Upgrade to 3.29
Update V8 to 3.29.88.17 and update makefiles to support building on
all the relevant platforms.
Bug: 17370214
Change-Id: Ia3407c157fd8d72a93e23d8318ccaf6ecf77fa4e
diff --git a/test/mjsunit/compiler/alloc-number-debug.js b/test/mjsunit/compiler/alloc-number-debug.js
new file mode 100644
index 0000000..ccfcc0c
--- /dev/null
+++ b/test/mjsunit/compiler/alloc-number-debug.js
@@ -0,0 +1,44 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Try to get a GC because of a heap number allocation while we
+// have live values (o) in a register.
+function f(o) {
+ var x = 1.5;
+ var y = 2.5;
+ for (var i = 1; i < 3; i += 1) {
+ %SetAllocationTimeout(1, 0, false);
+ o.val = x + y + i;
+ %SetAllocationTimeout(-1, -1, true);
+ }
+ return o;
+}
+
+var o = { val: 0 };
+f(o);
diff --git a/test/mjsunit/compiler/alloc-object-huge.js b/test/mjsunit/compiler/alloc-object-huge.js
index d6d9f1b..b0a981d 100644
--- a/test/mjsunit/compiler/alloc-object-huge.js
+++ b/test/mjsunit/compiler/alloc-object-huge.js
@@ -25,7 +25,9 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax --inline-construct --nolimit-inlining
+// Flags: --allow-natives-syntax --inline-construct
+// Flags: --max-inlined-source-size=999999 --max-inlined-nodes=999999
+// Flags: --max-inlined-nodes-cumulative=999999
// Test that huge constructors (more than 256 this assignments) are
// handled correctly.
diff --git a/test/mjsunit/compiler/alloc-object.js b/test/mjsunit/compiler/alloc-object.js
index 1d44efb..0e593a4 100644
--- a/test/mjsunit/compiler/alloc-object.js
+++ b/test/mjsunit/compiler/alloc-object.js
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax --expose-gc --inline-construct
+// Flags: --allow-natives-syntax --inline-construct
// Test that inlined object allocation works for different layouts of
// objects (e.g. in object properties, slack tracking in progress or
@@ -53,7 +53,7 @@
assertEquals(5, o.y);
assertEquals(6, o.z);
%DeoptimizeFunction(test_helper);
- gc(); // Makes V8 forget about type information for test_helper.
+ %ClearFunctionTypeFeedback(test_helper);
}
function finalize_slack_tracking(construct) {
diff --git a/test/mjsunit/compiler/compare-map-elim.js b/test/mjsunit/compiler/compare-map-elim.js
new file mode 100644
index 0000000..288d481
--- /dev/null
+++ b/test/mjsunit/compiler/compare-map-elim.js
@@ -0,0 +1,51 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --check-elimination
+
+a = {
+ f: function() { this.y = 3; }
+};
+b = {
+ f: function() { this.y = 4; }
+};
+
+function x(z) {
+ return z.f();
+}
+
+x(a);
+x(b);
+x(a);
+x(b);
+x(a);
+x(b);
+
+%OptimizeFunctionOnNextCall(x)
+
+x(a);
+x(b);
diff --git a/test/mjsunit/compiler/compare-map-elim2.js b/test/mjsunit/compiler/compare-map-elim2.js
new file mode 100644
index 0000000..0c0540c
--- /dev/null
+++ b/test/mjsunit/compiler/compare-map-elim2.js
@@ -0,0 +1,130 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --check-elimination
+
+
+function test_empty() {
+ function foo(o) {
+ return { value: o.value };
+ }
+
+ function Base() {
+ this.v_ = 5;
+ }
+ Base.prototype.__defineGetter__("value", function() { return 1; });
+
+ var a = new Base();
+ a.a = 1;
+ foo(a);
+
+ Base.prototype.__defineGetter__("value", function() { return this.v_; });
+
+ var b = new Base();
+ b.b = 1;
+ foo(b);
+
+ var d = new Base();
+ d.d = 1;
+ d.value;
+
+ %OptimizeFunctionOnNextCall(foo);
+
+ var o = foo(b);
+}
+
+
+function test_narrow1() {
+ function foo(o) {
+ return { value: o.value };
+ }
+
+ function Base() {
+ this.v_ = 5;
+ }
+ Base.prototype.__defineGetter__("value", function() { return 1; });
+
+ var a = new Base();
+ a.a = 1;
+ foo(a);
+
+ Base.prototype.__defineGetter__("value", function() { return this.v_; });
+
+ var b = new Base();
+ b.b = 1;
+ foo(b);
+
+ var c = new Base();
+ c.c = 1;
+ foo(c);
+
+ var d = new Base();
+ d.d = 1;
+ d.value;
+
+ %OptimizeFunctionOnNextCall(foo);
+
+ var o = foo(b);
+}
+
+
+function test_narrow2() {
+ function foo(o, flag) {
+ return { value: o.value(flag) };
+ }
+
+ function Base() {
+ this.v_ = 5;
+ }
+ Base.prototype.value = function(flag) { return flag ? this.v_ : this.v_; };
+
+
+ var a = new Base();
+ a.a = 1;
+ foo(a, false);
+ foo(a, false);
+
+ var b = new Base();
+ b.b = 1;
+ foo(b, true);
+
+ var c = new Base();
+ c.c = 1;
+ foo(c, true);
+
+ var d = new Base();
+ d.d = 1;
+ d.value(true);
+
+ %OptimizeFunctionOnNextCall(foo);
+
+ var o = foo(b);
+}
+
+test_empty();
+test_narrow1();
+test_narrow2();
diff --git a/test/mjsunit/compiler/compare-objeq-elim.js b/test/mjsunit/compiler/compare-objeq-elim.js
new file mode 100644
index 0000000..4492df4
--- /dev/null
+++ b/test/mjsunit/compiler/compare-objeq-elim.js
@@ -0,0 +1,85 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --check-elimination
+
+function A(x, y) {
+ this.x = x;
+ this.y = y;
+}
+
+function B(x, y) {
+ this.x = x;
+ this.y = y;
+}
+
+function F1(a, b) {
+ if (a == b) return a.x;
+ else return b.x;
+}
+
+function F2(a, b) {
+ if (a == b) return a.x;
+ else return b.x;
+}
+
+function F3(a, b) {
+ var f = a.y;
+ if (a == b) return a.x;
+ else return b.x;
+}
+
+function F4(a, b) {
+ var f = b.y;
+ if (a == b) return a.x;
+ else return b.x;
+}
+
+%NeverOptimizeFunction(test);
+
+function test(f, a, b) {
+ f(a, a);
+ f(a, b);
+ f(b, a);
+ f(b, c);
+ f(b, b);
+ f(c, c);
+
+ %OptimizeFunctionOnNextCall(f)
+
+ assertEquals(a.x, f(a, a));
+ assertEquals(b.x, f(b, b));
+}
+
+var a = new A(3, 5);
+var b = new B(2, 6);
+var c = new A(1, 7);
+
+test(F1, a, c);
+test(F2, a, b);
+test(F3, a, b);
+test(F4, a, b);
diff --git a/test/mjsunit/compiler/concurrent-invalidate-transition-map.js b/test/mjsunit/compiler/concurrent-invalidate-transition-map.js
new file mode 100644
index 0000000..ab7d6d5
--- /dev/null
+++ b/test/mjsunit/compiler/concurrent-invalidate-transition-map.js
@@ -0,0 +1,64 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --track-fields --track-double-fields --allow-natives-syntax
+// Flags: --concurrent-recompilation --block-concurrent-recompilation
+
+if (!%IsConcurrentRecompilationSupported()) {
+ print("Concurrent recompilation is disabled. Skipping this test.");
+ quit();
+}
+
+function new_object() {
+ var o = {};
+ o.a = 1;
+ o.b = 2;
+ return o;
+}
+
+function add_field(obj) {
+ obj.c = 3;
+}
+var obj1 = new_object();
+var obj2 = new_object();
+add_field(obj1);
+add_field(obj2);
+%OptimizeFunctionOnNextCall(add_field, "concurrent");
+
+var o = new_object();
+// Kick off recompilation.
+add_field(o);
+// Invalidate transition map after compile graph has been created.
+o.c = 2.2;
+// In the mean time, concurrent recompiling is still blocked.
+assertUnoptimized(add_field, "no sync");
+// Let concurrent recompilation proceed.
+%UnblockConcurrentRecompilation();
+// Sync with background thread to conclude optimization that bailed out.
+assertUnoptimized(add_field, "sync");
+// Clear type info for stress runs.
+%ClearFunctionTypeFeedback(add_field);
diff --git a/test/mjsunit/compiler/concurrent-proto-change.js b/test/mjsunit/compiler/concurrent-proto-change.js
new file mode 100644
index 0000000..3abf292
--- /dev/null
+++ b/test/mjsunit/compiler/concurrent-proto-change.js
@@ -0,0 +1,58 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+// Flags: --concurrent-recompilation --block-concurrent-recompilation
+
+if (!%IsConcurrentRecompilationSupported()) {
+ print("Concurrent recompilation is disabled. Skipping this test.");
+ quit();
+}
+
+function f(foo) { return foo.bar(); }
+
+var o = {};
+o.__proto__ = { __proto__: { bar: function() { return 1; } } };
+
+assertEquals(1, f(o));
+assertEquals(1, f(o));
+
+// Mark for concurrent optimization.
+%OptimizeFunctionOnNextCall(f, "concurrent");
+// Kick off recompilation.
+assertEquals(1, f(o));
+// Change the prototype chain after compile graph has been created.
+o.__proto__.__proto__ = { bar: function() { return 2; } };
+// At this point, concurrent recompilation thread has not yet done its job.
+assertUnoptimized(f, "no sync");
+// Let the background thread proceed.
+%UnblockConcurrentRecompilation();
+// Optimization eventually bails out due to map dependency.
+assertUnoptimized(f, "sync");
+assertEquals(2, f(o));
+//Clear type info for stress runs.
+%ClearFunctionTypeFeedback(f);
diff --git a/test/mjsunit/compiler/control-flow-1.js b/test/mjsunit/compiler/control-flow-1.js
index 973d9b6..ca7ad87 100644
--- a/test/mjsunit/compiler/control-flow-1.js
+++ b/test/mjsunit/compiler/control-flow-1.js
@@ -52,4 +52,4 @@
}
assertTrue(g1(0, 0));
-assertFalse(g1(0, 1));
\ No newline at end of file
+assertFalse(g1(0, 1));
diff --git a/test/mjsunit/compiler/dead-code.js b/test/mjsunit/compiler/dead-code.js
new file mode 100644
index 0000000..8b5bd2c
--- /dev/null
+++ b/test/mjsunit/compiler/dead-code.js
@@ -0,0 +1,79 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function dead1(a, b) {
+ var x = a + b;
+ return a; // x is dead
+}
+
+function dead2(a, b) {
+ var x = a | 0;
+ var y = b | 0;
+ return a; // x and y are both dead
+}
+
+function dead3(a, b) {
+ var z;
+ if(a == 2) z = a;
+ else z = b;
+ return a; // z is dead
+}
+
+function dead4(a) {
+ var z = 3;
+ for (i = 0; i < 3; i++) {
+ z++;
+ }
+ return a; // z is dead
+}
+
+function dead5(a) {
+ var z = 3;
+ for (i = 0; i < 3; i++) {
+ z++;
+ }
+ var w = z + a;
+ return a; // z is dead
+}
+
+assertTrue(dead1(33, 32) == 33);
+assertTrue(dead2(33, 32) == 33);
+assertTrue(dead3(33, 32) == 33);
+assertTrue(dead4(33) == 33);
+assertTrue(dead5(33) == 33);
+
+assertTrue(dead1(34, 7) == 34);
+assertTrue(dead2(34, 7) == 34);
+assertTrue(dead3(34, 7) == 34);
+assertTrue(dead4(34) == 34);
+assertTrue(dead5(34) == 34);
+
+assertTrue(dead1(3.4, 0.1) == 3.4);
+assertTrue(dead2(3.4, 0.1) == 3.4);
+assertTrue(dead3(3.4, 0.1) == 3.4);
+assertTrue(dead4(3.4) == 3.4);
+assertTrue(dead5(3.4) == 3.4);
diff --git a/test/mjsunit/compiler/dead-code2.js b/test/mjsunit/compiler/dead-code2.js
new file mode 100644
index 0000000..b058020
--- /dev/null
+++ b/test/mjsunit/compiler/dead-code2.js
@@ -0,0 +1,84 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function dead1(a, b) {
+ { var x = a + b; }
+ return a; // x is dead
+}
+
+function dead2(a, b) {
+ { var x = a | 0; var y = b | 0; }
+ return a; // x and y are both dead
+}
+
+function dead3(a, b) {
+ {
+ var z;
+ if(a == 2) z = a;
+ else z = b;
+ }
+ return a; // z is dead
+}
+
+function dead4(a) {
+ {
+ var z = 3;
+ for (i = 0; i < 3; i++) {
+ z++;
+ }
+ }
+ return a; // z is dead
+}
+
+function dead5(a) {
+ {
+ var z = 3;
+ for (i = 0; i < 3; i++) {
+ z++;
+ }
+ var w = z + a;
+ }
+ return a; // z and w are dead
+}
+
+assertTrue(dead1(33, 32) == 33);
+assertTrue(dead2(33, 32) == 33);
+assertTrue(dead3(33, 32) == 33);
+assertTrue(dead4(33) == 33);
+assertTrue(dead5(33) == 33);
+
+assertTrue(dead1(34, 7) == 34);
+assertTrue(dead2(34, 7) == 34);
+assertTrue(dead3(34, 7) == 34);
+assertTrue(dead4(34) == 34);
+assertTrue(dead5(34) == 34);
+
+assertTrue(dead1(3.4, 0.1) == 3.4);
+assertTrue(dead2(3.4, 0.1) == 3.4);
+assertTrue(dead3(3.4, 0.1) == 3.4);
+assertTrue(dead4(3.4) == 3.4);
+assertTrue(dead5(3.4) == 3.4);
diff --git a/test/mjsunit/compiler/dead-code3.js b/test/mjsunit/compiler/dead-code3.js
new file mode 100644
index 0000000..d057978
--- /dev/null
+++ b/test/mjsunit/compiler/dead-code3.js
@@ -0,0 +1,78 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function dead1(a, b) {
+ a + b; // dead
+ return a;
+}
+
+function dead2(a, b) {
+ a | 0; // dead
+ b | 0; // dead
+ return a; // x and y are both dead
+}
+
+function dead3(a, b) {
+ a == 2 ? a : b; // dead
+ return a;
+}
+
+function dead4(a) {
+ var z = 3;
+ for (i = 0; i < 3; i++) {
+ z + 3; // dead
+ }
+ return a;
+}
+
+function dead5(a) {
+ var z = 3;
+ for (i = 0; i < 3; i++) {
+ z + 3; // dead
+ z++;
+ }
+ var w = z + a;
+ return a; // z is dead
+}
+
+assertTrue(dead1(33, 32) == 33);
+assertTrue(dead2(33, 32) == 33);
+assertTrue(dead3(33, 32) == 33);
+assertTrue(dead4(33) == 33);
+assertTrue(dead5(33) == 33);
+
+assertTrue(dead1(34, 7) == 34);
+assertTrue(dead2(34, 7) == 34);
+assertTrue(dead3(34, 7) == 34);
+assertTrue(dead4(34) == 34);
+assertTrue(dead5(34) == 34);
+
+assertTrue(dead1(3.4, 0.1) == 3.4);
+assertTrue(dead2(3.4, 0.1) == 3.4);
+assertTrue(dead3(3.4, 0.1) == 3.4);
+assertTrue(dead4(3.4) == 3.4);
+assertTrue(dead5(3.4) == 3.4);
diff --git a/test/mjsunit/compiler/dead-code4.js b/test/mjsunit/compiler/dead-code4.js
new file mode 100644
index 0000000..a5c20f8
--- /dev/null
+++ b/test/mjsunit/compiler/dead-code4.js
@@ -0,0 +1,78 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function dead1(a, b) {
+ (a | 0) + (b | 0); // dead
+ return a;
+}
+
+function dead2(a, b) {
+ a | 0; // dead
+ b | 0; // dead
+ return a; // x and y are both dead
+}
+
+function dead3(a, b) {
+ a == 2 ? (a | 0) : (b | 0); // dead
+ return a;
+}
+
+function dead4(a) {
+ var z = 3;
+ for (i = 0; i < 3; i++) {
+ (z | 0) + 3; // dead
+ }
+ return a;
+}
+
+function dead5(a) {
+ var z = 3;
+ for (i = 0; i < 3; i++) {
+ (z | 0) + 3; // dead
+ z++;
+ }
+ var w = z + a;
+ return a; // z is dead
+}
+
+assertTrue(dead1(33, 32) == 33);
+assertTrue(dead2(33, 32) == 33);
+assertTrue(dead3(33, 32) == 33);
+assertTrue(dead4(33) == 33);
+assertTrue(dead5(33) == 33);
+
+assertTrue(dead1(34, 7) == 34);
+assertTrue(dead2(34, 7) == 34);
+assertTrue(dead3(34, 7) == 34);
+assertTrue(dead4(34) == 34);
+assertTrue(dead5(34) == 34);
+
+assertTrue(dead1(3.4, 0.1) == 3.4);
+assertTrue(dead2(3.4, 0.1) == 3.4);
+assertTrue(dead3(3.4, 0.1) == 3.4);
+assertTrue(dead4(3.4) == 3.4);
+assertTrue(dead5(3.4) == 3.4);
diff --git a/test/mjsunit/compiler/dead-code5.js b/test/mjsunit/compiler/dead-code5.js
new file mode 100644
index 0000000..834fa24
--- /dev/null
+++ b/test/mjsunit/compiler/dead-code5.js
@@ -0,0 +1,89 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function dead1(a, b) {
+ a * b;
+ a << b;
+ a >> b;
+ a >>> b;
+ a | b;
+ a & b;
+ a ^ b;
+ return a;
+}
+
+function dead2(a, b) {
+ (a | 0) * b;
+ (a | 0) << b;
+ (a | 0) >> b;
+ (a | 0) >>> b;
+ (a | 0) | b;
+ (a | 0) & b;
+ (a | 0) ^ b;
+ return a;
+}
+
+function dead3(a, b) {
+ a == 2 ? (a * b) : (b * a); // dead
+ return a;
+}
+
+function dead4(a) {
+ var z = 3;
+ for (i = 0; i < 3; i++) {
+ z * 3; // dead
+ }
+ return a;
+}
+
+function dead5(a) {
+ var z = 3;
+ for (i = 0; i < 3; i++) {
+ z * 3; // dead
+ z++;
+ }
+ var w = z * a;
+ return a; // w is dead
+}
+
+assertTrue(dead1(33, 32) == 33);
+assertTrue(dead2(33, 32) == 33);
+assertTrue(dead3(33, 32) == 33);
+assertTrue(dead4(33) == 33);
+assertTrue(dead5(33) == 33);
+
+assertTrue(dead1(34, 7) == 34);
+assertTrue(dead2(34, 7) == 34);
+assertTrue(dead3(34, 7) == 34);
+assertTrue(dead4(34) == 34);
+assertTrue(dead5(34) == 34);
+
+assertTrue(dead1(3.4, 0.1) == 3.4);
+assertTrue(dead2(3.4, 0.1) == 3.4);
+assertTrue(dead3(3.4, 0.1) == 3.4);
+assertTrue(dead4(3.4) == 3.4);
+assertTrue(dead5(3.4) == 3.4);
diff --git a/test/mjsunit/compiler/dead-code6.js b/test/mjsunit/compiler/dead-code6.js
new file mode 100644
index 0000000..ec9b843
--- /dev/null
+++ b/test/mjsunit/compiler/dead-code6.js
@@ -0,0 +1,73 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+// Test some dead code elimination scenarios
+
+function dead1(x, y) {
+ var a = x | 0, b = y | 0;
+ a * b;
+ a << b;
+ a >> b;
+ a >>> b;
+ a | b;
+ a & b;
+ a ^ b;
+ return x;
+}
+
+function dead2(x, y) {
+ var a = x | 0, b = y | 0;
+ (a | 0) * b;
+ (a | 0) << b;
+ (a | 0) >> b;
+ (a | 0) >>> b;
+ (a | 0) | b;
+ (a | 0) & b;
+ (a | 0) ^ b;
+ return x;
+}
+
+function dead3(a, b) {
+ a == 2 ? (a * b) : (b * a); // dead
+ return a;
+}
+
+assertTrue(dead1(33, 32) == 33);
+assertTrue(dead1(33, 32) == 33);
+%OptimizeFunctionOnNextCall(dead1);
+assertTrue(dead1(33, 32) == 33);
+
+assertTrue(dead2(34, 11) == 34);
+assertTrue(dead2(34, 11) == 34);
+%OptimizeFunctionOnNextCall(dead2);
+assertTrue(dead2(34, 11) == 34);
+
+assertTrue(dead3(35, 12) == 35);
+assertTrue(dead3(35, 12) == 35);
+%OptimizeFunctionOnNextCall(dead3);
+assertTrue(dead3(35, 12) == 35);
diff --git a/test/mjsunit/compiler/dead-loops-neg.js b/test/mjsunit/compiler/dead-loops-neg.js
new file mode 100644
index 0000000..dbf500b
--- /dev/null
+++ b/test/mjsunit/compiler/dead-loops-neg.js
@@ -0,0 +1,100 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Presents negative opportunities for dead loop removal.
+
+function loop1() {
+ while (true) return;
+}
+
+function loop2() {
+ var i = 0;
+ while (i++ < 10) ;
+ return i; // value of {i} escapes.
+ // can only remove the loop with induction variable analysis.
+}
+
+function loop3() {
+ var i = 0;
+ for (; i < 10; i++) ;
+ return i; // value of {i} escapes.
+ // can only remove the loop with induction variable analysis.
+}
+
+function loop4() {
+ var a = 0;
+ for (var i = 0; i < 10; i++) a++;
+ return a; // value of {a} escapes.
+ // can only remove the loop with induction variable analysis.
+}
+
+function loop5() {
+ var a = new Int32Array(4), sum = 0;
+ for (var i = 0; i < a.length; i++) {
+ sum += a[i];
+ }
+ return sum; // {sum} escapes.
+ // can only remove the loop by figuring out that all elements of {a} are 0.
+}
+
+function loop6(a) {
+ for (var i = 0; i < a; i++) ; // implicit a.valueOf().
+ // can only remove the loop by guarding on the type of a.
+}
+
+function loop7(a) {
+ for (var i = 0; i < 10; i++) a.toString(); // unknown side-effect on a.
+ // can only remove the loop by guarding on the type of a.
+}
+
+function loop8(a) {
+ for (var i = 0; i < 10; i++) a.valueOf(); // unknown side-effect on a.
+ // can only remove the loop by guarding on the type of a.
+}
+
+var no_params_loops = [loop1, loop2, loop3, loop4, loop5, loop6];
+var params_loops = [loop6, loop7, loop8];
+
+for (var i = 0; i < no_params_loops.length; i++) {
+ var f = no_params_loops[i];
+ f();
+ f();
+ f();
+ %OptimizeFunctionOnNextCall(f);
+ f();
+}
+
+for (var i = 0; i < params_loops.length; i++) {
+ var f = params_loops[i];
+ f(3);
+ f(7);
+ f(11);
+ %OptimizeFunctionOnNextCall(f);
+ f(9);
+}
diff --git a/test/mjsunit/compiler/dead-loops.js b/test/mjsunit/compiler/dead-loops.js
new file mode 100644
index 0000000..2301b12
--- /dev/null
+++ b/test/mjsunit/compiler/dead-loops.js
@@ -0,0 +1,87 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Presents opportunities for dead loop removal.
+
+function loop1() {
+ while (false) ; // doesn't even loop.
+}
+
+function loop2() {
+ var i = 0;
+ while (i++ < 10) ; // nothing in the body.
+}
+
+function loop3() {
+ for (var i = 0; i < 10; i++) ; // nothing in the body.
+}
+
+function loop4() {
+ var a = 0;
+ for (var i = 0; i < 10; i++) a++; // {a} is dead after the loop.
+}
+
+function loop5() {
+ var a = new Int32Array(4), sum = 0;
+ for (var i = 0; i < a.length; i++) {
+ // Involves only reads on typed arrays, and {i} doesn't overflow.
+ sum += a[i];
+ }
+}
+
+function loop6() {
+ var a = new Array(4), sum = 0;
+ for (var i = 0; i < a.length; i++) {
+ // Involves only in-bounds read on the array {a}.
+ // Have to prove that {a} doesn't have getters...?
+ sum += a[i];
+ }
+}
+
+function loop7() {
+ for (var i = 0; i < 10; i++) {
+ new Object(); // Have to prove the allocation doesn't escape.
+ }
+}
+
+function loop8() {
+ for (var i = 0; i < 10; i++) {
+ var x = {}; // Have to prove the allocation doesn't escape.
+ }
+}
+
+var loops = [loop1, loop2, loop3, loop4, loop5, loop6, loop7, loop8];
+
+for (var i = 0; i < loops.length; i++) {
+ var f = loops[i];
+ f();
+ f();
+ %OptimizeFunctionOnNextCall(f);
+ f();
+}
diff --git a/test/mjsunit/compiler/dead-string-add-warm.js b/test/mjsunit/compiler/dead-string-add-warm.js
new file mode 100644
index 0000000..c211ebd
--- /dev/null
+++ b/test/mjsunit/compiler/dead-string-add-warm.js
@@ -0,0 +1,76 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function dead1(a, b) {
+ var x = "a" + "b";
+ return a; // x, "a", and "b" are dead code
+}
+
+function dead2(a, b) {
+ var x = "0" + a;
+ var y = "0" + b;
+ return a; // x and y are both dead
+}
+
+function dead3(a, b) {
+ a = a ? "1" : "0";
+ b = b ? "1" : "0";
+ var x = a + "0";
+ var y = b + "0";
+ return a; // x and y are both dead
+}
+
+function run() {
+ assertEquals(33, dead1(33, 32));
+ assertEquals(33, dead2(33, 32));
+ assertEquals("1", dead3(33, 32));
+
+ assertEquals(31, dead1(31, 30));
+ assertEquals(31, dead2(31, 30));
+ assertEquals("1", dead3(31, 32));
+
+ assertEquals(0, dead1(0, 30));
+ assertEquals(0, dead2(0, 30));
+ assertEquals("0", dead3(0, 32));
+
+ assertEquals(true, dead1(true, 0));
+ assertEquals(true, dead2(true, 0));
+ assertEquals("1", dead3(true, 0));
+
+ assertEquals("true", dead1("true", 0));
+ assertEquals("true", dead2("true", 0));
+ assertEquals("1", dead3("true", 0));
+}
+
+run();
+run();
+%OptimizeFunctionOnNextCall(dead1);
+%OptimizeFunctionOnNextCall(dead2);
+%OptimizeFunctionOnNextCall(dead3);
+run();
diff --git a/test/mjsunit/compiler/dead-string-add.js b/test/mjsunit/compiler/dead-string-add.js
new file mode 100644
index 0000000..04155ef
--- /dev/null
+++ b/test/mjsunit/compiler/dead-string-add.js
@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function dead1(a, b) {
+ var x = "a" + "b";
+ return a; // x, "a", and "b" are dead code
+}
+
+function dead2(a, b) {
+ var x = a + "0";
+ var y = b + "0";
+ return a; // x and y are both dead
+}
+
+function dead3(a, b) {
+ a = a ? "1" : "0";
+ b = b ? "1" : "0";
+ var x = a + "0";
+ var y = b + "0";
+ return a; // x and y are both dead
+}
+
+assertEquals(33, dead1(33, 32));
+assertEquals(33, dead2(33, 32));
+assertEquals("1", dead3(33, 32));
+
+assertEquals(31, dead1(31, 30));
+assertEquals(31, dead2(31, 30));
+assertEquals("1", dead3(31, 32));
+
+assertEquals(0, dead1(0, 30));
+assertEquals(0, dead2(0, 30));
+assertEquals("0", dead3(0, 32));
+
+assertEquals(true, dead1(true, 0));
+assertEquals(true, dead2(true, 0));
+assertEquals("1", dead3(true, 0));
+
+assertEquals("true", dead1("true", 0));
+assertEquals("true", dead2("true", 0));
+assertEquals("1", dead3("true", 0));
diff --git a/test/mjsunit/compiler/dead-string-char-code-at.js b/test/mjsunit/compiler/dead-string-char-code-at.js
new file mode 100644
index 0000000..9f01541
--- /dev/null
+++ b/test/mjsunit/compiler/dead-string-char-code-at.js
@@ -0,0 +1,81 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var S1 = "string1";
+var S2 = "@@string2";
+
+function dead1(a, b) {
+ var x = %_StringCharCodeAt(a, 4);
+ return a; // x is dead code
+}
+
+function dead2(a, b) {
+ var x = %_StringCharCodeAt(a, 3);
+ var y = %_StringCharCodeAt(b, 1);
+ return a; // x and y are both dead
+}
+
+function dead3(a, b) {
+ a = a ? "11" : "12";
+ b = b ? "13" : "14";
+ var x = %_StringCharCodeAt(a, 2);
+ var y = %_StringCharCodeAt(b, 0);
+ return a; // x and y are both dead
+}
+
+function test() {
+ var S3 = S1 + S2;
+
+ assertEquals(S1, dead1(S1, S2));
+ assertEquals(S1, dead2(S1, S2));
+ assertEquals("11", dead3(S1, S2));
+
+ assertEquals(S2, dead1(S2, 677));
+ assertEquals(S2, dead2(S2, S3));
+ assertEquals("11", dead3(S2, S3));
+
+ assertEquals(S3, dead1(S3, 399));
+ assertEquals(S3, dead2(S3, "false"));
+ assertEquals("12", dead3(0, 32));
+
+ assertEquals(S3, dead1(S3, 0));
+ assertEquals(S3, dead2(S3, S1));
+ assertEquals("11", dead3(S3, 0));
+
+ assertEquals("true", dead1("true", 0));
+ assertEquals("true", dead2("true", S3));
+ assertEquals("11", dead3("true", 0));
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(dead1);
+%OptimizeFunctionOnNextCall(dead2);
+%OptimizeFunctionOnNextCall(dead3);
+test();
diff --git a/test/mjsunit/compiler/dead-string-char-code-at2.js b/test/mjsunit/compiler/dead-string-char-code-at2.js
new file mode 100644
index 0000000..9f01541
--- /dev/null
+++ b/test/mjsunit/compiler/dead-string-char-code-at2.js
@@ -0,0 +1,81 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var S1 = "string1";
+var S2 = "@@string2";
+
+function dead1(a, b) {
+ var x = %_StringCharCodeAt(a, 4);
+ return a; // x is dead code
+}
+
+function dead2(a, b) {
+ var x = %_StringCharCodeAt(a, 3);
+ var y = %_StringCharCodeAt(b, 1);
+ return a; // x and y are both dead
+}
+
+function dead3(a, b) {
+ a = a ? "11" : "12";
+ b = b ? "13" : "14";
+ var x = %_StringCharCodeAt(a, 2);
+ var y = %_StringCharCodeAt(b, 0);
+ return a; // x and y are both dead
+}
+
+function test() {
+ var S3 = S1 + S2;
+
+ assertEquals(S1, dead1(S1, S2));
+ assertEquals(S1, dead2(S1, S2));
+ assertEquals("11", dead3(S1, S2));
+
+ assertEquals(S2, dead1(S2, 677));
+ assertEquals(S2, dead2(S2, S3));
+ assertEquals("11", dead3(S2, S3));
+
+ assertEquals(S3, dead1(S3, 399));
+ assertEquals(S3, dead2(S3, "false"));
+ assertEquals("12", dead3(0, 32));
+
+ assertEquals(S3, dead1(S3, 0));
+ assertEquals(S3, dead2(S3, S1));
+ assertEquals("11", dead3(S3, 0));
+
+ assertEquals("true", dead1("true", 0));
+ assertEquals("true", dead2("true", S3));
+ assertEquals("11", dead3("true", 0));
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(dead1);
+%OptimizeFunctionOnNextCall(dead2);
+%OptimizeFunctionOnNextCall(dead3);
+test();
diff --git a/test/mjsunit/compiler/dead-string-char-from-code.js b/test/mjsunit/compiler/dead-string-char-from-code.js
new file mode 100644
index 0000000..1de5d9e
--- /dev/null
+++ b/test/mjsunit/compiler/dead-string-char-from-code.js
@@ -0,0 +1,76 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function dead1(a, b) {
+ var x = %_StringCharFromCode(a);
+ return a; // x is dead code
+}
+
+function dead2(a, b) {
+ var x = %_StringCharFromCode(a);
+ var y = %_StringCharFromCode(b);
+ return a; // x and y are both dead
+}
+
+function dead3(a, b) {
+ a = a ? 11 : 12;
+ b = b ? 13 : 14;
+ var x = %_StringCharFromCode(a);
+ var y = %_StringCharFromCode(b);
+ return a; // x and y are both dead
+}
+
+function test() {
+ assertEquals(33, dead1(33, 32));
+ assertEquals(33, dead2(33, 32));
+ assertEquals(11, dead3(33, 32));
+
+ assertEquals(31, dead1(31, 30));
+ assertEquals(31, dead2(31, 30));
+ assertEquals(11, dead3(31, 32));
+
+ assertEquals(0, dead1(0, 30));
+ assertEquals(0, dead2(0, 30));
+ assertEquals(12, dead3(0, 32));
+
+ assertEquals(true, dead1(true, 0));
+ assertEquals(true, dead2(true, 0));
+ assertEquals(11, dead3(true, 0));
+
+ assertEquals("true", dead1("true", 0));
+ assertEquals("true", dead2("true", 0));
+ assertEquals(11, dead3("true", 0));
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(dead1);
+%OptimizeFunctionOnNextCall(dead2);
+%OptimizeFunctionOnNextCall(dead3);
+test();
diff --git a/test/mjsunit/compiler/division-by-constant.js b/test/mjsunit/compiler/division-by-constant.js
new file mode 100644
index 0000000..0778e95
--- /dev/null
+++ b/test/mjsunit/compiler/division-by-constant.js
@@ -0,0 +1,131 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --no-use-inlining
+
+// -----------------------------------------------------------------------------
+
+function ConstructDiv(divisor) {
+ return "return ((dividend | 0) / ((" + divisor + ") | 0)) | 0";
+}
+
+var RefDivByConstI =
+ new Function("dividend", "divisor", ConstructDiv("divisor"));
+
+%NeverOptimizeFunction(RefDivByConstI);
+
+// -----------------------------------------------------------------------------
+
+function ConstructMod(divisor) {
+ return "return ((dividend | 0) % ((" + divisor + ") | 0)) | 0";
+}
+
+var RefModByConstI =
+ new Function("dividend", "divisor", ConstructMod("divisor"));
+
+%NeverOptimizeFunction(RefModByConstI);
+
+// -----------------------------------------------------------------------------
+
+function ConstructFlooringDiv(divisor) {
+ return "return Math.floor(dividend / (" + divisor + ")) | 0";
+}
+
+var RefFlooringDivByConstI =
+ new Function("dividend", "divisor", ConstructFlooringDiv("divisor"));
+
+%NeverOptimizeFunction(RefFlooringDivByConstI);
+
+// -----------------------------------------------------------------------------
+
+function PushSymmetric(values, x) {
+ values.push(x, -x);
+}
+
+function PushRangeSymmetric(values, from, to) {
+ for (var x = from; x <= to; x++) {
+ PushSymmetric(values, x);
+ }
+}
+
+function CreateTestValues() {
+ var values = [
+ // -(2^31)
+ -2147483648,
+ // Some values from "Hacker's Delight", chapter 10-7.
+ 715827883, 1431655766, -1431655765, -1431655764,
+ // Some "randomly" chosen numbers.
+ 123, -1234, 12345, -123456, 1234567, -12345678, 123456789
+ ];
+ // Powers of 2
+ for (var shift = 6; shift < 31; shift++) {
+ PushSymmetric(values, 1 << shift);
+ }
+ // Values near zero
+ PushRangeSymmetric(values, 1, 32);
+ // Various magnitudes
+ PushRangeSymmetric(values, 100, 109);
+ PushRangeSymmetric(values, 1000, 1009);
+ PushRangeSymmetric(values, 10000, 10009);
+ PushRangeSymmetric(values, 100000, 100009);
+ PushRangeSymmetric(values, 1000000, 1000009);
+ PushRangeSymmetric(values, 10000000, 10000009);
+ PushRangeSymmetric(values, 100000000, 100000009);
+ PushRangeSymmetric(values, 1000000000, 1000000009);
+ return values;
+}
+
+// -----------------------------------------------------------------------------
+
+function TestDivisionLike(ref, construct, values, divisor) {
+ // Define the function to test.
+ var OptFun = new Function("dividend", construct(divisor));
+
+ // Warm up type feedback.
+ OptFun(7);
+ OptFun(11);
+ %OptimizeFunctionOnNextCall(OptFun);
+ OptFun(13);
+
+ // Check results.
+ values.forEach(function(dividend) {
+ // Avoid deopt caused by overflow, we do not want to test this here.
+ if (dividend === -2147483648 && divisor === -1) return;
+ assertEquals(ref(dividend, divisor), OptFun(dividend));
+ });
+}
+
+function Test(ref, construct) {
+ var values = CreateTestValues();
+ values.forEach(function(divisor) {
+ TestDivisionLike(ref, construct, values, divisor);
+ });
+}
+
+Test(RefDivByConstI, ConstructDiv);
+Test(RefModByConstI, ConstructMod);
+Test(RefFlooringDivByConstI, ConstructFlooringDiv);
diff --git a/test/mjsunit/compiler/escape-analysis-arguments.js b/test/mjsunit/compiler/escape-analysis-arguments.js
new file mode 100644
index 0000000..bdab182
--- /dev/null
+++ b/test/mjsunit/compiler/escape-analysis-arguments.js
@@ -0,0 +1,187 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --use-escape-analysis --expose-gc
+
+
+// Simple test of capture
+(function testCapturedArguments() {
+ function h() {
+ return g.arguments[0];
+ }
+
+ function g(x) {
+ return h();
+ }
+
+ function f() {
+ var l = { y : { z : 4 }, x : 2 }
+ var r = g(l);
+ assertEquals(2, r.x);
+ assertEquals(2, l.x);
+ l.x = 3;
+ l.y.z = 5;
+ // Test that the arguments object is properly
+ // aliased
+ assertEquals(3, r.x);
+ assertEquals(3, l.x);
+ assertEquals(5, r.y.z);
+ }
+
+ f(); f(); f();
+ %OptimizeFunctionOnNextCall(f);
+ f();
+})();
+
+
+// Get the arguments object twice, test aliasing
+(function testTwoCapturedArguments() {
+ function h() {
+ return g.arguments[0];
+ }
+
+ function i() {
+ return g.arguments[0];
+ }
+
+ function g(x) {
+ return {h : h() , i : i()};
+ }
+
+ function f() {
+ var l = { y : { z : 4 }, x : 2 }
+ var r = g(l);
+ assertEquals(2, r.h.x)
+ l.y.z = 3;
+ assertEquals(3, r.h.y.z);
+ assertEquals(3, r.i.y.z);
+ }
+
+ f(); f(); f();
+ %OptimizeFunctionOnNextCall(f);
+ f();
+})();
+
+
+// Nested arguments object test
+(function testTwoCapturedArgumentsNested() {
+ function i() {
+ return { gx : g.arguments[0], hx : h.arguments[0] };
+ }
+
+ function h(x) {
+ return i();
+ }
+
+ function g(x) {
+ return h(x.y);
+ }
+
+ function f() {
+ var l = { y : { z : 4 }, x : 2 }
+ var r = g(l);
+ assertEquals(2, r.gx.x)
+ assertEquals(4, r.gx.y.z)
+ assertEquals(4, r.hx.z)
+ l.y.z = 3;
+ assertEquals(3, r.gx.y.z)
+ assertEquals(3, r.hx.z)
+ assertEquals(3, l.y.z)
+ }
+
+ f(); f(); f();
+ %OptimizeFunctionOnNextCall(f);
+ f(); f();
+ %OptimizeFunctionOnNextCall(f);
+ f(); f();
+})();
+
+
+// Nested arguments object test with different inlining
+(function testTwoCapturedArgumentsNested2() {
+ function i() {
+ return { gx : g.arguments[0], hx : h.arguments[0] };
+ }
+
+ function h(x) {
+ return i();
+ }
+
+ function g(x) {
+ return h(x.y);
+ }
+
+ function f() {
+ var l = { y : { z : 4 }, x : 2 }
+ var r = g(l);
+ assertEquals(2, r.gx.x)
+ assertEquals(4, r.gx.y.z)
+ assertEquals(4, r.hx.z)
+ l.y.z = 3;
+ assertEquals(3, r.gx.y.z)
+ assertEquals(3, r.hx.z)
+ assertEquals(3, l.y.z)
+ }
+
+ %NeverOptimizeFunction(i);
+ f(); f(); f();
+ %OptimizeFunctionOnNextCall(f);
+ f(); f();
+ %OptimizeFunctionOnNextCall(f);
+ f(); f();
+})();
+
+
+// Multiple captured argument test
+(function testTwoArgumentsCapture() {
+ function h() {
+ return { a : g.arguments[1], b : g.arguments[0] };
+ }
+
+ function g(x, y) {
+ return h();
+ }
+
+ function f() {
+ var l = { y : { z : 4 }, x : 2 }
+ var k = { t : { u : 3 } };
+ var r = g(k, l);
+ assertEquals(2, r.a.x)
+ assertEquals(4, r.a.y.z)
+ assertEquals(3, r.b.t.u)
+ l.y.z = 6;
+ r.b.t.u = 7;
+ assertEquals(6, r.a.y.z)
+ assertEquals(7, k.t.u)
+ }
+
+ f(); f(); f();
+ %OptimizeFunctionOnNextCall(f);
+ f(); f();
+ %OptimizeFunctionOnNextCall(f);
+ f(); f();
+})();
diff --git a/test/mjsunit/compiler/escape-analysis-representation.js b/test/mjsunit/compiler/escape-analysis-representation.js
new file mode 100644
index 0000000..8e21a36
--- /dev/null
+++ b/test/mjsunit/compiler/escape-analysis-representation.js
@@ -0,0 +1,73 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --use-escape-analysis --max-opt-count=100
+
+// This tests that captured objects materialized through the deoptimizer
+// have field descriptors with a representation matching the values that
+// have actually been stored in the object.
+
+var values = [ function() { return {}; },
+ function() { return 23; },
+ function() { return 4.2; } ];
+
+function constructor(value_track) {
+ this.x = value_track();
+}
+
+function access(value_track, value_break, deopt) {
+ var o = new constructor(value_track);
+ o.x = value_break;
+ deopt.deopt
+ assertEquals(value_break, o.x);
+}
+
+function test(value_track, value_break) {
+ var deopt = { deopt:false };
+
+ // Warm-up field tracking to a certain representation.
+ access(value_track, value_track(), deopt);
+ access(value_track, value_track(), deopt);
+ %OptimizeFunctionOnNextCall(access);
+ access(value_track, value_track(), deopt);
+
+ // Deoptimize on a run with a different representation.
+ delete deopt.deopt;
+ access(value_track, value_break(), deopt);
+
+ // Clear type feedback of the access function for next run.
+ %ClearFunctionTypeFeedback(access);
+
+ // Also make sure the initial map of the constructor is reset.
+ constructor.prototype = {};
+}
+
+for (var i = 0; i < values.length; i++) {
+ for (var j = 0; j < values.length; j++) {
+ test(values[i], values[j])
+ }
+}
diff --git a/test/mjsunit/compiler/escape-analysis.js b/test/mjsunit/compiler/escape-analysis.js
new file mode 100644
index 0000000..b12e7bf
--- /dev/null
+++ b/test/mjsunit/compiler/escape-analysis.js
@@ -0,0 +1,438 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --use-escape-analysis --expose-gc
+
+
+// Test stores on a join path.
+(function testJoin() {
+ function constructor() {
+ this.a = 0;
+ }
+ function join(mode, expected) {
+ var object = new constructor();
+ if (mode) {
+ object.a = 1;
+ } else {
+ object.a = 2;
+ }
+ assertEquals(expected, object.a);
+ }
+ join(true, 1); join(true, 1);
+ join(false, 2); join(false, 2);
+ %OptimizeFunctionOnNextCall(join);
+ join(true, 1); join(false, 2);
+})();
+
+
+// Test loads and stores inside a loop.
+(function testLoop() {
+ function constructor() {
+ this.a = 0;
+ this.b = 23;
+ }
+ function loop() {
+ var object = new constructor();
+ for (var i = 1; i < 10; i++) {
+ object.a = object.a + i;
+ assertEquals(i*(i+1)/2, object.a);
+ assertEquals(23, object.b);
+ }
+ assertEquals(45, object.a);
+ assertEquals(23, object.b);
+ }
+ loop(); loop();
+ %OptimizeFunctionOnNextCall(loop);
+ loop(); loop();
+})();
+
+
+// Test loads and stores inside nested loop.
+(function testNested() {
+ function constructor() {
+ this.a = 0;
+ this.b = 0;
+ this.c = 23;
+ }
+ function nested() {
+ var object = new constructor();
+ for (var i = 1; i < 10; i++) {
+ object.a = object.a + i;
+ assertEquals(i*(i+1)/2, object.a);
+ assertEquals((i-1)*6, object.b);
+ assertEquals(23, object.c);
+ for (var j = 1; j < 4; j++) {
+ object.b = object.b + j;
+ assertEquals(i*(i+1)/2, object.a);
+ assertEquals((i-1)*6+j*(j+1)/2, object.b);
+ assertEquals(23, object.c);
+ }
+ assertEquals(i*(i+1)/2, object.a);
+ assertEquals(i*6, object.b);
+ assertEquals(23, object.c);
+ }
+ assertEquals(45, object.a);
+ assertEquals(54, object.b);
+ assertEquals(23, object.c);
+ }
+ nested(); nested();
+ %OptimizeFunctionOnNextCall(nested);
+ nested(); nested();
+})();
+
+
+// Test deoptimization with captured objects in local variables.
+(function testDeoptLocal() {
+ var deopt = { deopt:false };
+ function constructor1() {
+ this.a = 1.0;
+ this.b = 2.3;
+ this.c = 3.0;
+ }
+ function constructor2(o) {
+ this.d = o;
+ this.e = 4.5;
+ }
+ function func() {
+ var o1 = new constructor1();
+ var o2 = new constructor2(o1);
+ deopt.deopt;
+ assertEquals(1.0, o1.a);
+ assertEquals(2.3, o2.d.b);
+ assertEquals(3.0, o2.d.c);
+ assertEquals(4.5, o2.e);
+ }
+ func(); func();
+ %OptimizeFunctionOnNextCall(func);
+ func(); func();
+ delete deopt.deopt;
+ func(); func();
+})();
+
+
+// Test deoptimization with captured objects on operand stack.
+(function testDeoptOperand() {
+ var deopt = { deopt:false };
+ function constructor1() {
+ this.a = 1.0;
+ this.b = 2.3;
+ deopt.deopt;
+ assertEquals(1.0, this.a);
+ assertEquals(2.3, this.b);
+ this.b = 2.7;
+ this.c = 3.0;
+ this.d = 4.5;
+ }
+ function constructor2() {
+ this.e = 5.0;
+ this.f = new constructor1();
+ assertEquals(1.0, this.f.a);
+ assertEquals(2.7, this.f.b);
+ assertEquals(3.0, this.f.c);
+ assertEquals(4.5, this.f.d);
+ assertEquals(5.0, this.e);
+ this.e = 5.9;
+ this.g = 6.7;
+ }
+ function func() {
+ var o = new constructor2();
+ assertEquals(1.0, o.f.a);
+ assertEquals(2.7, o.f.b);
+ assertEquals(3.0, o.f.c);
+ assertEquals(4.5, o.f.d);
+ assertEquals(5.9, o.e);
+ assertEquals(6.7, o.g);
+ }
+ func(); func();
+ %OptimizeFunctionOnNextCall(func);
+ func(); func();
+ delete deopt.deopt;
+ func(); func();
+})();
+
+
+// Test map checks on captured objects.
+(function testMapCheck() {
+ var sum = 0;
+ function getter() { return 27; }
+ function setter(v) { sum += v; }
+ function constructor() {
+ this.x = 23;
+ this.y = 42;
+ }
+ function check(x, y) {
+ var o = new constructor();
+ assertEquals(x, o.x);
+ assertEquals(y, o.y);
+ }
+ var monkey = Object.create(null, {
+ x: { get:getter, set:setter },
+ y: { get:getter, set:setter }
+ });
+ check(23, 42); check(23, 42);
+ %OptimizeFunctionOnNextCall(check);
+ check(23, 42); check(23, 42);
+ constructor.prototype = monkey;
+ check(27, 27); check(27, 27);
+ assertEquals(130, sum);
+})();
+
+
+// Test OSR into a loop with captured objects.
+(function testOSR() {
+ function constructor() {
+ this.a = 23;
+ }
+ function osr1(length) {
+ assertEquals(23, (new constructor()).a);
+ var result = 0;
+ for (var i = 0; i < length; i++) {
+ result = (result + i) % 99;
+ }
+ return result;
+ }
+ function osr2(length) {
+ var result = 0;
+ for (var i = 0; i < length; i++) {
+ result = (result + i) % 99;
+ }
+ assertEquals(23, (new constructor()).a);
+ return result;
+ }
+ function osr3(length) {
+ var result = 0;
+ var o = new constructor();
+ for (var i = 0; i < length; i++) {
+ result = (result + i) % 99;
+ }
+ assertEquals(23, o.a);
+ return result;
+ }
+ function test(closure) {
+ assertEquals(45, closure(10));
+ assertEquals(45, closure(10));
+ assertEquals(10, closure(50000));
+ }
+ test(osr1);
+ test(osr2);
+ test(osr3);
+})();
+
+
+// Test out-of-bounds access on captured objects.
+(function testOOB() {
+ function cons1() {
+ this.x = 1;
+ this.y = 2;
+ this.z = 3;
+ }
+ function cons2() {
+ this.a = 7;
+ }
+ function oob(constructor, branch) {
+ var o = new constructor();
+ if (branch) {
+ return o.a;
+ } else {
+ return o.z;
+ }
+ }
+ assertEquals(3, oob(cons1, false));
+ assertEquals(3, oob(cons1, false));
+ assertEquals(7, oob(cons2, true));
+ assertEquals(7, oob(cons2, true));
+ gc(); // Clears type feedback of constructor call.
+ assertEquals(7, oob(cons2, true));
+ assertEquals(7, oob(cons2, true));
+ %OptimizeFunctionOnNextCall(oob);
+ assertEquals(7, oob(cons2, true));
+})();
+
+
+// Test non-shallow nested graph of captured objects.
+(function testDeep() {
+ var deopt = { deopt:false };
+ function constructor1() {
+ this.x = 23;
+ }
+ function constructor2(nested) {
+ this.a = 17;
+ this.b = nested;
+ this.c = 42;
+ }
+ function deep() {
+ var o1 = new constructor1();
+ var o2 = new constructor2(o1);
+ assertEquals(17, o2.a);
+ assertEquals(23, o2.b.x);
+ assertEquals(42, o2.c);
+ o1.x = 99;
+ deopt.deopt;
+ assertEquals(99, o1.x);
+ assertEquals(99, o2.b.x);
+ }
+ deep(); deep();
+ %OptimizeFunctionOnNextCall(deep);
+ deep(); deep();
+ delete deopt.deopt;
+ deep(); deep();
+})();
+
+
+// Test non-shallow nested graph of captured objects with duplicates
+(function testDeepDuplicate() {
+ function constructor1() {
+ this.x = 23;
+ }
+ function constructor2(nested) {
+ this.a = 17;
+ this.b = nested;
+ this.c = 42;
+ }
+ function deep(shouldDeopt) {
+ var o1 = new constructor1();
+ var o2 = new constructor2(o1);
+ var o3 = new constructor2(o1);
+ assertEquals(17, o2.a);
+ assertEquals(23, o2.b.x);
+ assertEquals(42, o2.c);
+ o3.c = 54;
+ o1.x = 99;
+ if (shouldDeopt) %DeoptimizeFunction(deep);
+ assertEquals(99, o1.x);
+ assertEquals(99, o2.b.x);
+ assertEquals(99, o3.b.x);
+ assertEquals(54, o3.c);
+ assertEquals(17, o3.a);
+ assertEquals(42, o2.c);
+ assertEquals(17, o2.a);
+ o3.b.x = 1;
+ assertEquals(1, o1.x);
+ }
+ deep(false); deep(false);
+ %OptimizeFunctionOnNextCall(deep);
+ deep(false); deep(false);
+ deep(true); deep(true);
+})();
+
+
+// Test non-shallow nested graph of captured objects with inline
+(function testDeepInline() {
+ function h() {
+ return { y : 3 };
+ }
+
+ function g(x) {
+ var u = { x : h() };
+ %DeoptimizeFunction(f);
+ return u;
+ }
+
+ function f() {
+ var l = { dummy : { } };
+ var r = g(l);
+ assertEquals(3, r.x.y);
+ }
+
+ f(); f(); f();
+ %OptimizeFunctionOnNextCall(f);
+ f();
+})();
+
+
+// Test two nested objects
+(function testTwoNestedObjects() {
+ function f() {
+ var l = { x : { y : 111 } };
+ var l2 = { x : { y : 111 } };
+ %DeoptimizeFunction(f);
+ assertEquals(111, l.x.y);
+ assertEquals(111, l2.x.y);
+ }
+
+ f(); f(); f();
+ %OptimizeFunctionOnNextCall(f);
+ f();
+})();
+
+
+// Test a nested object and a duplicate
+(function testTwoObjectsWithDuplicate() {
+ function f() {
+ var l = { x : { y : 111 } };
+ var dummy = { d : 0 };
+ var l2 = l.x;
+ %DeoptimizeFunction(f);
+ assertEquals(111, l.x.y);
+ assertEquals(111, l2.y);
+ assertEquals(0, dummy.d);
+ }
+
+ f(); f(); f();
+ %OptimizeFunctionOnNextCall(f);
+ f();
+})();
+
+
+// Test materialization of a field that requires a Smi value.
+(function testSmiField() {
+ var deopt = { deopt:false };
+ function constructor() {
+ this.x = 1;
+ }
+ function field(x) {
+ var o = new constructor();
+ o.x = x;
+ deopt.deopt
+ assertEquals(x, o.x);
+ }
+ field(1); field(2);
+ %OptimizeFunctionOnNextCall(field);
+ field(3); field(4);
+ delete deopt.deopt;
+ field(5.5); field(6.5);
+})();
+
+
+// Test materialization of a field that requires a heap object value.
+(function testHeapObjectField() {
+ var deopt = { deopt:false };
+ function constructor() {
+ this.x = {};
+ }
+ function field(x) {
+ var o = new constructor();
+ o.x = x;
+ deopt.deopt
+ assertEquals(x, o.x);
+ }
+ field({}); field({});
+ %OptimizeFunctionOnNextCall(field);
+ field({}); field({});
+ delete deopt.deopt;
+ field(1); field(2);
+})();
diff --git a/test/mjsunit/compiler/expression-trees.js b/test/mjsunit/compiler/expression-trees.js
index fac6b4c..0d971a9 100644
--- a/test/mjsunit/compiler/expression-trees.js
+++ b/test/mjsunit/compiler/expression-trees.js
@@ -55,46 +55,43 @@
}
}
-// All 429 possible bitwise OR trees with eight leaves.
-var identifiers = ['a','b','c','d','e','f','g','h'];
+// All possible bitwise OR trees with six leaves, i.e. CatalanNumber[5] = 42,
+// see http://mathworld.wolfram.com/CatalanNumber.html.
+var identifiers = ['a','b','c','d','e','f'];
var or_trees = makeTrees("|", identifiers);
var and_trees = makeTrees("&", identifiers);
-// Set up leaf masks to set 8 least-significant bits.
+// Set up leaf masks to set 6 least-significant bits.
var a = 1 << 0;
var b = 1 << 1;
var c = 1 << 2;
var d = 1 << 3;
var e = 1 << 4;
var f = 1 << 5;
-var g = 1 << 6;
-var h = 1 << 7;
for (var i = 0; i < or_trees.length; ++i) {
- for (var j = 0; j < 8; ++j) {
+ for (var j = 0; j < 6; ++j) {
var or_fun = new Function("return " + or_trees[i]);
- if (j == 0) assertEquals(255, or_fun());
+ if (j == 0) assertEquals(63, or_fun());
// Set the j'th variable to a string to force a bailout.
eval(identifiers[j] + "+= ''");
- assertEquals(255, or_fun());
+ assertEquals(63, or_fun());
// Set it back to a number for the next iteration.
eval(identifiers[j] + "= +" + identifiers[j]);
}
}
-// Set up leaf masks to clear 8 least-significant bits.
-a ^= 255;
-b ^= 255;
-c ^= 255;
-d ^= 255;
-e ^= 255;
-f ^= 255;
-g ^= 255;
-h ^= 255;
+// Set up leaf masks to clear 6 least-significant bits.
+a ^= 63;
+b ^= 63;
+c ^= 63;
+d ^= 63;
+e ^= 63;
+f ^= 63;
for (i = 0; i < and_trees.length; ++i) {
- for (var j = 0; j < 8; ++j) {
+ for (var j = 0; j < 6; ++j) {
var and_fun = new Function("return " + and_trees[i]);
if (j == 0) assertEquals(0, and_fun());
diff --git a/test/mjsunit/compiler/increment-typefeedback.js b/test/mjsunit/compiler/increment-typefeedback.js
new file mode 100644
index 0000000..7989592
--- /dev/null
+++ b/test/mjsunit/compiler/increment-typefeedback.js
@@ -0,0 +1,39 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+ x++;
+ return x;
+}
+
+f(0.5);
+f(0.5);
+%OptimizeFunctionOnNextCall(f);
+f(0.5);
+assertOptimized(f);
diff --git a/test/mjsunit/compiler/inline-accessors.js b/test/mjsunit/compiler/inline-accessors.js
new file mode 100644
index 0000000..a4cf7ae
--- /dev/null
+++ b/test/mjsunit/compiler/inline-accessors.js
@@ -0,0 +1,368 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --inline-accessors --max-opt-count=100
+
+var accessorCallCount, setterArgument, setterValue, obj, forceDeopt;
+
+// -----------------------------------------------------------------------------
+// Helpers for testing inlining of getters.
+
+function TestInlinedGetter(context, obj, expected) {
+ forceDeopt = { deopt: 0 };
+ accessorCallCount = 0;
+
+ assertEquals(expected, context(obj));
+ assertEquals(1, accessorCallCount);
+
+ assertEquals(expected, context(obj));
+ assertEquals(2, accessorCallCount);
+
+ %OptimizeFunctionOnNextCall(context);
+ assertEquals(expected, context(obj));
+ assertEquals(3, accessorCallCount);
+
+ forceDeopt = { /* empty*/ };
+ assertEquals(expected, context(obj));
+ assertEquals(4, accessorCallCount);
+}
+
+
+function value_context_for_getter(obj) {
+ return obj.getterProperty;
+}
+
+function test_context_for_getter(obj) {
+ if (obj.getterProperty) {
+ return 111;
+ } else {
+ return 222;
+ }
+}
+
+function effect_context_for_getter(obj) {
+ obj.getterProperty;
+ return 5678;
+}
+
+function TryGetter(context, getter, obj, expected, expectException) {
+ try {
+ TestInlinedGetter(context, obj, expected);
+ assertFalse(expectException);
+ } catch (exception) {
+ assertTrue(expectException);
+ assertEquals(7, exception.stack.split('\n').length);
+ }
+ %DeoptimizeFunction(context);
+ %ClearFunctionTypeFeedback(context);
+ %ClearFunctionTypeFeedback(getter);
+}
+
+function TestGetterInAllContexts(getter, obj, expected, expectException) {
+ TryGetter(value_context_for_getter, getter, obj, expected, expectException);
+ TryGetter(test_context_for_getter, getter, obj, expected ? 111 : 222,
+ expectException);
+ TryGetter(effect_context_for_getter, getter, obj, 5678, expectException);
+}
+
+// -----------------------------------------------------------------------------
+// Test getter returning something 'true'ish in all contexts.
+
+function getter1() {
+ assertSame(obj, this);
+ accessorCallCount++;
+ forceDeopt.deopt;
+ return 1234;
+}
+
+function ConstrG1() { }
+obj = Object.defineProperty(new ConstrG1(), "getterProperty", { get: getter1 });
+TestGetterInAllContexts(getter1, obj, 1234, false);
+obj = Object.create(obj);
+TestGetterInAllContexts(getter1, obj, 1234, false);
+
+// -----------------------------------------------------------------------------
+// Test getter returning false in all contexts.
+
+function getter2() {
+ assertSame(obj, this);
+ accessorCallCount++;
+ forceDeopt.deopt;
+ return false;
+}
+
+function ConstrG2() { }
+obj = Object.defineProperty(new ConstrG2(), "getterProperty", { get: getter2 });
+TestGetterInAllContexts(getter2, obj, false, false);
+obj = Object.create(obj);
+TestGetterInAllContexts(getter2, obj, false, false);
+
+// -----------------------------------------------------------------------------
+// Test getter without a return in all contexts.
+
+function getter3() {
+ assertSame(obj, this);
+ accessorCallCount++;
+ forceDeopt.deopt;
+}
+
+function ConstrG3() { }
+obj = Object.defineProperty(new ConstrG3(), "getterProperty", { get: getter3 });
+TestGetterInAllContexts(getter3, obj, undefined, false);
+obj = Object.create(obj);
+TestGetterInAllContexts(getter3, obj, undefined, false);
+
+// -----------------------------------------------------------------------------
+// Test getter with too many arguments without a return in all contexts.
+
+function getter4(a) {
+ assertSame(obj, this);
+ assertEquals(undefined, a);
+ accessorCallCount++;
+ forceDeopt.deopt;
+}
+
+function ConstrG4() { }
+obj = Object.defineProperty(new ConstrG4(), "getterProperty", { get: getter4 });
+TestGetterInAllContexts(getter4, obj, undefined, false);
+obj = Object.create(obj);
+TestGetterInAllContexts(getter4, obj, undefined, false);
+
+// -----------------------------------------------------------------------------
+// Test getter with too many arguments with a return in all contexts.
+
+function getter5(a) {
+ assertSame(obj, this);
+ assertEquals(undefined, a);
+ accessorCallCount++;
+ forceDeopt.deopt;
+ return 9876;
+}
+
+function ConstrG5() { }
+obj = Object.defineProperty(new ConstrG5(), "getterProperty", { get: getter5 });
+TestGetterInAllContexts(getter5, obj, 9876, false);
+obj = Object.create(obj);
+TestGetterInAllContexts(getter5, obj, 9876, false);
+
+// -----------------------------------------------------------------------------
+// Test getter which throws from optimized code.
+
+function getter6() {
+ assertSame(obj, this);
+ accessorCallCount++;
+ forceDeopt.deopt;
+ if (accessorCallCount == 4) { 123 in null; }
+ return 13579;
+}
+
+function ConstrG6() { }
+obj = Object.defineProperty(new ConstrG6(), "getterProperty", { get: getter6 });
+TestGetterInAllContexts(getter6, obj, 13579, true);
+obj = Object.create(obj);
+TestGetterInAllContexts(getter6, obj, 13579, true);
+
+// -----------------------------------------------------------------------------
+// Helpers for testing inlining of setters.
+
+function TestInlinedSetter(context, obj, value, expected) {
+ forceDeopt = { deopt: 0 };
+ accessorCallCount = 0;
+ setterArgument = value;
+
+ assertEquals(expected, context(obj, value));
+ assertEquals(value, setterValue);
+ assertEquals(1, accessorCallCount);
+
+ assertEquals(expected, context(obj, value));
+ assertEquals(value, setterValue);
+ assertEquals(2, accessorCallCount);
+
+ %OptimizeFunctionOnNextCall(context);
+ assertEquals(expected, context(obj, value));
+ assertEquals(value, setterValue);
+ assertEquals(3, accessorCallCount);
+
+ forceDeopt = { /* empty*/ };
+ assertEquals(expected, context(obj, value));
+ assertEquals(value, setterValue);
+ assertEquals(4, accessorCallCount);
+}
+
+function value_context_for_setter(obj, value) {
+ return obj.setterProperty = value;
+}
+
+function test_context_for_setter(obj, value) {
+ if (obj.setterProperty = value) {
+ return 333;
+ } else {
+ return 444;
+ }
+}
+
+function effect_context_for_setter(obj, value) {
+ obj.setterProperty = value;
+ return 666;
+}
+
+function TrySetter(context, setter, obj, expectException, value, expected) {
+ try {
+ TestInlinedSetter(context, obj, value, expected);
+ assertFalse(expectException);
+ } catch (exception) {
+ assertTrue(expectException);
+ assertEquals(7, exception.stack.split('\n').length);
+ }
+ %DeoptimizeFunction(context);
+ %ClearFunctionTypeFeedback(context);
+ %ClearFunctionTypeFeedback(setter);
+}
+
+function TestSetterInAllContexts(setter, obj, expectException) {
+ TrySetter(value_context_for_setter, setter, obj, expectException, 111, 111);
+ TrySetter(test_context_for_setter, setter, obj, expectException, true, 333);
+ TrySetter(test_context_for_setter, setter, obj, expectException, false, 444);
+ TrySetter(effect_context_for_setter, setter, obj, expectException, 555, 666);
+}
+
+// -----------------------------------------------------------------------------
+// Test setter without a return in all contexts.
+
+function setter1(value) {
+ assertSame(obj, this);
+ accessorCallCount++;
+ forceDeopt.deopt;
+ setterValue = value;
+}
+
+function ConstrS1() { }
+obj = Object.defineProperty(new ConstrS1(), "setterProperty", { set: setter1 });
+TestSetterInAllContexts(setter1, obj, false);
+obj = Object.create(obj);
+TestSetterInAllContexts(setter1, obj, false);
+
+// -----------------------------------------------------------------------------
+// Test setter returning something different than the RHS in all contexts.
+
+function setter2(value) {
+ assertSame(obj, this);
+ accessorCallCount++;
+ forceDeopt.deopt;
+ setterValue = value;
+ return 1000000;
+}
+
+function ConstrS2() { }
+obj = Object.defineProperty(new ConstrS2(), "setterProperty", { set: setter2 });
+TestSetterInAllContexts(setter2, obj, false);
+obj = Object.create(obj);
+TestSetterInAllContexts(setter2, obj, false);
+
+// -----------------------------------------------------------------------------
+// Test setter with too few arguments without a return in all contexts.
+
+function setter3() {
+ assertSame(obj, this);
+ accessorCallCount++;
+ forceDeopt.deopt;
+ setterValue = setterArgument;
+}
+
+function ConstrS3() { }
+obj = Object.defineProperty(new ConstrS3(), "setterProperty", { set: setter3 });
+TestSetterInAllContexts(setter3, obj, false);
+obj = Object.create(obj);
+TestSetterInAllContexts(setter3, obj, false);
+
+// -----------------------------------------------------------------------------
+// Test setter with too few arguments with a return in all contexts.
+
+function setter4() {
+ assertSame(obj, this);
+ accessorCallCount++;
+ forceDeopt.deopt;
+ setterValue = setterArgument;
+ return 2000000;
+}
+
+function ConstrS4() { }
+obj = Object.defineProperty(new ConstrS4(), "setterProperty", { set: setter4 });
+TestSetterInAllContexts(setter4, obj, false);
+obj = Object.create(obj);
+TestSetterInAllContexts(setter4, obj, false);
+
+// -----------------------------------------------------------------------------
+// Test setter with too many arguments without a return in all contexts.
+
+function setter5(value, foo) {
+ assertSame(obj, this);
+ assertEquals(undefined, foo);
+ accessorCallCount++;
+ forceDeopt.deopt;
+ setterValue = value;
+}
+
+function ConstrS5() { }
+obj = Object.defineProperty(new ConstrS5(), "setterProperty", { set: setter5 });
+TestSetterInAllContexts(setter5, obj, false);
+obj = Object.create(obj);
+TestSetterInAllContexts(setter5, obj, false);
+
+// -----------------------------------------------------------------------------
+// Test setter with too many arguments with a return in all contexts.
+
+function setter6(value, foo) {
+ assertSame(obj, this);
+ assertEquals(undefined, foo);
+ accessorCallCount++;
+ forceDeopt.deopt;
+ setterValue = value;
+ return 3000000;
+}
+
+function ConstrS6() { }
+obj = Object.defineProperty(new ConstrS6(), "setterProperty", { set: setter6 });
+TestSetterInAllContexts(setter6, obj, false);
+obj = Object.create(obj);
+TestSetterInAllContexts(setter6, obj, false);
+
+// -----------------------------------------------------------------------------
+// Test setter which throws from optimized code.
+
+function setter7(value) {
+ accessorCallCount++;
+ forceDeopt.deopt;
+ if (accessorCallCount == 4) { 123 in null; }
+ setterValue = value;
+}
+
+function ConstrS7() { }
+obj = Object.defineProperty(new ConstrS7(), "setterProperty", { set: setter7 });
+TestSetterInAllContexts(setter7, obj, true);
+obj = Object.create(obj);
+TestSetterInAllContexts(setter7, obj, true);
diff --git a/test/mjsunit/compiler/inline-arguments.js b/test/mjsunit/compiler/inline-arguments.js
index b6adf7f..d52f31b 100644
--- a/test/mjsunit/compiler/inline-arguments.js
+++ b/test/mjsunit/compiler/inline-arguments.js
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --max-opt-count=100
function A() {
}
@@ -113,3 +113,225 @@
%OptimizeFunctionOnNextCall(test_adaptation);
test_adaptation();
})();
+
+// Test arguments access from the inlined function.
+%NeverOptimizeFunction(uninlinable);
+function uninlinable(v) {
+ assertEquals(0, v);
+ return 0;
+}
+
+function toarr_inner() {
+ var a = arguments;
+ var marker = a[0];
+ uninlinable(uninlinable(0, 0), marker.x);
+
+ var r = new Array();
+ for (var i = a.length - 1; i >= 1; i--) {
+ r.push(a[i]);
+ }
+
+ return r;
+}
+
+function toarr1(marker, a, b, c) {
+ return toarr_inner(marker, a / 2, b / 2, c / 2);
+}
+
+function toarr2(marker, a, b, c) {
+ var x = 0;
+ return uninlinable(uninlinable(0, 0),
+ x = toarr_inner(marker, a / 2, b / 2, c / 2)), x;
+}
+
+function test_toarr(toarr) {
+ var marker = { x: 0 };
+ assertArrayEquals([3, 2, 1], toarr(marker, 2, 4, 6));
+ assertArrayEquals([3, 2, 1], toarr(marker, 2, 4, 6));
+ %OptimizeFunctionOnNextCall(toarr);
+ assertArrayEquals([3, 2, 1], toarr(marker, 2, 4, 6));
+ delete marker.x;
+ assertArrayEquals([3, 2, 1], toarr(marker, 2, 4, 6));
+}
+
+test_toarr(toarr1);
+test_toarr(toarr2);
+
+
+// Test that arguments access from inlined function uses correct values.
+(function () {
+ function inner(x, y) {
+ "use strict";
+ x = 10;
+ y = 20;
+ for (var i = 0; i < 1; i++) {
+ for (var j = 1; j <= arguments.length; j++) {
+ return arguments[arguments.length - j];
+ }
+ }
+ }
+
+ function outer(x, y) {
+ return inner(x, y);
+ }
+
+ %OptimizeFunctionOnNextCall(outer);
+ %OptimizeFunctionOnNextCall(inner);
+ assertEquals(2, outer(1, 2));
+})();
+
+
+(function () {
+ function inner(x, y) {
+ "use strict";
+ x = 10;
+ y = 20;
+ for (var i = 0; i < 1; i++) {
+ for (var j = 1; j <= arguments.length; j++) {
+ return arguments[arguments.length - j];
+ }
+ }
+ }
+
+ function outer(x, y) {
+ return inner(x, y);
+ }
+
+ assertEquals(2, outer(1, 2));
+ assertEquals(2, outer(1, 2));
+ assertEquals(2, outer(1, 2));
+ %OptimizeFunctionOnNextCall(outer);
+ assertEquals(2, outer(1, 2));
+})();
+
+
+// Test inlining and deoptimization of functions accessing and modifying
+// the arguments object in strict mode with mismatched arguments count.
+(function () {
+ "use strict";
+ function test(outerCount, middleCount, innerCount) {
+ var forceDeopt = { deopt:false };
+ function inner(x,y) {
+ x = 0; y = 0;
+ forceDeopt.deopt;
+ assertSame(innerCount, arguments.length);
+ for (var i = 0; i < arguments.length; i++) {
+ assertSame(30 + i, arguments[i]);
+ }
+ }
+
+ function middle(x,y) {
+ x = 0; y = 0;
+ if (innerCount == 1) inner(30);
+ if (innerCount == 2) inner(30, 31);
+ if (innerCount == 3) inner(30, 31, 32);
+ assertSame(middleCount, arguments.length);
+ for (var i = 0; i < arguments.length; i++) {
+ assertSame(20 + i, arguments[i]);
+ }
+ }
+
+ function outer(x,y) {
+ x = 0; y = 0;
+ if (middleCount == 1) middle(20);
+ if (middleCount == 2) middle(20, 21);
+ if (middleCount == 3) middle(20, 21, 22);
+ assertSame(outerCount, arguments.length);
+ for (var i = 0; i < arguments.length; i++) {
+ assertSame(10 + i, arguments[i]);
+ }
+ }
+
+ for (var step = 0; step < 4; step++) {
+ if (outerCount == 1) outer(10);
+ if (outerCount == 2) outer(10, 11);
+ if (outerCount == 3) outer(10, 11, 12);
+ if (step == 1) %OptimizeFunctionOnNextCall(outer);
+ if (step == 2) delete forceDeopt.deopt;
+ }
+
+ %DeoptimizeFunction(outer);
+ %DeoptimizeFunction(middle);
+ %DeoptimizeFunction(inner);
+ %ClearFunctionTypeFeedback(outer);
+ %ClearFunctionTypeFeedback(middle);
+ %ClearFunctionTypeFeedback(inner);
+ }
+
+ for (var a = 1; a <= 3; a++) {
+ for (var b = 1; b <= 3; b++) {
+ for (var c = 1; c <= 3; c++) {
+ test(a,b,c);
+ }
+ }
+ }
+})();
+
+
+// Test materialization of arguments object with values in registers.
+(function () {
+ "use strict";
+ var forceDeopt = { deopt:false };
+ function inner(a,b,c,d,e,f,g,h,i,j) {
+ var args = arguments;
+ forceDeopt.deopt;
+ assertSame(10, args.length);
+ assertSame(a, args[0]);
+ assertSame(b, args[1]);
+ assertSame(c, args[2]);
+ assertSame(d, args[3]);
+ assertSame(e, args[4]);
+ assertSame(f, args[5]);
+ assertSame(g, args[6]);
+ assertSame(h, args[7]);
+ assertSame(i, args[8]);
+ assertSame(j, args[9]);
+ }
+
+ var a = 0.5;
+ var b = 1.7;
+ var c = 123;
+ function outer() {
+ inner(
+ a - 0.3, // double in double register
+ b + 2.3, // integer in double register
+ c + 321, // integer in general register
+ c - 456, // integer in stack slot
+ a + 0.1, a + 0.2, a + 0.3, a + 0.4, a + 0.5,
+ a + 0.6 // double in stack slot
+ );
+ }
+
+ outer();
+ outer();
+ %OptimizeFunctionOnNextCall(outer);
+ outer();
+ delete forceDeopt.deopt;
+ outer();
+})();
+
+
+// Test inlining of functions with %_Arguments and %_ArgumentsLength intrinsic.
+(function () {
+ function inner(len,a,b,c) {
+ assertSame(len, %_ArgumentsLength());
+ for (var i = 1; i < len; ++i) {
+ var c = String.fromCharCode(96 + i);
+ assertSame(c, %_Arguments(i));
+ }
+ }
+
+ function outer() {
+ inner(1);
+ inner(2, 'a');
+ inner(3, 'a', 'b');
+ inner(4, 'a', 'b', 'c');
+ inner(5, 'a', 'b', 'c', 'd');
+ inner(6, 'a', 'b', 'c', 'd', 'e');
+ }
+
+ outer();
+ outer();
+ %OptimizeFunctionOnNextCall(outer);
+ outer();
+})();
diff --git a/test/mjsunit/compiler/inline-closures.js b/test/mjsunit/compiler/inline-closures.js
new file mode 100644
index 0000000..69161e5
--- /dev/null
+++ b/test/mjsunit/compiler/inline-closures.js
@@ -0,0 +1,49 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test inlining of multiple closures derived from one shared function.
+
+function mkClosure(continuation) {
+ return function(value) {
+ if (continuation == 'g') return this.g(value);
+ if (continuation == 'h') return this.h(value);
+ return value.value;
+ }
+}
+
+var object = {};
+object.f = mkClosure('g');
+object.g = mkClosure('h');
+object.h = mkClosure('x');
+
+assertSame(1, object.f({value:1}));
+assertSame(2, object.f({value:2}));
+%OptimizeFunctionOnNextCall(object.f);
+assertSame(3, object.f({value:3}));
+assertSame(undefined, object.f({}));
diff --git a/test/mjsunit/compiler/inline-construct.js b/test/mjsunit/compiler/inline-construct.js
index af9e69c..fa784cf 100644
--- a/test/mjsunit/compiler/inline-construct.js
+++ b/test/mjsunit/compiler/inline-construct.js
@@ -25,65 +25,76 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax --expose-gc --inline-construct
+// Flags: --allow-natives-syntax --inline-construct
// Test inlining of constructor calls.
-function TestInlinedConstructor(closure) {
+function TestInlinedConstructor(constructor, closure) {
var result;
var counter = { value:0 };
- result = closure(11, 12, counter);
- assertEquals(23, result);
+ var noDeopt = { deopt:0 };
+ var forceDeopt = { /*empty*/ };
+
+ result = closure(constructor, 11, noDeopt, counter);
+ assertEquals(11, result);
assertEquals(1, counter.value);
- result = closure(23, 19, counter);
- assertEquals(42, result);
+
+ result = closure(constructor, 23, noDeopt, counter);
+ assertEquals(23, result);
assertEquals(2, counter.value);
+
%OptimizeFunctionOnNextCall(closure);
- result = closure(1, 42, counter)
- assertEquals(43, result);
+ result = closure(constructor, 42, noDeopt, counter);
+ assertEquals(42, result);
assertEquals(3, counter.value);
- result = closure("foo", "bar", counter)
- assertEquals("foobar", result)
+
+ result = closure(constructor, 127, forceDeopt, counter);
+ assertEquals(127, result)
assertEquals(4, counter.value);
+
+ %DeoptimizeFunction(closure);
+ %ClearFunctionTypeFeedback(closure);
+ %ClearFunctionTypeFeedback(constructor);
+}
+
+function value_context(constructor, val, deopt, counter) {
+ var obj = new constructor(val, deopt, counter);
+ return obj.x;
+}
+
+function test_context(constructor, val, deopt, counter) {
+ if (!new constructor(val, deopt, counter)) {
+ assertUnreachable("should not happen");
+ }
+ return val;
+}
+
+function effect_context(constructor, val, deopt, counter) {
+ new constructor(val, deopt, counter);
+ return val;
}
function TestInAllContexts(constructor) {
- function value_context(a, b, counter) {
- var obj = new constructor(a, b, counter);
- return obj.x;
- }
- function test_context(a, b, counter) {
- if (!new constructor(a, b, counter)) {
- assertUnreachable("should not happen");
- }
- return a + b;
- }
- function effect_context(a, b, counter) {
- new constructor(a, b, counter);
- return a + b;
- }
- TestInlinedConstructor(value_context);
- TestInlinedConstructor(test_context);
- TestInlinedConstructor(effect_context);
- %DeoptimizeFunction(value_context);
- %DeoptimizeFunction(test_context);
- %DeoptimizeFunction(effect_context);
- gc(); // Makes V8 forget about type information for *_context.
+ TestInlinedConstructor(constructor, value_context);
+ TestInlinedConstructor(constructor, test_context);
+ TestInlinedConstructor(constructor, effect_context);
}
// Test constructor returning nothing in all contexts.
-function c1(a, b, counter) {
- this.x = a + b;
+function c1(val, deopt, counter) {
+ deopt.deopt;
+ this.x = val;
counter.value++;
}
TestInAllContexts(c1);
// Test constructor returning an object in all contexts.
-function c2(a, b, counter) {
- var obj = new Object();
- obj.x = a + b;
+function c2(val, deopt, counter) {
+ var obj = {};
+ deopt.deopt;
+ obj.x = val;
counter.value++;
return obj;
}
@@ -91,8 +102,9 @@
// Test constructor returning a primitive value in all contexts.
-function c3(a, b, counter) {
- this.x = a + b;
+function c3(val, deopt, counter) {
+ deopt.deopt;
+ this.x = val;
counter.value++;
return "not an object";
}
@@ -131,9 +143,10 @@
// Test constructor that cannot be inlined.
-function c_unsupported_syntax(a, b, counter) {
+function c_unsupported_syntax(val, deopt, counter) {
try {
- this.x = a + b;
+ deopt.deopt;
+ this.x = val;
counter.value++;
} catch(e) {
throw new Error();
@@ -144,9 +157,10 @@
// Regression test: Inlined constructors called as functions do not get their
// implicit receiver object set to undefined, even in strict mode.
-function c_strict(a, b, counter) {
+function c_strict(val, deopt, counter) {
"use strict";
- this.x = a + b;
+ deopt.deopt;
+ this.x = val;
counter.value++;
}
TestInAllContexts(c_strict);
diff --git a/test/mjsunit/compiler/inline-function-apply.js b/test/mjsunit/compiler/inline-function-apply.js
new file mode 100644
index 0000000..6b761f4
--- /dev/null
+++ b/test/mjsunit/compiler/inline-function-apply.js
@@ -0,0 +1,89 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test inlining and deoptimization of function.apply(this, arguments)
+// calls for which the exact number of arguments is known.
+(function () {
+ "use strict";
+ function test(argumentsCount) {
+ var dispatcher = {};
+ var deoptimize = { deopt:false };
+ dispatcher["const" + argumentsCount] = 0;
+ dispatcher.func = C;
+
+ function A(x,y) {
+ var r = "A";
+ if (argumentsCount == 1) r += B(10);
+ if (argumentsCount == 2) r += B(10, 11);
+ if (argumentsCount == 3) r += B(10, 11, 12);
+ assertSame(1, x);
+ assertSame(2, y);
+ return r;
+ }
+
+ function B(x,y) {
+ x = 0; y = 0;
+ var r = "B" + dispatcher.func.apply(this, arguments);
+ assertSame(argumentsCount, arguments.length);
+ for (var i = 0; i < arguments.length; i++) {
+ assertSame(10 + i, arguments[i]);
+ }
+ return r;
+ }
+
+ function C(x,y) {
+ x = 0; y = 0;
+ var r = "C"
+ deoptimize.deopt;
+ assertSame(argumentsCount, arguments.length);
+ for (var i = 0; i < arguments.length; i++) {
+ assertSame(10 + i, arguments[i]);
+ }
+ return r;
+ }
+
+ assertEquals("ABC", A(1,2));
+ assertEquals("ABC", A(1,2));
+ %OptimizeFunctionOnNextCall(A);
+ assertEquals("ABC", A(1,2));
+ delete deoptimize.deopt;
+ assertEquals("ABC", A(1,2));
+
+ %DeoptimizeFunction(A);
+ %ClearFunctionTypeFeedback(A);
+ %DeoptimizeFunction(B);
+ %ClearFunctionTypeFeedback(B);
+ %DeoptimizeFunction(C);
+ %ClearFunctionTypeFeedback(C);
+ }
+
+ for (var a = 1; a <= 3; a++) {
+ test(a);
+ }
+})();
diff --git a/test/mjsunit/compiler/inline-literals.js b/test/mjsunit/compiler/inline-literals.js
index f78abe8..4487996 100644
--- a/test/mjsunit/compiler/inline-literals.js
+++ b/test/mjsunit/compiler/inline-literals.js
@@ -29,6 +29,26 @@
// Test that we can inline functions containing materialized literals.
+function a2(b, c) {
+ return [b, c, b + c];
+}
+
+function a1(a, b, c) {
+ return [a, a2(b, c)];
+}
+
+function TestArrayLiteral(a, b, c) {
+ var expected = [a, [b, c, b + c]];
+ var result = a1(a, b, c);
+ assertEquals(expected, result, "TestArrayLiteral");
+}
+
+TestArrayLiteral(1, 2, 3);
+TestArrayLiteral(1, 2, 3);
+%OptimizeFunctionOnNextCall(TestArrayLiteral);
+TestArrayLiteral(1, 2, 3);
+TestArrayLiteral('a', 'b', 'c');
+
function o2(b, c) {
return { 'b':b, 'c':c, 'y':b + c };
}
@@ -48,3 +68,43 @@
%OptimizeFunctionOnNextCall(TestObjectLiteral);
TestObjectLiteral(1, 2, 3);
TestObjectLiteral('a', 'b', 'c');
+
+function r2(s, x, y) {
+ return s.replace(/a/, x + y);
+}
+
+function r1(s, x, y) {
+ return r2(s, x, y).replace(/b/, y + x);
+}
+
+function TestRegExpLiteral(s, x, y, expected) {
+ var result = r1(s, x, y);
+ assertEquals(expected, result, "TestRegExpLiteral");
+}
+
+TestRegExpLiteral("a-", "reg", "exp", "regexp-");
+TestRegExpLiteral("-b", "reg", "exp", "-expreg");
+%OptimizeFunctionOnNextCall(TestRegExpLiteral);
+TestRegExpLiteral("ab", "reg", "exp", "regexpexpreg");
+TestRegExpLiteral("ab", 12345, 54321, "6666666666");
+
+function f2(b, c) {
+ var closure = function(b, c) { return b + c; }
+ var value = b + c;
+ return closure;
+}
+
+function f1(a, b, c) {
+ return a + f2(b, c)(b, c);
+}
+
+function TestFunctionLiteral(a, b, c, expected) {
+ var result = f1(a, b, c);
+ assertEquals(expected, result, "TestFunctionLiteral");
+}
+
+TestFunctionLiteral(1, 2, 3, 6);
+TestFunctionLiteral(4, 5, 6, 15);
+%OptimizeFunctionOnNextCall(TestFunctionLiteral);
+TestFunctionLiteral(7, 8, 9, 24);
+TestFunctionLiteral("a", "b", "c", "abc");
diff --git a/test/mjsunit/compiler/inline-throw.js b/test/mjsunit/compiler/inline-throw.js
index e3aab39..099b9d3 100644
--- a/test/mjsunit/compiler/inline-throw.js
+++ b/test/mjsunit/compiler/inline-throw.js
@@ -66,4 +66,3 @@
} catch(e) {
assertEquals("wow", e);
}
-
diff --git a/test/mjsunit/compiler/lazy-const-lookup.js b/test/mjsunit/compiler/lazy-const-lookup.js
index b4f15a1..ff4558e 100644
--- a/test/mjsunit/compiler/lazy-const-lookup.js
+++ b/test/mjsunit/compiler/lazy-const-lookup.js
@@ -38,4 +38,3 @@
}
outer();
-
diff --git a/test/mjsunit/compiler/literals.js b/test/mjsunit/compiler/literals.js
index e910bb3..8607cd9 100644
--- a/test/mjsunit/compiler/literals.js
+++ b/test/mjsunit/compiler/literals.js
@@ -36,38 +36,38 @@
// Characters just outside the ranges of hex-escapes.
// "/" comes just before "0".
-assertEquals("x1/", "\x1/");
-assertEquals("u111/", "\u111/");
+assertThrows('"\\x1/"');
+assertThrows('"\\u111/"');
assertEquals("\\x1/", RegExp("\\x1/").source);
assertEquals("\\u111/", RegExp("\\u111/").source);
// ":" comes just after "9".
-assertEquals("x1:", "\x1:");
-assertEquals("u111:", "\u111:");
+assertThrows('"\\x1:"');
+assertThrows('"\\u111:"');
assertEquals("\\x1:", /\x1:/.source);
assertEquals("\\u111:", /\u111:/.source);
// "`" comes just before "a".
-assertEquals("x1`", "\x1`");
-assertEquals("u111`", "\u111`");
+assertThrows('"\\x1`"');
+assertThrows('"\\u111`"');
assertEquals("\\x1`", /\x1`/.source);
assertEquals("\\u111`", /\u111`/.source);
// "g" comes just before "f".
-assertEquals("x1g", "\x1g");
-assertEquals("u111g", "\u111g");
+assertThrows('"\\x1g"');
+assertThrows('"\\u111g"');
assertEquals("\\x1g", /\x1g/.source);
assertEquals("\\u111g", /\u111g/.source);
// "@" comes just before "A".
-assertEquals("x1@", "\x1@");
-assertEquals("u111@", "\u111@");
+assertThrows('"\\x1@"');
+assertThrows('"\\u111@"');
assertEquals("\\x1@", /\x1@/.source);
assertEquals("\\u111@", /\u111@/.source);
// "G" comes just after "F".
-assertEquals("x1G", "\x1G");
-assertEquals("u111G", "\u111G");
+assertThrows('"\\x1G"');
+assertThrows('"\\u111G"');
assertEquals("\\x1G", /\x1G/.source);
assertEquals("\\u111G", /\u111G/.source);
diff --git a/test/mjsunit/compiler/load-elimination-global.js b/test/mjsunit/compiler/load-elimination-global.js
new file mode 100644
index 0000000..9caaa9f
--- /dev/null
+++ b/test/mjsunit/compiler/load-elimination-global.js
@@ -0,0 +1,196 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --load-elimination
+
+// Test global load elimination of redundant loads and stores.
+
+var X = true; // For forcing branches.
+X = false;
+X = true;
+X = false;
+
+function B(x, y) {
+ this.x = x;
+ this.y = y;
+ return this;
+}
+
+function test_load() {
+ var a = new B(1, 2);
+ var f = a.x + a.x;
+ if (false) ;
+ return f + a.x + a.x;
+}
+
+function test_load2() {
+ var a = new B(1, 2);
+ var f = a.x + a.x;
+ if (true) ;
+ return f + a.x + a.x;
+}
+
+function test_store_load() {
+ var a = new B(1, 2);
+ a.x = 4;
+ var b = X ? a.x : a.x;
+ return b + a.x;
+}
+
+function test_store_load2() {
+ var a = new B(1, 2);
+ var c = 6;
+ if (X) a.x = c;
+ else a.x = c;
+ return a.x + a.x;
+}
+
+function test_nonaliasing_store1() {
+ var a = new B(2, 3), b = new B(3, 4);
+ if (X) ;
+ b.x = 4;
+ if (X) ;
+ var f = a.x;
+ if (X) ;
+ b.x = 5;
+ if (X) ;
+ var g = a.x;
+ if (X) ;
+ b.x = 6;
+ if (X) ;
+ var h = a.x;
+ if (X) ;
+ b.x = 7;
+ if (X) ;
+ return f + g + h + a.x;
+}
+
+function test_loop(x) {
+ var a = new B(2, 3);
+ var v = a.x;
+ var total = v;
+ var i = 0;
+ while (i++ < 10) {
+ total = a.x;
+ a.y = 4;
+ }
+ return total;
+}
+
+function test_loop2(x) {
+ var a = new B(2, 3);
+ var v = a.x;
+ var total = v;
+ var i = 0;
+ while (i++ < 10) {
+ total = a.x; // a.x not affected by loop
+ a.y = 4;
+
+ var j = 0;
+ while (j++ < 10) {
+ total = a.x; // a.x not affected by loop
+ a.y = 5;
+ }
+
+ total = a.x;
+ a.y = 6;
+
+ j = 0;
+ while (j++ < 10) {
+ total = a.x; // a.x not affected by loop
+ a.y = 7;
+ }
+ }
+ return total;
+}
+
+function killall() {
+ try { } catch(e) { }
+}
+
+%NeverOptimizeFunction(killall);
+
+function test_store_load_kill() {
+ var a = new B(1, 2);
+ if (X) ;
+ a.x = 4;
+ if (X) ;
+ var f = a.x;
+ if (X) ;
+ a.x = 5;
+ if (X) ;
+ var g = a.x;
+ if (X) ;
+ killall();
+ if (X) ;
+ a.x = 6;
+ if (X) ;
+ var h = a.x;
+ if (X) ;
+ a.x = 7;
+ if (X) ;
+ return f + g + h + a.x;
+}
+
+function test_store_store() {
+ var a = new B(6, 7);
+ if (X) ;
+ a.x = 7;
+ if (X) ;
+ a.x = 7;
+ if (X) ;
+ a.x = 7;
+ if (X) ;
+ a.x = 7;
+ if (X) ;
+ return a.x;
+}
+
+function test(x, f) {
+ X = true;
+ assertEquals(x, f());
+ assertEquals(x, f());
+ X = false;
+ assertEquals(x, f());
+ assertEquals(x, f());
+ X = true;
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(x, f());
+ assertEquals(x, f());
+ X = false;
+ assertEquals(x, f());
+ assertEquals(x, f());
+}
+
+test(4, test_load);
+test(8, test_store_load);
+test(12, test_store_load2);
+test(8, test_nonaliasing_store1);
+test(22, test_store_load_kill);
+test(7, test_store_store);
+test(2, test_loop);
+test(2, test_loop2);
diff --git a/test/mjsunit/compiler/load-elimination-osr.js b/test/mjsunit/compiler/load-elimination-osr.js
new file mode 100644
index 0000000..a57fe17
--- /dev/null
+++ b/test/mjsunit/compiler/load-elimination-osr.js
@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --load-elimination
+
+// Test global load elimination in the presence of OSR compilation.
+
+function It(x, y) { }
+
+function foo_osr(x, limit) {
+ var o = new It();
+ o.x = x;
+ o.y = x;
+ for (var i = 0; i < limit; i++) {
+ o.y += o.x; // Load of x cannot be hoisted due to OSR.
+ }
+
+ return o.y;
+}
+
+assertEquals(22, foo_osr(11, 1));
+assertEquals(24, foo_osr(12, 1));
+assertEquals(1300013, foo_osr(13, 100000));
+
+
+function foo_hot(x, limit) {
+ var o = new It();
+ o.x = x;
+ o.y = x;
+ for (var i = 0; i < limit; i++) {
+ o.y += o.x; // Load of x can be hoisted without OSR.
+ }
+
+ return o.y;
+}
+
+assertEquals(22, foo_hot(11, 1));
+assertEquals(24, foo_hot(12, 1));
+%OptimizeFunctionOnNextCall(foo_hot);
+assertEquals(32, foo_hot(16, 1));
+assertEquals(1300013, foo_hot(13, 100000));
diff --git a/test/mjsunit/compiler/load-elimination-params.js b/test/mjsunit/compiler/load-elimination-params.js
new file mode 100644
index 0000000..13a4a85
--- /dev/null
+++ b/test/mjsunit/compiler/load-elimination-params.js
@@ -0,0 +1,71 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --load-elimination
+
+// Test local load elimination of redundant loads and stores.
+
+function B(x, y) {
+ this.x = x;
+ this.y = y;
+ return this;
+}
+
+function test_params1(a, b) {
+ var i = a.x;
+ var j = a.x;
+ var k = b.x;
+ var l = b.x;
+ return i + j + k + l;
+}
+
+assertEquals(14, test_params1(new B(3, 4), new B(4, 5)));
+assertEquals(110, test_params1(new B(11, 7), new B(44, 8)));
+
+%OptimizeFunctionOnNextCall(test_params1);
+
+assertEquals(6, test_params1(new B(1, 7), new B(2, 8)));
+
+function test_params2(a, b) {
+ var o = new B(a + 1, b);
+ o.x = a;
+ var i = o.x;
+ o.x = a;
+ var j = o.x;
+ o.x = b;
+ var k = o.x;
+ o.x = b;
+ var l = o.x;
+ return i + j + k + l;
+}
+
+assertEquals(14, test_params2(3, 4));
+assertEquals(110, test_params2(11, 44));
+
+%OptimizeFunctionOnNextCall(test_params2);
+
+assertEquals(6, test_params2(1, 2));
diff --git a/test/mjsunit/compiler/load-elimination.js b/test/mjsunit/compiler/load-elimination.js
new file mode 100644
index 0000000..9bf8564
--- /dev/null
+++ b/test/mjsunit/compiler/load-elimination.js
@@ -0,0 +1,158 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --load-elimination
+
+// Test local load elimination of redundant loads and stores.
+
+function B(x, y) {
+ this.x = x;
+ this.y = y;
+ return this;
+}
+
+function C() {
+}
+
+function test_load() {
+ var a = new B(1, 2);
+ return a.x + a.x + a.x + a.x;
+}
+
+
+function test_load_from_different_contexts() {
+ var r = 1;
+ this.f = function() {
+ var fr = r;
+ this.g = function(flag) {
+ var gr;
+ if (flag) {
+ gr = r;
+ } else {
+ gr = r;
+ }
+ return gr + r + fr;
+ };
+ };
+ this.f();
+ return this.g(true);
+}
+
+
+function test_store_load() {
+ var a = new B(1, 2);
+ a.x = 4;
+ var f = a.x;
+ a.x = 5;
+ var g = a.x;
+ a.x = 6;
+ var h = a.x;
+ a.x = 7;
+ return f + g + h + a.x;
+}
+
+function test_nonaliasing_store1() {
+ var a = new B(2, 3), b = new B(3, 4);
+ b.x = 4;
+ var f = a.x;
+ b.x = 5;
+ var g = a.x;
+ b.x = 6;
+ var h = a.x;
+ b.x = 7;
+ return f + g + h + a.x;
+}
+
+function test_transitioning_store1() {
+ var a = new B(2, 3);
+ var f = a.x, g = a.y;
+ var b = new B(3, 4);
+ return a.x + a.y;
+}
+
+function test_transitioning_store2() {
+ var b = new C();
+ var a = new B(-1, 5);
+ var f = a.x, g = a.y;
+ b.x = 9;
+ b.y = 11;
+ return a.x + a.y;
+}
+
+var false_v = false;
+function test_transitioning_store3() {
+ var o = new C();
+ var v = o;
+ if (false_v) v = 0;
+ v.x = 20;
+ return o.x;
+}
+
+function killall() {
+ try { } catch(e) { }
+}
+
+%NeverOptimizeFunction(killall);
+
+function test_store_load_kill() {
+ var a = new B(1, 2);
+ a.x = 4;
+ var f = a.x;
+ a.x = 5;
+ var g = a.x;
+ killall();
+ a.x = 6;
+ var h = a.x;
+ a.x = 7;
+ return f + g + h + a.x;
+}
+
+function test_store_store() {
+ var a = new B(6, 7);
+ a.x = 7;
+ a.x = 7;
+ a.x = 7;
+ a.x = 7;
+ return a.x;
+}
+
+function test(x, f) {
+ assertEquals(x, f());
+ assertEquals(x, f());
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(x, f());
+}
+
+test(4, test_load);
+test(3, new test_load_from_different_contexts().g);
+test(22, test_store_load);
+test(8, test_nonaliasing_store1);
+test(5, test_transitioning_store1);
+test(4, test_transitioning_store2);
+test(20, test_transitioning_store3);
+test(22, test_store_load_kill);
+test(7, test_store_store);
diff --git a/test/mjsunit/compiler/manual-concurrent-recompile.js b/test/mjsunit/compiler/manual-concurrent-recompile.js
new file mode 100644
index 0000000..b2b6398
--- /dev/null
+++ b/test/mjsunit/compiler/manual-concurrent-recompile.js
@@ -0,0 +1,67 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+// Flags: --concurrent-recompilation --block-concurrent-recompilation
+
+if (!%IsConcurrentRecompilationSupported()) {
+ print("Concurrent recompilation is disabled. Skipping this test.");
+ quit();
+}
+
+function f(x) {
+ var xx = x * x;
+ var xxstr = xx.toString();
+ return xxstr.length;
+}
+
+function g(x) {
+ var xxx = Math.sqrt(x) | 0;
+ var xxxstr = xxx.toString();
+ return xxxstr.length;
+}
+
+function k(x) {
+ return x * x;
+}
+
+f(g(1));
+assertUnoptimized(f);
+assertUnoptimized(g);
+
+%OptimizeFunctionOnNextCall(f, "concurrent");
+%OptimizeFunctionOnNextCall(g, "concurrent");
+f(g(2)); // Kick off recompilation.
+
+assertUnoptimized(f, "no sync"); // Not yet optimized since recompilation
+assertUnoptimized(g, "no sync"); // is still blocked.
+
+// Let concurrent recompilation proceed.
+%UnblockConcurrentRecompilation();
+
+assertOptimized(f, "sync"); // Optimized once we sync with the
+assertOptimized(g, "sync"); // background thread.
diff --git a/test/mjsunit/compiler/math-floor-global.js b/test/mjsunit/compiler/math-floor-global.js
index 9ec183f..9ee649c 100644
--- a/test/mjsunit/compiler/math-floor-global.js
+++ b/test/mjsunit/compiler/math-floor-global.js
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --max-new-space-size=256 --allow-natives-syntax
+// Flags: --max-semi-space-size=1 --allow-natives-syntax
// Test inlining of Math.floor when assigned to a global.
var flo = Math.floor;
@@ -140,8 +140,9 @@
// Test in a loop to cover the custom IC and GC-related issues.
-for (var i = 0; i < 50; i++) {
+for (var i = 0; i < 10; i++) {
test();
+ new Array(i * 10000);
}
@@ -158,4 +159,4 @@
%OptimizeFunctionOnNextCall(floorsum);
// The optimized function will deopt. Run it with enough iterations to try
// to optimize via OSR (triggering the bug).
-assertEquals(-0, floorsum(100000, -0));
+assertEquals(-0, floorsum(50000, -0));
diff --git a/test/mjsunit/compiler/math-floor-local.js b/test/mjsunit/compiler/math-floor-local.js
index e44b15c..5ebe90b 100644
--- a/test/mjsunit/compiler/math-floor-local.js
+++ b/test/mjsunit/compiler/math-floor-local.js
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --max-new-space-size=256 --allow-natives-syntax
+// Flags: --max-semi-space-size=1 --allow-natives-syntax
// Test inlining of Math.floor when assigned to a local.
var test_id = 0;
@@ -140,8 +140,9 @@
// Test in a loop to cover the custom IC and GC-related issues.
-for (var i = 0; i < 50; i++) {
+for (var i = 0; i < 10; i++) {
test();
+ new Array(i * 10000);
}
diff --git a/test/mjsunit/compiler/minus-zero.js b/test/mjsunit/compiler/minus-zero.js
new file mode 100644
index 0000000..c161257
--- /dev/null
+++ b/test/mjsunit/compiler/minus-zero.js
@@ -0,0 +1,93 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --no-fold-constants
+
+function add(x, y) {
+ return x + y;
+}
+
+assertEquals(0, add(0, 0));
+assertEquals(0, add(0, 0));
+%OptimizeFunctionOnNextCall(add);
+assertEquals(-0, add(-0, -0));
+
+
+function test(x, y) {
+ assertTrue(%_IsMinusZero(-0));
+ assertTrue(%_IsMinusZero(1/(-Infinity)));
+ assertTrue(%_IsMinusZero(x));
+
+ assertFalse(%_IsMinusZero(0));
+ assertFalse(%_IsMinusZero(1/Infinity));
+ assertFalse(%_IsMinusZero(0.1));
+ assertFalse(%_IsMinusZero(-0.2));
+ assertFalse(%_IsMinusZero({}));
+ assertFalse(%_IsMinusZero(""));
+ assertFalse(%_IsMinusZero("-0"));
+ assertFalse(%_IsMinusZero(function() {}));
+ assertFalse(%_IsMinusZero(y));
+}
+
+test(-0, 1.2);
+test(-0, 1.2);
+%OptimizeFunctionOnNextCall(test);
+test(-0, 1.2);
+assertOptimized(test);
+
+
+function testsin() {
+ assertTrue(%_IsMinusZero(Math.sin(-0)));
+}
+
+testsin();
+testsin();
+%OptimizeFunctionOnNextCall(testsin);
+testsin();
+
+
+function testfloor() {
+ assertTrue(%_IsMinusZero(Math.floor(-0)));
+ assertFalse(%_IsMinusZero(Math.floor(2)));
+}
+
+testfloor();
+testfloor();
+%OptimizeFunctionOnNextCall(testfloor);
+testfloor();
+
+
+var double_one = Math.cos(0);
+
+function add(a, b) {
+ return a + b;
+}
+
+assertEquals(1, 1/add(double_one, 0));
+assertEquals(1, 1/add(0, double_one));
+%OptimizeFunctionOnNextCall(add);
+assertEquals(1/(-0 + -0), 1/add(-0, -0));
diff --git a/test/mjsunit/compiler/multiply-add.js b/test/mjsunit/compiler/multiply-add.js
new file mode 100644
index 0000000..2b4304e
--- /dev/null
+++ b/test/mjsunit/compiler/multiply-add.js
@@ -0,0 +1,69 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+// Test expressions that can be computed with a multiply-add instruction.
+
+function f(a, b, c) {
+ return a * b + c;
+}
+
+function g(a, b, c) {
+ return a + b * c;
+}
+
+function h(a, b, c, d) {
+ return a * b + c * d;
+}
+
+assertEquals(5, f(1, 2, 3));
+assertEquals(5, f(1, 2, 3));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(5, f(1, 2, 3));
+assertEquals("2foo", f(1, 2, "foo"));
+assertEquals(5.41, f(1.1, 2.1, 3.1));
+assertEquals(5.41, f(1.1, 2.1, 3.1));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(5.41, f(1.1, 2.1, 3.1));
+
+assertEquals(7, g(1, 2, 3));
+assertEquals(7, g(1, 2, 3));
+%OptimizeFunctionOnNextCall(g);
+assertEquals(7, g(1, 2, 3));
+assertEquals(8.36, g(1.1, 2.2, 3.3));
+assertEquals(8.36, g(1.1, 2.2, 3.3));
+%OptimizeFunctionOnNextCall(g);
+assertEquals(8.36, g(1.1, 2.2, 3.3));
+
+assertEquals(14, h(1, 2, 3, 4));
+assertEquals(14, h(1, 2, 3, 4));
+%OptimizeFunctionOnNextCall(h);
+assertEquals(14, h(1, 2, 3, 4));
+assertEquals(15.02, h(1.1, 2.1, 3.1, 4.1));
+assertEquals(15.02, h(1.1, 2.1, 3.1, 4.1));
+%OptimizeFunctionOnNextCall(h);
+assertEquals(15.02, h(1.1, 2.1, 3.1, 4.1));
diff --git a/test/mjsunit/compiler/multiply-sub.js b/test/mjsunit/compiler/multiply-sub.js
new file mode 100644
index 0000000..4793181
--- /dev/null
+++ b/test/mjsunit/compiler/multiply-sub.js
@@ -0,0 +1,56 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+// Test expressions that can be computed with a multiply-add instruction.
+
+function f(a, b, c) {
+ return a - b * c;
+}
+
+function g(a, b, c) {
+ return a * b - c;
+}
+
+function h(a, b, c, d) {
+ return a * b - c * d;
+}
+
+assertEquals(-5.41, f(1.1, 2.1, 3.1));
+assertEquals(-5.41, f(1.1, 2.1, 3.1));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(-5.41, f(1.1, 2.1, 3.1));
+
+assertEquals(8.36, g(2.2, 3.3, -1.1));
+assertEquals(8.36, g(2.2, 3.3, -1.1));
+%OptimizeFunctionOnNextCall(g);
+assertEquals(8.36, g(2.2, 3.3, -1.1));
+
+assertEquals(-1.5, h(1.5, 3.0, 12, 0.5));
+assertEquals(-1.5, h(1.5, 3.0, 12, 0.5));
+%OptimizeFunctionOnNextCall(h);
+assertEquals(-1.5, h(1.5, 3.0, 12, 0.5));
diff --git a/test/mjsunit/compiler/opt-next-call.js b/test/mjsunit/compiler/opt-next-call.js
new file mode 100644
index 0000000..6366c7d
--- /dev/null
+++ b/test/mjsunit/compiler/opt-next-call.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ return "fooed";
+}
+
+%OptimizeFunctionOnNextCall(foo);
+assertEquals("fooed", foo());
+assertOptimized(foo);
diff --git a/test/mjsunit/compiler/optimize-bitnot.js b/test/mjsunit/compiler/optimize-bitnot.js
new file mode 100644
index 0000000..28315a4
--- /dev/null
+++ b/test/mjsunit/compiler/optimize-bitnot.js
@@ -0,0 +1,42 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+ return ~~x;
+}
+
+f(42);
+f(42);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(42, f(42));
+assertEquals(42, f(42.5));
+assertEquals(1/0, 1/f(-0));
+assertEquals(-1, f(0xffffffff));
+assertEquals(0, f(undefined));
+assertEquals(0, f("abc"));
diff --git a/test/mjsunit/compiler/optimized-closures.js b/test/mjsunit/compiler/optimized-closures.js
new file mode 100644
index 0000000..499e4d5
--- /dev/null
+++ b/test/mjsunit/compiler/optimized-closures.js
@@ -0,0 +1,53 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test optimized closures.
+
+var a = new Array(100);
+
+function f() {
+ var x=0;
+ for (var i=0; i<100; i++) {
+ var g = function goo(y) {
+ function h() {
+ if (goo.arguments[0] == 23) return -42;
+ return 42;
+ }
+ return x + y + h(y);
+ }
+ g(0);
+ %OptimizeFunctionOnNextCall(g);
+ a[i] = g(i);
+ }
+}
+
+f();
+assertEquals(42, a[0]);
+assertEquals(49, a[7]);
+assertEquals(-19, a[23]);
diff --git a/test/mjsunit/compiler/optimized-for-in.js b/test/mjsunit/compiler/optimized-for-in.js
index cb8c66d..9c756aa 100644
--- a/test/mjsunit/compiler/optimized-for-in.js
+++ b/test/mjsunit/compiler/optimized-for-in.js
@@ -26,6 +26,7 @@
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Flags: --optimize-for-in --allow-natives-syntax
+// Flags: --no-concurrent-osr
// Test for-in support in Crankshaft. For simplicity this tests assumes certain
// fixed iteration order for properties and will have to be adjusted if V8
diff --git a/test/mjsunit/compiler/osr-alignment.js b/test/mjsunit/compiler/osr-alignment.js
new file mode 100644
index 0000000..30d72d0
--- /dev/null
+++ b/test/mjsunit/compiler/osr-alignment.js
@@ -0,0 +1,86 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --use-osr
+
+function f1() {
+ var sum = 0;
+ for (var i = 0; i < 1000000; i++) {
+ var x = i + 2;
+ var y = x + 5;
+ var z = y + 3;
+ sum += z;
+ }
+ return sum;
+}
+
+function f2() {
+ var sum = 0;
+ for (var i = 0; i < 1000000; i++) {
+ var x = i + 2;
+ var y = x + 5;
+ var z = y + 3;
+ sum += z;
+ }
+ return sum;
+}
+
+function f3() {
+ var sum = 0;
+ for (var i = 0; i < 1000000; i++) {
+ var x = i + 2;
+ var y = x + 5;
+ var z = y + 3;
+ sum += z;
+ }
+ return sum;
+}
+
+function test1() {
+ var j = 11;
+ for (var i = 0; i < 2; i++) {
+ assertEquals(500009500000, f1());
+ }
+}
+
+function test2() {
+ for (var i = 0; i < 2; i++) {
+ var j = 11, k = 12;
+ assertEquals(500009500000, f2());
+ }
+}
+
+function test3() {
+ for (var i = 0; i < 2; i++) {
+ var j = 11, k = 13, m = 14;
+ assertEquals(500009500000, f3());
+ }
+}
+
+test1();
+test2();
+test3();
diff --git a/test/mjsunit/compiler/osr-assert.js b/test/mjsunit/compiler/osr-assert.js
new file mode 100644
index 0000000..94b901f
--- /dev/null
+++ b/test/mjsunit/compiler/osr-assert.js
@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --use-osr
+
+function f(x, b, c) {
+ var outer = 1000000;
+ var a = 1;
+ while (outer > 0) {
+ a = a + 5;
+ assertEquals(b + 1, c);
+ outer--;
+ }
+ return a + 4;
+}
+
+assertEquals(5000005, f(5, "122", "1221"));
diff --git a/test/mjsunit/compiler/osr-big.js b/test/mjsunit/compiler/osr-big.js
new file mode 100644
index 0000000..ed71744
--- /dev/null
+++ b/test/mjsunit/compiler/osr-big.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --use-osr
+
+function f(x) {
+ var sum = 0;
+ var outer = 1000000;
+ var a = 1, b = 2, c = 3, d = 4, e = 5;
+ while (outer > 0) {
+ a = a + 5;
+ b = b + 4;
+ c = c + 3;
+ d = d + 2;
+ e = e + 1;
+ outer--;
+ }
+ return a + b + c + d + e;
+}
+
+assertEquals(15000015, f(5));
diff --git a/test/mjsunit/compiler/osr-nested.js b/test/mjsunit/compiler/osr-nested.js
new file mode 100644
index 0000000..4bdb082
--- /dev/null
+++ b/test/mjsunit/compiler/osr-nested.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --use-osr
+
+function f() {
+ var sum = 0;
+ for (var i = 0; i < 10; i++) {
+ for (var j = 0; j < 100000; j++) {
+ var x = i + 2;
+ var y = x + 5;
+ var z = y + 3;
+ sum += z;
+ }
+ }
+ return sum;
+}
+
+
+assertEquals(14500000, f());
+assertEquals(14500000, f());
+assertEquals(14500000, f());
diff --git a/test/mjsunit/compiler/osr-one.js b/test/mjsunit/compiler/osr-one.js
new file mode 100644
index 0000000..2c27192
--- /dev/null
+++ b/test/mjsunit/compiler/osr-one.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --use-osr
+
+function f(x) {
+ var sum = 0;
+ var count = 10000000;
+ while (count > 0) {
+ sum += x;
+ count--;
+ }
+ return sum;
+}
+
+assertEquals(50000000, f(5));
diff --git a/test/mjsunit/compiler/regress-max-locals-for-osr.js b/test/mjsunit/compiler/osr-regress-max-locals.js
similarity index 100%
rename from test/mjsunit/compiler/regress-max-locals-for-osr.js
rename to test/mjsunit/compiler/osr-regress-max-locals.js
diff --git a/test/mjsunit/compiler/osr-sar.js b/test/mjsunit/compiler/osr-sar.js
new file mode 100644
index 0000000..fd68b98
--- /dev/null
+++ b/test/mjsunit/compiler/osr-sar.js
@@ -0,0 +1,49 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function test() {
+ // Loop to force OSR.
+ var j = 0;
+ for (var i = 0; i < 80000; i++) {
+ j++;
+ }
+
+ function SarShr(val) {
+ return val >> (-2 >>> 0);
+ }
+
+ var K3 = 0x80000000;
+ assertEquals(-2, SarShr(K3 | 0));
+ assertEquals(-2, SarShr(K3 | 0));
+ %OptimizeFunctionOnNextCall(SarShr);
+ assertEquals(-2, SarShr(K3 | 0));
+}
+
+test();
+//test();
diff --git a/test/mjsunit/compiler/simple-osr.js b/test/mjsunit/compiler/osr-simple.js
similarity index 100%
rename from test/mjsunit/compiler/simple-osr.js
rename to test/mjsunit/compiler/osr-simple.js
diff --git a/test/mjsunit/compiler/osr-two.js b/test/mjsunit/compiler/osr-two.js
new file mode 100644
index 0000000..8ac4c2c
--- /dev/null
+++ b/test/mjsunit/compiler/osr-two.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --use-osr
+
+function f(x) {
+ var sum = 0;
+ var outer = 100;
+ while (outer > 0) {
+ var inner = 100000;
+ while (inner > 0) {
+ sum += x;
+ inner--;
+ }
+ outer--;
+ }
+ return sum;
+}
+
+assertEquals(50000000, f(5));
diff --git a/test/mjsunit/compiler/osr-uint32.js b/test/mjsunit/compiler/osr-uint32.js
new file mode 100644
index 0000000..d6fcae5
--- /dev/null
+++ b/test/mjsunit/compiler/osr-uint32.js
@@ -0,0 +1,39 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Loop to force OSR.
+var j = 0;
+for (var i = 0; i < 80000; i++) {
+ j++;
+}
+
+function SarShr(val) {
+ return val >> (-2 >>> 0);
+}
+
+var K3 = 0x80000000;
+assertEquals(-2, SarShr(K3 | 0));
diff --git a/test/mjsunit/compiler/osr-warm.js b/test/mjsunit/compiler/osr-warm.js
new file mode 100644
index 0000000..73e1fd5
--- /dev/null
+++ b/test/mjsunit/compiler/osr-warm.js
@@ -0,0 +1,50 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --use-osr
+
+function f1(x) {
+ while (x > 0) {
+ x--;
+ }
+ return x;
+}
+
+assertEquals(0, f1(1));
+assertEquals(0, f1(200000));
+
+function f2(x) {
+ var sum = 1;
+ while (x > 0) {
+ x--;
+ sum++;
+ }
+ return sum;
+}
+
+assertEquals(2, f2(1));
+assertEquals(200001, f2(200000));
diff --git a/test/mjsunit/compiler/osr-with-args.js b/test/mjsunit/compiler/osr-with-args.js
new file mode 100644
index 0000000..4817ad7
--- /dev/null
+++ b/test/mjsunit/compiler/osr-with-args.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --use-osr
+
+function f() {
+ var sum = 0;
+ for (var i = 0; i < 100000; i++) {
+ var t = arguments[0] + 2;
+ var x = arguments[1] + 2;
+ var y = t + x + 5;
+ var z = y + 3;
+ sum += z;
+ }
+ return sum;
+}
+
+for (var i = 0; i < 3; i++) {
+ assertEquals(1700000, f(2, 3));
+}
diff --git a/test/mjsunit/compiler/phi-representations.js b/test/mjsunit/compiler/phi-representations.js
new file mode 100644
index 0000000..6d11bb0
--- /dev/null
+++ b/test/mjsunit/compiler/phi-representations.js
@@ -0,0 +1,56 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function ar() {
+ var r = undefined;
+ var f = 1;
+ while (f--) {
+ r = (typeof r === 'undefined') ? 0.1 : r;
+ };
+ return (r - r);
+}
+
+assertEquals(0, ar());
+assertEquals(0, ar());
+%OptimizeFunctionOnNextCall(ar);
+assertEquals(0, ar());
+
+function ar2() {
+ var r = undefined;
+ var f = 1;
+ while (f--) {
+ r = r === undefined ? 0.1 : r;
+ };
+ return (r - r);
+}
+
+assertEquals(0, ar2());
+assertEquals(0, ar2());
+%OptimizeFunctionOnNextCall(ar2);
+assertEquals(0, ar2());
diff --git a/test/mjsunit/compiler/property-static.js b/test/mjsunit/compiler/property-static.js
new file mode 100644
index 0000000..0702134
--- /dev/null
+++ b/test/mjsunit/compiler/property-static.js
@@ -0,0 +1,69 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test usage of static type information for loads that would otherwise
+// turn into polymorphic or generic loads.
+
+// Prepare a highly polymorphic load to be used by all tests.
+Object.prototype.load = function() { return this.property; };
+Object.prototype.load.call({ A:0, property:10 });
+Object.prototype.load.call({ A:0, B:0, property:11 });
+Object.prototype.load.call({ A:0, B:0, C:0, property:12 });
+Object.prototype.load.call({ A:0, B:0, C:0, D:0, property:13 });
+Object.prototype.load.call({ A:0, B:0, C:0, D:0, E:0, property:14 });
+Object.prototype.load.call({ A:0, B:0, C:0, D:0, E:0, F:0, property:15 });
+
+// Test for object literals.
+(function() {
+ function f(x) {
+ var object = { property:x };
+ return object.load();
+ }
+
+ assertSame(1, f(1));
+ assertSame(2, f(2));
+ %OptimizeFunctionOnNextCall(f);
+ assertSame(3, f(3));
+})();
+
+// Test for inlined constructors.
+(function() {
+ function c(x) {
+ this.property = x;
+ }
+ function f(x) {
+ var object = new c(x);
+ return object.load();
+ }
+
+ assertSame(1, f(1));
+ assertSame(2, f(2));
+ %OptimizeFunctionOnNextCall(f);
+ assertSame(3, f(3));
+})();
diff --git a/test/mjsunit/compiler/proto-chain-constant.js b/test/mjsunit/compiler/proto-chain-constant.js
new file mode 100644
index 0000000..0d9e3b0
--- /dev/null
+++ b/test/mjsunit/compiler/proto-chain-constant.js
@@ -0,0 +1,55 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test loading a constant function on the prototype chain.
+
+var c = Object.create;
+var obj4 = c(null, { f4: { value: function() { return 4; }, writable: true }});
+var obj3 = c(obj4, { f3: { value: function() { return 3; }, writable: true }});
+var obj2 = c(obj3, { f2: { value: function() { return 2; }, writable: true }});
+var obj1 = c(obj2, { f1: { value: function() { return 1; }, writable: true }});
+var obj0 = c(obj1, { f0: { value: function() { return 0; }, writable: true }});
+
+function get4(obj) { return obj.f4; }
+
+assertEquals(4, get4(obj0)());
+assertEquals(4, get4(obj0)());
+%OptimizeFunctionOnNextCall(get4);
+assertEquals(4, get4(obj0)());
+obj4.f4 = function() { return 5; };
+assertEquals(5, get4(obj0)());
+
+function get3(obj) { return obj.f3; }
+
+assertEquals(3, get3(obj0)());
+assertEquals(3, get3(obj0)());
+%OptimizeFunctionOnNextCall(get3);
+assertEquals(3, get3(obj0)());
+obj2.f3 = function() { return 6; };
+assertEquals(6, get3(obj0)());
diff --git a/test/mjsunit/compiler/proto-chain-load.js b/test/mjsunit/compiler/proto-chain-load.js
new file mode 100644
index 0000000..60c6431
--- /dev/null
+++ b/test/mjsunit/compiler/proto-chain-load.js
@@ -0,0 +1,44 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test HLoadNamedField on the proto chain.
+
+var obj4 = Object.create(null, { f4: {value: 4} });
+var obj3 = Object.create(obj4, { f3: {value: 3} });
+var obj2 = Object.create(obj3, { f2: {value: 2} });
+var obj1 = Object.create(obj2, { f1: {value: 1} });
+var obj0 = Object.create(obj1, { f0: {value: 0} });
+
+function get4(obj) { return obj.f4; }
+
+assertEquals(4, get4(obj0));
+assertEquals(4, get4(obj0));
+%OptimizeFunctionOnNextCall(get4);
+assertEquals(4, get4(obj0));
+assertEquals(4, get4(obj0));
diff --git a/test/mjsunit/compiler/regress-1394.js b/test/mjsunit/compiler/regress-1394.js
index b1ce192..fbf4357 100644
--- a/test/mjsunit/compiler/regress-1394.js
+++ b/test/mjsunit/compiler/regress-1394.js
@@ -56,4 +56,3 @@
assertEquals(0, f(0));
assertEquals(1, f(1));
-
diff --git a/test/mjsunit/compiler/regress-177883.js b/test/mjsunit/compiler/regress-177883.js
new file mode 100644
index 0000000..d5af584
--- /dev/null
+++ b/test/mjsunit/compiler/regress-177883.js
@@ -0,0 +1,179 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// A regression test for a register allocation bug triggered by
+// http://n3emscripten.appspot.com/dragons_asmjs.html. Note that the test is
+// very fragile, but without a proper testing infrastructure for the register
+// allocator we can't really do much better.
+//
+// The code below is a slighty modified version of Emscripten-translated C++
+// code for the standard textbook algorithm for frustum culling of an object
+// with a given bounding box.
+//
+// The key problem for the underlying bug was a value with a long live range
+// which is used often (a context) and a lot of live ranges starting at the same
+// point. The bug was that none of the ranges were allowed to be spilled, so the
+// allocator was splitting a live range at its start and re-added the very same
+// range into the list of unallocated ranges, making no progress.
+
+(function () {
+ function __ZNK4Math5plane3dotERKNS_6float4E(i1, i2) {
+ i1 = i1 | 0;
+ i2 = i2 | 0;
+ return +(+HEAPF32[i1 >> 2] * +HEAPF32[i2 >> 2] + +HEAPF32[i1 + 4 >> 2] * +HEAPF32[i2 + 4 >> 2] + +HEAPF32[i1 + 8 >> 2] * +HEAPF32[i2 + 8 >> 2] + +HEAPF32[i1 + 12 >> 2] * +HEAPF32[i2 + 12 >> 2]);
+ }
+
+ function __ZNK4Math7frustum8clipmaskERKNS_5pointE(i1, i2) {
+ i1 = i1 | 0;
+ i2 = i2 | 0;
+ var i3 = 0, i4 = 0;
+ i3 = i2 | 0;
+ i2 = +__ZNK4Math5plane3dotERKNS_6float4E(i1 | 0, i3) > 0.0 & 1;
+ i4 = +__ZNK4Math5plane3dotERKNS_6float4E(i1 + 16 | 0, i3) > 0.0 ? i2 | 2 : i2;
+ i2 = +__ZNK4Math5plane3dotERKNS_6float4E(i1 + 32 | 0, i3) > 0.0 ? i4 | 4 : i4;
+ i4 = +__ZNK4Math5plane3dotERKNS_6float4E(i1 + 48 | 0, i3) > 0.0 ? i2 | 8 : i2;
+ i2 = +__ZNK4Math5plane3dotERKNS_6float4E(i1 + 64 | 0, i3) > 0.0 ? i4 | 16 : i4;
+ return (+__ZNK4Math5plane3dotERKNS_6float4E(i1 + 80 | 0, i3) > 0.0 ? i2 | 32 : i2) | 0;
+ }
+
+ function __ZNK4Math7frustum10clipstatusERKNS_4bboxE(i1, i2) {
+ i1 = i1 | 0;
+ i2 = i2 | 0;
+ var i3 = 0, i4 = 0, i5 = 0, i6 = 0, i7 = 0, i8 = 0, i9 = 0, i10 = 0, i11 = 0, i12 = 0, i13 = 0, i14 = 0, i15 = 0, i16 = 0, d17 = 0.0, d18 = 0.0, i19 = 0, i20 = 0, i21 = 0, i22 = 0;
+ i3 = STACKTOP;
+ STACKTOP = STACKTOP + 16 | 0;
+ i4 = i3 | 0;
+ i5 = i4 | 0;
+ HEAPF32[i5 >> 2] = 0.0;
+ i6 = i4 + 4 | 0;
+ HEAPF32[i6 >> 2] = 0.0;
+ i7 = i4 + 8 | 0;
+ HEAPF32[i7 >> 2] = 0.0;
+ i8 = i4 + 12 | 0;
+ HEAPF32[i8 >> 2] = 1.0;
+ i9 = i2 | 0;
+ i10 = i2 + 4 | 0;
+ i11 = i2 + 8 | 0;
+ i12 = i2 + 20 | 0;
+ i13 = i2 + 16 | 0;
+ i14 = i2 + 24 | 0;
+ i2 = 65535;
+ i15 = 0;
+ i16 = 0;
+ while (1) {
+ if ((i16 | 0) == 1) {
+ d17 = +HEAPF32[i12 >> 2];
+ d18 = +HEAPF32[i11 >> 2];
+ HEAPF32[i5 >> 2] = +HEAPF32[i9 >> 2];
+ HEAPF32[i6 >> 2] = d17;
+ HEAPF32[i7 >> 2] = d18;
+ HEAPF32[i8 >> 2] = 1.0;
+ } else if ((i16 | 0) == 4) {
+ HEAPF32[i5 >> 2] = +HEAPF32[i13 >> 2];
+ HEAPF32[i6 >> 2] = +HEAPF32[i12 >> 2];
+ HEAPF32[i7 >> 2] = +HEAPF32[i14 >> 2];
+ HEAPF32[i8 >> 2] = 1.0;
+ } else if ((i16 | 0) == 6) {
+ d18 = +HEAPF32[i10 >> 2];
+ d17 = +HEAPF32[i14 >> 2];
+ HEAPF32[i5 >> 2] = +HEAPF32[i9 >> 2];
+ HEAPF32[i6 >> 2] = d18;
+ HEAPF32[i7 >> 2] = d17;
+ HEAPF32[i8 >> 2] = 1.0;
+ } else if ((i16 | 0) == 5) {
+ d17 = +HEAPF32[i12 >> 2];
+ d18 = +HEAPF32[i14 >> 2];
+ HEAPF32[i5 >> 2] = +HEAPF32[i9 >> 2];
+ HEAPF32[i6 >> 2] = d17;
+ HEAPF32[i7 >> 2] = d18;
+ HEAPF32[i8 >> 2] = 1.0;
+ } else if ((i16 | 0) == 3) {
+ d18 = +HEAPF32[i10 >> 2];
+ d17 = +HEAPF32[i11 >> 2];
+ HEAPF32[i5 >> 2] = +HEAPF32[i13 >> 2];
+ HEAPF32[i6 >> 2] = d18;
+ HEAPF32[i7 >> 2] = d17;
+ HEAPF32[i8 >> 2] = 1.0;
+ } else if ((i16 | 0) == 0) {
+ HEAPF32[i5 >> 2] = +HEAPF32[i9 >> 2];
+ HEAPF32[i6 >> 2] = +HEAPF32[i10 >> 2];
+ HEAPF32[i7 >> 2] = +HEAPF32[i11 >> 2];
+ HEAPF32[i8 >> 2] = 1.0;
+ } else if ((i16 | 0) == 2) {
+ d17 = +HEAPF32[i12 >> 2];
+ d18 = +HEAPF32[i11 >> 2];
+ HEAPF32[i5 >> 2] = +HEAPF32[i13 >> 2];
+ HEAPF32[i6 >> 2] = d17;
+ HEAPF32[i7 >> 2] = d18;
+ HEAPF32[i8 >> 2] = 1.0;
+ } else if ((i16 | 0) == 7) {
+ d18 = +HEAPF32[i10 >> 2];
+ d17 = +HEAPF32[i14 >> 2];
+ HEAPF32[i5 >> 2] = +HEAPF32[i13 >> 2];
+ HEAPF32[i6 >> 2] = d18;
+ HEAPF32[i7 >> 2] = d17;
+ HEAPF32[i8 >> 2] = 1.0;
+ }
+ i19 = __ZNK4Math7frustum8clipmaskERKNS_5pointE(i1, i4) | 0;
+ i20 = i19 & i2;
+ i21 = i19 | i15;
+ i19 = i16 + 1 | 0;
+ if ((i19 | 0) == 8) {
+ break;
+ } else {
+ i2 = i20;
+ i15 = i21;
+ i16 = i19;
+ }
+ }
+ if ((i21 | 0) == 0) {
+ i22 = 0;
+ STACKTOP = i3;
+ return i22 | 0;
+ }
+ i22 = (i20 | 0) == 0 ? 2 : 1;
+ STACKTOP = i3;
+ return i22 | 0;
+ }
+
+ // -----------------------------------------------------------------
+
+ var STACKTOP = 0;
+ var HEAPF32 = new Float32Array(1000);
+
+ for (var i = 0; i < HEAPF32.length; i++) {
+ HEAPF32[i] = 1.0;
+ }
+
+ __ZNK4Math7frustum10clipstatusERKNS_4bboxE(0, 0);
+ __ZNK4Math7frustum10clipstatusERKNS_4bboxE(0, 0);
+ __ZNK4Math7frustum10clipstatusERKNS_4bboxE(0, 0);
+ %OptimizeFunctionOnNextCall(__ZNK4Math7frustum10clipstatusERKNS_4bboxE);
+ __ZNK4Math7frustum10clipstatusERKNS_4bboxE(0, 0);
+})();
diff --git a/test/mjsunit/compiler/regress-3260426.js b/test/mjsunit/compiler/regress-3260426.js
index dfef424..457064d 100644
--- a/test/mjsunit/compiler/regress-3260426.js
+++ b/test/mjsunit/compiler/regress-3260426.js
@@ -33,4 +33,3 @@
function test() { return always_false() ? 0 : 1; }
assertEquals(1, test());
-
diff --git a/test/mjsunit/compiler/regress-4.js b/test/mjsunit/compiler/regress-4.js
index 0ec9a12..9a212ba 100644
--- a/test/mjsunit/compiler/regress-4.js
+++ b/test/mjsunit/compiler/regress-4.js
@@ -34,7 +34,7 @@
return y+x;
}
-for (var i=0; i<10000000; i++) f(42);
+for (var i=0; i<100000; i++) f(42);
var result = f("foo");
assertEquals("0foo6", result);
diff --git a/test/mjsunit/compiler/regress-411262.js b/test/mjsunit/compiler/regress-411262.js
new file mode 100644
index 0000000..ffbfe2e
--- /dev/null
+++ b/test/mjsunit/compiler/regress-411262.js
@@ -0,0 +1,37 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function b() {
+}
+function f() {
+ b.apply(this, arguments);
+}
+
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/compiler/regress-arguments.js b/test/mjsunit/compiler/regress-arguments.js
index ebae5a0..d32b435 100644
--- a/test/mjsunit/compiler/regress-arguments.js
+++ b/test/mjsunit/compiler/regress-arguments.js
@@ -25,6 +25,8 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Flags: --allow-natives-syntax
+
// Test of arguments.
// Test passing null or undefined as receiver.
@@ -35,8 +37,15 @@
var foo = 42;
-for (var i=0; i<1000000; i++) assertEquals(42, g());
-for (var i=0; i<1000000; i++) assertEquals(42, h());
+for (var i = 0; i < 3; i++) assertEquals(42, g());
+%OptimizeFunctionOnNextCall(g);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(42, g());
+
+for (var i = 0; i < 3; i++) assertEquals(42, h());
+%OptimizeFunctionOnNextCall(h);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(42, h());
var G1 = 21;
var G2 = 22;
@@ -49,4 +58,7 @@
Number.prototype.foo = 42;
delete Number.prototype.foo;
-for (var i=0; i<100000; i++) assertEquals(void 0, u());
+for (var i = 0; i < 3; i++) assertEquals(void 0, u());
+%OptimizeFunctionOnNextCall(u);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(void 0, u());
diff --git a/test/mjsunit/compiler/regress-closures-with-eval.js b/test/mjsunit/compiler/regress-closures-with-eval.js
index 57afb16..d95d128 100644
--- a/test/mjsunit/compiler/regress-closures-with-eval.js
+++ b/test/mjsunit/compiler/regress-closures-with-eval.js
@@ -53,4 +53,4 @@
withEval(expr, function(a) { return a; });
}
%OptimizeFunctionOnNextCall(withEval);
-withEval(expr, function(a) { return a; });
\ No newline at end of file
+withEval(expr, function(a) { return a; });
diff --git a/test/mjsunit/compiler/regress-gvn.js b/test/mjsunit/compiler/regress-gvn.js
index 358daf7..01b1aa9 100644
--- a/test/mjsunit/compiler/regress-gvn.js
+++ b/test/mjsunit/compiler/regress-gvn.js
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --noalways-opt
+// Flags: --noalways-opt --allow-natives-syntax
//
// Regression test for global value numbering.
@@ -39,10 +39,11 @@
var a = new Array();
-var n = 100000000;
+var n = 100;
var result = 0;
for (var i = 0; i < n; ++i) {
+ if (i == 10) %OptimizeFunctionOnNextCall(test);
a[0] = 0;
result += test(a);
}
diff --git a/test/mjsunit/compiler/regress-inline-callfunctionstub.js b/test/mjsunit/compiler/regress-inline-callfunctionstub.js
index a39d26d..3365534 100644
--- a/test/mjsunit/compiler/regress-inline-callfunctionstub.js
+++ b/test/mjsunit/compiler/regress-inline-callfunctionstub.js
@@ -43,4 +43,3 @@
main(o.g);
%OptimizeFunctionOnNextCall(main);
main(o.g);
-
diff --git a/test/mjsunit/compiler/regress-or.js b/test/mjsunit/compiler/regress-or.js
index 89f7802..939f2c3 100644
--- a/test/mjsunit/compiler/regress-or.js
+++ b/test/mjsunit/compiler/regress-or.js
@@ -25,6 +25,8 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Flags: --allow-natives-syntax
+
// Test deoptimization inside short-circuited expressions.
function f1(x) {
var c = "fail";
@@ -36,7 +38,8 @@
function g1() { try { return 1; } finally {} }
-for (var i=0; i<10000000; i++) f1(42);
+for (var i = 0; i < 5; i++) f1(42);
+%OptimizeFunctionOnNextCall(f1);
assertEquals(-1, f1(0));
assertEquals(-43, f1(42));
@@ -52,6 +55,7 @@
function g2() { try { return 0; } finally {} }
-for (var i=0; i<10000000; i++) f2(42);
+for (var i = 0; i < 5; i++) f2(42);
+%OptimizeFunctionOnNextCall(f2);
assertEquals(-1, f2(""));
diff --git a/test/mjsunit/compiler/regress-rep-change.js b/test/mjsunit/compiler/regress-rep-change.js
index 9370999..c8a0983 100644
--- a/test/mjsunit/compiler/regress-rep-change.js
+++ b/test/mjsunit/compiler/regress-rep-change.js
@@ -25,6 +25,8 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Flags: --allow-natives-syntax
+
// Regression test for the case where a phi has two input operands with
// the same value.
@@ -35,8 +37,11 @@
for (var i = start; i < 10; i++) { }
}
-var n = 5000000;
+var n = 3;
for (var i = 0; i < n; ++i) {
test(0);
}
+
+%OptimizeFunctionOnNextCall(test);
+test(0);
diff --git a/test/mjsunit/compiler/regress-shared-deopt.js b/test/mjsunit/compiler/regress-shared-deopt.js
new file mode 100644
index 0000000..669e0e2
--- /dev/null
+++ b/test/mjsunit/compiler/regress-shared-deopt.js
@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var soft = false;
+
+// disable optimization of this global
+soft = true;
+soft = false;
+soft = true;
+soft = false;
+
+function test() {
+ var f4 = makeF(4);
+ var f5 = makeF(5);
+
+ function makeF(i) {
+ return function f(x) {
+ if (x == 0) return i;
+ if (i == 4) if (soft) print("wahoo" + i);
+ return f4(x - 1);
+ }
+ }
+
+ f4(9);
+ f4(11);
+ %OptimizeFunctionOnNextCall(f4);
+ f4(12);
+
+ f5(9);
+ f5(11);
+ %OptimizeFunctionOnNextCall(f5);
+ f5(12);
+
+ soft = true;
+ f4(1);
+ f5(9);
+}
+
+test();
diff --git a/test/mjsunit/compiler/regress-toint32.js b/test/mjsunit/compiler/regress-toint32.js
index 54c2f76..75892d4 100644
--- a/test/mjsunit/compiler/regress-toint32.js
+++ b/test/mjsunit/compiler/regress-toint32.js
@@ -42,4 +42,3 @@
assertEquals(G, f(G));
%OptimizeFunctionOnNextCall(f);
assertEquals(G, f(G));
-
diff --git a/test/mjsunit/compiler/rotate.js b/test/mjsunit/compiler/rotate.js
new file mode 100644
index 0000000..1c81e49
--- /dev/null
+++ b/test/mjsunit/compiler/rotate.js
@@ -0,0 +1,308 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+// Test shift operations that can be replaced by rotate operation.
+
+function SideEffect() {
+ with ({}) { } // not inlinable
+}
+
+function Twenty() {
+ SideEffect();
+ return 20;
+}
+
+function Twelve() {
+ SideEffect();
+ return 12;
+}
+
+
+function ROR(x, sa) {
+ return (x >>> sa) | (x << (32 - sa));
+}
+
+function ROR1(x, sa) {
+ return (x >>> sa) | (x << (32 - sa));
+}
+
+function ROR2(x, sa) {
+ return (x >>> (32 - sa)) | (x << (sa));
+}
+
+function ROR3(x, sa) {
+ return (x << (32 - sa)) | (x >>> sa);
+}
+
+function ROR4(x, sa) {
+ return (x << (sa)) | (x >>> (32 - sa));
+}
+
+assertEquals(1 << ((2 % 32)), ROR(1, 30));
+assertEquals(1 << ((2 % 32)), ROR(1, 30));
+%OptimizeFunctionOnNextCall(ROR);
+assertEquals(1 << ((2 % 32)), ROR(1, 30));
+
+assertEquals(0xF0000FFF | 0, ROR1(0x0000FFFF, 4));
+assertEquals(0xF0000FFF | 0, ROR1(0x0000FFFF, 4));
+%OptimizeFunctionOnNextCall(ROR1);
+assertEquals(0xF0000FFF | 0, ROR1(0x0000FFFF, 4));
+
+assertEquals(0x0FFFF000 | 0, ROR1(0x0000FFFF, 20));
+assertEquals(0x0FFFF000 | 0, ROR1(0x0000FFFF, 20));
+%OptimizeFunctionOnNextCall(ROR1);
+assertEquals(0x0FFFF000 | 0, ROR1(0x0000FFFF, 20));
+
+assertEquals(0x0FFFF000 | 0, ROR1(0x0000FFFF, Twenty()));
+assertEquals(0x0FFFF000 | 0, ROR1(0x0000FFFF, Twenty()));
+%OptimizeFunctionOnNextCall(ROR1);
+assertEquals(0x0FFFF000 | 0, ROR1(0x0000FFFF, Twenty()));
+
+for (var i = 0; i <= 100; i++) {
+ assertEquals(0xFFFFFFFF | 0, ROR1(0xFFFFFFFF, i));
+ assertEquals(0xFFFFFFFF | 0, ROR1(0xFFFFFFFF, i));
+ %OptimizeFunctionOnNextCall(ROR1);
+ assertEquals(0xFFFFFFFF | 0, ROR1(0xFFFFFFFF, i));
+}
+
+for (var i = 0; i <= 100; i++) {
+ assertEquals(-1, ROR1(-1, i));
+ assertEquals(-1, ROR1(-1, i));
+ %OptimizeFunctionOnNextCall(ROR1);
+ assertEquals(-1, ROR1(-1, i));
+}
+
+for (var i = 0; i <= 100; i++) {
+ assertEquals(1 << (32 - (i % 32)), ROR1(1, i));
+ assertEquals(1 << (32 - (i % 32)), ROR1(1, i));
+ %OptimizeFunctionOnNextCall(ROR1);
+ assertEquals(1 << (32 - (i % 32)), ROR1(1, i));
+}
+
+for (var i = 0; i <= 100; i++) {
+ assertEquals(1 << (32 - (i % 32)), ROR1(1.4, i));
+ assertEquals(1 << (32 - (i % 32)), ROR1(1.4, i));
+ %OptimizeFunctionOnNextCall(ROR1);
+ assertEquals(1 << (32 - (i % 32)), ROR1(1.4, i));
+}
+
+
+
+assertEquals(0xF0000FFF | 0, ROR2(0x0000FFFF, 28));
+assertEquals(0xF0000FFF | 0, ROR2(0x0000FFFF, 28));
+%OptimizeFunctionOnNextCall(ROR2);
+assertEquals(0xF0000FFF | 0, ROR2(0x0000FFFF, 28));
+
+assertEquals(0x0FFFF000 | 0, ROR2(0x0000FFFF, 12));
+assertEquals(0x0FFFF000 | 0, ROR2(0x0000FFFF, 12));
+%OptimizeFunctionOnNextCall(ROR2);
+assertEquals(0x0FFFF000 | 0, ROR2(0x0000FFFF, 12));
+
+assertEquals(0x0FFFF000 | 0, ROR2(0x0000FFFF, Twelve()));
+assertEquals(0x0FFFF000 | 0, ROR2(0x0000FFFF, Twelve()));
+%OptimizeFunctionOnNextCall(ROR2);
+assertEquals(0x0FFFF000 | 0, ROR2(0x0000FFFF, Twelve()));
+
+for (var i = 0; i <= 100; i++) {
+ assertEquals(0xFFFFFFFF | 0, ROR2(0xFFFFFFFF, i));
+ assertEquals(0xFFFFFFFF | 0, ROR2(0xFFFFFFFF, i));
+ %OptimizeFunctionOnNextCall(ROR2);
+ assertEquals(0xFFFFFFFF | 0, ROR2(0xFFFFFFFF, i));
+}
+
+for (var i = 0; i <= 100; i++) {
+ assertEquals(-1, ROR2(-1, i));
+ assertEquals(-1, ROR2(-1, i));
+ %OptimizeFunctionOnNextCall(ROR2);
+ assertEquals(-1, ROR2(-1, i));
+}
+
+for (var i = 0; i <= 100; i++) {
+ assertEquals(1 << ((i % 32)), ROR2(1, i));
+ assertEquals(1 << ((i % 32)), ROR2(1, i));
+ %OptimizeFunctionOnNextCall(ROR2);
+ assertEquals(1 << ((i % 32)), ROR2(1, i));
+}
+
+assertEquals(0xF0000FFF | 0, ROR3(0x0000FFFF, 4));
+assertEquals(0xF0000FFF | 0, ROR3(0x0000FFFF, 4));
+%OptimizeFunctionOnNextCall(ROR3);
+assertEquals(0xF0000FFF | 0, ROR3(0x0000FFFF, 4));
+
+assertEquals(0x0FFFF000 | 0, ROR3(0x0000FFFF, 20));
+assertEquals(0x0FFFF000 | 0, ROR3(0x0000FFFF, 20));
+%OptimizeFunctionOnNextCall(ROR3);
+assertEquals(0x0FFFF000 | 0, ROR3(0x0000FFFF, 20));
+
+assertEquals(0x0FFFF000 | 0, ROR3(0x0000FFFF, Twenty()));
+assertEquals(0x0FFFF000 | 0, ROR3(0x0000FFFF, Twenty()));
+%OptimizeFunctionOnNextCall(ROR3);
+assertEquals(0x0FFFF000 | 0, ROR3(0x0000FFFF, Twenty()));
+
+for (var i = 0; i <= 100; i++) {
+ assertEquals(0xFFFFFFFF | 0, ROR3(0xFFFFFFFF, i));
+ assertEquals(0xFFFFFFFF | 0, ROR3(0xFFFFFFFF, i));
+ %OptimizeFunctionOnNextCall(ROR3);
+ assertEquals(0xFFFFFFFF | 0, ROR3(0xFFFFFFFF, i));
+}
+
+for (var i = 0; i <= 100; i++) {
+ assertEquals(-1, ROR3(-1, i));
+ assertEquals(-1, ROR3(-1, i));
+ %OptimizeFunctionOnNextCall(ROR3);
+ assertEquals(-1, ROR3(-1, i));
+}
+
+for (var i = 0; i <= 100; i++) {
+ assertEquals(1 << (32 - (i % 32)), ROR3(1, i));
+ assertEquals(1 << (32 - (i % 32)), ROR3(1, i));
+ %OptimizeFunctionOnNextCall(ROR3);
+ assertEquals(1 << (32 - (i % 32)), ROR3(1, i));
+}
+
+assertEquals(0xF0000FFF | 0, ROR4(0x0000FFFF, 28));
+assertEquals(0xF0000FFF | 0, ROR4(0x0000FFFF, 28));
+%OptimizeFunctionOnNextCall(ROR4);
+assertEquals(0xF0000FFF | 0, ROR4(0x0000FFFF, 28));
+
+assertEquals(0x0FFFF000 | 0, ROR4(0x0000FFFF, 12));
+assertEquals(0x0FFFF000 | 0, ROR4(0x0000FFFF, 12));
+%OptimizeFunctionOnNextCall(ROR4);
+assertEquals(0x0FFFF000 | 0, ROR4(0x0000FFFF, 12));
+
+assertEquals(0x0FFFF000 | 0, ROR4(0x0000FFFF, Twelve()));
+assertEquals(0x0FFFF000 | 0, ROR4(0x0000FFFF, Twelve()));
+%OptimizeFunctionOnNextCall(ROR4);
+assertEquals(0x0FFFF000 | 0, ROR4(0x0000FFFF, Twelve()));
+
+for (var i = 0; i <= 100; i++) {
+ assertEquals(0xFFFFFFFF | 0, ROR4(0xFFFFFFFF, i));
+ assertEquals(0xFFFFFFFF | 0, ROR4(0xFFFFFFFF, i));
+ %OptimizeFunctionOnNextCall(ROR4);
+ assertEquals(0xFFFFFFFF | 0, ROR4(0xFFFFFFFF, i));
+}
+
+for (var i = 0; i <= 100; i++) {
+ assertEquals(-1, ROR4(-1, i));
+ assertEquals(-1, ROR4(-1, i));
+ %OptimizeFunctionOnNextCall(ROR4);
+ assertEquals(-1, ROR4(-1, i));
+}
+
+for (var i = 0; i <= 100; i++) {
+ assertEquals(1 << ((i % 32)), ROR4(1, i));
+ assertEquals(1 << ((i % 32)), ROR4(1, i));
+ %OptimizeFunctionOnNextCall(ROR4);
+ assertEquals(1 << ((i % 32)), ROR4(1, i));
+}
+
+//---------------------------------------------------------
+// add test cases for constant operand
+//---------------------------------------------------------
+// constant operand: 20
+function ROR1_sa20(x) {
+ return (x >>> 20) | (x << 12);
+}
+
+function ROR2_sa20(x) {
+ return (x >>> 12) | (x << 20);
+}
+
+function ROR3_sa20(x, sa) {
+ return (x << 12) | (x >>> 20);
+}
+
+function ROR4_sa20(x) {
+ return (x << 20) | (x >>> 12);
+}
+
+// constant operand: 40
+function ROR1_sa40(x) {
+ return (x >>> 40) | (x << -8);
+}
+
+function ROR2_sa40(x) {
+ return (x >>> -8) | (x << 40);
+}
+
+function ROR3_sa40(x, sa) {
+ return (x << -8) | (x >>> 40);
+}
+
+function ROR4_sa40(x) {
+ return (x << 40) | (x >>> -8);
+}
+
+// ROR1_sa20
+assertEquals(ROR1(0x0000FFFF, 20), ROR1_sa20(0x0000FFFF));
+assertEquals(ROR1(0x0000FFFF, 20), ROR1_sa20(0x0000FFFF));
+%OptimizeFunctionOnNextCall(ROR1_sa20);
+assertEquals(ROR1(0x0000FFFF, 20), ROR1_sa20(0x0000FFFF));
+
+// ROR1_sa40
+assertEquals(ROR1(0x0000FFFF, 40), ROR1_sa40(0x0000FFFF));
+assertEquals(ROR1(0x0000FFFF, 40), ROR1_sa40(0x0000FFFF));
+%OptimizeFunctionOnNextCall(ROR1_sa40);
+assertEquals(ROR1(0x0000FFFF, 40), ROR1_sa40(0x0000FFFF));
+
+// ROR2_sa20
+assertEquals(ROR2(0xFFFFFFFF, 20), ROR2_sa20(0xFFFFFFFF));
+assertEquals(ROR2(0xFFFFFFFF, 20), ROR2_sa20(0xFFFFFFFF));
+%OptimizeFunctionOnNextCall(ROR2_sa20);
+assertEquals(ROR2(0xFFFFFFFF, 20), ROR2_sa20(0xFFFFFFFF));
+
+// ROR2_sa40
+assertEquals(ROR2(0x0000FFFF, 40), ROR2_sa40(0x0000FFFF));
+assertEquals(ROR2(0x0000FFFF, 40), ROR2_sa40(0x0000FFFF));
+%OptimizeFunctionOnNextCall(ROR2_sa40);
+assertEquals(ROR2(0x0000FFFF, 40), ROR2_sa40(0x0000FFFF));
+
+// ROR3_sa20
+assertEquals(ROR3(0x0000FFFF, 20), ROR3_sa20(0x0000FFFF));
+assertEquals(ROR3(0x0000FFFF, 20), ROR3_sa20(0x0000FFFF));
+%OptimizeFunctionOnNextCall(ROR3_sa20);
+assertEquals(ROR3(0x0000FFFF, 20), ROR3_sa20(0x0000FFFF));
+
+// ROR3_sa40
+assertEquals(ROR3(0x0000FFFF, 40), ROR3_sa40(0x0000FFFF));
+assertEquals(ROR3(0x0000FFFF, 40), ROR3_sa40(0x0000FFFF));
+%OptimizeFunctionOnNextCall(ROR3_sa40);
+assertEquals(ROR3(0x0000FFFF, 40), ROR3_sa40(0x0000FFFF));
+
+// ROR4_sa20
+assertEquals(ROR4(0x0000FFFF, 20), ROR4_sa20(0x0000FFFF));
+assertEquals(ROR4(0x0000FFFF, 20), ROR4_sa20(0x0000FFFF));
+%OptimizeFunctionOnNextCall(ROR4_sa20);
+assertEquals(ROR4(0x0000FFFF, 20), ROR4_sa20(0x0000FFFF));
+
+// ROR4_sa40
+assertEquals(ROR4(0xFFFFFFFF, 40), ROR4_sa40(0xFFFFFFFF));
+assertEquals(ROR4(0xFFFFFFFF, 40), ROR4_sa40(0xFFFFFFFF));
+%OptimizeFunctionOnNextCall(ROR4_sa40);
+assertEquals(ROR4(0xFFFFFFFF, 40), ROR4_sa40(0xFFFFFFFF));
diff --git a/test/mjsunit/compiler/shift-shr.js b/test/mjsunit/compiler/shift-shr.js
new file mode 100644
index 0000000..a300b2a
--- /dev/null
+++ b/test/mjsunit/compiler/shift-shr.js
@@ -0,0 +1,26 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --noopt-safe-uint32-operations
+
+// Check the results of `left >>> right`. The result is always unsigned (and
+// therefore positive).
+function test_shr(left) {
+ var errors = 0;
+
+ for (var i = 1; i < 1024; i++) {
+ var temp = left >>> i;
+ if (temp < 0) {
+ errors++;
+ }
+ }
+
+ return errors;
+}
+
+assertEquals(0, test_shr(1));
+%OptimizeFunctionOnNextCall(test_shr);
+for (var i = 5; i >= -5; i--) {
+ assertEquals(0, test_shr(i));
+}
diff --git a/test/mjsunit/compiler/smi-stores-opt.js b/test/mjsunit/compiler/smi-stores-opt.js
new file mode 100644
index 0000000..ca0923a
--- /dev/null
+++ b/test/mjsunit/compiler/smi-stores-opt.js
@@ -0,0 +1,49 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var o = {a:1.5};
+o.a = 0;
+var a = o.a;
+
+function g() {
+ return 1;
+}
+
+var o2 = {a:{}};
+
+function f() {
+ var result = {a: a};
+ var literal = {x:g()};
+ return [result, literal];
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f()[1].x);
diff --git a/test/mjsunit/compiler/store-elimination.js b/test/mjsunit/compiler/store-elimination.js
new file mode 100644
index 0000000..1806ed9
--- /dev/null
+++ b/test/mjsunit/compiler/store-elimination.js
@@ -0,0 +1,94 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --store-elimination
+
+// Test local elimination of unobservable stores.
+
+function B(x, y) {
+ this.x = x;
+ this.y = y;
+ return this;
+}
+
+function test_store_store() {
+ var a = new B(1, 2);
+ a.x = 3; // eliminatable.
+ a.x = 4;
+ return a.x;
+}
+
+function test_store_load_store1() {
+ var a = new B(6, 7);
+ a.x = 3; // eliminatable.
+ var r = a.y;
+ a.x = 4;
+ return r;
+}
+
+function test_store_load_store2() {
+ var a = new B(6, 8);
+ a.x = 3; // not eliminatable, unless next load is eliminated.
+ var r = a.x;
+ a.x = 4;
+ return r;
+}
+
+function test_store_call_store() {
+ var a = new B(2, 9);
+ a.x = 3; // not eliminatable.
+ killall();
+ a.x = 4;
+ return a.y;
+}
+
+function test_store_deopt_store() {
+ var a = new B(2, 1);
+ a.x = 3; // not eliminatable (implicit ValueOf following)
+ var c = a + 2;
+ a.x = 4;
+ return a.y;
+}
+
+function killall() {
+ try { } catch(e) { }
+}
+
+%NeverOptimizeFunction(killall);
+
+function test(x, f) {
+ assertEquals(x, f());
+ assertEquals(x, f());
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(x, f());
+}
+
+test(4, test_store_store);
+test(7, test_store_load_store1);
+test(3, test_store_load_store2);
+test(9, test_store_call_store);
+test(1, test_store_deopt_store);
diff --git a/test/mjsunit/compiler/to-fast-properties.js b/test/mjsunit/compiler/to-fast-properties.js
new file mode 100644
index 0000000..26829d9
--- /dev/null
+++ b/test/mjsunit/compiler/to-fast-properties.js
@@ -0,0 +1,43 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This test requires OSR or --stress-runs=3 to optimize the top level script.
+
+for (var i = 0; i < 3; i++) {
+ // HToFastProperties is used for top-level object literals that have
+ // function property.
+ var obj = {
+ index: function() { return i; },
+ x: 0
+ }
+ var n = 10000;
+ // Loop to hit OSR.
+ for (var j = 0; j < n; j++) {
+ obj.x += i;
+ }
+ assertEquals(obj.index() * n, obj.x);
+}
diff --git a/test/mjsunit/compiler/type-feedback-after-throw.js b/test/mjsunit/compiler/type-feedback-after-throw.js
new file mode 100644
index 0000000..891e315
--- /dev/null
+++ b/test/mjsunit/compiler/type-feedback-after-throw.js
@@ -0,0 +1,38 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ throw "Error";
+ return 1 > 5;
+};
+
+try { foo() } catch(e) {}
+try { foo() } catch(e) {}
+%OptimizeFunctionOnNextCall(foo);
+try { foo() } catch(e) {}
diff --git a/test/mjsunit/compiler/uint32.js b/test/mjsunit/compiler/uint32.js
new file mode 100644
index 0000000..abed285
--- /dev/null
+++ b/test/mjsunit/compiler/uint32.js
@@ -0,0 +1,173 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+// Test uint32 handing in optimized frames.
+
+var K1 = 0x7fffffff;
+var K2 = 0xffffffff;
+
+var uint32_array = new Uint32Array(2);
+uint32_array[0] = K1;
+uint32_array[1] = K2;
+
+function ChangeI2T(arr, i) {
+ return uint32_array[i];
+}
+
+assertEquals(K1, ChangeI2T(uint32_array, 0));
+assertEquals(K2, ChangeI2T(uint32_array, 1));
+%OptimizeFunctionOnNextCall(ChangeI2T);
+assertEquals(K1, ChangeI2T(uint32_array, 0));
+// Loop to force inline allocation failure and a call into runtime.
+for (var i = 0; i < 80000; i++) {
+ assertEquals(K2, ChangeI2T(uint32_array, 1));
+}
+
+function SideEffect() {
+ with ({}) { } // not inlinable
+}
+
+function Deopt(obj, arr, i) {
+ var x = arr[i];
+ SideEffect(); // x will be used by HSimulate.
+ obj.x;
+ return x;
+}
+
+assertEquals(K1, Deopt({x: 0}, uint32_array, 0));
+assertEquals(K2, Deopt({x: 0}, uint32_array, 1));
+%OptimizeFunctionOnNextCall(Deopt);
+assertEquals(K2, Deopt({}, uint32_array, 1));
+
+function ChangeI2D(arr) {
+ // This addition will have a double type feedback so ChangeI2D will
+ // be generated for its operands.
+ return arr[0] + arr[1];
+}
+
+assertEquals(K1 + K2, ChangeI2D(uint32_array));
+assertEquals(K1 + K2, ChangeI2D(uint32_array));
+%OptimizeFunctionOnNextCall(ChangeI2D);
+assertEquals(K1 + K2, ChangeI2D(uint32_array));
+
+function ShrShr(val) {
+ return (val >>> 0) >>> 1;
+}
+
+assertEquals(K1, ShrShr(K2 | 0));
+assertEquals(K1, ShrShr(K2 | 0));
+%OptimizeFunctionOnNextCall(ShrShr);
+assertEquals(K1, ShrShr(K2 | 0));
+
+function SarShr(val) {
+ return val >> (-2 >>> 0);
+}
+
+var K3 = 0x80000000;
+assertEquals(-2, SarShr(K3 | 0));
+assertEquals(-2, SarShr(K3 | 0));
+%OptimizeFunctionOnNextCall(SarShr);
+assertEquals(-2, SarShr(K3 | 0));
+
+function Uint32Phi(a, b, c) {
+ var i = a ? (b >>> 0) : (c >>> 0);
+ return (i | 0);
+}
+
+var K4 = 0x80000001;
+assertEquals(K3 | 0, Uint32Phi(true, K3, K4));
+assertEquals(K4 | 0, Uint32Phi(false, K3, K4));
+assertEquals(K3 | 0, Uint32Phi(true, K3, K4));
+assertEquals(K4 | 0, Uint32Phi(false, K3, K4));
+%OptimizeFunctionOnNextCall(Uint32Phi);
+assertEquals(K3 | 0, Uint32Phi(true, K3, K4));
+assertEquals(K4 | 0, Uint32Phi(false, K3, K4));
+
+function NonUint32Phi(a, b, c) {
+ var i = a ? (b >>> 0) : c;
+ return (i | 0);
+}
+
+assertEquals(K3 | 0, NonUint32Phi(true, K3, K4));
+assertEquals(K4 | 0, NonUint32Phi(false, K3, K4));
+assertEquals(K3 | 0, NonUint32Phi(true, K3, K4));
+assertEquals(K4 | 0, NonUint32Phi(false, K3, K4));
+%OptimizeFunctionOnNextCall(NonUint32Phi);
+assertEquals(K3 | 0, NonUint32Phi(true, K3, K4));
+assertEquals(K4 | 0, NonUint32Phi(false, K3, K4));
+
+function PhiOfPhi(x) {
+ var a = (x >>> 0);
+ for (var i = 0; i < 2; i++) {
+ for (var j = 0; j < 2; j++) {
+ a = (a >>> 0);
+ }
+ }
+ return (a | 0);
+}
+
+assertEquals(1, PhiOfPhi(1));
+assertEquals(1, PhiOfPhi(1));
+%OptimizeFunctionOnNextCall(PhiOfPhi);
+assertEquals(K3 | 0, PhiOfPhi(K3));
+
+function PhiOfPhiUnsafe(x) {
+ var a = x >>> 0;
+ for (var i = 0; i < 2; i++) {
+ for (var j = 0; j < 2; j++) {
+ a = (a >>> 0);
+ }
+ }
+ return a + a;
+}
+
+assertEquals(2, PhiOfPhiUnsafe(1));
+assertEquals(2, PhiOfPhiUnsafe(1));
+%OptimizeFunctionOnNextCall(PhiOfPhiUnsafe);
+assertEquals(2 * K3, PhiOfPhiUnsafe(K3));
+
+var old_array = new Array(1000);
+
+for (var i = 0; i < old_array.length; i++) old_array[i] = null;
+
+// Force promotion.
+gc();
+gc();
+
+function FillOldArrayWithHeapNumbers(N) {
+ for (var i = 0; i < N; i++) {
+ old_array[i] = uint32_array[1];
+ }
+}
+
+FillOldArrayWithHeapNumbers(1);
+FillOldArrayWithHeapNumbers(1);
+%OptimizeFunctionOnNextCall(FillOldArrayWithHeapNumbers);
+FillOldArrayWithHeapNumbers(old_array.length);
+gc();