Google Git
Sign in
chromium/external/github.com/WebKit/webkit/2cc0c9624ed1bfdbdc2be2e81529d41c91e9052d/./JSTests/ChangeLog
blob: 180e2c4ba2af6031eb3bfd6bd80462c5ea3b5069 [file] [log] [blame]
2021-10-25 Null <null@apple.com>
Cherry-pick r283600. rdar://problem/84625586
Don't pass DontBuildStrings to next token after parsing an empty parameter list
https://bugs.webkit.org/show_bug.cgi?id=225094
<rdar://problem/77231778>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/dont-pass-DontBuildStrings-when-building-empty-arguments-list.js: Added.
(main.a.prototype.g.toString.string_appeared_here):
(main.a):
(main):
Source/JavaScriptCore:
We might need the string, it turns out!
* parser/Parser.cpp:
(JSC::Parser<LexerType>::parseArguments):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@283600 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-10-05 Saam Barati <sbarati@apple.com>
Don't pass DontBuildStrings to next token after parsing an empty parameter list
https://bugs.webkit.org/show_bug.cgi?id=225094
<rdar://problem/77231778>
Reviewed by Yusuke Suzuki.
* stress/dont-pass-DontBuildStrings-when-building-empty-arguments-list.js: Added.
(main.a.prototype.g.toString.string_appeared_here):
(main.a):
(main):
2021-10-18 Russell Epstein <repstein@apple.com>
Cherry-pick r284348. rdar://problem/84398090
[JSC] PutByVal's child5 should be KnownInt32Use / Int52RepUse in FTL
https://bugs.webkit.org/show_bug.cgi?id=231884
rdar://84357099
Reviewed by Robin Morisset.
JSTests:
* stress/put-by-val-known-int32.js: Added.
(new.Uint8Array.1000000.map):
Source/JavaScriptCore:
The child5 of PutByVal should be KnownInt32Use or Int52RepUse.
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284348 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-10-18 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] PutByVal's child5 should be KnownInt32Use / Int52RepUse in FTL
https://bugs.webkit.org/show_bug.cgi?id=231884
rdar://84357099
Reviewed by Robin Morisset.
* stress/put-by-val-known-int32.js: Added.
(new.Uint8Array.1000000.map):
2021-10-18 Russell Epstein <repstein@apple.com>
Apply patch. rdar://problem/84351845
2021-10-18 Tadeu Zagallo <tzagallo@apple.com>
Implement the WebAssembly exception handling proposal
https://bugs.webkit.org/show_bug.cgi?id=229681
<rdar://81603387>
Reviewed by Keith Miller.
Add new tests for the exception handling and import a set of tests used by V8 into wasm/v8.
* wasm.yaml:
* wasm/Builder.js:
(const._importExceptionContinuation.type.Import.field):
(export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
(const._exportFunctionContinuation.type.Export.field): Deleted.
(const._exportFunctionContinuation): Deleted.
* wasm/Builder_WebAssemblyBinary.js:
(const.emitters.Import):
(const.emitters.Export):
(const.emitters.Exception):
* wasm/assert.js:
* wasm/self-test/test_BuilderJSON.js:
(ImportBeforeTypeSections): Deleted.
* wasm/stress/catch-with-delegate.js: Added.
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.callback):
(assert.throws):
* wasm/stress/create-tag-from.js: Added.
* wasm/stress/exception-cross-instance-2.js: Added.
(test):
(assert.eq):
* wasm/stress/exception-cross-instance-3.js: Added.
(test):
(assert.eq):
* wasm/stress/exception-cross-instance.js: Added.
(test):
(assert.throws):
(instB.new.WebAssembly.Instance):
* wasm/stress/exception-liveness-tier-up.js: Added.
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.catch):
(assert.eq.):
(assert.eq):
* wasm/stress/exception-multiple-instances.js: Added.
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.module.new.WebAssembly.Module):
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.inst.exports.throw):
* wasm/stress/exception-simple-delegate.js: Added.
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.testSimpleThrowDelegate):
(testThrowDelegateSkip):
(testDelegateCaller):
(testSimpleDelegateMerge):
* wasm/stress/exception-simple-throw-catch.js: Added.
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.testSimpleTryCatch):
(testSimpleTryCatchAll):
(testCallTryCatch):
(testCallTryCatchAll):
(testSimpleTryCatchValue):
(testCallTryCatchValue):
(testStackTryCatch):
(testLiveAfterTryCatch):
(testLiveAfterTryCatchAll):
(testUnifyTryCatchCatch):
(testUnifyTryCatchCatchAll):
(testUnifyTryNoThrow):
(testUnifyTryNoCatch):
(testNestedCatch):
* wasm/stress/exception-thrown-from-js-to-wasm-catchall-rethrow.js: Added.
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.callback):
* wasm/stress/exception-thrown-from-js-to-wasm-catchall.js: Added.
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.callback):
* wasm/stress/exception-thrown-from-js-to-wasm.js: Added.
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.callback):
* wasm/stress/exception-thrown-out-of-wasm.js: Added.
* wasm/stress/exception-thrown-over-wasm.js: Added.
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.callback):
* wasm/stress/exception-trap.js: Added.
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.testCannotCatchUnreachable):
(testCannotCatchOOB):
(testWasmAPIThrow):
(testJSCatchAndRethrow):
* wasm/stress/rethrow-from-catch-to-catch.js: Added.
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.callback):
* wasm/stress/rethrow-to-catch.js: Added.
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.callback):
(assert.throws.callback):
(assert.throws):
* wasm/stress/rethrow-to-delegate-to-catch.js: Added.
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here):
(assert.eq.exn.getArg):
(assert.throws):
(assert.throws.callback):
(assert.eq):
* wasm/stress/simple-export-exception.js: Added.
* wasm/v8/LICENSE: Added.
* wasm/v8/exceptions-api.js: Added.
(TestImport):
(TestImportExport):
(TestExceptionConstructor):
(TestExceptionConstructorWithPayload):
(TestCatchJSException.js_func):
(js_func):
(TestCatchJS):
(TestCatchJSExceptionWithPayload):
(TestGetArg):
* wasm/v8/exceptions-export.js: Added.
(TestExportMultiple):
(TestExportOutOfBounds):
* wasm/v8/exceptions-externref.js: Added.
(TestThrowRefNull):
(TestThrowRefParam):
* wasm/v8/exceptions-import.js: Added.
(NewExportedTag):
(TestImportSimple):
(TestImportMissing):
* wasm/v8/exceptions-rethrow.js: Added.
(TestRethrowInCatch):
(TestRethrowInCatchAll):
(TestRethrowNested):
(TestRethrowRecatch):
* wasm/v8/exceptions-shared.js: Added.
(NewExportedException):
(TestSingleInstance.let.instance.builder.instantiate.):
(TestSingleInstance):
(TestMultiInstanceNonShared.let.instance2.builder.instantiate.):
(TestMultiInstanceShared.let.instance2.builder.instantiate.):
(TestMultiModuleShared.let.instance2.builder2.instantiate.):
* wasm/v8/exceptions-type-reflection.js: Added.
(TestExport):
(TestImportExport):
* wasm/v8/exceptions-utils.js: Added.
(assertWasmThrows):
* wasm/v8/exceptions.js: Added.
(TestThrowSimple):
(TestCatchSimple):
(TestTrapNotCaught):
(TestTrapViaJSNotCaught.js_import):
(TestManuallyThrownRuntimeErrorCaught.throw_exc):
(TestManuallyThrownRuntimeErrorCaught):
(TestExnWithWasmProtoNotCaught.js_import):
(TestExnWithWasmProtoNotCaught):
(TestStackOverflowNotCaught.stack_overflow):
(TestStackOverflowNotCaught):
(TestThrowParamI):
(TestThrowParamF):
(TestThrowParamL):
(TestThrowParamD):
(TestCatchCrossFunctions.throw_value):
(TestCatchCrossFunctions.throw_string):
(TestCatchCrossFunctions.throw_undefined):
(TestCatchCrossFunctions.throw_fp):
(TestCatchCrossFunctions.throw_large):
(TestDelegateNoThrow):
(TestDelegateThrow):
(TestDelegateThrowNoCatch):
(TestDelegateMerge):
(TestDelegate1):
(TestDelegateUnreachable):
(TestDelegateToCaller):
(TestUnreachableInCatchAll):
(TestThrowWithLocal):
(TestCatchlessTry):
* wasm/v8/mjsunit.js: Added.
(MjsUnitAssertionError):
(MjsUnitAssertionError.prototype.toString):
(catch):
(classOf):
(ValueOf):
(prettyPrinted):
(prettyPrintedArrayElement):
(failWithMessage):
(formatFailureText):
(fail):
(deepObjectEquals):
(deepEquals):
(assertSame):
(assertNotSame):
(assertEquals):
(assertNotEquals):
(assertEqualsDelta):
(assertArrayEquals):
(assertPropertiesEqual):
(assertToStringEquals):
(assertTrue):
(assertFalse):
(assertNull):
(assertNotNull):
(executeCode):
(checkException):
(assertThrows):
(assertThrowsEquals):
(assertThrowsAsync):
(assertInstanceof):
(assertDoesNotThrow):
(assertUnreachable):
(assertContains):
(assertMatches):
(concatenateErrors):
(assertPromiseResult):
(OptimizationStatus):
(assertUnoptimized):
(assertOptimized):
(isNeverOptimizeLiteMode):
(isNeverOptimize):
(isAlwaysOptimize):
(isInterpreted):
(isBaseline):
(isUnoptimized):
(isOptimized):
(isTurboFanned):
(MjsUnitAssertionError.prepareStackTrace):
* wasm/v8/wasm-module-builder.js: Added.
(bytes):
(wasmOptRefType):
(wasmRefType):
(wasmRtt):
(wasmRttNoDepth):
(makeSig):
(makeSig_v_x):
(makeSig_x_v):
(makeSig_v_xx):
(makeSig_r_v):
(makeSig_r_x):
(makeSig_r_xx):
(defineWasmOpcode):
(assertTraps):
(Binary):
(Binary.prototype.ensure_space):
(Binary.prototype.trunc_buffer):
(Binary.prototype.reset):
(Binary.prototype.emit_u8):
(Binary.prototype.emit_u16):
(Binary.prototype.emit_u32):
(Binary.prototype.emit_leb_u):
(Binary.prototype.emit_u32v):
(Binary.prototype.emit_u64v):
(Binary.prototype.emit_bytes):
(Binary.prototype.emit_string):
(Binary.prototype.emit_heap_type):
(Binary.prototype.emit_type):
(Binary.prototype.emit_init_expr_recursive):
(Binary.prototype.emit_init_expr):
(Binary.prototype.emit_header):
(Binary.prototype.emit_section):
(WasmFunctionBuilder):
(WasmFunctionBuilder.prototype.numLocalNames):
(WasmFunctionBuilder.prototype.exportAs):
(WasmFunctionBuilder.prototype.exportFunc):
(WasmFunctionBuilder.prototype.setCompilationHint):
(WasmFunctionBuilder.prototype.addBody):
(WasmFunctionBuilder.prototype.addBodyWithEnd):
(WasmFunctionBuilder.prototype.getNumLocals):
(WasmFunctionBuilder.prototype.addLocals):
(WasmFunctionBuilder.prototype.end):
(WasmInitExpr.I32Const):
(WasmInitExpr.I64Const):
(WasmInitExpr.F32Const):
(WasmInitExpr.F64Const):
(WasmInitExpr.S128Const):
(WasmInitExpr.GlobalGet):
(WasmInitExpr.RefFunc):
(WasmInitExpr.RefNull):
(WasmInitExpr.StructNewWithRtt):
(WasmInitExpr.StructNew):
(WasmInitExpr.StructNewDefaultWithRtt):
(WasmInitExpr.StructNewDefault):
(WasmInitExpr.ArrayInit):
(WasmInitExpr.ArrayInitStatic):
(WasmInitExpr.RttCanon):
(WasmInitExpr.RttSub):
(WasmInitExpr.RttFreshSub):
(WasmInitExpr.defaultFor):
(WasmInitExpr):
(WasmGlobalBuilder):
(WasmGlobalBuilder.prototype.exportAs):
(WasmTableBuilder):
(WasmTableBuilder.prototype.exportAs):
(makeField):
(WasmStruct):
(WasmStructSubtype):
(WasmArray):
(WasmArraySubtype):
(WasmElemSegment):
(WasmElemSegment.prototype.is_active):
(WasmElemSegment.prototype.is_passive):
(WasmElemSegment.prototype.is_declarative):
(WasmElemSegment.prototype.expressions_as_elements):
(WasmModuleBuilder):
(WasmModuleBuilder.prototype.addStart):
(WasmModuleBuilder.prototype.addMemory):
(WasmModuleBuilder.prototype.addMemory64):
(WasmModuleBuilder.prototype.addExplicitSection):
(WasmModuleBuilder.prototype.stringToBytes):
(WasmModuleBuilder.prototype.createCustomSection):
(WasmModuleBuilder.prototype.addCustomSection):
(WasmModuleBuilder.prototype.addType):
(WasmModuleBuilder.prototype.addStruct):
(WasmModuleBuilder.prototype.addStructSubtype):
(WasmModuleBuilder.prototype.addArray):
(WasmModuleBuilder.prototype.addArraySubtype):
(WasmModuleBuilder.prototype.addGlobal):
(WasmModuleBuilder.prototype.addTable):
(WasmModuleBuilder.prototype.addTag):
(WasmModuleBuilder.prototype.addFunction):
(WasmModuleBuilder.prototype.addImport):
(WasmModuleBuilder.prototype.addImportedGlobal):
(WasmModuleBuilder.prototype.addImportedMemory):
(WasmModuleBuilder.prototype.addImportedTable):
(WasmModuleBuilder.prototype.addImportedTag):
(WasmModuleBuilder.prototype.addExport):
(WasmModuleBuilder.prototype.addExportOfKind):
(WasmModuleBuilder.prototype.setCompilationHint):
(WasmModuleBuilder.prototype.addDataSegment):
(WasmModuleBuilder.prototype.addPassiveDataSegment):
(WasmModuleBuilder.prototype.exportMemoryAs):
(WasmModuleBuilder.prototype.addActiveElementSegment):
(WasmModuleBuilder.prototype.addPassiveElementSegment):
(WasmModuleBuilder.prototype.addDeclarativeElementSegment):
(WasmModuleBuilder.prototype.appendToTable):
(WasmModuleBuilder.prototype.setTableBounds):
(WasmModuleBuilder.prototype.setName):
(WasmModuleBuilder.prototype.toBuffer):
(WasmModuleBuilder.prototype.toArray):
(WasmModuleBuilder.prototype.instantiate):
(WasmModuleBuilder.prototype.asyncInstantiate):
(WasmModuleBuilder.prototype.toModule):
(wasmSignedLeb):
(wasmUnsignedLeb):
(wasmI32Const):
(wasmI64Const):
(wasmF32Const):
(wasmF64Const):
(wasmS128Const):
(getOpcodeName):
* wasm/wasm.json:
2021-10-18 Russell Epstein <repstein@apple.com>
Cherry-pick r284230. rdar://problem/84351866
Allow WASM to use up to 4GB
https://bugs.webkit.org/show_bug.cgi?id=229353
rdar://81603447
Reviewed by Yusuke Suzuki.
JSTests:
The big-wasm-memory/wasm-memory-requested... tests used to simply expect an OOM at 2GB.
They now expect success at 4GB, and failure at 4GB+1.
The exceptions they expect are now more specific, as previously there was a rounding issue that was causing the specific exceptions not to be thrown (resulting in the generic OOM exception later in the code).
Finally I made them only run on 64-bit platforms since we don't support typed arrays >=2GB on 32-bits, and I made them only run in one configuration since they can take a little bit of time.
I also added a few new tests, specifically checking our handling of large typed arrays, and especially of indices above INT32_MAX.
* stress/big-wasm-memory-grow-no-max.js:
(test):
* stress/big-wasm-memory-grow.js:
(test):
* stress/big-wasm-memory.js:
(test):
* stress/typed-array-always-large.js: Added.
(getArrayLength):
(getByVal):
(putByVal):
(test):
* stress/typed-array-eventually-large.js: Added.
(getArrayLength):
(getByVal):
(putByVal):
(test):
* stress/typed-array-large-eventually-oob.js: Added.
(getArrayLength):
(getByVal):
(putByVal):
(test):
* wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js:
* wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js:
Source/JavaScriptCore:
While increasing MAX_ARRAY_BUFFER_SIZE to 4GB was easy, it was not remotely the only thing required to get this to work:
- 4GB is not representable in a uint32_t, so I changed all length of ArrayBuffer/TypedArray/etc.. to being UCPURegister.
- This also required changing NewTypedArray in all of LLInt/Baseline/DFG/FTL to accept a non-int32 size.
In order to avoid performance regressions, I had to add speculation in the DFG/FTL, which now have two versions of NewTypedArray (one that takes an Int32 and one that takes a StrictInt52)
- Similarly, GetArrayLength and GetTypedArrayByteOffset now can either return an Int32 or a larger number.
I also had to split them in the DFG/FTL, see GetTypedArrayLengthAsInt52 and GetTypedArrayByteOffsetAsInt52 for examples
- In turns, I had to add CheckInBoundsInt52 since CheckInBounds could not accept the result of GetTypedArrayLengthAsInt52
- I modified the runtime functions for GetByVal/PutByVal/DataViewGet/DataViewSet/AtomicsXXX to accept non-Int32 indices, since for {Int8/UInt8/UInt8Clamped}Array, a maximum size of 4GB implies indices > 2B.
- I added a "mayBeLargeTypedArray" bit to ArrayProfile/UnlinkedArrayProfile/DFG::ArrayMode to track whether such a non-Int32 index was seen to allow proper speculation and specialization of fast paths in the DFG/FTL.
I then updated the runtime functions used by the slow paths to correctly update it.
Unfortunately I ran out of time to add all the speculations/update all the fast paths.
So the following will have to wait for a follow-up patch:
- Accepting large indices in the fast path of GetByVal in the LLInt
- Accepting large indices in the fast paths generated by AccessCase/PolymorphicAccess
- Accepting large indices in the fast paths generated by the DFG/FTL for each of GetByVal/PutByVal/DataViewGet/DataViewSet/AtomicsXXX
The current patch is functional, it will just have dreadful performance if trying to use indices >2B in a {Int8/UInt8/UInt8Clamped}Array.
Other minor changes in this patch:
- Fixed an undefined behavior in ArrayBuffer::createInternal where memcpy could be called on nullptr (the spec explicitly bans this even when length is 0)
- Replaced some repetitive and error-prone bounds checking by calls to WTF::isSumSmallerThanOrEqual, which is clearer, shorter, and reuse CheckedArithmetic facilities to avoid overflow issues.
- Fixed a variety of obsolete comments
- Added support for branch64(RelationalCondition cond, RegisterID left, Imm64 right)
(there was already support for the same but with TrustedImm64)
- Made various AbstractMacroAssembler function constexpr as part of the previous point
* assembler/AbstractMacroAssembler.cpp:
* assembler/AbstractMacroAssembler.h:
(JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
(JSC::AbstractMacroAssembler::TrustedImmPtr::asIntptr):
(JSC::AbstractMacroAssembler::TrustedImmPtr::asPtr):
(JSC::AbstractMacroAssembler::ImmPtr::ImmPtr):
(JSC::AbstractMacroAssembler::ImmPtr::asTrustedImmPtr):
(JSC::AbstractMacroAssembler::TrustedImm32::TrustedImm32):
(JSC::AbstractMacroAssembler::Imm32::Imm32):
(JSC::AbstractMacroAssembler::Imm32::asTrustedImm32 const):
(JSC::AbstractMacroAssembler::TrustedImm64::TrustedImm64):
(JSC::AbstractMacroAssembler::Imm64::Imm64):
(JSC::AbstractMacroAssembler::Imm64::asTrustedImm64 const):
(JSC::AbstractMacroAssembler::canBlind):
(JSC::AbstractMacroAssembler::shouldBlindForSpecificArch):
* assembler/MacroAssembler.h:
(JSC::MacroAssembler::branch64):
* assembler/MacroAssemblerARM64.h:
(JSC::MacroAssemblerARM64::shouldBlindForSpecificArch):
(JSC::MacroAssemblerARM64::branch64):
* assembler/MacroAssemblerARM64E.h:
(JSC::MacroAssemblerARM64E::untagArrayPtrLength64):
(JSC::MacroAssemblerARM64E::untagArrayPtrLength32): Deleted.
* assembler/MacroAssemblerX86Common.h:
(JSC::MacroAssemblerX86Common::canBlind):
(JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
* bytecode/AccessCase.cpp:
(JSC::AccessCase::needsScratchFPR const):
(JSC::AccessCase::generateWithGuard):
* bytecode/ArrayProfile.h:
(JSC::ArrayProfile::setMayBeLargeTypedArray):
(JSC::ArrayProfile::mayBeLargeTypedArray const):
(JSC::UnlinkedArrayProfile::UnlinkedArrayProfile):
(JSC::UnlinkedArrayProfile::update):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGArgumentsEliminationPhase.cpp:
* dfg/DFGArrayMode.cpp:
(JSC::DFG::ArrayMode::refine const):
* dfg/DFGArrayMode.h:
(JSC::DFG::ArrayMode::ArrayMode):
(JSC::DFG::ArrayMode::mayBeLargeTypedArray const):
(JSC::DFG::ArrayMode::withType const):
(JSC::DFG::ArrayMode::withSpeculation const):
(JSC::DFG::ArrayMode::withConversion const):
(JSC::DFG::ArrayMode::withTypeAndConversion const):
(JSC::DFG::ArrayMode::withArrayClassAndSpeculationAndMayBeLargeTypedArray const):
(JSC::DFG::ArrayMode::speculationFromProfile):
(JSC::DFG::ArrayMode::withSpeculationFromProfile const):
(JSC::DFG::ArrayMode::withProfile const):
(JSC::DFG::ArrayMode::operator== const):
(JSC::DFG::ArrayMode::withArrayClass const): Deleted.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicGetter):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGCommon.h:
(JSC::DFG::enableInt52):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::convertToGetArrayLength):
(JSC::DFG::FixupPhase::prependGetArrayLength): Deleted.
* dfg/DFGGenerationInfo.h:
* dfg/DFGHeapLocation.cpp:
(WTF::printInternal):
* dfg/DFGHeapLocation.h:
* dfg/DFGIntegerRangeOptimizationPhase.cpp:
* dfg/DFGNode.h:
(JSC::DFG::Node::hasStorageChild const):
(JSC::DFG::Node::storageChildIndex):
(JSC::DFG::Node::hasArrayMode):
* dfg/DFGNodeType.h:
* dfg/DFGOperations.cpp:
(JSC::DFG::putByVal):
(JSC::DFG::newTypedArrayWithSize):
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSSALoweringPhase.cpp:
(JSC::DFG::SSALoweringPhase::handleNode):
(JSC::DFG::SSALoweringPhase::lowerBoundsCheck):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
(JSC::DFG::SpeculativeJIT::emitTypedArrayBoundsCheck):
(JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
(JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
(JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
(JSC::DFG::SpeculativeJIT::cageTypedArrayStorage):
(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
(JSC::DFG::SpeculativeJIT::compileGetArrayLength):
(JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
(JSC::DFG::SpeculativeJIT::emitNewTypedArrayWithSizeInRegister):
(JSC::DFG::SpeculativeJIT::compileNewTypedArray):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compileGetByVal):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithInt52Size):
(JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52):
(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffsetAsInt52):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGTypeCheckHoistingPhase.cpp:
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
* dfg/DFGValidate.cpp:
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::validateAIState):
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::emitGetTypedArrayByteOffsetExceptSettingResult):
(JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffsetAsInt52):
(JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
(JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckInBoundsInt52):
(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
(JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* ftl/FTLOutput.h:
(JSC::FTL::Output::load64NonNegative):
* jit/IntrinsicEmitter.cpp:
(JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):
* jit/JITOperations.cpp:
(JSC::putByVal):
(JSC::getByVal):
* llint/LLIntOfflineAsmConfig.h:
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::getByVal):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/ArrayBuffer.cpp:
(JSC::SharedArrayBufferContents::SharedArrayBufferContents):
(JSC::ArrayBufferContents::ArrayBufferContents):
(JSC::ArrayBufferContents::tryAllocate):
(JSC::ArrayBuffer::create):
(JSC::ArrayBuffer::createAdopted):
(JSC::ArrayBuffer::createFromBytes):
(JSC::ArrayBuffer::tryCreate):
(JSC::ArrayBuffer::createUninitialized):
(JSC::ArrayBuffer::tryCreateUninitialized):
(JSC::ArrayBuffer::createInternal):
(JSC::ArrayBuffer::clampValue):
(JSC::ArrayBuffer::clampIndex const):
(JSC::ArrayBuffer::sliceWithClampedIndex const):
* runtime/ArrayBuffer.h:
(JSC::ArrayBufferContents::sizeInBytes const):
(JSC::ArrayBuffer::byteLength const):
(JSC::ArrayBuffer::gcSizeEstimateInBytes const):
* runtime/ArrayBufferView.cpp:
(JSC::ArrayBufferView::ArrayBufferView):
* runtime/ArrayBufferView.h:
(JSC::ArrayBufferView::byteOffset const):
(JSC::ArrayBufferView::byteLength const):
(JSC::ArrayBufferView::verifyByteOffsetAlignment):
(JSC::ArrayBufferView::verifySubRangeLength):
(JSC::ArrayBufferView::clampOffsetAndNumElements):
(JSC::ArrayBufferView::setImpl):
(JSC::ArrayBufferView::setRangeImpl):
(JSC::ArrayBufferView::getRangeImpl):
(JSC::ArrayBufferView::zeroRangeImpl):
(JSC::ArrayBufferView::calculateOffsetAndLength): Deleted.
* runtime/AtomicsObject.cpp:
* runtime/DataView.cpp:
(JSC::DataView::DataView):
(JSC::DataView::create):
* runtime/DataView.h:
* runtime/GenericTypedArrayView.h:
* runtime/GenericTypedArrayViewInlines.h:
(JSC::GenericTypedArrayView<Adaptor>::GenericTypedArrayView):
(JSC::GenericTypedArrayView<Adaptor>::create):
(JSC::GenericTypedArrayView<Adaptor>::tryCreate):
(JSC::GenericTypedArrayView<Adaptor>::createUninitialized):
(JSC::GenericTypedArrayView<Adaptor>::tryCreateUninitialized):
(JSC::GenericTypedArrayView<Adaptor>::subarray const): Deleted.
* runtime/JSArrayBufferView.cpp:
(JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
(JSC::JSArrayBufferView::byteLength const):
(JSC::JSArrayBufferView::slowDownAndWasteMemory):
(JSC::JSArrayBufferView::possiblySharedImpl):
* runtime/JSArrayBufferView.h:
(JSC::JSArrayBufferView::sizeOf):
(JSC::JSArrayBufferView::ConstructionContext::length const):
(JSC::JSArrayBufferView::length const):
* runtime/JSArrayBufferViewInlines.h:
(JSC::JSArrayBufferView::byteOffsetImpl):
(JSC::JSArrayBufferView::byteOffset):
(JSC::JSArrayBufferView::byteOffsetConcurrently):
* runtime/JSCJSValue.h:
* runtime/JSCJSValueInlines.h:
(JSC::JSValue::toIndex const):
(JSC::JSValue::toTypedArrayIndex const):
* runtime/JSDataView.cpp:
(JSC::JSDataView::create):
(JSC::JSDataView::createUninitialized):
(JSC::JSDataView::set):
(JSC::JSDataView::setIndex):
* runtime/JSDataView.h:
* runtime/JSDataViewPrototype.cpp:
(JSC::getData):
(JSC::setData):
* runtime/JSGenericTypedArrayView.h:
* runtime/JSGenericTypedArrayViewConstructorInlines.h:
(JSC::constructGenericTypedArrayViewWithArguments):
(JSC::constructGenericTypedArrayViewImpl):
* runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView<Adaptor>::create):
(JSC::JSGenericTypedArrayView<Adaptor>::createWithFastVector):
(JSC::JSGenericTypedArrayView<Adaptor>::createUninitialized):
(JSC::JSGenericTypedArrayView<Adaptor>::validateRange):
(JSC::JSGenericTypedArrayView<Adaptor>::setWithSpecificType):
(JSC::JSGenericTypedArrayView<Adaptor>::set):
* runtime/JSObject.h:
(JSC::JSObject::putByIndexInline):
(JSC::JSObject::tryGetIndexQuickly const):
(JSC::JSObject::trySetIndexQuickly):
(JSC::JSObject::canSetIndexQuickly): Deleted.
* runtime/JSObjectInlines.h:
(JSC::JSObject::getIndexQuicklyForTypedArray const):
(JSC::JSObject::setIndexQuicklyForArrayStorageIndexingType):
(JSC::JSObject::trySetIndexQuicklyForTypedArray):
(JSC::JSObject::canSetIndexQuicklyForTypedArray const): Deleted.
* runtime/Operations.h:
(JSC::getByValWithIndex):
* wasm/WasmPageCount.h:
Source/WebCore:
Some parts of WebCore use TypedArrays, and would not build after I made the length() function on typed arrays return UCPURegister instead of uint32_t.
Most fixes were trivial, the only exception is SerializedScriptValue.cpp, where I had to increment the version number, as ArrayBuffer (and ArrayBufferViews) now write/read their length in a 64-bit field (and same for the byteOffset of ArrayBufferView).
I also had to add a test in PixelBuffer.cpp that the size of the ArrayBuffer it will try to allocate is < INT32_MAX.
Otherwise, the test LayoutTests/fast/shapes/shape-outside-floats/shape-outside-imagedata-overflow.html which checks that very large images are properly rejected without crashing, would timeout.
No new tests, as the code is already extensively covered by existing tests, and I implemented no new features.
* Modules/webaudio/AudioBuffer.cpp:
(WebCore::AudioBuffer::copyFromChannel):
(WebCore::AudioBuffer::copyToChannel):
* Modules/webaudio/RealtimeAnalyser.cpp:
(WebCore::RealtimeAnalyser::getByteFrequencyData):
(WebCore::RealtimeAnalyser::getFloatTimeDomainData):
(WebCore::RealtimeAnalyser::getByteTimeDomainData):
* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneSerializer::dumpArrayBufferView):
(WebCore::CloneSerializer::dumpImageBitmap):
(WebCore::CloneSerializer::dumpIfTerminal):
(WebCore::CloneDeserializer::readArrayBufferImpl):
(WebCore::CloneDeserializer::readArrayBuffer):
(WebCore::CloneDeserializer::readArrayBufferViewImpl):
(WebCore::CloneDeserializer::readArrayBufferView):
* bindings/js/SerializedScriptValue.h:
(WebCore::SerializedScriptValue::encode const):
(WebCore::SerializedScriptValue::decode):
* fileapi/NetworkSendQueue.cpp:
(WebCore::NetworkSendQueue::enqueue):
* platform/graphics/PixelBuffer.cpp:
(WebCore::PixelBuffer::tryCreate):
* platform/graphics/iso/ISOBox.h:
Source/WTF:
Made some of CheckedArithmetic constexpr, and added isSumSmallerThanOrEqual since it is a commonly used test in ArrayBuffer and easy to get wrong in terms of overflow.
* wtf/CheckedArithmetic.h:
(WTF::isInBounds):
(WTF::convertSafely):
(WTF::isSumSmallerThanOrEqual):
LayoutTests:
Rebaselined three following tests as different or fewer error messages appear on the console.
Also changed currentVersion in serialized-script-value.html from 9 to 10.
* fast/canvas/canvas-getImageData-invalid-result-buffer-crash-expected.txt:
* fast/storage/serialized-script-value.html:
* webaudio/OfflineAudioContext-bad-buffer-crash-expected.txt:
* webaudio/OfflineAudioContext/bad-buffer-length-expected.txt:
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284230 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-10-14 Robin Morisset <rmorisset@apple.com>
Allow WASM to use up to 4GB
https://bugs.webkit.org/show_bug.cgi?id=229353
rdar://81603447
Reviewed by Yusuke Suzuki.
The big-wasm-memory/wasm-memory-requested... tests used to simply expect an OOM at 2GB.
They now expect success at 4GB, and failure at 4GB+1.
The exceptions they expect are now more specific, as previously there was a rounding issue that was causing the specific exceptions not to be thrown (resulting in the generic OOM exception later in the code).
Finally I made them only run on 64-bit platforms since we don't support typed arrays >=2GB on 32-bits, and I made them only run in one configuration since they can take a little bit of time.
I also added a few new tests, specifically checking our handling of large typed arrays, and especially of indices above INT32_MAX.
* stress/big-wasm-memory-grow-no-max.js:
(test):
* stress/big-wasm-memory-grow.js:
(test):
* stress/big-wasm-memory.js:
(test):
* stress/typed-array-always-large.js: Added.
(getArrayLength):
(getByVal):
(putByVal):
(test):
* stress/typed-array-eventually-large.js: Added.
(getArrayLength):
(getByVal):
(putByVal):
(test):
* stress/typed-array-large-eventually-oob.js: Added.
(getArrayLength):
(getByVal):
(putByVal):
(test):
* wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js:
* wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js:
2021-08-26 Yusuke Suzuki <ysuzuki@apple.com>
Intl.DateTimeFormat incorrectly parses patterns with 'h' literal
https://bugs.webkit.org/show_bug.cgi?id=229313
rdar://82414310
Reviewed by Ross Kirsling.
* stress/intl-date-pattern-includes-literal-text.js: Added.
(shouldBe):
2021-10-06 Russell Epstein <repstein@apple.com>
Cherry-pick r283556. rdar://problem/83956477
[JSC] JSPropertyNameEnumerator should not have cached prototype chain since empty JSPropertyNameEnumerator is shared
https://bugs.webkit.org/show_bug.cgi?id=231202
JSTests:
Reviewed by Keith Miller.
* stress/for-in-validation-poly-proto.js: Added.
(shouldBe):
(test):
(factory.Test):
(factory):
* stress/for-in-validation-watchpoint.js: Added.
(shouldBe):
(test):
(Test):
(factory):
Source/JavaScriptCore:
rdar://83815122
Reviewed by Keith Miller.
r282014 assumed an invariant that JSPropertyNameEnumerator's StructureChain is immutable.
This invariant is also used in validation of JSPropertyNameEnumerator. However, this
invariant was broken since we now have shared empty sentinel JSPropertyNameEnumerator, which can
be used for different structures having different prototype chain.
Since now we have shared JSPropertyNameEnumerator, JSPropertyNameEnumerator should not have
StructureChain in its member. When invalidating StructureChain in Structure, we also clear
cached JSPropertyNameEnumerator so that we do not get a stale JSPropertyNameEnumerator from
Structure even though watchpoint-based validation is not used.
This patch also removes ValidatedViaWatchpoint flag in JSPropertyNameEnumerator due to the same
reason. We should not modify JSPropertyNameEnumerator once it is instantiated. Instead, we encode
this flag as a lowest bit of m_cachedPropertyNameEnumerator. If it is validated via traversing (not watchpoints),
then this bit is set. So when loading that pointer from StructureRareData, we can quickly detect
it without even accessing to the enumerator. This fixes the issue, and it is even cleaner.
We rename m_cachedPropertyNameEnumerator to m_cachedPropertyNameEnumeratorAndFlag since it now
includes this flag.
While reviewing the code, we also found that watchpoint-based validation didn't care about PolyProto.
We should disable watchpoint-based validation if PolyProto is used.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetPropertyEnumerator):
* ftl/FTLAbstractHeapRepository.h:
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_property_enumerator):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter64.asm:
* runtime/JSPropertyNameEnumerator.cpp:
(JSC::JSPropertyNameEnumerator::visitChildrenImpl):
* runtime/JSPropertyNameEnumerator.h:
(JSC::propertyNameEnumerator):
* runtime/Structure.cpp:
(JSC::Structure::visitChildrenImpl):
(JSC::Structure::setCachedPropertyNameEnumerator):
(JSC::Structure::cachedPropertyNameEnumeratorAndFlag const):
* runtime/Structure.h:
(JSC::Structure::propertyNameEnumeratorShouldWatch const):
* runtime/StructureInlines.h:
(JSC::Structure::prototypeChain const):
(JSC::Structure::clearCachedPrototypeChain):
* runtime/StructureRareData.cpp:
(JSC::StructureRareData::visitChildrenImpl):
* runtime/StructureRareData.h:
* runtime/StructureRareDataInlines.h:
(JSC::StructureRareData::cachedPropertyNameEnumerator const):
(JSC::StructureRareData::cachedPropertyNameEnumeratorAndFlag const):
(JSC::StructureRareData::setCachedPropertyNameEnumerator):
(JSC::StructureChainInvalidationWatchpoint::fireInternal):
(JSC::StructureRareData::tryCachePropertyNameEnumeratorViaWatchpoint):
(JSC::StructureRareData::clearCachedPropertyNameEnumerator):
(JSC::StructureRareData::invalidateWatchpointBasedValidation): Deleted.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@283556 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-10-05 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] JSPropertyNameEnumerator should not have cached prototype chain since empty JSPropertyNameEnumerator is shared
https://bugs.webkit.org/show_bug.cgi?id=231202
Reviewed by Keith Miller.
* stress/for-in-validation-poly-proto.js: Added.
(shouldBe):
(test):
(factory.Test):
(factory):
* stress/for-in-validation-watchpoint.js: Added.
(shouldBe):
(test):
(Test):
(factory):
2021-09-27 Alan Coon <alancoon@apple.com>
Cherry-pick r283098. rdar://problem/83584491
[JSC] Optimize PutByVal with for-in
https://bugs.webkit.org/show_bug.cgi?id=230801
Reviewed by Saam Barati.
JSTests:
* stress/for-in-sentinel.js: Added.
(shouldBe):
(test):
Source/JavaScriptCore:
We found that some of Speedometer2 subtests are heavily using for-in with PutByVal or the other DFG nodes.
And we also found that we are using polluted non-good type for the property names from for-in: String | Other.
The reason is that we are returning null when op_enumerator_next finishes instead of string. And this design
forces DFG and FTL to return null from EnumeratorNextUpdatePropertyName at the end of iteration. This pollutes
the type of property names as String | Other instead of String, and leading to suboptimal DFG nodes.
In this patch, we add special sentinel string in vm.smallString.sentinelString(). We know that this string cell
pointer will be never returned from EnumeratorNextUpdatePropertyName in the normal for-in iteration. This is easy
since we are always allocating a JSString when creating JSPropertyNameEnumerator. So this string cell (not the content)
is always different from pre-allocated vm.smallString.sentinelString(). So, we use this special string pointer
as a sentinel instead of null so that we can avoid polluting return type of EnumeratorNextUpdatePropertyName.
To check the sentinel in LLInt / Baseline, this patch adds jeq_ptr, which performs cell pointer comparison and do
not check string content equality. We do not need to have an implementation in DFG since we already have CompareEqPtr
for existing jneq_ptr bytecode.
We also clean up DFG operation related to PutByVal.
----------------------------------------------------------------------------------------------------------------------------------
| subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) |
----------------------------------------------------------------------------------------------------------------------------------
| Elm-TodoMVC |116.010000 |112.701667 |0.971482 | 0.000000 (significant) |
| VueJS-TodoMVC |22.995000 |23.023333 |1.001232 | 0.907086 |
| EmberJS-TodoMVC |125.498333 |125.525000 |1.000212 | 0.932546 |
| BackboneJS-TodoMVC |45.700000 |45.975000 |1.006018 | 0.084799 |
| Preact-TodoMVC |16.681667 |16.610000 |0.995704 | 0.722758 |
| AngularJS-TodoMVC |123.753333 |123.740000 |0.999892 | 0.971431 |
| Vanilla-ES2015-TodoMVC |61.255000 |61.380000 |1.002041 | 0.300654 |
| Inferno-TodoMVC |58.646667 |58.948333 |1.005144 | 0.267611 |
| Flight-TodoMVC |73.283333 |72.801667 |0.993427 | 0.207389 |
| Angular2-TypeScript-TodoMVC |39.746667 |40.015000 |1.006751 | 0.449821 |
| VanillaJS-TodoMVC |50.096667 |49.823333 |0.994544 | 0.162020 |
| jQuery-TodoMVC |212.870000 |213.196667 |1.001535 | 0.371944 |
| EmberJS-Debug-TodoMVC |331.878333 |332.710000 |1.002506 | 0.094499 |
| React-TodoMVC |83.078333 |82.726667 |0.995767 | 0.076143 |
| React-Redux-TodoMVC |136.018333 |133.935000 |0.984683 | 0.000000 (significant) |
| Vanilla-ES2015-Babel-Webpack-TodoMVC |59.743333 |59.643333 |0.998326 | 0.393671 |
----------------------------------------------------------------------------------------------------------------------------------
a mean = 271.75873
b mean = 272.45804
pValue = 0.0263030803
(Bigger means are better.)
1.003 times better
Results ARE significant
* builtins/BuiltinNames.h:
* bytecode/BytecodeList.rb:
* bytecode/BytecodeUseDef.cpp:
(JSC::computeUsesForBytecodeIndexImpl):
(JSC::computeDefsForBytecodeIndexImpl):
* bytecode/LinkTimeConstant.h:
* bytecode/Opcode.h:
(JSC::isBranch):
* bytecode/PreciseJumpTargetsInlines.h:
* bytecompiler/BytecodeGenerator.cpp:
(JSC::GenericLabel<JSGeneratorTraits>::setLocation):
(JSC::BytecodeGenerator::emitJumpIfSentinelString):
* bytecompiler/BytecodeGenerator.h:
* bytecompiler/NodesCodegen.cpp:
(JSC::ForInNode::emitBytecode):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCapabilities.cpp:
(JSC::DFG::capabilityLevel):
* dfg/DFGOperations.cpp:
(JSC::DFG::putByVal):
(JSC::DFG::putByValInternal):
(JSC::DFG::putByValCellInternal):
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
* jit/JIT.h:
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_jeq_ptr):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_jeq_ptr):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_enumerator_next):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/CommonSlowPaths.cpp:
(JSC::JSC_DEFINE_COMMON_SLOW_PATH):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
* runtime/SmallStrings.cpp:
(JSC::SmallStrings::initializeCommonStrings):
(JSC::SmallStrings::visitStrongReferences):
* runtime/SmallStrings.h:
(JSC::SmallStrings::sentinelString const):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@283098 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-09-26 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Optimize PutByVal with for-in
https://bugs.webkit.org/show_bug.cgi?id=230801
Reviewed by Saam Barati.
* stress/for-in-sentinel.js: Added.
(shouldBe):
(test):
2021-09-22 Alan Coon <alancoon@apple.com>
Cherry-pick r282707. rdar://problem/83429953
[JSC] Add fast property enumeration mode for JSON.stringify
https://bugs.webkit.org/show_bug.cgi?id=230393
Reviewed by Mark Lam.
JSTests:
* stress/json-stringify-object-modify.js: Added.
(shouldBe):
(throw.new.Error.let.object.hello.get inner):
(throw.new.Error):
(shouldBe.let.object.hello.get inner):
Source/JavaScriptCore:
We collected profiles and found several subtests are using JSON.stringify enough. And generated strings are many serialized leaf objects.
This patch adds fast object property enumeration. When we know that source object meets some conditions, we can say that,
as long as structure is not changed, we can continue using property names and offset collected from the structure.
This way removes non observable [[Get]] operations to accelerate JSON.stringify performance for major object iteration cases.
We also extend MarkedArgumentBuffer: introducing MarkedArgumentBufferWithSize which can take default inline capacity as a template
parameter. This is used in JSON.stringify to increase the buffer because now we also need to record structures in MarkedArgumentBuffer.
This offers 0.4% improvement in Speedometer2 (EmberJS-TodoMVC, Vanilla-XXX, EmberJS-Debug-TodoMVC, they have enough amount of JSON.stringify
time).
----------------------------------------------------------------------------------------------------------------------------------
| subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) |
----------------------------------------------------------------------------------------------------------------------------------
| Elm-TodoMVC |117.710000 |117.751667 |1.000354 | 0.883246 |
| VueJS-TodoMVC |24.500000 |24.311667 |0.992313 | 0.365130 |
| EmberJS-TodoMVC |126.646667 |125.738333 |0.992828 | 0.002587 (significant) |
| BackboneJS-TodoMVC |47.873333 |47.911667 |1.000801 | 0.762509 |
| Preact-TodoMVC |17.020000 |17.070000 |1.002938 | 0.786799 |
| AngularJS-TodoMVC |129.856667 |129.353333 |0.996124 | 0.177632 |
| Vanilla-ES2015-TodoMVC |61.698333 |61.120000 |0.990626 | 0.000003 (significant) |
| Inferno-TodoMVC |62.840000 |62.496667 |0.994536 | 0.312340 |
| Flight-TodoMVC |77.095000 |76.936667 |0.997946 | 0.702724 |
| Angular2-TypeScript-TodoMVC |39.740000 |39.191667 |0.986202 | 0.053485 |
| VanillaJS-TodoMVC |49.008333 |48.346667 |0.986499 | 0.000638 (significant) |
| jQuery-TodoMVC |216.785000 |217.188333 |1.001861 | 0.270747 |
| EmberJS-Debug-TodoMVC |344.230000 |342.993333 |0.996407 | 0.012262 (significant) |
| React-TodoMVC |85.461667 |85.411667 |0.999415 | 0.758049 |
| React-Redux-TodoMVC |140.681667 |140.640000 |0.999704 | 0.871277 |
| Vanilla-ES2015-Babel-Webpack-TodoMVC |59.928333 |59.351667 |0.990377 | 0.000000 (significant) |
----------------------------------------------------------------------------------------------------------------------------------
a mean = 264.40650
b mean = 265.51533
pValue = 0.0005567357
(Bigger means are better.)
1.004 times better
Results ARE significant
* heap/Heap.cpp:
(JSC::Heap::addCoreConstraints):
* heap/Heap.h:
* heap/HeapInlines.h:
* runtime/ArgList.cpp:
(JSC::MarkedArgumentBufferBase::addMarkSet):
(JSC::MarkedArgumentBufferBase::markLists):
(JSC::MarkedArgumentBufferBase::slowEnsureCapacity):
(JSC::MarkedArgumentBufferBase::expandCapacity):
(JSC::MarkedArgumentBufferBase::slowAppend):
(JSC::MarkedArgumentBuffer::addMarkSet): Deleted.
(JSC::MarkedArgumentBuffer::markLists): Deleted.
(JSC::MarkedArgumentBuffer::slowEnsureCapacity): Deleted.
(JSC::MarkedArgumentBuffer::expandCapacity): Deleted.
(JSC::MarkedArgumentBuffer::slowAppend): Deleted.
* runtime/ArgList.h:
(JSC::MarkedArgumentBufferWithSize::MarkedArgumentBufferWithSize):
(JSC::MarkedArgumentBuffer::MarkedArgumentBuffer): Deleted.
(JSC::MarkedArgumentBuffer::~MarkedArgumentBuffer): Deleted.
(JSC::MarkedArgumentBuffer::size const): Deleted.
(JSC::MarkedArgumentBuffer::isEmpty const): Deleted.
(JSC::MarkedArgumentBuffer::at const): Deleted.
(JSC::MarkedArgumentBuffer::clear): Deleted.
(JSC::MarkedArgumentBuffer::appendWithAction): Deleted.
(JSC::MarkedArgumentBuffer::append): Deleted.
(JSC::MarkedArgumentBuffer::appendWithCrashOnOverflow): Deleted.
(JSC::MarkedArgumentBuffer::removeLast): Deleted.
(JSC::MarkedArgumentBuffer::last): Deleted.
(JSC::MarkedArgumentBuffer::takeLast): Deleted.
(JSC::MarkedArgumentBuffer::ensureCapacity): Deleted.
(JSC::MarkedArgumentBuffer::hasOverflowed): Deleted.
(JSC::MarkedArgumentBuffer::overflowCheckNotNeeded): Deleted.
(JSC::MarkedArgumentBuffer::fill): Deleted.
(JSC::MarkedArgumentBuffer::slotFor const): Deleted.
(JSC::MarkedArgumentBuffer::mallocBase): Deleted.
(JSC::MarkedArgumentBuffer::setNeedsOverflowCheck): Deleted.
(JSC::MarkedArgumentBuffer::clearNeedsOverflowCheck): Deleted.
* runtime/JSONObject.cpp:
(JSC::Stringifier::Holder::hasFastObjectProperties const):
(JSC::Stringifier::appendStringifiedValue):
(JSC::Stringifier::Holder::Holder):
(JSC::Stringifier::Holder::appendNextProperty):
* runtime/ObjectConstructorInlines.h:
(JSC::canPerformFastPropertyEnumerationForJSONStringify):
Source/WebCore:
* Modules/webaudio/AudioWorkletProcessor.cpp:
(WebCore::AudioWorkletProcessor::buildJSArguments):
* Modules/webaudio/AudioWorkletProcessor.h:
Source/WebKitLegacy/mac:
* Plugins/Hosted/NetscapePluginInstanceProxy.h:
* Plugins/Hosted/NetscapePluginInstanceProxy.mm:
(WebKit::NetscapePluginInstanceProxy::demarshalValues):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@282707 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-09-17 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Add fast property enumeration mode for JSON.stringify
https://bugs.webkit.org/show_bug.cgi?id=230393
Reviewed by Mark Lam.
* stress/json-stringify-object-modify.js: Added.
(shouldBe):
(throw.new.Error.let.object.hello.get inner):
(throw.new.Error):
(shouldBe.let.object.hello.get inner):
2021-09-16 Russell Epstein <repstein@apple.com>
Cherry-pick r282239. rdar://problem/83183776
[JSC] Optimize op_get_property_enumerator further
https://bugs.webkit.org/show_bug.cgi?id=230086
Reviewed by Saam Barati.
JSTests:
* stress/for-in-cell-other.js: Added.
(shouldBe):
(forIn):
* stress/for-in-null-undefined.js: Added.
(shouldBe):
(forIn):
Source/JavaScriptCore:
1. This patch adds fast path of op_get_property_enumerator to LLInt and Baseline. Previously, we only had this fast path in DFG and FTL.
2. From the profiled data, Speedometer2/React-Redux-TodoMVC has GetPropertyEnumerator(CellOrOther). However, DFG and FTL only optimized
GetPropertyEnumerator(Cell). We add CellOrOther and Other cases: if the argument is Other, then we can constant fold it to the
empty enumerator. If the argument is CellOrOther, we can check first, and return empty enumerator for Other case.
3. This patch also cleans up StructureRareData lookup by introducing StructureType to JSType.
----------------------------------------------------------------------------------------------------------------------------------
| subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) |
----------------------------------------------------------------------------------------------------------------------------------
| Elm-TodoMVC |117.388333 |117.680000 |1.002485 | 0.269607 |
| VueJS-TodoMVC |24.918333 |24.651667 |0.989298 | 0.157665 |
| EmberJS-TodoMVC |126.430000 |126.296667 |0.998945 | 0.673803 |
| BackboneJS-TodoMVC |48.695000 |48.411667 |0.994181 | 0.019164 |
| Preact-TodoMVC |17.268333 |17.511667 |1.014091 | 0.199775 |
| AngularJS-TodoMVC |130.246667 |129.850000 |0.996954 | 0.261543 |
| Vanilla-ES2015-TodoMVC |63.626667 |63.611667 |0.999764 | 0.912112 |
| Inferno-TodoMVC |63.881667 |63.600000 |0.995591 | 0.385440 |
| Flight-TodoMVC |78.158333 |78.606667 |1.005736 | 0.284177 |
| Angular2-TypeScript-TodoMVC |39.448333 |39.411667 |0.999071 | 0.890825 |
| VanillaJS-TodoMVC |50.858333 |51.130000 |1.005342 | 0.195409 |
| jQuery-TodoMVC |225.318333 |226.256667 |1.004164 | 0.011190 |
| EmberJS-Debug-TodoMVC |340.150000 |338.450000 |0.995002 | 0.000063 (significant) |
| React-TodoMVC |85.703333 |85.606667 |0.998872 | 0.549298 |
| React-Redux-TodoMVC |141.985000 |140.418333 |0.988966 | 0.000000 (significant) |
| Vanilla-ES2015-Babel-Webpack-TodoMVC |61.505000 |61.705000 |1.003252 | 0.079817 |
----------------------------------------------------------------------------------------------------------------------------------
a mean = 260.98021
b mean = 261.16020
pValue = 0.4985041089
(Bigger means are better.)
1.001 times better
Results ARE NOT significant
* bytecode/SpeculatedType.cpp:
(JSC::dumpSpeculation):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetPropertyEnumerator):
(JSC::DFG::SpeculativeJIT::compileObjectKeysOrObjectGetOwnPropertyNames):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileObjectKeysOrObjectGetOwnPropertyNames):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::branchIfStructure):
(JSC::AssemblyHelpers::branchIfNotStructure):
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
* jit/JIT.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_property_enumerator):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_get_property_enumerator):
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/BrandedStructure.cpp:
(JSC::BrandedStructure::create):
* runtime/JSType.cpp:
(WTF::printInternal):
* runtime/JSType.h:
* runtime/Structure.cpp:
(JSC::Structure::Structure):
(JSC::Structure::create):
* runtime/Structure.h:
(JSC::Structure::isRareData):
(JSC::Structure::isRareData const): Deleted.
* runtime/StructureInlines.h:
(JSC::Structure::create):
(JSC::Structure::createStructure):
* runtime/StructureRareData.h:
* runtime/VM.cpp:
(JSC::VM::VM):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@282239 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-09-09 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Optimize op_get_property_enumerator further
https://bugs.webkit.org/show_bug.cgi?id=230086
Reviewed by Saam Barati.
* stress/for-in-cell-other.js: Added.
(shouldBe):
(forIn):
* stress/for-in-null-undefined.js: Added.
(shouldBe):
(forIn):
2021-09-16 Russell Epstein <repstein@apple.com>
Cherry-pick r282468. rdar://problem/83183967
[JSC] Optimize leaf object creation in JSON.parse
https://bugs.webkit.org/show_bug.cgi?id=230298
Reviewed by Keith Miller.
JSTests:
* microbenchmarks/json-parse-leaf-object.js: Added.
Source/JavaScriptCore:
This patch optimizes JSON.parse.
1. Use table in isJSONWhiteSpace.
2. Extract primitive value creation as parsePrimitiveValue function to use it in different place.
3. Add leaf-object creation fast path. Previously, when creating a leaf-object from JSON.parse we
are too generic and jumping around the code. Instead we add a fast path that does not perform
unnecessary operations and code gets tight.
It offers 3-4% improvement in microbenchmarks.
ToT Patched
vanilla-es2015-babel-webpack-todomvc-json-parse
104.7169+-0.1113 ^ 101.4836+-0.2168 ^ definitely 1.0319x faster
flight-todomvc-json-parse 53.9074+-0.0957 ^ 52.1347+-0.0802 ^ definitely 1.0340x faster
vanilla-es2015-todomvc-json-parse 104.9373+-0.1631 ^ 101.4978+-0.1073 ^ definitely 1.0339x faster
vanilla-todomvc-json-parse 79.1330+-0.0963 ^ 76.7568+-0.1606 ^ definitely 1.0310x faster
This offers 0.2% improvement in Speedometer2.
----------------------------------------------------------------------------------------------------------------------------------
| subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) |
----------------------------------------------------------------------------------------------------------------------------------
| Elm-TodoMVC |116.860000 |116.825000 |0.999700 | 0.901070 |
| VueJS-TodoMVC |24.658333 |24.763333 |1.004258 | 0.571728 |
| EmberJS-TodoMVC |126.666667 |126.335000 |0.997382 | 0.289517 |
| BackboneJS-TodoMVC |48.435000 |48.523333 |1.001824 | 0.455638 |
| Preact-TodoMVC |17.585000 |17.368333 |0.987679 | 0.247658 |
| AngularJS-TodoMVC |129.576667 |129.398333 |0.998624 | 0.625634 |
| Vanilla-ES2015-TodoMVC |62.746667 |62.241667 |0.991952 | 0.000019 (significant) |
| Inferno-TodoMVC |63.741667 |63.495000 |0.996130 | 0.448861 |
| Flight-TodoMVC |78.021667 |77.306667 |0.990836 | 0.087137 |
| Angular2-TypeScript-TodoMVC |39.823333 |39.923333 |1.002511 | 0.736279 |
| VanillaJS-TodoMVC |50.073333 |49.791667 |0.994375 | 0.136495 |
| jQuery-TodoMVC |221.300000 |221.586667 |1.001295 | 0.418008 |
| EmberJS-Debug-TodoMVC |340.145000 |339.965000 |0.999471 | 0.691490 |
| React-TodoMVC |85.698333 |85.650000 |0.999436 | 0.761586 |
| React-Redux-TodoMVC |140.510000 |140.785000 |1.001957 | 0.285922 |
| Vanilla-ES2015-Babel-Webpack-TodoMVC |60.928333 |60.500000 |0.992970 | 0.000069 (significant) |
----------------------------------------------------------------------------------------------------------------------------------
a mean = 262.15844
b mean = 262.72261
pValue = 0.0428052487
(Bigger means are better.)
1.002 times better
Results ARE significant
* runtime/LiteralParser.cpp:
(JSC::LiteralParser<CharType>::makeIdentifier):
(JSC::isJSONWhiteSpace):
(JSC::LiteralParser<CharType>::Lexer::lex):
(JSC::LiteralParser<CharType>::parsePrimitiveValue):
(JSC::LiteralParser<CharType>::parse):
* runtime/LiteralParser.h:
LayoutTests:
* js/dom/JSON-parse-expected.txt:
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@282468 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-09-15 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Optimize leaf object creation in JSON.parse
https://bugs.webkit.org/show_bug.cgi?id=230298
Reviewed by Keith Miller.
* microbenchmarks/json-parse-leaf-object.js: Added.
2021-09-08 Alan Coon <alancoon@apple.com>
Cherry-pick r282042. rdar://problem/82877251
[JSC] Make EnumeratorNextUpdateIndexAndMode clobberizing rule precise
https://bugs.webkit.org/show_bug.cgi?id=229898
rdar://82714439
Reviewed by Saam Barati.
JSTests:
* complex.yaml:
* complex/for-in-clobberize.js: Added.
Source/JavaScriptCore:
Clobberizing rule and AI does not match for EnumeratorNextUpdateIndexAndMode node.
We fix both cases: isSaneChain is not related to this node. So we should use isInBounds
as we are doing for HasIndexedProperty node.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@282042 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-09-03 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Make EnumeratorNextUpdateIndexAndMode clobberizing rule precise
https://bugs.webkit.org/show_bug.cgi?id=229898
rdar://82714439
Reviewed by Saam Barati.
* complex.yaml:
* complex/for-in-clobberize.js: Added.
2021-09-08 Alan Coon <alancoon@apple.com>
Cherry-pick r282014. rdar://problem/82877307
[JSC] Validate JSPropertyNameEnumerator via watchpoints
https://bugs.webkit.org/show_bug.cgi?id=229846
Reviewed by Keith Miller.
JSTests:
* stress/for-in-cacheable-dictionary.js: Added.
(shouldBe):
(collect):
* stress/for-in-invalidate.js: Added.
(shouldBe):
(collect):
* stress/for-in-uncacheable-dictionary.js: Added.
(shouldBe):
(collect):
Source/JavaScriptCore:
Looked into Elm-TodoMVC sampling profiler data and found that op_get_property_enumerator is taking enough amount of time.
And Instruments say validating JSPropertyNameEnumerator via traversing StructureChain is costly.
We are caching JSPropertyNameEnumerator only when we meet the condition: objects in prototype chain can ensure identity of
property names if structure is not changed. So we can use watchpoint based approach to invalidate JSPropertyNameEnumerator.
This patch injects structure transition watchpoints if possible. And when watchpoint is fired, we invalidate JSPropertyNameEnumerator
cached in StructureRareData, as if we are ensuring prototype chain condition for the other property accesses.
This offers 0.6% improvement in Speedometer2.
----------------------------------------------------------------------------------------------------------------------------------
| subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) |
----------------------------------------------------------------------------------------------------------------------------------
| Elm-TodoMVC |121.971667 |117.725000 |0.965183 | 0.000000 (significant) |
| VueJS-TodoMVC |26.246667 |26.035000 |0.991935 | 0.360614 |
| EmberJS-TodoMVC |126.196667 |126.653333 |1.003619 | 0.103138 |
| BackboneJS-TodoMVC |48.976667 |48.881667 |0.998060 | 0.474106 |
| Preact-TodoMVC |20.118333 |20.115000 |0.999834 | 0.989038 |
| AngularJS-TodoMVC |131.545000 |130.706667 |0.993627 | 0.015344 (significant) |
| Vanilla-ES2015-TodoMVC |63.725000 |63.773333 |1.000758 | 0.706560 |
| Inferno-TodoMVC |64.231667 |62.653333 |0.975427 | 0.000000 (significant) |
| Flight-TodoMVC |77.223333 |77.690000 |1.006043 | 0.268309 |
| Angular2-TypeScript-TodoMVC |39.686667 |39.500000 |0.995296 | 0.499678 |
| VanillaJS-TodoMVC |52.321667 |51.973333 |0.993342 | 0.077777 |
| jQuery-TodoMVC |224.908333 |225.761667 |1.003794 | 0.022136 |
| EmberJS-Debug-TodoMVC |339.858333 |339.886667 |1.000083 | 0.950320 |
| React-TodoMVC |86.545000 |86.070000 |0.994512 | 0.001518 (significant) |
| React-Redux-TodoMVC |146.010000 |142.855000 |0.978392 | 0.000000 (significant) |
| Vanilla-ES2015-Babel-Webpack-TodoMVC |61.411667 |61.456667 |1.000733 | 0.631499 |
----------------------------------------------------------------------------------------------------------------------------------
a mean = 255.96543
b mean = 257.53379
pValue = 0.0000034394
(Bigger means are better.)
1.006 times better
Results ARE significant
* bytecode/Watchpoint.cpp:
* bytecode/Watchpoint.h:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetPropertyEnumerator):
* ftl/FTLAbstractHeapRepository.h:
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* runtime/JSPropertyNameEnumerator.h:
(JSC::propertyNameEnumerator):
* runtime/StructureRareData.h:
* runtime/StructureRareDataInlines.h:
(JSC::StructureRareData::setCachedPropertyNameEnumerator):
(JSC::StructureChainInvalidationWatchpoint::install):
(JSC::StructureChainInvalidationWatchpoint::fireInternal):
(JSC::StructureRareData::tryCachePropertyNameEnumeratorViaWatchpoint):
(JSC::StructureRareData::invalidateWatchpointBasedValidation):
* tools/JSDollarVM.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::JSDollarVM::finishCreation):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@282014 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-09-02 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Validate JSPropertyNameEnumerator via watchpoints
https://bugs.webkit.org/show_bug.cgi?id=229846
Reviewed by Keith Miller.
* stress/for-in-cacheable-dictionary.js: Added.
(shouldBe):
(collect):
* stress/for-in-invalidate.js: Added.
(shouldBe):
(collect):
* stress/for-in-uncacheable-dictionary.js: Added.
(shouldBe):
(collect):
2021-09-01 Russell Epstein <repstein@apple.com>
Cherry-pick r281684. rdar://problem/82651474
[JSC] op_put_private_name should use modern IC and remove ByValInfo
https://bugs.webkit.org/show_bug.cgi?id=229544
Reviewed by Saam Barati.
JSTests:
Move class-fields-private benchmarks into microbenchmarks.
Added several microbenchmarks and stress tests.
* microbenchmarks/class-private-field-polymorphic.js: Added.
(shouldBe):
(test.A.prototype.put):
* microbenchmarks/get-private-name.js: Renamed from JSTests/microbenchmarks/class-fields-private/get-private-name.js.
* microbenchmarks/monomorphic-get-private-field.js: Renamed from JSTests/microbenchmarks/class-fields-private/monomorphic-get-private-field.js.
* microbenchmarks/polymorphic-get-private-field.js: Renamed from JSTests/microbenchmarks/class-fields-private/polymorphic-get-private-field.js.
* microbenchmarks/polymorphic-put-private-field.js: Renamed from JSTests/microbenchmarks/class-fields-private/polymorphic-put-private-field.js.
* microbenchmarks/put-by-val-polymorphic-properties.js: Added.
(shouldBe):
(test):
* microbenchmarks/put-private-field.js: Renamed from JSTests/microbenchmarks/class-fields-private/put-private-field.js.
* stress/class-private-field-megamorphic.js: Added.
(shouldBe):
* stress/class-private-field-polymorphic.js: Added.
(shouldBe):
(test.A.prototype.put):
* stress/put-by-val-polymorphic-properties.js: Added.
(shouldBe):
(test):
Source/JavaScriptCore:
This patch makes op_put_private_name use new PutByVal IC. This allows op_put_private_name to support
polymorphic properties, and we can finally remove Baseline's adhoc IC and ByValInfo completely.
Added microbenchmark showed 3x improvement due to polymorphic PutPrivateName IC.
ToT Patched
class-private-field-polymorphic 9.3666+-0.0332 ^ 3.1199+-0.0182 ^ definitely 3.0022x faster
* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* bytecode/ByValInfo.cpp: Removed.
* bytecode/ByValInfo.h: Removed.
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::getICStatusMap):
(JSC::CodeBlock::stronglyVisitStrongReferences):
(JSC::CodeBlock::findByValInfo): Deleted.
(JSC::CodeBlock::addByValInfo): Deleted.
* bytecode/CodeBlock.h:
* bytecode/ICStatusMap.h:
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetPrivateName):
(JSC::DFG::SpeculativeJIT::compilePutPrivateName):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStoreBarrierInsertionPhase.cpp:
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName):
* jit/JIT.cpp:
(JSC::JIT::privateCompileSlowCases):
(JSC::JIT::link):
(JSC::JIT::privateCompileExceptionHandlers):
* jit/JIT.h:
(JSC::ByValCompilationInfo::ByValCompilationInfo): Deleted.
* jit/JITInlines.h:
(JSC::JIT::emitArrayProfileStoreToHoleSpecialCase): Deleted.
(JSC::JIT::emitArrayProfileOutOfBoundsSpecialCase): Deleted.
* jit/JITOperations.cpp:
(JSC::putPrivateNameOptimize):
(JSC::putPrivateName):
(JSC::JSC_DEFINE_JIT_OPERATION):
* jit/JITOperations.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emitSlow_op_put_private_name):
(JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
(JSC::JIT::emitPutByValWithCachedId): Deleted.
(JSC::JIT::emitPutPrivateNameWithCachedId): Deleted.
(JSC::JIT::emitByValIdentifierCheck): Deleted.
(JSC::JIT::privateCompilePutPrivateNameWithCachedId): Deleted.
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emitSlow_op_put_private_name):
* jit/Repatch.cpp:
(JSC::appropriateGenericPutByFunction):
(JSC::appropriateOptimizingPutByFunction):
(JSC::resetPutBy):
Tools:
* Scripts/run-jsc-benchmarks:
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281684 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-08-26 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] op_put_private_name should use modern IC and remove ByValInfo
https://bugs.webkit.org/show_bug.cgi?id=229544
Reviewed by Saam Barati.
Move class-fields-private benchmarks into microbenchmarks.
Added several microbenchmarks and stress tests.
* microbenchmarks/class-private-field-polymorphic.js: Added.
(shouldBe):
(test.A.prototype.put):
* microbenchmarks/get-private-name.js: Renamed from JSTests/microbenchmarks/class-fields-private/get-private-name.js.
* microbenchmarks/monomorphic-get-private-field.js: Renamed from JSTests/microbenchmarks/class-fields-private/monomorphic-get-private-field.js.
* microbenchmarks/polymorphic-get-private-field.js: Renamed from JSTests/microbenchmarks/class-fields-private/polymorphic-get-private-field.js.
* microbenchmarks/polymorphic-put-private-field.js: Renamed from JSTests/microbenchmarks/class-fields-private/polymorphic-put-private-field.js.
* microbenchmarks/put-by-val-polymorphic-properties.js: Added.
(shouldBe):
(test):
* microbenchmarks/put-private-field.js: Renamed from JSTests/microbenchmarks/class-fields-private/put-private-field.js.
* stress/class-private-field-megamorphic.js: Added.
(shouldBe):
* stress/class-private-field-polymorphic.js: Added.
(shouldBe):
(test.A.prototype.put):
* stress/put-by-val-polymorphic-properties.js: Added.
(shouldBe):
(test):
2021-08-30 Russell Epstein <repstein@apple.com>
Cherry-pick r281665. rdar://problem/82528295
r281485 was not sufficient in where it called disablePeepholeOptimization
https://bugs.webkit.org/show_bug.cgi?id=229582
<rdar://82346980>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/for-in-disable-bytecode-generator-peephole-optimizations-after-rewrite-2.js: Added.
(foo):
Source/JavaScriptCore:
r281485 accidentally deleted a place where we called disablePeepholeOptimization
that was necessary. Basically, after we seek where the current instruction
in BytecodeGenerator is, we need to disablePeepholeOptimization.
* bytecompiler/BytecodeGenerator.cpp:
(JSC::ForInContext::finalize):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281665 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-08-26 Saam Barati <sbarati@apple.com>
r281485 was not sufficient in where it called disablePeepholeOptimization
https://bugs.webkit.org/show_bug.cgi?id=229582
<rdar://82346980>
Reviewed by Yusuke Suzuki.
* stress/for-in-disable-bytecode-generator-peephole-optimizations-after-rewrite-2.js: Added.
(foo):
2021-08-30 Russell Epstein <repstein@apple.com>
Cherry-pick r281485. rdar://problem/82535418
Disable peephole optimizations in the byte code generator after rewriting instructions for for-in
https://bugs.webkit.org/show_bug.cgi?id=229420
<rdar://82020528>
Reviewed by Keith Miller.
JSTests:
* stress/for-in-disable-bytecode-generator-peephole-optimizations-after-rewrite.js: Added.
(foo):
Source/JavaScriptCore:
The final instruction in a for-in loop might be the get by val that
we're rewriting because there was an escape. We won't ever actually
do peephole optimizations on this get_by_val today, but it breaks
some bookkeeping that the bytecode generator does. This patch makes
sure the bookkeeping is up to date.
* bytecompiler/BytecodeGenerator.cpp:
(JSC::ForInContext::finalize):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281485 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-08-23 Saam Barati <sbarati@apple.com>
Disable peephole optimizations in the byte code generator after rewriting instructions for for-in
https://bugs.webkit.org/show_bug.cgi?id=229420
<rdar://82020528>
Reviewed by Keith Miller.
* stress/for-in-disable-bytecode-generator-peephole-optimizations-after-rewrite.js: Added.
(foo):
2021-08-25 Alan Coon <alancoon@apple.com>
Cherry-pick r281500. rdar://problem/82350929
(r281473) stress/for-in-has-own-property-shouldnt-flush-registers.js failing on Debug
https://bugs.webkit.org/show_bug.cgi?id=229448
Reviewed by Mark Lam.
JSTests:
Fix typo in test name.
* stress/for-in-in-by-val-should-flush-registers.js: Renamed from JSTests/stress/for-in-in-by-val-shouldnt-flush-registers.js.
Source/JavaScriptCore:
Add missing exception checks.
* dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281500 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-08-24 Keith Miller <keith_miller@apple.com>
(r281473) stress/for-in-has-own-property-shouldnt-flush-registers.js failing on Debug
https://bugs.webkit.org/show_bug.cgi?id=229448
Reviewed by Mark Lam.
Fix typo in test name.
* stress/for-in-in-by-val-should-flush-registers.js: Renamed from JSTests/stress/for-in-in-by-val-shouldnt-flush-registers.js.
2021-08-23 Alan Coon <alancoon@apple.com>
Cherry-pick r281473. rdar://problem/82262986
compileEnumeratorHasProperty uses flushRegisters incorrectly
https://bugs.webkit.org/show_bug.cgi?id=229412
<rdar://82020767>
Reviewed by Keith Miller.
JSTests:
* stress/for-in-has-own-property-shouldnt-flush-registers.js: Added.
(foo):
* stress/for-in-in-by-val-shouldnt-flush-registers.js: Added.
(a.toString):
Source/JavaScriptCore:
We were calling flushRegisters() inside code that isn't always runs inside the
EnumeratorInByVal/EnumeratorHasOwnProperty nodes. That is a violation of how
flushRegisters() must be used, since flushRegisters() updates global register
allocation state, and therefore must run each time a node is run. To fix, we
move flushRegisters() before the code starts emitting branches.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileEnumeratorHasProperty):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281473 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-08-23 Saam Barati <sbarati@apple.com>
compileEnumeratorHasProperty uses flushRegisters incorrectly
https://bugs.webkit.org/show_bug.cgi?id=229412
<rdar://82020767>
Reviewed by Keith Miller.
* stress/for-in-has-own-property-shouldnt-flush-registers.js: Added.
(foo):
* stress/for-in-in-by-val-shouldnt-flush-registers.js: Added.
(a.toString):
2021-08-17 Mikhail R. Gadelha <mikhail@igalia.com>
Unreviewed. Skip failing MIPS tests
https://bugs.webkit.org/show_bug.cgi?id=229198
* ChakraCore.yaml:
2021-08-13 Keith Miller <keith_miller@apple.com>
EnumeratorNextUpdatePropertyName always needs to be able to handle IndexedMode
https://bugs.webkit.org/show_bug.cgi?id=229087
Reviewed by Filip Pizlo.
* stress/for-in-own-structure-and-generic-with-late-add-indexed.js: Added.
(test):
(Foo):
2021-08-11 Yusuke Suzuki <ysuzuki@apple.com>
WTFCrash in JSC::Lexer<char16_t>::append8
https://bugs.webkit.org/show_bug.cgi?id=228982
Reviewed by Mark Lam.
* stress/directive-includes-non-latin1.js: Added.
2021-08-09 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] super-Latin1 white space and line terminator after regular expression literal misinterpreted as flags
https://bugs.webkit.org/show_bug.cgi?id=227944
Reviewed by Alexey Shvayka.
* test262/expectations.yaml:
2021-08-08 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Clean up test262 expectations
https://bugs.webkit.org/show_bug.cgi?id=228903
Reviewed by Ross Kirsling.
* test262/config.yaml:
* test262/expectations.yaml:
2021-08-07 Keith Miller <keith_miller@apple.com>
for-in should only emit one loop in bytecode
https://bugs.webkit.org/show_bug.cgi?id=227989
Reviewed by Yusuke Suzuki.
* microbenchmarks/for-in-double-array-with-own-named.js: Added.
(test):
* microbenchmarks/for-in-double-array.js: Added.
(test):
* microbenchmarks/for-in-getters.js: Added.
(test):
* microbenchmarks/for-in-int32-array-with-own-named.js: Added.
(test):
* microbenchmarks/for-in-int32-array.js: Added.
(test):
* microbenchmarks/for-in-int32-object-with-own-named-and-getters.js: Added.
(test):
* microbenchmarks/for-in-int32-object-with-own-named.js: Added.
(test):
* microbenchmarks/for-in-object-with-own-named.js: Added.
(sum):
(opaqueSet):
* microbenchmarks/for-in-string-array.js: Added.
(test):
* microbenchmarks/for-of-iterate-array-map-set.js: Added.
(sum):
(let.generator):
* stress/for-in-array-mode.js:
(test):
* stress/for-in-base-reassigned-later.js:
* stress/for-in-delete-during-iteration.js:
* stress/for-in-primitive-index-on-prototype.js: Added.
(test):
* stress/for-in-tests.js:
* stress/has-own-property-structure-for-in-loop-correctness.js:
(test5):
2021-08-05 Mikhail R. Gadelha <mikhail@igalia.com>
Assertion failure when checking array in DFG (32 bits)
https://bugs.webkit.org/show_bug.cgi?id=228839
Reviewed by Yusuke Suzuki.
* stress/check-array-empty-32.js: Added.
(a.b.catch.print.c):
(a.b):
(a.e):
(a):
2021-08-02 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Yarr BoyerMoore search should support character-class
https://bugs.webkit.org/show_bug.cgi?id=228613
Reviewed by Saam Barati.
* stress/regexp-bm-search-character-non-fixed-size.js: Added.
(shouldBe):
* stress/regexp-bm-search-many-candidate-zero-length.js: Added.
(shouldBe):
(regexp.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.0.1.2.3.4.5.6.7.8.9.t.v.n.r):
* stress/regexp-bm-search-non-fixed-size.js: Added.
(shouldBe):
2021-08-02 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Update test262
https://bugs.webkit.org/show_bug.cgi?id=228709
Reviewed by Mark Lam.
* test262/latest-changes-summary.txt:
* test262/test/built-ins/Error/prototype/constructor/S15.11.4.1_A1_T1.js: Removed.
* test262/test/built-ins/Error/prototype/message/15.11.4.3-1.js: Removed.
* test262/test/built-ins/Error/prototype/message/S15.11.4.3_A1.js: Removed.
* test262/test/built-ins/Error/prototype/message/S15.11.4.3_A2.js: Removed.
* test262/test/built-ins/Error/prototype/name/15.11.4.2-1.js: Removed.
* test262/test/built-ins/Error/prototype/name/S15.11.4.2_A1.js: Removed.
* test262/test/built-ins/Error/prototype/name/S15.11.4.2_A2.js: Removed.
* test262/test/built-ins/Error/prototype/toString/S15.11.4.4_A1.js: Removed.
* test262/test/built-ins/TypedArray/prototype/findLast/return-abrupt-from-this-out-of-bounds.js:
* test262/test/built-ins/TypedArray/prototype/findLastIndex/return-abrupt-from-this-out-of-bounds.js:
* test262/test/harness/sta-error.js: Removed.
* test262/test/harness/sta-override-error.js: Removed.
* test262/test262-Revision.txt:
2021-07-29 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Upgrade test262
https://bugs.webkit.org/show_bug.cgi?id=228627
Reviewed by Ross Kirsling.
2021-07-30 Robin Morisset <rmorisset@apple.com>
Improve OSR entry into Wasm loops with arguments
https://bugs.webkit.org/show_bug.cgi?id=228595
Reviewed by Yusuke Suzuki.
Just a straightforward test that counts to 1M in a loop, to exercise both OSR entry and a loop with an argument at the same time.
100k iterations was not enough to reliably complete an OSR entry.
* wasm/stress/osr-entry-with-loop-arguments.js: Added.
(async test):
2021-07-30 Tadeu Zagallo <tzagallo@apple.com>
putInlineFastReplacingStaticPropertyIfNeeded should handle custom values
https://bugs.webkit.org/show_bug.cgi?id=227963
Reviewed by Alexey Shvayka.
* stress/reflect-set-custom-value.js:
2021-07-29 Tadeu Zagallo <tzagallo@apple.com>
definePropertyOnReceiver should check if receiver canPerformFastPutInline
https://bugs.webkit.org/show_bug.cgi?id=227963
<rdar://80259710>
Reviewed by Alexey Shvayka.
* stress/reflect-set-custom-value.js: Added.
2021-07-29 Yusuke Suzuki <ysuzuki@apple.com> and Alexey Shvayka <shvaikalesh@gmail.com>
[JSC] Legacy RegExp fields should be accessors
https://bugs.webkit.org/show_bug.cgi?id=220233
Reviewed by Tadeu Zagallo.
* ChakraCore/test/Lib/forin_lib_v3.baseline-jsc:
* microbenchmarks/assign-custom-setter-polymorphic.js:
* microbenchmarks/assign-custom-setter.js:
* microbenchmarks/custom-setter-getter-as-put-get-by-id.js:
* microbenchmarks/custom-value-2.js:
* microbenchmarks/custom-value.js:
* microbenchmarks/get-custom-getter.js:
* stress/custom-value-delete-property-1.js:
* stress/custom-value-delete-property-2.js:
* stress/custom-value-delete-property-3.js:
* stress/object-assign-fast-path.js:
* stress/reflect-set.js:
* stress/regexp-constructor-dollar-getters-are-unique.js: Added.
* stress/regexp-setter-realm.js: Added.
* stress/static-put-in-prototype-chain.js: Added.
* test262/config.yaml:
* test262/expectations.yaml:
2021-07-28 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Yarr should perform BoyerMoore search
https://bugs.webkit.org/show_bug.cgi?id=228301
Reviewed by Saam Barati.
* microbenchmarks/jquery-todomvc-regexp.js:
* stress/regexp--bm-search-long-character.js: Added.
(shouldBe):
* stress/regexp--bm-search-long-map.js: Added.
(shouldBe):
* stress/regexp-bitvector-reuse.js: Added.
(shouldBe):
* stress/regexp-non-ascii-bm-search-character.js: Added.
(shouldBe):
* stress/regexp-non-ascii-bm-search-map.js: Added.
(shouldBe):
2021-07-25 Alexey Shvayka <shvaikalesh@gmail.com>
Partly implement Function.prototype.{caller,arguments} reflection proposal
https://bugs.webkit.org/show_bug.cgi?id=158116
Reviewed by Yusuke Suzuki.
* ChakraCore/test/strict/19.function.baseline:
* ChakraCore/test/strict/22.callerCalleeArguments.baseline-jsc:
* microbenchmarks/function-prototype-get.js: Added.
* microbenchmarks/reflect-own-keys-function.js: Added.
* stress/for-in-shadow-non-enumerable.js:
* stress/function-hidden-as-caller.js:
* stress/has-own-property-arguments.js:
* stress/object-assign-fast-path.js:
* stress/put-to-proto-chain-overrides-put.js:
* stress/reflect-set.js:
* test262/config.yaml: Skip 3 test cases that are now incorrect.
* test262/expectations.yaml: Mark 2 test cases as passing.
2021-07-23 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Add Speedometer2 jQuery-TodoMVC RegExp microbenchmark
https://bugs.webkit.org/show_bug.cgi?id=228257
Reviewed by Mark Lam.
I instrumented JSC and extracted executed RegExp evaluations from Speedometer2/jQuery-TodoMVC
to easily test RegExp performance.
* microbenchmarks/jquery-todomvc-regexp.js: Added.
(x00.test):
2021-07-23 Alexey Shvayka <shvaikalesh@gmail.com>
[JSC] Call custom accessors / values with their holder's global object
https://bugs.webkit.org/show_bug.cgi?id=225997
Reviewed by Yusuke Suzuki.
* stress/custom-get-set-proto-chain-put.js:
* stress/getter-setter-globalobject-in-ic-2.js: Added.
2021-07-22 Saam Barati <sbarati@apple.com>
JSTests/stress/test-out-of-memory shouldn't assume that we always OOM
https://bugs.webkit.org/show_bug.cgi?id=228213
Reviewed by Mark Lam.
* stress/test-out-of-memory.js:
2021-07-22 Yusuke Suzuki <ysuzuki@apple.com>
Reduce iteration of microbenchmarks/memcpy-typed-loop.js
https://bugs.webkit.org/show_bug.cgi?id=228214
Reviewed by Saam Barati.
Observing frequent timeout (e.g. https://ews-build.webkit.org/#/builders/1/builds/44698).
We do not need to have such a large # of iterations.
* microbenchmarks/memcpy-typed-loop.js:
2021-07-22 Saam Barati <sbarati@apple.com>
AirStackSlot's uint16_t byte size is too small
https://bugs.webkit.org/show_bug.cgi?id=228193
<rdar://80888059>
Reviewed by Mark Lam.
* stress/stack-slot-needs-to-use-more-than-uint16.js: Added.
2021-07-20 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] invalidParameterInstanceofSourceAppender should care direct call of Symbol.hasInstance
https://bugs.webkit.org/show_bug.cgi?id=228075
rdar://80762879
Reviewed by Frédéric Wang.
* stress/symbol-hasinstance-error.js: Added.
(shouldThrow):
(let.a):
2021-07-19 Mark Lam <mark.lam@apple.com>
DFG's parseIntResult() should check for negative zero.
https://bugs.webkit.org/show_bug.cgi?id=228068
rdar://80788603
Reviewed by Yusuke Suzuki.
* stress/dfg-parseIntResult-should-check-for-negative-zero.js: Added.
2021-07-19 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] InByStatus / InByVariant should visit CacheableIdentifier
https://bugs.webkit.org/show_bug.cgi?id=228088
rdar://80794604
Reviewed by Mark Lam.
* stress/in-by-variant-should-mark-cacheable-identifier.js: Added.
(foo):
(let.handler.has):
2021-07-16 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Simplify sampling-profiler-regexp.js test
https://bugs.webkit.org/show_bug.cgi?id=228040
Reviewed by Saam Barati.
In this new test case, only thing we care is regexp appears on sampling-profiler regardless of whether the other functions are inlined / tail-called or not.
We change the sampling-profiler/samplingProfiler.js runTest to add a mode which searches specific signature in the call tree.
* stress/sampling-profiler-regexp.js:
(platformSupportsSamplingProfiler):
* stress/sampling-profiler/samplingProfiler.js:
(doesTreeHaveStackTrace):
(runTest):
2021-07-16 Saam Barati <sbarati@apple.com>
Grab the lock in FTL::Thunks::keyForSlowPathCallThunk
https://bugs.webkit.org/show_bug.cgi?id=227988
<rdar://problem/80627901>
Reviewed by Mark Lam.
* stress/thunks-hash-map-should-grab-lock.js: Added.
2021-07-16 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] RegExp::dumpToStream must not ref Strings since it is called concurrently
https://bugs.webkit.org/show_bug.cgi?id=228031
rdar://80686425
Reviewed by Mark Lam.
* stress/regexp-dump-concurrently.js: Added.
(let.code):
2021-07-15 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] SamplingProfiler should recognize RegExp execution
https://bugs.webkit.org/show_bug.cgi?id=201702
Reviewed by Saam Barati.
* stress/sampling-profiler-regexp.js: Added.
(platformSupportsSamplingProfiler.getText):
(platformSupportsSamplingProfiler.test):
(platformSupportsSamplingProfiler.baz):
(platformSupportsSamplingProfiler):
* stress/sampling-profiler/samplingProfiler.js: Extend samplingProfiler to show better error information when VERBOSE = true.
(doesTreeHaveStackTrace):
2021-07-15 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Harden defaultTimeZone retrieval
https://bugs.webkit.org/show_bug.cgi?id=227996
Reviewed by Mark Lam.
* complex.yaml:
* complex/intl-timezone-check.js: Added.
(shouldBe):
2021-07-15 Mark Lam <mark.lam@apple.com>
JITWorklist::waitUntilAllPlansForVMAreReady() should also be notified when plans are cancelled.
https://bugs.webkit.org/show_bug.cgi?id=228003
rdar://78314543
Reviewed by Yusuke Suzuki.
* stress/waitUntilAllPlansForVMAreReady-should-be-notified-of-cancelled-plans-too.js: Added.
2021-07-14 Devin Rousso <drousso@apple.com>
Implement Array.prototype.findLast and Array.prototype.findLastIndex
https://bugs.webkit.org/show_bug.cgi?id=227939
Reviewed by Yusuke Suzuki.
* stress/typedarray-findLast.js: Added.
(keepEven):
(keepEvenAndChange):
(isBigEnoughAndException):
* stress/typedarray-findLastIndex.js: Added.
(keepEven):
(keepEvenAndChange):
(isBigEnoughAndException):
2021-07-14 Keith Miller <keith_miller@apple.com>
Unreviewed, test gardening.
* stress/bit-op-with-object-returning-int32.js:
* stress/bitwise-not-fixup-rules.js:
(jscOptions):
2021-07-14 Mark Lam <mark.lam@apple.com>
Check for out of memory in JSC::globalFuncEscape() and JSC::globalFuncUnescape().
https://bugs.webkit.org/show_bug.cgi?id=227962
rdar://78392251
Reviewed by Yusuke Suzuki.
* stress/out-of-memory-in-globalFuncUnescape.js: Added.
2021-07-14 Mark Lam <mark.lam@apple.com>
Placate exception checker validation in operationObjectAssignUntyped.
https://bugs.webkit.org/show_bug.cgi?id=227955
rdar://80503746
Reviewed by Michael Saboff.
* stress/exception-check-in-operationObjectAssignUntyped.js: Added.
2021-07-14 Keith Miller <keith_miller@apple.com>
Fix more tests around fuzzing executable allocations
https://bugs.webkit.org/show_bug.cgi?id=226663
Reviewed by Mark Lam.
* stress/bit-op-with-object-returning-int32.js:
(numberOfDFGCompiles): Deleted.
* stress/bitwise-not-fixup-rules.js:
(jscOptions):
(numberOfDFGCompiles): Deleted.
2021-07-12 Saam Barati <sbarati@apple.com>
Run some tests for fewer iterations to prevent test timeouts
https://bugs.webkit.org/show_bug.cgi?id=227879
Reviewed by Mark Lam.
* microbenchmarks/get-by-val-negative-array-index.js:
* microbenchmarks/memcpy-typed-loop-small.js:
* microbenchmarks/put-by-val-negative-array-index.js:
2021-07-12 Saam Barati <sbarati@apple.com>
stress/wasm-loop-consistency.js should require the --useExecutableAllocationFuzz=false JSC option
https://bugs.webkit.org/show_bug.cgi?id=227876
Reviewed by Mark Lam.
* stress/wasm-loop-consistency.js:
2021-07-10 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Update test262
https://bugs.webkit.org/show_bug.cgi?id=227851
Reviewed by Mark Lam.
* test262/config.yaml:
* test262/expectations.yaml:
* test262/harness/compareArray.js:
(assert.compareArray):
* test262/harness/regExpUtils.js:
(buildString):
(): Deleted.
* test262/harness/sta.js:
(Test262Error.thrower):
* test262/harness/testIntl.js:
(getLocaleSupportInfo):
* test262/latest-changes-summary.txt:
* test262/test/annexB/language/literals/regexp/legacy-octal-escape.js:
* test262/test/built-ins/ArrayBuffer/options-maxbytelength-diminuitive.js: Added.
* test262/test/built-ins/ArrayBuffer/options-maxbytelength-excessive.js: Added.
* test262/test/built-ins/ArrayBuffer/options-maxbytelength-negative.js: Added.
* test262/test/built-ins/ArrayBuffer/options-maxbytelength-object.js: Added.
(options.maxByteLength.toString):
(options.maxByteLength.valueOf):
* test262/test/built-ins/ArrayBuffer/options-maxbytelength-poisoned.js: Added.
(options.get maxByteLength):
* test262/test/built-ins/ArrayBuffer/options-maxbytelength-undefined.js: Added.
* test262/test/built-ins/ArrayBuffer/options-non-object.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/maxByteLength/detached-buffer.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/maxByteLength/invoked-as-accessor.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/maxByteLength/invoked-as-func.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/maxByteLength/length.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/maxByteLength/name.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/maxByteLength/prop-desc.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/maxByteLength/return-maxbytelength-non-resizable.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/maxByteLength/return-maxbytelength-resizable.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/maxByteLength/this-has-no-arraybufferdata-internal.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/maxByteLength/this-is-not-object.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/maxByteLength/this-is-sharedarraybuffer.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resizable/detached-buffer.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resizable/invoked-as-accessor.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resizable/invoked-as-func.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resizable/length.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resizable/name.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resizable/prop-desc.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resizable/return-resizable.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resizable/this-has-no-arraybufferdata-internal.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resizable/this-is-not-object.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resizable/this-is-sharedarraybuffer.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resize/descriptor.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resize/extensible.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resize/length.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resize/name.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resize/new-length-excessive.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resize/new-length-negative.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resize/new-length-non-number.js: Added.
(newLength.toString):
(newLength.valueOf):
* test262/test/built-ins/ArrayBuffer/prototype/resize/nonconstructor.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resize/resize-grow.js: Added.
(catch):
* test262/test/built-ins/ArrayBuffer/prototype/resize/resize-same-size-zero-explicit.js: Added.
(catch):
* test262/test/built-ins/ArrayBuffer/prototype/resize/resize-same-size-zero-implicit.js: Added.
(catch):
* test262/test/built-ins/ArrayBuffer/prototype/resize/resize-same-size.js: Added.
(catch):
* test262/test/built-ins/ArrayBuffer/prototype/resize/resize-shrink-zero-explicit.js: Added.
(catch):
* test262/test/built-ins/ArrayBuffer/prototype/resize/resize-shrink-zero-implicit.js: Added.
(catch):
* test262/test/built-ins/ArrayBuffer/prototype/resize/resize-shrink.js: Added.
(catch):
* test262/test/built-ins/ArrayBuffer/prototype/resize/this-is-detached.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resize/this-is-not-arraybuffer-object.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resize/this-is-not-object.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resize/this-is-not-resizable-arraybuffer-object.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/resize/this-is-sharedarraybuffer.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/descriptor.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/extensible.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-larger.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-same.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-smaller.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-zero.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/from-resizable-to-larger.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/from-resizable-to-same.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/from-resizable-to-smaller.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/from-resizable-to-zero.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/length.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/name.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/new-length-excessive.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/new-length-non-number.js: Added.
(newLength.toString):
(newLength.valueOf):
* test262/test/built-ins/ArrayBuffer/prototype/transfer/nonconstructor.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/this-is-detached.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/this-is-not-arraybuffer-object.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/this-is-not-object.js: Added.
* test262/test/built-ins/ArrayBuffer/prototype/transfer/this-is-sharedarraybuffer.js: Added.
* test262/test/built-ins/DataView/prototype/byteLength/resizable-array-buffer-auto.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/byteLength/resizable-array-buffer-fixed.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/byteOffset/resizable-array-buffer-auto.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/byteOffset/resizable-array-buffer-fixed.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/getBigInt64/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/getBigUint64/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/getFloat32/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/getFloat64/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/getInt16/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/getInt32/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/getInt8/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/getUint16/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/getUint32/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/getUint8/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/setBigInt64/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/setBigUint64/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/setFloat32/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/setFloat64/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/setInt16/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/setInt32/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/setInt8/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/setUint16/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/setUint32/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/DataView/prototype/setUint8/resizable-buffer.js: Added.
(catch):
* test262/test/built-ins/Error/cause_abrupt.js:
(has):
(options.get cause):
* test262/test/built-ins/Object/hasOwn/descriptor.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_exists.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_getter.js: Added.
(base.get foo):
* test262/test/built-ins/Object/hasOwn/hasown_inherited_getter_and_setter.js: Added.
(base.get foo):
(base.set foo):
* test262/test/built-ins/Object/hasOwn/hasown_inherited_getter_and_setter_configurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_getter_and_setter_configurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_getter_and_setter_nonconfigurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_getter_and_setter_nonconfigurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_getter_configurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_getter_configurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_getter_nonconfigurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_getter_nonconfigurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_nonwritable_configurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_nonwritable_configurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_nonwritable_nonconfigurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_nonwritable_nonconfigurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_setter.js: Added.
(base.set foo):
* test262/test/built-ins/Object/hasOwn/hasown_inherited_setter_configurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_setter_configurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_setter_nonconfigurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_setter_nonconfigurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_writable_configurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_writable_configurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_writable_nonconfigurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_inherited_writable_nonconfigurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_nonexistent.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_getter.js: Added.
(o.get foo):
* test262/test/built-ins/Object/hasOwn/hasown_own_getter_and_setter.js: Added.
(o.get foo):
(o.set foo):
* test262/test/built-ins/Object/hasOwn/hasown_own_getter_and_setter_configurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_getter_and_setter_configurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_getter_and_setter_nonconfigurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_getter_and_setter_nonconfigurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_getter_configurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_getter_configurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_getter_nonconfigurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_getter_nonconfigurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_nonwritable_configurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_nonwritable_nonconfigurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_nonwriteable_configurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_nonwriteable_nonconfigurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_property_exists.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_setter.js: Added.
(o.set foo):
* test262/test/built-ins/Object/hasOwn/hasown_own_setter_configurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_setter_configurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_setter_nonconfigurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_setter_nonconfigurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_writable_configurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_writable_configurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_writable_nonconfigurable_enumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/hasown_own_writable_nonconfigurable_nonenumerable.js: Added.
* test262/test/built-ins/Object/hasOwn/length.js: Added.
* test262/test/built-ins/Object/hasOwn/name.js: Added.
* test262/test/built-ins/Object/hasOwn/not-a-constructor.js: Added.
* test262/test/built-ins/Object/hasOwn/prototype.js: Added.
* test262/test/built-ins/Object/hasOwn/symbol_own_property.js: Added.
* test262/test/built-ins/Object/hasOwn/symbol_property_toPrimitive.js: Added.
(wrapper.Symbol.toPrimitive):
* test262/test/built-ins/Object/hasOwn/symbol_property_toString.js: Added.
(wrapper.toString):
(wrapper.valueOf):
* test262/test/built-ins/Object/hasOwn/symbol_property_valueOf.js: Added.
(wrapper.valueOf):
* test262/test/built-ins/Object/hasOwn/toobject_before_topropertykey.js: Added.
(coercibleKey1.get toString):
(coercibleKey1.get valueOf):
(coercibleKey2.Symbol.toPrimitive):
* test262/test/built-ins/Object/hasOwn/toobject_null.js: Added.
* test262/test/built-ins/Object/hasOwn/toobject_undefined.js: Added.
* test262/test/built-ins/Promise/race/resolve-element-function-extensible.js: Removed.
* test262/test/built-ins/Promise/race/resolve-element-function-name.js: Removed.
* test262/test/built-ins/Promise/race/resolve-element-function-nonconstructor.js: Removed.
* test262/test/built-ins/Promise/race/resolve-element-function-prototype.js: Removed.
* test262/test/built-ins/SharedArrayBuffer/options-maxbytelength-diminuitive.js: Added.
* test262/test/built-ins/SharedArrayBuffer/options-maxbytelength-excessive.js: Added.
* test262/test/built-ins/SharedArrayBuffer/options-maxbytelength-negative.js: Added.
* test262/test/built-ins/SharedArrayBuffer/options-maxbytelength-object.js: Added.
(options.maxByteLength.toString):
(options.maxByteLength.valueOf):
* test262/test/built-ins/SharedArrayBuffer/options-maxbytelength-poisoned.js: Added.
(options.get maxByteLength):
* test262/test/built-ins/SharedArrayBuffer/options-maxbytelength-undefined.js: Added.
* test262/test/built-ins/SharedArrayBuffer/options-non-object.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/grow/descriptor.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/grow/extensible.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/grow/grow-larger-size.js: Added.
(catch):
* test262/test/built-ins/SharedArrayBuffer/prototype/grow/grow-same-size.js: Added.
(catch):
* test262/test/built-ins/SharedArrayBuffer/prototype/grow/grow-smaller-size.js: Added.
(catch):
* test262/test/built-ins/SharedArrayBuffer/prototype/grow/length.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/grow/name.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/grow/new-length-excessive.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/grow/new-length-negative.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/grow/new-length-non-number.js: Added.
(newLength.toString):
(newLength.valueOf):
* test262/test/built-ins/SharedArrayBuffer/prototype/grow/nonconstructor.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-arraybuffer-object.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-object.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-resizable-arraybuffer-object.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/grow/this-is-sharedarraybuffer.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/growable/invoked-as-accessor.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/growable/invoked-as-func.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/growable/length.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/growable/name.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/growable/prop-desc.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/growable/return-growable.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/growable/this-has-no-arraybufferdata-internal.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/growable/this-is-arraybuffer.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/growable/this-is-not-object.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/maxByteLength/invoked-as-accessor.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/maxByteLength/invoked-as-func.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/maxByteLength/length.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/maxByteLength/name.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/maxByteLength/prop-desc.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/maxByteLength/return-maxbytelength-growable.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/maxByteLength/return-maxbytelength-non-growable.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-has-no-arraybufferdata-internal.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-is-arraybuffer.js: Added.
* test262/test/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-is-not-object.js: Added.
* test262/test/built-ins/Symbol/for/description.js: Added.
(symbol.Symbol.toString):
* test262/test/built-ins/Temporal/now/instant/extensible.js: Added.
* test262/test/built-ins/Temporal/now/instant/length.js: Added.
* test262/test/built-ins/Temporal/now/instant/name.js: Added.
* test262/test/built-ins/Temporal/now/instant/not-a-constructor.js: Added.
* test262/test/built-ins/Temporal/now/instant/prop-desc.js: Added.
* test262/test/built-ins/Temporal/now/instant/return-value-distinct.js: Added.
* test262/test/built-ins/Temporal/now/instant/return-value-prototype.js: Added.
* test262/test/built-ins/Temporal/now/instant/return-value-value.js: Added.
* test262/test/built-ins/Temporal/now/timeZone/extensible.js: Added.
* test262/test/built-ins/Temporal/now/timeZone/length.js: Added.
* test262/test/built-ins/Temporal/now/timeZone/name.js: Added.
* test262/test/built-ins/Temporal/now/timeZone/new-object.js: Added.
* test262/test/built-ins/Temporal/now/timeZone/not-a-constructor.js: Added.
* test262/test/built-ins/Temporal/now/timeZone/prop-desc.js: Added.
* test262/test/built-ins/Temporal/now/timeZone/return-value.js: Added.
* test262/test/built-ins/TypedArray/prototype/at/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
* test262/test/built-ins/TypedArray/prototype/byteLength/resizable-array-buffer-auto.js: Added.
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArray/prototype/byteLength/resizable-array-buffer-fixed.js: Added.
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArray/prototype/byteOffset/resizable-array-buffer-auto.js: Added.
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArray/prototype/byteOffset/resizable-array-buffer-fixed.js: Added.
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArray/prototype/copyWithin/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
* test262/test/built-ins/TypedArray/prototype/entries/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
* test262/test/built-ins/TypedArray/prototype/every/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
(testWithTypedArrayConstructors.TA.array.every):
* test262/test/built-ins/TypedArray/prototype/fill/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
* test262/test/built-ins/TypedArray/prototype/filter/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
(testWithTypedArrayConstructors.TA.array.filter):
* test262/test/built-ins/TypedArray/prototype/find/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
(testWithTypedArrayConstructors.TA.array.find):
* test262/test/built-ins/TypedArray/prototype/findIndex/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
(testWithTypedArrayConstructors.TA.array.findIndex):
* test262/test/built-ins/TypedArray/prototype/forEach/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
(testWithTypedArrayConstructors.TA.array.forEach):
* test262/test/built-ins/TypedArray/prototype/includes/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
* test262/test/built-ins/TypedArray/prototype/indexOf/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
* test262/test/built-ins/TypedArray/prototype/join/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
* test262/test/built-ins/TypedArray/prototype/keys/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
* test262/test/built-ins/TypedArray/prototype/lastIndexOf/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
* test262/test/built-ins/TypedArray/prototype/length/resizable-array-buffer-auto.js: Added.
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArray/prototype/length/resizable-array-buffer-fixed.js: Added.
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArray/prototype/map/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
(testWithTypedArrayConstructors.TA.array.map):
* test262/test/built-ins/TypedArray/prototype/reduce/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
(testWithTypedArrayConstructors.TA.array.reduce):
* test262/test/built-ins/TypedArray/prototype/reduceRight/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
(testWithTypedArrayConstructors.TA.array.reduceRight):
* test262/test/built-ins/TypedArray/prototype/reverse/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
* test262/test/built-ins/TypedArray/prototype/set/typedarray-arg-set-values-same-buffer-same-type-resized.js: Added.
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArray/prototype/set/typedarray-arg-target-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
* test262/test/built-ins/TypedArray/prototype/slice/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
* test262/test/built-ins/TypedArray/prototype/some/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
(testWithTypedArrayConstructors.TA.array.some):
* test262/test/built-ins/TypedArray/prototype/sort/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
* test262/test/built-ins/TypedArray/prototype/toLocaleString/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
* test262/test/built-ins/TypedArray/prototype/values/return-abrupt-from-this-out-of-bounds.js: Added.
(testWithTypedArrayConstructors.TA.catch):
* test262/test/built-ins/TypedArrayConstructors/ctors/buffer-arg/excessive-offset-throws-resizable-ab.js: Added.
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/ctors/typedarray-arg/out-of-bounds-when-species-retrieved-different-type.js: Added.
(testWithTypedArrayConstructors.):
(testWithTypedArrayConstructors.get var):
(testWithTypedArrayConstructors.onGetSpecies):
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/ctors/typedarray-arg/out-of-bounds-when-species-retrieved-same-type.js: Added.
(testWithTypedArrayConstructors.):
(testWithTypedArrayConstructors.get var):
(testWithTypedArrayConstructors.onGetSpecies):
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/BigInt/detached-buffer-realm.js: Removed.
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/BigInt/detached-buffer-throws-realm.js: Added.
(testWithBigIntTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/BigInt/detached-buffer-throws.js: Added.
(testWithBigIntTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/BigInt/key-is-not-numeric-index-throws.js: Added.
(testWithBigIntTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/BigInt/key-is-numericindex-accessor-desc-throws.js: Added.
(testWithBigIntTypedArrayConstructors.):
(testWithBigIntTypedArrayConstructors.get assert):
(testWithBigIntTypedArrayConstructors.set assert):
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/BigInt/key-is-numericindex-desc-configurable.js:
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/BigInt/key-is-numericindex-desc-not-configurable-throws.js: Added.
(testWithBigIntTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/BigInt/key-is-numericindex-desc-not-enumerable-throws.js: Added.
(testWithBigIntTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/BigInt/key-is-numericindex-desc-not-writable-throws.js: Added.
(testWithBigIntTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/BigInt/tonumber-value-detached-buffer.js:
(testWithBigIntTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/detached-buffer-realm.js: Removed.
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/detached-buffer-throws-realm.js: Added.
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/detached-buffer-throws.js: Added.
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/key-is-not-numeric-index-throws.js: Added.
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/key-is-numericindex-accessor-desc-throws.js: Added.
(testWithTypedArrayConstructors.):
(testWithTypedArrayConstructors.get assert):
(testWithTypedArrayConstructors.set assert):
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/key-is-numericindex-desc-configurable.js:
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/key-is-numericindex-desc-not-configurable-throws.js: Added.
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/key-is-numericindex-desc-not-enumerable-throws.js: Added.
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/key-is-numericindex-desc-not-writable-throws.js: Added.
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/tonumber-value-detached-buffer.js:
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/Delete/key-is-symbol.js:
* test262/test/built-ins/TypedArrayConstructors/internals/HasProperty/resizable-array-buffer-auto.js: Added.
(inspect):
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/HasProperty/resizable-array-buffer-fixed.js: Added.
(inspect):
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/OwnPropertyKeys/integer-indexes-resizable-array-buffer-auto.js: Added.
(testWithTypedArrayConstructors):
* test262/test/built-ins/TypedArrayConstructors/internals/OwnPropertyKeys/integer-indexes-resizable-array-buffer-fixed.js: Added.
(testWithTypedArrayConstructors):
* test262/test/intl402/DateTimeFormat/constructor-options-style-conflict.js: Added.
* test262/test/intl402/Locale/prototype/calendars/branding.js: Added.
* test262/test/intl402/Locale/prototype/calendars/name.js: Added.
* test262/test/intl402/Locale/prototype/calendars/output-array.js: Added.
* test262/test/intl402/Locale/prototype/calendars/prop-desc.js: Added.
* test262/test/intl402/Locale/prototype/collations/branding.js: Added.
* test262/test/intl402/Locale/prototype/collations/name.js: Added.
* test262/test/intl402/Locale/prototype/collations/output-array-values.js: Added.
* test262/test/intl402/Locale/prototype/collations/output-array.js: Added.
* test262/test/intl402/Locale/prototype/collations/prop-desc.js: Added.
* test262/test/intl402/Locale/prototype/hourCycles/branding.js: Added.
* test262/test/intl402/Locale/prototype/hourCycles/name.js: Added.
* test262/test/intl402/Locale/prototype/hourCycles/output-array-values.js: Added.
* test262/test/intl402/Locale/prototype/hourCycles/output-array.js: Added.
* test262/test/intl402/Locale/prototype/hourCycles/prop-desc.js: Added.
* test262/test/intl402/Locale/prototype/numberingSystems/branding.js: Added.
* test262/test/intl402/Locale/prototype/numberingSystems/name.js: Added.
* test262/test/intl402/Locale/prototype/numberingSystems/output-array.js: Added.
* test262/test/intl402/Locale/prototype/numberingSystems/prop-desc.js: Added.
* test262/test/intl402/Locale/prototype/textInfo/branding.js: Added.
* test262/test/intl402/Locale/prototype/textInfo/name.js: Added.
* test262/test/intl402/Locale/prototype/textInfo/output-object-keys.js: Added.
* test262/test/intl402/Locale/prototype/textInfo/output-object.js: Added.
* test262/test/intl402/Locale/prototype/textInfo/prop-desc.js: Added.
* test262/test/intl402/Locale/prototype/timeZones/branding.js: Added.
* test262/test/intl402/Locale/prototype/timeZones/name.js: Added.
* test262/test/intl402/Locale/prototype/timeZones/output-array-sorted.js: Added.
* test262/test/intl402/Locale/prototype/timeZones/output-array.js: Added.
* test262/test/intl402/Locale/prototype/timeZones/output-undefined.js: Added.
* test262/test/intl402/Locale/prototype/timeZones/prop-desc.js: Added.
* test262/test/intl402/Locale/prototype/weekInfo/branding.js: Added.
* test262/test/intl402/Locale/prototype/weekInfo/name.js: Added.
* test262/test/intl402/Locale/prototype/weekInfo/output-object-keys.js: Added.
* test262/test/intl402/Locale/prototype/weekInfo/output-object.js: Added.
* test262/test/intl402/Locale/prototype/weekInfo/prop-desc.js: Added.
* test262/test/intl402/Segmenter/constructor/supportedLocalesOf/locales-specific.js:
* test262/test/intl402/Segmenter/prototype/segment/containing/iswordlike.js:
(other_granularities.forEach):
* test262/test/intl402/Segmenter/prototype/segment/containing/one-index.js:
(toString):
(valueOf):
(Symbol.toPrimitive):
* test262/test/intl402/Segmenter/prototype/segment/containing/out-of-bound-index.js:
(toString):
(valueOf):
(Symbol.toPrimitive):
* test262/test/intl402/Segmenter/prototype/segment/containing/word-iswordlike.js:
(inputs.forEach):
* test262/test/intl402/Segmenter/prototype/segment/containing/zero-index.js:
(toString):
(valueOf):
(Symbol.toPrimitive):
* test262/test/intl402/Segmenter/prototype/segment/segment-grapheme-iterable.js:
(const.v.of.seg.segment):
* test262/test/intl402/Segmenter/prototype/segment/segment-sentence-iterable.js:
(const.v.of.seg.segment):
* test262/test/intl402/Segmenter/prototype/segment/segment-word-iterable.js:
(const.v.of.seg.segment):
* test262/test/intl402/fallback-locales-are-supported.js:
(testWithIntlConstructors):
* test262/test/intl402/supportedLocalesOf-consistent-with-resolvedOptions.js:
(testWithIntlConstructors):
* test262/test/intl402/supportedLocalesOf-unicode-extensions-ignored.js:
(testWithIntlConstructors.):
(testWithIntlConstructors):
* test262/test/language/expressions/arrow-function/extensibility.js: Added.
(assert.Object.isExtensible):
* test262/test/language/expressions/arrow-function/syntax/arrowparameters-cover-initialize-2.js:
* test262/test/language/expressions/assignment/S11.13.1_A7_T1.js: Removed.
* test262/test/language/expressions/assignment/S11.13.1_A7_T2.js: Removed.
* test262/test/language/expressions/assignment/target-member-computed-reference-null.js: Added.
(DummyError):
(prop):
(expr):
(prop.toString):
* test262/test/language/expressions/assignment/target-member-computed-reference-undefined.js: Added.
(DummyError):
(prop):
(expr):
(prop.toString):
* test262/test/language/expressions/assignment/target-member-identifier-reference-null.js: Added.
* test262/test/language/expressions/assignment/target-member-identifier-reference-undefined.js: Added.
* test262/test/language/expressions/assignment/target-super-computed-reference-null.js: Added.
(C.m):
(C):
* test262/test/language/expressions/assignment/target-super-identifier-reference-null.js: Added.
(C.m):
(C):
* test262/test/language/expressions/delete/member-computed-reference-null.js: Added.
* test262/test/language/expressions/delete/member-computed-reference-undefined.js: Added.
* test262/test/language/expressions/delete/member-identifier-reference-null.js: Added.
* test262/test/language/expressions/delete/member-identifier-reference-undefined.js: Added.
* test262/test/language/expressions/delete/super-property-null-base.js: Added.
(C.m):
(C):
* test262/test/language/expressions/dynamic-import/2nd-param-assert-enumeration-abrupt.js: Added.
(options.ownKeys):
(options.then):
* test262/test/language/expressions/dynamic-import/2nd-param-assert-enumeration.js: Added.
(options.ownKeys):
(options.get _):
(options.getOwnPropertyDescriptor):
(options.then):
* test262/test/language/expressions/dynamic-import/2nd-param-assert-non-object.js: Added.
(test):
(string_appeared_here.then):
* test262/test/language/expressions/dynamic-import/2nd-param-assert-undefined.js: Added.
(then):
* test262/test/language/expressions/dynamic-import/2nd-param-assert-value-abrupt.js: Added.
(assert.get string_appeared_here):
(then):
* test262/test/language/expressions/dynamic-import/2nd-param-assert-value-non-string.js: Added.
(test):
(string_appeared_here.then):
* test262/test/language/expressions/dynamic-import/2nd-param-await-expr.js: Added.
* test262/test/language/expressions/dynamic-import/2nd-param-await-ident.js: Added.
(await):
(await.undefined.then):
* test262/test/language/expressions/dynamic-import/2nd-param-evaluation-abrupt-return.js: Added.
(iter):
* test262/test/language/expressions/dynamic-import/2nd-param-evaluation-abrupt-throw.js: Added.
(throwError):
* test262/test/language/expressions/dynamic-import/2nd-param-evaluation-sequence.js: Added.
* test262/test/language/expressions/dynamic-import/2nd-param-get-assert-error.js: Added.
(options.get assert):
(options.then):
* test262/test/language/expressions/dynamic-import/2nd-param-in.js: Added.
(promise.then):
* test262/test/language/expressions/dynamic-import/2nd-param-non-object.js: Added.
(test):
(string_appeared_here.then):
* test262/test/language/expressions/dynamic-import/2nd-param-trailing-comma-fulfill.js: Added.
(then):
* test262/test/language/expressions/dynamic-import/2nd-param-trailing-comma-reject.js: Added.
(import.toString):
(then):
* test262/test/language/expressions/dynamic-import/2nd-param-yield-expr.js: Added.
(iter):
(promise.then):
* test262/test/language/expressions/dynamic-import/2nd-param-yield-ident-invalid.js: Added.
* test262/test/language/expressions/dynamic-import/2nd-param-yield-ident-valid.js: Added.
(yield.then):
* test262/test/language/expressions/dynamic-import/2nd-param_FIXTURE.js: Added.
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-arrow-assignment-expression-not-extensible-args.js:
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-arrow-not-extensible-args.js:
(let.f):
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-arrow-function-await-not-extensible-args.js:
(async await):
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-arrow-function-return-await-not-extensible-args.js:
(async await):
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-arrow-function-return-await-not-extensible-no-trailing-comma.js: Removed.
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-function-await-not-extensible-args.js:
(async f):
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-function-not-extensible-args.js:
(async f):
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-function-return-await-not-extensible-args.js:
(async f):
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-function-return-await-not-extensible-no-trailing-comma.js: Removed.
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-gen-await-not-extensible-args.js:
(async f):
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-block-labeled-not-extensible-args.js:
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-block-not-extensible-args.js:
(DONOTEVALUATE):
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-do-while-not-extensible-args.js:
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-else-braceless-not-extensible-args.js:
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-else-not-extensible-args.js:
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-function-not-extensible-args.js:
(fn):
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-function-return-not-extensible-args.js:
(fn):
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-if-braceless-not-extensible-args.js:
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-if-braceless-not-extensible-no-trailing-comma.js: Removed.
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-if-not-extensible-args.js:
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-while-not-extensible-args.js:
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-with-expression-not-extensible-args.js:
(with.import):
* test262/test/language/expressions/dynamic-import/syntax/invalid/nested-with-not-extensible-args.js:
(with):
* test262/test/language/expressions/dynamic-import/syntax/invalid/top-level-not-extensible-args.js:
* test262/test/language/expressions/dynamic-import/syntax/invalid/top-level-not-extensible-no-trailing-comma.js: Removed.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-arrow-assignment-expression-trailing-comma-first.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-arrow-assignment-expression-not-extensible-args.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-arrow-assignment-expression-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-arrow-assignment-expression-not-extensible-args.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-arrow-trailing-comma-first.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-arrow-not-extensible-no-trailing-comma.js.
(let.f):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-arrow-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-arrow-not-extensible-args.js.
(let.f):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-async-arrow-function-await-trailing-comma-first.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-arrow-function-await-not-extensible-no-trailing-comma.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-async-arrow-function-await-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-arrow-function-await-not-extensible-args.js.
(async await):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-async-arrow-function-return-await-trailing-comma-first.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-arrow-assignment-expression-not-extensible-args.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-async-arrow-function-return-await-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-arrow-assignment-expression-not-extensible-args.js.
(async await):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-async-function-await-trailing-comma-first.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-function-await-not-extensible-args.js.
(async f):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-async-function-await-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-function-await-not-extensible-args.js.
(async f):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-async-function-return-await-trailing-comma-first.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-function-await-not-extensible-args.js.
(async f):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-async-function-return-await-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-function-await-not-extensible-args.js.
(async f):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-async-function-trailing-comma-first.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-function-await-not-extensible-no-trailing-comma.js.
(async f):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-async-function-trailing-comma-second.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-function-not-extensible-no-trailing-comma.js.
(async f):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-async-gen-await-trailing-comma-first.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-gen-await-not-extensible-no-trailing-comma.js.
(async f):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-async-gen-await-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-async-gen-await-not-extensible-args.js.
(async f):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-block-labeled-trailing-comma-first.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-block-labeled-not-extensible-no-trailing-comma.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-block-labeled-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-block-labeled-not-extensible-args.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-block-trailing-comma-first.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-block-not-extensible-no-trailing-comma.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-block-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-block-not-extensible-args.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-do-while-trailing-comma-first.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-do-while-not-extensible-no-trailing-comma.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-do-while-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-do-while-not-extensible-args.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-else-braceless-trailing-comma-first.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-else-braceless-not-extensible-no-trailing-comma.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-else-braceless-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-else-braceless-not-extensible-args.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-else-trailing-comma-first.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-else-not-extensible-no-trailing-comma.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-else-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-else-not-extensible-args.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-function-return-trailing-comma-first.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-function-return-not-extensible-args.js.
(fn):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-function-return-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-function-return-not-extensible-args.js.
(fn):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-function-trailing-comma-first.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-function-not-extensible-no-trailing-comma.js.
(fn):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-function-trailing-comma-second.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-function-return-not-extensible-no-trailing-comma.js.
(fn):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-if-braceless-trailing-comma-first.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-arrow-assignment-expression-not-extensible-no-trailing-comma.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-if-braceless-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-arrow-assignment-expression-not-extensible-args.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-if-trailing-comma-first.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-if-not-extensible-no-trailing-comma.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-if-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-if-not-extensible-args.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-while-trailing-comma-first.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-while-not-extensible-no-trailing-comma.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-while-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-while-not-extensible-args.js.
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-with-expression-trailing-comma-first.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-with-not-extensible-args.js.
(with.import):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-with-expression-trailing-comma-second.js: Copied from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-with-not-extensible-args.js.
(with.import):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-with-trailing-comma-first.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-with-not-extensible-no-trailing-comma.js.
(with):
* test262/test/language/expressions/dynamic-import/syntax/valid/nested-with-trailing-comma-second.js: Renamed from JSTests/test262/test/language/expressions/dynamic-import/syntax/invalid/nested-with-expression-not-extensible-no-trailing-comma.js.
(with):
* test262/test/language/expressions/dynamic-import/syntax/valid/top-level-trailing-comma-first.js: Added.
* test262/test/language/expressions/dynamic-import/syntax/valid/top-level-trailing-comma-second.js: Added.
* test262/test/language/expressions/dynamic-import/trailing-comma-fulfill.js: Added.
(then):
* test262/test/language/expressions/dynamic-import/trailing-comma-reject.js: Added.
(import.toString):
(then):
* test262/test/language/expressions/template-literal/invalid-legacy-octal-escape-sequence-8.js:
* test262/test/language/expressions/template-literal/invalid-legacy-octal-escape-sequence-9.js:
* test262/test/language/expressions/template-literal/invalid-legacy-octal-escape-sequence.js:
* test262/test/language/import/json-extensibility-array.js: Added.
* test262/test/language/import/json-extensibility-object.js: Added.
* test262/test/language/import/json-idempotency-indirect_FIXTURE.js: Added.
* test262/test/language/import/json-idempotency.js: Added.
(then):
* test262/test/language/import/json-invalid.js: Added.
* test262/test/language/import/json-named-bindings.js: Added.
* test262/test/language/import/json-value-array.js: Added.
* test262/test/language/import/json-value-boolean.js: Added.
* test262/test/language/import/json-value-null.js: Added.
* test262/test/language/import/json-value-number.js: Added.
* test262/test/language/import/json-value-object.js: Added.
* test262/test/language/import/json-value-string.js: Added.
* test262/test/language/import/json-via-namespace.js: Added.
* test262/test/language/literals/numeric/legacy-octal-integer-strict.js:
* test262/test/language/literals/numeric/legacy-octal-integer.js: Renamed from JSTests/test262/test/annexB/language/literals/numeric/legacy-octal-integer.js.
* test262/test/language/literals/numeric/non-octal-decimal-integer-strict.js:
* test262/test/language/literals/numeric/non-octal-decimal-integer.js: Renamed from JSTests/test262/test/annexB/language/literals/numeric/non-octal-decimal-integer.js.
* test262/test/language/literals/string/legacy-non-octal-escape-sequence-1-strict-explicit-pragma.js:
* test262/test/language/literals/string/legacy-non-octal-escape-sequence-2-strict-explicit-pragma.js:
* test262/test/language/literals/string/legacy-non-octal-escape-sequence-3-strict-explicit-pragma.js:
* test262/test/language/literals/string/legacy-non-octal-escape-sequence-4-strict-explicit-pragma.js:
* test262/test/language/literals/string/legacy-non-octal-escape-sequence-5-strict-explicit-pragma.js:
* test262/test/language/literals/string/legacy-non-octal-escape-sequence-6-strict-explicit-pragma.js:
* test262/test/language/literals/string/legacy-non-octal-escape-sequence-7-strict-explicit-pragma.js:
* test262/test/language/literals/string/legacy-non-octal-escape-sequence-8-non-strict.js: Added.
* test262/test/language/literals/string/legacy-non-octal-escape-sequence-8-strict-explicit-pragma.js:
* test262/test/language/literals/string/legacy-non-octal-escape-sequence-8-strict.js:
* test262/test/language/literals/string/legacy-non-octal-escape-sequence-9-non-strict.js: Added.
* test262/test/language/literals/string/legacy-non-octal-escape-sequence-9-strict-explicit-pragma.js:
* test262/test/language/literals/string/legacy-non-octal-escape-sequence-9-strict.js:
* test262/test/language/literals/string/legacy-non-octal-escape-sequence-strict.js:
* test262/test/language/literals/string/legacy-octal-escape-sequence-strict.js:
* test262/test/language/literals/string/legacy-octal-escape-sequence.js: Renamed from JSTests/test262/test/annexB/language/literals/string/legacy-octal-escape-sequence.js.
* test262/test/language/module-code/early-dup-assert-key-export.js: Added.
* test262/test/language/module-code/early-dup-assert-key-import-nobinding.js: Added.
* test262/test/language/module-code/early-dup-assert-key-import-withbinding.js: Added.
* test262/test/language/module-code/early-export-ill-formed-string.js:
* test262/test/language/module-code/eval-gtbndng-indirect-faux-assertion.js: Added.
* test262/test/language/module-code/import-assertion-1_FIXTURE.js: Added.
* test262/test/language/module-code/import-assertion-2_FIXTURE.js: Added.
* test262/test/language/module-code/import-assertion-3_FIXTURE.js: Added.
* test262/test/language/module-code/import-assertion-empty.js: Added.
* test262/test/language/module-code/import-assertion-key-identifiername.js: Added.
* test262/test/language/module-code/import-assertion-key-string-double.js: Added.
* test262/test/language/module-code/import-assertion-key-string-single.js: Added.
* test262/test/language/module-code/import-assertion-many.js: Added.
* test262/test/language/module-code/import-assertion-newlines.js: Added.
* test262/test/language/module-code/import-assertion-trlng-comma.js: Added.
* test262/test/language/module-code/import-assertion-value-string-double.js: Added.
* test262/test/language/module-code/import-assertion-value-string-single.js: Added.
* test262/test/language/module-code/instn-star-as-props-dflt-skip.js:
* test262/test/language/module-code/top-level-await/dfs-invariant-async_FIXTURE.js: Added.
* test262/test/language/module-code/top-level-await/dfs-invariant-direct-1_FIXTURE.js: Added.
* test262/test/language/module-code/top-level-await/dfs-invariant-direct-2_FIXTURE.js: Added.
* test262/test/language/module-code/top-level-await/dfs-invariant-indirect_FIXTURE.js: Added.
* test262/test/language/module-code/top-level-await/dfs-invariant.js: Added.
* test262/test/language/statements/for-of/head-lhs-async-escaped.js: Added.
* test262/test/language/statements/for-of/head-lhs-async-parens.js: Added.
* test262/test262-Revision.txt:
2021-07-08 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Update Intl.Locale test after AppleICU update
https://bugs.webkit.org/show_bug.cgi?id=227788
Reviewed by Keith Miller.
This patch fixes Intl.Locale test since AppleICU fixes the ICU bug and starts producing the right results.
* stress/intl-long-locale-id-maximize-minimize.js:
(shouldBe):
2021-07-07 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Fix Object.assign fast path to accept undefined/null
https://bugs.webkit.org/show_bug.cgi?id=227769
rdar://80264271
Reviewed by Saam Barati.
* stress/object-assign-undefined.js: Added.
(test):
2021-07-06 Commit Queue <commit-queue@webkit.org>
Unreviewed, reverting r279546, r279554, r279558 and r279567.
https://bugs.webkit.org/show_bug.cgi?id=227732
Speedometer/jQuery-TodoMVC 2-3% regression
Reverted changesets:
"[WebIDL] Rework runtime enabled properties leveraging
PropertyCallback"
https://bugs.webkit.org/show_bug.cgi?id=227275
https://commits.webkit.org/r279546
"[WebIDL] Generate constructor's hash table in
GenerateConstructorHelperMethods"
https://bugs.webkit.org/show_bug.cgi?id=227668
https://commits.webkit.org/r279554
"[WebIDL] Simplify generation of runtime conditionally read-
write attributes"
https://bugs.webkit.org/show_bug.cgi?id=227672
https://commits.webkit.org/r279558
"Use AbortSignal's [PrivateIdentifier] whenSignalAborted()
static method"
https://bugs.webkit.org/show_bug.cgi?id=227673
https://commits.webkit.org/r279567
2021-07-06 Saam Barati <sbarati@apple.com>
Run microbenchmarks/memcpy-typed-loop-small.js for fewer iterations to avoid timeouts
https://bugs.webkit.org/show_bug.cgi?id=227717
Reviewed by Robin Morisset.
* microbenchmarks/memcpy-typed-loop-small.js:
2021-07-05 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Optimize Object.assign and putDirectInternal
https://bugs.webkit.org/show_bug.cgi?id=227677
Reviewed by Filip Pizlo.
* microbenchmarks/object-assign-replace.js: Added.
(test):
* microbenchmarks/object-assign-transition.js: Added.
(test):
2021-07-03 Alexey Shvayka <shvaikalesh@gmail.com>
[WebIDL] Rework runtime enabled properties leveraging PropertyCallback
https://bugs.webkit.org/show_bug.cgi?id=227275
Reviewed by Saam Barati.
* stress/lazy-property-cross-realm.js: Added.
* stress/lazy-property-get-cache.js: Added.
* stress/lazy-property-gopd.js: Added.
* stress/lazy-property-hasownproperty-cache.js: Added.
* stress/lazy-property-put-cache.js: Added.
2021-06-30 Saam Barati <sbarati@apple.com>
Turn off data ICs by default
https://bugs.webkit.org/show_bug.cgi?id=227334
<rdar://problem/79802812>
Reviewed by Yusuke Suzuki.
* microbenchmarks/deltablue-varargs.js:
* microbenchmarks/richards-try-catch.js:
2021-06-30 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Stop generating default parameter code if class constructor is called without 'new'
https://bugs.webkit.org/show_bug.cgi?id=227547
rdar://78821453
Reviewed by Mark Lam.
* stress/calling-non-callable-constructors.js: Added.
(shouldThrow):
2021-06-29 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Private names should be handled by usedVariables mechanism
https://bugs.webkit.org/show_bug.cgi?id=227476
rdar://76049469
Reviewed by Saam Barati.
2021-06-30 Mikhail R. Gadelha <mikhail@igalia.com>
Unskip interpreter-wasm.js on ARM and MIPS
https://bugs.webkit.org/show_bug.cgi?id=227295
Reviewed by Caio Araujo Neponoceno de Lima.
Changed the testcase to be guarded by $vm.isWasmSupported(), so the
test will be executed once wasm is available in the arch
* microbenchmarks/interpreter-wasm.js:
(key.in.Module.Module.hasOwnProperty): Deleted.
(quit_): Deleted.
(locateFile): Deleted.
(ENVIRONMENT_IS_NODE.read_): Deleted.
(ENVIRONMENT_IS_NODE.readBinary): Deleted.
(ENVIRONMENT_IS_NODE.quit_): Deleted.
(ENVIRONMENT_IS_NODE.Module.string_appeared_here): Deleted.
(else.read_): Deleted.
(else.readBinary): Deleted.
(else.quit_): Deleted.
(else): Deleted.
(else.xhr.onload): Deleted.
(else.readAsync): Deleted.
(else.setWindowTitle): Deleted.
(key.in.moduleOverrides.moduleOverrides.hasOwnProperty): Deleted.
(dynamicAlloc): Deleted.
(getNativeTypeSize): Deleted.
(warnOnce): Deleted.
(convertJsFunctionToWasm): Deleted.
(addFunctionWasm): Deleted.
(removeFunctionWasm): Deleted.
(): Deleted.
(setTempRet0): Deleted.
(setValue): Deleted.
(assert): Deleted.
(getCFunc): Deleted.
(toC.string_appeared_here): Deleted.
(convertReturnValue): Deleted.
(ccall): Deleted.
(UTF8ArrayToString): Deleted.
(UTF8ToString): Deleted.
(stringToUTF8Array): Deleted.
(stringToUTF8): Deleted.
(lengthBytesUTF8): Deleted.
(allocateUTF8OnStack): Deleted.
(writeArrayToMemory): Deleted.
(writeAsciiToMemory): Deleted.
(updateGlobalBufferAndViews): Deleted.
(callRuntimeCallbacks): Deleted.
(preRun): Deleted.
(initRuntime): Deleted.
(preMain): Deleted.
(exitRuntime): Deleted.
(postRun): Deleted.
(addOnPreRun): Deleted.
(addOnPostRun): Deleted.
(addRunDependency): Deleted.
(removeRunDependency): Deleted.
(hasPrefix): Deleted.
(isDataURI): Deleted.
(isFileURI): Deleted.
(getBinary): Deleted.
(getBinaryPromise): Deleted.
(createWasm.receiveInstance): Deleted.
(createWasm.receiveInstantiatedSource): Deleted.
(createWasm.instantiateArrayBuffer): Deleted.
(createWasm.instantiateAsync.): Deleted.
(createWasm.instantiateAsync): Deleted.
(createWasm): Deleted.
(__ATINIT__.push.func): Deleted.
(demangle): Deleted.
(demangleAll): Deleted.
(_emscripten_get_sbrk_ptr): Deleted.
(_emscripten_memcpy_big): Deleted.
(abortOnCannotGrowMemory): Deleted.
(_emscripten_resize_heap): Deleted.
(PATH.splitPath): Deleted.
(PATH.normalizeArray): Deleted.
(PATH.normalize): Deleted.
(PATH.dirname): Deleted.
(PATH.basename): Deleted.
(PATH.extname): Deleted.
(PATH.join): Deleted.
(PATH.join2): Deleted.
(SYSCALLS.printChar): Deleted.
(SYSCALLS.getStr): Deleted.
(SYSCALLS.get64): Deleted.
(_fd_write): Deleted.
(_setTempRet0): Deleted.
(___wasm_call_ctors.Module.string_appeared_here): Deleted.
(_main.Module.string_appeared_here): Deleted.
(_malloc.Module.string_appeared_here): Deleted.
(___errno_location.Module.string_appeared_here): Deleted.
(_free.Module.string_appeared_here): Deleted.
(stackSave.Module.string_appeared_here): Deleted.
(stackAlloc.Module.string_appeared_here): Deleted.
(stackRestore.Module.string_appeared_here): Deleted.
(__growWasmMemory.Module.string_appeared_here): Deleted.
(dynCall_ii.Module.string_appeared_here): Deleted.
(dynCall_iiii.Module.string_appeared_here): Deleted.
(dynCall_jiji.Module.string_appeared_here): Deleted.
(ExitStatus): Deleted.
(dependenciesFulfilled): Deleted.
(callMain): Deleted.
(run.doRun): Deleted.
(run): Deleted.
(exit): Deleted.
2021-06-25 Guillaume Emont <guijemont@igalia.com>
Unskip stress/call-apply-exponential-bytecode-size.js on most platforms
https://bugs.webkit.org/show_bug.cgi?id=227354
Reviewed by Yusuke Suzuki.
Instead of skipping, we increase the JIT memory size for this test on
platforms that have less than 64 MB by default.
* stress/call-apply-exponential-bytecode-size.js:
2021-06-25 Mikhail R. Gadelha <mikhail@igalia.com>
Unskip structure-storedPrototype-should-only-assert-on-the-mutator-thread.js on arm and mips
https://bugs.webkit.org/show_bug.cgi?id=227222
Tested with 50 iterations in both arm and mips.
Unreviewed Gardening.
* stress/structure-storedPrototype-should-only-assert-on-the-mutator-thread.js:
2021-06-25 Paulo Matos <pmatos@igalia.com>
Unskip materialized-regexp-has-correct-last-index-set-by-match on arm and mips
https://bugs.webkit.org/show_bug.cgi?id=227213
Unreviewed Gardening.
* stress/materialized-regexp-has-correct-last-index-set-by-match.js:
2021-06-25 Mikhail R. Gadelha <mikhail@igalia.com>
Unskip materialize-regexp-cyclic-regexp.js on ARM and MIPS
https://bugs.webkit.org/show_bug.cgi?id=227223
Tested with 50 iterations in both arm and mips.
Unreviewed Gardening.
* stress/materialize-regexp-cyclic-regexp.js:
2021-06-24 Asumu Takikawa <asumu@igalia.com>
[WASM-Function-References] Add support for (ref null? $t) type constructor
https://bugs.webkit.org/show_bug.cgi?id=226296
Adds additional tests for uses of `(ref $t)` and `(ref null $t)`
types, including with non-null extern/funcrefs.
Reviewed by Yusuke Suzuki.
* wasm/function-references/ref_types.js: Added.
(module):
(async testRefTypeLocal):
(async testNonNullRefTypeLocal):
(async testRefTypeInSignature):
(async testRefTypeParamCheck):
(async testRefGlobalCheck):
(async testExternFuncrefNonNullCheck):
(async testExternrefCompatibility):
(async testNonNullExternrefIncompatible):
(async testFuncrefCompatibility):
(async testNonNullFuncrefIncompatible):
* wasm/wasm.json:
2021-06-24 Guillaume Emont <guijemont@igalia.com>
Improve our checking of NaN values in DataView tests
https://bugs.webkit.org/show_bug.cgi?id=227347
Reviewed by Yusuke Suzuki.
This allows the merging of dataview-jit-set-nan.js and
dataview-jit-set.js.
* stress/dataview-jit-set-nan.js: Removed.
* stress/dataview-jit-set.js:
(test5):
(test6):
2021-06-24 Mikhail R. Gadelha <mikhail@igalia.com>
Unskip arguments-properties-order.js on MIPS
https://bugs.webkit.org/show_bug.cgi?id=227254
No failures after 50 iterations. Also tested on Loongson 3A4000 (in 32-bits mode).
Unreviewed Gardening.
* stress/arguments-properties-order.js:
2021-06-24 Xan Lopez <xan@igalia.com>
[JSC] Implement returnEarlyFromInfiniteLoopsForFuzzing for 32bits
https://bugs.webkit.org/show_bug.cgi?id=227290
Reviewed by Mark Lam.
Now that we can return early from infinite (actual or just
extremely long running) loops on 32bits, we can pass these tests.
* stress/construct-return-early-from-infinite-loop-for-fuzzer.js: unskip for 32bits.
* stress/early-return-from-builtin2.js: ditto.
* stress/validate-does-gc-with-return-early-from-infinite-loop-2.js: ditto.
* stress/validate-does-gc-with-return-early-from-infinite-loop.js: ditto.
2021-06-23 Saam Barati <sbarati@apple.com>
Bound stress/put-by-id-flags with a fixed number of iterations
https://bugs.webkit.org/show_bug.cgi?id=227305
Reviewed by Mark Lam.
* stress/put-by-id-flags.js:
(numberOfDFGCompiles): Deleted.
2021-06-23 Saam Barati <sbarati@apple.com>
Run typedarray-intrinsic-getters-change-prototype for a fixed set of iterations
https://bugs.webkit.org/show_bug.cgi?id=227304
Reviewed by Mark Lam.
* stress/typedarray-intrinsic-getters-change-prototype.js:
(body):
2021-06-22 Saam Barati <sbarati@apple.com>
Don't assume stress/out-of-memory-while-constructing-BytecodeGenerator.js will OOM
https://bugs.webkit.org/show_bug.cgi?id=227263
Reviewed by Yusuke Suzuki.
* stress/out-of-memory-while-constructing-BytecodeGenerator.js:
2021-06-22 Saam Barati <sbarati@apple.com>
Run detach-buffer-during-iteration for fewer iterations
https://bugs.webkit.org/show_bug.cgi?id=227262
Reviewed by Yusuke Suzuki.
* stress/detach-buffer-during-iteration.js:
2021-06-22 Saam Barati <sbarati@apple.com>
Run microbenchmarks/interpreter-wasm under runDefault only
https://bugs.webkit.org/show_bug.cgi?id=227261
Reviewed by Robin Morisset.
* microbenchmarks/interpreter-wasm.js:
2021-06-22 Saam Barati <sbarati@apple.com>
jitCompileAndSetHeuristics shouldn't return true when we fail to compile
https://bugs.webkit.org/show_bug.cgi?id=227155
Reviewed by Tadeu Zagallo.
* microbenchmarks/interpreter-wasm.js:
* microbenchmarks/memcpy-wasm-large.js:
* microbenchmarks/memcpy-wasm-medium.js:
* microbenchmarks/memcpy-wasm-small.js:
* microbenchmarks/memcpy-wasm.js:
* stress/wasm-error-message-cross-threads.js:
2021-06-22 Angelos Oikonomopoulos <angelos@igalia.com>
Unskip stress/elidable-new-object-roflcopter-then-exit.js on MIPS/ARM
https://bugs.webkit.org/show_bug.cgi?id=227251
Unreviewed gardening.
No failures on either platform after 100 iterations.
* stress/elidable-new-object-roflcopter-then-exit.js:
2021-06-22 Angelos Oikonomopoulos <angelos@igalia.com>
Unskip microbenchmarks/redefine-property-data-dictionary.js on MIPS/ARM
https://bugs.webkit.org/show_bug.cgi?id=227252
Unreviewed gardening.
No failures on either platform after 100 iterations.
* microbenchmarks/redefine-property-data-dictionary.js:
2021-06-22 Angelos Oikonomopoulos <angelos@igalia.com>
Unskip stress/array-species-create-should-handle-masquerader.js on mips
https://bugs.webkit.org/show_bug.cgi?id=227249
Unreviewed gardening.
No failure after 60 iterations.
* stress/array-species-create-should-handle-masquerader.js:
2021-06-21 Ross Kirsling <ross.kirsling@sony.com>
[JSC] Add JIT ICs for `#x in obj` feature
https://bugs.webkit.org/show_bug.cgi?id=226146
Reviewed by Saam Barati.
* microbenchmarks/has-private-brand.js: Added.
* microbenchmarks/has-private-name.js: Added.
2021-06-21 Xan Lopez <xan@igalia.com>
[JSC] Fix consistency check during stack splitting in Wasm::LLIntGenerator::addLoop
https://bugs.webkit.org/show_bug.cgi?id=226012
Reviewed by Tadeu Zagallo.
* stress/wasm-loop-consistency.js: Added.
(vm.isWasmSupported):
2021-06-21 Yusuke Suzuki <ysuzuki@apple.com>
Release assert memory in JSC::Wasm::Memory::growShared(JSC::Wasm::PageCount)::<lambda()>
https://bugs.webkit.org/show_bug.cgi?id=227180
Reviewed by Keith Miller.
* stress/shared-wasm-memory-with-zero-byte.js: Added.
2021-06-21 Xan Lopez <xan@igalia.com>
[JSC] Reenable ChakraCore/test/Math/max.js on ARMv7 and MIPS
https://bugs.webkit.org/show_bug.cgi?id=227209
Reviewed by Adrian Perez de Castro.
* ChakraCore.yaml: reenable the test, should be working fine now.
2021-06-20 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Add ValueOf fast path in toPrimitive
https://bugs.webkit.org/show_bug.cgi?id=226948
Reviewed by Ross Kirsling.
* microbenchmarks/valueof-via-toprimitive.js: Added.
2021-06-17 Saam Barati <sbarati@apple.com>
Make microbenchmarks/delete-property-from-prototype-chain not time out on debug builds
https://bugs.webkit.org/show_bug.cgi?id=227148
Reviewed by Mark Lam.
* microbenchmarks/delete-property-from-prototype-chain.js:
2021-06-16 Tadeu Zagallo <tzagallo@apple.com>
AssemblyHelpers should save/restore callee save FPRs
https://bugs.webkit.org/show_bug.cgi?id=227052
<rdar://77080162>
Reviewed by Mark Lam.
* stress/callee-save-fpr.js: Added.
(_f):
(_g):
(_h):
(_i):
(assertEqual):
2021-06-15 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Optimize JSON.parse with small content by dropping single character Identifier pool
https://bugs.webkit.org/show_bug.cgi?id=227057
Reviewed by Sam Weinig.
* microbenchmarks/flight-todomvc-json.js: Added.
(test):
2021-06-14 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Workaround ICU uloc_addLikelySubtags / uloc_minimizeSubtags bugs
https://bugs.webkit.org/show_bug.cgi?id=226996
rdar://79250513
Reviewed by Ross Kirsling.
* stress/intl-long-locale-id-maximize-minimize.js: Added.
(shouldBe):
(throw.new.Error):
2021-06-13 Saam Barati <sbarati@apple.com>
https://bugs.webkit.org/show_bug.cgi?id=226576
<rdar://problem/78810362>
Reviewed by Yusuke Suzuki.
* stress/short-circuit-read-modify-write-cant-write-dst-before-tdz-check.js: Added.
(let.result.eval.try.captureV):
(catch):
2021-06-06 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Use ResolvedClosureVar to get brand from scope
https://bugs.webkit.org/show_bug.cgi?id=226677
rdar://78802869
Reviewed by Saam Barati.
* stress/private-access-nested-eval.js: Added.
(shouldThrow):
(shouldThrow.prototype.x):
(shouldThrow.prototype.m.C.prototype.z):
(shouldThrow.prototype.m.C.prototype.a):
(shouldThrow.prototype.m.C):
(shouldThrow.prototype.m):
* stress/private-access-nested.js: Added.
(shouldThrow):
(shouldThrow.prototype.x):
(shouldThrow.prototype.m.C.prototype.z):
(shouldThrow.prototype.m.C.prototype.a):
(shouldThrow.prototype.m.C):
(shouldThrow.prototype.m):
2021-06-07 Alexey Shvayka <shvaikalesh@gmail.com>
Unreviewed, reland r276592 with a fix for put() override in prototype chain of a JSProxy
https://bugs.webkit.org/show_bug.cgi?id=226185
* microbenchmarks/put-slow-no-cache-array.js: Added.
* microbenchmarks/put-slow-no-cache-function.js: Added.
* microbenchmarks/put-slow-no-cache-js-proxy.js: Added.
* microbenchmarks/put-slow-no-cache-long-prototype-chain.js: Added.
* microbenchmarks/put-slow-no-cache.js: Added.
* microbenchmarks/reflect-set-with-receiver.js: Added.
* stress/custom-get-set-proto-chain-put.js:
* stress/module-namespace-access-set-fails.js: Added.
* stress/put-non-reified-static-accessor-or-custom.js: Added.
* stress/put-non-reified-static-function-or-custom.js: Added.
* stress/put-to-primitive-non-reified-static-custom.js: Added.
* stress/put-to-primitive.js: Added.
* stress/put-to-proto-chain-overrides-put.js:
Rework to always test new objects, add JSProxy coverage, and assert that receiver has own property.
* stress/typed-array-canonical-numeric-index-string-set.js: Added.
2021-06-07 Saam Barati <sbarati@apple.com>
Short circuit read modify write nodes emit byte code that uses the wrong locals
https://bugs.webkit.org/show_bug.cgi?id=226576
<rdar://problem/78810362>
Reviewed by Yusuke Suzuki.
* stress/short-circuit-read-modify-should-use-the-write-virtual-registers.js: Added.
(eval):
2021-06-07 Robin Morisset <rmorisset@apple.com>
Optimize compareStrictEq when neither side is a double and at least one is neither a string nor a BigInt
https://bugs.webkit.org/show_bug.cgi?id=226676
Reviewed by Filip Pizlo.
I made two variants of the already existing poly-stricteq microbenchmarks with different types in the array.
I also tweaked all three so that we more reliably reach the FTL.
Finally I added a stress-test to verify that I did not introduce an OSR exit bug.
* microbenchmarks/poly-stricteq-not-double-nor-string.js: Added.
(foo):
(test):
* microbenchmarks/poly-stricteq-not-double.js: Added.
(foo):
(test):
* microbenchmarks/poly-stricteq.js:
(foo):
(test):
* stress/poly-stricteq-not-double-nor-string-fail.js: Added.
(foo):
(test):
2021-06-04 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Private static method should define privateClassBrandIdentifier in class-scope
https://bugs.webkit.org/show_bug.cgi?id=226656
rdar://78313139
Reviewed by Keith Miller.
* stress/private-in-error.js: Added.
(shouldThrow):
(x):
(prototype.foo):
* stress/private-static-method-declaration-error.js: Added.
(shouldThrow):
(prototype.get x):
(prototype.foo.D.a):
(prototype.foo.D.prototype.b):
(prototype.foo.D):
(prototype.foo):
2021-06-04 Mark Lam <mark.lam@apple.com>
Placate exception checker validation in objectPrototypeHasOwnProperty.
https://bugs.webkit.org/show_bug.cgi?id=226651
rdar://78861296
Reviewed by Keith Miller.
* stress/placate-exception-checker-in-objectPrototypeHasOwnProperty.js: Added.
2021-06-03 Filip Pizlo <fpizlo@apple.com>
DFG should speculate on CompareStrictEq(@x, @x)
https://bugs.webkit.org/show_bug.cgi?id=226621
Reviewed by Mark Lam.
* microbenchmarks/untyped-stricteq-self.js: Added.
(foo):
* stress/untyped-stricteq-self-fail.js: Added.
(bar):
(foo):
2021-06-04 Keith Miller <keith_miller@apple.com>
Fix tests that fail under executable allocation fuzzing
https://bugs.webkit.org/show_bug.cgi?id=226593
Reviewed by Mark Lam.
* microbenchmarks/memcpy-wasm-large.js:
(typeof.WebAssembly.string_appeared_here.try.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
(typeof.WebAssembly.string_appeared_here.catch):
(typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array): Deleted.
* microbenchmarks/memcpy-wasm-medium.js:
(typeof.WebAssembly.string_appeared_here.try.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
(typeof.WebAssembly.string_appeared_here.catch):
(typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array): Deleted.
* microbenchmarks/memcpy-wasm-small.js:
(typeof.WebAssembly.string_appeared_here.try.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
(typeof.WebAssembly.string_appeared_here.catch):
(typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array): Deleted.
* microbenchmarks/memcpy-wasm.js:
(typeof.WebAssembly.string_appeared_here.try.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
(typeof.WebAssembly.string_appeared_here.catch):
(typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array): Deleted.
* stress/bit-op-with-object-returning-int32.js:
(numberOfDFGCompiles):
(bitOr): Deleted.
(bitXor): Deleted.
(bitNot): Deleted.
(bitLShift): Deleted.
* stress/bitwise-not-fixup-rules.js:
(numberOfDFGCompiles):
(let.o.valueOf): Deleted.
2021-06-04 Tadeu Zagallo <tzagallo@apple.com>
Optimize Function.prototype.toString
https://bugs.webkit.org/show_bug.cgi?id=226418
<rdar://77861846>
Reviewed by Saam Barati.
* microbenchmarks/function-to-string.js: Added.
(f):
(C):
(C.prototype.method1):
(C.prototype.method2):
(test):
(test2):
2021-06-03 Ross Kirsling <ross.kirsling@sony.com>
[JSC] Implement JIT ICs for InByVal
https://bugs.webkit.org/show_bug.cgi?id=226563
Reviewed by Saam Barati.
* microbenchmarks/in-by-val-int32.js: Added.
* microbenchmarks/in-by-val-string-index.js: Added.
* microbenchmarks/in-by-val-symbol.js: Added.
2021-06-03 Mark Lam <mark.lam@apple.com>
Fix an ASSERT in objectPrototypeHasOwnProperty() to account for TerminationException.
https://bugs.webkit.org/show_bug.cgi?id=226609
rdar://78465046
Reviewed by Robin Morisset.
* stress/termination-exception-in-objectPrototypeHasOwnProperty.js: Added.
2021-06-03 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Make $vm's accessor test functions robust against primitive |this|
https://bugs.webkit.org/show_bug.cgi?id=226591
Reviewed by Saam Barati.
* stress/test-static-accessor-on-primitive.js: Added.
(shouldThrow):
2021-05-28 Robin Morisset <rmorisset@apple.com>
Fix LikelyDenseUnsignedIntegerSet::clear()
https://bugs.webkit.org/show_bug.cgi?id=226388
rdar://78607433
Reviewed by Mark Lam.
* stress/stack-allocation-regression.js: Added.
(foo):
2021-05-28 Saam Barati <sbarati@apple.com>
Don't sink arguments past the context of the inline call frame they were created in
https://bugs.webkit.org/show_bug.cgi?id=226363
<rdar://78392801>
Reviewed by Filip Pizlo.
* stress/dont-sink-arguments-past-inline-call-frame.js: Added.
(foo):
(fooWrap):
(empty):
(bar):
2021-05-22 Ross Kirsling <ross.kirsling@sony.com>
Support Ergonomic Brand Checks proposal (`#x in obj`)
https://bugs.webkit.org/show_bug.cgi?id=221093
Reviewed by Caio Araujo Neponoceno de Lima.
* stress/private-in.js: Added.
* test262/config.yaml: Add feature flag.
2021-05-21 Angelos Oikonomopoulos <angelos@igalia.com>
Unskip type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value on MIPS
https://bugs.webkit.org/show_bug.cgi?id=226011
Unreviewed gardening.
Appears to no longer be flaky.
* stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js:
2021-05-20 Saam Barati <sbarati@apple.com>
[ Catalina Release JSC] A large number of JSC test appear to be flaky failing
https://bugs.webkit.org/show_bug.cgi?id=225998
<rdar://problem/78235001>
Reviewed by Yusuke Suzuki.
* stress/dont-link-virtual-calls-on-compiler-thread.js: Added.
2021-05-19 Robin Morisset <rmorisset@apple.com>
Fix typo in AirUseCounts
https://bugs.webkit.org/show_bug.cgi?id=225977
rdar://78210501
Reviewed by Mark Lam.
Add the testcase found by Tuomas.
* stress/register-allocator-stress.js: Added.
(foo):
2021-05-18 Keith Miller <keith_miller@apple.com>
Temporarily revert r276592 as it breaks some native apps
https://bugs.webkit.org/show_bug.cgi?id=225917
Unreviewed, revert.
* microbenchmarks/put-slow-no-cache-array.js: Removed.
* microbenchmarks/put-slow-no-cache-function.js: Removed.
* microbenchmarks/put-slow-no-cache-js-proxy.js: Removed.
* microbenchmarks/put-slow-no-cache-long-prototype-chain.js: Removed.
* microbenchmarks/put-slow-no-cache.js: Removed.
* microbenchmarks/reflect-set-with-receiver.js: Removed.
* stress/custom-get-set-proto-chain-put.js:
(getObjects):
(let.base.of.getBases):
* stress/module-namespace-access-set-fails.js: Removed.
* stress/put-non-reified-static-accessor-or-custom.js: Removed.
* stress/put-non-reified-static-function-or-custom.js: Removed.
* stress/put-to-primitive-non-reified-static-custom.js: Removed.
* stress/put-to-primitive.js: Removed.
* stress/put-to-proto-chain-overrides-put.js: Removed.
* stress/typed-array-canonical-numeric-index-string-set.js: Removed.
2021-05-17 Alexey Shvayka <shvaikalesh@gmail.com>
REGRESSION (r271119): Object methods defined with shorthand notation cannot access "caller" in non-strict mode
https://bugs.webkit.org/show_bug.cgi?id=225277
Reviewed by Darin Adler.
* stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Now covers #157461 and #157863.
* stress/function-caller-cross-realm-via-call-apply.js: Added, coverage for #34553.
* stress/function-hidden-as-caller.js: Also adds test case for #102276.
2021-05-16 Saam Barati <sbarati@apple.com>
DFGVarargsForwardingPhase shouldn't consult Flush
https://bugs.webkit.org/show_bug.cgi?id=225824
Reviewed by Filip Pizlo and Yusuke Suzuki.
* microbenchmarks/tail-call-forward-arguments-arguments-elimination.js: Added.
2021-05-15 Alexey Shvayka <shvaikalesh@gmail.com>
Turn callGetter() / callSetter() into instance methods
https://bugs.webkit.org/show_bug.cgi?id=225831
Reviewed by Ross Kirsling.
* microbenchmarks/put-slow-no-cache-setter.js: Added.
2021-05-07 Ross Kirsling <ross.kirsling@sony.com>
[JSC] Error#cause must recognize explicit undefined
https://bugs.webkit.org/show_bug.cgi?id=225535
Reviewed by Alexey Shvayka.
* test262/config.yaml:
Re-enable tests for this feature; they were all failing due to this quirk.
2021-05-07 Ross Kirsling <ross.kirsling@sony.com>
Update test262 (2021.05.07)
https://bugs.webkit.org/show_bug.cgi?id=225536
Reviewed by Alexey Shvayka.
* test262/config.yaml:
* test262/expectations.yaml:
* test262/latest-changes-summary.txt:
* test262/test/:
* test262/test262-Revision.txt:
2021-05-06 Mark Lam <mark.lam@apple.com>
Forbid further execution in jsc shell if execution is terminated.
https://bugs.webkit.org/show_bug.cgi?id=225410
rdar://77548608
Reviewed by Michael Saboff.
* stress/jsc-shell-forbid-execution-after-termination.js: Added.
2021-05-05 Saam Barati <sbarati@apple.com>
Update tests to use collectExtraSamplingProfilerData instead of collectSamplingProfilerDataForJSCShell
https://bugs.webkit.org/show_bug.cgi?id=225398
Reviewed by Mark Lam.
I forgot to update the tests to use the new option name.
* stress/sampling-profiler-code-origin.js:
* stress/sampling-profiler-richards.js:
2021-05-03 Mark Lam <mark.lam@apple.com>
Fix syntax error message for AUTOPLUSPLUS token.
https://bugs.webkit.org/show_bug.cgi?id=225308
rdar://76830934
Reviewed by Saam Barati.
* stress/prefix-plusplus-syntax-error-should-say-plusplus.js: Added.
2021-05-03 Dmitry Bezhetskov <dbezhetskov@igalia.com>
[WASM-Function-References] Add call_ref instruction
https://bugs.webkit.org/show_bug.cgi?id=222903
Reviewed by Yusuke Suzuki.
Add basic tests for new call_ref instruction:
https://github.com/WebAssembly/function-references/blob/master/proposals/function-references/Overview.md.
Add tests for calling same-instance wasm function, foreign-instance
wasm function and for calling imported js function.
* wasm.yaml:
* wasm/function-references/call_ref.js: Added.
(module):
(async basics):
(async indirectCall):
(async importHostCall):
* wasm/wasm.json:
2021-04-28 Mark Lam <mark.lam@apple.com>
Fix exception assertions in light of the TerminationException.
https://bugs.webkit.org/show_bug.cgi?id=225128
rdar://76694909
Reviewed by Robin Morisset.
* stress/suppress-TerminationException-in-JSFunction-prototypeForConstruction.js: Added.
2021-04-27 Angelos Oikonomopoulos <angelos@igalia.com>
[JSC] Skip tests failing on Loongson 3A4000
https://bugs.webkit.org/show_bug.cgi?id=225091
Reviewed by Yusuke Suzuki.
This new hardware is much faster when it comes to running JSC tests (and
hopefully more reliable than the ci20 boards currently in use), so skip the
couple of tests that fail, so that we can test the Loongson box in production.
* ChakraCore.yaml:
* stress/arguments-properties-order.js:
2021-04-26 Mark Lam <mark.lam@apple.com>
%TypedArray%.prototype.sort() should not use a regular array as a temp buffer.
https://bugs.webkit.org/show_bug.cgi?id=225062
rdar://77021547
Reviewed by Yusuke Suzuki.
* stress/typedarray-sort-should-not-use-a-regular-array-as-temp-buffer.js: Added.
2021-04-26 Alexey Shvayka <shvaikalesh@gmail.com>
[JSC] OrdinarySet should invoke custom [[Set]] methods
https://bugs.webkit.org/show_bug.cgi?id=217916
Reviewed by Yusuke Suzuki.
* microbenchmarks/put-slow-no-cache-array.js: Added.
* microbenchmarks/put-slow-no-cache-function.js: Added.
* microbenchmarks/put-slow-no-cache-js-proxy.js: Added.
* microbenchmarks/put-slow-no-cache-long-prototype-chain.js: Added.
* microbenchmarks/put-slow-no-cache.js: Added.
* microbenchmarks/reflect-set-with-receiver.js: Added.
* stress/custom-get-set-proto-chain-put.js:
* stress/module-namespace-access-set-fails.js: Added.
* stress/put-non-reified-static-accessor-or-custom.js: Added.
* stress/put-non-reified-static-function-or-custom.js: Added.
* stress/put-to-primitive-non-reified-static-custom.js: Added.
* stress/put-to-primitive.js: Added.
* stress/put-to-proto-chain-overrides-put.js: Added.
* stress/typed-array-canonical-numeric-index-string-set.js: Added.
2021-04-22 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Baseline should have fast path for switch_imm
https://bugs.webkit.org/show_bug.cgi?id=224521
Reviewed by Tadeu Zagallo.
* stress/switch-imm-baseline.js: Added.
(shouldBe):
(test):
2021-04-21 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] DFG / FTL should inline switch_string
https://bugs.webkit.org/show_bug.cgi?id=224578
Reviewed by Mark Lam.
* microbenchmarks/switch-inlining.js: Added.
(inner):
(outer):
* stress/switch-inlining-nested.js: Added.
(shouldBe):
(inner):
(outer):
2021-04-21 Caio Lima <ticaiolima@gmail.com>
[JSC] Unskip some tests for ARMv7 and MIPS
https://bugs.webkit.org/show_bug.cgi?id=224813
Unreviewed test gardening.
* stress/has-own-property-name-cache-symbols-and-strings.js:
* stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js:
2021-04-20 Paulo Matos <pmatos@igalia.com>
Unskip couple of tests for armv7l and mips
https://bugs.webkit.org/show_bug.cgi?id=224607
Unreviewed gardening.
* stress/check-stack-overflow-before-value-profiling-arguments.js:
(fullGC):
* stress/intl-suppored-locales-of.js:
2021-04-20 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Limit memory allocation size of JSTests/stress/early-return-from-builtin.js
https://bugs.webkit.org/show_bug.cgi?id=224803
<rdar://problem/75597901>
Reviewed by Ryosuke Niwa.
Add limit to JSTests/stress/early-return-from-builtin.js to avoid infinite allocation.
* stress/early-return-from-builtin.js:
(let.iter.Symbol.iterator):
2021-04-19 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Rebaseline test results for new ICU
https://bugs.webkit.org/show_bug.cgi?id=224792
Reviewed by Mark Lam.
This patch updates some intl- tests' expectation since it is changed because of ICU CLDR data change.
* stress/intl-datetimeformat-formatrange-relevant-extensions-ja.js:
(shouldBeOneOfThem):
(vm.icuVersion):
* stress/intl-datetimeformat-formatrange-relevant-extensions.js:
(shouldBeOneOfThem):
* stress/intl-datetimeformat-formatrange-should-not-handle-gregorian-change-date.js:
(shouldBe):
(vm.icuHeaderVersion):
* stress/intl-datetimeformat-formatrangetoparts-relevant-extensions-ja.js:
(normalize):
(shouldBe):
(compareParts):
(shouldBeOneOfParts):
(shouldBeParts):
(Intl.DateTimeFormat.prototype.formatRangeToParts.shouldBeOneOfParts.fmt5.formatRangeToParts):
(Intl.DateTimeFormat.prototype.formatRangeToParts.vm.icuVersion):
(Intl.DateTimeFormat.prototype.formatRangeToParts.shouldBeOneOfParts.fmt7.formatRangeToParts):
(Intl.DateTimeFormat.prototype.formatRangeToParts.shouldBeOneOfParts.fmt9.formatRangeToParts):
(Intl.DateTimeFormat.prototype.formatRangeToParts.shouldBeOneOfParts.fmt11.formatRangeToParts):
(Intl.DateTimeFormat.prototype.formatRangeToParts.shouldBeOneOfParts.fmt13.formatRangeToParts):
(Intl.DateTimeFormat.prototype.formatRangeToParts.shouldBeParts.fmt13.formatRangeToParts):
(Intl.DateTimeFormat.prototype.formatRangeToParts.shouldBeOneOfParts.fmt14.formatRangeToParts):
(Intl.DateTimeFormat.prototype.formatRangeToParts.shouldBeOneOfParts.fmt15.formatRangeToParts):
(Intl.DateTimeFormat.prototype.formatRangeToParts.shouldBeOneOfParts.fmt16.formatRangeToParts):
(Intl.DateTimeFormat.prototype.formatRangeToParts.compareParts.fmt1.formatRangeToParts): Deleted.
(Intl.DateTimeFormat.prototype.formatRangeToParts.compareParts.fmt2.formatRangeToParts): Deleted.
(Intl.DateTimeFormat.prototype.formatRangeToParts.compareParts.fmt3.formatRangeToParts): Deleted.
(Intl.DateTimeFormat.prototype.formatRangeToParts.compareParts.fmt4.formatRangeToParts): Deleted.
(Intl.DateTimeFormat.prototype.formatRangeToParts.compareParts.fmt5.formatRangeToParts): Deleted.
(Intl.DateTimeFormat.prototype.formatRangeToParts.compareParts.fmt6.formatRangeToParts): Deleted.
(Intl.DateTimeFormat.prototype.formatRangeToParts.compareParts.fmt7.formatRangeToParts): Deleted.
(Intl.DateTimeFormat.prototype.formatRangeToParts.compareParts.fmt8.formatRangeToParts): Deleted.
(Intl.DateTimeFormat.prototype.formatRangeToParts.compareParts.fmt9.formatRangeToParts): Deleted.
(Intl.DateTimeFormat.prototype.formatRangeToParts.compareParts.fmt10.formatRangeToParts): Deleted.
(Intl.DateTimeFormat.prototype.formatRangeToParts.compareParts.fmt11.formatRangeToParts): Deleted.
(Intl.DateTimeFormat.prototype.formatRangeToParts.compareParts.fmt12.formatRangeToParts): Deleted.
(Intl.DateTimeFormat.prototype.formatRangeToParts.compareParts.fmt13.formatRangeToParts): Deleted.
(Intl.DateTimeFormat.prototype.formatRangeToParts.compareParts.fmt14.formatRangeToParts): Deleted.
(Intl.DateTimeFormat.prototype.formatRangeToParts.compareParts.fmt15.formatRangeToParts): Deleted.
(Intl.DateTimeFormat.prototype.formatRangeToParts.compareParts.fmt16.formatRangeToParts): Deleted.
* stress/intl-datetimeformat-formatrangetoparts-relevant-extensions.js:
(normalize):
(shouldBe):
(compareParts):
(shouldBeOneOfParts):
(shouldBeParts):
* stress/intl-datetimeformat-formatrangetoparts-should-not-handle-gregorian-change-date.js:
(shouldBe):
* stress/intl-datetimeformat.js:
(shouldBeOneOfThem):
2021-04-16 Guillaume Emont <guijemont@igalia.com>
[JSC] Unskip stress/intl-parse-unicode-subtags.js on arm
https://bugs.webkit.org/show_bug.cgi?id=224679
Unreviewed test gardening.
* stress/intl-parse-unicode-subtags.js: Unskipped, as it passes fine
now.
2021-04-16 Xan Lopez <xan@igalia.com>
[JSC][ARMv7] Unskip stress/put-direct-index-broken-2.js
https://bugs.webkit.org/show_bug.cgi?id=224661
Unreviewed test gardening.
* stress/put-direct-index-broken-2.js: unskip on ARMv7, could not
reproduce locally the crash we saw earlier.
2021-04-15 Mark Lam <mark.lam@apple.com>
HashMapImpl::rehash() should use a version of jsMapHash that cannot throw.
https://bugs.webkit.org/show_bug.cgi?id=224610
rdar://76698910
Reviewed by Yusuke Suzuki.
* stress/suppress-TerminationException-in-HashMapImpl-rehash.js: Added.
2021-04-14 Mark Lam <mark.lam@apple.com>
Add missing exception check in operationGetPrivateNameOptimize().
https://bugs.webkit.org/show_bug.cgi?id=224592
rdar://76645873
Reviewed by Yusuke Suzuki.
* stress/suppress-TerminationException-in-operationGetPrivateNameOptimize.js: Added.
2021-04-14 Mark Lam <mark.lam@apple.com>
Defer TerminationExceptions when evaluating ASSERT in HashMapIml::addNormalized().
https://bugs.webkit.org/show_bug.cgi?id=224565
rdar://76645980
Reviewed by Yusuke Suzuki.
* stress/suppress-TerrminationException-in-ASSERT-in-HashMapImpl-addNormalized.js: Added.
2021-04-14 Guillaume Emont <guijemont@igalia.com>
[JSC] Unskip stress/intl-segmenter.js
https://bugs.webkit.org/show_bug.cgi?id=224553
Unreviewed test gardening.
It shouldn't fail any more on our bots now that our handling of libicu
is more robust.
* stress/intl-segmenter.js:
2021-04-14 Angelos Oikonomopoulos <angelos@igalia.com>
[JSC] Unskip typedarray-functions-with-neutered.js on MIPS
https://bugs.webkit.org/show_bug.cgi?id=224428
Unreviewed test gardening.
This appears to no longer fail.
* stress/typedarray-functions-with-neutered.js:
2021-04-13 Angelos Oikonomopoulos <angelos@igalia.com>
[JSC] Unskip stress/intl-displaynames.js on ARM
https://bugs.webkit.org/show_bug.cgi?id=224427
Unreviewed test gardening.
* stress/intl-displaynames.js:
2021-04-10 Mark Lam <mark.lam@apple.com>
Enable VMTraps checks in RETURN_IF_EXCEPTION.
https://bugs.webkit.org/show_bug.cgi?id=224078
rdar://75037057
Reviewed by Keith Miller.
* stress/watchdog-fire-while-in-forEachInIterable.js: Added.
2021-04-07 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] DUCET level-1 weighs are equal if characters are alphabets
https://bugs.webkit.org/show_bug.cgi?id=224047
Reviewed by Saam Barati and Mark Lam.
* stress/ducet-level-3-or-4-comparison.js: Added.
(shouldBe):
2021-04-07 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Update test262
https://bugs.webkit.org/show_bug.cgi?id=224272
Reviewed by Ross Kirsling.
* test262/latest-changes-summary.txt:
* test262/test/intl402/DisplayNames/options-getoptionsobject.js: Added.
* test262/test/intl402/ListFormat/constructor/constructor/options-getoptionsobject.js: Renamed from JSTests/test262/test/intl402/ListFormat/constructor/constructor/options-toobject.js.
* test262/test/intl402/ListFormat/constructor/constructor/options-toobject-prototype.js: Removed.
* test262/test/intl402/Segmenter/constructor/constructor/options-getoptionsobject.js: Added.
* test262/test/intl402/Segmenter/constructor/constructor/options-toobject-prototype.js: Removed.
* test262/test/intl402/Segmenter/constructor/constructor/options-toobject.js: Removed.
* test262/test/language/expressions/in/rhs-yield-absent-non-strict.js: Added.
* test262/test/language/expressions/in/rhs-yield-absent-strict.js: Added.
* test262/test/language/expressions/in/rhs-yield-present.js: Added.
(isNameIn):
* test262/test262-Revision.txt:
2021-04-06 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] WasmMemory caging should care about nullptr
https://bugs.webkit.org/show_bug.cgi?id=224268
<rdar://problem/74654838>
Reviewed by Mark Lam.
* wasm/stress/4g-memory-cage.js: Added.
(async test):
* wasm/stress/more-than-4g-offset-access-oom.js: Added.
(async test):
* wasm/stress/null-memory-cage-explicit.js: Added.
(async test):
* wasm/stress/null-memory-cage.js: Added.
(async test):
2021-04-06 Alexey Shvayka <shvaikalesh@gmail.com>
Symbol and BigInt wrapper objects should perform OrdinaryToPrimitive
https://bugs.webkit.org/show_bug.cgi?id=224208
Reviewed by Yusuke Suzuki.
* stress/bigint-object-ordinary-toprimitive.js: Added.
* stress/symbol-object-ordinary-toprimitive.js: Added.
2021-04-06 Alexey Shvayka <shvaikalesh@gmail.com>
Array's toString() is incorrect if join() is non-callable
https://bugs.webkit.org/show_bug.cgi?id=224215
Reviewed by Yusuke Suzuki.
* stress/array-toString-non-callable-join.js: Added.
2021-04-05 Keith Miller <keith_miller@apple.com>
DFG arity fixup nodes should exit to the caller's call opcode
https://bugs.webkit.org/show_bug.cgi?id=223278
Reviewed by Saam Barati.
* stress/dfg-arity-fixup-uses-callers-exit-origin.js: Added.
(main.v22):
(main.v30):
(main.try.v40):
(main.try.v47):
(main.try.v56):
(main.):
(main):
2021-04-02 Alexey Shvayka <shvaikalesh@gmail.com>
Reduce bytecode instruction count emitted for `class extends`
https://bugs.webkit.org/show_bug.cgi?id=223884
Reviewed by Yusuke Suzuki.
* ChakraCore/test/Error/validate_line_column.baseline-jsc:
2021-04-02 Jessica Tallon <jtallon@igalia.com>
Add tests for the new type method on certain JS-API wasm objects.
https://bugs.webkit.org/show_bug.cgi?id=222412
Reviewed by Yusuke Suzuki.
* wasm/js-api/global.js: Added.
(assert.throws):
* wasm/js-api/table.js:
(assert.truthy):
* wasm/js-api/test_memory.js:
2021-04-01 Alexey Shvayka <shvaikalesh@gmail.com>
Optimize createListFromArrayLike() and Proxy's [[OwnPropertyKeys]] method
https://bugs.webkit.org/show_bug.cgi?id=223928
Reviewed by Yusuke Suzuki.
* microbenchmarks/json-stringify-array-replacer.js:
Reduce running time from over 350ms to ~60ms.
* microbenchmarks/reflect-own-keys-proxy-2.js: Added.
* microbenchmarks/reflect-own-keys-proxy.js: Added.
2021-03-31 Mark Lam <mark.lam@apple.com>
Missing exception check in HashMapImpl::add().
https://bugs.webkit.org/show_bug.cgi?id=224007
rdar://76053163
Reviewed by Saam Barati.
* stress/missing-exception-check-in-HashMapImpl-add.js: Added.
2021-03-31 Alexey Shvayka <shvaikalesh@gmail.com>
Optimize constructors of ES6 collections
https://bugs.webkit.org/show_bug.cgi?id=223953
Reviewed by Yusuke Suzuki.
* microbenchmarks/map-constructor.js:
* microbenchmarks/set-constructor.js: Added.
* microbenchmarks/weak-map-constructor.js: Added.
* microbenchmarks/weak-set-constructor.js: Added.
* stress/map-constructor-adder.js:
* stress/set-constructor-adder.js:
* stress/weak-map-constructor-adder-error-cross-realm.js: Added.
* stress/weak-map-constructor-adder.js:
* stress/weak-set-constructor-adder-error-cross-realm.js: Added.
* stress/weak-set-constructor-adder.js:
* stress/weak-set-constructor.js:
2021-03-29 Ryan Haddad <ryanhaddad@apple.com>
Unreviewed test gardening.
* stress/early-return-from-builtin.js: Disable this test for memoryLimited configurations.
2021-03-26 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Use AppleICU SPI for canonicalization
https://bugs.webkit.org/show_bug.cgi?id=223552
Reviewed by Ryosuke Niwa.
* stress/intl-canonical-locale-alias-mapping.js: Added.
(shouldBe):
(Intl.getCanonicalLocales):
2021-03-25 Truitt Savell <tsavell@apple.com>
Unreviewed, reverting r275056.
This is no longer needed
Reverted changeset:
"stress/early-return-from-builtin.js.default is failing on iOS
JSC testers"
https://commits.webkit.org/r275056
2021-03-25 Truitt Savell <tsavell@apple.com>
stress/early-return-from-builtin.js.default is failing on iOS JSC testers
rdar://75597901
Unreviewed test gardening.
* stress/early-return-from-builtin.js:
2021-03-25 Saam Barati <sbarati@apple.com>
early-return-from-builtin.js should try/catch in case of OOM
https://bugs.webkit.org/show_bug.cgi?id=223756
Reviewed by Yusuke Suzuki.
It's throwing an OOM on iOS.
* stress/early-return-from-builtin.js:
2021-03-24 Michael Saboff <msaboff@apple.com>
[YARR] Interpreter incorrectly matches non-BMP characters with multiple . w/dotAll flag
https://bugs.webkit.org/show_bug.cgi?id=223666
Reviewed by Mark Lam.
Added tests for dotAll. Also made sure that we test both JIT and non-JIT execution.
* stress/regexp-dot-match-nonBMP.js:
2021-03-24 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Rope string equal operation should first check length
https://bugs.webkit.org/show_bug.cgi?id=223678
Reviewed by Mark Lam.
* stress/redefine-property-same-value-exception-check.js:
(shouldThrow):
2021-03-23 Robin Morisset <rmorisset@apple.com>
Object.freeze(this) at the global scope can lose a reference to a WatchpointSet
https://bugs.webkit.org/show_bug.cgi?id=223608
Reviewed by Yusuke Suzuki.
* stress/freeze-global-object.js: Added.
(foo):
2021-03-22 Saam Barati <sbarati@apple.com>
LiteralParser shouldn't make error messages of length ~2^31
https://bugs.webkit.org/show_bug.cgi?id=223483
<rdar://75572255>
Reviewed by Robin Morisset.
* stress/literal-parser-error-message-oom.js: Added.
2021-03-22 Michael Saboff <msaboff@apple.com>
[YARR] Interpreter incorrectly matches non-BMP characters with multiple .
https://bugs.webkit.org/show_bug.cgi?id=223498
Reviewed by Yusuke Suzuki.
New test.
* stress/regexp-dot-match-nonBMP.js: Added.
(shouldMatch):
(shouldntMatch):
2021-03-22 Yusuke Suzuki <ysuzuki@apple.com>
[JSC] Intl.Locale should not assume is8Bit
https://bugs.webkit.org/show_bug.cgi?id=223553
Reviewed by Ross Kirsling.
* stress/intl-locale-non-8bit.js: Added.
(shouldBe):
2021-03-19 Mark Lam <mark.lam@apple.com>
BrandedStructure should keep its members alive.
https://bugs.webkit.org/show_bug.cgi?id=223495
rdar://75565765
Reviewed by Saam Barati.
* stress/BrandedStructure-should-keep-its-members-alive.js: Added.
== Rolled over to ChangeLog-2021-03-18 ==