[turbofan] Array.prototype.find inlining.

Support inlining Array.prototype.find in Turbofan.
Quick benchmarks show >2x improvement for Smi and
Double packed arrays: https://github.com/peterwmwong/v8-perf/blob/master/array-find-tf/README.md

Bug: chromium:791045, v8:1956
Change-Id: I9a6882be9bc3e1e84df372a24bd0f85897cf92a0
Reviewed-on: https://chromium-review.googlesource.com/818193Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49987}

src/builtins/builtins-array-gen.cc

@@ -1658,6 +1658,65 @@ TF_BUILTIN(ArrayFindLoopContinuation, ArrayBuiltinCodeStubAssembler) {
       MissingPropertyMode::kUseUndefined, ForEachDirection::kForward);
 }
 
+TF_BUILTIN(ArrayFindLoopEagerDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
+  Node* context = Parameter(Descriptor::kContext);
+  Node* receiver = Parameter(Descriptor::kReceiver);
+  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
+  Node* this_arg = Parameter(Descriptor::kThisArg);
+  Node* initial_k = Parameter(Descriptor::kInitialK);
+  Node* len = Parameter(Descriptor::kLength);
+
+  Callable stub(
+      Builtins::CallableFor(isolate(), Builtins::kArrayFindLoopContinuation));
+  Return(CallStub(stub, context, receiver, callbackfn, this_arg,
+                  UndefinedConstant(), receiver, initial_k, len,
+                  UndefinedConstant()));
+}
+
+TF_BUILTIN(ArrayFindLoopLazyDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
+  Node* context = Parameter(Descriptor::kContext);
+  Node* receiver = Parameter(Descriptor::kReceiver);
+  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
+  Node* this_arg = Parameter(Descriptor::kThisArg);
+  Node* initial_k = Parameter(Descriptor::kInitialK);
+  Node* len = Parameter(Descriptor::kLength);
+
+  Callable stub(
+      Builtins::CallableFor(isolate(), Builtins::kArrayFindLoopContinuation));
+  Return(CallStub(stub, context, receiver, callbackfn, this_arg,
+                  UndefinedConstant(), receiver, initial_k, len,
+                  UndefinedConstant()));
+}
+
+TF_BUILTIN(ArrayFindLoopAfterCallbackLazyDeoptContinuation,
+           ArrayBuiltinCodeStubAssembler) {
+  Node* context = Parameter(Descriptor::kContext);
+  Node* receiver = Parameter(Descriptor::kReceiver);
+  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
+  Node* this_arg = Parameter(Descriptor::kThisArg);
+  Node* initial_k = Parameter(Descriptor::kInitialK);
+  Node* len = Parameter(Descriptor::kLength);
+  Node* element = Parameter(Descriptor::kElement);
+  Node* result = Parameter(Descriptor::kResult);
+
+  // This custom lazy deopt point is right after the callback. find() needs
+  // to pick up at the next step, which is returning the element if the callback
+  // value is truthy.  Otherwise, continue the search by calling the
+  // continuation.
+  Label if_true(this), if_false(this);
+  BranchIfToBooleanIsTrue(result, &if_true, &if_false);
+  BIND(&if_true);
+  Return(element);
+  BIND(&if_false);
+  {
+    Callable stub(
+        Builtins::CallableFor(isolate(), Builtins::kArrayFindLoopContinuation));
+    Return(CallStub(stub, context, receiver, callbackfn, this_arg,
+                    UndefinedConstant(), receiver, initial_k, len,
+                    UndefinedConstant()));
+  }
+}
+
 // ES #sec-get-%typedarray%.prototype.find
 TF_BUILTIN(ArrayPrototypeFind, ArrayBuiltinCodeStubAssembler) {
   Node* argc =

src/builtins/builtins-definitions.h

@@ -319,6 +319,12 @@ namespace internal {
   /* ES6 #sec-array.prototype.find */                                          \
   TFS(ArrayFindLoopContinuation, kReceiver, kCallbackFn, kThisArg, kArray,     \
       kObject, kInitialK, kLength, kTo)                                        \
+  TFJ(ArrayFindLoopEagerDeoptContinuation, 4, kCallbackFn, kThisArg,           \
+      kInitialK, kLength)                                                      \
+  TFJ(ArrayFindLoopLazyDeoptContinuation, 5, kCallbackFn, kThisArg, kInitialK, \
+      kLength, kResult)                                                        \
+  TFJ(ArrayFindLoopAfterCallbackLazyDeoptContinuation, 6, kCallbackFn,         \
+      kThisArg, kInitialK, kLength, kElement, kResult)                         \
   TFJ(ArrayPrototypeFind, SharedFunctionInfo::kDontAdaptArgumentsSentinel)     \
   /* ES6 #sec-array.prototype.findIndex */                                     \
   TFS(ArrayFindIndexLoopContinuation, kReceiver, kCallbackFn, kThisArg,        \

src/builtins/builtins.cc

@@ -172,6 +172,9 @@ Callable Builtins::CallableFor(Isolate* isolate, Name name) {
 #undef CASE_OTHER
     case kArrayFilterLoopEagerDeoptContinuation:
     case kArrayFilterLoopLazyDeoptContinuation:
+    case kArrayFindLoopEagerDeoptContinuation:
+    case kArrayFindLoopLazyDeoptContinuation:
+    case kArrayFindLoopAfterCallbackLazyDeoptContinuation:
     case kArrayForEach:
     case kArrayForEachLoopEagerDeoptContinuation:
     case kArrayForEachLoopLazyDeoptContinuation:
@@ -213,6 +216,10 @@ bool Builtins::IsLazy(int index) {
   // TODO(wasm): Remove wasm builtins once immovability is no longer required.
   switch (index) {
     case kAbort:  // Required by wasm.
+    case kArrayFindLoopEagerDeoptContinuation:  // https://crbug.com/v8/6786.
+    case kArrayFindLoopLazyDeoptContinuation:   // https://crbug.com/v8/6786.
+    // https://crbug.com/v8/6786.
+    case kArrayFindLoopAfterCallbackLazyDeoptContinuation:
     case kArrayForEachLoopEagerDeoptContinuation:  // https://crbug.com/v8/6786.
     case kArrayForEachLoopLazyDeoptContinuation:   // https://crbug.com/v8/6786.
     case kArrayMapLoopEagerDeoptContinuation:      // https://crbug.com/v8/6786.

src/compiler/js-call-reducer.cc

@@ -1374,6 +1374,179 @@ Reduction JSCallReducer::ReduceArrayFilter(Handle<JSFunction> function,
   return Replace(a);
 }
 
+Reduction JSCallReducer::ReduceArrayFind(Handle<JSFunction> function,
+                                         Node* node) {
+  if (!FLAG_turbo_inline_array_builtins) return NoChange();
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  Node* outer_frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* context = NodeProperties::GetContextInput(node);
+  CallParameters const& p = CallParametersOf(node->op());
+
+  // Try to determine the {receiver} map.
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* fncallback = node->op()->ValueInputCount() > 2
+                         ? NodeProperties::GetValueInput(node, 2)
+                         : jsgraph()->UndefinedConstant();
+  Node* this_arg = node->op()->ValueInputCount() > 3
+                       ? NodeProperties::GetValueInput(node, 3)
+                       : jsgraph()->UndefinedConstant();
+  ZoneHandleSet<Map> receiver_maps;
+  NodeProperties::InferReceiverMapsResult result =
+      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+
+  if (result != NodeProperties::kReliableReceiverMaps) return NoChange();
+  if (receiver_maps.size() == 0) return NoChange();
+
+  const ElementsKind kind = receiver_maps[0]->elements_kind();
+  for (Handle<Map> receiver_map : receiver_maps) {
+    if (!CanInlineArrayIteratingBuiltin(receiver_map)) return NoChange();
+    // We can handle different maps, as long as their elements kind are the
+    // same.
+    if (receiver_map->elements_kind() != kind) return NoChange();
+  }
+
+  // Install code dependencies on the {receiver} prototype maps and the
+  // global array protector cell.
+  dependencies()->AssumePropertyCell(factory()->no_elements_protector());
+
+  Node* k = jsgraph()->ZeroConstant();
+
+  Node* original_length = effect = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForJSArrayLength(PACKED_ELEMENTS)),
+      receiver, effect, control);
+
+  std::vector<Node*> checkpoint_params(
+      {receiver, fncallback, this_arg, k, original_length});
+  const int stack_parameters = static_cast<int>(checkpoint_params.size());
+
+  // Check whether the given callback function is callable. Note that this has
+  // to happen outside the loop to make sure we also throw on empty arrays.
+  Node* check_fail = nullptr;
+  Node* check_throw = nullptr;
+  {
+    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
+        jsgraph(), function, Builtins::kArrayFindLoopLazyDeoptContinuation,
+        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
+        outer_frame_state, ContinuationFrameStateMode::LAZY);
+    WireInCallbackIsCallableCheck(fncallback, context, frame_state, effect,
+                                  &control, &check_fail, &check_throw);
+  }
+
+  // Start the loop.
+  Node* loop = control = graph()->NewNode(common()->Loop(2), control, control);
+  Node* eloop = effect =
+      graph()->NewNode(common()->EffectPhi(2), effect, effect, loop);
+  Node* terminate = graph()->NewNode(common()->Terminate(), eloop, loop);
+  NodeProperties::MergeControlToEnd(graph(), common(), terminate);
+  Node* vloop = k = graph()->NewNode(
+      common()->Phi(MachineRepresentation::kTagged, 2), k, k, loop);
+  checkpoint_params[3] = k;
+
+  // Check if we've iterated past the last element of the array.
+  Node* if_false = nullptr;
+  {
+    Node* continue_test =
+        graph()->NewNode(simplified()->NumberLessThan(), k, original_length);
+    Node* continue_branch = graph()->NewNode(
+        common()->Branch(BranchHint::kTrue), continue_test, control);
+    control = graph()->NewNode(common()->IfTrue(), continue_branch);
+    if_false = graph()->NewNode(common()->IfFalse(), continue_branch);
+  }
+
+  // Check the map hasn't changed during the iteration.
+  {
+    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
+        jsgraph(), function, Builtins::kArrayFindLoopEagerDeoptContinuation,
+        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
+        outer_frame_state, ContinuationFrameStateMode::EAGER);
+
+    effect =
+        graph()->NewNode(common()->Checkpoint(), frame_state, effect, control);
+
+    effect = graph()->NewNode(
+        simplified()->CheckMaps(CheckMapsFlag::kNone, receiver_maps), receiver,
+        effect, control);
+  }
+
+  // Increment k for the next iteration.
+  Node* next_k = checkpoint_params[3] =
+      graph()->NewNode(simplified()->NumberAdd(), k, jsgraph()->Constant(1));
+
+  // Load k-th element from receiver.
+  Node* element = SafeLoadElement(kind, receiver, control, &effect, &k);
+
+  // Replace holes with undefined.
+  if (IsHoleyElementsKind(kind)) {
+    element = graph()->NewNode(
+        common()->Select(MachineRepresentation::kTagged, BranchHint::kFalse),
+        graph()->NewNode(simplified()->ReferenceEqual(), element,
+                         jsgraph()->TheHoleConstant()),
+        jsgraph()->UndefinedConstant(), element);
+  }
+
+  // Call the callback.
+  Node* callback_value = nullptr;
+  {
+    std::vector<Node*> call_checkpoint_params(
+        {receiver, fncallback, this_arg, next_k, original_length, element});
+    const int call_stack_parameters =
+        static_cast<int>(call_checkpoint_params.size());
+
+    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
+        jsgraph(), function,
+        Builtins::kArrayFindLoopAfterCallbackLazyDeoptContinuation,
+        node->InputAt(0), context, &call_checkpoint_params[0],
+        call_stack_parameters, outer_frame_state,
+        ContinuationFrameStateMode::LAZY);
+
+    callback_value = control = effect = graph()->NewNode(
+        javascript()->Call(5, p.frequency()), fncallback, this_arg, element, k,
+        receiver, context, frame_state, effect, control);
+  }
+
+  // Rewire potential exception edges.
+  Node* on_exception = nullptr;
+  if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
+    RewirePostCallbackExceptionEdges(check_throw, on_exception, effect,
+                                     &check_fail, &control);
+  }
+
+  // Check whether the given callback function returned a truthy value.
+  Node* boolean_result =
+      graph()->NewNode(simplified()->ToBoolean(), callback_value);
+  Node* efound_branch = effect;
+  Node* found_branch = graph()->NewNode(common()->Branch(BranchHint::kFalse),
+                                        boolean_result, control);
+  Node* if_found = graph()->NewNode(common()->IfTrue(), found_branch);
+  Node* if_notfound = graph()->NewNode(common()->IfFalse(), found_branch);
+  control = if_notfound;
+
+  // Close the loop.
+  loop->ReplaceInput(1, control);
+  vloop->ReplaceInput(1, next_k);
+  eloop->ReplaceInput(1, effect);
+
+  control = graph()->NewNode(common()->Merge(2), if_found, if_false);
+  effect =
+      graph()->NewNode(common()->EffectPhi(2), efound_branch, eloop, control);
+  Node* return_value =
+      graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                       element, jsgraph()->UndefinedConstant(), control);
+
+  // Wire up the branch for the case when IsCallable fails for the callback.
+  // Since {check_throw} is an unconditional throw, it's impossible to
+  // return a successful completion. Therefore, we simply connect the successful
+  // completion to the graph end.
+  Node* throw_node =
+      graph()->NewNode(common()->Throw(), check_throw, check_fail);
+  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
+
+  ReplaceWithValue(node, return_value, effect, control);
+  return Replace(return_value);
+}
+
 Node* JSCallReducer::DoFilterPostCallbackWork(ElementsKind kind, Node** control,
                                               Node** effect, Node* a, Node* to,
                                               Node* element,
@@ -1923,6 +2096,8 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
           return ReduceArrayMap(function, node);
         case Builtins::kArrayFilter:
           return ReduceArrayFilter(function, node);
+        case Builtins::kArrayPrototypeFind:
+          return ReduceArrayFind(function, node);
         case Builtins::kReturnReceiver:
           return ReduceReturnReceiver(node);
         default:

src/compiler/js-call-reducer.h

@@ -74,6 +74,7 @@ class JSCallReducer final : public AdvancedReducer {
   Reduction ReduceArrayForEach(Handle<JSFunction> function, Node* node);
   Reduction ReduceArrayMap(Handle<JSFunction> function, Node* node);
   Reduction ReduceArrayFilter(Handle<JSFunction> function, Node* node);
+  Reduction ReduceArrayFind(Handle<JSFunction> function, Node* node);
   Reduction ReduceCallOrConstructWithArrayLikeOrSpread(
       Node* node, int arity, CallFrequency const& frequency,
       VectorSlotPair const& feedback);

test/mjsunit/optimized-array-find.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-inline-array-builtins --opt
+// Flags: --no-always-opt
+
+// Unknown field access leads to soft-deopt unrelated to find, should still
+// lead to correct result.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
+             20, 21, 22, 23, 24, 25];
+  let result = 0;
+  function eagerDeoptInCalled(deopt) {
+    return a.find((v, i) => {
+      if (i === 13 && deopt) {
+        a.abc = 25;
+      }
+      result += v;
+      return v === 20;
+    });
+  }
+  eagerDeoptInCalled();
+  eagerDeoptInCalled();
+  %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
+  eagerDeoptInCalled();
+  assertEquals(20, eagerDeoptInCalled(true));
+  eagerDeoptInCalled();
+  assertEquals(1050, result);
+})();
+
+// Length change detected during loop, must cause properly handled eager deopt.
+(() => {
+  let called_values;
+  function eagerDeoptInCalled(deopt) {
+    const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+    called_values = [];
+    return a.find((v,i) => {
+      called_values.push(v);
+      a.length = (i === 5 && deopt) ? 8 : 10;
+      return v === 9;
+    });
+  }
+  assertEquals(9, eagerDeoptInCalled());
+  assertArrayEquals([1, 2, 3, 4, 5, 6, 7, 8, 9], called_values);
+  eagerDeoptInCalled();
+  %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
+  assertEquals(9, eagerDeoptInCalled());
+  assertEquals(undefined, eagerDeoptInCalled(true));
+  assertArrayEquals([1, 2, 3, 4, 5, 6, 7, 8, undefined, undefined],
+                    called_values);
+  eagerDeoptInCalled();
+})();
+
+// Lazy deopt from a callback that changes the input array. Deopt in a callback
+// execution that returns true.
+(() => {
+  const a = [1, 2, 3, 4, 5];
+  function lazyChanger(deopt) {
+    return a.find((v, i) => {
+      if (i === 3 && deopt) {
+        a[3] = 100;
+        %DeoptimizeNow();
+       }
+      return v > 3;
+    });
+  }
+  assertEquals(4, lazyChanger());
+  lazyChanger();
+  %OptimizeFunctionOnNextCall(lazyChanger);
+  assertEquals(4, lazyChanger(true));
+  assertEquals(100, lazyChanger());
+})();
+
+// Lazy deopt from a callback that changes the input array. Deopt in a callback
+// execution that returns false.
+(() => {
+  const a = [1, 2, 3, 4, 5];
+  function lazyChanger(deopt) {
+    return a.find((v, i) => {
+      if (i === 2 && deopt) {
+        a[3] = 100;
+        %DeoptimizeNow();
+       }
+      return v > 3;
+    });
+  }
+  assertEquals(4, lazyChanger());
+  lazyChanger();
+  %OptimizeFunctionOnNextCall(lazyChanger);
+  assertEquals(100, lazyChanger(true));
+  assertEquals(100, lazyChanger());
+})();
+
+// Escape analyzed array
+(() => {
+  let result = 0;
+  function eagerDeoptInCalled(deopt) {
+    const a_noescape = [0, 1, 2, 3, 4, 5];
+    a_noescape.find((v, i) => {
+      result += v | 0;
+      if (i === 13 && deopt) {
+        a_noescape.length = 25;
+      }
+      return false;
+    });
+  }
+  eagerDeoptInCalled();
+  eagerDeoptInCalled();
+  %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
+  eagerDeoptInCalled();
+  eagerDeoptInCalled(true);
+  eagerDeoptInCalled();
+  assertEquals(75, result);
+})();
+
+// Lazy deopt from runtime call from inlined callback function.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
+             20, 21, 22, 23, 24, 25];
+  let result = 0;
+  function lazyDeopt(deopt) {
+    a.find((v, i) => {
+      result += i;
+      if (i === 13 && deopt) {
+        %DeoptimizeNow();
+      }
+      return false;
+    });
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  lazyDeopt();
+  lazyDeopt(true);
+  lazyDeopt();
+  assertEquals(1500, result);
+})();
+
+// Lazy deopt from runtime call from non-inline callback function.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
+             20, 21, 22, 23, 24, 25];
+  let result = 0;
+  function lazyDeopt(deopt) {
+    function callback(v, i) {
+      result += i;
+      if (i === 13 && deopt) {
+        %DeoptimizeNow();
+      }
+      return false;
+    }
+    %NeverOptimizeFunction(callback);
+    a.find(callback);
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  lazyDeopt();
+  lazyDeopt(true);
+  lazyDeopt();
+  assertEquals(1500, result);
+})();
+
+// Call to a.find is done inside a try-catch block and the callback function
+// being called actually throws.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
+             20, 21, 22, 23, 24, 25];
+  let caught = false;
+  function lazyDeopt(deopt) {
+    try {
+      a.find((v, i) => {
+        if (i === 1 && deopt) {
+          throw("a");
+        }
+        return false;
+      });
+    } catch (e) {
+      caught = true;
+    }
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  lazyDeopt();
+  assertDoesNotThrow(() => lazyDeopt(true));
+  assertTrue(caught);
+  lazyDeopt();
+})();
+
+// Call to a.find is done inside a try-catch block and the callback function
+// being called actually throws, but the callback is not inlined.
+(() => {
+  let a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+  let caught = false;
+  function lazyDeopt(deopt) {
+    function callback(v, i) {
+      if (i === 1 && deopt) {
+        throw("a");
+      }
+      return false;
+    }
+    %NeverOptimizeFunction(callback);
+    try {
+      a.find(callback);
+    } catch (e) {
+      caught = true;
+    }
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  lazyDeopt();
+  assertDoesNotThrow(() => lazyDeopt(true));
+  assertTrue(caught);
+  lazyDeopt();
+})();
+
+// Call to a.find is done inside a try-catch block and the callback function
+// being called throws into a deoptimized caller function.
+(function TestThrowIntoDeoptimizedOuter() {
+  const a = [1, 2, 3, 4];
+  function lazyDeopt(deopt) {
+    function callback(v, i) {
+      if (i === 1 && deopt) {
+        %DeoptimizeFunction(lazyDeopt);
+        throw "some exception";
+      }
+      return v === 3;
+    }
+    %NeverOptimizeFunction(callback);
+    let result = 0;
+    try {
+      result = a.find(callback);
+    } catch (e) {
+      assertEquals("some exception", e);
+      result = "nope";
+    }
+    return result;
+  }
+  assertEquals(3, lazyDeopt(false));
+  assertEquals(3, lazyDeopt(false));
+  assertEquals("nope", lazyDeopt(true));
+  assertEquals("nope", lazyDeopt(true));
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  assertEquals(3, lazyDeopt(false));
+  assertEquals("nope", lazyDeopt(true));
+})();
+
+// An error generated inside the callback includes find in it's
+// stack trace.
+(() => {
+  const re = /Array\.find/;
+  function lazyDeopt(deopt) {
+    const b = [1, 2, 3];
+    let result = 0;
+    b.find((v, i) => {
+      result += v;
+      if (i === 1) {
+        const e = new Error();
+        assertTrue(re.exec(e.stack) !== null);
+      }
+      return false;
+    });
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  lazyDeopt();
+})();
+
+// An error generated inside a non-inlined callback function also
+// includes find in it's stack trace.
+(() => {
+  const re = /Array\.find/;
+  function lazyDeopt(deopt) {
+    const b = [1, 2, 3];
+    let did_assert_error = false;
+    let result = 0;
+    function callback(v, i) {
+      result += v;
+      if (i === 1) {
+        const e = new Error();
+        assertTrue(re.exec(e.stack) !== null);
+        did_assert_error = true;
+      }
+      return false;
+    }
+    %NeverOptimizeFunction(callback);
+    b.find(callback);
+    return did_assert_error;
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  assertTrue(lazyDeopt());
+})();
+
+// An error generated inside a recently deoptimized callback function
+// includes find in it's stack trace.
+(() => {
+  const re = /Array\.find/;
+  function lazyDeopt(deopt) {
+    const b = [1, 2, 3];
+    let did_assert_error = false;
+    let result = 0;
+    b.find((v, i) => {
+      result += v;
+      if (i === 1) {
+        %DeoptimizeNow();
+      } else if (i === 2) {
+        const e = new Error();
+        assertTrue(re.exec(e.stack) !== null);
+        did_assert_error = true;
+      }
+      return false;
+    });
+    return did_assert_error;
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  assertTrue(lazyDeopt());
+})();
+
+// Verify that various exception edges are handled appropriately.
+// The thrown Error object should always indicate it was created from
+// a find call stack.
+(() => {
+  const re = /Array\.find/;
+  const a = [1, 2, 3];
+  let result = 0;
+  function lazyDeopt() {
+    a.find((v, i) => {
+      result += i;
+      if (i === 1) {
+        %DeoptimizeFunction(lazyDeopt);
+        throw new Error();
+      }
+      return false;
+    });
+  }
+  assertThrows(() => lazyDeopt());
+  assertThrows(() => lazyDeopt());
+  try {
+    lazyDeopt();
+  } catch (e) {
+    assertTrue(re.exec(e.stack) !== null);
+  }
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  try {
+    lazyDeopt();
+  } catch (e) {
+    assertTrue(re.exec(e.stack) !== null);
+  }
+})();
+
+// Messing with the Array prototype causes deoptimization.
+(() => {
+  const a = [1, 2, 3];
+  let result = 0;
+  function prototypeChanged() {
+    a.find((v, i) => {
+      result += v;
+      return false;
+    });
+  }
+  prototypeChanged();
+  prototypeChanged();
+  %OptimizeFunctionOnNextCall(prototypeChanged);
+  prototypeChanged();
+  a.constructor = {};
+  prototypeChanged();
+  assertUnoptimized(prototypeChanged);
+  assertEquals(24, result);
+})();
+
+// Verify holes are replaced with undefined.
+(() => {
+  const a = [1, 2, , 3, 4];
+  function withHoles() {
+    const callback_values = [];
+    a.find(v => {
+      callback_values.push(v);
+      return false;
+    });
+    return callback_values;
+  }
+  withHoles();
+  withHoles();
+  %OptimizeFunctionOnNextCall(withHoles);
+  assertArrayEquals([1, 2, undefined, 3, 4], withHoles());
+})();