Add deopt fuzzer tool.

Can be run as a stand-alone script like run-tests.

Executes first all tests of a given test suite to collect the maximum number of possible deopt points. Runs then a fuzzing phase with artificial deoptimizations triggered during testing.

Works for now with mjsunit and ia32 only.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/19931005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15855 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

test/mjsunit/mjsunit.status

@@ -242,3 +242,22 @@ regress/regress-165637: SKIP
 
 # Skip long running test that times out in debug mode and goes OOM on NaCl.
 regress/regress-crbug-160010: SKIP
+
+##############################################################################
+[ $deopt_fuzzer == True ]
+
+# Skip tests that are not suitable for deoptimization fuzzing.
+assert-opt-and-deopt: SKIP
+never-optimize: SKIP
+regress/regress-2185-2: SKIP
+harmony/object-observe: SKIP
+readonly: SKIP
+array-feedback: SKIP
+
+# Deopt every n garbage collections collides with the deopt every n times flag.
+regress/regress-2653: SKIP
+
+# Issue 2795:
+array-store-and-grow: SKIP if $mode == debug
+
+

tools/run-tests.py

@@ -303,7 +303,8 @@ def Execute(arch, mode, args, options, suites, workspace):
     "mode": mode,
     "arch": arch,
     "system": utils.GuessOS(),
-    "isolates": options.isolates
+    "isolates": options.isolates,
+    "deopt_fuzzer": False,
   }
   all_tests = []
   num_tests = 0