- a51fc7c Unreviewed, fix the test after r240543 not to use @Error / Error in builtins by ysuzuki@apple.com · 6 years ago
- 0ed808f ToString node actually does GC. by mark.lam@apple.com · 6 years ago
- f4986c8 [JSC] NativeErrorConstructor should not have own IsoSubspace by ysuzuki@apple.com · 6 years ago
- 4123fb6 stress/const-semantics.js fails a dfg-eager / ftl-eager run with an ASAN release build. by ysuzuki@apple.com · 6 years ago
- 70d21ed Object Allocation Sinking phase can move a node that walks the stack into a place where the InlineCallFrame is no longer valid by sbarati@apple.com · 6 years ago
- 18f1816 [JSC] Reenable baseline JIT on mips by guijemont@igalia.com · 6 years ago
- 5fee3e8 [DFG] AvailabilityMap::pruneByLiveness should make non-live operands Availability::unavailable instead of Availability() by ysuzuki@apple.com · 6 years ago
- a9fb386 Unreviewed, fix initial global lexical binding epoch by ysuzuki@apple.com · 6 years ago
- 90ec30a REGRESSION(r239612) Crash at runtime due to broken DFG assumption by ysuzuki@apple.com · 6 years ago
- 9ebb5f1 Unreviewed. Rollout r240223. It regressed JetStream2 by 1%. by sbarati@apple.com · 6 years ago
- 4d3c310 [JSC] Invalidate old scope operations using global lexical binding epoch by commit-queue@webkit.org · 6 years ago
- c9028b4 Unreviewed, roll out r240220 due to date-format-xparb regression by yusukesuzuki@slowstart.org · 6 years ago
- 6859e5e DoesGC rule is wrong for nodes with BigIntUse by ticaiolima@gmail.com · 6 years ago
- ee94edd DFG: When inlining DataView set* intrinsics we need to set undefined as our result by sbarati@apple.com · 6 years ago
- d6041b8 JSTests: by sbarati@apple.com · 6 years ago
- 98b0b20 [JSC] Invalidate old scope operations using global lexical binding epoch by commit-queue@webkit.org · 6 years ago
- 04f2fe6 StringObjectUse should not be a structure check for the original string object structure by sbarati@apple.com · 6 years ago
- eab1dfb [JSC] ToThis omission in DFGByteCodeParser is wrong by yusukesuzuki@slowstart.org · 6 years ago
- 1e044b1 JSFunction::canUseAllocationProfile() should account for builtin functions with no own prototypes. by mark.lam@apple.com · 6 years ago
- f050942 [JSC] Use KnownStringUse for GetByVal(Array::String) since AI would offer wider type information and offer non-string type after removing Check(String) by yusukesuzuki@slowstart.org · 6 years ago
- 5262551 Unreviewed, skip JIT tests if it's not enabled by tpopela@redhat.com · 6 years ago
- af93386 DFGByteCodeParser rules for bitwise operations should consider type of their operands by ticaiolima@gmail.com · 6 years ago
- 84bb29c Skip a slow test and a flakey test on arm by guijemont@igalia.com · 6 years ago
- a7b67fe Skip type-check-hoisting-phase-hoist... with no jit by keith_miller@apple.com · 6 years ago
- 96b1648 [JSC] AI should check the given constant's array type when folding GetByVal into constant by yusukesuzuki@slowstart.org · 6 years ago
- a7dafda [BigInt] Literal parsing is crashing when used inside a Object Literal by ticaiolima@gmail.com · 6 years ago
- 0ebc789 [JSC] Do not use asArrayModes() with Structures because it discards TypedArray information by yusukesuzuki@slowstart.org · 6 years ago
- e7def11 Fix all CLoop JSC test failures (including some LLInt bugs due to recent bytecode format change). by mark.lam@apple.com · 6 years ago
- a3d53a8 DFG combined liveness can be wrong for terminal basic blocks by sbarati@apple.com · 6 years ago
- d2cb345 [JSC] Global lexical bindings can shadow global variables if it is `configurable = true` by yusukesuzuki@slowstart.org · 6 years ago
- 0fcdabc Enable DFG on ARM/Linux again https://bugs.webkit.org/show_bug.cgi?id=192496 by dinfuehr@igalia.com · 6 years ago
- aee1b11 Unreviewed, rolling out r239825. https://bugs.webkit.org/show_bug.cgi?id=193330 by commit-queue@webkit.org · 6 years ago
- 7348ff5 Enable DFG on ARM/Linux again https://bugs.webkit.org/show_bug.cgi?id=192496 by dinfuehr@igalia.com · 6 years ago
- c52e54d Array.prototype.flat/flatMap have a minor bug in ArraySpeciesCreate by yusukesuzuki@slowstart.org · 6 years ago
- 3f94e49 LLInt put_by_id uses the wrong load instruction for loading flags from the metadata by tzagallo@apple.com · 6 years ago
- 9ac24c4 Baseline version of get_by_id may corrupt metadata by tzagallo@apple.com · 6 years ago
- 9fca117 [JSC] Optimize Object.prototype.toString by yusukesuzuki@slowstart.org · 6 years ago
- cec5e43 test262-runner misbehaves when test file YAML has a trailing space by ross.kirsling@sony.com · 6 years ago
- 589c6ba Unreviewed, JSTests gardening with memoryLimited by yusukesuzuki@slowstart.org · 6 years ago
- f2cb723 [JSC] Identifier validity should be based on ID_Start / ID_Continue properties by ross.kirsling@sony.com · 6 years ago
- 08c76af [BigInt] Support BigInt in JSON.stringify by yusukesuzuki@slowstart.org · 6 years ago
- 870e680 [JSC] Implement "well-formed JSON.stringify" proposal by yusukesuzuki@slowstart.org · 6 years ago
- 046331a Add support for globalThis https://bugs.webkit.org/show_bug.cgi?id=165171 by keith_miller@apple.com · 6 years ago
- dba6ead Update test262 configuration to not run tests dependent on ICU version. by keith_miller@apple.com · 6 years ago
- 351d7c8 Fix a typo in slow_path_construct_arityCheck and operationConstructArityCheck. by mark.lam@apple.com · 6 years ago
- 2a97e92 JSTests: by tzagallo@apple.com · 6 years ago
- e203fe9 Unreviewed follow-up to r192914. by ross.kirsling@sony.com · 6 years ago
- 59a7ea2 Fix test262 expectations https://bugs.webkit.org/show_bug.cgi?id=192914 by keith_miller@apple.com · 6 years ago
- 210e160 Update test262 tests. https://bugs.webkit.org/show_bug.cgi?id=192907 by keith_miller@apple.com · 6 years ago
- cb4391f JSPropertyNameEnumerator should cache the iterated object's structure only after getting its property names. by mark.lam@apple.com · 6 years ago
- 0cd95dc String overflow in JSC::createError results in ASSERT in WTF::makeString by tzagallo@apple.com · 6 years ago
- 0d0527e Error message for `-x ** y` contains a typo. by ross.kirsling@sony.com · 6 years ago
- 1ac2695 Gardening: test options fix. https://bugs.webkit.org/show_bug.cgi?id=192822 by mark.lam@apple.com · 6 years ago
- 7d55564 JSON.stringify() should throw OOM on StringBuilder overflows. by mark.lam@apple.com · 6 years ago
- 6dbb1ef Redeclaration of var over let/const/class should be a syntax error. by ross.kirsling@sony.com · 6 years ago
- 5ef29f6 Skip the stress/elidable-new-object-roflcopter-then-exit.js test on 32-bit. by mark.lam@apple.com · 6 years ago
- efa0dbe Skip the stress/materialized-regexp-has-correct-last-index-set-by-match.js test on 32-bit. by mark.lam@apple.com · 6 years ago
- eb89845 Skip the stress/materialize-regexp-cyclic-regexp.js test on 32-bit. by mark.lam@apple.com · 6 years ago
- c7f40e9 Array unshift/shift should not race against the AI in the compiler thread. by mark.lam@apple.com · 6 years ago
- 8178441 [JSC] Optimize Object.keys by caching own keys results in StructureRareData by yusukesuzuki@slowstart.org · 6 years ago
- 8a3e337 SamplingProfiler's isValidFramePointer() should reject address at stack origin. by mark.lam@apple.com · 6 years ago
- eab0115 Unreviewed test gardening, address a syntax error in a new test. by ryanhaddad@apple.com · 6 years ago
- cffd4db Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit(). by mark.lam@apple.com · 6 years ago
- 2859c7a Fix stale assertion in attemptToForceStringArrayModeByToStringConversion(). by mark.lam@apple.com · 6 years ago
- 777029d CallFrame::convertToStackOverflowFrame() needs to keep the top CodeBlock alive. by mark.lam@apple.com · 6 years ago
- 9c2e56e Unreviewed, rolling out r239153, r239154, and r239155. by commit-queue@webkit.org · 6 years ago
- d417ccd Callers of JSString::getIndex should check for OOM exceptions by keith_miller@apple.com · 6 years ago
- fd1812b Add a missing exception check. by mark.lam@apple.com · 6 years ago
- 77f1746 [BigInt] Add ValueDiv into DFG https://bugs.webkit.org/show_bug.cgi?id=186178 by ticaiolima@gmail.com · 6 years ago
- 0ae781e [JSC] Optimize Object.keys by caching own keys results in StructureRareData by yusukesuzuki@slowstart.org · 6 years ago
- 7ec74d1 [DFG][FTL] Add NewSymbol https://bugs.webkit.org/show_bug.cgi?id=192620 by yusukesuzuki@slowstart.org · 6 years ago
- 3cd4fee [BigInt] Implement DFG/FTL typeof for BigInt by yusukesuzuki@slowstart.org · 6 years ago
- 11530f1 PropertyAttribute needs a CustomValue bit. by mark.lam@apple.com · 6 years ago
- 3ac487d [BigInt] Add ValueMul into DFG https://bugs.webkit.org/show_bug.cgi?id=186175 by ticaiolima@gmail.com · 6 years ago
- 5292785 stress/big-wasm-memory tests failing on 32-bit JSC bot by keith_miller@apple.com · 6 years ago
- 5912d98 speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar. by mark.lam@apple.com · 6 years ago
- b85119d DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility. by mark.lam@apple.com · 6 years ago
- 6514855 [ESNext][BigInt] Support logic operations by ticaiolima@gmail.com · 6 years ago
- 2b558d7 Unreviewed, rolling out r238833. by ryanhaddad@apple.com · 6 years ago
- bb46de3 [ESNext][BigInt] Support logic operations by ticaiolima@gmail.com · 6 years ago
- c8fd1769 [ESNext][BigInt] Implement support for "<<" and ">>" by ticaiolima@gmail.com · 6 years ago
- a4bbb08 Add first-class support for .mjs files in jsc binary by dino@apple.com · 6 years ago
- 30786e6 [BigInt] Implement ValueBitXor into DFG by ticaiolima@gmail.com · 6 years ago
- d8dbdd1 r238510 broke scopes of size zero by sbarati@apple.com · 6 years ago
- 313900e [Re-landing] NaNs read from Wasm code needs to be be purified. by mark.lam@apple.com · 6 years ago
- ef5a75a Unreviewed, rolling out r238509. by ryanhaddad@apple.com · 6 years ago
- 10f9b734 Re-introduce op_bitnot https://bugs.webkit.org/show_bug.cgi?id=190923 by ticaiolima@gmail.com · 6 years ago
- 2dbf270 InPlaceAbstractState::endBasicBlock rule for SetLocal should filter the value based on the flush format by sbarati@apple.com · 6 years ago
- efedbce Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation by sbarati@apple.com · 6 years ago
- c3c54f8 NaNs read from Wasm code needs to be be purified. by mark.lam@apple.com · 6 years ago
- 59036fb 32-bit JSC test failure: stress/regexp-compile-oom.js by msaboff@apple.com · 6 years ago
- 7b81e97 ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset) by tzagallo@apple.com · 6 years ago
- 403646c DFGSpeculativeJIT should not &= exitOK with mayExit(node) by sbarati@apple.com · 6 years ago
- 735e5ef6 Fix assertion in KnownCellUse inside SpeculativeJIT::speculate by sbarati@apple.com · 6 years ago
- 27656fd Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError. by mark.lam@apple.com · 6 years ago
- b56d983 [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength by ticaiolima@gmail.com · 6 years ago
- 968eaa3 Remove invalid assertion in VMTraps::SignalSender's SignalAction. by mark.lam@apple.com · 6 years ago
- 060dcd2 Enable JIT on ARM/Linux https://bugs.webkit.org/show_bug.cgi?id=191548 by dinfuehr@igalia.com · 6 years ago
- b41fe4b Merging an IC variant may lead to the IC status containing overlapping structure sets by sbarati@apple.com · 6 years ago
- 55e3465 globalFuncImportModule() should return a promise when it clears exceptions. by mark.lam@apple.com · 6 years ago