Merge V8 5.3.332.45. DO NOT MERGE
Test: Manual
FPIIM-449
Change-Id: Id3254828b068abdea3cb10442e0172a8c9a98e03
(cherry picked from commit 13e2dadd00298019ed862f2b2fc5068bba730bcf)
diff --git a/test/mjsunit/compiler/dont-constant-fold-deopting-checks.js b/test/mjsunit/compiler/dont-constant-fold-deopting-checks.js
new file mode 100644
index 0000000..02bd8d9
--- /dev/null
+++ b/test/mjsunit/compiler/dont-constant-fold-deopting-checks.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(a) { a[0](true); }
+function foo(a) { return bar(1); }
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() {bar([foo])}, TypeError);
diff --git a/test/mjsunit/compiler/inline-dead-jscreate.js b/test/mjsunit/compiler/inline-dead-jscreate.js
new file mode 100644
index 0000000..a977875
--- /dev/null
+++ b/test/mjsunit/compiler/inline-dead-jscreate.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var bar = 0;
+
+function baz() { return this; }
+
+function foo() {
+ bar += 1;
+ if (bar === 2) throw new baz();
+}
+
+foo();
diff --git a/test/mjsunit/compiler/optimized-instanceof-1.js b/test/mjsunit/compiler/optimized-instanceof-1.js
index 538b0ef..242b4be 100644
--- a/test/mjsunit/compiler/optimized-instanceof-1.js
+++ b/test/mjsunit/compiler/optimized-instanceof-1.js
@@ -2,7 +2,7 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --allow-natives-syntax --harmony-instanceof
+// Flags: --allow-natives-syntax
function F() {}
var f = new F
diff --git a/test/mjsunit/compiler/optimized-instanceof-2.js b/test/mjsunit/compiler/optimized-instanceof-2.js
index 80bbdcd..38a35b7 100644
--- a/test/mjsunit/compiler/optimized-instanceof-2.js
+++ b/test/mjsunit/compiler/optimized-instanceof-2.js
@@ -2,7 +2,7 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --allow-natives-syntax --harmony-instanceof
+// Flags: --allow-natives-syntax
function F() {}
var f = new F
diff --git a/test/mjsunit/compiler/regress-5074.js b/test/mjsunit/compiler/regress-5074.js
new file mode 100644
index 0000000..903b54a
--- /dev/null
+++ b/test/mjsunit/compiler/regress-5074.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var s = [,0.1];
+
+function foo(a, b) {
+ var x = s[a];
+ s[1] = 0.1;
+ return x + b;
+}
+
+assertEquals(2.1, foo(1, 2));
+assertEquals(2.1, foo(1, 2));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals("undefined2", foo(0, "2"));
diff --git a/test/mjsunit/compiler/regress-5100.js b/test/mjsunit/compiler/regress-5100.js
new file mode 100644
index 0000000..694cd8a
--- /dev/null
+++ b/test/mjsunit/compiler/regress-5100.js
@@ -0,0 +1,51 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = [0, 1];
+a["true"] = "true";
+a["false"] = "false";
+a["null"] = "null";
+a["undefined"] = "undefined";
+
+// Ensure we don't accidentially truncate true when used to index arrays.
+(function() {
+ function f(x) { return a[x]; }
+
+ assertEquals(0, f(0));
+ assertEquals(0, f(0));
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals("true", f(true));
+})();
+
+// Ensure we don't accidentially truncate false when used to index arrays.
+(function() {
+ function f( x) { return a[x]; }
+
+ assertEquals(0, f(0));
+ assertEquals(0, f(0));
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals("false", f(false));
+})();
+
+// Ensure we don't accidentially truncate null when used to index arrays.
+(function() {
+ function f( x) { return a[x]; }
+
+ assertEquals(0, f(0));
+ assertEquals(0, f(0));
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals("null", f(null));
+})();
+
+// Ensure we don't accidentially truncate undefined when used to index arrays.
+(function() {
+ function f( x) { return a[x]; }
+
+ assertEquals(0, f(0));
+ assertEquals(0, f(0));
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals("undefined", f(undefined));
+})();
diff --git a/test/mjsunit/compiler/regress-5129.js b/test/mjsunit/compiler/regress-5129.js
new file mode 100644
index 0000000..1d100ab
--- /dev/null
+++ b/test/mjsunit/compiler/regress-5129.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo($a,$b) {
+ $a = $a|0;
+ $b = $b|0;
+ var $sub = $a - $b;
+ return ($sub|0) < 0;
+}
+
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(0x7fffffff,-1));
diff --git a/test/mjsunit/compiler/regress-621423.js b/test/mjsunit/compiler/regress-621423.js
new file mode 100644
index 0000000..962176f
--- /dev/null
+++ b/test/mjsunit/compiler/regress-621423.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = [0, ""];
+a[0] = 0;
+
+function g(array) {
+ array[1] = undefined;
+}
+
+function f() {
+ g(function() {});
+ g(a);
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/compiler/regress-number-is-hole-nan.js b/test/mjsunit/compiler/regress-number-is-hole-nan.js
new file mode 100644
index 0000000..368c837
--- /dev/null
+++ b/test/mjsunit/compiler/regress-number-is-hole-nan.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = [, 2.121736758e-314];
+
+function foo() { return a[1]; }
+
+assertEquals(2.121736758e-314, foo());
+assertEquals(2.121736758e-314, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(2.121736758e-314, foo());
diff --git a/test/mjsunit/compiler/regress-store-holey-double-array.js b/test/mjsunit/compiler/regress-store-holey-double-array.js
new file mode 100644
index 0000000..8123198
--- /dev/null
+++ b/test/mjsunit/compiler/regress-store-holey-double-array.js
@@ -0,0 +1,43 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function StoreHoleBitPattern() {
+ function g(src, dst, i) {
+ dst[i] = src[i];
+ }
+
+ var b = new ArrayBuffer(16);
+ var i32 = new Int32Array(b);
+ i32[0] = 0xFFF7FFFF;
+ i32[1] = 0xFFF7FFFF;
+ i32[3] = 0xFFF7FFFF;
+ i32[4] = 0xFFF7FFFF;
+ var f64 = new Float64Array(b);
+
+ var a = [,0.1];
+
+ g(f64, a, 1);
+ g(f64, a, 1);
+ %OptimizeFunctionOnNextCall(g);
+ g(f64, a, 0);
+
+ assertTrue(Number.isNaN(a[0]));
+})();
+
+
+(function ConvertHoleToNumberAndStore() {
+ function g(a, i) {
+ var x = a[i];
+ a[i] = +x;
+ }
+
+ var a=[,0.1];
+ g(a, 1);
+ g(a, 1);
+ %OptimizeFunctionOnNextCall(g);
+ g(a, 0);
+ assertTrue(Number.isNaN(a[0]));
+})();
diff --git a/test/mjsunit/compiler/regress-string-to-number-add.js b/test/mjsunit/compiler/regress-string-to-number-add.js
new file mode 100644
index 0000000..e872401
--- /dev/null
+++ b/test/mjsunit/compiler/regress-string-to-number-add.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-type-feedback
+
+function f(x) {
+ var s = x ? "0" : "1";
+ return 1 + Number(s);
+}
+
+f(0);
+f(0);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(2, f(0));
diff --git a/test/mjsunit/compiler/regress-truncate-number-or-undefined-to-float64.js b/test/mjsunit/compiler/regress-truncate-number-or-undefined-to-float64.js
new file mode 100644
index 0000000..1dc3042
--- /dev/null
+++ b/test/mjsunit/compiler/regress-truncate-number-or-undefined-to-float64.js
@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g(a, b) {
+ a = +a;
+ if (b) {
+ a = undefined;
+ }
+ print(a);
+ return +a;
+}
+
+g(0);
+g(0);
+%OptimizeFunctionOnNextCall(g);
+assertTrue(Number.isNaN(g(0, true)));
diff --git a/test/mjsunit/compiler/turbo-number-feedback.js b/test/mjsunit/compiler/turbo-number-feedback.js
new file mode 100644
index 0000000..059a0ca
--- /dev/null
+++ b/test/mjsunit/compiler/turbo-number-feedback.js
@@ -0,0 +1,58 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-type-feedback
+
+(function AddSubtractSmis() {
+ function f0(a, b, c) {
+ return a + b - c;
+ }
+
+ assertEquals(4, f0(3, 2, 1));
+ assertEquals(4, f0(3, 2, 1));
+ %OptimizeFunctionOnNextCall(f0);
+ assertEquals(4, f0(3, 2, 1));
+})();
+
+(function AddSubtractDoubles() {
+ function f1(a, b, c) {
+ return a + b - c;
+ }
+
+ assertEquals(4.5, f1(3.5, 2.5, 1.5));
+ assertEquals(4.5, f1(3.5, 2.5, 1.5));
+ %OptimizeFunctionOnNextCall(f1);
+ assertEquals(4.5, f1(3.5, 2.5, 1.5));
+ assertEquals(4, f1(3, 2, 1));
+ assertTrue(isNaN(f1(3, 2, undefined)));
+ assertTrue(isNaN(f1(3, undefined, 1)));
+})();
+
+(function CheckUint32ToInt32Conv() {
+ function f2(a) {
+ return (a >>> 0) + 1;
+ }
+
+ assertEquals(1, f2(0));
+ assertEquals(1, f2(0));
+ %OptimizeFunctionOnNextCall(f2);
+ assertEquals(1, f2(0));
+ assertEquals(4294967295, f2(-2));
+})();
+
+(function CheckFloat64ToInt32Conv() {
+ function f3(a, b) {
+ var x = 0;
+ if (a) {
+ x = 0.5;
+ }
+ return x + b;
+ }
+
+ assertEquals(1, f3(0, 1));
+ assertEquals(1, f3(0, 1));
+ %OptimizeFunctionOnNextCall(f3);
+ assertEquals(1, f3(0, 1));
+ assertEquals(1.5, f3(1, 1));
+})();