From 5594c916bff85e94bf6e942ef9423a052677aa65 Mon Sep 17 00:00:00 2001
From: test262-automation <test262-automation@bocoup.com>
Date: Thu, 6 Sep 2018 18:21:27 +0000
Subject: [PATCH 1/2] [javascriptcore-test262-automation] Changes from
 https://github.com/webkit/webkit.git at sha 3ced8564a6 on Thu Sep 06 2018
 18:18:56 GMT+0000 (Coordinated Universal Time)

---
 .../javascriptcore/stress/regress-189185.js   |  2 +-
 .../stress/symbol-description.js              | 95 +++++++++++++++++++
 2 files changed, 96 insertions(+), 1 deletion(-)
 create mode 100644 implementation-contributed/javascriptcore/stress/symbol-description.js

diff --git a/implementation-contributed/javascriptcore/stress/regress-189185.js b/implementation-contributed/javascriptcore/stress/regress-189185.js
index c016efd268..14b901e7ca 100644
--- a/implementation-contributed/javascriptcore/stress/regress-189185.js
+++ b/implementation-contributed/javascriptcore/stress/regress-189185.js
@@ -1,5 +1,5 @@
-//@ runDefault
 //@ skip if $architecture == "x86"
+//@ runDefault
 // This passes if it does not crash.
 new WebAssembly.CompileError({
     valueOf() {
diff --git a/implementation-contributed/javascriptcore/stress/symbol-description.js b/implementation-contributed/javascriptcore/stress/symbol-description.js
new file mode 100644
index 0000000000..f2d8c760f0
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/symbol-description.js
@@ -0,0 +1,95 @@
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error(`bad value: ${String(actual)}`);
+}
+
+function shouldThrow(func, errorMessage) {
+    var errorThrown = false;
+    var error = null;
+    try {
+        func();
+    } catch (e) {
+        errorThrown = true;
+        error = e;
+    }
+    if (!errorThrown)
+        throw new Error('not thrown');
+    if (String(error) !== errorMessage)
+        throw new Error(`bad error: ${String(error)}`);
+}
+
+var s0 = Symbol("Cocoa");
+var s1 = Symbol("Cappuccino");
+var s2 = Symbol("");
+var s3 = Symbol();
+
+shouldBe(s0.description, "Cocoa");
+shouldBe(s0.toString(), "Symbol(Cocoa)");
+shouldBe(s1.description, "Cappuccino");
+shouldBe(s1.toString(), "Symbol(Cappuccino)");
+shouldBe(s2.description, "");
+shouldBe(s2.toString(), "Symbol()");
+shouldBe(s3.description, undefined);
+shouldBe(s3.toString(), "Symbol()");
+
+var o0 = Object(s0);
+var o1 = Object(s1);
+var o2 = Object(s2);
+var o3 = Object(s3);
+
+shouldBe(o0.description, "Cocoa");
+shouldBe(o0.toString(), "Symbol(Cocoa)");
+shouldBe(o1.description, "Cappuccino");
+shouldBe(o1.toString(), "Symbol(Cappuccino)");
+shouldBe(o2.description, "");
+shouldBe(o2.toString(), "Symbol()");
+shouldBe(o3.description, undefined);
+shouldBe(o3.toString(), "Symbol()");
+
+var descriptor = Object.getOwnPropertyDescriptor(Symbol.prototype, "description");
+shouldBe(descriptor.enumerable, false);
+shouldBe(descriptor.configurable, true);
+shouldBe(descriptor.set, undefined);
+shouldBe(typeof descriptor.get, "function");
+
+shouldThrow(() => {
+    "use strict";
+    s0.description = "Matcha";
+}, `TypeError: Attempted to assign to readonly property.`);
+shouldThrow(() => {
+    "use strict";
+    o0.description = "Matcha";
+}, `TypeError: Attempted to assign to readonly property.`);
+
+shouldThrow(() => {
+    descriptor.get.call({});
+}, `TypeError: Symbol.prototype.description requires that |this| be a symbol or a symbol object`);
+
+shouldThrow(() => {
+    descriptor.get.call(null);
+}, `TypeError: Symbol.prototype.description requires that |this| be a symbol or a symbol object`);
+
+shouldThrow(() => {
+    descriptor.get.call(undefined);
+}, `TypeError: Symbol.prototype.description requires that |this| be a symbol or a symbol object`);
+
+shouldThrow(() => {
+    descriptor.get.call(42);
+}, `TypeError: Symbol.prototype.description requires that |this| be a symbol or a symbol object`);
+
+shouldThrow(() => {
+    descriptor.get.call("Hello");
+}, `TypeError: Symbol.prototype.description requires that |this| be a symbol or a symbol object`);
+
+shouldThrow(() => {
+    descriptor.get.call(42.195);
+}, `TypeError: Symbol.prototype.description requires that |this| be a symbol or a symbol object`);
+
+shouldThrow(() => {
+    descriptor.get.call(false);
+}, `TypeError: Symbol.prototype.description requires that |this| be a symbol or a symbol object`);
+
+shouldBe(descriptor.get.call(s0), "Cocoa");
+shouldBe(descriptor.get.call(o0), "Cocoa");
+o0.__proto__ = {};
+shouldBe(descriptor.get.call(o0), "Cocoa");

From 5e03c6ce7bf10477dba8be85a01b46ce537e3c9f Mon Sep 17 00:00:00 2001
From: test262-automation <test262-automation@bocoup.com>
Date: Thu, 6 Sep 2018 18:21:31 +0000
Subject: [PATCH 2/2] [javascriptcore-test262-automation] Updated curation log
 with latest revision sha's from export and changed files.    
 sourceRevisionAtLastExport: 3ced8564a6 targetRevisionAtLastExport: f8c62a49f

---
 .../curation_logs/javascriptcore.json         |  4 +--
 .../javascriptcore/stress/regress-189124.js   | 31 +++++++++++++++++++
 2 files changed, 33 insertions(+), 2 deletions(-)
 create mode 100644 implementation-contributed/javascriptcore/stress/regress-189124.js

diff --git a/implementation-contributed/curation_logs/javascriptcore.json b/implementation-contributed/curation_logs/javascriptcore.json
index 8bf7f05d11..8c13dab716 100644
--- a/implementation-contributed/curation_logs/javascriptcore.json
+++ b/implementation-contributed/curation_logs/javascriptcore.json
@@ -1,6 +1,6 @@
 {
-  "sourceRevisionAtLastExport": "3ced8564a6",
-  "targetRevisionAtLastExport": "f8c62a49f",
+  "sourceRevisionAtLastExport": "a2f7b0c562",
+  "targetRevisionAtLastExport": "5594c916b",
   "curatedFiles": {
     "/stress/Number-isNaN-basics.js": "DELETED_IN_TARGET",
     "/stress/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js": "DELETED_IN_TARGET",
diff --git a/implementation-contributed/javascriptcore/stress/regress-189124.js b/implementation-contributed/javascriptcore/stress/regress-189124.js
new file mode 100644
index 0000000000..cd5532fde4
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/regress-189124.js
@@ -0,0 +1,31 @@
+//@ runDefault("--jitPolicyScale=0")
+
+function makeTmp() {
+    let tmp = {a: 1};
+    gc();
+    tmp.__proto__ = {};
+    return tmp;
+}
+
+function foo(tmp, obj) {
+    for (let k in tmp) {
+        tmp.__proto__ = {};
+        gc();
+        obj.__proto__ = {};
+
+        var result = obj[k];
+        return result;
+    }
+}
+
+foo(makeTmp(), {});
+
+let memory = new Uint32Array(100);
+memory[0] = 0x1234;
+
+let fooResult = foo(makeTmp(), memory);
+var result = $vm.value(fooResult);
+
+if (result != "Undefined")
+    throw "FAIL";
+