diff --git a/implementation-contributed/curation_logs/javascriptcore.json b/implementation-contributed/curation_logs/javascriptcore.json
index a07db43643ea2eca6064746c2dd3690a623be5d8..892e7626873f9224dc3eb4ec8c5796c5b667af55 100644
--- a/implementation-contributed/curation_logs/javascriptcore.json
+++ b/implementation-contributed/curation_logs/javascriptcore.json
@@ -1,6 +1,6 @@
{
- "sourceRevisionAtLastExport": "3353b2924e",
- "targetRevisionAtLastExport": "b0b5c9f9e",
+ "sourceRevisionAtLastExport": "13bea0a046",
+ "targetRevisionAtLastExport": "d544eaced",
"curatedFiles": {
"/stress/Number-isNaN-basics.js": "DELETED_IN_TARGET",
"/stress/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js": "DELETED_IN_TARGET",
diff --git a/implementation-contributed/javascriptcore/stress/arguments-elimination-will-generate-edge-without-result.js b/implementation-contributed/javascriptcore/stress/arguments-elimination-will-generate-edge-without-result.js
new file mode 100644
index 0000000000000000000000000000000000000000..49bad35a42ad9bf908bbf7911868cb252f870dff
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/arguments-elimination-will-generate-edge-without-result.js
@@ -0,0 +1,9 @@
+//@ runDefault("--validateGraphAtEachPhase=true", "--jitPolicyScale=0", "--useConcurrentJIT=0")
+
+'use strict';
+function foo() {
+ return arguments[1][0] === arguments[0];
+}
+for (let i = 0; i < 100000; ++i) {
+ foo(0, 0);
+}
diff --git a/implementation-contributed/javascriptcore/stress/array-indexof-cached-length.js b/implementation-contributed/javascriptcore/stress/array-indexof-cached-length.js
new file mode 100644
index 0000000000000000000000000000000000000000..602f8a2c62cdba90e8d037328a7ffe21e4cdf968
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/array-indexof-cached-length.js
@@ -0,0 +1,24 @@
+function assert(b) {
+ if (!b)
+ throw new Error;
+
+}
+
+const originalLength = 10000;
+let arr = new Proxy([], {
+ has(...args) {
+ assert(parseInt(args[1]) < originalLength);
+ assert(args[0].length - 10 === originalLength);
+ return Reflect.has(...args);
+ }
+});
+
+for (var i = 0; i < originalLength; i++)
+ arr[i] = [];
+
+arr.indexOf(new Object(), {
+ valueOf: function () {
+ arr.length += 10;
+ return 0;
+ }
+});
diff --git a/implementation-contributed/javascriptcore/stress/array-indexof-fast-path-effects.js b/implementation-contributed/javascriptcore/stress/array-indexof-fast-path-effects.js
new file mode 100644
index 0000000000000000000000000000000000000000..2dac83cb1e7f6618932039f2bd23609439a473c3
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/array-indexof-fast-path-effects.js
@@ -0,0 +1,11 @@
+// This shouldn't crash when running with ASAN.
+let arr = [];
+for (var i = 0; i < 1000000; i++)
+ arr[i] = [];
+
+arr.indexOf(new Object(), {
+ valueOf: function () {
+ arr.length = 0;
+ return 0;
+ }
+});
diff --git a/implementation-contributed/javascriptcore/stress/array-lastindexof-array-prototype-trap.js b/implementation-contributed/javascriptcore/stress/array-lastindexof-array-prototype-trap.js
new file mode 100644
index 0000000000000000000000000000000000000000..ee7bc7be911103dbc5585bf4b91f735f2224b08e
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/array-lastindexof-array-prototype-trap.js
@@ -0,0 +1,45 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+class AncestorArray extends Object {
+ get 2() {
+ this.called = true;
+ return 42;
+ }
+}
+
+Array.prototype.__proto__ = AncestorArray.prototype;
+
+{
+ let array = [];
+ array.length = 42;
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
+{
+ let array = [20, 20];
+ array.length = 42;
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
+{
+ let array = ["Hello"];
+ array.length = 42;
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
+{
+ let array = [42.195];
+ array.length = 42;
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
+{
+ let array = ["Hello"];
+ array.length = 42;
+ ensureArrayStorage(array);
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
diff --git a/implementation-contributed/javascriptcore/stress/array-lastindexof-cached-length.js b/implementation-contributed/javascriptcore/stress/array-lastindexof-cached-length.js
new file mode 100644
index 0000000000000000000000000000000000000000..066a4db7001ec4200fb9fafdc02704d63c51bd63
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/array-lastindexof-cached-length.js
@@ -0,0 +1,24 @@
+function assert(b) {
+ if (!b)
+ throw new Error;
+
+}
+
+const originalLength = 10000;
+let arr = new Proxy([], {
+ has(...args) {
+ assert(parseInt(args[1]) < originalLength);
+ assert(args[0].length - 10 === originalLength);
+ return Reflect.has(...args);
+ }
+});
+
+for (var i = 0; i < originalLength; i++)
+ arr[i] = [];
+
+arr.lastIndexOf(new Object(), {
+ valueOf: function () {
+ arr.length += 10;
+ return 0;
+ }
+});
diff --git a/implementation-contributed/javascriptcore/stress/array-lastindexof-fast-path-effects.js b/implementation-contributed/javascriptcore/stress/array-lastindexof-fast-path-effects.js
new file mode 100644
index 0000000000000000000000000000000000000000..a92651d29b89cf53f85a037928cb90cf3491d113
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/array-lastindexof-fast-path-effects.js
@@ -0,0 +1,11 @@
+// This shouldn't crash when running with ASAN.
+let arr = [];
+for (var i = 0; i < 1000000; i++)
+ arr[i] = [];
+
+arr.lastIndexOf(new Object(), {
+ valueOf: function () {
+ arr.length = 0;
+ return 0;
+ }
+});
diff --git a/implementation-contributed/javascriptcore/stress/array-lastindexof-have-a-bad-time-c-runtime.js b/implementation-contributed/javascriptcore/stress/array-lastindexof-have-a-bad-time-c-runtime.js
new file mode 100644
index 0000000000000000000000000000000000000000..81bab225a5e80acf6624b1a09d688c692a9f2550
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/array-lastindexof-have-a-bad-time-c-runtime.js
@@ -0,0 +1,43 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+Object.defineProperty(Array.prototype, 2, {
+ get() {
+ this.called = true;
+ return 42;
+ }
+});
+
+{
+ let array = [];
+ array.length = 42;
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
+{
+ let array = [20, 20];
+ array.length = 42;
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
+{
+ let array = ["Hello"];
+ array.length = 42;
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
+{
+ let array = [42.195];
+ array.length = 42;
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
+{
+ let array = ["Hello"];
+ array.length = 42;
+ ensureArrayStorage(array);
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
diff --git a/implementation-contributed/javascriptcore/stress/array-lastindexof-hole-nan.js b/implementation-contributed/javascriptcore/stress/array-lastindexof-hole-nan.js
new file mode 100644
index 0000000000000000000000000000000000000000..862ed837559c3ad7fbb907f110e66ca6e029e970
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/array-lastindexof-hole-nan.js
@@ -0,0 +1,19 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+
+{
+ let array = [42, , , 0];
+ shouldBe(array.lastIndexOf(Number.NaN), -1);
+ shouldBe(array.lastIndexOf(0), 3);
+}
+{
+ let array = [42.195, , , 0];
+ shouldBe(array.lastIndexOf(Number.NaN), -1);
+}
+{
+ let array = [42.195, Number.NaN, , 0];
+ shouldBe(array.lastIndexOf(Number.NaN), -1);
+}
diff --git a/implementation-contributed/javascriptcore/stress/array-lastindexof-infinity.js b/implementation-contributed/javascriptcore/stress/array-lastindexof-infinity.js
new file mode 100644
index 0000000000000000000000000000000000000000..3f0a4b616d72bd6106e6617ae95f702a410e33f6
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/array-lastindexof-infinity.js
@@ -0,0 +1,21 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+{
+ let array = [42.195, -0.0, -Infinity];
+ shouldBe(array.lastIndexOf(Infinity), -1);
+ shouldBe(array.lastIndexOf(-Infinity), 2);
+ shouldBe(array.lastIndexOf(42), -1);
+}
+{
+ let array = [1, 2, 3, 0];
+ shouldBe(array.lastIndexOf(Infinity), -1);
+ shouldBe(array.lastIndexOf(-Infinity), -1);
+}
+{
+ let array = ["String", 42.5, Infinity, 33];
+ shouldBe(array.lastIndexOf(Infinity), 2);
+ shouldBe(array.lastIndexOf(-Infinity), -1);
+}
diff --git a/implementation-contributed/javascriptcore/stress/array-lastindexof-negative-zero.js b/implementation-contributed/javascriptcore/stress/array-lastindexof-negative-zero.js
new file mode 100644
index 0000000000000000000000000000000000000000..42bf2ad5d2d1fa470a7e1b72c03ca1e5c850db13
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/array-lastindexof-negative-zero.js
@@ -0,0 +1,25 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+{
+ let array = [42.195, -0.0];
+ shouldBe(array.lastIndexOf(0), 1);
+ shouldBe(array.lastIndexOf(-0), 1);
+}
+{
+ let array = [42.195, 0, -0.0];
+ shouldBe(array.lastIndexOf(0), 2);
+ shouldBe(array.lastIndexOf(-0), 2);
+}
+{
+ let array = [42, 0];
+ shouldBe(array.lastIndexOf(0), 1);
+ shouldBe(array.lastIndexOf(-0), 1);
+}
+{
+ let array = [42, 0, 44];
+ shouldBe(array.lastIndexOf(0), 1);
+ shouldBe(array.lastIndexOf(-0), 1);
+}
diff --git a/implementation-contributed/javascriptcore/stress/array-lastindexof-own-getter.js b/implementation-contributed/javascriptcore/stress/array-lastindexof-own-getter.js
new file mode 100644
index 0000000000000000000000000000000000000000..adab0917d4b40c26448e29f7ea58a1203dbcecb1
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/array-lastindexof-own-getter.js
@@ -0,0 +1,66 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+{
+ let array = [];
+ Object.defineProperty(array, 2, {
+ get() {
+ this.called = true;
+ return 42;
+ }
+ });
+ array.length = 42;
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
+{
+ let array = [20, 20];
+ Object.defineProperty(array, 2, {
+ get() {
+ this.called = true;
+ return 42;
+ }
+ });
+ array.length = 42;
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
+{
+ let array = ["Hello"];
+ Object.defineProperty(array, 2, {
+ get() {
+ this.called = true;
+ return 42;
+ }
+ });
+ array.length = 42;
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
+{
+ let array = [42.195];
+ Object.defineProperty(array, 2, {
+ get() {
+ this.called = true;
+ return 42;
+ }
+ });
+ array.length = 42;
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
+{
+ let array = ["Hello"];
+ Object.defineProperty(array, 2, {
+ get() {
+ this.called = true;
+ return 42;
+ }
+ });
+ array.length = 42;
+ ensureArrayStorage(array);
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
diff --git a/implementation-contributed/javascriptcore/stress/array-lastindexof-prototype-trap.js b/implementation-contributed/javascriptcore/stress/array-lastindexof-prototype-trap.js
new file mode 100644
index 0000000000000000000000000000000000000000..ee5edcb04fdd99163a98f2a92c1fd9390ed999da
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/array-lastindexof-prototype-trap.js
@@ -0,0 +1,48 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+class DerivedArray extends Array {
+ get 2() {
+ this.called = true;
+ return 42;
+ }
+}
+
+{
+ let array = [];
+ array.__proto__ = DerivedArray.prototype;
+ array.length = 42;
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
+{
+ let array = [20, 20];
+ array.__proto__ = DerivedArray.prototype;
+ array.length = 42;
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
+{
+ let array = ["Hello"];
+ array.__proto__ = DerivedArray.prototype;
+ array.length = 42;
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
+{
+ let array = [42.195];
+ array.__proto__ = DerivedArray.prototype;
+ array.length = 42;
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
+{
+ let array = ["Hello"];
+ array.__proto__ = DerivedArray.prototype;
+ array.length = 42;
+ ensureArrayStorage(array);
+ shouldBe(array.lastIndexOf(42), 2);
+ shouldBe(array.called, true);
+}
diff --git a/implementation-contributed/javascriptcore/stress/use-baseline-codeblock-materialize-osr-exit.js b/implementation-contributed/javascriptcore/stress/use-baseline-codeblock-materialize-osr-exit.js
new file mode 100644
index 0000000000000000000000000000000000000000..f86d650175464dc8e710b20547ebea6e41d849cb
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/use-baseline-codeblock-materialize-osr-exit.js
@@ -0,0 +1,13 @@
+//@ runDefault("--jitPolicyScale=0")
+
+function foo() {
+ let j = 0;
+ let arr = [0];
+ arr.foo = 0;
+ for (var i = 0; i < 1024; i++) {
+ arr[0] = new Array(1024);
+ }
+}
+
+foo();
+foo();