diff --git a/implementation-contributed/curation_logs/javascriptcore.json b/implementation-contributed/curation_logs/javascriptcore.json
index 65375ace22cf5e2620bcff39f64bb1fd00e1e13c..1ca4ce25d190501e99b836f0b7676837096eaa2d 100644
--- a/implementation-contributed/curation_logs/javascriptcore.json
+++ b/implementation-contributed/curation_logs/javascriptcore.json
@@ -1,6 +1,6 @@
{
- "sourceRevisionAtLastExport": "873fa026de",
- "targetRevisionAtLastExport": "92b6974df",
+ "sourceRevisionAtLastExport": "8a73712b6a",
+ "targetRevisionAtLastExport": "8e73aadc2",
"curatedFiles": {
"/stress/Number-isNaN-basics.js": "DELETED_IN_TARGET",
"/stress/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js": "DELETED_IN_TARGET",
diff --git a/implementation-contributed/javascriptcore/stress/regress-189317.js b/implementation-contributed/javascriptcore/stress/regress-189317.js
new file mode 100644
index 0000000000000000000000000000000000000000..8e68ee241e7a77e07a6aacc07aa4ff042677b8cb
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/regress-189317.js
@@ -0,0 +1,125 @@
+let intrinsics = [
+ "Array.prototype.indexOf",
+ "Array.prototype.pop",
+ "Array.prototype.push",
+ "Array.prototype.slice",
+ "DataView.prototype.getInt8",
+ "DataView.prototype.getUint8",
+ "DataView.prototype.getInt16",
+ "DataView.prototype.getUint16",
+ "DataView.prototype.getInt32",
+ "DataView.prototype.getUint32",
+ "DataView.prototype.getFloat32",
+ "DataView.prototype.getFloat64",
+ "DataView.prototype.setInt8",
+ "DataView.prototype.setUint8",
+ "DataView.prototype.setInt16",
+ "DataView.prototype.setUint16",
+ "DataView.prototype.setInt32",
+ "DataView.prototype.setUint32",
+ "DataView.prototype.setFloat32",
+ "DataView.prototype.setFloat64",
+ "Map.prototype.get",
+ "Map.prototype.has",
+ "Map.prototype.set",
+ "Math.abs",
+ "Math.acos",
+ "Math.asin",
+ "Math.atan",
+ "Math.acosh",
+ "Math.asinh",
+ "Math.atanh",
+ "Math.cbrt",
+ "Math.ceil",
+ "Math.clz32",
+ "Math.cos",
+ "Math.cosh",
+ "Math.exp",
+ "Math.expm1",
+ "Math.floor",
+ "Math.fround",
+ "Math.log",
+ "Math.log10",
+ "Math.log1p",
+ "Math.log2",
+ "Math.max",
+ "Math.min",
+ "Math.pow",
+ "Math.random",
+ "Math.round",
+ "Math.sin",
+ "Math.sinh",
+ "Math.sqrt",
+ "Math.tan",
+ "Math.tanh",
+ "Math.trunc",
+ "Math.imul",
+ "Number.isInteger",
+ "Number.prototype.toString",
+ "Object.create",
+ "Object.getPrototypeOf",
+ "Object.is",
+ "Object.prototype.hasOwnProperty",
+ "parseInt",
+ "Set.prototype.add",
+ "Set.prototype.has",
+ "String.fromCharCode",
+ "String.prototype.charCodeAt",
+ "String.prototype.charAt",
+ "String.prototype.replace",
+ "String.prototype.slice",
+ "String.prototype.toLowerCase",
+ "String.prototype.valueOf",
+ "Reflect.getPrototypeOf",
+ "RegExp.prototype.exec",
+ "RegExp.prototype.test",
+ "WeakMap.prototype.get",
+ "WeakMap.prototype.has",
+ "WeakMap.prototype.set",
+ "WeakSet.prototype.add",
+ "WeakSet.prototype.has",
+];
+
+if (typeof Atomics !== "undefined") {
+ intrinsics = intrinsics.concat([
+ "Atomics.add",
+ "Atomics.and",
+ "Atomics.compareExchange",
+ "Atomics.exchange",
+ "Atomics.isLockFree",
+ "Atomics.load",
+ "Atomics.or",
+ "Atomics.store",
+ "Atomics.sub",
+ "Atomics.wait",
+ "Atomics.wake",
+ "Atomics.xor",
+ ]);
+}
+
+function testGetter(intrinsic) {
+ let runTest = new Function(
+ "let x = {};" + "\n" +
+ "x.__defineGetter__('a', " + intrinsic + ");" + "\n" +
+ "function test() { x['a']; }" + "\n" +
+ "for (let i = 0; i < 1000; i++) {" + "\n" +
+ " try { test(); } catch(e) { }" + "\n" +
+ "}");
+ runTest();
+}
+
+function testSetter(intrinsic) {
+ let runTest = new Function(
+ "let x = {};" + "\n" +
+ "x.__defineSetter__('a', " + intrinsic + ");" + "\n" +
+ "function test() { x['a'] = 42; }" + "\n" +
+ "for (let i = 0; i < 1000; i++) {" + "\n" +
+ " try { test(); } catch(e) { }" + "\n" +
+ "}");
+ runTest();
+}
+
+for (var i = 0; i < intrinsics.length; ++i) {
+ testGetter(intrinsics[i]);
+ testSetter(intrinsics[i]);
+}
diff --git a/implementation-contributed/javascriptcore/stress/string-to-string-error.js b/implementation-contributed/javascriptcore/stress/string-to-string-error.js
new file mode 100644
index 0000000000000000000000000000000000000000..7f98113479da71a41fd46be7c437013faac698c6
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/string-to-string-error.js
@@ -0,0 +1,45 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+function shouldThrow(func, errorMessage) {
+ var errorThrown = false;
+ var error = null;
+ try {
+ func();
+ } catch (e) {
+ errorThrown = true;
+ error = e;
+ }
+ if (!errorThrown)
+ throw new Error('not thrown');
+ if (String(error) !== errorMessage)
+ throw new Error(`bad error: ${String(error)}`);
+}
+
+var toString = String.prototype.toString;
+function test(string)
+{
+ return toString.call(string);
+}
+noInline(test);
+
+var object = {};
+var symbol = Symbol("Cocoa");
+for (var i = 0; i < 3e3; ++i) {
+ shouldThrow(() => test(object), `TypeError: Type error`);
+ shouldThrow(() => test(false), `TypeError: Type error`);
+ shouldThrow(() => test(true), `TypeError: Type error`);
+ shouldThrow(() => test(42), `TypeError: Type error`);
+ shouldThrow(() => test(null), `TypeError: Type error`);
+ shouldThrow(() => test(undefined), `TypeError: Type error`);
+ shouldThrow(() => test(symbol), `TypeError: Type error`);
+}
+
+var string = "Hello";
+var stringObject = new String(string);
+for (var i = 0; i < 1e2; ++i) {
+ shouldBe(test(string), string);
+ shouldBe(test(stringObject), string);
+}
diff --git a/implementation-contributed/javascriptcore/stress/string-to-string.js b/implementation-contributed/javascriptcore/stress/string-to-string.js
new file mode 100644
index 0000000000000000000000000000000000000000..ba0e7e3d60ad6575dcaa370cc958f9daa6e476cc
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/string-to-string.js
@@ -0,0 +1,38 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+function test1(string)
+{
+ return string.toString();
+}
+noInline(test1);
+
+function test2(string)
+{
+ return string.toString();
+}
+noInline(test2);
+
+function test3(string)
+{
+ return string.toString();
+}
+noInline(test3);
+
+var string = "Hello";
+var stringObject = new String(string);
+
+for (var i = 0; i < 1e6; ++i) {
+ shouldBe(test1(string), string);
+ shouldBe(test2(stringObject), string);
+ if (i & 1)
+ shouldBe(test3(string), string);
+ else
+ shouldBe(test3(stringObject), string);
+}
+
+shouldBe(test1({}), `[object Object]`);
+shouldBe(test2({}), `[object Object]`);
+shouldBe(test3({}), `[object Object]`);
diff --git a/implementation-contributed/javascriptcore/stress/string-value-of-error.js b/implementation-contributed/javascriptcore/stress/string-value-of-error.js
new file mode 100644
index 0000000000000000000000000000000000000000..53bca53328c2634de6c95c71818b881762a8cf94
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/string-value-of-error.js
@@ -0,0 +1,45 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+function shouldThrow(func, errorMessage) {
+ var errorThrown = false;
+ var error = null;
+ try {
+ func();
+ } catch (e) {
+ errorThrown = true;
+ error = e;
+ }
+ if (!errorThrown)
+ throw new Error('not thrown');
+ if (String(error) !== errorMessage)
+ throw new Error(`bad error: ${String(error)}`);
+}
+
+var valueOf = String.prototype.valueOf;
+function test(string)
+{
+ return valueOf.call(string);
+}
+noInline(test);
+
+var object = {};
+var symbol = Symbol("Cocoa");
+for (var i = 0; i < 3e3; ++i) {
+ shouldThrow(() => test(object), `TypeError: Type error`);
+ shouldThrow(() => test(false), `TypeError: Type error`);
+ shouldThrow(() => test(true), `TypeError: Type error`);
+ shouldThrow(() => test(42), `TypeError: Type error`);
+ shouldThrow(() => test(null), `TypeError: Type error`);
+ shouldThrow(() => test(undefined), `TypeError: Type error`);
+ shouldThrow(() => test(symbol), `TypeError: Type error`);
+}
+
+var string = "Hello";
+var stringObject = new String(string);
+for (var i = 0; i < 1e2; ++i) {
+ shouldBe(test(string), string);
+ shouldBe(test(stringObject), string);
+}
diff --git a/implementation-contributed/javascriptcore/stress/string-value-of.js b/implementation-contributed/javascriptcore/stress/string-value-of.js
new file mode 100644
index 0000000000000000000000000000000000000000..4f6d2fd5ec6970b5eefee5e09db66a4a83d18c28
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/string-value-of.js
@@ -0,0 +1,39 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+function test1(string)
+{
+ return string.valueOf();
+}
+noInline(test1);
+
+function test2(string)
+{
+ return string.valueOf();
+}
+noInline(test2);
+
+function test3(string)
+{
+ return string.valueOf();
+}
+noInline(test3);
+
+var string = "Hello";
+var stringObject = new String(string);
+
+for (var i = 0; i < 1e6; ++i) {
+ shouldBe(test1(string), string);
+ shouldBe(test2(stringObject), string);
+ if (i & 1)
+ shouldBe(test3(string), string);
+ else
+ shouldBe(test3(stringObject), string);
+}
+
+var object = {};
+shouldBe(test1(object), object);
+shouldBe(test2(object), object);
+shouldBe(test3(object), object);