Upgrade to 3.29
Update V8 to 3.29.88.17 and update makefiles to support building on
all the relevant platforms.
Bug: 17370214
Change-Id: Ia3407c157fd8d72a93e23d8318ccaf6ecf77fa4e
diff --git a/test/mjsunit/array-store-and-grow.js b/test/mjsunit/array-store-and-grow.js
index 131d4eb..5ac95e9 100644
--- a/test/mjsunit/array-store-and-grow.js
+++ b/test/mjsunit/array-store-and-grow.js
@@ -25,6 +25,8 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Flags: --allow-natives-syntax
+
// Verifies that the KeyedStoreIC correctly handles out-of-bounds stores
// to an array that grow it by a single element. Test functions are
// called twice to make sure that the IC is used, first call is handled
@@ -99,7 +101,10 @@
a = makeCOW();
array_store_5(a, 1, 0.5);
assertEquals(0.5, a[1]);
-assertEquals(0.5, array_store_5([], 1, 0.5));
+a = [];
+assertEquals(0.5, array_store_5(a, 1, 0.5));
+assertEquals(undefined, a[0]);
+assertEquals(0.5, a[1]);
function array_store_6(a,b,c) {
return (a[b] = c);
@@ -181,3 +186,71 @@
array_store_1(a, 0, 0.5);
assertEquals(0.5, a[0]);
assertEquals(0.5, array_store_1([], 0, 0.5));
+
+
+// Verify that a grow store will deoptimize if the max gap (difference between
+// the end of an array capacity and a new index) is passed. The wrapper is to
+// make sure array_store_10 isn't inlined.
+
+(function() {
+ function grow_store(a,b,c) {
+ a[b] = c;
+ }
+
+ a = new Array(1);
+ grow_store(a,1,1);
+ grow_store(a,2,1);
+ %OptimizeFunctionOnNextCall(grow_store);
+ grow_store(a,10,1);
+ assertOptimized(grow_store);
+ grow_store(a,2048,1);
+ assertUnoptimized(grow_store);
+ %ClearFunctionTypeFeedback(grow_store);
+})();
+
+
+// Verify that a polymorphic store and grow IC when crankshafted is still
+// a grow IC (earlier it would revert to a standard store in the polymorphic
+// case).
+(function() {
+ function f(o, k, v) {
+ o[k] = v;
+ }
+
+ a = [3.5];
+ f(a, 1, "hi"); // DOUBLE packed array -> tagged packed grow
+ a = {};
+ a.p = "property";
+ a[0] = 1;
+ f(a, 0, 5.4);
+
+ %OptimizeFunctionOnNextCall(f);
+ // Should be a polymorphic grow stub. If not a grow stub it will deopt.
+ f(new Array("hi"), 1, 3);
+ assertOptimized(f);
+ %ClearFunctionTypeFeedback(f);
+})();
+
+
+// Now verify that a polymorphic store (non-growing) IC when crankshafted WILL
+// deopt if you pass an element out of bounds.
+(function() {
+ function f(o, k, v) {
+ o[k] = v;
+ }
+
+ a = [3.5];
+ f(a, 0, "hi"); // DOUBLE packed array -> tagged packed grow
+ a = {};
+ a.p = "property";
+ a[0] = 1;
+ f(a, 0, 5.4);
+
+ %OptimizeFunctionOnNextCall(f);
+ f(new Array("hi"), 0, 3);
+ assertOptimized(f);
+ // An attempt to grow should cause deopt
+ f(new Array("hi"), 1, 3);
+ assertUnoptimized(f);
+ %ClearFunctionTypeFeedback(f);
+})();