Fix failing mjsunit/compiler/call-with-arraylike-or-spread*

Fixes an issue with tests mjsunit/compiler/call-with-arraylike-or-spread*
that fail when run with the fuzzer.

Bug: v8:11821
Change-Id: I6b75c065397d66062a7f552198ca92d151d89a4b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2917814Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#74764}

test/mjsunit/compiler/call-with-arraylike-or-spread-3.js

@@ -9,6 +9,10 @@
 // and assertions would fail. We prevent re-runs.
 // Flags: --nostress-opt --no-always-opt
 
+// The test relies on optimizing/deoptimizing at predictable moments, so
+// it's not suitable for deoptimization fuzzing.
+// Flags: --deopt-every-n-times=0
+
 // Tests for optimization of CallWithSpread and CallWithArrayLike.
 // This test is in a separate file because it invalidates protectors.
 

test/mjsunit/compiler/call-with-arraylike-or-spread-4.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-optimize-apply --opt
+
+// These tests do not work well if this script is run more than once (e.g.
+// --stress-opt); after a few runs the whole function is immediately compiled
+// and assertions would fail. We prevent re-runs.
+// Flags: --nostress-opt --no-always-opt
+
+// The test relies on optimizing/deoptimizing at predictable moments, so
+// this is not suitable for deoptimization fuzzing.
+// Flags: --deopt-every-n-times=0 --interrupt-budget=1024
+
+// Tests for optimization of CallWithSpread and CallWithArrayLike.
+
+// Test deopt when array map changes.
+(function () {
+  "use strict";
+  var sum_js3_got_interpreted = true;
+  function sum_js3(a, b, c) {
+    sum_js3_got_interpreted = %IsBeingInterpreted();
+    return a + b + c;
+  }
+  function foo(x, y, z, str) {
+    let v = [x, y, z];
+    if (str) {
+      v[0] = str;
+    }
+    return sum_js3.apply(null, v);
+  }
+
+  %PrepareFunctionForOptimization(sum_js3);
+  for (let i = 0; i < 5; i++) {
+    %PrepareFunctionForOptimization(foo);
+    assertEquals(78, foo(26, 6, 46, null));
+    assertTrue(sum_js3_got_interpreted);
+
+    // Compile function foo; inlines 'sum_js3' into 'foo'.
+    %OptimizeFunctionOnNextCall(foo);
+    assertEquals(78, foo(26, 6, 46, null));
+    assertOptimized(foo);
+
+    if (i < 3) {
+      assertFalse(sum_js3_got_interpreted);
+    } else {
+      // i: 3: Speculation mode prevents optimization of sum_js3.apply() call.
+      assertTrue(sum_js3_got_interpreted);
+    }
+
+    // This should deoptimize:
+    // i: 0: Deopt soft: insufficient type feedback for generic keyed access.
+    // i: 1,2: Deopt eager: wrong map.
+    // i: 3: Won't deopt anymore.
+    assertEquals("v8646", foo(26, 6, 46, "v8"));
+    assertTrue(sum_js3_got_interpreted);
+
+    if (i < 3) {
+      assertUnoptimized(foo);
+    } else {
+      assertOptimized(foo);
+    }
+  }
+})();

test/mjsunit/compiler/call-with-arraylike-or-spread.js

@@ -9,6 +9,10 @@
 // and assertions would fail. We prevent re-runs.
 // Flags: --nostress-opt --no-always-opt
 
+// Some of the tests rely on optimizing/deoptimizing at predictable moments, so
+// this is not suitable for deoptimization fuzzing.
+// Flags: --deopt-every-n-times=0
+
 // Tests for optimization of CallWithSpread and CallWithArrayLike.
 
 // Test JSCallReducer::ReduceJSCallWithArrayLike.
@@ -122,55 +126,6 @@
   assertOptimized(foo);
 })();
 
-// Test deopt when array map changes.
-(function () {
-  "use strict";
-  var sum_js3_got_interpreted = true;
-  function sum_js3(a, b, c) {
-    sum_js3_got_interpreted = %IsBeingInterpreted();
-    return a + b + c;
-  }
-  function foo(x, y, z, str) {
-    let v = [x, y, z];
-    if (str) {
-      v[0] = str;
-    }
-    return sum_js3.apply(null, v);
-  }
-
-  %PrepareFunctionForOptimization(sum_js3);
-  for (let i = 0; i < 5; i++) {
-    %PrepareFunctionForOptimization(foo);
-    assertEquals(78, foo(26, 6, 46, null));
-    assertTrue(sum_js3_got_interpreted);
-
-    // Compile function foo; inlines 'sum_js3' into 'foo'.
-    %OptimizeFunctionOnNextCall(foo);
-    assertEquals(78, foo(26, 6, 46, null));
-    assertOptimized(foo);
-
-    if (i < 3) {
-      assertFalse(sum_js3_got_interpreted);
-    } else {
-      // i: 3: Speculation mode prevents optimization of sum_js3.apply() call.
-      assertTrue(sum_js3_got_interpreted);
-    }
-
-    // This should deoptimize:
-    // i: 0: Deopt soft: insufficient type feedback for generic keyed access.
-    // i: 1,2: Deopt eager: wrong map.
-    // i: 3: Won't deopt anymore.
-    assertEquals("v8646", foo(26, 6, 46, "v8"));
-    assertTrue(sum_js3_got_interpreted);
-
-    if (i < 3) {
-      assertUnoptimized(foo);
-    } else {
-      assertOptimized(foo);
-    }
-  }
-})();
-
 // Test with FixedDoubleArray.
 (function () {
   "use strict";