Merge remote-tracking branch 'upstream'

JSTests/stress/json-range-error.js

@@ -0,0 +1,32 @@
+try {
+  this.g ??= createGlobalObject();
+  function func_1_() {
+    for (let var_4_ = 0; var_4_ < 1000; (() => {
+        var var_14_ = new Intl.Locale('ml');
+      })(), var_4_++) {
+      this.g ??= createGlobalObject();
+      function func_2_() {
+        this.g ??= createGlobalObject();
+        const var_2_ = var_4_ + 127 - 2147484671 - 1024;
+        const var_3_ = String.fromCharCode(var_4_, var_4_, var_2_);
+        const var_5_ = [-(903931.176977 - this.g.Number?.MAX_VALUE * -1 || NaN), var_3_, , , {}.var_7_];
+        var_3_.__proto__ = Reflect;
+        try {
+          const var_12_ = Int8Array.toStringTag;
+          const var_8_ = {};
+          const var_10_ = String.prototype.fontsize(var_8_, var_12_);
+          const var_11_ = JSON.stringify(var_5_, var_10_, var_10_);
+          const var_9_ = this.g.JSON['parse'](var_11_, isNaN);
+          var var_13_ = new Float32Array(new this.g.SharedArrayBuffer());
+        } catch (var_6_) {}
+        Set.prototype = Object.assign.__proto__;
+      }
+      const var_1_ = func_2_();
+    }
+  }
+  func_1_();
+  eval(''.repeat(2 ** 20) + '\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004' + '' + `
+class cl_1_ {
+` + '0o1' + (() => 'n')() + '');
+  fullGC();
+} catch {}

JSTests/stress/map-set-iterators-next.js

@@ -0,0 +1,18 @@
+//@ runDefault("--useConcurrentJIT=0", "--jitPolicyScale=0.001")
+for (let i = 0; i < 100; i++) {
+    const m = new Map();
+    let itr = m.entries();
+    m.set('1', '11');
+    const result = itr.next();
+    if (result.value === undefined || result.value[0] !== '1' || result.value[1] !== '11')
+        throw new Error("bad!");
+}
+
+for (let i = 0; i < 100; i++) {
+    const m = new Set();
+    let itr = m.entries();
+    m.add('1');
+    const result = itr.next();
+    if (result.value === undefined || result.value[0] !== '1' || result.value[1] !== '1')
+        throw new Error("bad!");
+}

JSTests/stress/regexp-escape-oom.js

@@ -0,0 +1,10 @@
+//@ runDefault
+
+var exception;
+try {
+    RegExp.escape('퀀'.repeat?.(2 ** 30));
+} catch (e) {
+    exception = e;
+}
+if (exception != 'RangeError: Out of memory')
+  throw 'FAILED';

JSTests/wasm/gc/any.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/array_new_data.js

@@ -1,5 +1,4 @@
 //@ $skipModes << :wasm_aggressive_inline if $memoryLimited
-//@ runWebAssemblySuite("--useWasmGC=true")
 
 // This tests in the :wasm_aggressive_inline test configuration will use more than the
 // 600M that $memoryLimited devices are capped at due JSCTEST_memoryLimit. Skip it

JSTests/wasm/gc/array_new_elem.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/array_new_fixed.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/array_new_fixed_long.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/arrays.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/block.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 
@@ -37,7 +35,7 @@ function testBlockType() {
         (func (type 0)))
     `),
     WebAssembly.CompileError,
-    "WebAssembly.Module doesn't parse at byte 0: type signature was not a function signature, in function at index 0"
+    "WebAssembly.Module doesn't parse at byte 26: 0th Function type 0 doesn't have a function signature"
   );
 }
 

JSTests/wasm/gc/br_on_cast.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/bug137224743.js

@@ -1,4 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
 import { instantiate } from "./wast-wrapper.js";
 
 try {

JSTests/wasm/gc/bug138038945.js

@@ -1,4 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
 import { instantiate } from "./wast-wrapper.js";
 
 try {

JSTests/wasm/gc/bug247874.js

@@ -1,4 +1,4 @@
-//@ runWebAssemblySuite("--useWasmGC=true", "--collectContinuously=true")
+//@ runWebAssemblySuite("--collectContinuously=true")
 
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/bug250613.js

@@ -1,4 +1,4 @@
-//@ runWebAssemblySuite("--useWasmGC=true", "--slowPathAllocsBetweenGCs=8")
+//@ runWebAssemblySuite("--slowPathAllocsBetweenGCs=8")
 
 // Test for https://bugs.webkit.org/show_bug.cgi?id=250613
 // Note: without the --slowPathAllocsBetweenGCs=8 flag, this test only fails approximately every 1 in 10 executions.

JSTests/wasm/gc/bug252299.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/bug252538.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/bug252719.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/bug254226.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/bug254412.js

@@ -1,6 +1,5 @@
 //@ skip unless $isSIMDPlatform
 //@ requireOptions("--useWasmSIMD=1")
-//@ runWebAssemblySuite("--useWasmGC=true")
 
 import * as assert from "../assert.js";
 

JSTests/wasm/gc/bug254413.js

@@ -1,6 +1,5 @@
 //@ requireOptions("--useWasmSIMD=1")
 //@ skip unless $isSIMDPlatform
-//@ runWebAssemblySuite("--useWasmGC=true")
 
 function module(bytes, valid = true) {
   let buffer = new ArrayBuffer(bytes.length);

JSTests/wasm/gc/bug254414.js

@@ -1,6 +1,5 @@
 //@ requireOptions("--useWasmSIMD=1")
 //@ skip if !$isSIMDPlatform
-//@ runWebAssemblySuite("--useWasmGC=true")
 
 function module(bytes, valid = true) {
   let buffer = new ArrayBuffer(bytes.length);

JSTests/wasm/gc/bug258127.js

@@ -1,6 +1,5 @@
 //@ requireOptions("--useWasmSIMD=1")
 //@ skip unless $isSIMDPlatform
-//@ runWebAssemblySuite("--useWasmGC=true")
 
 function module(bytes, valid = true) {
   let buffer = new ArrayBuffer(bytes.length);

JSTests/wasm/gc/bug258128.js

@@ -1,6 +1,5 @@
 //@ requireOptions("--useWasmSIMD=1")
 //@ skip if !$isSIMDPlatform
-//@ runWebAssemblySuite("--useWasmGC=true")
 
 function module(bytes, valid = true) {
   let buffer = new ArrayBuffer(bytes.length);

JSTests/wasm/gc/bug258499.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 
 function module(bytes, valid = true) {

JSTests/wasm/gc/bug258795.js

@@ -1,6 +1,5 @@
 //@ skip if !$isSIMDPlatform
 //@ requireOptions("--useWasmSIMD=1")
-//@ runWebAssemblySuite("--useWasmGC=true")
 
 function module(bytes, valid = true) {
   let buffer = new ArrayBuffer(bytes.length);

JSTests/wasm/gc/bug258796.js

@@ -1,6 +1,5 @@
 //@ skip if !$isSIMDPlatform
 //@ requireOptions("--useWasmSIMD=1")
-//@ runWebAssemblySuite("--useWasmGC=true")
 
 import * as assert from "../assert.js";
 

JSTests/wasm/gc/bug258801.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 function module(bytes, valid = true) {
   let buffer = new ArrayBuffer(bytes.length);

JSTests/wasm/gc/bug258804.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 
 function module(bytes, valid = true) {

JSTests/wasm/gc/bug260516.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import { compile, instantiate } from "./wast-wrapper.js";
 
 function module(bytes, valid = true) {

JSTests/wasm/gc/bug262862.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 function module(bytes, valid = true) {
   let buffer = new ArrayBuffer(bytes.length);
   let view = new Uint8Array(buffer);

JSTests/wasm/gc/bug262863.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 function module(bytes, valid = true) {
   let buffer = new ArrayBuffer(bytes.length);
   let view = new Uint8Array(buffer);

JSTests/wasm/gc/bug265721.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 // Test for https://bugs.webkit.org/show_bug.cgi?id=265721
 
 import * as assert from "../assert.js";

JSTests/wasm/gc/bug265742.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import { instantiate } from "./wast-wrapper.js";
 
 instantiate(`

JSTests/wasm/gc/bug265927.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 function module(bytes, valid = true) {
   let buffer = new ArrayBuffer(bytes.length);
   let view = new Uint8Array(buffer);

JSTests/wasm/gc/bug266043.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/bug266056.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/bug266127.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile } from "./wast-wrapper.js";
 

JSTests/wasm/gc/bug266167.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/bug266249.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import { compile, instantiate } from "./wast-wrapper.js";
 
 instantiate(`

JSTests/wasm/gc/bug267381.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/bulk-array.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/call_indirect.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/call_ref.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/casts.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/const-exprs.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/eq.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/exception.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/extern.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/i31.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/js-api.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/limits.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/linking.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";
 

JSTests/wasm/gc/packed-arrays.js

@@ -1,5 +1,3 @@
-//@ runWebAssemblySuite("--useWasmGC=true")
-
 import * as assert from "../assert.js";
 import { compile, instantiate } from "./wast-wrapper.js";