From f09435a459bfe231f6556da80562470f8539c684 Mon Sep 17 00:00:00 2001
From: test262-automation <test262-automation@bocoup.com>
Date: Thu, 4 Oct 2018 18:37:07 +0000
Subject: [PATCH] [javascriptcore-test262-automation] Changes from
 https://github.com/webkit/webkit.git at sha 9dc12cff08 on Thu Oct 04 2018
 18:33:55 GMT+0000 (Coordinated Universal Time)

---
 ...ays-filter-for-low-type-check-functions.js | 31 +++++++++++++++++++
 .../javascriptcore/stress/regress-190187.js   | 18 +++++++++++
 2 files changed, 49 insertions(+)
 create mode 100644 implementation-contributed/javascriptcore/stress/ftl-should-always-filter-for-low-type-check-functions.js
 create mode 100644 implementation-contributed/javascriptcore/stress/regress-190187.js

diff --git a/implementation-contributed/javascriptcore/stress/ftl-should-always-filter-for-low-type-check-functions.js b/implementation-contributed/javascriptcore/stress/ftl-should-always-filter-for-low-type-check-functions.js
new file mode 100644
index 0000000000..0a1f4f3e09
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/ftl-should-always-filter-for-low-type-check-functions.js
@@ -0,0 +1,31 @@
+//@ runDefault("--useConcurrentJIT=0", "--jitPolicyScale=0", "--maximumInliningDepth=2")
+
+function foo(x, y) {
+    var w = 0;
+    for (var i = 0; i < x.length; ++i) {
+        for (var j = 0; j < x.length; ++j)
+            w += foo(j, i);
+        y[i] = w;
+    }
+}
+
+function test(x, a3) {
+      a1 = [];
+      a2 = [];
+
+    for (i = 0; i < x; ++i)
+        a1[i] = 0;
+
+    for (i = 0; i < 10; ++i) {
+        foo(a3, a2);
+        foo(a3, a1);
+    }
+}
+noDFG(test);
+
+a3 = [];
+for (var i = 0; i < 3; ++i)
+    a3[i] = 0;
+
+for (var i = 3; i <= 12; i *= 2)
+    test(i, a3);
diff --git a/implementation-contributed/javascriptcore/stress/regress-190187.js b/implementation-contributed/javascriptcore/stress/regress-190187.js
new file mode 100644
index 0000000000..72de2d8357
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/regress-190187.js
@@ -0,0 +1,18 @@
+//@ runDefault
+//@ skip if $memoryLimited or $buildType == "debug"
+//@ slow!
+
+try {
+    var v1 = "AAAAAAAAAAA";
+    for(var i = 0; i < 27; i++)
+      v1 = v1 + v1;
+    var v2;
+    var v3 = RegExp.prototype.toString.call({source:v1,flags:v1});
+    v3 += v1;
+    v2 += v3.localeCompare(v1);
+} catch (e) {
+    exception = e;
+}
+
+if (exception != "Error: Out of memory")
+    throw "FAILED";