Merge pull request #2063 from test262-automation/javascriptcore-test262-automation-export-7a0293f26c

Import test changes from JavaScriptCore

implementation-contributed/curation_logs/javascriptcore.json

@@ -1,6 +1,6 @@
 {
-  "sourceRevisionAtLastExport": "c0dba7aed4",
-  "targetRevisionAtLastExport": "7a0293f26c",
+  "sourceRevisionAtLastExport": "8493f293ea",
+  "targetRevisionAtLastExport": "a2c0e3fdba",
   "curatedFiles": {
     "/stress/Number-isNaN-basics.js": "DELETED_IN_TARGET",
     "/stress/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js": "DELETED_IN_TARGET",

implementation-contributed/javascriptcore/stress/availability-was-cleared-when-locals-are-not-live.js

@@ -0,0 +1,37 @@
+//@ runDefault("--jitPolicyScale=0", "--useConcurrentJIT=false")
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error('bad value: ' + actual);
+}
+noInline(shouldBe);
+
+var a;
+
+function foo(x, y, z) {
+    baz(a);
+    0 + (x ? a : [] + 0);
+    return y;
+}
+
+function bar() {
+    return foo.apply(null, arguments);
+}
+
+function baz(p) {
+    if (p) {
+        return bar(1, 1, 0);
+    }
+}
+
+baz(1);
+
+for (let i = 0; i < 1; i++) {
+    foo(1);
+}
+
+for (let i = 0; i < 10000; i++) {
+    baz();
+}
+
+let hello = baz(1);
+shouldBe(hello, 1);

implementation-contributed/javascriptcore/stress/big-int-value-op-update-gc-rules.js

@@ -0,0 +1,105 @@
+//@ runBigIntEnabled
+
+function assert(a, e) {
+    if (a !== e)
+        throw new Error("Expected: " + e + " but got: " + a);
+}
+
+function doesGCAdd(a) {
+    let o = {};
+    let c = a + 1n;
+    o.b = c;
+
+    return o;
+}
+noInline(doesGCAdd);
+
+for (var i = 0; i < 10000; i++) {
+    let o = doesGCAdd(3n);
+    assert(o.b, 4n);
+}
+
+function doesGCSub(a) {
+    let o = {};
+    let c = a - 1n;
+    o.b = c;
+
+    return o;
+}
+noInline(doesGCSub);
+
+for (var i = 0; i < 10000; i++) {
+    let o = doesGCSub(3n);
+    assert(o.b, 2n);
+}
+
+function doesGCDiv(a) {
+    let o = {};
+    let c = a / 2n;
+    o.b = c;
+
+    return o;
+}
+noInline(doesGCDiv);
+
+for (var i = 0; i < 10000; i++) {
+    let o = doesGCDiv(4n);
+    assert(o.b, 2n);
+}
+
+function doesGCMul(a) {
+    let o = {};
+    let c = a * 2n;
+    o.b = c;
+
+    return o;
+}
+noInline(doesGCMul);
+
+for (var i = 0; i < 10000; i++) {
+    let o = doesGCMul(4n);
+    assert(o.b, 8n);
+}
+
+function doesGCBitAnd(a) {
+    let o = {};
+    let c = a & 0b11n;
+    o.b = c;
+
+    return o;
+}
+noInline(doesGCBitAnd);
+
+for (var i = 0; i < 10000; i++) {
+    let o = doesGCBitAnd(0b1010n);
+    assert(o.b, 0b10n);
+}
+
+function doesGCBitOr(a) {
+    let o = {};
+    let c = a | 0b11n;
+    o.b = c;
+
+    return o;
+}
+noInline(doesGCBitOr);
+
+for (var i = 0; i < 10000; i++) {
+    let o = doesGCBitOr(0b10n);
+    assert(o.b, 0b11n);
+}
+
+function doesGCBitXor(a) {
+    let o = {};
+    let c = a ^ 0b11n;
+    o.b = c;
+
+    return o;
+}
+noInline(doesGCBitXor);
+
+for (var i = 0; i < 10000; i++) {
+    let o = doesGCBitXor(0b10n);
+    assert(o.b, 0b1n);
+}
+

implementation-contributed/javascriptcore/stress/constant-fold-double-rep-into-double-constant.js

@@ -0,0 +1,14 @@
+function bar(o) {
+    for (let i = 0; i < 2; i++)
+        o[i] = undefined;
+    o.length = undefined;
+    return o;
+}
+
+function foo(a) {
+    bar(a);
+    undefined + bar(0) + bar(0);
+    for(let i = 0; i < 10000000; i++) {}
+}
+
+foo({});

implementation-contributed/javascriptcore/stress/data-view-set-intrinsic-undefined-result-2.js

@@ -0,0 +1,11 @@
+function foo(view) {
+    return view.setInt8(0, 0);
+}
+noInline(foo);
+
+let a = new Int8Array(10);
+let dataView = new DataView(a.buffer);
+for (let i = 0; i < 10000; ++i) {
+    if (foo(dataView) !== undefined)
+        throw new Error("Bad!")
+}

implementation-contributed/javascriptcore/stress/data-view-set-intrinsic-undefined-result.js

@@ -0,0 +1,20 @@
+let setInt8 = DataView.prototype.setInt8;
+
+function foo() {
+  new bar();
+  xyz(setInt8(0, 0));
+}
+
+function bar(a) {
+  if (a) {
+    return;
+  }
+  if (0 === undefined) {
+  }
+  a = + String(0);
+  foo(0);
+}
+
+try {
+    foo();
+} catch { }

implementation-contributed/javascriptcore/stress/dfg-to-string-on-int-does-gc.js

@@ -0,0 +1,26 @@
+//@ requireOptions("--exceptionStackTraceLimit=0", "--defaultErrorStackTraceLimit=0", "--forceRAMSize=1000000", "--forceDebuggerBytecodeGeneration=1", "--useZombieMode=1", "--jitPolicyScale=0", "--collectContinuously=1", "--useConcurrentJIT=0")
+
+function assert(b) {
+    if (!b)
+        throw new Error('aa');
+}
+
+var exception;
+try {
+    let target = function (x, y) {
+        const actual = '' + x;
+        target(x);
+    };
+    let handler = {
+        apply: function (theTarget, thisArg, argArray) {
+            return theTarget.apply([], argArray);
+        }
+    };
+    let proxy = new Proxy(target, handler);
+    assert(proxy(10, 20) === 'foo');
+} catch(e) {
+    exception = e;
+}
+
+if (exception != "RangeError: Maximum call stack size exceeded.")
+    throw "FAILED";

implementation-contributed/javascriptcore/stress/dfg-to-string-on-string-object-does-not-gc.js

@@ -0,0 +1,26 @@
+//@ requireOptions("--exceptionStackTraceLimit=0", "--defaultErrorStackTraceLimit=0", "--forceRAMSize=1000000", "--forceDebuggerBytecodeGeneration=1", "--useZombieMode=1", "--jitPolicyScale=0", "--collectContinuously=1", "--useConcurrentJIT=0")
+
+function assert(b) {
+    if (!b)
+        throw new Error('aa');
+}
+
+var exception;
+try {
+    let target = function (x, y) {
+        const actual = '' + x;
+        target(x);
+    };
+    let handler = {
+        apply: function (theTarget, thisArg, argArray) {
+            return theTarget.apply([], argArray);
+        }
+    };
+    let proxy = new Proxy(target, handler);
+    assert(proxy(new String("10"), new String("20")) === 'foo');
+} catch(e) {
+    exception = e;
+}
+
+if (exception != "RangeError: Maximum call stack size exceeded.")
+    throw "FAILED";

implementation-contributed/javascriptcore/stress/dfg-to-string-on-string-or-string-object-does-not-gc.js

@@ -0,0 +1,34 @@
+//@ requireOptions("--exceptionStackTraceLimit=0", "--defaultErrorStackTraceLimit=0", "--forceRAMSize=1000000", "--forceDebuggerBytecodeGeneration=1", "--useZombieMode=1", "--jitPolicyScale=0", "--collectContinuously=1", "--useConcurrentJIT=0")
+
+function assert(b) {
+    if (!b)
+        throw new Error('aa');
+}
+
+let alternate = true;
+var exception;
+try {
+    function alter(x) {
+        alternate = !alternate;
+        if (alternate)
+            return new String(x);
+        return x;
+    }
+    noInline(alter);
+    let target = function (x, y) {
+        const actual = '' + alter(x);
+        target(x);
+    };
+    let handler = {
+        apply: function (theTarget, thisArg, argArray) {
+            return theTarget.apply([], argArray);
+        }
+    };
+    let proxy = new Proxy(target, handler);
+    assert(proxy("10", "20") === 'foo');
+} catch(e) {
+    exception = e;
+}
+
+if (exception != "RangeError: Maximum call stack size exceeded.")
+    throw "FAILED";

implementation-contributed/javascriptcore/stress/global-lexical-binding-epoch-should-be-correct-one.js

@@ -0,0 +1,31 @@
+globalThis.a = 0;
+function f1(v)
+{
+    let x = 40;
+    function f2() {
+        x;
+        let y = 41;
+        function f3() {
+            let z = 44;
+            function f4() {
+                z;
+                if (v)
+                    return a;
+                return 1;
+            }
+            return f4();
+        }
+        return f3();
+    }
+    return f2();
+}
+var N = 2;
+for (var i = 0; i < N; ++i) {
+    $.evalScript(`let i${i} = 42`);
+}
+if (f1(false) !== 1) {
+    throw new Error('first');
+}
+$.evalScript(`let a = 42`);
+if (f1(true) !== 42)
+    throw new Error('second');

implementation-contributed/javascriptcore/stress/json-parse-big-object.js

@@ -0,0 +1,15 @@
+
+var obj = {
+    "foo1": { "foo2": { "foo3":  { "foo4":  { "foo5":  { "foo6":  { "foo7": [
+        { "bar1":  "a".repeat(670)},
+        { "bar2":  "a".repeat(15771)},
+    ]
+    }}}}}}};
+
+function doTest(x) {
+    for (let i=1; i<10000; i++) {
+        var s = JSON.stringify(x);
+    }
+}
+
+doTest(obj);

implementation-contributed/javascriptcore/stress/let-lexical-binding-shadow-existing-global-property-ftl.js

@@ -40,6 +40,7 @@ for (var i = 0; i < 1e6; ++i)
     shouldBe(get(), 3);
 
 foo();
+shouldBe(globalThis.bar, 4);
 shouldBe(bar, 4);
 shouldBe(get(), 4);
 

implementation-contributed/javascriptcore/stress/new-largeish-contiguous-array-with-size.js

@@ -0,0 +1,47 @@
+// We only need one run of this with any GC or JIT strategy. This test is not particularly fast.
+// Unfortunately, it needs to run for a while to test the thing it's testing.
+//@ if $architecture =~ /arm|mips/ then skip else runWithRAMSize(10000000) end
+//@ slow!
+
+function foo(x) {
+    return new Array(x);
+}
+
+noInline(foo);
+
+function test(size) {
+    var result = foo(size);
+    if (result.length != size)
+        throw "Error: bad result: " + result;
+    var sawThings = false;
+    for (var s in result)
+        sawThings = true;
+    if (sawThings)
+        throw "Error: array is in bad state: " + result;
+    result[0] = "42.5";
+    if (result[0] != "42.5")
+        throw "Error: array is in weird state: " + result;
+}
+
+var result = gcHeapSize();
+
+for (var i = 0; i < 1000; ++i) {
+    // The test was written when we found that large array allocations weren't being accounted for
+    // in that part of the GC's accounting that determined the GC trigger. Consequently, the GC
+    // would run too infrequently in this loop and we would use an absurd amount of memory when this
+    // loop exited.
+    test(50000);
+}
+
+// Last time I tested, the heap should be 3725734 before and 125782 after. I don't want to enforce
+// exactly that. If you regress the accounting code, the GC heap size at this point will be much
+// more than that.
+var result = gcHeapSize();
+if (result > 10000000)
+    throw "Error: heap too big before forced GC: " + result;
+
+// Do a final check after GC, just for sanity.
+gc();
+result = gcHeapSize();
+if (result > 1000000)
+    throw "Error: heap too big after forced GC: " + result;

implementation-contributed/javascriptcore/stress/object-allocation-sinking-phase-must-only-move-allocations-if-stack-trace-is-still-valid.js

@@ -0,0 +1,30 @@
+//@ runDefault("--useConcurrentJIT=0", "--jitPolicyScale=0", "--collectContinuously=1")
+
+let thing = []
+
+function bar(x) {
+    thing.push(x);
+}
+
+function foo() {
+    let hello = function () {
+        let tmp = 1;
+        return function (num) {
+            if (tmp) {
+                if (num.length) {
+                }
+            }
+        };
+    }();
+
+    bar();
+    for (j = 0; j < 10000; j++) {
+        if (/\s/.test(' ')) {
+            hello(j);
+        }
+    }
+}
+
+for (let i=0; i<100; i++) {
+    foo();
+}

implementation-contributed/javascriptcore/stress/object-keys-osr-exit.js

@@ -0,0 +1,22 @@
+//@ runDefault("--forceEagerCompilation=1", "--useConcurrentJIT=0")
+
+function foo(x) {
+  if (x) {
+    return;
+  }
+  let obj = {
+    a: 0,
+    b: 0
+  };
+  foo(1);
+  let keys = Object.keys(obj);
+  foo();
+  keys.length
+}
+
+try {
+  foo();
+} catch(e) {
+  if (e != "RangeError: Maximum call stack size exceeded.")
+  throw "FAILED";
+}

implementation-contributed/javascriptcore/stress/object-tostring-changed-proto.js

@@ -1,18 +0,0 @@
-function shouldBe(actual, expected)
-{
-    if (actual !== expected)
-        throw new Error('bad value: ' + actual);
-}
-noInline(shouldBe);
-
-function test(value)
-{
-    return Object.prototype.toString.call(value);
-}
-noInline(test);
-
-var object = {};
-for (var i = 0; i < 1e5; ++i)
-    shouldBe(test(object), `[object Object]`);
-Object.prototype[Symbol.toStringTag] = "Hello";
-shouldBe(test(object), `[object Hello]`);

implementation-contributed/javascriptcore/stress/object-tostring-changed.js

@@ -1,18 +0,0 @@
-function shouldBe(actual, expected)
-{
-    if (actual !== expected)
-        throw new Error('bad value: ' + actual);
-}
-noInline(shouldBe);
-
-function test(value)
-{
-    return Object.prototype.toString.call(value);
-}
-noInline(test);
-
-var object = {};
-for (var i = 0; i < 1e5; ++i)
-    shouldBe(test(object), `[object Object]`);
-object[Symbol.toStringTag] = "Hello";
-shouldBe(test(object), `[object Hello]`);

implementation-contributed/javascriptcore/stress/object-tostring-misc.js

@@ -1,26 +0,0 @@
-function shouldBe(actual, expected)
-{
-    if (actual !== expected)
-        throw new Error('bad value: ' + actual);
-}
-noInline(shouldBe);
-
-function test(value)
-{
-    return Object.prototype.toString.call(value);
-}
-noInline(test);
-
-for (var i = 0; i < 1e6; ++i) {
-    switch (i % 3) {
-    case 0:
-        shouldBe(test(null), `[object Null]`);
-        break;
-    case 1:
-        shouldBe(test(undefined), `[object Undefined]`);
-        break;
-    case 2:
-        shouldBe(test(true), `[object Boolean]`);
-        break;
-    }
-}

implementation-contributed/javascriptcore/stress/object-tostring-other.js

@@ -1,19 +0,0 @@
-function shouldBe(actual, expected)
-{
-    if (actual !== expected)
-        throw new Error('bad value: ' + actual);
-}
-noInline(shouldBe);
-
-function test(value)
-{
-    return Object.prototype.toString.call(value);
-}
-noInline(test);
-
-for (var i = 0; i < 1e6; ++i) {
-    if (i & 0x1)
-        shouldBe(test(null), `[object Null]`);
-    else
-        shouldBe(test(undefined), `[object Undefined]`);
-}

implementation-contributed/javascriptcore/stress/object-tostring-untyped.js

@@ -1,50 +0,0 @@
-function shouldBe(actual, expected)
-{
-    if (actual !== expected)
-        throw new Error('bad value: ' + actual);
-}
-noInline(shouldBe);
-
-function test(value)
-{
-    return Object.prototype.toString.call(value);
-}
-noInline(test);
-
-var value0 = {};
-var value1 = { [Symbol.toStringTag]: "Hello" };
-var value2 = new Date();
-var value3 = "Hello";
-var value4 = 42;
-var value5 = Symbol("Cocoa");
-var value6 = 42.195;
-var value7 = false;
-
-for (var i = 0; i < 1e6; ++i) {
-    switch (i % 8) {
-    case 0:
-        shouldBe(test(value0), `[object Object]`);
-        break;
-    case 1:
-        shouldBe(test(value1), `[object Hello]`);
-        break;
-    case 2:
-        shouldBe(test(value2), `[object Date]`);
-        break;
-    case 3:
-        shouldBe(test(value3), `[object String]`);
-        break;
-    case 4:
-        shouldBe(test(value4), `[object Number]`);
-        break;
-    case 5:
-        shouldBe(test(value5), `[object Symbol]`);
-        break;
-    case 6:
-        shouldBe(test(value6), `[object Number]`);
-        break;
-    case 7:
-        shouldBe(test(value7), `[object Boolean]`);
-        break;
-    }
-}

implementation-contributed/javascriptcore/stress/op_add.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_bitand.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_bitor.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_bitxor.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_lshift-ConstVar.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_lshift-VarConst.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_lshift-VarVar.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_mod-ConstVar.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT("--timeoutMultiplier=1.5")
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_mod-VarConst.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT("--timeoutMultiplier=1.5")
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_mod-VarVar.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT("--timeoutMultiplier=1.5")
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_mul-ConstVar.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_mul-VarConst.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_mul-VarVar.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_rshift-ConstVar.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_rshift-VarConst.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_rshift-VarVar.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_sub-ConstVar.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_sub-VarConst.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_sub-VarVar.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_urshift-ConstVar.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_urshift-VarConst.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/op_urshift-VarVar.js

@@ -1,6 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm" or $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 //@ runFTLNoCJIT
 
 // If all goes well, this test module will terminate silently. If not, it will print

implementation-contributed/javascriptcore/stress/regress-190693.js

@@ -0,0 +1,63 @@
+// Reduced and tweaked code from const-semantics.js to reproduce https://bugs.webkit.org/show_bug.cgi?id=190693 easily.
+"use strict";
+function truth() {
+    return true;
+}
+noInline(truth);
+
+function assert(cond) {
+    if (!cond)
+        throw new Error("broke assertion");
+}
+noInline(assert);
+function shouldThrowInvalidConstAssignment(f) {
+    var threw = false;
+    try {
+        f();
+    } catch(e) {
+        if (e.name.indexOf("TypeError") !== -1 && e.message.indexOf("readonly") !== -1)
+            threw = true;
+    }
+    assert(threw);
+}
+noInline(shouldThrowInvalidConstAssignment);
+
+
+// ========== tests below ===========
+
+const NUM_LOOPS = 6000;
+
+;(function() {
+    function taz() {
+        const x = 20;
+        shouldThrowInvalidConstAssignment(function() { x = 20; });
+        assert(x === 20);
+        shouldThrowInvalidConstAssignment(function() { x += 20; });
+        assert(x === 20);
+        shouldThrowInvalidConstAssignment(function() { x -= 20; });
+        assert(x === 20);
+        shouldThrowInvalidConstAssignment(function() { x *= 20; });
+        assert(x === 20);
+        shouldThrowInvalidConstAssignment(function() { x /= 20; });
+        assert(x === 20);
+        shouldThrowInvalidConstAssignment(function() { x >>= 20; });
+        assert(x === 20);
+        shouldThrowInvalidConstAssignment(function() { x <<= 20; });
+        assert(x === 20);
+        shouldThrowInvalidConstAssignment(function() { x ^= 20; });
+        assert(x === 20);
+        shouldThrowInvalidConstAssignment(function() { x++; });
+        assert(x === 20);
+        shouldThrowInvalidConstAssignment(function() { x--; });
+        assert(x === 20);
+        shouldThrowInvalidConstAssignment(function() { ++x; });
+        assert(x === 20);
+        shouldThrowInvalidConstAssignment(function() { --x; });
+        assert(x === 20);
+    }
+    for (var i = 0; i < NUM_LOOPS; i++) {
+        taz();
+    }
+})();
+
+for(var i = 0; i < 1e6; ++i);

implementation-contributed/javascriptcore/stress/sampling-profiler-richards.js

@@ -1,6 +1,6 @@
 // [JSC] [Armv7] stress/sampling-profiler-richards.js crashes
 // https://bugs.webkit.org/show_bug.cgi?id=190426
-//@ skip if $architecture == "arm" and $hostOS == "linux"
+//@ skip if ["arm", "mips"].include?($architecture) and $hostOS == "linux"
 //@ skip if $architecture == "x86"
 //@ runDefault("--collectContinuously=1", "--useSamplingProfiler=1", "--collectSamplingProfilerDataForJSCShell=1")
 

implementation-contributed/javascriptcore/stress/scope-operation-cache-global-property-before-deleting.js

@@ -0,0 +1,27 @@
+function shouldThrow(func, errorMessage) {
+    var errorThrown = false;
+    var error = null;
+    try {
+        func();
+    } catch (e) {
+        errorThrown = true;
+        error = e;
+    }
+    if (!errorThrown)
+        throw new Error('not thrown');
+    if (String(error) !== errorMessage)
+        throw new Error(`bad error: ${String(error)}`);
+}
+noInline(shouldThrow);
+
+function bar()
+{
+    foo = 42;
+}
+
+bar();
+bar();
+delete globalThis.foo;
+$.evalScript(`const foo = 50`);
+
+shouldThrow(() => bar(), `TypeError: Attempted to assign to readonly property.`);

implementation-contributed/javascriptcore/stress/scope-operation-cache-global-property-bump-counter.js

@@ -0,0 +1,58 @@
+//@ runDefault("--thresholdForGlobalLexicalBindingEpoch=2")
+
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error('bad value: ' + actual);
+}
+noInline(shouldBe);
+
+foo1 = 1;
+foo2 = 2;
+function get1() {
+    return foo1;
+}
+noInline(get1);
+
+function get2() {
+    return foo2;
+}
+noInline(get2);
+
+function get1If(condition) {
+    if (condition)
+        return foo1;
+    return -1;
+}
+noInline(get1If);
+
+function get2If(condition) {
+    if (condition)
+        return foo2;
+    return -1;
+}
+noInline(get2If);
+
+for (var i = 0; i < 1e5; ++i) {
+    shouldBe(get1(), 1);
+    shouldBe(get2(), 2);
+    shouldBe(get1(), 1);
+    shouldBe(get2(), 2);
+    shouldBe(get1If(true), 1);
+    shouldBe(get2If(true), 2);
+    shouldBe(get1If(false), -1);
+    shouldBe(get2If(false), -1);
+}
+
+$.evalScript(`const foo1 = 41;`);
+$.evalScript(`const foo2 = 42;`);
+
+for (var i = 0; i < 1e3; ++i) {
+    shouldBe(get1(), 41);
+    shouldBe(get2(), 42);
+    shouldBe(get1(), 41);
+    shouldBe(get2(), 42);
+    shouldBe(get1If(false), -1);
+    shouldBe(get2If(false), -1);
+}
+shouldBe(get1If(true), 41);
+shouldBe(get2If(true), 42);

implementation-contributed/javascriptcore/stress/scope-operation-cache-global-property-even-if-it-fails.js

@@ -0,0 +1,23 @@
+function shouldThrow(func, errorMessage) {
+    var errorThrown = false;
+    var error = null;
+    try {
+        func();
+    } catch (e) {
+        errorThrown = true;
+        error = e;
+    }
+    if (!errorThrown)
+        throw new Error('not thrown');
+    if (String(error) !== errorMessage)
+        throw new Error(`bad error: ${String(error)}`);
+}
+noInline(shouldThrow);
+
+function foo() {
+    bar = 4;
+}
+Object.preventExtensions(this);
+foo();
+$.evalScript('const bar = 3;');
+shouldThrow(() => foo(), `TypeError: Attempted to assign to readonly property.`);

implementation-contributed/javascriptcore/stress/spread-forward-call-varargs-stack-overflow.js

@@ -1,7 +1,6 @@
 // FIXME: unskip when this is solved
 // https://bugs.webkit.org/show_bug.cgi?id=191163
-//@ skip if $architecture == "arm"
-//@ skip if $architecture == "x86"
+//@ skip if ["arm", "mips", "x86"].include?($architecture)
 function assert(b) {
     if (!b)
         throw new Error("Bad assertion");

implementation-contributed/javascriptcore/stress/try-get-by-id-should-spill-registers-dfg.js

@@ -0,0 +1,12 @@
+var createBuiltin = $vm.createBuiltin;
+
+let f = createBuiltin(`(function (arg) { 
+    let r = @tryGetById(arg, "prototype");
+    if (arg !== true) throw "Bad clobber of arg";
+    return r;
+})`);
+noInline(f);
+
+for (let i = 0; i < 10000; i++) {
+    f(true);
+}

implementation-contributed/javascriptcore/stress/value-recovery-of-double-displaced-in-jsstack-should-be-purified.js

@@ -0,0 +1,13 @@
+let buffer = new ArrayBuffer(4);
+let int32View = new Int32Array(buffer);
+int32View[0] = -1;
+let floatView = new Float32Array(buffer);
+
+function foo() {
+    let tmp = floatView[0];
+    for (let i = 0; i < 10000; ++i) { }
+    if (tmp) {}
+}
+
+for (let i = 0; i < 100; ++i)
+    foo();