Merge branch 'master' into qtwebkit-dev

Change-Id: I8226dc5a9b86857450ab356dd1e568ad5fea5dda

JSTests/ChangeLog

@@ -1,3 +1,80 @@
+2019-10-17  Mark Lam  <mark.lam@apple.com>
+
+        Add missing checks after calls to the sameValue() JSValue comparator.
+        https://bugs.webkit.org/show_bug.cgi?id=203126
+        <rdar://problem/56366561>
+
+        Reviewed by Saam Barati.
+
+        * stress/validate-exception-check-in-proxy-object-put.js: Added.
+
+2019-10-17  Saam Barati  <sbarati@apple.com>
+
+        GetByVal and PutByVal on ArrayStorage need to use the same AbstractHeap
+        https://bugs.webkit.org/show_bug.cgi?id=203124
+        <rdar://problem/55988183>
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/licm-array-storage-get-and-put-by-val.js: Added.
+        (assert):
+        (foo):
+
+2019-10-16  Keith Miller  <keith_miller@apple.com>
+
+        Move assert in Wasm::Plan::fail.
+        https://bugs.webkit.org/show_bug.cgi?id=203052
+
+        Reviewed by Mark Lam.
+
+        * wasm/regress/wasm-plan-fail-bad-error-message-assert.js: Added.
+        (Binary):
+        (Binary.prototype.trunc_buffer):
+        (Binary.prototype.emit_leb_u):
+        (Binary.prototype.emit_u32v):
+        (Binary.prototype.emit_bytes):
+        (Binary.prototype.emit_header):
+        (__f_576):
+        (__f_587):
+
+2019-10-15  Mark Lam  <mark.lam@apple.com>
+
+        operationSwitchCharWithUnknownKeyType failed to handle OOME when resolving rope string.
+        https://bugs.webkit.org/show_bug.cgi?id=202312
+        <rdar://problem/55782280>
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings.js: Added.
+        * stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings2.js: Added.
+        * stress/switch-on-char-llint-rope.js:
+        - Changed this test to make a new rope string for each iterations.  Otherwise,
+          the rope will get resolved, and subsequent tiers will not be testing with a rope.
+
+2019-10-14  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] GetterSetter should be JSCell, not JSObject
+        https://bugs.webkit.org/show_bug.cgi?id=202656
+
+        Reviewed by Tadeu Zagallo and Saam Barati.
+
+        * stress/getter-setter-should-be-cell.js: Added.
+        (foo.with.):
+        (foo.with.get for):
+        (foo.with.bar):
+        (foo):
+
+2019-10-14  Saam Barati  <sbarati@apple.com>
+
+        Canonicalize how we prepare the prototype chain for inline caching
+        https://bugs.webkit.org/show_bug.cgi?id=202827
+        <rdar://problem/56193919>
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/cache-correct-offset-after-flattening.js: Added.
+        (assert):
+
 2019-10-14  Paulo Matos  <pmatos@igalia.com>
 
         Skip memcpy-typed-loop timing out on ARMv7 pending investigation

JSTests/stress/cache-correct-offset-after-flattening.js

@@ -0,0 +1,24 @@
+function assert(b) {
+    if (!b)
+        throw new Error;
+}
+
+let p = {};
+let o = {};
+o.__proto__ = p;
+
+for (let i = 0; i < 1000; ++i) {
+    p["p" + i] = i;
+}
+p.foo = 42;
+delete p.p0;
+delete p.p1;
+delete p.p2;
+delete p.p3;
+delete p.p4;
+delete p.p5;
+
+for (let i = 0; i < 10; ++i) {
+    p.foo = i;
+    assert(o.foo === i);
+}

JSTests/stress/getter-setter-should-be-cell.js

@@ -0,0 +1,26 @@
+//@ runDefault("--validateAbstractInterpreterState=1", "--forceEagerCompilation=1")
+String.__proto__ = createGlobalObject();
+const that = {};
+that.__proto__ = String;
+
+function foo() {
+    with (that) {
+        function bar(a0, a1) {
+            const v0 = '';
+            const v1 = undefined;
+            const v2 = undefined;
+            const v3 = undefined;
+            const p = { get: ()=>{} };
+            for (let j = 0; j < 1; j++) {
+                function f0() {}
+                const v4 = Object.defineProperty(''.__proto__, '__proto__', p);
+            }
+            const v5 = undefined;
+        }
+        for (let i = 0; i < 100; i++) {
+            new Promise(bar);
+        }
+    }
+}
+
+foo();

JSTests/stress/licm-array-storage-get-and-put-by-val.js

@@ -0,0 +1,25 @@
+function assert(b) {
+    if (!b)
+        throw new Error;
+}
+function foo(a) {
+    a[1] = 1;
+    let b = 0;
+    for (let j = 0; j < 10; j++) {
+        a[1] = 2;
+        b = a[1];
+    }
+    return b;
+}
+noInline(foo);
+
+let arr = new Array(5);
+for (let i = 0; i < 0x1000; i++) {
+    arr[i] = i;
+}
+arr[100000] = 1;
+
+for (let i = 0; i < 20000; i++){
+    arr[1] = 1;
+    assert(foo(arr) === 2);
+}

JSTests/stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings.js

@@ -0,0 +1,17 @@
+//@ if $memoryLimited then skip else runDefault("--useConcurrentJIT=false") end
+//@ slow!
+
+var o = (-1).toLocaleString().padEnd(2 ** 31 - 1, "a");
+
+function f() {
+    switch (o) {
+        case "t":
+        case "s":
+        case "u":
+    }
+}
+noInline(f);
+
+for (var i = 0; i < 10000; i++)
+    f();
+

JSTests/stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings2.js

@@ -0,0 +1,24 @@
+//@ if $memoryLimited then skip else runDefault("--useConcurrentJIT=false") end
+//@ slow!
+
+function f(o) {
+    switch (o) {
+        case "t":
+        case "s":
+        case "u":
+    }
+}
+noInline(f);
+
+for (var i = 0; i < 10000; i++) {
+    let o;
+    // This test needs to allocate a large rope string, which is slow.
+    // The following is tweaked so that we only use this large string once each to
+    // exercise the llint, baseline, DFG, and FTL, so that the test doesn't run too slow.
+    if (i == 0 || i == 99 || i == 200 || i == 9999)
+        o = (-1).toLocaleString().padEnd(2 ** 31 - 1, "a");
+    else
+        o = (-1).toLocaleString().padEnd(2, "a");
+    f(o);
+}
+

JSTests/stress/switch-on-char-llint-rope.js

@@ -14,8 +14,8 @@ function foo(z) {
 }
 noInline(foo);
 
-let str = 'a' + constStr();
 for (let i = 0; i < 10000; ++i) {
+    let str = 'a' + constStr();
     let result = foo(str);
     if (result !== 2)
         throw new Error("Bad result");

JSTests/stress/validate-exception-check-in-proxy-object-put.js

@@ -0,0 +1,13 @@
+const h = {
+  set: ()=>1,
+};
+const t = new String('b');
+const p = new Proxy(t, h);
+try {
+    p[0] = 'a' + 'a';
+} catch (e) {
+    exception = e;
+}
+
+if (exception != "TypeError: Proxy handler's 'set' on a non-configurable and non-writable property on 'target' should either return false or be the same value already on the 'target'")
+    throw "FAILED";

JSTests/wasm/regress/wasm-plan-fail-bad-error-message-assert.js

@@ -0,0 +1,55 @@
+// From oss-fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17976
+
+var kWasmH0 = 0;
+var kWasmH1 = 0x61;
+var kWasmH2 = 0x73;
+var kWasmH3 = 0x6d;
+var kWasmV0 = 0x1;
+var kWasmV1 = 0;
+var kWasmV2 = 0;
+var kWasmV3 = 0;
+let kTypeSectionCode = 1;
+let kFunctionSectionCode = 3;
+let kCodeSectionCode = 10;
+let kWasmFunctionTypeForm = 0x60;
+class Binary {
+  constructor() {
+    this.length = 0;
+    this.buffer = new Uint8Array(8192);
+  }
+  trunc_buffer() {
+    return new Uint8Array(this.buffer.buffer, 0, this.length);
+  }
+  emit_leb_u() {
+
+        this.buffer[this.length++] = v;
+        return;
+  }
+  emit_u32v() {
+    this.emit_leb_u();
+  }
+  emit_bytes(data) {
+    this.buffer.set(data, this.length);
+    this.length += data.length;
+  }
+  emit_header() {
+    this.emit_bytes([kWasmH0, kWasmH1, kWasmH2, kWasmH3, kWasmV0, kWasmV1, kWasmV2, kWasmV3]);
+  }
+
+}
+function __f_576(__v_2078) {
+    WebAssembly.compile(__v_2078.trunc_buffer())
+}
+  (function __f_587() {
+    let __v_2099 = new Binary();
+
+      __v_2099.emit_header()
+      __v_2099.emit_bytes([kTypeSectionCode, 4, 1, kWasmFunctionTypeForm, 0, 0])
+      __v_2099.emit_bytes([kFunctionSectionCode, 2, 1, 0])
+      __v_2099.emit_bytes([kCodeSectionCode, 20, 1])
+    try {
+      __v_2099.emit_u32v();
+    } catch (e) {}
+      __f_576(__v_2099,
+ 'testBodySizeIsZero')
+  })();