Upgrade to upstream WebKit bbc000ae4f3d

JSTests/AGENTS.md

@@ -0,0 +1 @@
+@README.md

JSTests/CLAUDE.md

@@ -0,0 +1 @@
+@README.md

JSTests/README.md

@@ -0,0 +1,23 @@
+# JSTests
+
+## Running Tests
+
+Tests are not always set up to run directly. Instead run them through `Tools/Scripts/run-javascriptcore-tests`, which runs everything, or `Tools/Scripts/run-jsc-stress-tests <collection>`, which runs a specific subset. For day-to-day development, the `JSTests/stress` and `JSTests/wasm.yaml` collections are sufficient for catching most bugs.
+
+Tests are run in a variety of different JSC configurations, for example with various JIT tiers disabled, concurrent compilation off, or the GC running continuously. These configurations show up as a suffix on the test name. For example, `stress/array-push.js.ftl-eager-no-cjit` corresponds to `JSTests/stress/array-push.js` with tier-up thresholds lowered and concurrent JIT off.
+
+`run-jsc-stress-tests` looks for a `jsc` in the release build directory unless `--debug` or `--jsc <path>` is passed. `run-javascriptcore-tests` builds one first unless `--no-build` or `--root <path>` is passed.
+
+`run-jsc-stress-tests` takes a collection (a directory or a `.yaml` file), not a single test file. To run a limited subset, pass `--filter <regex>`, which will pattern match on the test's name/configuration. e.g. `run-jsc-stress-tests JSTests/stress --filter array-push`.
+
+## Adding Tests
+
+Put tests that only target JS behavior in `JSTests/stress` and tests that involve wasm in `JSTests/wasm/stress`.
+
+New tests are *required* to adhere to the following rules:
+
+1. Tests must run in under 200ms in all configurations. This can be checked by passing `--report-execution-time` to `run-jsc-stress-tests`.
+2. Use `testLoopCount` or `wasmTestLoopCount` to control how many iterations a test runs. The `jsc` CLI sets these based on the configuration of the test, so tests iterate enough to tier up where that matters and exit early where it doesn't.
+3. Tests fail by crashing or throwing an uncaught exception, so assertions must throw rather than print. Add `//@ mustCrash!` or `//@ requireOptions("--exception=<exception-name>")` to the top of the test file if testing expected crashes/exceptions, respectively.
+4. Don't print or log unless a test is about to fail. Test output goes straight to the terminal, so extra logging is noisy and disruptive.
+5. Make sure the test actually reproduces the bug. Run the test against a build without the fix and make sure it fails.

JSTests/microbenchmarks/array-prototype-sort-string-keys.js

@@ -0,0 +1,9 @@
+var keys = [];
+for (var i = 0; i < 40; ++i) {
+    var name = "";
+    for (var j = 0, x = i * 2654435761; j < 6; ++j, x = (x * 48271 + 12345) | 0)
+        name += String.fromCharCode(97 + ((x >>> 8) % 26));
+    keys.push(name + (i % 3 ? "Id" : "Name"));
+}
+for (var i = 0; i < 5e4; ++i)
+    keys.slice().sort();

JSTests/microbenchmarks/function-bind-method.js

@@ -0,0 +1,20 @@
+class Component {
+    constructor(seed) { this.state = seed | 0; }
+    handleClick(e) { return this.state + e; }
+    onScroll(x) { return this.state - x; }
+    render() {
+        const onClick = this.handleClick.bind(this);
+        const onScr = this.onScroll.bind(this, 2);
+        return onClick(1) + onScr();
+    }
+}
+
+var shorthand = {
+    handle(e) { return e; },
+};
+
+var component = new Component(3);
+for (var i = 0; i < 1e5; ++i) {
+    component.render();
+    shorthand.handle.bind(shorthand);
+}

JSTests/microbenchmarks/json-parse-short-string-ids.js

@@ -0,0 +1,33 @@
+//@ $skipModes << :lockdown if $buildType == "debug"
+
+let seed = 12345;
+function next() {
+    seed = (seed + 0x9e3779b9) | 0;
+    let z = seed;
+    z = Math.imul(z ^ (z >>> 16), 0x85ebca6b);
+    z = Math.imul(z ^ (z >>> 13), 0xc2b2ae35);
+    return (z ^ (z >>> 16)) >>> 0;
+}
+
+const colors = ["red", "blue", "green", "black", "white"];
+const sizes = ["S", "M", "L", "XL"];
+const items = [];
+for (let i = 0; i < 2000; ++i) {
+    items.push({
+        id: "item-" + (1000 + next() % 9000) + "-" + colors[next() % colors.length],
+        sku: "SKU-" + (10000 + next() % 90000) + "-" + sizes[next() % sizes.length],
+        owner: "user-" + (next() % 100000).toString(36),
+        parent: "ord-" + (next() % 1e6),
+        status: next() & 1 ? "active" : "archived",
+    });
+}
+const json = JSON.stringify({ items });
+
+// Each payload carries a distinct set of short ID-like string values, as successive API responses would.
+const separators = "GHIJKLMNOPQRSTUVWXYZghijklmnopqrstuvwxyz";
+const payloads = [];
+for (let i = 0; i < separators.length; ++i)
+    payloads.push(json.replaceAll("-", separators[i]));
+
+for (let i = 0; i < 240; ++i)
+    JSON.parse(payloads[i % payloads.length]);

JSTests/microbenchmarks/json-stringify-class-instances.js

@@ -0,0 +1,38 @@
+class Address {
+    constructor(i) {
+        this.street = "Street " + i;
+        this.city = "City";
+        this.zip = 10000 + i;
+    }
+}
+
+class User {
+    constructor(i) {
+        this.id = i;
+        this.name = "user" + i;
+        this.email = "user" + i + "@example.com";
+        this.active = (i & 1) === 0;
+        this.address = new Address(i);
+        this.tags = ["a", "b", "c"];
+    }
+    get displayName() { return this.name.toUpperCase(); }
+    greet() { return "hi " + this.name; }
+}
+
+class Admin extends User {
+    constructor(i) {
+        super(i);
+        this.level = i % 5;
+    }
+}
+
+let users = [];
+for (let i = 0; i < 40; ++i)
+    users.push((i % 4) === 0 ? new Admin(i) : new User(i));
+let payload = { ok: true, count: users.length, data: users };
+
+let result;
+for (let i = 0; i < 2e4; ++i)
+    result = JSON.stringify(payload);
+if (result.length !== JSON.stringify(JSON.parse(result)).length)
+    throw new Error("bad");

JSTests/microbenchmarks/locale-compare-with-locales.js

@@ -0,0 +1,9 @@
+(function(a, b) {
+    var n = 200000;
+    var result = 0;
+    for (var i = 0; i < n; ++i) {
+        result += a.localeCompare(b, "en");
+    }
+    if (result != n)
+        throw "Error: bad result: " + result;
+})("yes", "no");

JSTests/microbenchmarks/regexp-buffer-boundary-anchor-end.js

@@ -0,0 +1,19 @@
+//@ requireOptions("--useRegExpBufferBoundaries=1")
+
+(function() {
+    var urls = [];
+    for (var i = 0; i < 1000; i++)
+        urls.push("https://cdn.example.com/assets/build/" + i + "/static/media/components/very/deeply/nested/directory/structure/image-" + i + (i % 7 == 0 ? ".png" : ".webp?width=1024&quality=80"));
+
+    var re = /\.png\z/u;
+    var n = 400;
+    var result = 0;
+    for (var i = 0; i < n; i++) {
+        for (var j = 0; j < urls.length; j++) {
+            if (re.test(urls[j]))
+                result++;
+        }
+    }
+    if (result !== n * 143)
+        throw "Error: bad result: " + result;
+})();

JSTests/microbenchmarks/regexp-buffer-boundary-anchor-start.js

@@ -0,0 +1,20 @@
+//@ requireOptions("--useRegExpBufferBoundaries=1")
+
+(function() {
+    var source = "";
+    for (var i = 0; i < 4000; i++)
+        source += "const value" + i + " = compute(" + i + "); // no shebang, no BOM\n";
+
+    var shebang = /\A#!.*\n/u;
+    var bom = /\A\uFEFF/u;
+    var n = 1000;
+    var result = 0;
+    for (var i = 0; i < n; i++) {
+        if (shebang.test(source))
+            result++;
+        if (bom.test(source))
+            result++;
+    }
+    if (result !== 0)
+        throw "Error: bad result: " + result;
+})();

JSTests/microbenchmarks/regexp-u-flag-character-class-greedy.js

@@ -0,0 +1,27 @@
+// /u greedy character classes (\w, [a-z], \d) that hold no non-BMP or surrogate members, over UTF-16 text.
+function splitmix32(seed) {
+    var a = seed;
+    return function () {
+        a |= 0; a = (a + 0x9e3779b9) | 0;
+        var t = a ^ (a >>> 16); t = Math.imul(t, 0x21f0aaad);
+        t = t ^ (t >>> 15); t = Math.imul(t, 0x735a2d97);
+        return ((t = t ^ (t >>> 15)) >>> 0) / 4294967296;
+    };
+}
+let rnd = splitmix32(42);
+let words = [];
+for (let i = 0; i < 60; ++i) {
+    let n = 300 + (rnd() * 400 | 0);
+    let w = "";
+    for (let j = 0; j < n; ++j)
+        w += String.fromCharCode(0x61 + (rnd() * 26 | 0));
+    words.push(w + (rnd() * 100000 | 0));
+}
+let text = words.join(" あ ");
+
+let identifier = /^(?:\w+(?: あ )?)+$/u;
+let word = /^(?:[a-z]+\d+(?: あ )?)+$/u;
+for (let i = 0; i < 2000; ++i) {
+    if (!identifier.test(text) || !word.test(text))
+        throw new Error("bad match");
+}

JSTests/microbenchmarks/regexp-u-flag-class-astral-subject.js

@@ -0,0 +1,11 @@
+// BMP-only /u character class scanning a subject dense in surrogate pairs.
+let unit = "\u{1F600}a\u{1F601}bcd";
+let text = "";
+for (let i = 0; i < 4000; ++i)
+    text += unit + (i % 10);
+
+let re = /^(?:[\u{1F600}\u{1F601}]+[a-z0-9]+)+$/u;
+for (let i = 0; i < 1500; ++i) {
+    if (!re.test(text))
+        throw new Error("bad match");
+}

JSTests/microbenchmarks/string-replace-regexp-trim-end.js

@@ -0,0 +1,18 @@
+function test(str, re)
+{
+    return str.replace(re, "");
+}
+noInline(test);
+
+const strs = [];
+for (let k = 0; k < 16; k++)
+    strs.push("a".repeat(200 + k * 50) + " \t\n".repeat(k & 3));
+
+const re = /\s+$/;
+
+let result;
+for (let i = 0; i < 1000000; ++i)
+    result = test(strs[i & 15], re);
+
+if (test("hello   ", re) !== "hello")
+    throw new Error("bad result: " + test("hello   ", re));

JSTests/microbenchmarks/string-replace-regexp-trim-start.js

@@ -0,0 +1,18 @@
+function test(str, re)
+{
+    return str.replace(re, "");
+}
+noInline(test);
+
+const strs = [];
+for (let k = 0; k < 16; k++)
+    strs.push(" \t\n".repeat(k & 3) + "a".repeat(200 + k * 50));
+
+const re = /^\s+/;
+
+let result;
+for (let i = 0; i < 1000000; ++i)
+    result = test(strs[i & 15], re);
+
+if (test("   hello", re) !== "hello")
+    throw new Error("bad result: " + test("   hello", re));

JSTests/microbenchmarks/string-split-non-atom-subject.js

@@ -0,0 +1,21 @@
+// CSV-style row parsing where each subject string is built at runtime (not an atom),
+// so String.prototype.split must not atomize the parts nor consult the split cache.
+
+const words = ["alpha", "bravo", "charlie", "delta", "echo", "foxtrot", "golf", "hotel"];
+
+function parseRow(row)
+{
+    return row.split(",");
+}
+noInline(parseRow);
+
+let count = 0;
+let seed = 1;
+for (let i = 0; i < 3e5; ++i) {
+    seed = (seed * 1103515245 + 12345) >>> 0;
+    const row = words[seed & 7] + i + "," + words[(seed >>> 3) & 7] + (i + 1) + "," + words[(seed >>> 6) & 7] + (i + 2) + "," + words[(seed >>> 9) & 7] + (i + 3);
+    const parts = parseRow(row);
+    count += parts.length + parts[2].length;
+}
+if (count !== 4379333)
+    throw new Error("bad count: " + count);

JSTests/microbenchmarks/string-substring-empty.js

@@ -0,0 +1,8 @@
+function substring(string, start, end)
+{
+    return string.substring(start, end);
+}
+noInline(substring);
+
+for (var i = 0; i < 1e6; ++i)
+    substring("Cocoa", 3, 3);

JSTests/microbenchmarks/string-substring-multi-chars.js

@@ -0,0 +1,8 @@
+function substring(string, start, end)
+{
+    return string.substring(start, end);
+}
+noInline(substring);
+
+for (var i = 0; i < 1e6; ++i)
+    substring("Hello, World", 2, 9);

JSTests/microbenchmarks/string-substring-no-end.js

@@ -0,0 +1,8 @@
+function substring(string, start)
+{
+    return string.substring(start);
+}
+noInline(substring);
+
+for (var i = 0; i < 1e6; ++i)
+    substring("Cocoa", 2);

JSTests/microbenchmarks/string-substring-one-char.js

@@ -0,0 +1,8 @@
+function substring(string, start, end)
+{
+    return string.substring(start, end);
+}
+noInline(substring);
+
+for (var i = 0; i < 1e6; ++i)
+    substring("Cocoa", 2, 3);

JSTests/microbenchmarks/string-substring-reversed.js

@@ -0,0 +1,8 @@
+function substring(string, start, end)
+{
+    return string.substring(start, end);
+}
+noInline(substring);
+
+for (var i = 0; i < 1e6; ++i)
+    substring("Cocoa", 4, 1);

JSTests/microbenchmarks/temporal-zoned-date-time-time-zone-cache.js

@@ -0,0 +1,19 @@
+//@ requireOptions("--useTemporal=1")
+
+// Guards the UCalendar TinyLRUCache in TimeZoneICUBridge.cpp (timeZoneCacheEntry,
+// capacity 16). Cycling 12 named zones fits the cache; a smaller capacity evicts
+// before reuse and pays ucal_open (~900ns) on every access.
+const zones = [
+    "America/Vancouver", "America/Denver", "America/Chicago", "America/New_York",
+    "America/Sao_Paulo", "Europe/London", "Europe/Paris", "Africa/Cairo",
+    "Asia/Kolkata", "Asia/Tokyo", "Australia/Sydney", "Pacific/Auckland",
+];
+const instant = Temporal.Instant.fromEpochMilliseconds(1750000000000); // 2025-06-15T15:06:40Z
+const zdts = zones.map(zone => instant.toZonedDateTimeISO(zone));
+
+let acc = 0;
+for (var i = 0; i < 2400000; ++i)
+    acc += zdts[i % zdts.length].offsetNanoseconds / 900e9; // ICU offset lookup per iteration
+
+if (acc !== 14000000)
+    throw "Bad result: " + acc;

JSTests/modules/import-defer-async-cycle-sync-access.js

@@ -0,0 +1,26 @@
+//@ requireOptions("--useImportDefer=1")
+import { shouldBe, shouldThrow } from "./resources/assert.js";
+import { blocker, aStarted } from "./import-defer/async-cycle-setup.js";
+
+// SCC {tla, member}: tla has TLA and is the cycle root, member is the non-root member.
+// While tla is suspended on the blocker, member has already reached EVALUATED even though the
+// cycle has not finished. The deferred module behind ns depends on member, so it still cannot be
+// evaluated synchronously: ReadyForSyncExecution must consult IsModuleSCCEvaluated(member), which
+// follows [[CycleRoot]], rather than member's own [[Status]].
+
+const evaluations = globalThis.asyncCycleEvaluations;
+
+const pTLA = import("./import-defer/async-cycle-tla.js");
+await aStarted.promise;
+
+shouldBe(JSON.stringify(evaluations), JSON.stringify(["toucher", "member", "A-before-await"]));
+
+shouldThrow(() => globalThis.asyncCycleTouch(), "TypeError: Unable to synchronously evaluate deferred module");
+shouldBe(JSON.stringify(evaluations), JSON.stringify(["toucher", "member", "A-before-await"]));
+
+blocker.resolve();
+await pTLA;
+
+// The cycle root is EVALUATED now, so the same access succeeds and evaluates only the deferred module.
+shouldBe(globalThis.asyncCycleTouch(), 1);
+shouldBe(JSON.stringify(evaluations), JSON.stringify(["toucher", "member", "A-before-await", "A-after-await", "deferred"]));

JSTests/modules/import-defer/async-cycle-deferred.js

@@ -0,0 +1,4 @@
+import "./async-cycle-member.js";
+
+globalThis.asyncCycleEvaluations.push("deferred");
+export const value = 1;

JSTests/modules/import-defer/async-cycle-member.js

@@ -0,0 +1,4 @@
+import "./async-cycle-tla.js";
+import "./async-cycle-toucher.js";
+
+globalThis.asyncCycleEvaluations.push("member");

JSTests/modules/import-defer/async-cycle-setup.js

@@ -0,0 +1,4 @@
+globalThis.asyncCycleEvaluations = [];
+
+export const blocker = Promise.withResolvers();
+export const aStarted = Promise.withResolvers();

JSTests/modules/import-defer/async-cycle-tla.js

@@ -0,0 +1,7 @@
+import { blocker, aStarted } from "./async-cycle-setup.js";
+import "./async-cycle-member.js";
+
+globalThis.asyncCycleEvaluations.push("A-before-await");
+aStarted.resolve();
+await blocker.promise;
+globalThis.asyncCycleEvaluations.push("A-after-await");