Upgrade V8 to version 4.9.385.28
https://chromium.googlesource.com/v8/v8/+/4.9.385.28
FPIIM-449
Change-Id: I4b2e74289d4bf3667f2f3dc8aa2e541f63e26eb4
diff --git a/test/mjsunit/compiler/boolean-protototype.js b/test/mjsunit/compiler/boolean-protototype.js
new file mode 100644
index 0000000..5e940d7
--- /dev/null
+++ b/test/mjsunit/compiler/boolean-protototype.js
@@ -0,0 +1,43 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test1(s) {
+ return s.toString;
+}
+assertSame(test1(false), Boolean.prototype.toString);
+assertSame(test1(true), Boolean.prototype.toString);
+%OptimizeFunctionOnNextCall(test1);
+assertSame(test1(false), Boolean.prototype.toString);
+assertSame(test1(true), Boolean.prototype.toString);
+
+function test2(s) {
+ return s.valueOf;
+}
+assertSame(test2(false), Boolean.prototype.valueOf);
+assertSame(test2(true), Boolean.prototype.valueOf);
+%OptimizeFunctionOnNextCall(test2);
+assertSame(test2(false), Boolean.prototype.valueOf);
+assertSame(test2(true), Boolean.prototype.valueOf);
+
+Boolean.prototype.foo = 42;
+function test3(s) {
+ return s["foo"];
+}
+assertEquals(test3(false), 42);
+assertEquals(test3(true), 42);
+%OptimizeFunctionOnNextCall(test3);
+assertEquals(test3(false), 42);
+assertEquals(test3(true), 42);
+
+Boolean.prototype.bar = function bar() { "use strict"; return this; }
+function test4(s) {
+ return s.bar();
+}
+assertEquals(test4(false), false);
+assertEquals(test4(true), true);
+%OptimizeFunctionOnNextCall(test4);
+assertEquals(test4(false), false);
+assertEquals(test4(true), true);
diff --git a/test/mjsunit/compiler/deopt-bool.js b/test/mjsunit/compiler/deopt-bool.js
new file mode 100644
index 0000000..13a4a97
--- /dev/null
+++ b/test/mjsunit/compiler/deopt-bool.js
@@ -0,0 +1,28 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a, b) {
+ var passed = a == 3;
+ if (passed) {
+ if (passed) {
+ passed = b == 4;
+ }
+ }
+ %DeoptimizeFunction(foo);
+ return passed;
+}
+
+assertTrue(foo(3, 4));
+assertTrue(foo(3, 4));
+assertFalse(foo(3.1, 4));
+assertFalse(foo(3, 4.1));
+
+%OptimizeFunctionOnNextCall(foo);
+
+assertTrue(foo(3, 4));
+assertTrue(foo(3, 4));
+assertFalse(foo(3.1, 4));
+assertFalse(foo(3, 4.1));
diff --git a/test/mjsunit/compiler/deopt-bool2.js b/test/mjsunit/compiler/deopt-bool2.js
new file mode 100644
index 0000000..4d1c41e
--- /dev/null
+++ b/test/mjsunit/compiler/deopt-bool2.js
@@ -0,0 +1,31 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(expected, x) {
+ var passed = expected.length == x.length;
+ for (var i = 0; i < expected.length; i++) {
+ if (passed)
+ passed = expected[i] == x[i];
+ }
+ print("a");
+ print(passed);
+
+ %DeoptimizeFunction(foo);
+
+ print("b");
+ print(passed);
+ return passed;
+}
+
+assertTrue(foo([0,1], [0,1]));
+assertTrue(foo([0,2], [0,2]));
+assertFalse(foo([0,2.25], [0,2.75]));
+
+%OptimizeFunctionOnNextCall(foo);
+
+assertTrue(foo([0,1], [0,1]));
+assertTrue(foo([0,2], [0,2]));
+assertFalse(foo([0,2.25], [0,2.75]));
diff --git a/test/mjsunit/compiler/jsnatives.js b/test/mjsunit/compiler/deopt-during-eval-lookup.js
similarity index 80%
copy from test/mjsunit/compiler/jsnatives.js
copy to test/mjsunit/compiler/deopt-during-eval-lookup.js
index f5d6ac4..1df04bb 100644
--- a/test/mjsunit/compiler/jsnatives.js
+++ b/test/mjsunit/compiler/deopt-during-eval-lookup.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2015 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -27,7 +27,21 @@
// Flags: --allow-natives-syntax
-// Test call of JS runtime functions.
+function g() {
+ return 100;
+}
-var a = %GlobalParseInt("21", 16);
-assertEquals(33, a);
+function getter() {
+ // Test that we can deopt during the CallRuntimeForPair call to LoadLookupSlot
+ %DeoptimizeFunction(f);
+ return g;
+}
+
+Object.defineProperty(this, "eval", {get: getter });
+
+function f() {
+ return eval("200");
+}
+
+%OptimizeFunctionOnNextCall(f);
+assertEquals(100, f());
diff --git a/test/mjsunit/compiler/deopt-tonumber-binop.js b/test/mjsunit/compiler/deopt-tonumber-binop.js
new file mode 100644
index 0000000..c93ef9d
--- /dev/null
+++ b/test/mjsunit/compiler/deopt-tonumber-binop.js
@@ -0,0 +1,40 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+//
+var f = (function() {
+ "use asm";
+ function f(x, y) {
+ return x - y;
+ }
+ return f;
+})();
+
+var counter = 0;
+
+var deopt = { toString : function() {
+ %DeoptimizeFunction(f);
+ counter++;
+ return "2";
+} };
+
+var o = { toString : function() {
+ counter++;
+ return "1";
+} };
+
+counter = 0;
+assertEquals(1, f(deopt, o));
+assertEquals(2, counter);
+
+%OptimizeFunctionOnNextCall(f);
+counter = 0;
+assertEquals(-1, f(o, deopt));
+assertEquals(2, counter);
+
+%OptimizeFunctionOnNextCall(f);
+counter = 0;
+assertEquals(0, f(deopt, deopt));
+assertEquals(2, counter);
diff --git a/test/mjsunit/compiler/deopt-tonumber-compare.js b/test/mjsunit/compiler/deopt-tonumber-compare.js
new file mode 100644
index 0000000..9a7e992
--- /dev/null
+++ b/test/mjsunit/compiler/deopt-tonumber-compare.js
@@ -0,0 +1,44 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var m = (function() {
+ "use asm";
+ function f(x) {
+ return x < 0;
+ }
+ function g(x) {
+ return 0 < x;
+ }
+ return { f: f, g: g };
+})();
+var f = m.f;
+var g = m.g;
+
+var counter = 0;
+
+function deopt(f) {
+ return {
+ toString : function() {
+ %DeoptimizeFunction(f);
+ counter++;
+ return "2";
+ }
+ };
+}
+
+assertEquals(false, f(deopt(f)));
+assertEquals(1, counter);
+
+assertEquals(true, g(deopt(g)));
+assertEquals(2, counter);
+
+%OptimizeFunctionOnNextCall(f);
+assertEquals(false, f(deopt(f)));
+assertEquals(3, counter);
+
+%OptimizeFunctionOnNextCall(g);
+assertEquals(true, g(deopt(g)));
+assertEquals(4, counter);
diff --git a/test/mjsunit/compiler/deopt-tonumber-shift.js b/test/mjsunit/compiler/deopt-tonumber-shift.js
new file mode 100644
index 0000000..bb4d1d5
--- /dev/null
+++ b/test/mjsunit/compiler/deopt-tonumber-shift.js
@@ -0,0 +1,40 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var f = (function() {
+ "use asm";
+ function f(x, y) {
+ return x << y;
+ }
+ return f;
+})();
+
+var counter = 0;
+
+var deopt = { toString : function() {
+ %DeoptimizeFunction(f);
+ counter++;
+ return "2";
+} };
+
+var o = { toString : function() {
+ counter++;
+ return "1";
+} };
+
+counter = 0;
+assertEquals(4, f(deopt, o));
+assertEquals(2, counter);
+
+%OptimizeFunctionOnNextCall(f);
+counter = 0;
+assertEquals(4, f(o, deopt));
+assertEquals(2, counter);
+
+%OptimizeFunctionOnNextCall(f);
+counter = 0;
+assertEquals(8, f(deopt, deopt));
+assertEquals(2, counter);
diff --git a/test/mjsunit/compiler/eager-deopt-simple.js b/test/mjsunit/compiler/eager-deopt-simple.js
new file mode 100644
index 0000000..067400c
--- /dev/null
+++ b/test/mjsunit/compiler/eager-deopt-simple.js
@@ -0,0 +1,18 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g(a, b, c) {
+ return a + b + c;
+}
+
+function f() {
+ return g(1, (%_DeoptimizeNow(), 2), 3);
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+assertEquals(6, f());
diff --git a/test/mjsunit/compiler/jsnatives.js b/test/mjsunit/compiler/escape-analysis-1.js
similarity index 82%
copy from test/mjsunit/compiler/jsnatives.js
copy to test/mjsunit/compiler/escape-analysis-1.js
index f5d6ac4..b8c6644 100644
--- a/test/mjsunit/compiler/jsnatives.js
+++ b/test/mjsunit/compiler/escape-analysis-1.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2015 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,9 +25,19 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-escape
+//
-// Test call of JS runtime functions.
+function f(a) {
+ "use strict";
+ return arguments.length;
+}
-var a = %GlobalParseInt("21", 16);
-assertEquals(33, a);
+function g() {
+ return f(1,2,3);
+}
+
+assertEquals(3, g());
+assertEquals(3, g());
+%OptimizeFunctionOnNextCall(g);
+assertEquals(3, g());
diff --git a/test/mjsunit/compiler/jsnatives.js b/test/mjsunit/compiler/escape-analysis-10.js
similarity index 85%
rename from test/mjsunit/compiler/jsnatives.js
rename to test/mjsunit/compiler/escape-analysis-10.js
index f5d6ac4..c53cf4d 100644
--- a/test/mjsunit/compiler/jsnatives.js
+++ b/test/mjsunit/compiler/escape-analysis-10.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2015 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,9 +25,13 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
-
-// Test call of JS runtime functions.
-
-var a = %GlobalParseInt("21", 16);
-assertEquals(33, a);
+// Flags: --allow-natives-syntax --turbo-escape
+(function() {
+ "use strict";
+ function f() {
+ for (let i = 0; i < 5; ++i) {
+ function g() { return i }
+ }
+ }
+ f();
+})();
diff --git a/test/mjsunit/compiler/jsnatives.js b/test/mjsunit/compiler/escape-analysis-2.js
similarity index 81%
copy from test/mjsunit/compiler/jsnatives.js
copy to test/mjsunit/compiler/escape-analysis-2.js
index f5d6ac4..d116e9a 100644
--- a/test/mjsunit/compiler/jsnatives.js
+++ b/test/mjsunit/compiler/escape-analysis-2.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2015 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,9 +25,21 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-escape
+//
-// Test call of JS runtime functions.
+function f(a) {
+ "use strict";
+ if (arguments === a)
+ return 1;
+ return arguments.length;
+}
-var a = %GlobalParseInt("21", 16);
-assertEquals(33, a);
+function g(a) {
+ return f(a,1,2,3);
+}
+
+assertEquals(4, g());
+assertEquals(4, g());
+%OptimizeFunctionOnNextCall(g);
+assertEquals(4, g());
diff --git a/test/mjsunit/compiler/jsnatives.js b/test/mjsunit/compiler/escape-analysis-3.js
similarity index 81%
copy from test/mjsunit/compiler/jsnatives.js
copy to test/mjsunit/compiler/escape-analysis-3.js
index f5d6ac4..d1ebc9b 100644
--- a/test/mjsunit/compiler/jsnatives.js
+++ b/test/mjsunit/compiler/escape-analysis-3.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2015 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,9 +25,20 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-escape
+//
-// Test call of JS runtime functions.
+function f(a) {
+ "use strict";
+ return arguments.length;
+}
-var a = %GlobalParseInt("21", 16);
-assertEquals(33, a);
+function g() {
+ "use strict";
+ return arguments[f(1,2)];
+}
+
+assertEquals(6, g(4,5,6));
+assertEquals(6, g(4,5,6));
+%OptimizeFunctionOnNextCall(g);
+assertEquals(6, g(4,5,6));
diff --git a/test/mjsunit/compiler/jsnatives.js b/test/mjsunit/compiler/escape-analysis-4.js
similarity index 77%
copy from test/mjsunit/compiler/jsnatives.js
copy to test/mjsunit/compiler/escape-analysis-4.js
index f5d6ac4..d9fdccc 100644
--- a/test/mjsunit/compiler/jsnatives.js
+++ b/test/mjsunit/compiler/escape-analysis-4.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2015 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,9 +25,24 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-escape
+//
-// Test call of JS runtime functions.
+function f(a) {
+ "use strict";
+ return arguments.length;
+}
-var a = %GlobalParseInt("21", 16);
-assertEquals(33, a);
+function h() {
+ "use strict";
+ return arguments;
+}
+
+function g() {
+ return "" + f(1,2,3) + " " + h(4,5,6);
+}
+
+assertEquals("3 [object Arguments]", g());
+assertEquals("3 [object Arguments]", g());
+%OptimizeFunctionOnNextCall(g);
+assertEquals("3 [object Arguments]", g());
diff --git a/test/mjsunit/compiler/jsnatives.js b/test/mjsunit/compiler/escape-analysis-5.js
similarity index 79%
copy from test/mjsunit/compiler/jsnatives.js
copy to test/mjsunit/compiler/escape-analysis-5.js
index f5d6ac4..cfaf81d 100644
--- a/test/mjsunit/compiler/jsnatives.js
+++ b/test/mjsunit/compiler/escape-analysis-5.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2015 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,9 +25,24 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-escape
+//
-// Test call of JS runtime functions.
+function f(h) {
+ "use strict";
+ h(arguments);
+ return arguments.length;
+}
-var a = %GlobalParseInt("21", 16);
-assertEquals(33, a);
+function g(h) {
+ return f(h,1,2,3);
+}
+
+function h(x) {
+ assertEquals("[object Arguments]", ""+x)
+}
+
+assertEquals(4, g(h));
+assertEquals(4, g(h));
+%OptimizeFunctionOnNextCall(g);
+assertEquals(4, g(h));
diff --git a/test/mjsunit/compiler/jsnatives.js b/test/mjsunit/compiler/escape-analysis-6.js
similarity index 79%
copy from test/mjsunit/compiler/jsnatives.js
copy to test/mjsunit/compiler/escape-analysis-6.js
index f5d6ac4..6143cfb 100644
--- a/test/mjsunit/compiler/jsnatives.js
+++ b/test/mjsunit/compiler/escape-analysis-6.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2015 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,9 +25,24 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-escape
+//
-// Test call of JS runtime functions.
+function f(a) {
+ "use strict";
+ return arguments;
+}
-var a = %GlobalParseInt("21", 16);
-assertEquals(33, a);
+function g() {
+ "use strict";
+ var x = f(1,2,3);
+ while (x.length < 4) {
+ x = f(4,5,6,7,8);
+ }
+ return x.length;
+}
+
+assertEquals(5, g());
+assertEquals(5, g());
+%OptimizeFunctionOnNextCall(g);
+assertEquals(5, g());
diff --git a/test/mjsunit/compiler/jsnatives.js b/test/mjsunit/compiler/escape-analysis-7.js
similarity index 78%
copy from test/mjsunit/compiler/jsnatives.js
copy to test/mjsunit/compiler/escape-analysis-7.js
index f5d6ac4..16bc71c 100644
--- a/test/mjsunit/compiler/jsnatives.js
+++ b/test/mjsunit/compiler/escape-analysis-7.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2015 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,9 +25,28 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-escape
+//
-// Test call of JS runtime functions.
+function f() {
+ this.x=0;
+}
-var a = %GlobalParseInt("21", 16);
-assertEquals(33, a);
+function g(a) {
+ "use strict";
+ var o = new f();
+ if (a) {
+ o.x = 5;
+ } else {
+ o.x = 7;
+ }
+
+ return o.x;
+}
+
+assertEquals(5, g(true));
+assertEquals(7, g(false));
+%OptimizeFunctionOnNextCall(g);
+assertEquals(5, g(true));
+assertEquals(7, g(false));
+assertEquals(7, g());
diff --git a/test/mjsunit/compiler/jsnatives.js b/test/mjsunit/compiler/escape-analysis-8.js
similarity index 80%
copy from test/mjsunit/compiler/jsnatives.js
copy to test/mjsunit/compiler/escape-analysis-8.js
index f5d6ac4..bc5b1d9 100644
--- a/test/mjsunit/compiler/jsnatives.js
+++ b/test/mjsunit/compiler/escape-analysis-8.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2015 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,9 +25,25 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-escape
+//
-// Test call of JS runtime functions.
+function f(a) {
+ this.x=a;
+ this.y=1;
+}
-var a = %GlobalParseInt("21", 16);
-assertEquals(33, a);
+function g() {
+ "use strict";
+ var o = new f(2);
+ while (o.y < 4) {
+ o.x = 5;
+ o.y = 5;
+ }
+ return o.x;
+}
+
+assertEquals(5, g());
+assertEquals(5, g());
+%OptimizeFunctionOnNextCall(g);
+assertEquals(5, g());
diff --git a/test/mjsunit/compiler/jsnatives.js b/test/mjsunit/compiler/escape-analysis-9.js
similarity index 78%
copy from test/mjsunit/compiler/jsnatives.js
copy to test/mjsunit/compiler/escape-analysis-9.js
index f5d6ac4..a19786b 100644
--- a/test/mjsunit/compiler/jsnatives.js
+++ b/test/mjsunit/compiler/escape-analysis-9.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2015 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,9 +25,28 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-escape
+//
-// Test call of JS runtime functions.
+function f() {
+ return arguments;
+}
-var a = %GlobalParseInt("21", 16);
-assertEquals(33, a);
+function g(a) {
+ "use strict";
+ var o = f(1,2);
+ if (a) {
+ o[0] = 5;
+ } else {
+ o[0] = 7;
+ }
+
+ return o[0];
+}
+
+assertEquals(7, g());
+assertEquals(7, g());
+%OptimizeFunctionOnNextCall(g);
+assertEquals(5, g(true));
+assertEquals(7, g(false));
+assertEquals(7, g());
diff --git a/test/mjsunit/compiler/jsnatives.js b/test/mjsunit/compiler/escape-analysis-deopt-1.js
similarity index 73%
copy from test/mjsunit/compiler/jsnatives.js
copy to test/mjsunit/compiler/escape-analysis-deopt-1.js
index f5d6ac4..7337264 100644
--- a/test/mjsunit/compiler/jsnatives.js
+++ b/test/mjsunit/compiler/escape-analysis-deopt-1.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2013 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,9 +25,23 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-escape
-// Test call of JS runtime functions.
-
-var a = %GlobalParseInt("21", 16);
-assertEquals(33, a);
+// Test deoptimization with captured objects in local variables.
+(function testDeoptLocal() {
+ "use strict";
+ function constructor1(a) {
+ return arguments;
+ }
+ function func(a) {
+ var o1 = constructor1(1,2,3);
+ if (a) { %DeoptimizeNow(); }
+ assertEquals(1, o1[0]);
+ assertEquals(2, o1[1]);
+ assertEquals(3, o1[2]);
+ }
+ func(false);
+ func(false);
+ %OptimizeFunctionOnNextCall(func);
+ func(true);
+})();
diff --git a/test/mjsunit/compiler/jsnatives.js b/test/mjsunit/compiler/escape-analysis-deopt-2.js
similarity index 71%
copy from test/mjsunit/compiler/jsnatives.js
copy to test/mjsunit/compiler/escape-analysis-deopt-2.js
index f5d6ac4..306f3e7 100644
--- a/test/mjsunit/compiler/jsnatives.js
+++ b/test/mjsunit/compiler/escape-analysis-deopt-2.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2013 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,9 +25,26 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-escape
-// Test call of JS runtime functions.
-
-var a = %GlobalParseInt("21", 16);
-assertEquals(33, a);
+// Test deoptimization with captured objects in local variables.
+(function testDeoptLocal() {
+ "use strict";
+ function constructor1(a) {
+ return arguments;
+ }
+ function func() {
+ var o1 = constructor1(1,2,3);
+ var o2 = constructor1(4,o1);
+ %DeoptimizeNow();
+ assertEquals(1, o1[0]);
+ assertEquals(2, o1[1]);
+ assertEquals(3, o1[2]);
+ assertEquals(4, o2[0]);
+ assertEquals(o1, o2[1]);
+ }
+ func();
+ func();
+ %OptimizeFunctionOnNextCall(func);
+ func();
+})();
diff --git a/test/mjsunit/compiler/jsnatives.js b/test/mjsunit/compiler/escape-analysis-deopt-3.js
similarity index 71%
copy from test/mjsunit/compiler/jsnatives.js
copy to test/mjsunit/compiler/escape-analysis-deopt-3.js
index f5d6ac4..9999e53 100644
--- a/test/mjsunit/compiler/jsnatives.js
+++ b/test/mjsunit/compiler/escape-analysis-deopt-3.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2013 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,9 +25,27 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-escape
-// Test call of JS runtime functions.
-
-var a = %GlobalParseInt("21", 16);
-assertEquals(33, a);
+// Test deoptimization with captured objects in local variables.
+(function testDeoptLocal() {
+ "use strict";
+ function constructor1(a) {
+ return arguments;
+ }
+ function func() {
+ var o1 = constructor1(1,2,3);
+ var o2 = constructor1(4,o1);
+ o1[0] = o1;
+ %DeoptimizeNow();
+ assertEquals(o1, o1[0]);
+ assertEquals(2, o1[1]);
+ assertEquals(3, o1[2]);
+ assertEquals(4, o2[0]);
+ assertEquals(o1, o2[1]);
+ }
+ func();
+ func();
+ %OptimizeFunctionOnNextCall(func);
+ func();
+})();
diff --git a/test/mjsunit/compiler/jsnatives.js b/test/mjsunit/compiler/escape-analysis-deopt-4.js
similarity index 68%
copy from test/mjsunit/compiler/jsnatives.js
copy to test/mjsunit/compiler/escape-analysis-deopt-4.js
index f5d6ac4..c807657 100644
--- a/test/mjsunit/compiler/jsnatives.js
+++ b/test/mjsunit/compiler/escape-analysis-deopt-4.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2013 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,9 +25,33 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-escape
-// Test call of JS runtime functions.
-
-var a = %GlobalParseInt("21", 16);
-assertEquals(33, a);
+// Test deoptimization with captured objects in local variables.
+(function testDeoptLocal() {
+ "use strict";
+ function constructor1() {
+ this.x=1;
+ this.y=2;
+ this.z=3;
+ }
+ function constructor2(x) {
+ this.a=x;
+ this.b=4;
+ }
+ function func() {
+ var o1 = new constructor1();
+ var o2 = new constructor2(o1);
+ o1.x = o1;
+ %DeoptimizeNow();
+ assertEquals(o1, o1.x);
+ assertEquals(2, o1.y);
+ assertEquals(3, o1.z);
+ assertEquals(o1, o2.a);
+ assertEquals(4, o2.b);
+ }
+ func();
+ func();
+ %OptimizeFunctionOnNextCall(func);
+ func();
+})();
diff --git a/test/mjsunit/compiler/jsnatives.js b/test/mjsunit/compiler/escape-analysis-deopt-5.js
similarity index 81%
copy from test/mjsunit/compiler/jsnatives.js
copy to test/mjsunit/compiler/escape-analysis-deopt-5.js
index f5d6ac4..e70f0b1 100644
--- a/test/mjsunit/compiler/jsnatives.js
+++ b/test/mjsunit/compiler/escape-analysis-deopt-5.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2016 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,9 +25,17 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-escape
-// Test call of JS runtime functions.
+function f() {
+ var x = new Array(2);
+ x[0] = 23.1234;
+ x[1] = 25.1234;
+ %DeoptimizeNow();
+ return x[0];
+}
-var a = %GlobalParseInt("21", 16);
-assertEquals(33, a);
+assertEquals(f(), 23.1234);
+assertEquals(f(), 23.1234);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(f(), 23.1234);
diff --git a/test/mjsunit/compiler/generic-add.js b/test/mjsunit/compiler/generic-add.js
new file mode 100644
index 0000000..f61cd10
--- /dev/null
+++ b/test/mjsunit/compiler/generic-add.js
@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function dateL() {
+ var date = new Date();
+ return (date + true) == date.toString() + true;
+}
+
+function dateR() {
+ var date = new Date();
+ return (true + date) == true + date.toString();
+}
+
+function strL() {
+ return (new String(1) + true) == "1true";
+}
+
+function strR() {
+ return (true + new String(1)) == "true1";
+}
+
+assertTrue(dateL());
+assertTrue(dateR());
+assertTrue(strL());
+assertTrue(strR());
diff --git a/test/mjsunit/compiler/global-delete.js b/test/mjsunit/compiler/global-delete.js
new file mode 100644
index 0000000..c32fda6
--- /dev/null
+++ b/test/mjsunit/compiler/global-delete.js
@@ -0,0 +1,73 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test(expected, f) {
+ assertEquals(expected, f());
+ assertEquals(expected, f());
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(expected, f());
+ assertEquals(expected, f());
+}
+
+function testThrows(f) {
+ assertThrows(f);
+ assertThrows(f);
+ %OptimizeFunctionOnNextCall(f);
+ assertThrows(f);
+ assertThrows(f);
+}
+
+// --- Constant case.
+a = 11;
+
+function f1() { return a; }
+test(11, f1);
+
+delete a;
+
+testThrows(f1);
+
+
+// --- SMI case.
+
+b = 11;
+b = 12;
+b = 13;
+
+function f2() { return b; }
+test(13, f2);
+
+delete b;
+
+testThrows(f2);
+
+
+// --- double case.
+
+c = 11;
+c = 12.25;
+c = 13.25;
+
+function f3() { return c; }
+test(13.25, f3);
+
+delete c;
+
+testThrows(f3);
+
+
+// --- tagged case.
+
+d = 11;
+d = 12.25;
+d = "hello";
+
+function f4() { return d; }
+test("hello", f4);
+
+delete d;
+
+testThrows(f4);
diff --git a/test/mjsunit/compiler/global-var-delete.js b/test/mjsunit/compiler/global-var-delete.js
new file mode 100644
index 0000000..a7ea9ea
--- /dev/null
+++ b/test/mjsunit/compiler/global-var-delete.js
@@ -0,0 +1,73 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test(expected, f) {
+ assertEquals(expected, f());
+ assertEquals(expected, f());
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(expected, f());
+ assertEquals(expected, f());
+}
+
+function testThrows(f) {
+ assertThrows(f);
+ assertThrows(f);
+ %OptimizeFunctionOnNextCall(f);
+ assertThrows(f);
+ assertThrows(f);
+}
+
+// --- Constant case.
+var a = 11;
+
+function f1() { return a; }
+test(11, f1);
+
+delete a;
+
+test(11, f1);
+
+
+// --- SMI case.
+
+var b = 11;
+b = 12;
+b = 13;
+
+function f2() { return b; }
+test(13, f2);
+
+delete b;
+
+test(13, f2);
+
+
+// --- double case.
+
+var c = 11;
+c = 12.25;
+c = 13.25;
+
+function f3() { return c; }
+test(13.25, f3);
+
+delete c;
+
+test(13.25, f3);
+
+
+// --- tagged case.
+
+var d = 11;
+d = 12.25;
+d = "hello";
+
+function f4() { return d; }
+test("hello", f4);
+
+delete d;
+
+test("hello", f4);
diff --git a/test/mjsunit/compiler/inlined-call-mapcheck.js b/test/mjsunit/compiler/inlined-call-mapcheck.js
index 84ec1d2..1f7b2da 100644
--- a/test/mjsunit/compiler/inlined-call-mapcheck.js
+++ b/test/mjsunit/compiler/inlined-call-mapcheck.js
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax --noalways-opt
+// Flags: --allow-natives-syntax
(function() {
function f(x) {
diff --git a/test/mjsunit/compiler/inlined-call.js b/test/mjsunit/compiler/inlined-call.js
index dfa1675..f296b08 100644
--- a/test/mjsunit/compiler/inlined-call.js
+++ b/test/mjsunit/compiler/inlined-call.js
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax --noalways-opt
+// Flags: --allow-natives-syntax
var global = this;
diff --git a/test/mjsunit/compiler/lazy-deopt-in-literal.js b/test/mjsunit/compiler/lazy-deopt-in-literal.js
new file mode 100644
index 0000000..0a1481c
--- /dev/null
+++ b/test/mjsunit/compiler/lazy-deopt-in-literal.js
@@ -0,0 +1,20 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function deopt() {
+ %DeoptimizeFunction(fun3);
+}
+
+function fun3() {
+ var r = { 113: deopt(), 113: 7 };
+ return r[113];
+}
+
+fun3();
+fun3();
+%OptimizeFunctionOnNextCall(fun3);
+var y = fun3();
+assertEquals(7, y);
diff --git a/test/mjsunit/compiler/lazy-iife-no-parens.js b/test/mjsunit/compiler/lazy-iife-no-parens.js
new file mode 100644
index 0000000..cbad4da
--- /dev/null
+++ b/test/mjsunit/compiler/lazy-iife-no-parens.js
@@ -0,0 +1,43 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+
+// Test that IIFEs are compilable even under lazy conditions where the enclosing
+// parentheses heuristic has not been triggered.
+
+function f() {
+ return function(){ return 0; }();
+}
+
+function g() {
+ function h() {
+ return function(){ return 0; }();
+ }
+ return h();
+}
+
+f();
+
+g();
+
+0, function(){}();
+
+(function(){ 0, function(){}(); })();
+
+0, function(){ (function(){ 0, function(){}(); })(); }();
diff --git a/test/mjsunit/compiler/mul-div-52bit.js b/test/mjsunit/compiler/mul-div-52bit.js
new file mode 100644
index 0000000..46a5d05
--- /dev/null
+++ b/test/mjsunit/compiler/mul-div-52bit.js
@@ -0,0 +1,86 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function mul(a, b) {
+ const l = a & 0x3ffffff;
+ const h = b & 0x3ffffff;
+
+ return (l * h) >>> 0;
+}
+
+function mulAndDiv(a, b) {
+ const l = a & 0x3ffffff;
+ const h = b & 0x3ffffff;
+ const m = l * h;
+
+ const rl = m & 0x3ffffff;
+ const rh = (m / 0x4000000) >>> 0;
+
+ return rl | rh;
+}
+
+function overflowMul(a, b) {
+ const l = a | 0;
+ const h = b | 0;
+
+ return (l * h) >>> 0;
+}
+
+function overflowDiv(a, b) {
+ const l = a & 0x3ffffff;
+ const h = b & 0x3ffffff;
+ const m = l * h;
+
+ return (m / 0x10) >>> 0;
+}
+
+function nonPowerOfTwoDiv(a, b) {
+ const l = a & 0x3ffffff;
+ const h = b & 0x3ffffff;
+ const m = l * h;
+
+ return (m / 0x4000001) >>> 0;
+}
+
+function test(fn, a, b, sets) {
+ const expected = fn(a, b);
+ fn(1, 2);
+ fn(0, 0);
+ %OptimizeFunctionOnNextCall(fn);
+ const actual = fn(a, b);
+
+ assertEquals(expected, actual);
+
+ sets.forEach(function(set, i) {
+ assertEquals(set.expected, fn(set.a, set.b), fn.name + ', set #' + i);
+ });
+}
+
+test(mul, 0x3ffffff, 0x3ffffff, [
+ { a: 0, b: 0, expected: 0 },
+ { a: 0xdead, b: 0xbeef, expected: 0xa6144983 },
+ { a: 0x1aa1dea, b: 0x2badead, expected: 0x35eb2322 }
+]);
+test(mulAndDiv, 0x3ffffff, 0x3ffffff, [
+ { a: 0, b: 0, expected: 0 },
+ { a: 0xdead, b: 0xbeef, expected: 0x21449ab },
+ { a: 0x1aa1dea, b: 0x2badead, expected: 0x1ebf32f }
+]);
+test(overflowMul, 0x4ffffff, 0x4ffffff, [
+ { a: 0, b: 0, expected: 0 },
+ { a: 0xdead, b: 0xbeef, expected: 0xa6144983 },
+ { a: 0x1aa1dea, b: 0x2badead, expected: 0x35eb2322 }
+]);
+test(overflowDiv, 0x3ffffff, 0x3ffffff, [
+ { a: 0, b: 0, expected: 0 },
+ { a: 0xdead, b: 0xbeef, expected: 0xa614498 },
+ { a: 0x1aa1dea, b: 0x2badead, expected: 0x835eb232 }
+]);
+test(nonPowerOfTwoDiv, 0x3ffffff, 0x3ffffff, [
+ { a: 0, b: 0, expected: 0 },
+ { a: 0xdead, b: 0xbeef, expected: 0x29 },
+ { a: 0x1aa1dea, b: 0x2badead, expected: 0x122d20d }
+]);
diff --git a/test/mjsunit/compiler/named-load.js b/test/mjsunit/compiler/named-load.js
new file mode 100644
index 0000000..3527b83
--- /dev/null
+++ b/test/mjsunit/compiler/named-load.js
@@ -0,0 +1,31 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Foo(a, b) {
+ this.a = a;
+ this.b = b;
+ var bname = "b";
+ this.x = this["a"] + this[bname];
+}
+
+var f1 = new Foo(3, 4);
+assertEquals(7, f1.x);
+
+// SMIs
+for (var i = 0; i < 6; i++) {
+ var f = new Foo(i, i + 2);
+ assertEquals(i + i + 2, f.x);
+}
+
+// derbles
+for (var i = 0.25; i < 6.25; i++) {
+ var f = new Foo(i, i + 2);
+ assertEquals(i + i + 2, f.x);
+}
+
+// stirngs
+for (var i = 0; i < 6; i++) {
+ var f = new Foo(i + "", (i + 2) + "");
+ assertEquals((i + "") + ((i + 2) + ""), f.x);
+}
diff --git a/test/mjsunit/compiler/named-store.js b/test/mjsunit/compiler/named-store.js
new file mode 100644
index 0000000..8d1306a
--- /dev/null
+++ b/test/mjsunit/compiler/named-store.js
@@ -0,0 +1,31 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Foo(a, b) {
+ var bname = "b";
+ this["a"] = a;
+ this[bname] = b;
+ this.x = this.a + this.b;
+}
+
+var f1 = new Foo(3, 4);
+assertEquals(7, f1.x);
+
+// SMIs
+for (var i = 0; i < 6; i++) {
+ var f = new Foo(i, i + 2);
+ assertEquals(i + i + 2, f.x);
+}
+
+// derbles
+for (var i = 0.25; i < 6.25; i++) {
+ var f = new Foo(i, i + 2);
+ assertEquals(i + i + 2, f.x);
+}
+
+// stirngs
+for (var i = 0; i < 6; i++) {
+ var f = new Foo(i + "", (i + 2) + "");
+ assertEquals((i + "") + ((i + 2) + ""), f.x);
+}
diff --git a/test/mjsunit/compiler/opt-next-call-turbo.js b/test/mjsunit/compiler/opt-next-call-turbo.js
new file mode 100644
index 0000000..d4beff9
--- /dev/null
+++ b/test/mjsunit/compiler/opt-next-call-turbo.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-filter=*
+
+function foo() {
+ with ({ value:"fooed" }) { return value; }
+}
+
+%OptimizeFunctionOnNextCall(foo);
+assertEquals("fooed", foo());
+assertOptimized(foo);
+
+function bar() {
+ with ({ value:"bared" }) { return value; }
+}
+
+assertEquals("bared", bar());
+%OptimizeFunctionOnNextCall(bar);
+assertEquals("bared", bar());
+assertOptimized(bar);
diff --git a/test/mjsunit/compiler/opt-next-call.js b/test/mjsunit/compiler/opt-next-call.js
index 6366c7d..3d7e74f 100644
--- a/test/mjsunit/compiler/opt-next-call.js
+++ b/test/mjsunit/compiler/opt-next-call.js
@@ -11,3 +11,12 @@
%OptimizeFunctionOnNextCall(foo);
assertEquals("fooed", foo());
assertOptimized(foo);
+
+function bar() {
+ return "bared";
+}
+
+assertEquals("bared", bar());
+%OptimizeFunctionOnNextCall(bar);
+assertEquals("bared", bar());
+assertOptimized(bar);
diff --git a/test/mjsunit/compiler/optimize_max.js b/test/mjsunit/compiler/optimize_max.js
new file mode 100644
index 0000000..6baefe4
--- /dev/null
+++ b/test/mjsunit/compiler/optimize_max.js
@@ -0,0 +1,69 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var DOUBLE_ZERO = %AllocateHeapNumber();
+var SMI_ZERO = 0;
+var MINUS_ZERO = -0.0;
+
+function max1(a, b) {
+ a = +a;
+ b = +b;
+ return +(a < b ? b : a);
+}
+
+function max2(a, b) {
+ a = +a;
+ b = +b;
+ return a < b ? b : a;
+}
+
+for (f of [max1, max2]) {
+ for (var i = 0; i < 5; i++) {
+ assertEquals(4, f(3, 4));
+ assertEquals(4, f(4, 3));
+ assertEquals(4.3, f(3.3, 4.3));
+ assertEquals(4.4, f(4.4, 3.4));
+
+ assertEquals(Infinity, 1 / f(SMI_ZERO, MINUS_ZERO));
+ assertEquals(Infinity, 1 / f(DOUBLE_ZERO, MINUS_ZERO));
+ assertEquals(-Infinity, 1 / f(MINUS_ZERO, SMI_ZERO));
+ assertEquals(-Infinity, 1 / f(MINUS_ZERO, DOUBLE_ZERO));
+
+ assertEquals(NaN, f(NaN, NaN));
+ assertEquals(3, f(3, NaN));
+ assertEquals(NaN, f(NaN, 3));
+ }
+}
+
+function max3(a, b) {
+ a = +a;
+ b = +b;
+ return +(a > b ? a : b);
+}
+
+function max4(a, b) {
+ a = +a;
+ b = +b;
+ return a > b ? a : b;
+}
+
+for (f of [max3, max4]) {
+ for (var i = 0; i < 5; i++) {
+ assertEquals(4, f(3, 4));
+ assertEquals(4, f(4, 3));
+ assertEquals(4.3, f(3.3, 4.3));
+ assertEquals(4.4, f(4.4, 3.4));
+
+ assertEquals(-Infinity, 1 / f(SMI_ZERO, MINUS_ZERO));
+ assertEquals(-Infinity, 1 / f(DOUBLE_ZERO, MINUS_ZERO));
+ assertEquals(Infinity, 1 / f(MINUS_ZERO, SMI_ZERO));
+ assertEquals(Infinity, 1 / f(MINUS_ZERO, DOUBLE_ZERO));
+
+ assertEquals(NaN, f(NaN, NaN));
+ assertEquals(NaN, f(3, NaN));
+ assertEquals(3, f(NaN, 3));
+ }
+}
diff --git a/test/mjsunit/compiler/optimize_min.js b/test/mjsunit/compiler/optimize_min.js
new file mode 100644
index 0000000..906b999
--- /dev/null
+++ b/test/mjsunit/compiler/optimize_min.js
@@ -0,0 +1,69 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var DOUBLE_ZERO = %AllocateHeapNumber();
+var SMI_ZERO = 0;
+var MINUS_ZERO = -0.0;
+
+function min1(a, b) {
+ a = +a;
+ b = +b;
+ return +(a < b ? a : b);
+}
+
+function min2(a, b) {
+ a = +a;
+ b = +b;
+ return a < b ? a : b;
+}
+
+for (f of [min1, min2]) {
+ for (var i = 0; i < 5; i++) {
+ assertEquals(3, f(3, 4));
+ assertEquals(3, f(4, 3));
+ assertEquals(3.3, f(3.3, 4));
+ assertEquals(3.4, f(4, 3.4));
+
+ assertEquals(-Infinity, 1 / f(SMI_ZERO, MINUS_ZERO));
+ assertEquals(-Infinity, 1 / f(DOUBLE_ZERO, MINUS_ZERO));
+ assertEquals(Infinity, 1 / f(MINUS_ZERO, SMI_ZERO));
+ assertEquals(Infinity, 1 / f(MINUS_ZERO, DOUBLE_ZERO));
+
+ assertEquals(NaN, f(NaN, NaN));
+ assertEquals(NaN, f(3, NaN));
+ assertEquals(3, f(NaN, 3));
+ }
+}
+
+function min3(a, b) {
+ a = +a;
+ b = +b;
+ return +(a > b ? b : a);
+}
+
+function min4(a, b) {
+ a = +a;
+ b = +b;
+ return a > b ? b : a;
+}
+
+for (f of [min3, min4]) {
+ for (var i = 0; i < 5; i++) {
+ assertEquals(3, f(3, 4));
+ assertEquals(3, f(4, 3));
+ assertEquals(3.3, f(3.3, 4));
+ assertEquals(3.4, f(4, 3.4));
+
+ assertEquals(Infinity, 1 / f(SMI_ZERO, MINUS_ZERO));
+ assertEquals(Infinity, 1 / f(DOUBLE_ZERO, MINUS_ZERO));
+ assertEquals(-Infinity, 1 / f(MINUS_ZERO, SMI_ZERO));
+ assertEquals(-Infinity, 1 / f(MINUS_ZERO, DOUBLE_ZERO));
+
+ assertEquals(NaN, f(NaN, NaN));
+ assertEquals(3, f(3, NaN));
+ assertEquals(NaN, f(NaN, 3));
+ }
+}
diff --git a/test/mjsunit/compiler/optimized-for-in.js b/test/mjsunit/compiler/optimized-for-in.js
index 9c756aa..f3ff6be 100644
--- a/test/mjsunit/compiler/optimized-for-in.js
+++ b/test/mjsunit/compiler/optimized-for-in.js
@@ -251,9 +251,7 @@
if (t.hasOwnProperty(x)) {
for (var i = 0; i < t[x].length; i++) {
r += t[x][i];
- if (i === limit) {
- %OptimizeFunctionOnNextCall(osr_inner, "osr");
- }
+ if (i === limit) %OptimizeOsr();
}
r += x;
}
@@ -267,9 +265,7 @@
for (var i = 0; i < t[x].length; i++) {
r += t[x][i];
}
- if (x === osr_after) {
- %OptimizeFunctionOnNextCall(osr_outer, "osr");
- }
+ if (x === osr_after) %OptimizeOsr();
r += x;
}
return r;
@@ -279,9 +275,7 @@
var r = 1;
for (var x in t) {
r += x;
- if (x == osr_after) {
- %OptimizeFunctionOnNextCall(osr_outer_and_deopt, "osr");
- }
+ if (x == osr_after) %OptimizeOsr();
}
return r;
}
diff --git a/test/mjsunit/compiler/osr-alignment.js b/test/mjsunit/compiler/osr-alignment.js
index 30d72d0..085d6c4 100644
--- a/test/mjsunit/compiler/osr-alignment.js
+++ b/test/mjsunit/compiler/osr-alignment.js
@@ -25,37 +25,40 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --use-osr
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
function f1() {
var sum = 0;
- for (var i = 0; i < 1000000; i++) {
+ for (var i = 0; i < 1000; i++) {
var x = i + 2;
var y = x + 5;
var z = y + 3;
sum += z;
+ if (i == 18) %OptimizeOsr();
}
return sum;
}
function f2() {
var sum = 0;
- for (var i = 0; i < 1000000; i++) {
+ for (var i = 0; i < 1000; i++) {
var x = i + 2;
var y = x + 5;
var z = y + 3;
sum += z;
+ if (i == 19) %OptimizeOsr();
}
return sum;
}
function f3() {
var sum = 0;
- for (var i = 0; i < 1000000; i++) {
+ for (var i = 0; i < 1000; i++) {
var x = i + 2;
var y = x + 5;
var z = y + 3;
sum += z;
+ if (i == 20) %OptimizeOsr();
}
return sum;
}
@@ -63,21 +66,21 @@
function test1() {
var j = 11;
for (var i = 0; i < 2; i++) {
- assertEquals(500009500000, f1());
+ assertEquals(509500, f1());
}
}
function test2() {
for (var i = 0; i < 2; i++) {
var j = 11, k = 12;
- assertEquals(500009500000, f2());
+ assertEquals(509500, f2());
}
}
function test3() {
for (var i = 0; i < 2; i++) {
var j = 11, k = 13, m = 14;
- assertEquals(500009500000, f3());
+ assertEquals(509500, f3());
}
}
diff --git a/test/mjsunit/compiler/osr-array-len.js b/test/mjsunit/compiler/osr-array-len.js
new file mode 100644
index 0000000..aaee860
--- /dev/null
+++ b/test/mjsunit/compiler/osr-array-len.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+function fastaRandom(n, table) {
+ var line = new Array(5);
+ while (n > 0) {
+ if (n < line.length) line = new Array(n);
+ %OptimizeOsr();
+ line[0] = n;
+ n--;
+ }
+}
+
+print("---BEGIN 1");
+assertEquals(undefined, fastaRandom(6, null));
+print("---BEGIN 2");
+assertEquals(undefined, fastaRandom(6, null));
+print("---END");
diff --git a/test/mjsunit/compiler/osr-backedges1.js b/test/mjsunit/compiler/osr-backedges1.js
new file mode 100644
index 0000000..d415f4a
--- /dev/null
+++ b/test/mjsunit/compiler/osr-backedges1.js
@@ -0,0 +1,31 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
+
+function foo(a) {
+ var i = a | 0;
+ while (true) {
+ if (i == 0) { i = 1; continue; }
+ if (i == 1) { i = 2; continue; }
+ if (i == 2) { i = 3; continue; }
+ if (i == 3) { i = 4; continue; }
+ if (i == 4) { i = 5; continue; }
+ if (i == 5) { i = 6; continue; }
+ if (i == 6) { i = 7; continue; }
+ if (i == 7) { i = 8; continue; }
+ for (var j = 0; j < 10; j++) { if (i == 5) %OptimizeOsr(); }
+ break;
+ }
+ return j;
+}
+
+function test(func, tv, fv) {
+ assertEquals(tv, func(0));
+ assertEquals(tv, func(0));
+ assertEquals(fv, func(9));
+ assertEquals(fv, func(9));
+}
+
+test(foo, 10, 10);
diff --git a/test/mjsunit/compiler/osr-block-scope-func.js b/test/mjsunit/compiler/osr-block-scope-func.js
new file mode 100644
index 0000000..df4076c
--- /dev/null
+++ b/test/mjsunit/compiler/osr-block-scope-func.js
@@ -0,0 +1,27 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
+
+"use strict";
+
+function foo() {
+ var result;
+ {
+ let sum = 0;
+ for (var i = 0; i < 100; i++) {
+ if (i == 50) %OptimizeOsr();
+ sum += i;
+ }
+ result = ret;
+ function ret() {
+ return sum;
+ }
+ }
+ return result;
+}
+
+assertEquals(4950, foo()());
+assertEquals(4950, foo()());
+assertEquals(4950, foo()());
diff --git a/test/mjsunit/compiler/osr-block-scope-id.js b/test/mjsunit/compiler/osr-block-scope-id.js
new file mode 100644
index 0000000..923c72f
--- /dev/null
+++ b/test/mjsunit/compiler/osr-block-scope-id.js
@@ -0,0 +1,40 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
+
+"use strict";
+
+function foo() {
+ var result = new Array();
+ var out;
+ {
+ let sum = 0;
+ for (var i = 0; i < 10; i++) {
+ {
+ let x = i;
+ if (i == 5) %OptimizeOsr();
+ sum += i;
+ result.push(function() { return x; });
+ }
+ }
+ out = sum;
+ }
+ result.push(out);
+ return result;
+}
+
+
+function check() {
+ var r = foo();
+ assertEquals(45, r.pop());
+ for (var i = 9; i >= 0; i--) {
+ assertEquals(i, r.pop()());
+ }
+ assertEquals(0, r.length);
+}
+
+check();
+check();
+check();
diff --git a/test/mjsunit/compiler/osr-block-scope.js b/test/mjsunit/compiler/osr-block-scope.js
new file mode 100644
index 0000000..0d78cdc
--- /dev/null
+++ b/test/mjsunit/compiler/osr-block-scope.js
@@ -0,0 +1,116 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
+
+"use strict";
+
+function nest(body, name, depth) {
+ var header = "";
+ for (var i = 0; i < depth; i++) {
+ var x = "x" + (i + 1);
+ header += " for(var " + x + " = 0; " + x + " < 2; " + x + " = " + x + " + 1 | 0) {\n";
+ body = body + "}"
+ }
+
+ return body.replace(new RegExp("function " + name + "\\(\\) {"),
+ "function " + name + "_" + x + "() {\n" + header);
+}
+
+function test(expected, func, depth) {
+ assertEquals(expected, func());
+ assertEquals(expected, func());
+ assertEquals(expected, func());
+
+ var orig = func.toString();
+ var name = func.name;
+ for (var depth = 1; depth < 4; depth++) {
+ var body = nest(orig, name, depth);
+ func = eval("(" + body + ")");
+
+ assertEquals(expected, func());
+ assertEquals(expected, func());
+ assertEquals(expected, func());
+ }
+}
+
+function foo() {
+ var result;
+ {
+ let sum = 0;
+ for (var i = 0; i < 10; i++) {
+ %OptimizeOsr();
+ sum += i;
+ }
+ result = sum;
+ }
+ return result;
+}
+
+test(45, foo);
+
+function bar() {
+ let sum = 0;
+ for (var i = 0; i < 10; i++) {
+ %OptimizeOsr();
+ sum += i;
+ }
+ return sum;
+}
+
+test(45, bar);
+
+function bon() {
+ {
+ let sum = 0;
+ for (var i = 0; i < 10; i++) {
+ if (i == 5) %OptimizeOsr();
+ sum += i;
+ }
+ return sum;
+ }
+}
+
+test(45, bon);
+
+function row() {
+ var i = 0;
+ {
+ let sum = 0;
+ while (true) {
+ if (i == 8) return sum;
+ %OptimizeOsr();
+ sum = i;
+ i = i + 1 | 0;
+ }
+ }
+ return 11;
+}
+
+test(7, row);
+
+function nub() {
+ let i = 0;
+ while (i < 2) {
+ %OptimizeOsr();
+ i++;
+ }
+ return i;
+}
+
+test(2, nub);
+
+function kub() {
+ var result = 0;
+ let i = 0;
+ while (i < 2) {
+ let x = i;
+ %OptimizeOsr();
+ i++;
+ result = x;
+ }
+ return result;
+}
+
+test(1, kub);
diff --git a/test/mjsunit/compiler/osr-follow.js b/test/mjsunit/compiler/osr-follow.js
new file mode 100644
index 0000000..b6a2e8e
--- /dev/null
+++ b/test/mjsunit/compiler/osr-follow.js
@@ -0,0 +1,61 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --use-osr --turbo-osr
+
+function foo(a) {
+ var sum = 0;
+ var inc = a ? 100 : 200;
+ for (var i = 0; i < 100000; i++) {
+ sum += inc;
+ }
+ return sum + inc;
+}
+
+function bar(a) {
+ var sum = 0;
+ var inc = a ? 100 : 200;
+ var x = a ? 5 : 6;
+ var y = a ? 7 : 8;
+ for (var i = 0; i < 100000; i++) {
+ sum += inc;
+ }
+ return sum ? x : y;
+}
+
+function baz(a) {
+ var limit = a ? 100001 : 100002;
+ var r = 1;
+ var x = a ? 1 : 2;
+ var y = a ? 3 : 4;
+ for (var i = 0; i < limit; i++) {
+ r = r * -1;
+ }
+ return r > 0 ? x == y : x != y;
+}
+
+function qux(a) {
+ var limit = a ? 100001 : 100002;
+ var r = 1;
+ var x = a ? 1 : 2;
+ var y = a ? 3 : 4;
+ for (var i = 0; i < limit; i++) {
+ r = r * -1;
+ }
+ var w = r > 0 ? x : y;
+ var z = r > 0 ? y : x;
+ return w === z;
+}
+
+function test(func, tv, fv) {
+ assertEquals(tv, func(true));
+ assertEquals(fv, func(false));
+ assertEquals(tv, func(true));
+ assertEquals(fv, func(false));
+}
+
+test(foo, 10000100, 20000200);
+test(bar, 5, 6);
+test(baz, true, false);
+test(qux, false, false);
diff --git a/test/mjsunit/compiler/osr-for-let.js b/test/mjsunit/compiler/osr-for-let.js
new file mode 100644
index 0000000..4b2fa3e
--- /dev/null
+++ b/test/mjsunit/compiler/osr-for-let.js
@@ -0,0 +1,82 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
+
+"use strict";
+
+function test(expected, func) {
+ assertEquals(expected, func());
+ assertEquals(expected, func());
+ assertEquals(expected, func());
+}
+
+function bar() {
+ var result;
+ {
+ let sum = 0;
+ for (let i = 0; i < 90; i++) {
+ sum += i;
+ if (i == 45) %OptimizeOsr();
+ }
+ result = sum;
+ }
+ return result;
+}
+
+test(4005, bar);
+
+function baz() {
+ let sum = 0;
+ for (let i = 0; i < 2; i++) {
+ sum = 2;
+ %OptimizeOsr();
+ }
+ return sum;
+}
+
+test(2, baz);
+
+function qux() {
+ var result = 0;
+ for (let i = 0; i < 2; i++) {
+ result = i;
+ %OptimizeOsr();
+ }
+ return result;
+}
+
+test(1, qux);
+
+function nux() {
+ var result = 0;
+ for (let i = 0; i < 2; i++) {
+ {
+ let sum = i;
+ %OptimizeOsr();
+ result = sum;
+ }
+ }
+ return result;
+}
+
+test(1, nux);
+
+function blo() {
+ var result;
+ {
+ let sum = 0;
+ for (let i = 0; i < 90; i++) {
+ sum += i;
+ if (i == 45) %OptimizeOsr();
+ }
+ result = ret;
+ function ret() {
+ return sum;
+ }
+ }
+ return result;
+}
+
+test(4005, blo());
diff --git a/test/mjsunit/compiler/osr-forin-nested.js b/test/mjsunit/compiler/osr-forin-nested.js
new file mode 100644
index 0000000..ad55b30
--- /dev/null
+++ b/test/mjsunit/compiler/osr-forin-nested.js
@@ -0,0 +1,35 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-osr --allow-natives-syntax
+
+function test(e, f, v) {
+ assertEquals(e, f(v));
+ assertEquals(e, f(v));
+ assertEquals(e, f(v));
+}
+
+function foo(t) {
+ for (var x in t) {
+ for (var i = 0; i < 2; i++) {
+ %OptimizeOsr();
+ }
+ }
+ return 5;
+}
+
+test(5, foo, {x:20});
+
+function bar(t) {
+ var sum = 0;
+ for (var x in t) {
+ for (var i = 0; i < 2; i++) {
+ %OptimizeOsr();
+ sum += t[x];
+ }
+ }
+ return sum;
+}
+
+test(62, bar, {x:20,y:11});
diff --git a/test/mjsunit/compiler/osr-forin.js b/test/mjsunit/compiler/osr-forin.js
new file mode 100644
index 0000000..8d16782
--- /dev/null
+++ b/test/mjsunit/compiler/osr-forin.js
@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --use-osr --turbo-osr
+
+function f(a) {
+ var sum = 0;
+ for (var j in a) {
+ var i = a[j];
+ var x = i + 2;
+ var y = x + 5;
+ var z = y + 3;
+ sum += z;
+ }
+ return sum;
+}
+
+var a = new Array(10000);
+for (var i = 0; i < 10000; i++) {
+ a[i] = (i * 999) % 77;
+}
+
+for (var i = 0; i < 3; i++) {
+ assertEquals(480270, f(a));
+}
diff --git a/test/mjsunit/compiler/osr-forof.js b/test/mjsunit/compiler/osr-forof.js
new file mode 100644
index 0000000..36bff09
--- /dev/null
+++ b/test/mjsunit/compiler/osr-forof.js
@@ -0,0 +1,35 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --use-osr --turbo-osr
+
+function f(a) {
+ var sum = 0;
+ for (var i of a) {
+ var x = i + 2;
+ var y = x + 5;
+ var z = y + 3;
+ sum += z;
+ }
+ return sum;
+}
+
+var a = new Array(10000);
+for (var i = 0; i < 10000; i++) {
+ a[i] = (i * 999) % 77;
+}
+
+for (var i = 0; i < 3; i++) {
+ assertEquals(480270, f(wrap(a)));
+}
+
+function wrap(array) {
+ var iterable = {};
+ var i = 0;
+ function next() {
+ return { done: i >= array.length, value: array[i++] };
+ };
+ iterable[Symbol.iterator] = function() { return { next:next }; };
+ return iterable;
+}
diff --git a/test/mjsunit/compiler/osr-function-id.js b/test/mjsunit/compiler/osr-function-id.js
new file mode 100644
index 0000000..c506ae8
--- /dev/null
+++ b/test/mjsunit/compiler/osr-function-id.js
@@ -0,0 +1,33 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --use-osr --turbo-osr
+
+function id(f) { return f; }
+
+function foo() {
+ var sum = 0;
+ var r = id(foo);
+ for (var i = 0; i < 100000; i++) {
+ sum += i;
+ }
+ return foo == r;
+}
+
+assertEquals(true, foo());
+assertEquals(true, foo());
+assertEquals(true, foo());
+
+
+function bar() {
+ var sum = 0;
+ for (var i = 0; i < 90000; i++) {
+ sum += i;
+ }
+ return id(bar,sum);
+}
+
+assertEquals(bar, bar());
+assertEquals(bar, bar());
+assertEquals(bar, bar());
diff --git a/test/mjsunit/compiler/osr-function-id2.js b/test/mjsunit/compiler/osr-function-id2.js
new file mode 100644
index 0000000..561c62e
--- /dev/null
+++ b/test/mjsunit/compiler/osr-function-id2.js
@@ -0,0 +1,28 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --use-osr --turbo-osr
+
+function id(f) { return f; }
+
+var x = (function foo() {
+ var sum = 0;
+ var r = id(foo);
+ for (var i = 0; i < 100000; i++) {
+ sum += i;
+ }
+ return foo == r;
+})();
+
+assertEquals(true, x);
+
+var x = (function bar() {
+ var sum = 0;
+ for (var i = 0; i < 90000; i++) {
+ sum += i;
+ }
+ return bar;
+})();
+
+assertEquals("function", typeof x);
diff --git a/test/mjsunit/compiler/osr-function.js b/test/mjsunit/compiler/osr-function.js
new file mode 100644
index 0000000..06d137b
--- /dev/null
+++ b/test/mjsunit/compiler/osr-function.js
@@ -0,0 +1,31 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --use-osr --turbo-osr
+
+function foo() {
+ var sum = 0;
+ for (var i = 0; i < 100000; i++) {
+ sum += i;
+ }
+ return function() { return sum; }
+}
+
+assertEquals(4999950000, foo()());
+assertEquals(4999950000, foo()());
+assertEquals(4999950000, foo()());
+
+function bar() {
+ var sum = 0;
+ var ret = 0;
+ for (var i = 0; i < 90000; i++) {
+ sum += i;
+ if (i == 0) ret = function() { return sum; }
+ }
+ return ret;
+}
+
+assertEquals(4049955000, bar()());
+assertEquals(4049955000, bar()());
+assertEquals(4049955000, bar()());
diff --git a/test/mjsunit/compiler/osr-infinite.js b/test/mjsunit/compiler/osr-infinite.js
new file mode 100644
index 0000000..aa74c87
--- /dev/null
+++ b/test/mjsunit/compiler/osr-infinite.js
@@ -0,0 +1,78 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --use-osr --allow-natives-syntax --turbo-osr
+
+var global_counter = 0;
+
+function thrower() {
+ var x = global_counter++;
+ if (x == 5) %OptimizeOsr(thrower.caller);
+ if (x == 10) throw "terminate";
+}
+
+%NeverOptimizeFunction(thrower); // Don't want to inline the thrower.
+%NeverOptimizeFunction(test); // Don't want to inline the func into test.
+
+function test(func) {
+ for (var i = 0; i < 3; i++) {
+ global_counter = 0;
+ assertThrows(func);
+ }
+}
+
+function n1() {
+ while (true) thrower();
+}
+
+function n2() {
+ while (true) while (true) thrower();
+}
+
+function n3() {
+ while (true) while (true) while (true) thrower();
+}
+
+function n4() {
+ while (true) while (true) while (true) while (true) thrower();
+}
+
+function b1(a) {
+ while (true) {
+ thrower();
+ if (a) break
+ }
+}
+
+
+function b2(a) {
+ while (true) {
+ while (true) {
+ thrower();
+ if (a) break
+ }
+ }
+}
+
+
+function b3(a) {
+ while (true) {
+ while (true) {
+ while (true) {
+ thrower();
+ if (a) break
+ }
+ if (a) break
+ }
+ }
+}
+
+
+test(n1);
+test(n2);
+test(n3);
+test(n4);
+test(b1);
+test(b2);
+test(b3);
diff --git a/test/mjsunit/compiler/osr-labeled.js b/test/mjsunit/compiler/osr-labeled.js
new file mode 100644
index 0000000..1a97092
--- /dev/null
+++ b/test/mjsunit/compiler/osr-labeled.js
@@ -0,0 +1,47 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
+
+function foo() {
+ var sum = 0;
+ A: for (var i = 0; i < 5; i++) {
+ B: for (var j = 0; j < 5; j++) {
+ C: for (var k = 0; k < 10; k++) {
+ if (k === 5) %OptimizeOsr();
+ if (k === 6) break B;
+ sum++;
+ }
+ }
+ }
+ return sum;
+}
+
+assertEquals(30, foo());
+assertEquals(30, foo());
+
+function bar(a) {
+ var sum = 0;
+ A: for (var i = 0; i < 5; i++) {
+ B: for (var j = 0; j < 5; j++) {
+ C: for (var k = 0; k < 10; k++) {
+ sum++;
+ %OptimizeOsr();
+ if (a === 1) break A;
+ if (a === 2) break B;
+ if (a === 3) break C;
+ }
+ }
+ }
+ return sum;
+}
+
+assertEquals(1, bar(1));
+assertEquals(1, bar(1));
+
+assertEquals(5, bar(2));
+assertEquals(5, bar(2));
+
+assertEquals(25, bar(3));
+assertEquals(25, bar(3));
diff --git a/test/mjsunit/compiler/osr-literals-adapted.js b/test/mjsunit/compiler/osr-literals-adapted.js
new file mode 100644
index 0000000..950d8b0
--- /dev/null
+++ b/test/mjsunit/compiler/osr-literals-adapted.js
@@ -0,0 +1,56 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
+
+function mod() {
+ function f0() {
+ for (var i = 0; i < 3; i = i + 1 | 0) {
+ %OptimizeOsr();
+ }
+ return {blah: i};
+ }
+
+ function f1(a) {
+ for (var i = 0; i < 3; i = i + 1 | 0) {
+ %OptimizeOsr();
+ }
+ return {blah: i};
+ }
+
+ function f2(a,b) {
+ for (var i = 0; i < 3; i = i + 1 | 0) {
+ %OptimizeOsr();
+ }
+ return {blah: i};
+ }
+
+ function f3(a,b,c) {
+ for (var i = 0; i < 3; i = i + 1 | 0) {
+ %OptimizeOsr();
+ }
+ return {blah: i};
+ }
+
+ function f4(a,b,c,d) {
+ for (var i = 0; i < 3; i = i + 1 | 0) {
+ %OptimizeOsr();
+ }
+ return {blah: i};
+ }
+
+ function bar() {
+ assertEquals(3, f0().blah);
+ assertEquals(3, f1().blah);
+ assertEquals(3, f2().blah);
+ assertEquals(3, f3().blah);
+ assertEquals(3, f4().blah);
+ }
+ bar();
+}
+
+
+mod();
+mod();
+mod();
diff --git a/test/mjsunit/compiler/osr-literals.js b/test/mjsunit/compiler/osr-literals.js
new file mode 100644
index 0000000..d9f68a0
--- /dev/null
+++ b/test/mjsunit/compiler/osr-literals.js
@@ -0,0 +1,56 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
+
+function mod() {
+ function f0() {
+ for (var i = 0; i < 3; i = i + 1 | 0) {
+ %OptimizeOsr();
+ }
+ return {blah: i};
+ }
+
+ function f1(a) {
+ for (var i = 0; i < 3; i = i + 1 | 0) {
+ %OptimizeOsr();
+ }
+ return {blah: i};
+ }
+
+ function f2(a,b) {
+ for (var i = 0; i < 3; i = i + 1 | 0) {
+ %OptimizeOsr();
+ }
+ return {blah: i};
+ }
+
+ function f3(a,b,c) {
+ for (var i = 0; i < 3; i = i + 1 | 0) {
+ %OptimizeOsr();
+ }
+ return {blah: i};
+ }
+
+ function f4(a,b,c,d) {
+ for (var i = 0; i < 3; i = i + 1 | 0) {
+ %OptimizeOsr();
+ }
+ return {blah: i};
+ }
+
+ function bar() {
+ assertEquals(3, f0().blah);
+ assertEquals(3, f1(1).blah);
+ assertEquals(3, f2(1,2).blah);
+ assertEquals(3, f3(1,2,3).blah);
+ assertEquals(3, f4(1,2,3,4).blah);
+ }
+ bar();
+}
+
+
+mod();
+mod();
+mod();
diff --git a/test/mjsunit/compiler/osr-manual1.js b/test/mjsunit/compiler/osr-manual1.js
new file mode 100644
index 0000000..29a4948
--- /dev/null
+++ b/test/mjsunit/compiler/osr-manual1.js
@@ -0,0 +1,35 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
+
+var counter = 111;
+
+function gen(w) { // defeat compiler cache.
+ var num = counter++;
+ var Z = [ "", "", "", ];
+ Z[w] = "%OptimizeOsr()";
+ var src =
+ "function f" + num + "(a,b,c) {" +
+ " var x = 0;" +
+ " var y = 0;" +
+ " var z = 0;" +
+ " while (a > 0) { " + Z[0] + "; x += 19; a--; }" +
+ " while (b > 0) { " + Z[1] + "; y += 23; b--; }" +
+ " while (c > 0) { " + Z[2] + "; z += 29; c--; }" +
+ " return x + y + z;" +
+ "} f" + num;
+ return eval(src);
+}
+
+function check(x,a,b,c) {
+ for (var i = 0; i < 3; i++) {
+ var f = gen(i);
+ assertEquals(x, f(a, b, c));
+ }
+}
+
+check(213, 3,3,3);
+check(365, 4,5,6);
+check(6948, 99,98,97);
diff --git a/test/mjsunit/compiler/osr-manual2.js b/test/mjsunit/compiler/osr-manual2.js
new file mode 100644
index 0000000..8aa5d69
--- /dev/null
+++ b/test/mjsunit/compiler/osr-manual2.js
@@ -0,0 +1,35 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
+
+var counter = 188;
+
+function gen(w) { // defeat compiler cache.
+ var num = counter++;
+ var Z = [ "", "", "", ];
+ Z[w] = "%OptimizeOsr()";
+ var src =
+ "function f" + num + "(a,b,c) {" +
+ " var x = 0;" +
+ " var y = 0;" +
+ " var z = 0;" +
+ " while (a > 0) { " + Z[0] + "; x += 19; a--; var j=2; while(j--); }" +
+ " while (b > 0) { " + Z[1] + "; y += 23; b--; var j=2; while(j--); }" +
+ " while (c > 0) { " + Z[2] + "; z += 29; c--; var j=2; while(j--); }" +
+ " return x + y + z;" +
+ "} f" + num;
+ return eval(src);
+}
+
+function check(x,a,b,c) {
+ for (var i = 0; i < 3; i++) {
+ var f = gen(i);
+ assertEquals(x, f(a, b, c));
+ }
+}
+
+check(213, 3,3,3);
+check(365, 4,5,6);
+check(6948, 99,98,97);
diff --git a/test/mjsunit/compiler/osr-maze1.js b/test/mjsunit/compiler/osr-maze1.js
new file mode 100644
index 0000000..da17282
--- /dev/null
+++ b/test/mjsunit/compiler/osr-maze1.js
@@ -0,0 +1,51 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr
+
+function bar(goal) {
+ var count = 0;
+ var sum = 11;
+ var i = 35;
+ while (i-- > 33) {
+ if (count++ == goal) %OptimizeOsr();
+ sum = sum + i;
+ }
+ while (i-- > 31) {
+ if (count++ == goal) %OptimizeOsr();
+ j = 9;
+ while (j-- > 7) {
+ if (count++ == goal) %OptimizeOsr();
+ sum = sum + j * 3;
+ }
+ while (j-- > 5) {
+ if (count++ == goal) %OptimizeOsr();
+ sum = sum + j * 5;
+ }
+ }
+ while (i-- > 29) {
+ if (count++ == goal) %OptimizeOsr();
+ while (j-- > 3) {
+ var k = 10;
+ if (count++ == goal) %OptimizeOsr();
+ while (k-- > 8) {
+ if (count++ == goal) %OptimizeOsr();
+ sum = sum + k * 11;
+ }
+ }
+ while (j-- > 1) {
+ if (count++ == goal) %OptimizeOsr();
+ while (k-- > 6) {
+ if (count++ == goal) %OptimizeOsr();
+ sum = sum + j * 13;
+ }
+ }
+ }
+ return sum;
+}
+
+for (var i = 0; i < 13; i++) {
+ %DeoptimizeFunction(bar);
+ assertEquals(348, bar(i));
+}
diff --git a/test/mjsunit/compiler/osr-maze2.js b/test/mjsunit/compiler/osr-maze2.js
new file mode 100644
index 0000000..1fc1cd2
--- /dev/null
+++ b/test/mjsunit/compiler/osr-maze2.js
@@ -0,0 +1,63 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr
+
+function bar() {
+ var sum = 11;
+ var i = 35;
+ while (i-- > 31) {
+ LOOP1();
+ j = 9;
+ while (j-- > 7) {
+ LOOP2();
+ sum = sum + j * 5;
+ var k = 7;
+ while (k-- > 5) {
+ LOOP3();
+ sum = sum + j * 5;
+ }
+ }
+ }
+ while (i-- > 29) {
+ LOOP4();
+ while (j-- > 3) {
+ LOOP5();
+ var k = 10;
+ while (k-- > 8) {
+ LOOP6();
+ sum = sum + k * 11;
+ }
+ }
+ while (j-- > 1) {
+ LOOP7();
+ var k = 8;
+ while (k-- > 6) {
+ LOOP8();
+ var m = 9;
+ while (m-- > 6) {
+ LOOP9();
+ sum = sum + k * 13;
+ }
+ }
+ }
+ }
+ return sum;
+}
+
+function gen(i) {
+ var body = bar.toString();
+ body = body.replace(new RegExp("bar"), "bar" + i);
+ for (var j = 1; j < 10; j++) {
+ var r = new RegExp("LOOP" + j + "\\(\\);");
+ if (i == j) body = body.replace(r, "%OptimizeOsr();");
+ else body = body.replace(r, "");
+ }
+ return eval("(" + body + ")");
+}
+
+for (var i = 1; i < 10; i++) {
+ var f = gen(i);
+ assertEquals(1979, f());
+}
diff --git a/test/mjsunit/compiler/osr-multiple.js b/test/mjsunit/compiler/osr-multiple.js
new file mode 100644
index 0000000..c318645
--- /dev/null
+++ b/test/mjsunit/compiler/osr-multiple.js
@@ -0,0 +1,44 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --use-osr --turbo-osr
+
+function f1(a,b,c) {
+ var x = 0;
+ var y = 0;
+ var z = 0;
+ while (a > 0) { x += 19; a--; }
+ while (b > 0) { y += 23; b--; }
+ while (c > 0) { z += 29; c--; }
+ return x + y + z;
+}
+
+function f2(a,b,c) {
+ var x = 0;
+ var y = 0;
+ var z = 0;
+ while (a > 0) { x += 19; a--; }
+ while (b > 0) { y += 23; b--; }
+ while (c > 0) { z += 29; c--; }
+ return x + y + z;
+}
+
+
+function f3(a,b,c) {
+ var x = 0;
+ var y = 0;
+ var z = 0;
+ while (a > 0) { x += 19; a--; }
+ while (b > 0) { y += 23; b--; }
+ while (c > 0) { z += 29; c--; }
+ return x + y + z;
+}
+
+function check(f,a,b,c) {
+ assertEquals(a * 19 + b * 23 + c * 29, f(a,b,c));
+}
+
+check(f1, 50000, 5, 6);
+check(f2, 4, 50000, 6);
+check(f3, 11, 12, 50000);
diff --git a/test/mjsunit/compiler/osr-multiple2.js b/test/mjsunit/compiler/osr-multiple2.js
new file mode 100644
index 0000000..9a81bfb
--- /dev/null
+++ b/test/mjsunit/compiler/osr-multiple2.js
@@ -0,0 +1,51 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --use-osr
+// TODO(titzer): enable --turbo-osr when nested OSR works.
+
+function f1(a,b,c) {
+ var x = 0;
+ var y = 0;
+ var z = 0;
+ for (var i = 0; i < 2; i++) {
+ while (a > 0) { x += 19; a--; }
+ while (b > 0) { y += 23; b--; }
+ while (c > 0) { z += 29; c--; }
+ }
+ return x + y + z;
+}
+
+function f2(a,b,c) {
+ var x = 0;
+ var y = 0;
+ var z = 0;
+ for (var i = 0; i < 2; i++) {
+ while (a > 0) { x += 19; a--; }
+ while (b > 0) { y += 23; b--; }
+ while (c > 0) { z += 29; c--; }
+ }
+ return x + y + z;
+}
+
+
+function f3(a,b,c) {
+ var x = 0;
+ var y = 0;
+ var z = 0;
+ for (var i = 0; i < 2; i++) {
+ while (a > 0) { x += 19; a--; }
+ while (b > 0) { y += 23; b--; }
+ while (c > 0) { z += 29; c--; }
+ }
+ return x + y + z;
+}
+
+function check(f,a,b,c) {
+ assertEquals(a * 19 + b * 23 + c * 29, f(a,b,c));
+}
+
+check(f1, 50000, 5, 6);
+check(f2, 4, 50000, 6);
+check(f3, 11, 12, 50000);
diff --git a/test/mjsunit/compiler/osr-multiple3.js b/test/mjsunit/compiler/osr-multiple3.js
new file mode 100644
index 0000000..0fb1ac7
--- /dev/null
+++ b/test/mjsunit/compiler/osr-multiple3.js
@@ -0,0 +1,57 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --use-osr
+// TODO(titzer): enable --turbo-osr when nested OSR works.
+
+function f1(a,b,c) {
+ var x = 0;
+ var y = 0;
+ var z = 0;
+ for (var i = 0; i < 2; i++) {
+ for (var j = 0; j < 2; j++) {
+ while (a > 0) { x += 19; a--; }
+ while (b > 0) { y += 23; b--; }
+ while (c > 0) { z += 29; c--; }
+ }
+ }
+ return x + y + z;
+}
+
+function f2(a,b,c) {
+ var x = 0;
+ var y = 0;
+ var z = 0;
+ for (var i = 0; i < 2; i++) {
+ for (var j = 0; j < 2; j++) {
+ while (a > 0) { x += 19; a--; }
+ while (b > 0) { y += 23; b--; }
+ while (c > 0) { z += 29; c--; }
+ }
+ }
+ return x + y + z;
+}
+
+
+function f3(a,b,c) {
+ var x = 0;
+ var y = 0;
+ var z = 0;
+ for (var i = 0; i < 2; i++) {
+ for (var j = 0; j < 2; j++) {
+ while (a > 0) { x += 19; a--; }
+ while (b > 0) { y += 23; b--; }
+ while (c > 0) { z += 29; c--; }
+ }
+ }
+ return x + y + z;
+}
+
+function check(f,a,b,c) {
+ assertEquals(a * 19 + b * 23 + c * 29, f(a,b,c));
+}
+
+check(f1, 50000, 5, 6);
+check(f2, 4, 50000, 6);
+check(f3, 11, 12, 50000);
diff --git a/test/mjsunit/compiler/osr-nested2.js b/test/mjsunit/compiler/osr-nested2.js
new file mode 100644
index 0000000..41bd9b2
--- /dev/null
+++ b/test/mjsunit/compiler/osr-nested2.js
@@ -0,0 +1,24 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
+
+function f() {
+ var sum = 0;
+ for (var i = 5; i < 6; i++) {
+ for (var j = 0; j < 1000; j++) {
+ var x = i + 2;
+ var y = x + 5;
+ var z = y + 3;
+ sum += z;
+ if (i == 21) %OptimizeOsr();
+ }
+ }
+ return sum;
+}
+
+
+assertEquals(15000, f());
+assertEquals(15000, f());
+assertEquals(15000, f());
diff --git a/test/mjsunit/compiler/osr-nested2b.js b/test/mjsunit/compiler/osr-nested2b.js
new file mode 100644
index 0000000..e64c10c
--- /dev/null
+++ b/test/mjsunit/compiler/osr-nested2b.js
@@ -0,0 +1,25 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
+
+function f() {
+ var sum = 0;
+ for (var i = 5; i < 6; i++) {
+ for (var j = 0; j < 1000; j++) {
+ var x = i + 2;
+ var y = x + 5;
+ var z = y + 3;
+ sum += z;
+ if (i == 25) %OptimizeOsr();
+ }
+ if (true) break;
+ }
+ return sum;
+}
+
+
+assertEquals(15000, f());
+assertEquals(15000, f());
+assertEquals(15000, f());
diff --git a/test/mjsunit/compiler/osr-nested3.js b/test/mjsunit/compiler/osr-nested3.js
new file mode 100644
index 0000000..f5d09ba
--- /dev/null
+++ b/test/mjsunit/compiler/osr-nested3.js
@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
+
+function f() {
+ var sum = 0;
+ for (var m = 99; m < 100; m++) {
+ for (var i = 5; i < 6; i++) {
+ for (var j = 0; j < 1000; j++) {
+ var x = i + 2;
+ var y = x + 5;
+ var z = y + 3;
+ sum += z;
+ if (i == 19) %OptimizeOsr();
+ }
+ }
+ }
+ return sum;
+}
+
+
+assertEquals(15000, f());
+assertEquals(15000, f());
+assertEquals(15000, f());
diff --git a/test/mjsunit/compiler/osr-nested3b.js b/test/mjsunit/compiler/osr-nested3b.js
new file mode 100644
index 0000000..32ac2a7
--- /dev/null
+++ b/test/mjsunit/compiler/osr-nested3b.js
@@ -0,0 +1,28 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
+
+function f() {
+ var sum = 0;
+ for (var m = 99; m < 100; m++) {
+ for (var i = 5; i < 6; i++) {
+ for (var j = 0; j < 1000; j++) {
+ var x = i + 2;
+ var y = x + 5;
+ var z = y + 3;
+ sum += z;
+ if (i == 25) %OptimizeOsr();
+ }
+ if (true) break;
+ }
+ if (true) break;
+ }
+ return sum;
+}
+
+
+assertEquals(15000, f());
+assertEquals(15000, f());
+assertEquals(15000, f());
diff --git a/test/mjsunit/compiler/osr-regex-id.js b/test/mjsunit/compiler/osr-regex-id.js
new file mode 100644
index 0000000..7831b14
--- /dev/null
+++ b/test/mjsunit/compiler/osr-regex-id.js
@@ -0,0 +1,54 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
+
+function id(f) { return f; }
+
+function foo(a) {
+ var r = /\0/;
+ for (var i = 0; i < 10; i++) {
+ if (a) %OptimizeOsr();
+ }
+ return r;
+}
+
+function bar(a) {
+ for (var i = 0; i < 10; i++) {
+ if (a) %OptimizeOsr();
+ var r = /\0/;
+ }
+ return r;
+}
+
+function baz(a) {
+ for (var i = 0; i < 10; i++) {
+ if (a) %OptimizeOsr();
+ }
+ return /\0/;
+}
+
+function qux(a) {
+ for (var i = 0; i < 10; i++) {
+ if (i > 5 && a) {
+ %OptimizeOsr();
+ } else {
+ var r = /\0/;
+ }
+ }
+ return r;
+}
+
+function test(f) {
+ // Test the reference equality of regex's created in OSR'd function.
+ var x = f(false);
+ assertEquals(x, f(true));
+ assertEquals(x, f(true));
+ assertEquals(x, f(true));
+}
+
+test(foo);
+test(bar);
+test(baz);
+test(qux);
diff --git a/test/mjsunit/compiler/osr-sar.js b/test/mjsunit/compiler/osr-sar.js
index fd68b98..cc04adc 100644
--- a/test/mjsunit/compiler/osr-sar.js
+++ b/test/mjsunit/compiler/osr-sar.js
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
function test() {
// Loop to force OSR.
diff --git a/test/mjsunit/compiler/osr-simple.js b/test/mjsunit/compiler/osr-simple.js
index 8ec1b2b..ddbc5f8 100644
--- a/test/mjsunit/compiler/osr-simple.js
+++ b/test/mjsunit/compiler/osr-simple.js
@@ -1,44 +1,22 @@
// Copyright 2010 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-// * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-// * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following
-// disclaimer in the documentation and/or other materials provided
-// with the distribution.
-// * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived
-// from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
-// Flags: --use-osr
+// Flags: --allow-natives-syntax --use-osr
function f() {
var sum = 0;
- for (var i = 0; i < 1000000; i++) {
+ for (var i = 0; i < 1000; i++) {
var x = i + 2;
var y = x + 5;
var z = y + 3;
sum += z;
+ if (i == 11) %OptimizeOsr();
}
return sum;
}
for (var i = 0; i < 2; i++) {
- assertEquals(500009500000, f());
+ assertEquals(509500, f());
}
diff --git a/test/mjsunit/compiler/osr-top1.js b/test/mjsunit/compiler/osr-top1.js
new file mode 100644
index 0000000..742b71d
--- /dev/null
+++ b/test/mjsunit/compiler/osr-top1.js
@@ -0,0 +1,16 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --use-osr --allow-natives-syntax
+
+var sum = 0;
+for (var i = 0; i < 10000; i++) {
+ if (i == 100) %OptimizeOsr();
+ var x = i + 2;
+ var y = x + 5;
+ var z = y + 3;
+ sum += z;
+}
+
+assertEquals(50095000, sum);
diff --git a/test/mjsunit/compiler/osr-top2.js b/test/mjsunit/compiler/osr-top2.js
new file mode 100644
index 0000000..a15aa15
--- /dev/null
+++ b/test/mjsunit/compiler/osr-top2.js
@@ -0,0 +1,19 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --use-osr --allow-natives-syntax
+
+for (var j = 0; j < 3; j++) {
+ var sum = 0;
+ for (var i = 0; i < 1000; i++) {
+ if (i == 100) %OptimizeOsr();
+ var x = i + 2;
+ var y = x + 5;
+ var z = y + 3;
+ sum += z;
+ }
+ assertEquals(509500, sum);
+}
+
+assertEquals(509500, sum);
diff --git a/test/mjsunit/compiler/osr-top3.js b/test/mjsunit/compiler/osr-top3.js
new file mode 100644
index 0000000..4c4a364
--- /dev/null
+++ b/test/mjsunit/compiler/osr-top3.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --use-osr --allow-natives-syntax
+
+for (var k = 0; k < 2; k++) {
+ for (var j = 0; j < 3; j++) {
+ var sum = 0;
+ for (var i = 0; i < 1000; i++) {
+ if (i == 100) %OptimizeOsr();
+ var x = i + 2;
+ var y = x + 5;
+ var z = y + 3;
+ sum += z;
+ }
+ assertEquals(509500, sum);
+ }
+ assertEquals(509500, sum);
+}
+
+assertEquals(509500, sum);
diff --git a/test/mjsunit/compiler/osr-warm.js b/test/mjsunit/compiler/osr-warm.js
index 73e1fd5..7c30c07 100644
--- a/test/mjsunit/compiler/osr-warm.js
+++ b/test/mjsunit/compiler/osr-warm.js
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --use-osr
+// Flags: --use-osr --turbo-osr
function f1(x) {
while (x > 0) {
diff --git a/test/mjsunit/compiler/osr-while-let.js b/test/mjsunit/compiler/osr-while-let.js
new file mode 100644
index 0000000..c19cf6c
--- /dev/null
+++ b/test/mjsunit/compiler/osr-while-let.js
@@ -0,0 +1,58 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --turbo-osr
+
+"use strict";
+
+function test(expected, func) {
+ assertEquals(expected, func());
+ assertEquals(expected, func());
+ assertEquals(expected, func());
+}
+
+function foo() {
+ var result = 0;
+ {
+ let x = 0;
+ var temp_x = x;
+ var first = 1;
+ outer: while (true) {
+ let x = temp_x;
+ if (first == 1) first = 0;
+ else x = x + 1 | 0;
+ var flag = 1;
+ for (; flag == 1; (flag = 0, temp_x = x)) {
+ if (x < 2) {
+ result = x; %OptimizeOsr();
+ } else {
+ break outer;
+ }
+ }
+ if (flag == 1) break;
+ }
+ }
+ return result;
+}
+
+test(1, foo);
+
+
+function smo() {
+ var result = 0;
+ {
+ let x = 11;
+ outer: while (true) {
+ let y = x;
+ for (var i = 0; i < 5; i++) {
+ %OptimizeOsr();
+ if (i) break outer;
+ else result = y;
+ }
+ }
+ }
+ return result;
+}
+
+test(11, smo);
diff --git a/test/mjsunit/compiler/receiver-conversion.js b/test/mjsunit/compiler/receiver-conversion.js
new file mode 100644
index 0000000..c3f807a
--- /dev/null
+++ b/test/mjsunit/compiler/receiver-conversion.js
@@ -0,0 +1,128 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// This test suite checks that the receiver value (i.e. the 'this' binding) is
+// correctly converted even when the callee function is inlined. This behavior
+// is specified by ES6, section 9.2.1.2 "OrdinaryCallBindThis".
+
+var global = this;
+function test(outer, inner, check) {
+ check(outer());
+ check(outer());
+ %OptimizeFunctionOnNextCall(outer);
+ check(outer());
+}
+
+
+// -----------------------------------------------------------------------------
+// Test undefined in sloppy mode.
+(function UndefinedSloppy() {
+ function check(x) {
+ assertEquals("object", typeof x);
+ assertSame(global, x);
+ }
+ function inner(x) {
+ return this;
+ }
+ function outer() {
+ return sloppy();
+ }
+ global.sloppy = inner;
+ test(outer, inner, check);
+})();
+
+
+// -----------------------------------------------------------------------------
+// Test undefined in strict mode.
+(function UndefinedStrict() {
+ function check(x) {
+ assertEquals("undefined", typeof x);
+ assertSame(undefined, x);
+ }
+ function inner(x) {
+ "use strict";
+ return this;
+ }
+ function outer() {
+ return strict();
+ }
+ global.strict = inner;
+ test(outer, inner, check);
+})();
+
+
+// -----------------------------------------------------------------------------
+// Test primitive number in sloppy mode.
+(function NumberSloppy() {
+ function check(x) {
+ assertEquals("object", typeof x);
+ assertInstanceof(x, Number);
+ }
+ function inner(x) {
+ return this;
+ }
+ function outer() {
+ return (0).sloppy();
+ }
+ Number.prototype.sloppy = inner;
+ test(outer, inner, check);
+})();
+
+
+// -----------------------------------------------------------------------------
+// Test primitive number in strict mode.
+(function NumberStrict() {
+ function check(x) {
+ assertEquals("number", typeof x);
+ assertSame(0, x);
+ }
+ function inner(x) {
+ "use strict";
+ return this;
+ }
+ function outer() {
+ return (0).strict();
+ }
+ Number.prototype.strict = inner;
+ test(outer, inner, check);
+})();
+
+
+// -----------------------------------------------------------------------------
+// Test primitive string in sloppy mode.
+(function StringSloppy() {
+ function check(x) {
+ assertEquals("object", typeof x);
+ assertInstanceof(x, String);
+ }
+ function inner(x) {
+ return this;
+ }
+ function outer() {
+ return ("s").sloppy();
+ }
+ String.prototype.sloppy = inner;
+ test(outer, inner, check);
+})();
+
+
+// -----------------------------------------------------------------------------
+// Test primitive string in strict mode.
+(function StringStrict() {
+ function check(x) {
+ assertEquals("string", typeof x);
+ assertSame("s", x);
+ }
+ function inner(x) {
+ "use strict";
+ return this;
+ }
+ function outer() {
+ return ("s").strict();
+ }
+ String.prototype.strict = inner;
+ test(outer, inner, check);
+})();
diff --git a/test/mjsunit/compiler/regress-3812.js b/test/mjsunit/compiler/regress-3812.js
new file mode 100644
index 0000000..cfc8feb
--- /dev/null
+++ b/test/mjsunit/compiler/regress-3812.js
@@ -0,0 +1,19 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var stdlib = this;
+var buffer = new ArrayBuffer(64 * 1024);
+var foreign = {}
+
+var foo = (function Module(stdlib, foreign, heap) {
+ "use asm";
+ function foo(i) {
+ var x = i ? (i&1) : true;
+ if (x) return x;
+ return false;
+ }
+ return {foo:foo};
+})(stdlib, foreign, buffer).foo;
+
+assertEquals(1, foo(1));
diff --git a/test/mjsunit/compiler/regress-416359.js b/test/mjsunit/compiler/regress-416359.js
new file mode 100644
index 0000000..18cdc5e
--- /dev/null
+++ b/test/mjsunit/compiler/regress-416359.js
@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict"
+function f() {
+ for (x in {a:0});
+}
+
+assertThrows(f);
diff --git a/test/mjsunit/compiler/regress-4206.js b/test/mjsunit/compiler/regress-4206.js
new file mode 100644
index 0000000..742ed5d
--- /dev/null
+++ b/test/mjsunit/compiler/regress-4206.js
@@ -0,0 +1,28 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Module(stdlib) {
+ "use asm";
+ function TernaryMin(a, b) {
+ a=+(a);
+ b=+(b);
+ return (+((a < b) ? a : b));
+ }
+ function TernaryMax(a, b) {
+ a=+(a);
+ b=+(b);
+ return (+((b < a) ? a : b));
+ }
+ return { TernaryMin: TernaryMin,
+ TernaryMax: TernaryMax };
+}
+var min = Module(this).TernaryMin;
+var max = Module(this).TernaryMax;
+
+assertEquals(0.0, min(-0.0, 0.0));
+assertEquals(0.0, min(NaN, 0.0));
+assertEquals(-0.0, min(NaN, -0.0));
+assertEquals(-0.0, max(0.0, -0.0));
+assertEquals(0.0, max(NaN, 0.0));
+assertEquals(-0.0, max(NaN, -0.0));
diff --git a/test/mjsunit/compiler/regress-4207.js b/test/mjsunit/compiler/regress-4207.js
new file mode 100644
index 0000000..c4ab5a7
--- /dev/null
+++ b/test/mjsunit/compiler/regress-4207.js
@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar() { return 0/0 && 1; }
+assertEquals(NaN, bar());
+%OptimizeFunctionOnNextCall(bar);
+assertEquals(NaN, bar());
+
+function foo() { return 0/0 || 1; }
+assertEquals(1, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1, foo());
diff --git a/test/mjsunit/compiler/regress-4389-1.js b/test/mjsunit/compiler/regress-4389-1.js
new file mode 100644
index 0000000..c58ce2d
--- /dev/null
+++ b/test/mjsunit/compiler/regress-4389-1.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.fround(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);
diff --git a/test/mjsunit/compiler/regress-4389-2.js b/test/mjsunit/compiler/regress-4389-2.js
new file mode 100644
index 0000000..3b720a5
--- /dev/null
+++ b/test/mjsunit/compiler/regress-4389-2.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.sqrt(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);
diff --git a/test/mjsunit/compiler/regress-4389-3.js b/test/mjsunit/compiler/regress-4389-3.js
new file mode 100644
index 0000000..9aa72d1
--- /dev/null
+++ b/test/mjsunit/compiler/regress-4389-3.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.floor(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);
diff --git a/test/mjsunit/compiler/regress-4389-4.js b/test/mjsunit/compiler/regress-4389-4.js
new file mode 100644
index 0000000..e824973
--- /dev/null
+++ b/test/mjsunit/compiler/regress-4389-4.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.round(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);
diff --git a/test/mjsunit/compiler/regress-4389-5.js b/test/mjsunit/compiler/regress-4389-5.js
new file mode 100644
index 0000000..64797bc
--- /dev/null
+++ b/test/mjsunit/compiler/regress-4389-5.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.abs(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);
diff --git a/test/mjsunit/compiler/regress-4389-6.js b/test/mjsunit/compiler/regress-4389-6.js
new file mode 100644
index 0000000..fe06570
--- /dev/null
+++ b/test/mjsunit/compiler/regress-4389-6.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.log(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);
diff --git a/test/mjsunit/compiler/regress-4413-1.js b/test/mjsunit/compiler/regress-4413-1.js
new file mode 100644
index 0000000..6f53711
--- /dev/null
+++ b/test/mjsunit/compiler/regress-4413-1.js
@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-asm
+
+var foo = (function(stdlib) {
+ "use asm";
+ var bar = stdlib.Symbol;
+ function foo() { return bar("lala"); }
+ return foo;
+})(this);
+
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/test/mjsunit/compiler/regress-445907.js b/test/mjsunit/compiler/regress-445907.js
new file mode 100644
index 0000000..8cde944
--- /dev/null
+++ b/test/mjsunit/compiler/regress-445907.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+v = [];
+v.length = (1 << 30);
+
+function f() {
+ v++;
+}
+
+assertThrows(f);
diff --git a/test/mjsunit/compiler/regress-446647.js b/test/mjsunit/compiler/regress-446647.js
new file mode 100644
index 0000000..6387aaa
--- /dev/null
+++ b/test/mjsunit/compiler/regress-446647.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt --turbo-filter=* --allow-natives-syntax
+
+function f(a,b) {
+ a%b
+};
+
+f({ toString : function() { %DeoptimizeFunction(f); }});
diff --git a/test/mjsunit/compiler/regress-4470-1.js b/test/mjsunit/compiler/regress-4470-1.js
new file mode 100644
index 0000000..91d26b7
--- /dev/null
+++ b/test/mjsunit/compiler/regress-4470-1.js
@@ -0,0 +1,16 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Foo() {}
+Foo.prototype.x = 0;
+function foo(f) {
+ f.x = 1;
+}
+foo(new Foo);
+foo(new Foo);
+%OptimizeFunctionOnNextCall(foo);
+foo(new Foo);
+assertEquals(Foo.prototype.x, 0);
diff --git a/test/mjsunit/compiler/regress-447567.js b/test/mjsunit/compiler/regress-447567.js
new file mode 100644
index 0000000..7aaada0
--- /dev/null
+++ b/test/mjsunit/compiler/regress-447567.js
@@ -0,0 +1,13 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(function () {
+ Object.freeze(new Int8Array(1))
+});
+
+assertThrows(function() {
+ "use strict";
+ const v = 42;
+ v += 1;
+});
diff --git a/test/mjsunit/compiler/regress-451012.js b/test/mjsunit/compiler/regress-451012.js
new file mode 100644
index 0000000..bffc8bc
--- /dev/null
+++ b/test/mjsunit/compiler/regress-451012.js
@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+function f() {
+ for (let v; v; ) {
+ let x;
+ }
+}
+
+f();
diff --git a/test/mjsunit/compiler/regress-452427.js b/test/mjsunit/compiler/regress-452427.js
new file mode 100644
index 0000000..f798b9c
--- /dev/null
+++ b/test/mjsunit/compiler/regress-452427.js
@@ -0,0 +1,18 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var stdlib = {};
+var foreign = {};
+var heap = new ArrayBuffer(64 * 1024);
+
+var rol = (function Module(stdlib, foreign, heap) {
+ "use asm";
+ function rol() {
+ y = "a" > false;
+ return y + (1 - y);
+ }
+ return { rol: rol };
+})(stdlib, foreign, heap).rol;
+
+assertEquals(1, rol());
diff --git a/test/mjsunit/compiler/regress-463056.js b/test/mjsunit/compiler/regress-463056.js
new file mode 100644
index 0000000..fb87161
--- /dev/null
+++ b/test/mjsunit/compiler/regress-463056.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+ return ((0%0)&1) + (1>>>(0%0));
+}
+
+f();
diff --git a/test/mjsunit/compiler/regress-468162.js b/test/mjsunit/compiler/regress-468162.js
new file mode 100644
index 0000000..47bff03
--- /dev/null
+++ b/test/mjsunit/compiler/regress-468162.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var asm = (function() {
+ "use asm";
+ var max = Math.max;
+ return function f() { return max(0, -17); };
+})();
+
+assertEquals(0, asm());
diff --git a/test/mjsunit/compiler/regress-468727.js b/test/mjsunit/compiler/regress-468727.js
new file mode 100644
index 0000000..a69efe5
--- /dev/null
+++ b/test/mjsunit/compiler/regress-468727.js
@@ -0,0 +1,16 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --noanalyze-environment-liveness
+
+function f() {
+ var __v_7 = -126 - __v_3;
+ var __v_17 = ((__v_15 & __v_14) != 4) | 16;
+ if (__v_17) {
+ var __v_11 = 1 << __v_7;
+ }
+ __v_12 >>= __v_3;
+}
+
+assertThrows(f);
diff --git a/test/mjsunit/compiler/regress-469089.js b/test/mjsunit/compiler/regress-469089.js
new file mode 100644
index 0000000..6aff2b7
--- /dev/null
+++ b/test/mjsunit/compiler/regress-469089.js
@@ -0,0 +1,16 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+(function() {
+ var __v_6 = false;
+ function f(val, idx) {
+ if (idx === 1) {
+ gc();
+ __v_6 = (val === 0);
+ }
+ }
+ f(.1, 1);
+})();
diff --git a/test/mjsunit/compiler/regress-491578.js b/test/mjsunit/compiler/regress-491578.js
new file mode 100644
index 0000000..c275704
--- /dev/null
+++ b/test/mjsunit/compiler/regress-491578.js
@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ if (x === undefined) return;
+ while (true) {
+ while (1 || 2) { }
+ f();
+ }
+}
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/test/mjsunit/compiler/regress-572409.js b/test/mjsunit/compiler/regress-572409.js
new file mode 100644
index 0000000..126b622
--- /dev/null
+++ b/test/mjsunit/compiler/regress-572409.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = function() {};
+function f() {
+ var lit = { __proto__: o };
+ o instanceof RegExp;
+}
+f();
diff --git a/test/mjsunit/compiler/regress-96989.js b/test/mjsunit/compiler/regress-96989.js
index aedeb24..85beaed 100644
--- a/test/mjsunit/compiler/regress-96989.js
+++ b/test/mjsunit/compiler/regress-96989.js
@@ -26,7 +26,7 @@
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --legacy-const
// Test correct handling of uninitialized const.
diff --git a/test/mjsunit/compiler/regress-const.js b/test/mjsunit/compiler/regress-const.js
index aa55d0f..89b559c 100644
--- a/test/mjsunit/compiler/regress-const.js
+++ b/test/mjsunit/compiler/regress-const.js
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --legacy-const
// Test const initialization and assignments.
function f() {
diff --git a/test/mjsunit/compiler/regress-crbug-540593.js b/test/mjsunit/compiler/regress-crbug-540593.js
new file mode 100644
index 0000000..ec68e85
--- /dev/null
+++ b/test/mjsunit/compiler/regress-crbug-540593.js
@@ -0,0 +1,14 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --enable-slow-asserts --turbo-inlining
+
+var __f_2 = (function(stdlib) {
+ "use asm";
+ var __v_3 = stdlib.Symbol;
+ function __f_2() { return __v_3(); }
+ return __f_2;
+})(this);
+%OptimizeFunctionOnNextCall(__f_2);
+__f_2();
diff --git a/test/mjsunit/compiler/regress-f64-w32-change.js b/test/mjsunit/compiler/regress-f64-w32-change.js
new file mode 100644
index 0000000..834da29
--- /dev/null
+++ b/test/mjsunit/compiler/regress-f64-w32-change.js
@@ -0,0 +1,23 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var f = (function () {
+ "use asm";
+ var f64use = 0;
+ function f(x, b) {
+ x = x|0;
+ b = b >>> 0;
+ var f64 = x ? -1 : b;
+ f64use = f64 + 0.5;
+ var w32 = x ? 1 : f64;
+ return (w32 + 1)|0;
+ }
+
+ return f;
+})();
+
+%OptimizeFunctionOnNextCall(f);
+assertEquals(0, f(0, -1));
diff --git a/test/mjsunit/compiler/regress-gvn.js b/test/mjsunit/compiler/regress-gvn.js
index 01b1aa9..7055e34 100644
--- a/test/mjsunit/compiler/regress-gvn.js
+++ b/test/mjsunit/compiler/regress-gvn.js
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --noalways-opt --allow-natives-syntax
+// Flags: --allow-natives-syntax
//
// Regression test for global value numbering.
diff --git a/test/mjsunit/compiler/regress-lazy-deopt.js b/test/mjsunit/compiler/regress-lazy-deopt.js
index d1c3d01..7662207 100644
--- a/test/mjsunit/compiler/regress-lazy-deopt.js
+++ b/test/mjsunit/compiler/regress-lazy-deopt.js
@@ -27,7 +27,7 @@
// Flags: --allow-natives-syntax
-// Test lazy deoptimization after CallFunctionStub.
+// Test lazy deoptimization after Call builtin.
function foo() { return 1; }
@@ -37,7 +37,7 @@
%DeoptimizeFunction(f);
return 1;
}
- a[0] = %_CallFunction(null, x - 1, f);
+ a[0] = %_Call(f, null, x - 1);
return x >> a[0];
}
diff --git a/test/mjsunit/compiler/regress-shift-left.js b/test/mjsunit/compiler/regress-shift-left.js
new file mode 100644
index 0000000..110e899
--- /dev/null
+++ b/test/mjsunit/compiler/regress-shift-left.js
@@ -0,0 +1,41 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function ShiftLeftWithDeoptUsage() {
+ function g() {}
+
+ function f() {
+ var tmp = 1264475713;
+ var tmp1 = tmp - (-913041544);
+ g();
+ return 1 << tmp1;
+ }
+
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(512, f());
+})();
+
+
+(function ShiftLeftWithCallUsage() {
+ var f = (function() {
+ "use asm"
+ // This is not a valid asm.js, we use the "use asm" here to
+ // trigger Turbofan without deoptimization support.
+
+ function g(x) { return x; }
+
+ function f() {
+ var tmp = 1264475713;
+ var tmp1 = tmp - (-913041544);
+ return g(1 << tmp1, tmp1);
+ }
+
+ return f;
+ })();
+
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(512, f());
+})();
diff --git a/test/mjsunit/compiler/regress-shift-right-logical.js b/test/mjsunit/compiler/regress-shift-right-logical.js
new file mode 100644
index 0000000..f2be2ad
--- /dev/null
+++ b/test/mjsunit/compiler/regress-shift-right-logical.js
@@ -0,0 +1,41 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function ShiftRightLogicalWithDeoptUsage() {
+ function g() {}
+
+ function f() {
+ var tmp = 1264475713;
+ var tmp1 = tmp - (-913041544);
+ g();
+ return 1 >>> tmp1;
+ }
+
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(0, f());
+})();
+
+
+(function ShiftRightLogicalWithCallUsage() {
+ var f = (function() {
+ "use asm"
+ // This is not a valid asm.js, we use the "use asm" here to
+ // trigger Turbofan without deoptimization support.
+
+ function g(x) { return x; }
+
+ function f() {
+ var tmp = 1264475713;
+ var tmp1 = tmp - (-913041544);
+ return g(1 >>> tmp1, tmp1);
+ }
+
+ return f;
+ })();
+
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(0, f());
+})();
diff --git a/test/mjsunit/compiler/regress-shift-right.js b/test/mjsunit/compiler/regress-shift-right.js
new file mode 100644
index 0000000..71bcb21
--- /dev/null
+++ b/test/mjsunit/compiler/regress-shift-right.js
@@ -0,0 +1,41 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function ShiftRightWithDeoptUsage() {
+ function g() {}
+
+ function f() {
+ var tmp = 1264475713;
+ var tmp1 = tmp - (-913041544);
+ g();
+ return 1 >> tmp1;
+ }
+
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(0, f());
+})();
+
+
+(function ShiftRightWithCallUsage() {
+ var f = (function() {
+ "use asm"
+ // This is not a valid asm.js, we use the "use asm" here to
+ // trigger Turbofan without deoptimization support.
+
+ function g(x) { return x; }
+
+ function f() {
+ var tmp = 1264475713;
+ var tmp1 = tmp - (-913041544);
+ return g(1 >> tmp1, tmp1);
+ }
+
+ return f;
+ })();
+
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(0, f());
+})();
diff --git a/test/mjsunit/compiler/regress-stacktrace.js b/test/mjsunit/compiler/regress-stacktrace.js
index 843dd12..ca57876 100644
--- a/test/mjsunit/compiler/regress-stacktrace.js
+++ b/test/mjsunit/compiler/regress-stacktrace.js
@@ -48,5 +48,4 @@
assertTrue(p1 != -1);
assertTrue(p3 < p2);
assertTrue(p2 < p1);
- print(stack);
}
diff --git a/test/mjsunit/compiler/regress-to-number-binop-deopt.js b/test/mjsunit/compiler/regress-to-number-binop-deopt.js
new file mode 100644
index 0000000..f6b77d9
--- /dev/null
+++ b/test/mjsunit/compiler/regress-to-number-binop-deopt.js
@@ -0,0 +1,25 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function deopt(f) {
+ return { valueOf : function() { %DeoptimizeFunction(f); return 1.1; } };
+}
+
+function or_zero(o) {
+ return o|0;
+}
+
+function multiply_one(o) {
+ return +o;
+}
+
+function multiply_one_symbol() {
+ return +Symbol();
+}
+
+assertThrows(multiply_one_symbol, TypeError);
+assertEquals(1, or_zero(deopt(or_zero)));
+assertEquals(1.1, multiply_one(deopt(multiply_one)));
diff --git a/test/mjsunit/compiler/regress-uint8-deopt.js b/test/mjsunit/compiler/regress-uint8-deopt.js
index ba2823f..5be2d0c 100644
--- a/test/mjsunit/compiler/regress-uint8-deopt.js
+++ b/test/mjsunit/compiler/regress-uint8-deopt.js
@@ -2,7 +2,7 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --turbo-asm --turbo-deoptimization --allow-natives-syntax
+// Flags: --turbo-asm --turbo-asm-deoptimization --allow-natives-syntax
function Module(heap) {
"use asm";
diff --git a/test/mjsunit/compiler/regress-variable-liveness-let.js b/test/mjsunit/compiler/regress-variable-liveness-let.js
new file mode 100644
index 0000000..4c6b693
--- /dev/null
+++ b/test/mjsunit/compiler/regress-variable-liveness-let.js
@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-filter=f
+
+"use strict";
+
+function f() {
+ %DeoptimizeNow();
+ let x = 23;
+}
+
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/compiler/regress-variable-liveness.js b/test/mjsunit/compiler/regress-variable-liveness.js
new file mode 100644
index 0000000..e18741d
--- /dev/null
+++ b/test/mjsunit/compiler/regress-variable-liveness.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ %DeoptimizeFunction(run);
+ return x;
+}
+
+function run() {
+ var line = new Array(2);
+ for (var n = 3; n > 0; n = n - 1) {
+ if (n < foo(line.length)) line = new Array(n);
+ line[0] = n;
+ }
+}
+
+assertEquals(void 0, run());
+%OptimizeFunctionOnNextCall(run);
+assertEquals(void 0, run());
diff --git a/test/mjsunit/compiler/string-length.js b/test/mjsunit/compiler/string-length.js
new file mode 100644
index 0000000..855a1a6
--- /dev/null
+++ b/test/mjsunit/compiler/string-length.js
@@ -0,0 +1,31 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertEquals(0, "".length);
+assertEquals(1, "a".length);
+assertEquals(2, ("a" + "b").length);
+
+function id(x) { return x; }
+
+function f1(x) {
+ return x.length;
+}
+assertEquals(0, f1(""));
+assertEquals(1, f1("a"));
+%OptimizeFunctionOnNextCall(f1);
+assertEquals(2, f1("a" + "b"));
+assertEquals(3, f1(id("a") + id("b" + id("c"))))
+
+function f2(x, y, z) {
+ x = x ? "" + y : "" + z;
+ return x.length;
+}
+assertEquals(0, f2(true, "", "a"));
+assertEquals(1, f2(false, "", "a"));
+%OptimizeFunctionOnNextCall(f2);
+assertEquals(0, f2(true, "", "a"));
+assertEquals(1, f2(false, "", "a"));
+assertEquals(3, f2(true, id("a") + id("b" + id("c")), ""));
diff --git a/test/mjsunit/compiler/symbol-protototype.js b/test/mjsunit/compiler/symbol-protototype.js
new file mode 100644
index 0000000..9a707e8
--- /dev/null
+++ b/test/mjsunit/compiler/symbol-protototype.js
@@ -0,0 +1,40 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test1(s) {
+ return s.toString;
+}
+assertSame(test1(Symbol()), Symbol.prototype.toString);
+assertSame(test1(Symbol()), Symbol.prototype.toString);
+%OptimizeFunctionOnNextCall(test1);
+assertSame(test1(Symbol()), Symbol.prototype.toString);
+
+function test2(s) {
+ return s.valueOf;
+}
+assertSame(test2(Symbol()), Symbol.prototype.valueOf);
+assertSame(test2(Symbol()), Symbol.prototype.valueOf);
+%OptimizeFunctionOnNextCall(test2);
+assertSame(test2(Symbol()), Symbol.prototype.valueOf);
+
+Symbol.prototype.foo = 1;
+function test3(s) {
+ return s["foo"];
+}
+assertEquals(test3(Symbol()), 1);
+assertEquals(test3(Symbol()), 1);
+%OptimizeFunctionOnNextCall(test3);
+assertEquals(test3(Symbol()), 1);
+
+Symbol.prototype.bar = function() { "use strict"; return this; }
+function test4(s) {
+ return s.bar();
+}
+var s = Symbol("foo");
+assertEquals(test4(s), s);
+assertEquals(test4(s), s);
+%OptimizeFunctionOnNextCall(test4);
+assertEquals(test4(s), s);
diff --git a/test/mjsunit/compiler/truncating-store-deopt.js b/test/mjsunit/compiler/truncating-store-deopt.js
new file mode 100644
index 0000000..a640caf
--- /dev/null
+++ b/test/mjsunit/compiler/truncating-store-deopt.js
@@ -0,0 +1,28 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g(a, b, c) {
+ return a + b + c;
+}
+
+var asm = (function Module(global, env, buffer) {
+ "use asm";
+
+ var i32 = new global.Int32Array(buffer);
+
+ // This is not valid asm.js, but we should still generate correct code.
+ function store(x) {
+ return g(1, i32[0] = x, 2);
+ }
+
+ return { store: store };
+})({
+ "Int32Array": Int32Array
+}, {}, new ArrayBuffer(64 * 1024));
+
+var o = { toString : function() { %DeoptimizeFunction(asm.store); return "1"; } }
+
+asm.store(o);
diff --git a/test/mjsunit/compiler/try-binop.js b/test/mjsunit/compiler/try-binop.js
new file mode 100644
index 0000000..2132ad2
--- /dev/null
+++ b/test/mjsunit/compiler/try-binop.js
@@ -0,0 +1,45 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var boom = { valueOf: function() { throw "boom" } };
+
+function mult_left_plain(x) {
+ try {
+ return 2 * x;
+ } catch (e) {
+ return e;
+ }
+}
+
+%OptimizeFunctionOnNextCall(mult_left_plain);
+assertEquals("boom", mult_left_plain(boom));
+assertEquals(46, mult_left_plain(23));
+
+function mult_right_plain(x) {
+ try {
+ return x * 3;
+ } catch (e) {
+ return e;
+ }
+}
+
+%OptimizeFunctionOnNextCall(mult_right_plain);
+assertEquals("boom", mult_right_plain(boom));
+assertEquals(69, mult_right_plain(23));
+
+function mult_none_plain(x,y) {
+ try {
+ return x * y;
+ } catch (e) {
+ return e;
+ }
+}
+
+%OptimizeFunctionOnNextCall(mult_none_plain);
+assertEquals("boom", mult_none_plain(boom, boom));
+assertEquals("boom", mult_none_plain(boom, 2));
+assertEquals("boom", mult_none_plain(2, boom));
+assertEquals(966, mult_none_plain(23, 42));
diff --git a/test/mjsunit/compiler/try-deopt.js b/test/mjsunit/compiler/try-deopt.js
new file mode 100644
index 0000000..a4a6eb0
--- /dev/null
+++ b/test/mjsunit/compiler/try-deopt.js
@@ -0,0 +1,55 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function DeoptFromTry(x) {
+ try {
+ %DeoptimizeFunction(DeoptFromTry);
+ throw x;
+ } catch (e) {
+ return e + 1;
+ }
+ return x + 2;
+}
+%OptimizeFunctionOnNextCall(DeoptFromTry);
+assertEquals(24, DeoptFromTry(23));
+
+
+function DeoptFromCatch(x) {
+ try {
+ throw x;
+ } catch (e) {
+ %DeoptimizeFunction(DeoptFromCatch);
+ return e + 1;
+ }
+ return x + 2;
+}
+%OptimizeFunctionOnNextCall(DeoptFromCatch);
+assertEquals(24, DeoptFromCatch(23));
+
+
+function DeoptFromFinally_Return(x) {
+ try {
+ throw x;
+ } finally {
+ %DeoptimizeFunction(DeoptFromFinally_Return);
+ return x + 1;
+ }
+ return x + 2;
+}
+%OptimizeFunctionOnNextCall(DeoptFromFinally_Return);
+assertEquals(24, DeoptFromFinally_Return(23));
+
+
+function DeoptFromFinally_ReThrow(x) {
+ try {
+ throw x;
+ } finally {
+ %DeoptimizeFunction(DeoptFromFinally_ReThrow);
+ }
+ return x + 2;
+}
+%OptimizeFunctionOnNextCall(DeoptFromFinally_ReThrow);
+assertThrows("DeoptFromFinally_ReThrow(new Error)", Error);
diff --git a/test/mjsunit/compiler/try-osr.js b/test/mjsunit/compiler/try-osr.js
new file mode 100644
index 0000000..e4eb8dd
--- /dev/null
+++ b/test/mjsunit/compiler/try-osr.js
@@ -0,0 +1,51 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-osr
+
+function OSRInsideTry(x) {
+ try {
+ for (var i = 0; i < 10; i++) { if (i == 5) %OptimizeOsr(); }
+ throw x;
+ } catch (e) {
+ return e + 1;
+ }
+ return x + 2;
+}
+assertEquals(24, OSRInsideTry(23));
+
+
+function OSRInsideCatch(x) {
+ try {
+ throw x;
+ } catch (e) {
+ for (var i = 0; i < 10; i++) { if (i == 5) %OptimizeOsr(); }
+ return e + 1;
+ }
+ return x + 2;
+}
+assertEquals(24, OSRInsideCatch(23));
+
+
+function OSRInsideFinally_Return(x) {
+ try {
+ throw x;
+ } finally {
+ for (var i = 0; i < 10; i++) { if (i == 5) %OptimizeOsr(); }
+ return x + 1;
+ }
+ return x + 2;
+}
+assertEquals(24, OSRInsideFinally_Return(23));
+
+
+function OSRInsideFinally_ReThrow(x) {
+ try {
+ throw x;
+ } finally {
+ for (var i = 0; i < 10; i++) { if (i == 5) %OptimizeOsr(); }
+ }
+ return x + 2;
+}
+assertThrows("OSRInsideFinally_ReThrow(new Error)", Error);
diff --git a/test/mjsunit/compiler/uint32.js b/test/mjsunit/compiler/uint32.js
index abed285..3568e27 100644
--- a/test/mjsunit/compiler/uint32.js
+++ b/test/mjsunit/compiler/uint32.js
@@ -171,3 +171,34 @@
%OptimizeFunctionOnNextCall(FillOldArrayWithHeapNumbers);
FillOldArrayWithHeapNumbers(old_array.length);
gc();
+
+// Test that HArgumentsObject does not prevent uint32 optimization and
+// that arguments object with uint32 values inside is correctly materialized.
+function Pack(x, y) {
+ try { // Prevent inlining.
+ return [x, y];
+ } catch (e) {
+ }
+}
+
+function InnerWithArguments(x, f) {
+ "use strict";
+ x >>>= 8;
+ return f(arguments[0], x|0);
+}
+
+function Outer(v, f) {
+ return InnerWithArguments(v >>> 0, f);
+}
+
+assertArrayEquals([0x0100, 0x01], Outer(0x0100, Pack));
+assertArrayEquals([0x0100, 0x01], Outer(0x0100, Pack));
+assertArrayEquals([0x0100, 0x01], Outer(0x0100, Pack));
+%OptimizeFunctionOnNextCall(Outer);
+assertArrayEquals([0x0100, 0x01], Outer(0x0100, Pack));
+assertArrayEquals([0xFFFFFFFF, 0x00FFFFFF], Outer(-1, Pack));
+
+// Cause deopt inside InnerWithArguments by passing different pack function.
+assertArrayEquals([0xFFFFFFFF, 0x00FFFFFF], Outer(-1, function (x, y) {
+ return [x, y];
+}));