Deoptimizer tests

Adding (very) small tests for deoptimization.
Some of these tests were failing when the safepoints were not found,
after setting the return address.

BUG=V8:6563

Change-Id: I3af36b193a5982cd73414cc1884c5f0a7a727f5a
Reviewed-on: https://chromium-review.googlesource.com/584751Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Juliana Patricia Vicente Franco <jupvfranco@google.com>
Cr-Commit-Position: refs/heads/master@{#46922}

test/mjsunit/compiler/deopt-eager-and-lazy.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file
+
+// Flags: --allow-natives-syntax
+
+
+function f() {
+  %DeoptimizeFunction(g);
+}
+%NeverOptimizeFunction(f);
+
+function g(o) {
+  f();
+  return h(o);
+}
+
+function h(o) {
+  return o.x;
+}
+
+g({x : 1});
+g({x : 2});
+%OptimizeFunctionOnNextCall(g);
+%OptimizeFunctionOnNextCall(h);
+g({x : 3});
+g({y : 1, x : 3});

test/mjsunit/compiler/deopt-eager-var-mutation-ite.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file
+
+// Flags: --allow-natives-syntax
+
+var foo = { x : 0, y : 1 }
+
+function f(b) {
+  h(b);
+  return foo.x;
+}
+
+function h(b) {
+  g(b);
+  return foo.x;
+}
+
+function g(b) {
+  if (b) {
+    foo = { x : 536 };
+  } // It should trigger an eager deoptimization when b=true.
+}
+
+f(false); f(false);
+%OptimizeFunctionOnNextCall(f);
+f(false);
+assertEquals(f(true), 536);

test/mjsunit/compiler/deopt-eager-with-freeze.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file
+
+// Flags: --allow-natives-syntax
+
+function useObject(obj) {
+  if (!Object.isFrozen(obj)) {
+    var t = obj.f;
+    obj.f = t * 2;
+  }
+  return obj.f;
+}
+
+var o = {f: 1, g: 2}
+assertEquals(useObject(o), 2);
+assertEquals(useObject(o), 4);
+%OptimizeFunctionOnNextCall(useObject);
+Object.freeze(o);
+assertEquals(useObject(o), 4);

test/mjsunit/compiler/deopt-followed-by-gc.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file
+
+// Flags: --allow-natives-syntax --expose-gc
+
+// Testing GC after setting the pc on the stack.
+// There must be a safepoint for the trampoline.
+
+function opt_me() {
+  deopt();
+}
+
+function deopt() {
+  %DeoptimizeFunction(opt_me);
+  gc();
+}
+%NeverOptimizeFunction(deopt);
+
+opt_me();
+opt_me();
+%OptimizeFunctionOnNextCall(opt_me);
+opt_me();

test/mjsunit/compiler/deopt-lazy-freeze.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file
+
+// Flags: --allow-natives-syntax
+
+var b = false;
+var obj = {f: 1, g: 2};
+
+function setMutability() {
+  if (b) Object.freeze(obj);
+}
+%NeverOptimizeFunction(setMutability);
+
+function setAndUseObject() {
+  setMutability(obj);
+  if (!Object.isFrozen(obj)) {
+    var t = obj.f;
+    obj.f = t * 2;
+  }
+  return obj.f;
+}
+
+assertEquals(setAndUseObject(), 2);
+assertEquals(setAndUseObject(), 4);
+%OptimizeFunctionOnNextCall(setAndUseObject);
+b = true;
+assertEquals(setAndUseObject(), 4);

test/mjsunit/compiler/deopt-lazy-shape-mutation.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file
+
+// Flags: --allow-natives-syntax
+
+var b = false;
+
+function change_o() {
+  if (b) o = { y : 1, x : 0};
+}
+%NeverOptimizeFunction(change_o);
+
+var o = { x : 1 };
+function f() {
+  change_o();
+  return o.x;
+}
+
+f(); f();
+%OptimizeFunctionOnNextCall(f);
+b = true;
+f();

test/mjsunit/compiler/deopt-lazy-var-mutation.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file
+
+// Flags: --allow-natives-syntax
+
+var x = 1;
+var y = 1;
+
+function g(a) {
+ x = a;
+ y = a;
+}
+%NeverOptimizeFunction(g);
+
+function foo(a) {
+ g(a);
+ return x + y;
+}
+
+var o = 1;
+assertEquals(foo(o), 2);
+assertEquals(foo(o), 2);
+%OptimizeFunctionOnNextCall(foo);
+o = 2;
+assertEquals(foo(o), 4);

test/mjsunit/compiler/deopt-many-lazy.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file
+
+// Flags: --allow-natives-syntax
+
+
+// It optimizes and lazily deoptimizes 2 functions several times.
+
+function f() {
+  g();
+}
+
+function g() {
+  %DeoptimizeFunction(f);
+}
+
+function a() {
+  b();
+}
+
+function b() {
+  %DeoptimizeFunction(a);
+}
+
+f(); f();
+a(); a();
+for(var i = 0; i < 5; i++) {
+  %OptimizeFunctionOnNextCall(f);
+  %OptimizeFunctionOnNextCall(a);
+  f();
+  a();
+}

test/mjsunit/compiler/deopt-now-lazy.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  %DeoptimizeNow();
+}
+
+%OptimizeFunctionOnNextCall(f);
+f();

test/mjsunit/compiler/deopt-simple-eager.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file
+
+// Flags: --allow-natives-syntax
+
+// Simple eager deoptimization test.
+
+function f(o) {
+  return o.x;
+}
+
+assertEquals(f({x : 2}), 2);
+assertEquals(f({x : 2}), 2);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(f({x : 2}), 2);
+assertEquals(f({y : 1, x  : 3}), 3);

test/mjsunit/compiler/deopt-simple-lazy.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file
+
+// Flags: --allow-natives-syntax
+
+// Simple lazy deoptimization test.
+
+function f() {
+  g();
+}
+
+function g() {
+  %DeoptimizeFunction(f);
+}
+
+f(); f();
+%OptimizeFunctionOnNextCall(f);
+f();

test/mjsunit/compiler/deopt-soft-simple.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file
+
+// Flags: --allow-natives-syntax
+
+
+function change_o() {
+  o = { y : 0, x : 1 };
+}
+
+var o = { x : 1 };
+
+function f() {
+  // It triggers a soft deoptimization.
+  change_o();
+  return o.x;
+}
+
+%OptimizeFunctionOnNextCall(f);
+f();

test/mjsunit/compiler/deopt-twice-on-call.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  g();
+  h();
+}
+
+function g() {
+  %DeoptimizeFunction(f);
+}
+
+function h() {
+  %DeoptimizeFunction(f);
+}
+
+f(); f();
+%OptimizeFunctionOnNextCall(f);
+f();

test/mjsunit/compiler/deopt-twice.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  g();
+}
+
+function g() {
+  %DeoptimizeFunction(f);
+  %DeoptimizeFunction(f);
+}
+
+f(); f();
+%OptimizeFunctionOnNextCall(f);
+f();