit.org/show_bug.cgi?id=198065

        Reviewed by Keith Miller.

        New test.

        * stress/regexp-large-paren-context.js: Added.
        (testLargeRegExp):

2019-05-28  Tadeu Zagallo  <tzagallo@apple.com>

        JITOperations putByVal should mark negative array indices as out-of-bounds
        https://bugs.webkit.org/show_bug.cgi?id=198271

        Reviewed by Saam Barati.

        * microbenchmarks/get-by-val-negative-array-index.js:
        (foo):
        Update the getByVal microbenchmark added in r245769. This now shows that r245769
        is 4.2x faster than the previous commit.

        * microbenchmarks/put-by-val-negative-array-index.js: Added.
        (foo):

2019-05-25  Tadeu Zagallo  <tzagallo@apple.com>

        JITOperations getByVal should mark negative array indices as out-of-bounds
        https://bugs.webkit.org/show_bug.cgi?id=198229

        Reviewed by Saam Barati.

        * microbenchmarks/get-by-val-negative-array-index.js: Added.
        (foo):

2019-05-24  Justin Michaud  <justin_michaud@apple.com>

        [WASM-References] Support Anyref in globals
        https://bugs.webkit.org/show_bug.cgi?id=198102

        Reviewed by Saam Barati.

        Add test for anyrefs in globals, as well as adding a new RefNull initExpr for Builder.

        * wasm/Builder.js:
        (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
        * wasm/Builder_WebAssemblyBinary.js:
        (const.putInitExpr):
        * wasm/references/anyref_globals.js: Added.
        (GetGlobal.0.End.End.WebAssembly):
        (5.doGCSet):
        (doGCTest):
        (doGCSet.doGCTest.let.count.0.doBarrierSet):

2019-05-23  Tadeu Zagallo  <tzagallo@apple.com>

        DFG::OSREntry should not perform arity check
        https://bugs.webkit.org/show_bug.cgi?id=198189

        Reviewed by Saam Barati.

        * microbenchmarks/loop-osr-with-arity-mismatch.js: Added.
        (foo):

2019-05-23  Stephan Szabo  <stephan.szabo@sony.com>

        [PlayStation] Skip additional tests on PlayStation
        https://bugs.webkit.org/show_bug.cgi?id=198145

        Reviewed by Ross Kirsling.

        * exceptionFuzz.yaml:
        Add skip on hostOS playstation
        * executableAllocationFuzz.yaml:
        Add skip on hostOS playstation

2019-05-23  Tadeu Zagallo  <tzagallo@apple.com>

        createListFromArrayLike should throw if value is not an object
        https://bugs.webkit.org/show_bug.cgi?id=198138

        Reviewed by Yusuke Suzuki.

        * stress/create-list-from-array-like-not-object.js: Added.
        (testValid):
        (testInvalid):
        * stress/proxy-get-own-property-names-should-not-clear-previous-results.js:
        (opt):
        * stress/proxy-proto-enumerator.js: Added.
        (main):
        * stress/proxy-proto-own-keys.js: Added.
        (assert):
        (ownKeys):

2019-05-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] ArrayAllocationProfile should not access to butterfly in concurrent compiler
        https://bugs.webkit.org/show_bug.cgi?id=197809

        Reviewed by Michael Saboff.

        * stress/array-allocation-profile-should-not-update-itself-in-concurrent-compiler.js: Added.
        (foo):

2019-05-22  Ross Kirsling  <ross.kirsling@sony.com>

        [ESNext] Implement support for Numeric Separators
        https://bugs.webkit.org/show_bug.cgi?id=196351

        Reviewed by Keith Miller.

        * stress/numeric-literal-separators.js: Added.
        Add tests for feature.

        * test262/expectations.yaml:
        Mark 60 test cases as passing.

2019-05-22  Tadeu Zagallo  <tzagallo@apple.com>

        llint_slow_path_get_by_id needs to hold the CodeBlock's to update the metadata's mode
        https://bugs.webkit.org/show_bug.cgi?id=198120
        <rdar://problem/49668795>

        Reviewed by Michael Saboff.

        * stress/get-array-length-concurrently-change-mode.js: Added.
        (main):

2019-05-22  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r245634.
        https://bugs.webkit.org/show_bug.cgi?id=198140

        'This patch makes JSC crash on launch in debug builds'
        (Requested by tadeuzagallo on #webkit).

        Reverted changeset:

        "[ESNext] Implement support for Numeric Separators"
        https://bugs.webkit.org/show_bug.cgi?id=196351
        https://trac.webkit.org/changeset/245634

2019-05-22  Tadeu Zagallo  <tzagallo@apple.com>

        Stack-buffer-overflow in decodeURIComponent
        https://bugs.webkit.org/show_bug.cgi?id=198109
        <rdar://problem/50397550>

        Reviewed by Michael Saboff.

        * stress/decode-uri-icu-count-trail-bytes.js: Added.
        (i.j.try.i.toString):
        (i.j.catch):

2019-05-22  Yusuke Suzuki  <ysuzuki@apple.com>

        Don't clear PropertyNameArray in Proxy code
        https://bugs.webkit.org/show_bug.cgi?id=197691

        Reviewed by Saam Barati.

        * stress/proxy-get-own-property-names-should-not-clear-previous-results.js: Added.
        (shouldBe):
        (opt):

2019-05-22  Ross Kirsling  <ross.kirsling@sony.com>

        [ESNext] Implement support for Numeric Separators
        https://bugs.webkit.org/show_bug.cgi?id=196351

        Reviewed by Keith Miller.

        * stress/numeric-literal-separators.js: Added.
        Add tests for feature.

        * test262/expectations.yaml:
        Mark 60 test cases as passing.

2019-05-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] ArrayBufferContents::tryAllocate signs the pointer with allocation size and authenticates it with sizeInBytes
        https://bugs.webkit.org/show_bug.cgi?id=198101

        Reviewed by Michael Saboff.

        * stress/zero-sized-array-buffer-pointer-should-be-signed-with-zero.js: Added.
        (shouldBe):

2019-05-20  Keith Miller  <keith_miller@apple.com>

        Cleanup Yarr regexp code around paren contexts.
        https://bugs.webkit.org/show_bug.cgi?id=198063

        Reviewed by Yusuke Suzuki.

        * stress/regexp-many-named-sequential-capture-groups.js: Added.
        (i.s):
        * stress/regexp-many-unnamed-sequential-capture-groups.js: Added.

2019-05-17  Justin Michaud  <justin_michaud@apple.com>

        [WASM-References] Add support for Anyref in parameters and return types, Ref.null and Ref.is_null for Anyref values.
        https://bugs.webkit.org/show_bug.cgi?id=197969

        Reviewed by Keith Miller.

        Support the anyref type in Builder.js, plus add some extra error logging.
        Add new folder for wasm references tests.

        * wasm.yaml:
        * wasm/Builder.js:
        (const._isValidValue):
        * wasm/references/anyref_modules.js: Added.
        (Call.3.RefIsNull.End.End.WebAssembly.js.ident):
        (Call.3.RefIsNull.End.End.WebAssembly.js.make_null):
        (Call.3.RefIsNull.End.End.WebAssembly):
        (undefined):
        * wasm/references/is_null.js: Added.
        * wasm/references/is_null_error.js: Added.
        * wasm/spec-harness/index.js:
        * wasm/wasm.json:

2019-05-16  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Invalid AssignmentTargetType should be an early error.
        https://bugs.webkit.org/show_bug.cgi?id=197603

        Reviewed by Keith Miller.

        * test262/expectations.yaml:
        Update expectations to reflect new SyntaxErrors.
        (Ideally, these should all be viewed as passing in the near future.)

        * stress/async-await-basic.js:
        * stress/big-int-literals.js:
        Update tests to reflect new SyntaxErrors.

        * ChakraCore.yaml:
        * ChakraCore/test/EH/try6.baseline-jsc:
        * ChakraCore/test/Error/variousErrors3.baseline-jsc: Added.
        Update baselines to reflect new SyntaxErrors.

2019-05-15  Saam Barati  <sbarati@apple.com>

        Bound liveness of SetArgumentMaybe nodes when maximal flush insertion phase is enabled
        https://bugs.webkit.org/show_bug.cgi?id=197855
        <rdar://problem/50236506>

        Reviewed by Michael Saboff.

        * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness-2.js: Added.
        (f0):
        (bar):
        (foo):
        * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness.js: Added.
        (f1):
        (f2):
        (foo):

2019-05-14  Keith Miller  <keith_miller@apple.com>

        Fix issue with byteOffset on ARM64E
        https://bugs.webkit.org/show_bug.cgi?id=197884

        Reviewed by Saam Barati.

        We didn't have any tests that run with non-byte/non-zero offset
        typed arrays.

        * stress/ftl-gettypedarrayoffset-wasteful.js:

2019-05-14  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Shrink sizeof(UnlinkedFunctionExecutable) more
        https://bugs.webkit.org/show_bug.cgi?id=197833

        Reviewed by Darin Adler.

        * stress/generator-name.js: Added.
        (shouldBe):
        (gen):
        (catch):

2019-05-13  Tadeu Zagallo  <tzagallo@apple.com>

        JSObject::getOwnPropertyDescriptor is missing an exception check
        https://bugs.webkit.org/show_bug.cgi?id=197693
        <rdar://problem/50441784>

        Reviewed by Saam Barati.

        * stress/proxy-spread.js: Added.
        (foo):

2019-05-10  Saam barati  <sbarati@apple.com>

        Call to JSToWasmICCallee::createStructure passes in wrong prototype value
        https://bugs.webkit.org/show_bug.cgi?id=197807
        <rdar://problem/50530400>

        Reviewed by Yusuke Suzuki.

        * stress/js-to-wasm-callee-has-correct-prototype.js: Added.
        (test.getInstance):
        (test):

2019-05-10  Ross Kirsling  <ross.kirsling@sony.com>

        [Test262] Unreviewed expectations update following r245188.

        * test262/config.yaml:
        * test262/expectations.yaml:

        * test262/test/intl402/DateTimeFormat/prototype/formatRange/date-is-infinity-throws.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRange/date-is-nan-throws.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRange/date-undefined-throws.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRange/date-x-greater-than-y-throws.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRange/this-is-not-object-throws.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-is-infinity-throws.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-is-nan-throws.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-undefined-throws.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-x-greater-than-y-throws.js:
        * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/this-is-not-object-throws.js:
        These files have invalid YAML comments. Will also submit corrections back to Test262.

2019-05-10  Keith Miller  <keith_miller@apple.com>

        Update test262 tests.

        Rubber-stamped by Yusuke Suzuki.

        * test262/*: mega-patch too many things to list individually.

2019-05-09  Keith Miller  <keith_miller@apple.com>

        Unreview, fix test to have a try-catch.

        * stress/many-nested-functions-parser-stack-overflow.js:
        (catch):

2019-05-09  Keith Miller  <keith_miller@apple.com>

        parseStatementListItem needs a stack overflow check
        https://bugs.webkit.org/show_bug.cgi?id=197749

        Reviewed by Saam Barati.

        * stress/many-nested-functions-parser-stack-overflow.js: Added.

2019-05-08  Saam barati  <sbarati@apple.com>

        AccessGenerationState::emitExplicitExceptionHandler can clobber an in use register
        https://bugs.webkit.org/show_bug.cgi?id=197715
        <rdar://problem/50399252>

        Reviewed by Filip Pizlo.

        * stress/polymorphic-access-exception-handler-should-not-clobber-used-register.js: Added.
        (foo):
        (bar):

2019-05-08  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r245068.

        Caused debug layout tests to exit early due to an assertion
        failure.

        Reverted changeset:

        "All prototypes should call didBecomePrototype()"
        https://bugs.webkit.org/show_bug.cgi?id=196315
        https://trac.webkit.org/changeset/245068

2019-05-08  Yusuke Suzuki  <ysuzuki@apple.com>

        Invalid DFG JIT genereation in high CPU usage state
        https://bugs.webkit.org/show_bug.cgi?id=197453

        Reviewed by Saam Barati.

        * stress/string-ident-use-clears-abstract-value-if-rope-string-constant-is-held.js: Added.
        (trigger):
        (main):

2019-05-08  Robin Morisset  <rmorisset@apple.com>

        All prototypes should call didBecomePrototype()
        https://bugs.webkit.org/show_bug.cgi?id=196315

        Reviewed by Saam Barati.

        This changelog already landed, but the commit was missing the actual changes.

        * stress/function-prototype-indexed-accessor.js: Added.

2019-05-08  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] Add ValueMod into DFG
        https://bugs.webkit.org/show_bug.cgi?id=186174

        Reviewed by Saam Barati.

        * microbenchmarks/mod-untyped.js: Added.
        * stress/big-int-mod-osr.js: Added.
        * stress/value-div-ai-rule.js: Added.
        * stress/value-mod-ai-rule.js: Added.

2019-05-07  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] DFG_ASSERT failed in lowInt52
        https://bugs.webkit.org/show_bug.cgi?id=197569

        Reviewed by Saam Barati.

        * stress/getstack-int52.js: Added.
        (opt):
        (main):

2019-05-07  Yusuke Suzuki  <ysuzuki@apple.com>

        JSC: A bug in BytecodeGenerator::emitEqualityOpImpl
        https://bugs.webkit.org/show_bug.cgi?id=197479

        Reviewed by Saam Barati.

        * stress/do-not-perform-bytecode-peephole-optimization-in-jump-target.js: Added.
        (shouldBe):

2019-05-07  Yusuke Suzuki  <ysuzuki@apple.com>

        TemplateObject passed to template literal tags are not always identical for the same source location.
        https://bugs.webkit.org/show_bug.cgi?id=190756

        Reviewed by Saam Barati.

        * complex.yaml:
        * complex/tagged-template-regeneration-after.js: Added.
        (shouldBe):
        * complex/tagged-template-regeneration.js: Added.
        (call):
        (test):
        * modules/tagged-template-inside-module.js: Added.
        (from.string_appeared_here.call):
        * modules/tagged-template-inside-module/other-tagged-templates.js: Added.
        (call):
        (export.otherTaggedTemplates):
        * stress/call-and-construct-should-return-same-tagged-templates.js: Added.
        (shouldBe):
        (call):
        (poly):
        * stress/tagged-templates-in-direct-eval-should-not-produce-same-site-object.js: Added.
        (shouldBe):
        (call):
        * stress/tagged-templates-in-function-in-direct-eval.js: Added.
        (shouldBe):
        (call):
        (test):
        * stress/tagged-templates-in-global-function-should-not-produce-same-site-object.js: Added.
        (shouldBe):
        (call):
        * stress/tagged-templates-in-indirect-eval-should-not-produce-same-site-object.js: Added.
        (shouldBe):
        (call):
        * stress/tagged-templates-in-multiple-functions.js: Added.
        (shouldBe):
        (call):
        (a):
        (b):
        (c):
        * stress/tagged-templates-with-same-start-offset.js: Added.
        (shouldBe):

2019-05-07  Robin Morisset  <rmorisset@apple.com>

        All prototypes should call didBecomePrototype()
        https://bugs.webkit.org/show_bug.cgi?id=196315

        Reviewed by Saam Barati.

        * stress/function-prototype-indexed-accessor.js: Added.

2019-05-07  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r244978.
        https://bugs.webkit.org/show_bug.cgi?id=197671

        TemplateObject map should use start/end offsets (Requested by
        yusukesuzuki on #webkit).

        Reverted changeset:

        "TemplateObject passed to template literal tags are not always
        identical for the same source location."
        https://bugs.webkit.org/show_bug.cgi?id=190756
        https://trac.webkit.org/changeset/244978

2019-05-07  Tadeu Zagallo  <tzagallo@apple.com>

        tryCachePutByID should not crash if target offset changes
        https://bugs.webkit.org/show_bug.cgi?id=197311
        <rdar://problem/48033612>

        Reviewed by Filip Pizlo.

        Add a series of tests related tryCachePutByID. Two of these tests used to crash and were fixed
        by this patch: `cache-put-by-id-different-attributes.js` and `cache-put-by-id-different-offset.js`

        * stress/cache-put-by-id-delete-prototype.js: Added.
        (A.prototype.set y):
        (A):
        (B.prototype.set y):
        (B):
        (C):
        * stress/cache-put-by-id-different-__proto__.js: Added.
        (A.prototype.set y):
        (A):
        (B1):
        (B2.prototype.set y):
        (B2):
        (C):
        (D):
        * stress/cache-put-by-id-different-attributes.js: Added.
        (Foo):
        (set x):
        * stress/cache-put-by-id-different-offset.js: Added.
        (Foo):
        (set x):
        * stress/cache-put-by-id-insert-prototype.js: Added.
        (A.prototype.set y):
        (A):
        (C):
        * stress/cache-put-by-id-poly-proto.js: Added.
        (Foo):
        (set _):
        (createBar.Bar):
        (createBar):

2019-05-07  Saam Barati  <sbarati@apple.com>

        Don't OSR enter into an FTL CodeBlock that has been jettisoned
        https://bugs.webkit.org/show_bug.cgi?id=197531
        <rdar://problem/50162379>

        Reviewed by Yusuke Suzuki.

        * stress/dont-osr-enter-into-jettisoned-ftl-code-block.js: Added.

2019-05-06  Dean Jackson  <dino@apple.com>

        Update test262 expectations for Proxy passes
        https://bugs.webkit.org/show_bug.cgi?id=197628

        Reviewed by Yusuke Suzuki.

        There are two consistent passes in Proxy.ownKeys.

        * test262/expectations.yaml:

2019-05-06  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] We should check OOM for description string of Symbol
        https://bugs.webkit.org/show_bug.cgi?id=197634

        Reviewed by Keith Miller.

        * stress/check-symbol-description-oom.js: Added.
        (shouldThrow):

2019-05-06  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, land one more test
        https://bugs.webkit.org/show_bug.cgi?id=197587

        * stress/setter-frame-flush.js: Added.
        (setter):
        (foo):
        (bar):

2019-05-06  Yusuke Suzuki  <ysuzuki@apple.com>

        TemplateObject passed to template literal tags are not always identical for the same source location.
        https://bugs.webkit.org/show_bug.cgi?id=190756

        Reviewed by Saam Barati.

        * complex.yaml:
        * complex/tagged-template-regeneration-after.js: Added.
        (shouldBe):
        * complex/tagged-template-regeneration.js: Added.
        (call):
        (test):
        * modules/tagged-template-inside-module.js: Added.
        (from.string_appeared_here.call):
        * modules/tagged-template-inside-module/other-tagged-templates.js: Added.
        (call):
        (export.otherTaggedTemplates):
        * stress/call-and-construct-should-return-same-tagged-templates.js: Added.
        (shouldBe):
        (call):
        (poly):
        * stress/tagged-templates-in-direct-eval-should-not-produce-same-site-object.js: Added.
        (shouldBe):
        (call):
        * stress/tagged-templates-in-global-function-should-not-produce-same-site-object.js: Added.
        (shouldBe):
        (call):
        * stress/tagged-templates-in-indirect-eval-should-not-produce-same-site-object.js: Added.
        (shouldBe):
        (call):
        * stress/tagged-templates-in-multiple-functions.js: Added.
        (shouldBe):
        (call):
        (a):
        (b):
        (c):

2019-05-06  Stephan Szabo  <stephan.szabo@sony.com>

        [PlayStation] JSC Stress tests failing due to timezone printing
        https://bugs.webkit.org/show_bug.cgi?id=197615

        PlayStation's strftime does not give timezone strings, which
        results in time strings like "Wed Oct 23 1974 11:45:01 GMT-0700"
        rather than "Wed Oct 23 1974 11:45:01 GMT-0700 (Pacific Daylight Time)"
        which causes diff failures with the expectations. Add expectations
        without the timezone string and use those on playstation.

        Reviewed by Ross Kirsling.

        * ChakraCore.yaml: Update these tests to use alternate expectation file on PlayStation
        * ChakraCore/test/GlobalFunctions/InternalToString.baseline-jsc-playstation: Added.
        * ChakraCore/test/Operators/equals.baseline-jsc-playstation: Added.
        * ChakraCore/test/fieldopts/objtypespec-newobj.2.baseline-jsc-playstation: Added.

2019-05-06  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Add more tests for DFG SetLocal emission for adhoc SetterCall frame
        https://bugs.webkit.org/show_bug.cgi?id=197587

        Reviewed by Sam Weinig.

        This patch adds more tests to r244939. It also inlines setter calls, and eventually see that no PutStack is emitted because MovHint's KillStack kills it.

        * stress/adhoc-setter-frame-should-not-be-killed.js: Added.

2019-05-04  Tadeu Zagallo  <tzagallo@apple.com>

        TypedArrays should not store properties that are canonical numeric indices
        https://bugs.webkit.org/show_bug.cgi?id=197228
        <rdar://problem/49557381>

        Reviewed by Saam Barati.

        * stress/array-species-config-array-constructor.js:
        (test):
        * stress/put-direct-index-broken-2.js:
        * stress/typed-array-canonical-numeric-index-string.js: Added.
        (makeTest.assert):
        (makeTest):
        (const.testInvalidIndices.makeTest.set assert):
        (const.testInvalidIndices.makeTest):
        (const.makeTestValidIndex.configurable.set assert):
        (const.makeTestValidIndex.configurable):
        * stress/typedarray-access-monomorphic-neutered.js:
        (checkNoException):
        (testNoException):
        (testFTLNoException):
        * stress/typedarray-access-neutered.js:
        (testNoException):
        * stress/typedarray-getownproperty-not-configurable.js:
        (foo):
        * test262/expectations.yaml:

2019-05-03  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Need to emit SetLocal if we emit MovHint in DFGByteCodeParser
        https://bugs.webkit.org/show_bug.cgi?id=197584

        Reviewed by Saam Barati.

        * stress/adhoc-setter-frame-should-emit-setlocal-again.js: Added.
        (X):
        (foo):

2019-05-03  Michael Saboff  <msaboff@apple.com>

        iOS JSC tests frequently exiting with execption after stress/json-stringify-string-builder-overflow.js.no-cjit-validate-phases
        https://bugs.webkit.org/show_bug.cgi?id=197586

        Reviewed by Keith Miller.

        We should only run one config of this test and only when we think we'll have the memory.

        * stress/json-stringify-string-builder-overflow.js:

2019-05-03  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Generator CodeBlock generation should be idempotent
        https://bugs.webkit.org/show_bug.cgi?id=197552

        Reviewed by Keith Miller.

        Add complex.yaml, which controls how to run JSC shell more.
        We split test files into two to run macro task between them which allows debugger to be attached to VM.

        * complex.yaml: Added.
        * complex/generator-regeneration-after.js: Added.
        * complex/generator-regeneration.js: Added.
        (gen):

2019-05-02  Michael Saboff  <msaboff@apple.com>

        Unreviewed rollout of r244862.

        * stress/proxy-getOwnPropertySlots-exceptionChecks.js:

2019-05-01  Saam barati  <sbarati@apple.com>

        Baseline JIT should do argument value profiling after checking for stack overflow
        https://bugs.webkit.org/show_bug.cgi?id=197052
        <rdar://problem/50009602>

        Reviewed by Yusuke Suzuki.

        * stress/check-stack-overflow-before-value-profiling-arguments.js: Added.

2019-05-01  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Inlining Getter/Setter should care availability of ad-hocly constructed frame
        https://bugs.webkit.org/show_bug.cgi?id=197405

        Reviewed by Saam Barati.

        * stress/getter-setter-inlining-should-emit-movhint.js: Added.
        (foo):
        (test):
        (i.o.get f):
        (i.o.set f):

2019-05-01  Michael Saboff  <msaboff@apple.com>

        ASSERTION FAILED: !m_needExceptionCheck with --validateExceptionChecks=1; ProxyObject.getOwnPropertySlotCommon/JSFunction.callerGetter
        https://bugs.webkit.org/show_bug.cgi?id=197485

        Reviewed by Saam Barati.

        New test.

        * stress/proxy-getOwnPropertySlots-exceptionChecks.js: Added.
        (foo):

2019-05-01  Ross Kirsling  <ross.kirsling@sony.com>

        Unreviewed correction to Test262 expectations following r244828.

        * test262/expectations.yaml:

2019-05-01  Stephan Szabo  <stephan.szabo@sony.com>

        Add memory-limited skipping to some tests generating very large strings
        https://bugs.webkit.org/show_bug.cgi?id=197437

        Reviewed by Ross Kirsling.

        * stress/StringObject-define-length-getter-rope-string-oom.js:
        * stress/create-error-out-of-memory-rope-string.js:
        * stress/string-16bit-repeat-overflow.js:

2019-04-30  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r244806.
        https://bugs.webkit.org/show_bug.cgi?id=197446

        Causing Test262 and JSC test failures on multiple builds
        (Requested by ShawnRoberts on #webkit).

        Reverted changeset:

        "TypeArrays should not store properties that are canonical
        numeric indices"
        https://bugs.webkit.org/show_bug.cgi?id=197228
        https://trac.webkit.org/changeset/244806

2019-04-30  Tadeu Zagallo  <tzagallo@apple.com>

        TypeArrays should not store properties that are canonical numeric indices
        https://bugs.webkit.org/show_bug.cgi?id=197228
        <rdar://problem/49557381>

        Reviewed by Darin Adler.

        * stress/typed-array-canonical-numeric-index-string.js: Added.
        (makeTest.assert):
        (makeTest):
        (const.testInvalidIndices.makeTest.set assert):
        (const.testInvalidIndices.makeTest):
        (const.testValidIndices.makeTest.set assert):
        (const.testValidIndices.makeTest):

2019-04-29  Yusuke Suzuki  <ysuzuki@apple.com>

        normalizeMapKey should normalize NaN to one PureNaN bit pattern to make MapHash same
        https://bugs.webkit.org/show_bug.cgi?id=197362

        Reviewed by Saam Barati.

        * stress/map-with-nan.js: Added.
        (shouldBe):
        (div):
        (NaN1):
        (NaN2):
        (NaN3):
        (NaN4):
        (NaN1NoInline):
        (NaN2NoInline):
        (NaN3NoInline):
        (NaN4NoInline):
        (test1):
        (test2):
        (test3):
        (test4):
        * stress/set-with-nan.js: Added.
        (shouldBe):
        (div):
        (NaN1):
        (NaN2):
        (NaN3):
        (NaN4):
        (NaN1NoInline):
        (NaN2NoInline):
        (NaN3NoInline):
        (NaN4NoInline):
        (test2):
        (test4):

2019-04-26  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r244708.
        https://bugs.webkit.org/show_bug.cgi?id=197334

        "Broke the debug build" (Requested by rmorisset on #webkit).

        Reverted changeset:

        "All prototypes should call didBecomePrototype()"
        https://bugs.webkit.org/show_bug.cgi?id=196315
        https://trac.webkit.org/changeset/244708

2019-04-25  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] linkPolymorphicCall now does GC
        https://bugs.webkit.org/show_bug.cgi?id=197306

        Reviewed by Saam Barati.

        * stress/link-polymorphic-call-can-gc.js: Added.
        (module):
        (instance):

2019-04-26  Robin Morisset  <rmorisset@apple.com>

        All prototypes should call didBecomePrototype()
        https://bugs.webkit.org/show_bug.cgi?id=196315

        Reviewed by Saam Barati.

        * stress/function-prototype-indexed-accessor.js: Added.

2019-04-23  Saam Barati  <sbarati@apple.com>

        LICM incorrectly assumes it'll never insert a node which provably OSR exits
        https://bugs.webkit.org/show_bug.cgi?id=196721
        <rdar://problem/49556479> 

        Reviewed by Filip Pizlo.

        * stress/licm-should-handle-if-a-hoist-causes-a-provable-osr-exit.js: Added.
        (foo):

2019-04-19  Saam Barati  <sbarati@apple.com>

        AbstractValue can represent more than int52
        https://bugs.webkit.org/show_bug.cgi?id=197118
        <rdar://problem/49969960>

        Reviewed by Michael Saboff.

        * stress/abstract-value-can-include-int52.js: Added.
        (foo):
        (index.index.8.index.60.index.65.index.1234.index.1234.parseInt.string_appeared_here.String.fromCharCode):

2019-04-18  Yusuke Suzuki  <ysuzuki@apple.com>

        [WTF] StringBuilder should set correct m_is8Bit flag when merging
        https://bugs.webkit.org/show_bug.cgi?id=197053

        Reviewed by Saam Barati.

        * stress/merge-string-builder-in-dfg.js: Added.
        (foo):

2019-04-16  Caitlin Potter  <caitp@igalia.com>

        [JSC] Filter DontEnum properties in ProxyObject::getOwnPropertyNames()
        https://bugs.webkit.org/show_bug.cgi?id=176810

        Reviewed by Saam Barati.

        Add tests for the DontEnum filtering, and variations of other tests
        take the DontEnum-filtering path.

        * stress/proxy-own-keys.js:
        (i.catch):
        (set assert):
        (set add):
        (let.set new):
        (get let):

2019-04-15  Saam barati  <sbarati@apple.com>

        Modify how we do SetArgument when we inline varargs calls
        https://bugs.webkit.org/show_bug.cgi?id=196712
        <rdar://problem/49605012>

        Reviewed by Michael Saboff.

        * stress/get-stack-wrong-type-when-inline-varargs.js: Added.
        (foo):

2019-04-15  Saam barati  <sbarati@apple.com>

        SafeToExecute for GetByOffset/GetGetterByOffset/PutByOffset is using the wrong child for the base
        https://bugs.webkit.org/show_bug.cgi?id=196945
        <rdar://problem/49802750>

        Reviewed by Filip Pizlo.

        * stress/get-by-offset-should-use-correct-child.js: Added.
        (foo.bar):
        (foo):

2019-04-15  Robin Morisset  <rmorisset@apple.com>

        DFG should be able to constant fold Object.create() with a constant prototype operand
        https://bugs.webkit.org/show_bug.cgi?id=196886

        Reviewed by Yusuke Suzuki.

        Note that this new benchmark does not currently see a speedup with inlining removed.
        The reason is that we do not yet have inline caching for Object.create(), we only optimize it when the DFG can see statically the prototype being passed.

        * microbenchmarks/object-create-constant-prototype.js: Added.
        (test):

2019-04-15  Tadeu Zagallo  <tzagallo@apple.com>

        Incremental bytecode cache should not append function updates when loaded from memory
        https://bugs.webkit.org/show_bug.cgi?id=196865

        Reviewed by Filip Pizlo.

        * stress/bytecode-cache-shared-code-block.js: Added.
        (b):
        (program):

2019-04-13  Tadeu Zagallo  <tzagallo@apple.com>

        CodeCache should check that the UnlinkedCodeBlock was successfully created before caching it
        https://bugs.webkit.org/show_bug.cgi?id=196880

        Reviewed by Yusuke Suzuki.

        * stress/bytecode-cache-syntax-error.js: Added.
        (catch):

2019-04-12  Saam barati  <sbarati@apple.com>

        r244079 logically broke shouldSpeculateInt52
        https://bugs.webkit.org/show_bug.cgi?id=196884

        Reviewed by Yusuke Suzuki.

        * microbenchmarks/int52-rand-function.js: Added.
        (Math.random):

2019-04-11  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] op_has_indexed_property should not assume subscript part is Uint32
        https://bugs.webkit.org/show_bug.cgi?id=196850

        Reviewed by Saam Barati.

        * stress/has-indexed-property-should-accept-non-int32.js: Added.
        (foo):

2019-04-11  Saam barati  <sbarati@apple.com>

        Remove invalid assertion in operationInstanceOfCustom
        https://bugs.webkit.org/show_bug.cgi?id=196842
        <rdar://problem/49725493>

        Reviewed by Michael Saboff.

        * stress/operationInstanceOfCustom-bad-assertion.js: Added.

2019-04-10  Saam Barati  <sbarati@apple.com>

        AbstractValue::validateOSREntryValue is wrong for Int52 constants
        https://bugs.webkit.org/show_bug.cgi?id=196801
        <rdar://problem/49771122>

        Reviewed by Yusuke Suzuki.

        * stress/abstract-value-int52-constant-validation-should-not-care-about-representation.js: Added.

2019-04-10  Robin Morisset  <rmorisset@apple.com>

        We should clear m_needsOverflowCheck when hitting an exception in defineProperties in ObjectConstructor.cpp
        https://bugs.webkit.org/show_bug.cgi?id=196746

        Reviewed by Yusuke Suzuki.

        * stress/cyclic-define-properties.js: Added.
        (foo):

2019-04-09  Saam barati  <sbarati@apple.com>

        Clean up Int52 code and some bugs in it
        https://bugs.webkit.org/show_bug.cgi?id=196639
        <rdar://problem/49515757>

        Reviewed by Yusuke Suzuki.

        * stress/spec-any-int-as-double-produces-any-int52-from-int52-rep.js: Added.

2019-04-09  Tadeu Zagallo  <tzagallo@apple.com>

        ASSERTION FAILED: !scope.exception() || !hasProperty in JSObject::get
        https://bugs.webkit.org/show_bug.cgi?id=196708
        <rdar://problem/49556803>

        Reviewed by Yusuke Suzuki.

        * stress/proxy-getter-stack-overflow.js: Added.
        (const.handler.get target):
        (const.handler.has):
        (try.with):
        (catch):

2019-04-08  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] DFG should respect node's strict flag
        https://bugs.webkit.org/show_bug.cgi?id=196617

        Reviewed by Saam Barati.

        * stress/put-by-val-direct-should-respect-strict-mode-of-inlining-codeblock.js: Added.
        (shouldEqual):
        (makeUnwriteableUnconfigurableObject):
        (runTest):
        * stress/put-dynamic-var-strict-and-sloppy.js: Added.
        (shouldBe):
        (shouldThrow):
        (with.result):
        (with.putValueStrict):
        (with.putValueSloppy):

2019-04-08  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] isRope jump in StringSlice should not jump over register allocations
        https://bugs.webkit.org/show_bug.cgi?id=196716

        Reviewed by Saam Barati.

        * stress/is-rope-check-in-string-slice-should-not-jump-over-register-allocations.js: Added.
        (foo.bar):
        (foo):

2019-04-08  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] to_index_string should not assume incoming value is Uint32
        https://bugs.webkit.org/show_bug.cgi?id=196713

        Reviewed by Saam Barati.

        * stress/to-index-string-should-not-assume-incoming-value-is-uint32.js: Added.
        (foo):

2019-04-08  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Add more tests for r243966
        https://bugs.webkit.org/show_bug.cgi?id=196711

        Reviewed by Saam Barati.

        Adding one more test for r243966 fix. The added test will not crash after r243966.

        * stress/stress-cleared-calllinkinfo.js: Added.
        (runNearStackLimit.t):
        (runNearStackLimit):
        (repeat):
        (cls):
        (let.item.of.array.runNearStackLimit):

2019-04-08  Saam Barati  <sbarati@apple.com>

        WebAssembly.RuntimeError missing exception check
        https://bugs.webkit.org/show_bug.cgi?id=196700
        <rdar://problem/49693932>

        Reviewed by Yusuke Suzuki.

        * wasm/js-api/runtime-error-should-exception-check.js: Added.

2019-04-08  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, rolling in r243948 with test fix
        https://bugs.webkit.org/show_bug.cgi?id=196486

        * stress/arrow-function-and-use-strict-directive.js: Added.
        * stress/arrow-function-syntax.js: Added.
        (checkSyntax):
        (checkSyntaxError):

2019-04-08  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r243948.

        Caused inspector/runtime/parse.html to fail

        Reverted changeset:

        "SIGSEGV in JSC::BytecodeGenerator::addStringConstant"
        https://bugs.webkit.org/show_bug.cgi?id=196486
        https://trac.webkit.org/changeset/243948

2019-04-08  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r243943.

        Caused test262 failures.

        Reverted changeset:

        "[JSC] Filter DontEnum properties in
        ProxyObject::getOwnPropertyNames()"
        https://bugs.webkit.org/show_bug.cgi?id=176810
        https://trac.webkit.org/changeset/243943

2019-04-07  Michael Saboff  <msaboff@apple.com>

        REGRESSION (r243642): Crash in reddit.com page
        https://bugs.webkit.org/show_bug.cgi?id=196684

        Reviewed by Geoffrey Garen.

        New regression test.

        * stress/regexp-nongreedy-charclass-backtracks.js: Added.

2019-04-07  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] CallLinkInfo should clear Callee or CodeBlock even if it is unlinked by jettison
        https://bugs.webkit.org/show_bug.cgi?id=196683

        Reviewed by Saam Barati.

        * stress/clear-callee-or-codeblock-in-calllinkinfo-even-cleared-by-jettison.js: Added.
        (foo):

2019-04-05  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] OSRExit recovery for SpeculativeAdd does not consier "A = A + A" pattern
        https://bugs.webkit.org/show_bug.cgi?id=196582

        Reviewed by Saam Barati.

        * stress/add-overflow-check-with-three-same-registers.js: Added.
        (foo):
        (Number.prototype.valueOf):
        (runWithNumber):

2019-04-05  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r243665.

        Caused iOS JSC tests to exit with an exception.

        Reverted changeset:

        "Assertion failed in JSC::createError"
        https://bugs.webkit.org/show_bug.cgi?id=196305
        https://trac.webkit.org/changeset/243665

2019-04-05  Yusuke Suzuki  <ysuzuki@apple.com>

        SIGSEGV in JSC::BytecodeGenerator::addStringConstant
        https://bugs.webkit.org/show_bug.cgi?id=196486

        Reviewed by Saam Barati.

        * stress/arrow-function-and-use-strict-directive.js: Added.
        * stress/arrow-function-syntax.js: Added. Checking EOF token handling.
        (checkSyntax):
        (checkSyntaxError): Currently not using it. But it is useful for testing more things related to arrow function syntax.

2019-04-05  Caitlin Potter  <caitp@igalia.com>

        [JSC] Filter DontEnum properties in ProxyObject::getOwnPropertyNames()
        https://bugs.webkit.org/show_bug.cgi?id=176810

        Reviewed by Saam Barati.

        Add tests for the DontEnum filtering, and variations of other tests
        take the DontEnum-filtering path.

        * stress/proxy-own-keys.js:
        (i.catch):
        (set assert):
        (set add):
        (let.set new):
        (get let):

2019-04-05  Caitlin Potter  <caitp@igalia.com>

        [JSC] throw if 'ownKeys' Proxy trap result contains duplicate keys
        https://bugs.webkit.org/show_bug.cgi?id=185211

        Reviewed by Saam Barati.

        This is for the normative spec change in https://github.com/tc39/ecma262/pull/833

        This changes several assertions to expect a TypeError to be thrown (in some cases,
        changing thee expected message).

        * es6/Proxy_ownKeys_duplicates.js:
        (handler):
        (shouldThrow):
        (test):
        * stress/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js:
        (shouldThrow):
        * stress/proxy-own-keys.js:
        (i.catch):
        (assert):

2019-04-04  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] makeBoundFunction should not assume incoming "length" value is Int32 because it performs some calculation in bytecode
        https://bugs.webkit.org/show_bug.cgi?id=196631

        Reviewed by Saam Barati.

        * stress/make-bound-function-should-not-assume-int32-length.js: Added.
        (assert):
        (test):
        (foo):

2019-04-04  Saam Barati  <sbarati@apple.com>

        Unreviewed. Make the test from r243906 catch the thrown exceptions.

        * stress/inferred-types-regex-matches-array.js:

2019-04-04  Saam Barati  <sbarati@apple.com>

        createRegExpMatchesArray does not respect inferred types
        https://bugs.webkit.org/show_bug.cgi?id=193287

        Reviewed by Yusuke Suzuki.

        This checks in the test case for 193287. This issue was discovered by
        Samuel Groß of Google Project Zero.

        * stress/inferred-types-regex-matches-array.js: Added.

2019-04-04  Saam barati  <sbarati@apple.com>

        Teach Call ICs how to call Wasm
        https://bugs.webkit.org/show_bug.cgi?id=196387

        Reviewed by Filip Pizlo.

        * wasm/function-tests/stack-trace.js:

2019-04-04  Caio Lima  <ticaiolima@gmail.com>

        [JSC] We should consider moving UnlinkedFunctionExecutable::m_parentScopeTDZVariables to RareData
        https://bugs.webkit.org/show_bug.cgi?id=194944

        Reviewed by Keith Miller.

        * stress/verify-bytecode-generator-cached-variables-under-tdz.js: Added.

2019-04-04  Tadeu Zagallo  <tzagallo@apple.com>

        Cache bytecode for jsc.cpp helpers and fix CachedStringImpl
        https://bugs.webkit.org/show_bug.cgi?id=196409

        Reviewed by Saam Barati.

        * stress/bytecode-cache-cached-string-impl.js: Added.
        (f):
        (g):
        * stress/bytecode-cache-run-string.js: Added.

2019-04-03  Robin Morisset  <rmorisset@apple.com>

        B3 should use associativity to optimize expression trees
        https://bugs.webkit.org/show_bug.cgi?id=194081

        Reviewed by Filip Pizlo.

        Added three microbenchmarks:
        - add-tree should be the ideal case, but there is no speedup because we are currently unable to prove that the CheckAdd won't overflow
        - bit-xor-tree most closely matches the situation where the optimization triggers on the JetStream2 subtests where it triggers:
          an unbalanced expression tree of size 8 that can be balanced, with no other optimizations being unlocked. 16% speedup
        - bit-or-tree is an ideal case, where the reassociation also enables a ton of further simplifications. 42% speedup

        * microbenchmarks/add-tree.js: Added.
        * microbenchmarks/bit-or-tree.js: Added.
        * microbenchmarks/bit-xor-tree.js: Added.

2019-04-03  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Exception verification crash on operationArrayIndexOfValueInt32OrContiguous
        https://bugs.webkit.org/show_bug.cgi?id=196574

        Reviewed by Saam Barati.

        * stress/string-index-of-exception-check.js: Added.
        (blurType):
        (1.forEach):

2019-03-29  Tadeu Zagallo  <tzagallo@apple.com>

        Assertion failed in JSC::createError
        https://bugs.webkit.org/show_bug.cgi?id=196305
        <rdar://problem/49387382>

        Reviewed by Saam Barati.

        * stress/create-error-out-of-memory-rope-string-2.js: Added.
        (assert):
        (catch):

2019-03-28  Saam Barati  <sbarati@apple.com>

        BackwardsGraph needs to consider back edges as the backward's root successor
        https://bugs.webkit.org/show_bug.cgi?id=195991

        Reviewed by Filip Pizlo.

        * stress/map-b3-licm-infinite-loop.js: Added.

2019-03-28  Tadeu Zagallo  <tzagallo@apple.com>

        CodeBlock::jettison() should disallow repatching its own calls
        https://bugs.webkit.org/show_bug.cgi?id=196359
        <rdar://problem/48973663>

        Reviewed by Saam Barati.

        * stress/call-link-info-osrexit-repatch.js: Added.
        (foo):

2019-03-28  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] imports-oom.js intermittently fails
        https://bugs.webkit.org/show_bug.cgi?id=196373

        Reviewed by Saam Barati.

        imports-oom.js ensures that a wasm module compilation / instantiation throws an OOM error instead of crashing when compiling / instantiating their entry points
        with extremely low executable memory amount. And this test expects we at least once successfully compile, instantiate, and execute a wasm module to test that
        wasm implementation is always throwing an OOM error. However, maybe due to wasm changes, the amount of executable memory consumed by wasm compilation is changed,
        and now we may encounter an OOM error at the first compilation. Since imports-oom.js randomize the amount of executable memory used by the generated wasm module,
        imports-oom.js intermittently fails when it first generates large wasm module which cannot be compiled.

        This patch reduces the maxParams from 32 to 8 to reduce the size of randomly generated wasm module. Since we repeatedly generate wasm modules, this test soon encounter
        an expected OOM error. But this avoids the situation that we get an OOM error when we compile a first wasm module.

        * wasm/lowExecutableMemory/imports-oom.js:

2019-03-27  Saam Barati  <sbarati@apple.com>

        validateOSREntryValue with Int52 should box the value being checked into double format
        https://bugs.webkit.org/show_bug.cgi?id=196313
        <rdar://problem/49306703>

        Reviewed by Yusuke Suzuki.

        * stress/validate-int-52-ai-state.js: Added.

2019-03-27  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Owner of watchpoints should validate at GC finalizing phase
        https://bugs.webkit.org/show_bug.cgi?id=195827

        Reviewed by Filip Pizlo.

        * stress/gc-should-reap-dead-watchpoints.js: Added.
        (foo):
        (A.prototype.y):
        (A):

2019-03-26  Dominik Infuehr  <dinfuehr@igalia.com>

        Skip WebAssembly test on 32-bit systems
        https://bugs.webkit.org/show_bug.cgi?id=196206

        Reviewed by Saam Barati.

        Invoking runDefault executes test immediately even though
        that test should be skipped due to missing WASM support.
        Therefore remove runDefault.

        * wasm/regress/web-assembly-link-error-exception-check.js:

2019-03-26  Tadeu Zagallo  <tzagallo@apple.com>

        WebAssembly: Fix f32.min, f64.min and f64.max operations on NaN
        https://bugs.webkit.org/show_bug.cgi?id=196217

        Reviewed by Saam Barati.

        Re-enable all NaN tests for f32.min, f64.min and f64.max.

        * wasm/spec-tests/f32.wast.js:
        * wasm/spec-tests/f64.wast.js:
        * wasm/wasm.json:

2019-03-25  Keith Miller  <keith_miller@apple.com>

        ASSERTION FAILED: m_op == CompareStrictEq in JSC::DFG::Node::convertToCompareEqPtr(JSC::DFG::FrozenValue *, JSC::DFG::Edge)
        https://bugs.webkit.org/show_bug.cgi?id=196176

        Reviewed by Saam Barati.

        * stress/object-is-fold-to-compare-eq-ptr.js: Added.
        (main.v10):
        (main):

2019-03-25  Tadeu Zagallo  <tzagallo@apple.com>

        WebAssembly: f32.max with NaN generates incorrect result
        https://bugs.webkit.org/show_bug.cgi?id=175691
        <rdar://problem/33952228>

        Reviewed by Saam Barati.

        Enable all f32.max NaN tests

        * wasm/spec-tests/f32.wast.js:
        * wasm/wasm.json:

2019-03-24  Dominik Infuehr  <dinfuehr@igalia.com>

        [JSC] Move test into directory for WASM tests
        https://bugs.webkit.org/show_bug.cgi?id=196187

        Reviewed by Mark Lam.

        Move Test into wasm-directory. Otherwise this test
        is also executed on systems without WASM support.

        * wasm/regress/web-assembly-link-error-exception-check.js: Renamed from JSTests/stress/web-assembly-link-error-exception-check.js.

2019-03-23  Mark Lam  <mark.lam@apple.com>

        Rolling out r243032 and r243071 because the fix is incorrect.
        https://bugs.webkit.org/show_bug.cgi?id=195892
        <rdar://problem/48981239>

        Not reviewed.

        * stress/check-object-property-condition-liveness-before-accessing-it-when-watchpoints-fire.js: Removed.

2019-03-22  Mark Lam  <mark.lam@apple.com>

        Placate exception check validation in genericTypedArrayViewProtoFuncLastIndexOf().
        https://bugs.webkit.org/show_bug.cgi?id=196154
        <rdar://problem/49145307>

        Reviewed by Filip Pizlo.

        Also added //@ runDefault constraint to web-assembly-link-error-exception-check.js.
        There's no need to run this test on more than 1 test configuration.

        * stress/typed-array-lastIndexOf-exception-check.js: Added.
        * stress/web-assembly-link-error-exception-check.js:

2019-03-22  Mark Lam  <mark.lam@apple.com>

        Placate exception check validation in constructJSWebAssemblyLinkError().
        https://bugs.webkit.org/show_bug.cgi?id=196152
        <rdar://problem/49145257>

        Reviewed by Michael Saboff.

        * stress/web-assembly-link-error-exception-check.js: Added.

2019-03-22  Dominik Infuehr  <dinfuehr@igalia.com>

        Skip tests running out of memory on ARM/MIPS
        https://bugs.webkit.org/show_bug.cgi?id=196131

        Unreviewed. Skip test if memory is limited.

        * microbenchmarks/put-by-val-direct-large-index.js:

2019-03-21  Mark Lam  <mark.lam@apple.com>

        Remove an invalid assertion in DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined().
        https://bugs.webkit.org/show_bug.cgi?id=196116
        <rdar://problem/48976951>

        Reviewed by Filip Pizlo.

        * stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js: Added.

2019-03-21  Tadeu Zagallo  <tzagallo@apple.com>

        JSObject::putDirectIndexSlowOrBeyondVectorLength should check if indexIsSufficientlyBeyondLengthForSparseMap
        https://bugs.webkit.org/show_bug.cgi?id=196078
        <rdar://problem/35925380>

        Reviewed by Mark Lam.

        Add a new benchmark that allocates several objects and invokes put_by_val_direct
        with a large index. run-jsc-benchmarks says "definitely 1.6178x faster".

        * microbenchmarks/put-by-val-direct-large-index.js: Added.

2019-03-21  Mark Lam  <mark.lam@apple.com>

        Placate exception check validation in operationArrayIndexOfString().
        https://bugs.webkit.org/show_bug.cgi?id=196067
        <rdar://problem/49056572>

        Reviewed by Michael Saboff.

        * stress/string-equal-exception-check.js: Added.

2019-03-21  Mark Lam  <mark.lam@apple.com>

        Cap length of an array with spread to MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.
        https://bugs.webkit.org/show_bug.cgi?id=196055
        <rdar://problem/49067448>

        Reviewed by Yusuke Suzuki.

        * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: Added.

2019-03-20  Saam Barati  <sbarati@apple.com>

        typeOfDoubleSum is wrong for when NaN can be produced
        https://bugs.webkit.org/show_bug.cgi?id=196030

        Reviewed by Filip Pizlo.

        * stress/double-add-sub-mul-can-produce-nan.js: Added.
        (assert):
        (noInline.sub):
        (noInline):
        (assert.mul):
        (assert.add):

2019-03-20  Yusuke Suzuki  <ysuzuki@apple.com>

        Update the test to ensure OutOfMemoryError is thrown as intended
        https://bugs.webkit.org/show_bug.cgi?id=196032
        <rdar://problem/46842740>

        Rubber stamped by Saam Barati.

        * stress/create-error-out-of-memory-rope-string.js:
        (assert):
        (catch):

2019-03-20  Tadeu Zagallo  <tzagallo@apple.com>

        JSC::createError needs to check for OOM in errorDescriptionForValue
        https://bugs.webkit.org/show_bug.cgi?id=196032
        <rdar://problem/46842740>

        Reviewed by Mark Lam.

        * stress/create-error-out-of-memory-rope-string.js: Added.

2019-03-19  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, reduce # of iterations to avoid timing out after r242991
        https://bugs.webkit.org/show_bug.cgi?id=195791

        To avoid timing out, this patch reduces it from 3e7 to 1e7. 1e7 iteration counts still reproduce the issue at 60%.

        * stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js:

2019-03-19  Caio Lima  <ticaiolima@gmail.com>

        [JSC] microbenchmarks/generate-multiple-llint-entrypoints.js is running out of executable memory on ARMv7
        https://bugs.webkit.org/show_bug.cgi?id=195950

        Unreviewed, reducing the amount of memory used on this test to avoid
        OOM on devices with memory restrictions.

        * microbenchmarks/generate-multiple-llint-entrypoints.js:

2019-03-19  Caio Lima  <ticaiolima@gmail.com>

        [JSC] LLIntEntryPoint creates same DirectJITCode for all functions
        https://bugs.webkit.org/show_bug.cgi?id=194648

        Reviewed by Keith Miller.

        * microbenchmarks/generate-multiple-llint-entrypoints.js: Added.

2019-03-18  Mark Lam  <mark.lam@apple.com>

        Missing a ThrowScope release in JSObject::toString().
        https://bugs.webkit.org/show_bug.cgi?id=195893
        <rdar://problem/48970986>

        Reviewed by Michael Saboff.

        * stress/to-string-exception-check-release.js: Added.

2019-03-18  Mark Lam  <mark.lam@apple.com>

        Structure::flattenDictionary() should clear unused property slots.
        https://bugs.webkit.org/show_bug.cgi?id=195871
        <rdar://problem/48959497>

        Reviewed by Michael Saboff.

        * stress/structure-flattenDictionary-should-clear-unused-property-slots.js: Added.

2019-03-15  Mark Lam  <mark.lam@apple.com>

        Need to check ObjectPropertyCondition liveness before accessing it when firing watchpoints.
        https://bugs.webkit.org/show_bug.cgi?id=195827
        <rdar://problem/48845513>

        Reviewed by Filip Pizlo.

        * stress/check-object-property-condition-liveness-before-accessing-it-when-watchpoints-fire.js: Added.

2019-03-15  Dominik Infuehr  <dinfuehr@igalia.com>

        [ARM,MIPS] Skip slow tests
        https://bugs.webkit.org/show_bug.cgi?id=195799

        Unreviewed, test does not finish on ARM and MIPS within the
        timeout limit.

        * stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js:

2019-03-14  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Retain PrivateName of Symbol before passing it to operations potentially incurring GC
        https://bugs.webkit.org/show_bug.cgi?id=195791
        <rdar://problem/48806130>

        Reviewed by Mark Lam.

        * stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js: Added.
        (foo):

2019-03-14  Saam barati  <sbarati@apple.com>

        We can't remove code after ForceOSRExit until after FixupPhase
        https://bugs.webkit.org/show_bug.cgi?id=186916
        <rdar://problem/41396612>

        Reviewed by Yusuke Suzuki.

        * stress/movhint-backwards-propagation-must-merge-use-as-value-add.js: Added.
        (foo):
        * stress/movhint-backwards-propagation-must-merge-use-as-value.js: Added.
        (foo):

2019-03-13  Michael Saboff  <msaboff@apple.com>

        ASSERTION FAILED: regexp->isValid() or ASSERTION FAILED: !isCompilationThread()
        https://bugs.webkit.org/show_bug.cgi?id=195735

        Reviewed by Mark Lam.

        New regression test.

        * stress/dont-strength-reduce-regexp-with-compile-error.js: Added.
        (foo):
        (bar):

2019-03-14  Saam barati  <sbarati@apple.com>

        Fixup uses KnownInt32 incorrectly in some nodes
        https://bugs.webkit.org/show_bug.cgi?id=195279
        <rdar://problem/47915654>

        Reviewed by Yusuke Suzuki.

        * stress/known-int32-cant-be-used-across-bytecode-boundary.js: Added.
        (foo):

2019-03-14  Keith Miller  <keith_miller@apple.com>

        DFG liveness can't skip tail caller inline frames
        https://bugs.webkit.org/show_bug.cgi?id=195715

        Reviewed by Saam Barati.

        * stress/dfg-scan-inlined-tail-caller-frames-liveness.js:
        (i.foo):

2019-03-13  Mark Lam  <mark.lam@apple.com>

        Gardening: reducing the variants on 2 tests to avoid timing out on JSC Debug queue.
        https://bugs.webkit.org/show_bug.cgi?id=195415

        Not reviewed.

        Changed these tests to only run the default configuration.
        The ftl-no-cjit-validate-sampling-profiler variant was timing out.
        There's no strong need to run this test on that variant.

        * stress/dfg-to-string-on-int-does-gc.js:
        * stress/dfg-to-string-on-string-or-string-object-does-not-gc.js:

2019-03-13  Dominik Infuehr  <dinfuehr@igalia.com>

        String overflow when using StringBuilder in JSC::createError
        https://bugs.webkit.org/show_bug.cgi?id=194957

        Reviewed by Mark Lam.

        Add test string-overflow-createError-bulder.js that overflows
        StringBuilder in notAFunctionSourceAppender. The second new test
        string-overflow-createError-fit.js has an error message that doesn't
        overflow, it still failed since the String's capacity can't be doubled.
        Run test string-overflow-createError.js only in the default
        configuration to reduce memory consumption when running the test
        in all configurations on multiple CPUs in parallel.

        * stress/string-overflow-createError-builder.js: Copied from JSTests/stress/string-overflow-createError.js.
        (catch):
        * stress/string-overflow-createError-fit.js: Copied from JSTests/stress/string-overflow-createError.js.
        (catch):
        * stress/string-overflow-createError.js:

2019-03-12  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] OSR entry should respect abstract values in addition to flush formats
        https://bugs.webkit.org/show_bug.cgi?id=195653

        Reviewed by Mark Lam.

        * stress/osr-entry-locals-none.js: Added.

2019-03-12  Michael Saboff  <msaboff@apple.com>

        REGRESSION (iOS 12.2): Webpage using CoffeeScript crashes
        https://bugs.webkit.org/show_bug.cgi?id=195613

        Reviewed by Mark Lam.

        New regression test.

        * stress/regexp-backref-inbounds.js: Added.
        (testRegExp):

2019-03-12  Mark Lam  <mark.lam@apple.com>

        The HasIndexedProperty node does GC.
        https://bugs.webkit.org/show_bug.cgi?id=195559
        <rdar://problem/48767923>

        Reviewed by Yusuke Suzuki.

        * stress/HasIndexedProperty-does-gc.js: Added.

2019-03-11  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Implement "~" unary operation
        https://bugs.webkit.org/show_bug.cgi?id=182216

        Reviewed by Keith Miller.

        * stress/big-int-bit-not-general.js: Added.
        * stress/big-int-bitwise-not-jit.js: Added.
        * stress/big-int-bitwise-not-wrapped-value.js: Added.
        * stress/bit-op-with-object-returning-int32.js:
        * stress/bitwise-not-fixup-rules.js: Added.
        * stress/value-bit-not-ai-rule.js: Added.

2019-03-10  Ross Kirsling  <ross.kirsling@sony.com>

        Invalid flags in a RegExp literal should be an early SyntaxError
        https://bugs.webkit.org/show_bug.cgi?id=195514

        Reviewed by Darin Adler.

        * test262/expectations.yaml:
        Mark 4 test cases as passing.

        * stress/regexp-syntax-error-invalid-flags.js:
        * stress/regress-161995.js: Removed.
        Update existing test, merging in an older test for the same behavior.

2019-03-08  Mark Lam  <mark.lam@apple.com>

        Stack overflow crash in JSC::JSObject::hasInstance.
        https://bugs.webkit.org/show_bug.cgi?id=195458
        <rdar://problem/48710195>

        Reviewed by Yusuke Suzuki.

        * stress/stack-overflow-in-custom-hasInstance.js: Added.

2019-03-08  Tadeu Zagallo  <tzagallo@apple.com>

        op_check_tdz does not def its argument
        https://bugs.webkit.org/show_bug.cgi?id=192880
        <rdar://problem/46221598>

        Reviewed by Saam Barati.

        * microbenchmarks/let-for-in.js: Added.
        (foo):

2019-03-07  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] StringFromCharCode fast path should accept 0xff in DFG and FTL
        https://bugs.webkit.org/show_bug.cgi?id=195429

        Reviewed by Saam Barati.

        * stress/must-handled-values-should-not-be-used-as-proven-constants-in-cfa.js: Added.
        (foo):
        * stress/string-from-char-code-255.js: Added.

2019-03-06  Mark Lam  <mark.lam@apple.com>

        Fix incorrect handling of try-finally completion values.
        https://bugs.webkit.org/show_bug.cgi?id=195131
        <rdar://problem/46222079>

        Reviewed by Saam Barati and Yusuke Suzuki.

        Added many permutations of new test case to test-finally.js.  test-finally.js has
        been run on Chrome and Firefox as a sanity check, and we confirmed that all the
        tests passes there as well.

        * stress/test-finally.js:

2019-03-06  Saam Barati  <sbarati@apple.com>

        Air::reportUsedRegisters must padInterference
        https://bugs.webkit.org/show_bug.cgi?id=195303
        <rdar://problem/48270343>

        Reviewed by Keith Miller.

        * stress/optional-def-arg-width-should-be-both-early-and-late-use.js: Added.

2019-03-06  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] AI should not propagate AbstractValue relying on constant folding phase
        https://bugs.webkit.org/show_bug.cgi?id=195375

        Reviewed by Saam Barati.

        * stress/make-rope-should-not-propagate-constant-folded-value-in-ai.js: Added.
        (let.array):

2019-03-05  Saam barati  <sbarati@apple.com>

        op_switch_char broken for rope strings after JSRopeString layout rewrite
        https://bugs.webkit.org/show_bug.cgi?id=195339
        <rdar://problem/48592545>

        Reviewed by Yusuke Suzuki.

        * stress/switch-on-char-llint-rope.js: Added.

2019-03-04  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Store bits for JSRopeString in 3 stores
        https://bugs.webkit.org/show_bug.cgi?id=195234

        Reviewed by Saam Barati.

        * stress/null-rope-and-collectors.js: Added.

2019-03-01  Dominik Infuehr  <dinfuehr@igalia.com>

        Unskip test read-dead-bytecode-locals-in-must-have-handle-values2.js on ARM/MIPS
        https://bugs.webkit.org/show_bug.cgi?id=195207

        Unreviewed. After test runtime was reduced in r242213, test can be
        run again on ARM/MIPS.

        * stress/read-dead-bytecode-locals-in-must-handle-values2.js:

2019-02-28  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] sizeof(JSString) should be 16
        https://bugs.webkit.org/show_bug.cgi?id=194375

        Reviewed by Saam Barati.

        * microbenchmarks/make-rope.js: Added.
        (makeRope):
        * stress/to-lower-case-intrinsic-on-empty-rope.js: We no longer allow 0 length JSString except for jsEmptyString singleton per VM.
        (returnRope.helper): Deleted.
        (returnRope): Deleted.

2019-02-28  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, reduce the count in the stress/read-dead-bytecode-locals-in-must-handle-values2.js
        https://bugs.webkit.org/show_bug.cgi?id=195144

        1e8 takes too much time in the Debug build. I tried 1e5 with the old Debug build and it successfully reproduced the issue.
        Change the number from 1e8 to 1e5.

        * stress/read-dead-bytecode-locals-in-must-handle-values2.js:
        (foo):

2019-02-28  Dominik Infuehr  <dinfuehr@igalia.com>

        Test times out on ARM/MIPS
        https://bugs.webkit.org/show_bug.cgi?id=195168

        Unreviewed. Skip test on ARM/MIPS.

        * stress/read-dead-bytecode-locals-in-must-handle-values2.js:

2019-02-27  Mark Lam  <mark.lam@apple.com>

        The parser is failing to record the token location of new in new.target.
        https://bugs.webkit.org/show_bug.cgi?id=195127
        <rdar://problem/39645578>

        Reviewed by Yusuke Suzuki.

        * stress/parser-should-record-token-location-of-new-dot-target.js: Added.

2019-02-27  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] mustHandleValues for dead bytecode locals should be ignored in DFG phases
        https://bugs.webkit.org/show_bug.cgi?id=195144
        <rdar://problem/47595961>

        Reviewed by Mark Lam.

        * stress/read-dead-bytecode-locals-in-must-handle-values1.js: Added.
        (bar):
        (foo):
        * stress/read-dead-bytecode-locals-in-must-handle-values2.js: Added.
        (bar):
        (foo):

2019-02-27  Robin Morisset  <rmorisset@apple.com>

        DFG: Loop-invariant code motion (LICM) should not hoist dead code
        https://bugs.webkit.org/show_bug.cgi?id=194945
        <rdar://problem/48311657>

        Reviewed by Mark Lam.

        * stress/licm-dead-code.js: Added.

2019-02-26  Yusuke Suzuki  <ysuzuki@apple.com>

        REGRESSION: stress/regress-178386.js is timing out on JSC debug bot
        https://bugs.webkit.org/show_bug.cgi?id=194677
        <rdar://problem/48112492>

        Reviewed by Mark Lam.

        Before r241233, String.fromCharCode (except for an empty string) always returns 16bit string.
        This makes the rope generated by padEnd 16bit. When we resolve the rope inside JSON.stringify,
        it immediately fails due the large size.

        After r241233, String.fromCharCode starts returning 8bit string if possible. So the rope becomes
        8bit, and we successfully resolve the rope in this case. Resolving such a large rope takes long
        time and that is why stress/regress-178386.js starts timing out. Note that, the test fails with
        OOM error anyway because JSON.stringify's builder overflows with such a large string input.

        This patch changes the test to produce 16bit string from String.fromCharCode.

        * stress/regress-178386.js:

2019-02-26  Mark Lam  <mark.lam@apple.com>

        wasmToJS() should purify incoming NaNs.
        https://bugs.webkit.org/show_bug.cgi?id=194807
        <rdar://problem/48189132>

        Reviewed by Saam Barati.

        * wasm/regress/wasmToJS-should-purify-NaNs.js: Added.

2019-02-26  Guillaume Emont  <guijemont@igalia.com>

        [JSC] Repeat string created from Array.prototype.join() take too much memory
        https://bugs.webkit.org/show_bug.cgi?id=193912

        Reviewed by Saam Barati.

        Added a test and a microbenchmark for corner cases of
        Array.prototype.join() with an uninitialized array.

        * microbenchmarks/array-prototype-join-uninitialized.js: Added.
        * stress/array-prototype-join-uninitialized.js: Added.
        (testArray):
        (testABC):
        (B):
        (C):

2019-02-22  Robin Morisset  <rmorisset@apple.com>

        DFGBytecodeParser should not declare that a node won't clobberExit if DFGFixupPhase can later declare it does clobberExit
        https://bugs.webkit.org/show_bug.cgi?id=194953
        <rdar://problem/47595253>

        Reviewed by Saam Barati.

        I could not make this work without the infinite loop, so I am using a watchdog to be able to use it as a regression test.

        * stress/has-indexed-property-with-worsening-array-mode.js: Added.

2019-02-19  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
        https://bugs.webkit.org/show_bug.cgi?id=172848
        <rdar://problem/25709212>

        Reviewed by Mark Lam.

        * typeProfiler/inheritance.js:
        Rewrite the test slightly for clarity. The hoisting was confusing.

        * heapProfiler/class-names.js: Added.
        (MyES5Class):
        (MyES6Class):
        (MyES6Subclass):
        Test object types and improved class names.

        * heapProfiler/driver/driver.js:
        (CheapHeapSnapshotNode):
        (CheapHeapSnapshot):
        (createCheapHeapSnapshot):
        (HeapSnapshot):
        (createHeapSnapshot):
        Update snapshot parsing from version 1 to version 2.

2019-02-19  Truitt Savell  <tsavell@apple.com>

        Unreviewed, rolling out r241784.

        Broke all OpenSource builds.

        Reverted changeset:

        "Web Inspector: Improve ES6 Class instances in Heap Snapshot
        instances view"
        https://bugs.webkit.org/show_bug.cgi?id=172848
        https://trac.webkit.org/changeset/241784

2019-02-19  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
        https://bugs.webkit.org/show_bug.cgi?id=172848
        <rdar://problem/25709212>

        Reviewed by Mark Lam.

        * typeProfiler/inheritance.js:
        Rewrite the test slightly for clarity. The hoisting was confusing.

        * heapProfiler/class-names.js: Added.
        (MyES5Class):
        (MyES6Class):
        (MyES6Subclass):
        Test object types and improved class names.

        * heapProfiler/driver/driver.js:
        (CheapHeapSnapshotNode):
        (CheapHeapSnapshot):
        (createCheapHeapSnapshot):
        (HeapSnapshot):
        (createHeapSnapshot):
        Update snapshot parsing from version 1 to version 2.

2019-02-18  Dominik Infuehr  <dinfuehr@igalia.com>

        [ARM] Fix crash with sampling profiler
        https://bugs.webkit.org/show_bug.cgi?id=194772

        Reviewed by Mark Lam.

        Do not skip test since crash with sampling profiler is now fixed.

        * stress/sampling-profiler-richards.js:

2019-02-18  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Add LazyClassStructure::getInitializedOnMainThread
        https://bugs.webkit.org/show_bug.cgi?id=194784
        <rdar://problem/48154820>

        Reviewed by Mark Lam.

        * stress/lazy-initialization-done-a-priori-if-jit-enabled.js: Added.
        (getProperties):
        (getRandomProperty):
        (i.catch):

2019-02-18  Dominik Infuehr  <dinfuehr@igalia.com>

        [ARM] Test gardening: Test running out of executable memory
        https://bugs.webkit.org/show_bug.cgi?id=194771

        Unreviewed. Do not run test without LLInt, test is running out of executable
        memory on ARM otherwise.

        * stress/tagged-template-object-collect.js:

2019-02-18  Tomas Popela  <tpopela@redhat.com>

        Unreviewed, skip the test on platforms without sampling profiler

        * stress/sampling-profiler-stack-trace-with-double-quote-in-function-name.js:
        (platformSupportsSamplingProfiler.foo):
        (platformSupportsSamplingProfiler.test):
        (platformSupportsSamplingProfiler):
        (foo): Deleted.
        (test): Deleted.

2019-02-17  Saam Barati  <sbarati@apple.com>

        Deadlock when adding a Structure property transition and then doing incremental marking
        https://bugs.webkit.org/show_bug.cgi?id=194767

        Reviewed by Mark Lam.

        * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js: Added.

2019-02-15  Michael Saboff  <msaboff@apple.com>

        RELEASE_ASSERT at com.apple.JavaScriptCore: JSC::jsSubstringOfResolved
        https://bugs.webkit.org/show_bug.cgi?id=194558

        Reviewed by Saam Barati.

        New regression test.

        * stress/regexp-unicode-within-string.js: Added.

2019-02-15  Mark Lam  <mark.lam@apple.com>

        SamplingProfiler::stackTracesAsJSON() should escape strings.
        https://bugs.webkit.org/show_bug.cgi?id=194649
        <rdar://problem/48072386>

        Reviewed by Saam Barati.

        * stress/sampling-profiler-stack-trace-with-double-quote-in-function-name.js: Added.
        * stress/type-profiler-with-double-quote-in-constructor-name.js: Added.
        * stress/type-profiler-with-double-quote-in-field-name.js: Added.
        * stress/type-profiler-with-double-quote-in-optional-field-name.js: Added.

2019-02-15  Robin Morisset  <rmorisset@apple.com>
        CodeBlock::jettison should clear related watchpoints
        https://bugs.webkit.org/show_bug.cgi?id=194544

        Reviewed by Mark Lam.

        * stress/regexp-replace-double-watchpoint.js: Added.
        (foo):

2019-02-15  Saam barati  <sbarati@apple.com>

        [WebAssembly] Write a new register allocator for Air O0 and make BBQ use it
        https://bugs.webkit.org/show_bug.cgi?id=194036

        Reviewed by Yusuke Suzuki.

        * stress/tail-call-many-arguments.js: Added.
        (foo):
        (bar):

2019-02-14  Saam Barati  <sbarati@apple.com>

        Cache the results of BytecodeGenerator::getVariablesUnderTDZ
        https://bugs.webkit.org/show_bug.cgi?id=194583
        <rdar://problem/48028140>

        Reviewed by Yusuke Suzuki.

        * microbenchmarks/cache-get-variables-under-tdz-in-bytecode-generator.js: Added.

2019-02-08  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] String.fromCharCode's slow path always generates 16bit string
        https://bugs.webkit.org/show_bug.cgi?id=194466

        Reviewed by Keith Miller.

        * stress/string-from-char-code-slow-path.js: Added.
        (shouldBe):
        (testWithLength):

2019-02-08  Saam barati  <sbarati@apple.com>

        Nodes that rely on being dominated by CheckInBounds should have a child edge to it
        https://bugs.webkit.org/show_bug.cgi?id=194334
        <rdar://problem/47844327>

        Reviewed by Mark Lam.

        * stress/check-in-bounds-should-be-a-child-use.js: Added.
        (func):

2019-02-06  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] InitializeEntrypointArguments should produce SpecCellCheck if FlushFormat is FlushedCell
        https://bugs.webkit.org/show_bug.cgi?id=194369
        <rdar://problem/47813087>

        Reviewed by Saam Barati.

        * stress/initialize-entrypoint-arguments-with-tdz.js: Added.
        (A):

2019-02-06  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] PrivateName to PublicName hash table is wasteful
        https://bugs.webkit.org/show_bug.cgi?id=194277

        Reviewed by Michael Saboff.

        This test depends on the order of JSSegmentedVariableObjects' variables, which is not guaranteed in JSC. Skipped.

        * ChakraCore.yaml:

2019-02-05  Dominik Infuehr  <dinfuehr@igalia.com>

        [ARM] Test running out of executable memory
        https://bugs.webkit.org/show_bug.cgi?id=194285

        Unreviewed. Do no execute test with LLInt disabled, test runs out of
        executable memory otherwise.

        * stress/class-subclassing-function.js:

2019-02-04  Robin Morisset  <rmorisset@apple.com>

        when lowering AssertNotEmpty, create the value before creating the patchpoint
        https://bugs.webkit.org/show_bug.cgi?id=194231

        Reviewed by Saam Barati.

        This test is painfully fragile: it tries to test that AssertNotEmpty on a constant produces valid B3 IR.
        The problem is that AssertNotEmpty is only created by DFGConstantFolding when it can simplify a CheckStructure, and constant folding is a bit capricious (https://bugs.webkit.org/show_bug.cgi?id=133947)
        So even tiny changes to this test can change the path code taken.

        * stress/assert-not-empty.js: Added.
        (foo):

2019-02-01  Mark Lam  <mark.lam@apple.com>

        Remove invalid assertion in DFG's compileDoubleRep().
        https://bugs.webkit.org/show_bug.cgi?id=194130
        <rdar://problem/47699474>

        Reviewed by Saam Barati.

        * stress/constant-fold-double-rep-into-double-constant.js: Added.

2019-01-30  Ross Kirsling  <ross.kirsling@sony.com>

        Import latest Test262 updates.

        Rubber-stamped by Keith Miller.

        * test262.yaml: Deleted.
        * test262/config.yaml:
        * test262/expectations.yaml:
        * test262/latest-changes-summary.txt:
        * test262/test/:
        * test262/test262-Revision.txt:

2019-01-30  Robin Morisset  <rmorisset@apple.com>

        Object.keys can now lead to a PhantomNewArrayBuffer, OSR exit from the FTL should know how to materialize a NewArrayBuffer in that case
        https://bugs.webkit.org/show_bug.cgi?id=194050
        <rdar://problem/47595592>

        Reviewed by Yusuke Suzuki.

        * stress/object-keys-osr-exit.js: Added.
        (foo):
        (catch):

2019-01-29  Mark Lam  <mark.lam@apple.com>

        ValueRecovery::recover() should purify NaN values it recovers.
        https://bugs.webkit.org/show_bug.cgi?id=193978
        <rdar://problem/47625488>

        Reviewed by Saam Barati.

        * stress/value-recovery-of-double-displaced-in-jsstack-should-be-purified.js: Added.

2019-01-28  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, fix the test after r240543 not to use @Error / Error in builtins
        https://bugs.webkit.org/show_bug.cgi?id=193713

        * stress/try-get-by-id-should-spill-registers-dfg.js:
        (let.f.createBuiltin):

2019-01-28  Mark Lam  <mark.lam@apple.com>

        ToString node actually does GC.
        https://bugs.webkit.org/show_bug.cgi?id=193920
        <rdar://problem/46695900>

        Reviewed by Yusuke Suzuki.

        * stress/dfg-to-string-on-int-does-gc.js: Added.
        * stress/dfg-to-string-on-string-object-does-not-gc.js: Added.
        * stress/dfg-to-string-on-string-or-string-object-does-not-gc.js: Added.

2019-01-25  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] NativeErrorConstructor should not have own IsoSubspace
        https://bugs.webkit.org/show_bug.cgi?id=193713

        Reviewed by Saam Barati.

        Remove @Error use.

        * stress/try-get-by-id-should-spill-registers-dfg.js:
        (let.f.createBuiltin):

2019-01-24  Yusuke Suzuki  <ysuzuki@apple.com>

        stress/const-semantics.js fails a dfg-eager / ftl-eager run with an ASAN release build.
        https://bugs.webkit.org/show_bug.cgi?id=190693

        Reviewed by Michael Saboff.

        * stress/regress-190693.js: Added.
        (truth):
        (assert):
        (shouldThrowInvalidConstAssignment):
        (taz):

2019-01-24  Saam Barati  <sbarati@apple.com>

        Object Allocation Sinking phase can move a node that walks the stack into a place where the InlineCallFrame is no longer valid
        https://bugs.webkit.org/show_bug.cgi?id=193751
        <rdar://problem/47280215>

        Reviewed by Michael Saboff.

        * stress/object-allocation-sinking-phase-must-only-move-allocations-if-stack-trace-is-still-valid.js: Added.
        (let.thing):
        (foo.let.hello):
        (foo):

2019-01-24  Guillaume Emont  <guijemont@igalia.com>

        [JSC] Reenable baseline JIT on mips
        https://bugs.webkit.org/show_bug.cgi?id=192983

        Reviewed by Mark Lam.

        Added a new test for a case that was triggering a RELEASE_ASSERT when
        testing.
        Disable some slow tests that were already disabled for arm and x86.

        * stress/json-parse-big-object.js: Added.
        * stress/new-largeish-contiguous-array-with-size.js:
        * stress/op_add.js:
        * stress/op_bitand.js:
        * stress/op_bitor.js:
        * stress/op_bitxor.js:
        * stress/op_lshift-ConstVar.js:
        * stress/op_lshift-VarConst.js:
        * stress/op_lshift-VarVar.js:
        * stress/op_mod-ConstVar.js:
        * stress/op_mod-VarConst.js:
        * stress/op_mod-VarVar.js:
        * stress/op_mul-ConstVar.js:
        * stress/op_mul-VarConst.js:
        * stress/op_mul-VarVar.js:
        * stress/op_rshift-ConstVar.js:
        * stress/op_rshift-VarConst.js:
        * stress/op_rshift-VarVar.js:
        * stress/op_sub-ConstVar.js:
        * stress/op_sub-VarConst.js:
        * stress/op_sub-VarVar.js:
        * stress/op_urshift-ConstVar.js:
        * stress/op_urshift-VarConst.js:
        * stress/op_urshift-VarVar.js:
        * stress/sampling-profiler-richards.js:
        * stress/spread-forward-call-varargs-stack-overflow.js:

2019-01-23  Yusuke Suzuki  <ysuzuki@apple.com>

        [DFG] AvailabilityMap::pruneByLiveness should make non-live operands Availability::unavailable instead of Availability()
        https://bugs.webkit.org/show_bug.cgi?id=193711
        <rdar://problem/47250262>

        Reviewed by Saam Barati.

        * stress/availability-was-cleared-when-locals-are-not-live.js: Added.
        (shouldBe):
        (foo):
        (bar):
        (baz):

2019-01-22  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, fix initial global lexical binding epoch
        https://bugs.webkit.org/show_bug.cgi?id=193603
        <rdar://problem/47380869>

        * stress/global-lexical-binding-epoch-should-be-correct-one.js: Added.
        (f1.f2.f3.f4):
        (f1.f2.f3):
        (f1.f2):
        (f1):

2019-01-22  Yusuke Suzuki  <ysuzuki@apple.com>

        REGRESSION(r239612) Crash at runtime due to broken DFG assumption
        https://bugs.webkit.org/show_bug.cgi?id=193709
        <rdar://problem/47363838>

        Unreviewed, rollout to watch the tests.

        * stress/object-tostring-changed-proto.js: Removed.
        * stress/object-tostring-changed.js: Removed.
        * stress/object-tostring-misc.js: Removed.
        * stress/object-tostring-other.js: Removed.
        * stress/object-tostring-untyped.js: Removed.

2019-01-22  Saam Barati  <sbarati@apple.com>

        Unreviewed. Rollout r240223. It regressed JetStream2 by 1%.

        * stress/arith-abs-to-arith-negate-range-optimizaton.js:
        (testUncheckedBetweenIntMinInclusiveAndZeroExclusive):
        (testUncheckedLessThanZero):
        (testUncheckedLessThanOrEqualZero):
        * stress/movhint-backwards-propagation-must-merge-use-as-value-add.js: Removed.
        * stress/movhint-backwards-propagation-must-merge-use-as-value.js: Removed.

2019-01-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Invalidate old scope operations using global lexical binding epoch
        https://bugs.webkit.org/show_bug.cgi?id=193603
        <rdar://problem/47380869>

        Reviewed by Saam Barati.

        * stress/let-lexical-binding-shadow-existing-global-property-ftl.js:
        * stress/scope-operation-cache-global-property-before-deleting.js: Added.
        (shouldThrow):
        (bar):
        * stress/scope-operation-cache-global-property-bump-counter.js: Added.
        (shouldBe):
        (get1):
        (get2):
        (get1If):
        (get2If):
        * stress/scope-operation-cache-global-property-even-if-it-fails.js: Added.
        (shouldThrow):
        (foo):

2019-01-21  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, roll out r240220 due to date-format-xparb regression
        https://bugs.webkit.org/show_bug.cgi?id=193603

        * stress/let-lexical-binding-shadow-existing-global-property-ftl.js:
        * stress/scope-operation-cache-global-property-before-deleting.js: Removed.
        * stress/scope-operation-cache-global-property-bump-counter.js: Removed.
        * stress/scope-operation-cache-global-property-even-if-it-fails.js: Removed.

2019-01-21  Caio Lima  <ticaiolima@gmail.com>

        DoesGC rule is wrong for nodes with BigIntUse
        https://bugs.webkit.org/show_bug.cgi?id=193652

        Reviewed by Saam Barati.

        * stress/big-int-value-op-update-gc-rules.js: Added.
        (assert):
        (doesGCAdd):
        (doesGCSub):
        (doesGCDiv):
        (doesGCMul):
        (doesGCBitAnd):
        (doesGCBitOr):
        (doesGCBitXor):

2019-01-20  Saam Barati  <sbarati@apple.com>

        DFG: When inlining DataView set* intrinsics we need to set undefined as our result
        https://bugs.webkit.org/show_bug.cgi?id=193644
        <rdar://problem/46209745>

        Reviewed by Yusuke Suzuki.

        * stress/data-view-set-intrinsic-undefined-result-2.js: Added.
        (foo):
        * stress/data-view-set-intrinsic-undefined-result.js: Added.
        (foo):
        (bar):

2019-01-20  Saam Barati  <sbarati@apple.com>

        MovHint must merge NodeBytecodeUsesAsValue for its child
        https://bugs.webkit.org/show_bug.cgi?id=186916
        <rdar://problem/41396612>

        Reviewed by Yusuke Suzuki.

        * stress/arith-abs-to-arith-negate-range-optimizaton.js:
        * stress/movhint-backwards-propagation-must-merge-use-as-value.js: Added.

2019-01-20  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Invalidate old scope operations using global lexical binding epoch
        https://bugs.webkit.org/show_bug.cgi?id=193603
        <rdar://problem/47380869>

        Reviewed by Saam Barati.

        * stress/let-lexical-binding-shadow-existing-global-property-ftl.js:
        * stress/scope-operation-cache-global-property-before-deleting.js: Added.
        (shouldThrow):
        (bar):
        * stress/scope-operation-cache-global-property-bump-counter.js: Added.
        (shouldBe):
        (get1):
        (get2):
        (get1If):
        (get2If):
        * stress/scope-operation-cache-global-property-even-if-it-fails.js: Added.
        (shouldThrow):
        (foo):

2019-01-17  Saam barati  <sbarati@apple.com>

        StringObjectUse should not be a structure check for the original string object structure
        https://bugs.webkit.org/show_bug.cgi?id=193483
        <rdar://problem/47280522>

        Reviewed by Yusuke Suzuki.

        * stress/cant-eliminate-string-object-structure-check-when-string-object-is-proven.js: Added.
        (foo):
        (a.valueOf.0):

2019-01-17  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] ToThis omission in DFGByteCodeParser is wrong
        https://bugs.webkit.org/show_bug.cgi?id=193513
        <rdar://problem/45842236>

        Reviewed by Saam Barati.

        * stress/to-this-omission-with-different-strict-modes.js: Added.
        (thisA):
        (thisAStrictWrapper):

2019-01-15  Mark Lam  <mark.lam@apple.com>

        JSFunction::canUseAllocationProfile() should account for builtin functions with no own prototypes.
        https://bugs.webkit.org/show_bug.cgi?id=193423
        <rdar://problem/46209355>

        Reviewed by Saam Barati.

        * microbenchmarks/sinkable-new-object-with-builtin-constructor.js: Added.
        * stress/constructing-builtin-functions-with-getter-prototype-should-only-call-getter-once-per-new-1.js: Added.
        * stress/constructing-builtin-functions-with-getter-prototype-should-only-call-getter-once-per-new-2.js: Added.
        * stress/jsfunction-cannot-use-allocation-profile-with-builtin-functions-with-no-prototype.js: Added.

2019-01-15  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] Use KnownStringUse for GetByVal(Array::String) since AI would offer wider type information and offer non-string type after removing Check(String)
        https://bugs.webkit.org/show_bug.cgi?id=193438
        <rdar://problem/45581249>

        Reviewed by Saam Barati and Keith Miller.

        Under the heavy load (like, compiling WebKit), AI in this code can broaden type information after the 1st run.
        Then, GetByVal(String) crashed.

        * stress/string-get-by-val-lowering.js: Added.
        (shouldBe):
        (test):
        * stress/type-for-get-by-val-can-be-widen-after-ai.js: Added.
        (Hello):
        (foo):

2019-01-15  Tomas Popela  <tpopela@redhat.com>

        Unreviewed, skip JIT tests if it's not enabled

        * stress/bit-op-with-object-returning-int32.js:

2019-01-15  Caio Lima  <ticaiolima@gmail.com>

        DFGByteCodeParser rules for bitwise operations should consider type of their operands
        https://bugs.webkit.org/show_bug.cgi?id=192966

        Reviewed by Yusuke Suzuki.

        * stress/bit-op-with-object-returning-int32.js: Added.

2019-01-15  Guillaume Emont  <guijemont@igalia.com>

        Skip a slow test and a flakey test on arm

        Unreviewed gardening.

        * typeProfiler/getter-richards.js:
        this test always times out, it used to be always skipped on arm and
        mips, but got accidentally enabled by r237919 now that we have DFG on
        arm. Also skipping on mips as we plan to soon enable DFG for it too.

2019-01-14  Keith Miller  <keith_miller@apple.com>

        Skip type-check-hoisting-phase-hoist... with no jit
        https://bugs.webkit.org/show_bug.cgi?id=193421

        Reviewed by Mark Lam.

        It's timing out the 32-bit bots and takes 330 seconds
        on my machine when run by itself.

        * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js:

2019-01-14  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] AI should check the given constant's array type when folding GetByVal into constant
        https://bugs.webkit.org/show_bug.cgi?id=193413
        <rdar://problem/46092389>

        Reviewed by Keith Miller.

        This test is super flaky. It causes crash in r238109, but it does not crash with `--useConcurrentJIT=false`.
        It does not cause any crashes on the latest revision too. Basically, it highly depends on the timing, and
        without this patch, the root cause is not fixed yet. If GetLocal is turned into JSConstant in AI,
        but GetByVal does not have appropriate ArrayModes, JSC crashes.

        * stress/ai-should-perform-array-check-on-get-by-val-constant-folding.js: Added.
        (compareArray):

2019-01-14  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] Literal parsing is crashing when used inside a Object Literal
        https://bugs.webkit.org/show_bug.cgi?id=193404

        Reviewed by Yusuke Suzuki.

        * stress/big-int-literal-inside-literal-object.js: Added.

2019-01-14  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] Do not use asArrayModes() with Structures because it discards TypedArray information
        https://bugs.webkit.org/show_bug.cgi?id=193372

        Reviewed by Saam Barati.

        * stress/typed-array-array-modes-profile.js: Added.
        (foo):

2019-01-14  Mark Lam  <mark.lam@apple.com>

        Fix all CLoop JSC test failures (including some LLInt bugs due to recent bytecode format change).
        https://bugs.webkit.org/show_bug.cgi?id=193402
        <rdar://problem/46012309>

        Reviewed by Keith Miller.

        * stress/regexp-compile-oom.js:
        - Skip this test for !$jitTests because it is tuned for stack usage when the JIT
          is enabled.  As a result, it will fail on cloop builds though there is no bug.

2019-01-11  Saam barati  <sbarati@apple.com>

        DFG combined liveness can be wrong for terminal basic blocks
        https://bugs.webkit.org/show_bug.cgi?id=193304
        <rdar://problem/45268632>

        Reviewed by Yusuke Suzuki.

        * stress/dfg-combined-liveness-consider-terminal-blocks-bytecode-liveness.js: Added.

2019-01-11  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] Global lexical bindings can shadow global variables if it is `configurable = true`
        https://bugs.webkit.org/show_bug.cgi?id=193308
        <rdar://problem/45546542>

        Reviewed by Saam Barati.

        * stress/const-lexical-binding-shadow-existing-global-property-ftl.js: Added.
        (shouldThrow):
        (shouldBe):
        (foo):
        (get shouldThrow):
        * stress/const-lexical-binding-shadow-existing-global-property-tdz-ftl.js: Added.
        (shouldThrow):
        (shouldBe):
        (foo):
        (get shouldBe):
        (get shouldThrow):
        (get return):
        * stress/const-lexical-binding-shadow-existing-global-property-tdz.js: Added.
        (shouldThrow):
        (shouldBe):
        (foo):
        (get shouldBe):
        (get shouldThrow):
        * stress/const-lexical-binding-shadow-existing-global-property.js: Added.
        (shouldThrow):
        (shouldBe):
        (foo):
        * stress/const-lexical-binding-shadowing-global-properties-and-eval-injection.js: Added.
        (shouldThrow):
        (shouldBe):
        (foo):
        * stress/global-add-function-should-not-be-shadowed-by-lexical-bindings.js: Added.
        (shouldThrow):
        * stress/global-static-variables-should-not-be-shadowed-by-lexical-bindings.js: Added.
        (shouldThrow):
        * stress/let-lexical-binding-shadow-existing-global-property-ftl.js: Added.
        (shouldThrow):
        (shouldBe):
        (foo):
        * stress/let-lexical-binding-shadow-existing-global-property-tdz-ftl.js: Added.
        (shouldThrow):
        (shouldBe):
        (foo):
        (get shouldBe):
        (get shouldThrow):
        (get return):
        * stress/let-lexical-binding-shadow-existing-global-property-tdz.js: Added.
        (shouldThrow):
        (shouldBe):
        (foo):
        (get shouldBe):
        (get shouldThrow):
        * stress/let-lexical-binding-shadow-existing-global-property.js: Added.
        (shouldThrow):
        (shouldBe):
        (foo):
        * stress/let-lexical-binding-shadowing-global-properties-and-eval-injection.js: Added.
        (shouldThrow):
        (shouldBe):
        (foo):

2019-01-11  Dominik Infuehr  <dinfuehr@igalia.com>

        Enable DFG on ARM/Linux again
        https://bugs.webkit.org/show_bug.cgi?id=192496

        Reviewed by Yusuke Suzuki.

        Test wasn't really skipped before moving the line with skip
        to the top.

        * stress/regress-192717.js:

2019-01-10  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r239825.
        https://bugs.webkit.org/show_bug.cgi?id=193330

        Broke tests on armv7/linux bots (Requested by guijemont on
        #webkit).

        Reverted changeset:

        "Enable DFG on ARM/Linux again"
        https://bugs.webkit.org/show_bug.cgi?id=192496
        https://trac.webkit.org/changeset/239825

2019-01-10  Dominik Infuehr  <dinfuehr@igalia.com>

        Enable DFG on ARM/Linux again
        https://bugs.webkit.org/show_bug.cgi?id=192496

        Reviewed by Yusuke Suzuki.

        Test wasn't really skipped before moving the line with skip
        to the top.

        * stress/regress-192717.js:

2019-01-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        Array.prototype.flat/flatMap have a minor bug in ArraySpeciesCreate
        https://bugs.webkit.org/show_bug.cgi?id=193127

        Reviewed by Saam Barati.

        * stress/array-species-create-should-handle-masquerader.js: Added.
        (shouldThrow):
        * stress/is-undefined-or-null-builtin.js: Added.
        (shouldBe):
        (isUndefinedOrNull.vm.createBuiltin):

2019-01-08  Tadeu Zagallo  <tzagallo@apple.com>

        LLInt put_by_id uses the wrong load instruction for loading flags from the metadata
        https://bugs.webkit.org/show_bug.cgi?id=193221

        Reviewed by Mark Lam.

        * stress/put-by-id-flags.js: Added.
        (f):
        (g):
        (numberOfDFGCompiles):

2019-01-04  Tadeu Zagallo  <tzagallo@apple.com>

        Baseline version of get_by_id may corrupt metadata
        https://bugs.webkit.org/show_bug.cgi?id=193085
        <rdar://problem/23453006>

        Reviewed by Saam Barati.

        * stress/get-by-id-change-mode.js: Added.
        (forEach):

2019-01-02  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] Optimize Object.prototype.toString
        https://bugs.webkit.org/show_bug.cgi?id=193031

        Reviewed by Saam Barati.

        * stress/object-tostring-changed-proto.js: Added.
        (shouldBe):
        (test):
        * stress/object-tostring-changed.js: Added.
        (shouldBe):
        (test):
        * stress/object-tostring-misc.js: Added.
        (shouldBe):
        (test):
        (i.switch):
        * stress/object-tostring-other.js: Added.
        (shouldBe):
        (test):
        * stress/object-tostring-untyped.js: Added.
        (shouldBe):
        (test):
        (i.switch):

2019-01-03  Ross Kirsling  <ross.kirsling@sony.com>

        test262-runner misbehaves when test file YAML has a trailing space
        https://bugs.webkit.org/show_bug.cgi?id=193053

        Reviewed by Yusuke Suzuki.

        * test262/expectations.yaml:
        Mark two dozen tests as passing (and correct the output of another).

2018-12-30  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        Unreviewed, JSTests gardening with memoryLimited

        * stress/string-overflow-createError.js:

2018-12-30  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Identifier validity should be based on ID_Start / ID_Continue properties
        https://bugs.webkit.org/show_bug.cgi?id=193050

        Reviewed by Yusuke Suzuki.

        * test262.yaml:
        * test262/expectations.yaml:
        Mark 16 tests as passing.

2018-12-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [BigInt] Support BigInt in JSON.stringify
        https://bugs.webkit.org/show_bug.cgi?id=192624

        Reviewed by Saam Barati.

        * stress/big-int-json-stringify-to-json.js: Added.
        (shouldBe):
        (shouldThrow):
        (BigInt.prototype.toJSON):
        (shouldBe.JSON.stringify):
        * stress/big-int-json-stringify.js: Added.
        (shouldBe):
        (shouldThrow):

2018-12-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] Implement "well-formed JSON.stringify" proposal
        https://bugs.webkit.org/show_bug.cgi?id=191677

        Reviewed by Darin Adler.

        * stress/json-surrogate-pair.js: Added.
        (shouldBe):
        * test262/expectations.yaml:

2018-12-20  Keith Miller  <keith_miller@apple.com>

        Add support for globalThis
        https://bugs.webkit.org/show_bug.cgi?id=165171

        Reviewed by Mark Lam.

        * test262/config.yaml:

2018-12-19  Keith Miller  <keith_miller@apple.com>

        Update test262 configuration to not run tests dependent on ICU version.
        https://bugs.webkit.org/show_bug.cgi?id=192920

        Reviewed by Saam Barati.

        * test262/expectations.yaml:

2018-12-20  Mark Lam  <mark.lam@apple.com>

        Fix a typo in slow_path_construct_arityCheck and operationConstructArityCheck.
        https://bugs.webkit.org/show_bug.cgi?id=192939
        <rdar://problem/46869516>

        Reviewed by Keith Miller.

        * stress/stack-overflow-frame-for-construct-arityCheck-should-use-construct-codeBlock.js: Added.

2018-12-20  Tadeu Zagallo  <tzagallo@apple.com>

        WTF::String and StringImpl overflow MaxLength
        https://bugs.webkit.org/show_bug.cgi?id=192853
        <rdar://problem/45726906>

        Reviewed by Mark Lam.

        * stress/string-16bit-repeat-overflow.js: Added.
        (catch):

2018-12-19  Ross Kirsling  <ross.kirsling@sony.com>

        Unreviewed follow-up to r192914.

        * test262/expectations.yaml:
        Add the last 20 missing expectations.

2018-12-19  Keith Miller  <keith_miller@apple.com>

        Fix test262 expectations
        https://bugs.webkit.org/show_bug.cgi?id=192914

        Unreviewed, when I imported the latest round of test262 tests I must have failed to update the test expectations.

        * test262/expectations.yaml:

2018-12-19  Keith Miller  <keith_miller@apple.com>

        Update test262 tests.
        https://bugs.webkit.org/show_bug.cgi?id=192907

        Rubber stamped by Mark Lam.

        * test262/*: Omitted because prepare-changelog crashes.

2018-12-19  Mark Lam  <mark.lam@apple.com>

        JSPropertyNameEnumerator should cache the iterated object's structure only after getting its property names.
        https://bugs.webkit.org/show_bug.cgi?id=192464
        <rdar://problem/46519455>

        Reviewed by Saam Barati.

        This patch is about a 10% speed up on the new for-in-on-object-with-lazily-materialized-properties.js
        microbenchmark.

        * microbenchmarks/for-in-on-object-with-lazily-materialized-properties.js: Added.
        * stress/property-name-enumerator-should-cache-structure-after-getting-property-names.js: Added.

2018-12-19  Tadeu Zagallo  <tzagallo@apple.com>

        String overflow in JSC::createError results in ASSERT in WTF::makeString
        https://bugs.webkit.org/show_bug.cgi?id=192833
        <rdar://problem/45706868>

        Reviewed by Mark Lam.

        * stress/string-overflow-createError.js: Added.

2018-12-18  Ross Kirsling  <ross.kirsling@sony.com>

        Error message for `-x ** y` contains a typo.
        https://bugs.webkit.org/show_bug.cgi?id=192832

        Reviewed by Saam Barati.

        * ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
        (assert.assert.return.throws):
        * stress/pow-expects-update-expression-on-lhs.js:
        (throw.new.Error):
        Update test expectations which match against the exact error message.

2018-12-18  Mark Lam  <mark.lam@apple.com>

        Gardening: test options fix.
        https://bugs.webkit.org/show_bug.cgi?id=192822

        Unreviewed.

        * stress/json-stringify-string-builder-overflow.js:

2018-12-18  Mark Lam  <mark.lam@apple.com>

        JSON.stringify() should throw OOM on StringBuilder overflows.
        https://bugs.webkit.org/show_bug.cgi?id=192822
        <rdar://problem/46670577>

        Reviewed by Saam Barati.

        * stress/json-stringify-string-builder-overflow.js: Added.

2018-12-18  Ross Kirsling  <ross.kirsling@sony.com>

        Redeclaration of var over let/const/class should be a syntax error.
        https://bugs.webkit.org/show_bug.cgi?id=192298

        Reviewed by Keith Miller.

        * test262.yaml:
        * test262/expectations.yaml:
        Mark 46 tests as passing.

        * stress/block-scope-redeclarations.js:
        Add some new tests.

        * stress/for-in-invalidate-context-weird-assignments.js:
        * stress/for-in-tests.js:
        Replace tests for outdated behavior with tests for SyntaxError.

        * ChakraCore/test/LetConst/defer3.baseline-jsc:
        * ChakraCore/test/LetConst/letvar.baseline-jsc:
        Update expectations.

2018-12-18  Mark Lam  <mark.lam@apple.com>

        Skip the stress/elidable-new-object-roflcopter-then-exit.js test on 32-bit.
        https://bugs.webkit.org/show_bug.cgi?id=191374
        <rdar://problem/46525447>

        Reviewed by Yusuke Suzuki.

        This test runs too slow on 32-bit, and is not relevant for non-JIT builds.

        * stress/elidable-new-object-roflcopter-then-exit.js:

2018-12-17  Mark Lam  <mark.lam@apple.com>

        Skip the stress/materialized-regexp-has-correct-last-index-set-by-match.js test on 32-bit.
        https://bugs.webkit.org/show_bug.cgi?id=192019
        <rdar://problem/46525456>

        Reviewed by Yusuke Suzuki.

        The test runs too slow on 32-bit.

        * stress/materialized-regexp-has-correct-last-index-set-by-match.js:

2018-12-17  Mark Lam  <mark.lam@apple.com>

        Skip the stress/materialize-regexp-cyclic-regexp.js test on 32-bit.
        https://bugs.webkit.org/show_bug.cgi?id=191373
        <rdar://problem/46525458>

        Reviewed by Yusuke Suzuki.

        The test is already slow running with a JIT on 64-bit.  It will always timeout
        on 32-bit without a JIT.

        * stress/materialize-regexp-cyclic-regexp.js:

2018-12-17  Mark Lam  <mark.lam@apple.com>

        Array unshift/shift should not race against the AI in the compiler thread.
        https://bugs.webkit.org/show_bug.cgi?id=192795
        <rdar://problem/46724263>

        Reviewed by Saam Barati.

        * stress/array-unshift-should-not-race-against-compiler-thread.js: Added.

2018-12-16  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] Optimize Object.keys by caching own keys results in StructureRareData
        https://bugs.webkit.org/show_bug.cgi?id=190047

        Reviewed by Saam Barati.

        * stress/object-keys-cached-zero.js: Added.
        (shouldBe):
        (test):
        * stress/object-keys-changed-attribute.js: Added.
        (shouldBe):
        (test):
        * stress/object-keys-changed-index.js: Added.
        (shouldBe):
        (test):
        * stress/object-keys-changed.js: Added.
        (shouldBe):
        (test):
        * stress/object-keys-indexed-non-cache.js: Added.
        (shouldBe):
        (test):
        * stress/object-keys-overrides-get-property-names.js: Added.
        (shouldBe):
        (test):
        (noInline):

2018-12-17  Mark Lam  <mark.lam@apple.com>

        SamplingProfiler's isValidFramePointer() should reject address at stack origin.
        https://bugs.webkit.org/show_bug.cgi?id=192779
        <rdar://problem/46775869>

        Reviewed by Saam Barati.

        * stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js: Added.

2018-12-17  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed test gardening, address a syntax error in a new test.

        * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js:

2018-12-17  Mark Lam  <mark.lam@apple.com>

        Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit().
        https://bugs.webkit.org/show_bug.cgi?id=192776
        <rdar://problem/46772368>

        Reviewed by Keith Miller.

        * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js: Added.

2018-12-17  Mark Lam  <mark.lam@apple.com>

        Fix stale assertion in attemptToForceStringArrayModeByToStringConversion().
        https://bugs.webkit.org/show_bug.cgi?id=192770
        <rdar://problem/46449037>

        Reviewed by Keith Miller.

        * stress/force-string-arrayMode-on-originalNonArray-array-class.js: Added.

2018-12-14  Mark Lam  <mark.lam@apple.com>

        CallFrame::convertToStackOverflowFrame() needs to keep the top CodeBlock alive.
        https://bugs.webkit.org/show_bug.cgi?id=192717
        <rdar://problem/46660677>

        Reviewed by Saam Barati.

        * stress/regress-192717.js: Added.

2018-12-14  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r239153, r239154, and r239155.
        https://bugs.webkit.org/show_bug.cgi?id=192715

        Caused flaky GC-related crashes seen with layout tests
        (Requested by ryanhaddad on #webkit).

        Reverted changesets:

        "[JSC] Optimize Object.keys by caching own keys results in
        StructureRareData"
        https://bugs.webkit.org/show_bug.cgi?id=190047
        https://trac.webkit.org/changeset/239153

        "Unreviewed, build fix after r239153"
        https://bugs.webkit.org/show_bug.cgi?id=190047
        https://trac.webkit.org/changeset/239154

        "Unreviewed, build fix after r239153, part 2"
        https://bugs.webkit.org/show_bug.cgi?id=190047
        https://trac.webkit.org/changeset/239155

2018-12-14  Keith Miller  <keith_miller@apple.com>

        Callers of JSString::getIndex should check for OOM exceptions
        https://bugs.webkit.org/show_bug.cgi?id=192709

        Reviewed by Mark Lam.

        * stress/StringObject-define-length-getter-rope-string-oom.js: Added.

2018-12-13  Mark Lam  <mark.lam@apple.com>

        Add a missing exception check.
        https://bugs.webkit.org/show_bug.cgi?id=192626
        <rdar://problem/46662163>

        Reviewed by Keith Miller.

        * stress/regress-192626.js: Added.

2018-12-13  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] Add ValueDiv into DFG
        https://bugs.webkit.org/show_bug.cgi?id=186178

        Reviewed by Yusuke Suzuki.

        * stress/big-int-div-jit-osr.js: Added.
        * stress/big-int-div-jit-untyped.js: Added.
        * stress/value-div-fixup-int32-big-int.js: Added.

2018-12-10  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] Optimize Object.keys by caching own keys results in StructureRareData
        https://bugs.webkit.org/show_bug.cgi?id=190047

        Reviewed by Keith Miller.

        * stress/object-keys-cached-zero.js: Added.
        (shouldBe):
        (test):
        * stress/object-keys-changed-attribute.js: Added.
        (shouldBe):
        (test):
        * stress/object-keys-changed-index.js: Added.
        (shouldBe):
        (test):
        * stress/object-keys-changed.js: Added.
        (shouldBe):
        (test):
        * stress/object-keys-indexed-non-cache.js: Added.
        (shouldBe):
        (test):
        * stress/object-keys-overrides-get-property-names.js: Added.
        (shouldBe):
        (test):
        (noInline):

2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [DFG][FTL] Add NewSymbol
        https://bugs.webkit.org/show_bug.cgi?id=192620

        Reviewed by Saam Barati.

        * microbenchmarks/symbol-creation.js: Added.
        (test):
        * stress/symbol-description-identity.js: Added.
        (shouldBe):
        (test):
        * stress/symbol-identity.js: Added.
        (shouldBe):
        (test):
        * stress/symbol-with-description-throw-error.js: Added.
        (shouldBe):
        (shouldThrow):
        (test):
        (object.toString):

2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [BigInt] Implement DFG/FTL typeof for BigInt
        https://bugs.webkit.org/show_bug.cgi?id=192619

        Reviewed by Keith Miller.

        * stress/big-int-boolean-proven-type.js: Added.
        (assert):
        (bool):
        * stress/big-int-type-of-proven-type-non-constant-including-symbol.js: Added.
        (assert):
        (typeOf):
        (i.switch):
        * stress/big-int-type-of-proven-type-non-constant.js: Added.
        (assert):
        (typeOf):
        * stress/big-int-type-of.js:
        (typeOf):
        (func):

2018-12-10  Mark Lam  <mark.lam@apple.com>

        PropertyAttribute needs a CustomValue bit.
        https://bugs.webkit.org/show_bug.cgi?id=191993
        <rdar://problem/46264467>

        Reviewed by Saam Barati.

        * stress/regress-191993.js: Added.

2018-12-10  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] Add ValueMul into DFG
        https://bugs.webkit.org/show_bug.cgi?id=186175

        Reviewed by Yusuke Suzuki.

        * stress/big-int-mul-jit-osr.js: Added.
        * stress/big-int-mul-jit-untyped.js: Added.
        * stress/value-mul-fixup-int32-big-int.js: Added.

2018-12-06  Keith Miller  <keith_miller@apple.com>

        stress/big-wasm-memory tests failing on 32-bit JSC bot
        https://bugs.webkit.org/show_bug.cgi?id=192020

        Reviewed by Saam Barati.

        Not every platform has WebAssembly, e.g. 32-bit, so we should exit
        the wasm stress tests if the WebAssembly object does not exist.

        * stress/big-wasm-memory-grow-no-max.js:
        (test.foo):
        (test):
        (foo): Deleted.
        (catch): Deleted.
        * stress/big-wasm-memory-grow.js:
        (test.foo):
        (test):
        (foo): Deleted.
        (catch): Deleted.
        * stress/big-wasm-memory.js:
        (test.foo):
        (test):
        (foo): Deleted.
        (catch): Deleted.

2018-12-05  Mark Lam  <mark.lam@apple.com>

        speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
        https://bugs.webkit.org/show_bug.cgi?id=192441
        <rdar://problem/46480355>

        Reviewed by Saam Barati.

        * stress/regress-192441.js: Added.

2018-12-04  Mark Lam  <mark.lam@apple.com>

        DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility.
        https://bugs.webkit.org/show_bug.cgi?id=192386
        <rdar://problem/46445516>

        Reviewed by Saam Barati.

        * stress/regress-192386.js: Added.

2018-12-04  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Support logic operations
        https://bugs.webkit.org/show_bug.cgi?id=179903

        Reviewed by Yusuke Suzuki.

        * stress/big-int-branch-usage.js: Added.
        * stress/big-int-logical-and.js: Added.
        * stress/big-int-logical-not.js: Added.
        * stress/big-int-logical-or.js: Added.

2018-12-03  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r238833.

        Breaks macOS and iOS debug builds.

        Reverted changeset:

        "[ESNext][BigInt] Support logic operations"
        https://bugs.webkit.org/show_bug.cgi?id=179903
        https://trac.webkit.org/changeset/238833

2018-12-03  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Support logic operations
        https://bugs.webkit.org/show_bug.cgi?id=179903

        Reviewed by Yusuke Suzuki.

        * stress/big-int-branch-usage.js: Added.
        * stress/big-int-logical-and.js: Added.
        * stress/big-int-logical-not.js: Added.
        * stress/big-int-logical-or.js: Added.

2018-12-02  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Implement support for "<<" and ">>"
        https://bugs.webkit.org/show_bug.cgi?id=186233

        Reviewed by Yusuke Suzuki.

        * stress/big-int-left-shift-general.js: Added.
        * stress/big-int-left-shift-range-error.js: Added.
        * stress/big-int-left-shift-type-error.js: Added.
        * stress/big-int-left-shift-wrapped-value.js: Added.
        * stress/big-int-right-shift-general.js: Added.
        * stress/big-int-right-shift-type-error.js: Added.
        * stress/big-int-right-shift-wrapped-value.js: Added.
        * stress/left-shift-to-primitive-precedence.js: Added.
        * stress/right-shift-to-primitive-precedence.js: Added.

2018-11-30  Dean Jackson  <dino@apple.com>

        Add first-class support for .mjs files in jsc binary
        https://bugs.webkit.org/show_bug.cgi?id=192190
        <rdar://problem/46375715>

        Reviewed by Keith Miller.

        * stress/simple-module.mjs: Added.
        * stress/simple-script.js: Added.

2018-11-30  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] Implement ValueBitXor into DFG
        https://bugs.webkit.org/show_bug.cgi?id=190264

        Reviewed by Yusuke Suzuki.

        * stress/big-int-bitwise-xor-jit.js: Added.
        * stress/big-int-bitwise-xor-memory-stress.js: Added.
        * stress/big-int-bitwise-xor-untyped.js: Added.

2018-11-27  Saam barati  <sbarati@apple.com>

        r238510 broke scopes of size zero
        https://bugs.webkit.org/show_bug.cgi?id=192033
        <rdar://problem/46281734>

        Reviewed by Keith Miller.

        * stress/r238510-bad-loop.js: Added.
        (foo):

2018-11-27  Mark Lam  <mark.lam@apple.com>

        [Re-landing] NaNs read from Wasm code needs to be be purified.
        https://bugs.webkit.org/show_bug.cgi?id=191056
        <rdar://problem/45660341>

        Reviewed by Filip Pizlo.

        * wasm/regress/regress-191056.js: Added.

2018-11-27  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r238509.

        Causes JSC tests to fail on iOS.

        Reverted changeset:

        "NaNs read from Wasm code needs to be be purified."
        https://bugs.webkit.org/show_bug.cgi?id=191056
        https://trac.webkit.org/changeset/238509

2018-11-26  Caio Lima  <ticaiolima@gmail.com>

        Re-introduce op_bitnot
        https://bugs.webkit.org/show_bug.cgi?id=190923

        Reviewed by Yusuke Suzuki.

        * stress/bit-not-must-generate.js: Added.
        * stress/bitwise-not-no-int32.js: Added.

2018-11-26  Saam barati  <sbarati@apple.com>

        InPlaceAbstractState::endBasicBlock rule for SetLocal should filter the value based on the flush format
        https://bugs.webkit.org/show_bug.cgi?id=191956
        <rdar://problem/45665806>

        Reviewed by Yusuke Suzuki.

        * stress/end-basic-block-set-local-should-filter-type.js: Added.
        (bar):
        (foo):

2018-11-26  Saam barati  <sbarati@apple.com>

        Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation
        https://bugs.webkit.org/show_bug.cgi?id=191958
        <rdar://problem/46221877>

        Reviewed by Yusuke Suzuki.

        * stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added.
        (x):
        (foo):

2018-11-26  Mark Lam  <mark.lam@apple.com>

        NaNs read from Wasm code needs to be be purified.
        https://bugs.webkit.org/show_bug.cgi?id=191056
        <rdar://problem/45660341>

        Reviewed by Filip Pizlo.

        * wasm/regress/regress-191056.js: Added.

2018-11-26  Michael Saboff  <msaboff@apple.com>

        32-bit JSC test failure: stress/regexp-compile-oom.js
        https://bugs.webkit.org/show_bug.cgi?id=191375

        Reviewed by Mark Lam.

        Disabled the test for 32 bit platforms.

        * stress/regexp-compile-oom.js:

2018-11-26  Tadeu Zagallo  <tzagallo@apple.com>

        ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
        https://bugs.webkit.org/show_bug.cgi?id=191716
        <rdar://problem/45723878>

        Reviewed by Saam Barati.

        * stress/regress-187373.js: Added.
        (async.fn):

2018-11-21  Saam barati  <sbarati@apple.com>

        DFGSpeculativeJIT should not &= exitOK with mayExit(node)
        https://bugs.webkit.org/show_bug.cgi?id=191897
        <rdar://problem/45871998>

        Reviewed by Mark Lam.

        * stress/exitok-is-not-the-same-as-mayExit.js: Added.
        (bar):
        (foo):

2018-11-21  Saam barati  <sbarati@apple.com>

        Fix assertion in KnownCellUse inside SpeculativeJIT::speculate
        https://bugs.webkit.org/show_bug.cgi?id=191895
        <rdar://problem/46167406>

        Reviewed by Mark Lam.

        * stress/known-cell-use-needs-type-check-assertion.js: Added.
        (foo):
        (bar):

2018-11-21  Mark Lam  <mark.lam@apple.com>

        Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError.
        https://bugs.webkit.org/show_bug.cgi?id=191776
        <rdar://problem/46152851>

        Reviewed by Saam Barati.

        * stress/big-wasm-memory-grow-no-max.js:
        * stress/big-wasm-memory-grow.js:
        * stress/big-wasm-memory.js:
        - updated these to expect an OutOfMemoryError.

        * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: Added.
        (Binary.prototype.emit_u8):
        (Binary.prototype.emit_u32v):
        (Binary.prototype.emit_header):
        (Binary.prototype.emit_section):
        (Binary):
        (WasmModuleBuilder):
        (WasmModuleBuilder.prototype.addMemory):
        (WasmModuleBuilder.prototype.toArray):
        (WasmModuleBuilder.prototype.toBuffer):
        (WasmModuleBuilder.prototype.instantiate):
        (catch):
        * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Added.
        (catch):

2018-11-21  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
        https://bugs.webkit.org/show_bug.cgi?id=190836

        Reviewed by Saam Barati and Yusuke Suzuki.

        * stress/big-int-out-of-memory-tests.js: Added.

2018-11-20  Mark Lam  <mark.lam@apple.com>

        Remove invalid assertion in VMTraps::SignalSender's SignalAction.
        https://bugs.webkit.org/show_bug.cgi?id=191856
        <rdar://problem/46089992>

        Reviewed by Yusuke Suzuki.

        * stress/regress-191856.js: Added.
        - this test is skipped for now until we have a fix for webkit.org/b/191855.

2018-11-21  Dominik Infuehr  <dinfuehr@igalia.com>

        Enable JIT on ARM/Linux
        https://bugs.webkit.org/show_bug.cgi?id=191548

        Reviewed by Yusuke Suzuki.

        Disable test on system with limited memory. Program was killed by
        the OS before the exception was thrown.

        * slowMicrobenchmarks/function-constructor-with-huge-strings.js:

2018-11-20  Saam barati  <sbarati@apple.com>

        Merging an IC variant may lead to the IC status containing overlapping structure sets
        https://bugs.webkit.org/show_bug.cgi?id=191869
        <rdar://problem/45403453>

        Reviewed by Mark Lam.

        * stress/merging-ic-variants-should-bail-if-structures-overlap.js: Added.

2018-11-19  Mark Lam  <mark.lam@apple.com>

        globalFuncImportModule() should return a promise when it clears exceptions.
        https://bugs.webkit.org/show_bug.cgi?id=191792
        <rdar://problem/46090763>

        Reviewed by Michael Saboff.

        * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: Added.

2018-11-19  Guillaume Emont  <guijemont@igalia.com>

        Skip new memory-hungry tests on memory limited devices

        Unreviewed gardening.

        * stress/big-wasm-memory-grow-no-max.js:
        * stress/big-wasm-memory-grow.js:
        * stress/big-wasm-memory.js:

2018-11-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        Unreviewed, rolling in the rest of r237254
        https://bugs.webkit.org/show_bug.cgi?id=190340

        * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
        * stress/function-cache-with-parameters-end-position.js: Added.
        (shouldBe):
        (shouldThrow):
        (i.anonymous):
        * stress/function-constructor-name.js: Added.
        (shouldBe):
        (GeneratorFunction):
        (AsyncFunction.async):
        (AsyncGeneratorFunction.async):
        (anonymous):
        (async.anonymous):
        * test262/expectations.yaml:

2018-11-16  Filip Pizlo  <fpizlo@apple.com>

        All users of ArrayBuffer should agree on the same max size
        https://bugs.webkit.org/show_bug.cgi?id=191771

        Reviewed by Mark Lam.

        * stress/big-wasm-memory-grow-no-max.js: Added.
        (foo):
        (catch):
        * stress/big-wasm-memory-grow.js: Added.
        (foo):
        (catch):
        * stress/big-wasm-memory.js: Added.
        (foo):
        (catch):

2018-11-16  Filip Pizlo  <fpizlo@apple.com>

        Unreviewed, make some more tests not crash my computer by only running on instance of it. These tests do not need to
        run for each JSC config since they're regression tests for runtime bugs.

        * stress/json-stringified-overflow-2.js:
        * stress/json-stringified-overflow.js:

2018-11-16  Filip Pizlo  <fpizlo@apple.com>

        Unreviewed, make some tests not crash my computer by only running on instance of it. These tests do not need to run for each JSC
        config since they're regression tests for runtime bugs.

        * stress/large-unshift-splice.js:
        * stress/regress-185888.js:

2018-11-16  Saam Barati  <sbarati@apple.com>

        KnownCellUse should also have SpecCellCheck as its type filter
        https://bugs.webkit.org/show_bug.cgi?id=191729
        <rdar://problem/45872852>

        Reviewed by Filip Pizlo.

        * stress/known-cell-type-check-should-allow-empty-value-to-flow-through.js: Added.
        (C):

2018-11-16  Tadeu Zagallo  <tzagallo@apple.com>

        Fix assertion failure on BytecodeGenerator::recordOpcode
        https://bugs.webkit.org/show_bug.cgi?id=191724
        <rdar://problem/45724395>

        Reviewed by Saam Barati.

        * stress/regress-187373-2.js: Added.
        (foo):

2018-11-15  Mark Lam  <mark.lam@apple.com>

        RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
        https://bugs.webkit.org/show_bug.cgi?id=191730
        <rdar://problem/46048517>

        Reviewed by Saam Barati.

        * stress/regress-187006.js: Removed.
          - this test is invalid because its sole purpose is to test for the non-spec
            compliant behavior that we just fixed.

        * stress/regress-191730.js: Added.

2018-11-15  Mark Lam  <mark.lam@apple.com>

        RegExp operations should not take fast patch if lastIndex is not numeric.
        https://bugs.webkit.org/show_bug.cgi?id=191731
        <rdar://problem/46017305>

        Reviewed by Saam Barati.

        * stress/regress-191731.js: Added.

2018-11-13  Saam Barati  <sbarati@apple.com>

        TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM
        https://bugs.webkit.org/show_bug.cgi?id=191600

        Reviewed by Mark Lam.

        * stress/type-profiler-log-should-defer-pending-exceptions.js: Added.
        (foo):
        (test):
        (bar):

2018-11-13  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r238132.

        The test added with this change is timing out on Debug JSC
        bots.

        Reverted changeset:

        "[BigInt] JSBigInt::createWithLength should throw when length
        is greater than JSBigInt::maxLength"
        https://bugs.webkit.org/show_bug.cgi?id=190836
        https://trac.webkit.org/changeset/238132

2018-11-13  Mark Lam  <mark.lam@apple.com>

        Add OOM detection to StringPrototype's substituteBackreferences().
        https://bugs.webkit.org/show_bug.cgi?id=191563
        <rdar://problem/45720428>

        Reviewed by Saam Barati.

        * stress/regress-191563.js: Added.

2018-11-13  Mark Lam  <mark.lam@apple.com>

        LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame.
        https://bugs.webkit.org/show_bug.cgi?id=191579
        <rdar://problem/45942472>

        Reviewed by Saam Barati.

        * stress/regress-191579.js: Added.

2018-11-13  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
        https://bugs.webkit.org/show_bug.cgi?id=190836

        Reviewed by Saam Barati.

        * stress/big-int-out-of-memory-tests.js: Added.

2018-11-08  Ross Kirsling  <ross.kirsling@sony.com>

        U+180E is no longer a whitespace character
        https://bugs.webkit.org/show_bug.cgi?id=191415

        Reviewed by Saam Barati.

        * ChakraCore/test/es5/regexSpace.baseline:
        * ChakraCore/test/es6/unicode_whitespace.js:
        Update tests to latest version.
        (See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.)

        * test262.yaml:
        * test262/config.yaml:
        * test262/expectations.yaml:
        Update expectations.

2018-11-07  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] Add support to BigInt into ValueAdd
        https://bugs.webkit.org/show_bug.cgi?id=186177

        Reviewed by Keith Miller.

        * stress/big-int-negate-jit.js:
        * stress/value-add-big-int-and-string.js: Added.
        * stress/value-add-big-int-prediction-propagation.js: Added.
        * stress/value-add-big-int-untyped.js: Added.

2018-11-07  Tadeu Zagallo  <tzagallo@apple.com>

        REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled
        https://bugs.webkit.org/show_bug.cgi?id=191184

        Reviewed by Saam Barati.

        Most tests were failing due to timeouts, since they are too slow to
        run on CLoop. The exceptions are:

        proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop
        dont-crash-on-stack-overflow-when-parsing-builtin.js and
        dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had
        to change the stack size since CLoop requires it to be page aligned.

        * microbenchmarks/array-push-1.js:
        * microbenchmarks/array-push-2.js:
        * microbenchmarks/elidable-new-object-dag.js:
        * microbenchmarks/elidable-new-object-roflcopter.js:
        * microbenchmarks/elidable-new-object-tree.js:
        * microbenchmarks/getter-richards.js:
        * microbenchmarks/sinkable-new-object-dag.js:
        * microbenchmarks/string-concat-long-convert.js:
        * microbenchmarks/typed-array-get-set-by-val-profiling.js:
        * slowMicrobenchmarks/array-push-3.js:
        * slowMicrobenchmarks/large-map-iteration-with-additions.js:
        * slowMicrobenchmarks/spread-small-array.js:
        * slowMicrobenchmarks/undefined-property-access.js:
        * stress/activation-sink-default-value-tdz-error.js:
        * stress/activation-sink-default-value.js:
        * stress/activation-sink-osrexit-default-value-tdz-error.js:
        * stress/activation-sink-osrexit-default-value.js:
        * stress/activation-sink-osrexit.js:
        * stress/activation-sink.js:
        * stress/allow-math-ic-b3-code-duplication.js:
        * stress/array-push-multiple-int32.js:
        * stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js:
        * stress/arrowfunction-lexical-this-activation-sink-osrexit.js:
        * stress/arrowfunction-lexical-this-activation-sink.js:
        * stress/dont-crash-on-stack-overflow-when-parsing-builtin.js:
        * stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js:
        * stress/elide-new-object-dag-then-exit.js:
        * stress/materialize-regexp-cyclic.js:
        * stress/new-regex-inline.js:
        * stress/op_add.js:
        * stress/op_bitand.js:
        * stress/op_bitor.js:
        * stress/op_bitxor.js:
        * stress/op_div-ConstVar.js:
        * stress/op_div-VarConst.js:
        * stress/op_div-VarVar.js:
        * stress/op_lshift-ConstVar.js:
        * stress/op_lshift-VarConst.js:
        * stress/op_lshift-VarVar.js:
        * stress/op_mod-ConstVar.js:
        * stress/op_mod-VarConst.js:
        * stress/op_mod-VarVar.js:
        * stress/op_mul-ConstVar.js:
        * stress/op_mul-VarConst.js:
        * stress/op_mul-VarVar.js:
        * stress/op_rshift-ConstVar.js:
        * stress/op_rshift-VarConst.js:
        * stress/op_rshift-VarVar.js:
        * stress/op_sub-ConstVar.js:
        * stress/op_sub-VarConst.js:
        * stress/op_sub-VarVar.js:
        * stress/op_urshift-ConstVar.js:
        * stress/op_urshift-VarConst.js:
        * stress/op_urshift-VarVar.js:
        * stress/proxy-get-set-correct-receiver.js:
        * stress/regress-179562.js:
        * stress/rest-parameter-many-arguments.js:
        * stress/sampling-profiler-richards.js:
        * stress/splay-flash-access-1ms.js:
        * stress/tailCallForwardArguments.js:
        * stress/typed-array-get-by-val-profiling.js:
        * typeProfiler/getter-richards.js:

2018-11-06  Michael Saboff  <msaboff@apple.com>

        Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.
        https://bugs.webkit.org/show_bug.cgi?id=191271

        Reviewed by Saam Barati.

        Added more test cases and made all test cases run with the same deeply recursive stack
        instead of finding that same point for each test case.

        * stress/regexp-compile-oom.js:
        (prototype.runTest):
        (recurseAndTest):
        (testList.push.new.TestAndExpectedException):

2018-11-05  Michael Saboff  <msaboff@apple.com>

        Unreviewed build fix for linux.

        * stress/regexp-compile-oom.js: Disabled for non-darwin OSes.

2018-11-02  Michael Saboff  <msaboff@apple.com>

        Rolling in r237753 with unreviewed build fix.

        Fixed issues with DECLARE_THROW_SCOPE placement.

2018-11-02  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r237753.

        Introduced JSC test failures

        Reverted changeset:

        "Running out of stack space not properly handled in
        RegExp::compile() and its callers"
        https://bugs.webkit.org/show_bug.cgi?id=191206
        https://trac.webkit.org/changeset/237753

2018-11-02  Michael Saboff  <msaboff@apple.com>

        Running out of stack space not properly handled in RegExp::compile() and its callers
        https://bugs.webkit.org/show_bug.cgi?id=191206

        Reviewed by Filip Pizlo.

        New regression test.

        * stress/regexp-compile-oom.js: Added.
        (recurseAndTest):

2018-11-01  Guillaume Emont  <guijemont@igalia.com>

        Skip tests on arm/mips that time out now we're running on CLoop

        Unreviewed gardening.

        Since the JIT is temporarily disabled on 32-bit platforms, these tests
        time out on the bots and need to be disabled. There's more tests
        disabled on arm because the timeout is longer on the mips bot (as the
        device is slower to start with), so many of the tests don't time out
        there.

        * microbenchmarks/getter-richards.js: disable on arm and mips.
        * stress/op_add.js: disable on arm.
        * stress/op_bitand.js: disable on arm.
        * stress/op_bitor.js: disable on arm.
        * stress/op_bitxor.js: disable on arm.
        * stress/op_lshift-ConstVar.js: disable on arm.
        * stress/op_lshift-VarConst.js: disable on arm.
        * stress/op_lshift-VarVar.js: disable on arm.
        * stress/op_mod-ConstVar.js: disable on arm.
        * stress/op_mod-VarConst.js: disable on arm.
        * stress/op_mod-VarVar.js: disable on arm.
        * stress/op_mul-ConstVar.js: disable on arm.
        * stress/op_mul-VarConst.js: disable on arm.
        * stress/op_mul-VarVar.js: disable on arm.
        * stress/op_rshift-ConstVar.js: disable on arm.
        * stress/op_rshift-VarConst.js: disable on arm.
        * stress/op_rshift-VarVar.js: disable on arm.
        * stress/op_sub-ConstVar.js: disable on arm.
        * stress/op_sub-VarConst.js: disable on arm.
        * stress/op_sub-VarVar.js: disable on arm.
        * stress/op_urshift-ConstVar.js: disable on arm.
        * stress/op_urshift-VarConst.js: disable on arm.
        * stress/op_urshift-VarVar.js: disable on arm.
        * stress/spread-forward-call-varargs-stack-overflow.js: disable on arm.
        * stress/value-to-boolean.js: disable on arm and mips.

2018-10-31  Tadeu Zagallo  <tzagallo@apple.com>

        REGRESSION(r237547): Exception handlers should be aware of wide opcodes
        https://bugs.webkit.org/show_bug.cgi?id=191108
        <rdar://problem/45690700>

        Reviewed by Saam Barati.

        * stress/wide-op_catch.js: Added.
        (catch):

2018-10-29  Mark Lam  <mark.lam@apple.com>

        Correctly detect string overflow when using the 'Function' constructor.
        https://bugs.webkit.org/show_bug.cgi?id=184883
        <rdar://problem/36320331>

        Reviewed by Saam Barati.

        I've verified that this passes on 32-bit as well.

        * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.

2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>

        Add support for GetStack FlushedDouble
        https://bugs.webkit.org/show_bug.cgi?id=191012
        <rdar://problem/45265141>

        Reviewed by Saam Barati.

        * stress/get-stack-double.js: Added.
        (bar):
        (noInline):

2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>

        New bytecode format for JSC
        https://bugs.webkit.org/show_bug.cgi?id=187373
        <rdar://problem/44186758>

        Reviewed by Filip Pizlo.

        Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.

        * stress/maximum-inline-capacity.js: Added.
        (test1):
        (test3.Foo):
        (test3):

2018-10-26  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r237479 and r237484.
        https://bugs.webkit.org/show_bug.cgi?id=190978

        broke JSC on iOS (Requested by tadeuzagallo on #webkit).

        Reverted changesets:

        "New bytecode format for JSC"
        https://bugs.webkit.org/show_bug.cgi?id=187373
        https://trac.webkit.org/changeset/237479

        "Gardening: Build fix after r237479."
        https://bugs.webkit.org/show_bug.cgi?id=187373
        https://trac.webkit.org/changeset/237484

2018-10-26  Tadeu Zagallo  <tzagallo@apple.com>

        New bytecode format for JSC
        https://bugs.webkit.org/show_bug.cgi?id=187373
        <rdar://problem/44186758>

        Reviewed by Filip Pizlo.

        Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.

        * stress/maximum-inline-capacity.js: Added.
        (test1):
        (test3.Foo):
        (test3):

2018-10-26  Mark Lam  <mark.lam@apple.com>

        Fix missing edge cases with JSGlobalObjects having a bad time.
        https://bugs.webkit.org/show_bug.cgi?id=189028
        <rdar://problem/45204939>

        Reviewed by Saam Barati.

        * stress/regress-189028.js: Added.

2018-10-22  Mark Lam  <mark.lam@apple.com>

        DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
        https://bugs.webkit.org/show_bug.cgi?id=190515
        <rdar://problem/45222379>

        Rubber-stamped by Saam Barati.

        Adding another test.

        * stress/regress-190515-2.js: Added.

2018-10-22  Mark Lam  <mark.lam@apple.com>

        DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
        https://bugs.webkit.org/show_bug.cgi?id=190515
        <rdar://problem/45222379>

        Reviewed by Saam Barati.

        * stress/regress-190515.js: Added.

2018-10-19  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r237254.
        https://bugs.webkit.org/show_bug.cgi?id=190760

        "It regresses JetStream 2 by 5% on some iOS devices"
        (Requested by saamyjoon on #webkit).

        Reverted changeset:

        "[JSC] JSC should have "parseFunction" to optimize Function
        constructor"
        https://bugs.webkit.org/show_bug.cgi?id=190340
        https://trac.webkit.org/changeset/237254

2018-10-19  Saam Barati  <sbarati@apple.com>

        vmCall should check if we exit before emitting an OSR exit due to exceptions
        https://bugs.webkit.org/show_bug.cgi?id=190740
        <rdar://problem/45220139>

        Reviewed by Mark Lam.

        * stress/dont-emit-osr-exits-for-every-call-ftl.js: Added.
        (foo):

2018-10-19  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Implement support for "^"
        https://bugs.webkit.org/show_bug.cgi?id=186235

        Reviewed by Yusuke Suzuki.

        * stress/big-int-bitwise-xor-general.js: Added.
        * stress/big-int-bitwise-xor-to-primitive-precedence.js: Added.
        * stress/big-int-bitwise-xor-type-error.js: Added.
        * stress/big-int-bitwise-xor-wrapped-value.js: Added.

2018-10-19  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] Add ValueSub into DFG
        https://bugs.webkit.org/show_bug.cgi?id=186176

        Reviewed by Yusuke Suzuki.

        * stress/big-int-subtraction-jit.js:
        * stress/value-sub-big-int-prediction-propagation.js: Added.
        * stress/value-sub-big-int-untyped.js: Added.
        * stress/value-sub-spec-none-case.js: Added.

2018-10-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] JSC should have "parseFunction" to optimize Function constructor
        https://bugs.webkit.org/show_bug.cgi?id=190340

        Reviewed by Mark Lam.

        This patch fixes the line number of syntax errors raised by the Function constructor,
        since we now parse the final code only once. And we no longer use block statement
        for Function constructor's parsing.

        * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
        * stress/function-cache-with-parameters-end-position.js: Added.
        (shouldBe):
        (shouldThrow):
        (i.anonymous):
        * stress/function-constructor-name.js: Added.
        (shouldBe):
        (GeneratorFunction):
        (AsyncFunction.async):
        (AsyncGeneratorFunction.async):
        (anonymous):
        (async.anonymous):
        * test262/expectations.yaml:

2018-10-18  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r237242.
        https://bugs.webkit.org/show_bug.cgi?id=190701

        it breaks "stress/sampling-profiler-basic.js" (Requested by
        caiolima on #webkit).

        Reverted changeset:

        "[BigInt] Add ValueSub into DFG"
        https://bugs.webkit.org/show_bug.cgi?id=186176
        https://trac.webkit.org/changeset/237242

2018-10-17  Keith Miller  <keith_miller@apple.com>

        AI does not clear Phantom allocation nodes.
        https://bugs.webkit.org/show_bug.cgi?id=190694

        Reviewed by Saam Barati.

        * stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added.
        (Day):
        (DaysInYear):
        (TimeInYear):
        (TimeFromYear):
        (DayFromYear):
        (InLeapYear):
        (YearFromTime):
        (WeekDay):
        (DaylightSavingTA):
        (GetSecondSundayInMarch):
        (TimeInMonth):

2018-10-17  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] Add ValueSub into DFG
        https://bugs.webkit.org/show_bug.cgi?id=186176

        Reviewed by Yusuke Suzuki.

        * stress/big-int-subtraction-jit.js:
        * stress/value-sub-big-int-prediction-propagation.js: Added.
        * stress/value-sub-big-int-untyped.js: Added.

2018-10-16  Dominik Infuehr  <dinfuehr@igalia.com>

        [JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips
        https://bugs.webkit.org/show_bug.cgi?id=190611

        Reviewed by Saam Barati.

        Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js
        to improve test runtime. On ARM/MIPS this test even timed out when running all
        tests.

        * stress/array-prototype-concat-of-long-spliced-arrays2.js:
        (test):

2018-10-15  Guillaume Emont  <guijemont@igalia.com>

        Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux

        Unreviewed gardening.

        * stress/array-prototype-concat-of-long-spliced-arrays2.js:

2018-10-15  Saam barati  <sbarati@apple.com>

        Emit fjcvtzs on ARM64E on Darwin
        https://bugs.webkit.org/show_bug.cgi?id=184023

        Reviewed by Yusuke Suzuki and Filip Pizlo.

        * stress/double-to-int32-NaN.js: Added.
        (assert):
        (foo):

2018-10-15  Saam Barati  <sbarati@apple.com>

        JSArray::shiftCountWithArrayStorage is wrong when an array has holes
        https://bugs.webkit.org/show_bug.cgi?id=190262
        <rdar://problem/44986241>

        Reviewed by Mark Lam.

        * stress/array-prototype-concat-of-long-spliced-arrays.js:
        (test):
        * stress/slice-array-storage-with-holes.js: Added.
        (main):

2018-10-15  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r237054.
        https://bugs.webkit.org/show_bug.cgi?id=190593

        "this regressed JetStream 2 by 6% on iOS" (Requested by
        saamyjoon on #webkit).

        Reverted changeset:

        "[JSC] JSC should have "parseFunction" to optimize Function
        constructor"
        https://bugs.webkit.org/show_bug.cgi?id=190340
        https://trac.webkit.org/changeset/237054

2018-10-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] JSON.stringify can accept call-with-no-arguments
        https://bugs.webkit.org/show_bug.cgi?id=190343

        Reviewed by Mark Lam.

        * stress/json-stringify-no-arguments.js: Added.
        (shouldBe):

2018-10-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] JSC should have "parseFunction" to optimize Function constructor
        https://bugs.webkit.org/show_bug.cgi?id=190340

        Reviewed by Mark Lam.

        This patch fixes the line number of syntax errors raised by the Function constructor,
        since we now parse the final code only once. And we no longer use block statement
        for Function constructor's parsing.

        * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
        * stress/function-cache-with-parameters-end-position.js: Added.
        (shouldBe):
        (shouldThrow):
        (i.anonymous):
        * stress/function-constructor-name.js: Added.
        (shouldBe):
        (GeneratorFunction):
        (AsyncFunction.async):
        (AsyncGeneratorFunction.async):
        (anonymous):
        (async.anonymous):
        * test262/expectations.yaml:

2018-10-10  Guillaume Emont  <guijemont@igalia.com>

        Skip JSC test stress/sampling-profiler-richards.js on armv7/linux
        https://bugs.webkit.org/show_bug.cgi?id=190426

        Unreviewed gardening.

        * stress/sampling-profiler-richards.js:

2018-10-06  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Implement support for "|"
        https://bugs.webkit.org/show_bug.cgi?id=186229

        Reviewed by Yusuke Suzuki.

        * stress/big-int-bitwise-and-jit.js:
        * stress/big-int-bitwise-or-general.js: Added.
        * stress/big-int-bitwise-or-jit-untyped.js: Added.
        * stress/big-int-bitwise-or-jit.js: Added.
        * stress/big-int-bitwise-or-memory-stress.js: Added.
        * stress/big-int-bitwise-or-to-primitive-precedence.js: Added.
        * stress/big-int-bitwise-or-type-error.js: Added.
        * stress/big-int-bitwise-or-wrapped-value.js: Added.

2018-10-05  Dominik Infuehr  <dominik.infuehr@gmail.com>

        Skip test on systems with limited memory
        https://bugs.webkit.org/show_bug.cgi?id=190310

        Invoking runDefault adds test to runlist, skipping the test in the next
        line does not prevent the test from executing. Change order of lines such
        that runDefault is only executed if test is not executed.

        Reviewed by Mark Lam.

        * stress/regress-190187.js:

2018-10-03  Saam barati  <sbarati@apple.com>

        lowXYZ in FTLLower should always filter the type of the incoming edge
        https://bugs.webkit.org/show_bug.cgi?id=189939
        <rdar://problem/44407030>

        Reviewed by Michael Saboff.

        * stress/ftl-should-always-filter-for-low-type-check-functions.js: Added.
        (foo):
        (test):

2018-10-03  Mark Lam  <mark.lam@apple.com>

        Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX.
        https://bugs.webkit.org/show_bug.cgi?id=190187
        <rdar://problem/42512909>

        Reviewed by Michael Saboff.

        * stress/regress-190187.js: Added.

2018-10-02  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
        https://bugs.webkit.org/show_bug.cgi?id=190033

        Reviewed by Yusuke Suzuki.

        * stress/big-int-to-string.js:

2018-10-01  Mark Lam  <mark.lam@apple.com>

        Function.toString() should also copy the source code Functions that are class definitions.
        https://bugs.webkit.org/show_bug.cgi?id=190186
        <rdar://problem/44733360>

        Reviewed by Saam Barati.

        * stress/regress-190186.js: Added.

2018-10-01  Dominik Infuehr  <dinfuehr@igalia.com>

        Split NaN-check into separate test
        https://bugs.webkit.org/show_bug.cgi?id=190010

        Reviewed by Saam Barati.

        DataView exposes NaN-representation, which is not necessarily the same on each
        architecture. Therefore move the check of the NaN-representation into its own
        file such that we can disable this test on MIPS where NaN-representation can be
        different on older CPUs.

        * stress/dataview-jit-set-nan.js: Added.
        (assert):
        (test.storeLittleEndian):
        (test.storeBigEndian):
        (test.store):
        (test):
        * stress/dataview-jit-set.js:
        (test5):

2018-10-01  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r236647.
        https://bugs.webkit.org/show_bug.cgi?id=190124

        Breaking test stress/big-int-to-string.js (Requested by
        caiolima_ on #webkit).

        Reverted changeset:

        "[BigInt] BigInt.proptotype.toString is broken when radix is
        power of 2"
        https://bugs.webkit.org/show_bug.cgi?id=190033
        https://trac.webkit.org/changeset/236647

2018-09-30  Caio Lima  <ticaiolima@gmail.com>

        [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
        https://bugs.webkit.org/show_bug.cgi?id=190033

        Reviewed by Yusuke Suzuki.

        * stress/big-int-to-string.js:

2018-09-28  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Implement support for "&"
        https://bugs.webkit.org/show_bug.cgi?id=186228

        Reviewed by Yusuke Suzuki.

        * stress/big-int-bitwise-and-general.js: Added.
        (assert):
        (assert.sameValue):
        * stress/big-int-bitwise-and-jit.js: Added.
        (let.assert.sameValue):
        (bigIntBitAnd):
        * stress/big-int-bitwise-and-memory-stress.js: Added.
        (assert):
        * stress/big-int-bitwise-and-to-primitive-precedence.js: Added.
        (assert.sameValue):
        (let.o.Symbol.toPrimitive):
        (catch):
        * stress/big-int-bitwise-and-type-error.js: Added.
        (assert):
        (assertThrowTypeError):
        (let.o.valueOf):
        (o.valueOf):
        (o.toString):
        (o.Symbol.toPrimitive):
        * stress/big-int-bitwise-and-wrapped-value.js: Added.
        (assert.sameValue):
        (testBitAnd):
        (let.o.Symbol.toPrimitive):
        (o.valueOf):
        (o.toString):

2018-09-28  Ross Kirsling  <ross.kirsling@sony.com>

        JSC test stress/jsc-read.js doesn't support CRLF
        https://bugs.webkit.org/show_bug.cgi?id=190063

        Reviewed by Yusuke Suzuki.

        In order to run this test via Windows command prompt, we can't assume that the final newline will be LF.

        * stress/jsc-read.js:
        (test):

2018-09-27  Saam barati  <sbarati@apple.com>

        Verify the contents of AssemblerBuffer on arm64e
        https://bugs.webkit.org/show_bug.cgi?id=190057
        <rdar://problem/38916630>

        Reviewed by Mark Lam.

        * stress/regress-189132.js:

2018-09-27  Dominik Infuehr  <dinfuehr@igalia.com>

        Disable test without LLInt on ARMv7
        https://bugs.webkit.org/show_bug.cgi?id=190037

        Reviewed by Mark Lam.

        Test runs out of executable memory on ARMv7, do not run
        this test without LLInt enabled.

        * stress/regress-169445.js:

2018-09-26  Keith Miller  <keith_miller@apple.com>

        We should zero unused property storage when rebalancing array storage.
        https://bugs.webkit.org/show_bug.cgi?id=188151

        Reviewed by Michael Saboff.

        * stress/splice-should-zero-property-storage-when-rebalancing.js: Added.

2018-09-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] Optimize Array#lastIndexOf
        https://bugs.webkit.org/show_bug.cgi?id=189780

        Reviewed by Saam Barati.

        * stress/array-lastindexof-array-prototype-trap.js: Added.
        (shouldBe):
        (AncestorArray.prototype.get 2):
        (AncestorArray):
        * stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added.
        (shouldBe):
        * stress/array-lastindexof-hole-nan.js: Added.
        (shouldBe):
        (throw.new.Error):
        * stress/array-lastindexof-infinity.js: Added.
        (shouldBe):
        (throw.new.Error):
        * stress/array-lastindexof-negative-zero.js: Added.
        (shouldBe):
        (throw.new.Error):
        * stress/array-lastindexof-own-getter.js: Added.
        (shouldBe):
        (throw.new.Error.get array):
        (get array):
        * stress/array-lastindexof-prototype-trap.js: Added.
        (shouldBe):
        (DerivedArray.prototype.get 2):
        (DerivedArray):

2018-09-25  Saam Barati  <sbarati@apple.com>

        Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
        https://bugs.webkit.org/show_bug.cgi?id=189940
        <rdar://problem/43640987>

        Reviewed by Mark Lam.

        * stress/use-baseline-codeblock-materialize-osr-exit.js: Added.

2018-09-24  Saam Barati  <sbarati@apple.com>

        Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects
        https://bugs.webkit.org/show_bug.cgi?id=189922
        <rdar://problem/44651275>

        Reviewed by Mark Lam.

        * stress/array-indexof-fast-path-effects.js: Added.
        * stress/array-indexof-cached-length.js: Added.

2018-09-24  Saam barati  <sbarati@apple.com>

        ArgumentsEliminationPhase should snip basic blocks after proven OSR exits
        https://bugs.webkit.org/show_bug.cgi?id=189682
        <rdar://problem/43557315>

        Reviewed by Mark Lam.

        * stress/arguments-elimination-will-generate-edge-without-result.js: Added.
        (foo):

2018-09-22  Saam barati  <sbarati@apple.com>

        The sampling should not use Strong<CodeBlock> in its machineLocation field
        https://bugs.webkit.org/show_bug.cgi?id=189319

        Reviewed by Filip Pizlo.

        * stress/sampling-profiler-richards.js: Added.

2018-09-19  Yusuke Suzuki  <yusukesuzuki@slowstart.org>

        [JSC] Optimize Array#indexOf in C++ runtime
        https://bugs.webkit.org/show_bug.cgi?id=189507

        Reviewed by Saam Barati.

        * stress/array-indexof-array-prototype-trap.js: Added.
        (shouldBe):
        (AncestorArray.prototype.get 2):
        (AncestorArray):
        * stress/array-indexof-have-a-bad-time-c-runtime.js: Added.
        (shouldBe):
        * stress/array-indexof-hole-nan.js: Added.
        (shouldBe):
        (throw.new.Error):
        * stress/array-indexof-infinity.js: Added.
        (shouldBe):
        (throw.new.Error):
        * stress/array-indexof-negative-zero.js: Added.
        (shouldBe):
        (throw.new.Error):
        * stress/array-indexof-own-getter.js: Added.
        (shouldBe):
        (throw.new.Error.get array):
        (get array):
        * stress/array-indexof-prototype-trap.js: Added.
        (shouldBe):
        (DerivedArray.prototype.get 2):
        (DerivedArray):

2018-09-19  Saam barati  <sbarati@apple.com>

        AI rule for MultiPutByOffset executes its effects in the wrong order
        https://bugs.webkit.org/show_bug.cgi?id=189757
        <rdar://problem/43535257>

        Reviewed by Michael Saboff.

        * stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
        (foo):
        (Foo):
        (g):

2018-09-17  Mark Lam  <mark.lam@apple.com>

        Ensure that ForInContexts are invalidated if their loop local is over-written.
        https://bugs.webkit.org/show_bug.cgi?id=189571
        <rdar://problem/44402277>

        Reviewed by Saam Barati.

        * stress/regress-189571.js: Added.

2018-09-17  Saam barati  <sbarati@apple.com>

        We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
        https://bugs.webkit.org/show_bug.cgi?id=189676
        <rdar://problem/39682897>

        Reviewed by Michael Saboff.

        * typeProfiler/check-structure-or-empty-in-fixup.js: Added.
        (A):
        (K):
        (i.catch):

2018-09-14  Saam barati  <sbarati@apple.com>

        Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
        https://bugs.webkit.org/show_bug.cgi?id=189628
        <rdar://problem/39481690>

        Reviewed by Mark Lam.

        * stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
        (foo):

2018-09-11  Mark Lam  <mark.lam@apple.com>

        Test for array initialization in arrayProtoFuncSplice.
        https://bugs.webkit.org/show_bug.cgi?id=170253
        <rdar://problem/31328773>

        Rubber-stamped by Saam Barati.

        * stress/regress-170253.js: Added.

2018-09-11  Mark Lam  <mark.lam@apple.com>

        Test for IntlObject initialization.
        https://bugs.webkit.org/show_bug.cgi?id=170251
        <rdar://problem/31328419>

        Rubber-stamped by Saam Barati.

        * stress/regress-170251.js: Added.

2018-09-11  Mark Lam  <mark.lam@apple.com>

        Test for array memcpy'ing when JSGlobalObject::haveABadTime.
        https://bugs.webkit.org/show_bug.cgi?id=169889
        <rdar://problem/31155607>

        Reviewed by Saam Barati.

        * stress/regress-169889-array-concat.js: Added.
        * stress/regress-169889-array-concat1.js: Added.
        * stress/regress-169889-array-slice.js: Added.

2018-09-11  Mark Lam  <mark.lam@apple.com>

        Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope.
        https://bugs.webkit.org/show_bug.cgi?id=169445
        <rdar://problem/30957435>

        Reviewed by Saam Barati.

        * stress/regress-169445.js: Added.
        (let.gun.eval.A):
        (let.gun.eval.B.C):
        (let.gun.eval.B.C.prototype.trigger):
        (let.gun.eval.B.C.prototype.triggerWithRestParameters):
        (let.gun.eval.B):
        (let.gun.eval):

== Rolled over to ChangeLog-2018-09-11 ==