From ffcc3dc7670af452bbbd72552839f465b0dda28d Mon Sep 17 00:00:00 2001
From: test262-automation <test262-automation@bocoup.com>
Date: Tue, 27 Nov 2018 19:07:31 +0000
Subject: [PATCH] [javascriptcore-test262-automation] Changes from
 https://github.com/webkit/webkit.git at sha 2f2295c3f7 on Tue Nov 27 2018
 19:04:26 GMT+0000 (Coordinated Universal Time)

---
 ...d-basic-block-set-local-should-filter-type.js | 16 ++++++++++++++++
 ...-phase-needs-to-write-to-each-scope-offset.js | 13 +++++++++++++
 .../javascriptcore/stress/regexp-compile-oom.js  |  2 +-
 .../javascriptcore/stress/regress-187373.js      | 12 ++++++++++++
 .../wasm/regress/regress-191056.js               | 15 +++++++++++++++
 5 files changed, 57 insertions(+), 1 deletion(-)
 create mode 100644 implementation-contributed/javascriptcore/stress/end-basic-block-set-local-should-filter-type.js
 create mode 100644 implementation-contributed/javascriptcore/stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js
 create mode 100644 implementation-contributed/javascriptcore/stress/regress-187373.js
 create mode 100644 implementation-contributed/javascriptcore/wasm/regress/regress-191056.js

diff --git a/implementation-contributed/javascriptcore/stress/end-basic-block-set-local-should-filter-type.js b/implementation-contributed/javascriptcore/stress/end-basic-block-set-local-should-filter-type.js
new file mode 100644
index 0000000000..cdd0035764
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/end-basic-block-set-local-should-filter-type.js
@@ -0,0 +1,16 @@
+function bar() {
+    let x = 0;
+    foo(0);
+    if (x) {
+    }
+}
+function foo(a) {
+    let x = a[0]
+    a[0] = 0;
+    return;
+    a
+}
+foo([0]);
+for (var i = 0; i < 10000; ++i) {
+    bar();
+}
diff --git a/implementation-contributed/javascriptcore/stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js b/implementation-contributed/javascriptcore/stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js
new file mode 100644
index 0000000000..d9eca32bf6
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js
@@ -0,0 +1,13 @@
+//@ runDefault("--forceEagerCompilation=1", "--useConcurrentJIT=0")
+
+function foo(a, a) {
+    function x() {
+        eval();
+    }
+}
+foo();
+foo();
+foo();
+foo();
+foo();
+foo(0);
diff --git a/implementation-contributed/javascriptcore/stress/regexp-compile-oom.js b/implementation-contributed/javascriptcore/stress/regexp-compile-oom.js
index b1c62e9065..a115f12cba 100644
--- a/implementation-contributed/javascriptcore/stress/regexp-compile-oom.js
+++ b/implementation-contributed/javascriptcore/stress/regexp-compile-oom.js
@@ -1,4 +1,4 @@
-//@ skip if $hostOS != "darwin"
+//@ skip if $hostOS != "darwin" or $architecture == "arm" or $architecture == "x86"
 // Test that throw an OOM exception when compiling a pathological, but valid nested RegExp.
 
 var failures = [];
diff --git a/implementation-contributed/javascriptcore/stress/regress-187373.js b/implementation-contributed/javascriptcore/stress/regress-187373.js
new file mode 100644
index 0000000000..fe819f9bb9
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/regress-187373.js
@@ -0,0 +1,12 @@
+async function* fn() {
+  return p
+  return q
+  switch (0) {
+    case 1:
+      i++;
+      i++;
+      foo(x, arguments[z]);
+      break;
+  }
+}
+fn().next();
diff --git a/implementation-contributed/javascriptcore/wasm/regress/regress-191056.js b/implementation-contributed/javascriptcore/wasm/regress/regress-191056.js
new file mode 100644
index 0000000000..d9bd772f40
--- /dev/null
+++ b/implementation-contributed/javascriptcore/wasm/regress/regress-191056.js
@@ -0,0 +1,15 @@
+var importObject = {
+    env: {
+        print_number: function (number) {
+            print('[+] importObject callback.');
+            print(number);
+        }
+    }
+};
+var wasmCode = new Uint8Array([0x0,0x61,0x73,0x6d,0x1,0x0,0x0,0x0,0x1,0x7,0x1,0x60,0x2,0x7e,0x7f,0x1,0x7f,0x3,0x2,0x1,0x0,0x4,0x4,0x1,0x70,0x0,0x4,0x6,0x2e,0x5,0x7f,0x0,0x41,0x2a,0xb,0x7d,0x0,0x43,0x74,0x0,0x0,0x4d,0xb,0x7c,0x0    ,0x44,0x83,0x88,0x88,0x00,0x0,0x0,0xff,0xff,0xb,0x7d,0x0,0x43,0x0,0x0,0x9,0x7f,0xb,0x7c,0x0,0x44,0x0,0x3c,0x0,0x0,0x0,0x0,0xf8,0x7f,0xb,0x7,0x40,0x7,0x5,0x74,0x61,0x62,0x3f,0x45,0x1,0x0,0x3,0x7d,0x75,0x6d,0x0,0x0,0x6,0x61,0x3d,    0x22,0x0,0xd,0x72,0x3,0x0,0x7,0x4f,0x7c,0x68,0x77,0x65,0x20,0x31,0x3,0x1,0x7,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x3,0x2,0x7,0x61,0x6e,0x73,0x77,0x65,0x72,0x3c,0x3,0x3,0x7,0x61,0x6e,0x73,0x77,0x65,0x72,0x34,0x3,0x4,0x9,0x7,0x1,0x0,0x41,0x0,0xb,0x1,0x0,0xa,0x9,0x1,0x7,0x0,0x20,0x1,0x0,0x1,0x0,0xb,]);
+var wasmModule = new WebAssembly.Module(wasmCode);
+var wasmInstance = new WebAssembly.Instance(wasmModule, importObject);
+
+var res = wasmInstance.exports.AAAAAAA;
+res = res + 'string';
+