Upgrade to upstream WebKit df289ce551

JSTests/modules/module-function-declaration-executable-reuse-jettison.js

@@ -0,0 +1,8 @@
+//@ requireOptions("--forceCodeBlockToJettisonDueToOldAge=1", "--useEagerCodeBlockJettisonTiming=1")
+import { shouldBe } from "./resources/assert.js";
+import * as A from "./module-function-declaration-executable-reuse-jettison/a.js";
+
+shouldBe(A.before, "f g h s");
+shouldBe(A.after, "f 42 h2 s");
+shouldBe(A.blockResult, "block");
+shouldBe(A.fAfterBlock, "f");

JSTests/modules/module-function-declaration-executable-reuse-jettison/a.js

@@ -0,0 +1,16 @@
+export function f() { return "f"; }
+export function g() { return "g"; }
+export function h() { return "h"; }
+function s() { return "s"; }
+export const before = [f(), g(), h(), s()].join(" ");
+g = 42;
+h = function () { return "h2"; };
+Promise.resolve().then(() => { fullGC(); });
+await 0;
+export const after = [f(), g, h(), s()].join(" ");
+export let blockResult;
+{
+    function f() { return "block"; }
+    blockResult = f();
+}
+export const fAfterBlock = f();

JSTests/modules/module-function-declaration-executable-reuse.js

@@ -0,0 +1,23 @@
+import { shouldBe } from "./resources/assert.js";
+import * as A from "./module-function-declaration-executable-reuse/a.js";
+import * as Same1 from "./module-function-declaration-executable-reuse/same-1.js";
+import * as Same2 from "./module-function-declaration-executable-reuse/same-2.js";
+
+shouldBe(A.f(), "f");
+shouldBe(A.blockResult, "block");
+shouldBe(A.gSeenInB, "g");
+shouldBe(A.hSeenInB, "h");
+shouldBe(A.kSeenInB, "k");
+shouldBe(A.gInBody(), "replaced");
+shouldBe(A.hInBody, 42);
+shouldBe(A.kInBody, Math.max);
+shouldBe(A.callCaptured(), "captured");
+shouldBe(A.localResult, "local");
+shouldBe(A.gen().next().value, "gen");
+shouldBe(typeof A.asyncFn, "function");
+shouldBe(typeof A.asyncGen, "function");
+
+shouldBe(Same1.fInBody, Same2.f);
+shouldBe(Same2.fInBody, Same1.f);
+shouldBe(Same1.f(), "f");
+shouldBe(Same2.f(), "f");

JSTests/modules/module-function-declaration-executable-reuse/a.js

@@ -0,0 +1,29 @@
+import { gSeenInB, hSeenInB, kSeenInB } from "./b.js";
+
+export function f() { return "f"; }
+export function g() { return "g"; }
+export function h() { return "h"; }
+export function k() { return "k"; }
+export function setG(value) { g = value; }
+export function setH(value) { h = value; }
+export function setK(value) { k = value; }
+export function* gen() { yield "gen"; }
+export async function asyncFn() { return "async"; }
+export async function* asyncGen() { yield "asyncGen"; }
+
+function captured() { return "captured"; }
+export function callCaptured() { return captured(); }
+
+function local() { return "local"; }
+export const localResult = local();
+
+export let blockResult;
+{
+    function f() { return "block"; }
+    blockResult = f();
+}
+
+export const gInBody = g;
+export const hInBody = h;
+export const kInBody = k;
+export { gSeenInB, hSeenInB, kSeenInB };

JSTests/modules/module-function-declaration-executable-reuse/b.js

@@ -0,0 +1,8 @@
+import { g, h, k, setG, setH, setK } from "./a.js";
+
+export const gSeenInB = g();
+export const hSeenInB = h();
+export const kSeenInB = k();
+setG(function () { return "replaced"; });
+setH(42);
+setK(Math.max);

JSTests/modules/module-function-declaration-executable-reuse/same-1.js

@@ -0,0 +1,4 @@
+import "./same-setter.js";
+export function f() { return "f"; }
+export function setF(value) { f = value; }
+export const fInBody = f;

JSTests/modules/module-function-declaration-executable-reuse/same-2.js

@@ -0,0 +1,4 @@
+import "./same-setter.js";
+export function f() { return "f"; }
+export function setF(value) { f = value; }
+export const fInBody = f;

JSTests/modules/module-function-declaration-executable-reuse/same-setter.js

@@ -0,0 +1,5 @@
+import { f, setF } from "./same-1.js";
+import { f as f2, setF as setF2 } from "./same-2.js";
+
+setF(f2);
+setF2(f);

JSTests/stress/arguments-elimination-inlined-load-varargs-preserves-recoveries.js

@@ -0,0 +1,84 @@
+//@ runDefault("--thresholdForJITAfterWarmUp=10", "--thresholdForFTLOptimizeAfterWarmUp=1000", "--useConcurrentJIT=false", "--validateFTLOSRExitLiveness=true")
+
+"use strict";
+
+function shouldBe(actual, expected)
+{
+    if (actual !== expected)
+        throw new Error("bad value: " + actual + ", expected: " + expected);
+}
+
+function five(values1, values2)
+{
+    let result = null;
+    for (let i = 0; i < 5; ++i) {
+        function arg() { "use strict"; return arguments; }
+        const a = arg.apply(undefined, values1);
+        const b = arg.apply(undefined, values2);
+        try {
+            (3881)(b);
+        } catch (error) {
+            a.toString();
+            result = a;
+        }
+    }
+    return result;
+}
+
+function eight(values1, values2)
+{
+    let result = null;
+    for (let i = 0; i < 5; ++i) {
+        function arg() { "use strict"; return arguments; }
+        const a = arg.apply(undefined, values1);
+        const b = arg.apply(undefined, values2);
+        try {
+            (3881)(b);
+        } catch (error) {
+            a.toString();
+            result = a;
+        }
+    }
+    return result;
+}
+
+function filled(length, value)
+{
+    const result = [];
+    for (let i = 0; i < length; ++i)
+        result.push(value);
+    return result;
+}
+
+const fiveMarker = { marker: "five" };
+const eightMarker = { marker: "eight" };
+const seedArray = [{ marker: "seed" }, 1, 2, 3, 4, 5];
+
+const firstFive = filled(5, fiveMarker);
+const overwriteFive = filled(30, fiveMarker);
+overwriteFive[22] = 9;
+
+const firstEight = filled(8, eightMarker);
+const overwriteEight = filled(30, eightMarker);
+overwriteEight[20] = 9;
+
+for (let i = 0; i < testLoopCount; ++i) {
+    five(firstFive, overwriteFive);
+    eight(firstEight, overwriteEight);
+}
+
+const seedValues = filled(30, seedArray);
+seedValues[20] = 9;
+for (let i = 0; i < testLoopCount; ++i)
+    eight(firstEight, seedValues);
+
+const recoveredEight = eight(firstEight, seedValues);
+shouldBe(recoveredEight.length, firstEight.length);
+for (let i = 0; i < firstEight.length; ++i)
+    shouldBe(recoveredEight[i], eightMarker);
+
+const recoveredFive = five(firstFive, overwriteFive);
+shouldBe(recoveredFive.length, firstFive.length);
+for (let i = 0; i < firstFive.length; ++i)
+    shouldBe(recoveredFive[i], fiveMarker);
+shouldBe(recoveredFive[5], undefined);

JSTests/stress/arguments-elimination-load-varargs-kills-promoted-recoveries.js

@@ -0,0 +1,88 @@
+//@ runDefault("--thresholdForJITAfterWarmUp=10", "--thresholdForFTLOptimizeAfterWarmUp=1000", "--useConcurrentJIT=false")
+
+"use strict";
+
+function shouldBe(actual, expected)
+{
+    if (actual !== expected)
+        throw new Error("bad value: " + actual + ", expected: " + expected);
+}
+noInline(shouldBe);
+
+function five(values1, values2)
+{
+    let result = null;
+    for (let i = 0; i < 5; ++i) {
+        function arg() { "use strict"; return arguments; }
+        const a = arg.apply(undefined, values1);
+        const b = arg.apply(undefined, values2);
+        try {
+            (3881)(b);
+        } catch (error) {
+            a.toString();
+            result = a;
+        }
+    }
+    return result;
+}
+noInline(five);
+
+function eight(values1, values2)
+{
+    let result = null;
+    for (let i = 0; i < 5; ++i) {
+        function arg() { "use strict"; return arguments; }
+        const a = arg.apply(undefined, values1);
+        const b = arg.apply(undefined, values2);
+        try {
+            (3881)(b);
+        } catch (error) {
+            a.toString();
+            result = a;
+        }
+    }
+    return result;
+}
+noInline(eight);
+
+function filled(length, value)
+{
+    const result = [];
+    for (let i = 0; i < length; ++i)
+        result.push(value);
+    return result;
+}
+noInline(filled);
+
+const fiveMarker = { marker: "five" };
+const eightMarker = { marker: "eight" };
+const seedArray = [{ marker: "seed" }, 1, 2, 3, 4, 5];
+
+const firstFive = filled(5, fiveMarker);
+const overwriteFive = filled(30, fiveMarker);
+overwriteFive[22] = 9;
+
+const firstEight = filled(8, eightMarker);
+const overwriteEight = filled(30, eightMarker);
+overwriteEight[20] = 9;
+
+for (let i = 0; i < testLoopCount; ++i) {
+    five(firstFive, overwriteFive);
+    eight(firstEight, overwriteEight);
+}
+
+const seedValues = filled(30, seedArray);
+seedValues[20] = 9;
+for (let i = 0; i < testLoopCount; ++i)
+    eight(firstEight, seedValues);
+
+const recoveredEight = eight(firstEight, seedValues);
+shouldBe(recoveredEight.length, firstEight.length);
+for (let i = 0; i < firstEight.length; ++i)
+    shouldBe(recoveredEight[i], eightMarker);
+
+const recoveredFive = five(firstFive, overwriteFive);
+shouldBe(recoveredFive.length, firstFive.length);
+for (let i = 0; i < firstFive.length; ++i)
+    shouldBe(recoveredFive[i], fiveMarker);
+shouldBe(recoveredFive[5], undefined);

JSTests/stress/dfg-string-replace-regexp-unicode-empty-match-surrogate-pair.js

@@ -0,0 +1,37 @@
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error(`bad value: ${JSON.stringify(actual)}, expected ${JSON.stringify(expected)}`);
+}
+
+function replaceUnicode() {
+    return "a\u{1F600}b".replace(/(?:)/gu, "-");
+}
+noInline(replaceUnicode);
+
+function replaceUnicodeSets() {
+    return "a\u{1F600}b".replace(/(?:)/gv, "-");
+}
+noInline(replaceUnicodeSets);
+
+function replaceAllUnicode() {
+    return "\u{1F600}\u{1F601}".replaceAll(/(?:)/gu, "|");
+}
+noInline(replaceAllUnicode);
+
+function replaceLoneLead() {
+    return "a\uD83D".replace(/(?:)/gu, "-");
+}
+noInline(replaceLoneLead);
+
+function replaceNonUnicode() {
+    return "a\u{1F600}b".replace(/(?:)/g, "-");
+}
+noInline(replaceNonUnicode);
+
+for (var i = 0; i < testLoopCount; ++i) {
+    shouldBe(replaceUnicode(), "-a-\u{1F600}-b-");
+    shouldBe(replaceUnicodeSets(), "-a-\u{1F600}-b-");
+    shouldBe(replaceAllUnicode(), "|\u{1F600}|\u{1F601}|");
+    shouldBe(replaceLoneLead(), "-a-\uD83D-");
+    shouldBe(replaceNonUnicode(), "-a-\uD83D-\uDE00-b-");
+}

JSTests/stress/for-of-mixed-element-types-value-profile.js

@@ -0,0 +1,40 @@
+//@ skip if not $jitTests
+//@ $skipModes << :lockdown
+//@ requireOptions("--forceUnlinkedDFG=0")
+
+// The baseline JIT's fast-array op_iterator_next path must profile the iterated element into the
+// getValue checkpoint's value profile. When it wrote to the computeNext slot instead, the DFG kept
+// predicting the loop variable from whatever the LLInt had sampled, so it re-speculated the same
+// wrong type on every recompilation until the reoptimization retry counter ran out.
+
+function events(i)
+{
+    // Only the baseline JIT ever sees the number: by iteration 20000 this function is long past the
+    // LLInt.
+    return i < 20000 ? ["a", "bb", "ccc"] : ["a", "bb", 0];
+}
+noInline(events);
+
+function walk(i)
+{
+    let count = 0;
+    for (let event of events(i)) {
+        if (typeof event === "number")
+            count += event;
+        else
+            count += event.length;
+    }
+    return count;
+}
+noInline(walk);
+
+let total = 0;
+for (let i = 0; i < 300000; ++i)
+    total += walk(i);
+
+if (total !== 960000)
+    throw new Error(`bad result: ${total}`);
+
+const compiles = numberOfDFGCompiles(walk);
+if (compiles > 4)
+    throw new Error(`walk was DFG-compiled ${compiles} times; the loop variable's value profile is not being updated`);

JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js

@@ -1,3 +1,4 @@
+//@ slow!
 //@ runDefault("--forceEagerCompilation=1")
 
 let total = 0;