[builtins] Enable embedded builtins and add testing variants

This enables the v8_enable_embedded_builtins gn flag on non-ia32 builds
and adds a new --stress-off-heap-code test mode to fyi bots.

v8_enable_embedded_builtins=true changes accesses to constants and
external references to go through the root list in builtins code.

--stress-off-heap-code copies builtins code off-heap on isolate
creation.

A few drive-by-fixes:
- ensure that we actually inspect the correct builtin during
  isolate-independence testing.
- relax tests to decrease maintenance (now we only fail if a builtin
  should be isolate-independent but isn't).
- switch to a different off-heap-trampoline register on arm due to
  conflicts with custom stub linkages.

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:6666
Change-Id: I09ad3c75cb4342f4c548ea780f275993730896c8
Reviewed-on: https://chromium-review.googlesource.com/934281
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51717}

BUILD.gn

@@ -65,8 +65,8 @@ declare_args() {
   v8_enable_fast_mksnapshot = false
 
   # Enable embedded builtins.
-  # TODO(jgruber,v8:6666): Support ia32.
-  v8_enable_embedded_builtins = false
+  # TODO(jgruber,v8:6666): Support ia32 and maybe MSVC.
+  v8_enable_embedded_builtins = v8_current_cpu != "x86" && (!is_win || is_clang)
 
   # Enable code-generation-time checking of types in the CodeStubAssembler.
   v8_enable_verify_csa = false

infra/testing/client.v8.pyl

@@ -36,12 +36,14 @@
   'V8 Linux64 - fyi': [
     {'name': 'v8testing', 'variant': 'infra_staging', 'shards': 1},
     {'name': 'test262_variants', 'variant': 'infra_staging', 'shards': 2},
+    {'name': 'v8testing', 'variant': 'stress_off_heap_code', 'shards': 1},
     {'name': 'mjsunit', 'variant': 'stress_sampling', 'shards': 1},
     {'name': 'webkit', 'variant': 'stress_sampling', 'shards': 1},
   ],
   'V8 Linux64 - debug - fyi': [
     {'name': 'v8testing', 'variant': 'infra_staging', 'shards': 2},
     {'name': 'test262_variants', 'variant': 'infra_staging', 'shards': 3},
+    {'name': 'v8testing', 'variant': 'stress_off_heap_code', 'shards': 1},
     {'name': 'mjsunit', 'variant': 'stress_sampling', 'shards': 1},
     {'name': 'webkit', 'variant': 'stress_sampling', 'shards': 1},
   ],

infra/testing/tryserver.v8.pyl

@@ -11,6 +11,7 @@
   'v8_linux64_fyi_rel_ng_triggered': [
     {'name': 'v8testing', 'variant': 'infra_staging', 'shards': 2},
     {'name': 'test262_variants', 'variant': 'infra_staging', 'shards': 2},
+    {'name': 'v8testing', 'variant': 'stress_off_heap_code', 'shards': 1},
     {'name': 'mjsunit', 'variant': 'stress_sampling', 'shards': 1},
     {'name': 'webkit', 'variant': 'stress_sampling', 'shards': 1},
   ],

src/arm/macro-assembler-arm.h

@@ -28,7 +28,7 @@ constexpr Register kInterpreterDispatchTableRegister = r8;
 constexpr Register kJavaScriptCallArgCountRegister = r0;
 constexpr Register kJavaScriptCallCodeStartRegister = r2;
 constexpr Register kJavaScriptCallNewTargetRegister = r3;
-constexpr Register kOffHeapTrampolineRegister = r4;
+constexpr Register kOffHeapTrampolineRegister = r6;
 constexpr Register kRuntimeCallFunctionRegister = r1;
 constexpr Register kRuntimeCallArgCountRegister = r0;
 

src/builtins/builtins.cc

@@ -290,527 +290,38 @@ bool Builtins::IsIsolateIndependent(int index) {
   DCHECK(IsBuiltinId(index));
   switch (index) {
 #ifdef DEBUG
-    case kAbortJS:
-    case kAllocateHeapNumber:
-    case kArrayEveryLoopEagerDeoptContinuation:
-    case kArrayFilterLoopEagerDeoptContinuation:
-    case kArrayFindIndexLoopEagerDeoptContinuation:
-    case kArrayFindIndexLoopLazyDeoptContinuation:
-    case kArrayFindLoopEagerDeoptContinuation:
-    case kArrayFindLoopLazyDeoptContinuation:
-    case kArrayForEachLoopEagerDeoptContinuation:
-    case kArrayForEachLoopLazyDeoptContinuation:
-    case kArrayMapLoopEagerDeoptContinuation:
-    case kArrayReduceLoopEagerDeoptContinuation:
-    case kArrayReduceLoopLazyDeoptContinuation:
-    case kArrayReducePreLoopEagerDeoptContinuation:
-    case kArrayReduceRightLoopEagerDeoptContinuation:
-    case kArrayReduceRightLoopLazyDeoptContinuation:
-    case kArrayReduceRightPreLoopEagerDeoptContinuation:
-    case kArraySomeLoopEagerDeoptContinuation:
-    case kBitwiseNot:
-    case kBooleanPrototypeToString:
-    case kBooleanPrototypeValueOf:
     case kContinueToCodeStubBuiltin:
     case kContinueToCodeStubBuiltinWithResult:
     case kContinueToJavaScriptBuiltin:
     case kContinueToJavaScriptBuiltinWithResult:
-    case kDatePrototypeGetDate:
-    case kDatePrototypeGetDay:
-    case kDatePrototypeGetFullYear:
-    case kDatePrototypeGetHours:
-    case kDatePrototypeGetMilliseconds:
-    case kDatePrototypeGetMinutes:
-    case kDatePrototypeGetMonth:
-    case kDatePrototypeGetSeconds:
-    case kDatePrototypeGetTime:
-    case kDatePrototypeGetTimezoneOffset:
-    case kDatePrototypeGetUTCDate:
-    case kDatePrototypeGetUTCDay:
-    case kDatePrototypeGetUTCFullYear:
-    case kDatePrototypeGetUTCHours:
-    case kDatePrototypeGetUTCMilliseconds:
-    case kDatePrototypeGetUTCMinutes:
-    case kDatePrototypeGetUTCMonth:
-    case kDatePrototypeGetUTCSeconds:
-    case kDatePrototypeToPrimitive:
-    case kDatePrototypeValueOf:
-    case kDecrement:
-    case kDivide:
-    case kGlobalIsFinite:
-    case kGlobalIsNaN:
-    case kIncrement:
-    case kKeyedLoadIC_Slow:
-    case kKeyedLoadICTrampoline:
-    case kKeyedStoreIC_Slow:
-    case kKeyedStoreICTrampoline:
-    case kLoadField:
-    case kLoadGlobalICInsideTypeofTrampoline:
-    case kLoadGlobalIC_Slow:
-    case kLoadGlobalICTrampoline:
-    case kLoadIC_Slow:
-    case kLoadICTrampoline:
-    case kMapPrototypeEntries:
-    case kMapPrototypeGet:
-    case kMapPrototypeGetSize:
-    case kMapPrototypeHas:
-    case kMapPrototypeKeys:
-    case kMapPrototypeValues:
-    case kMathAcos:
-    case kMathAcosh:
-    case kMathAsin:
-    case kMathAsinh:
-    case kMathAtan:
-    case kMathAtan2:
-    case kMathAtanh:
-    case kMathCbrt:
-    case kMathCeil:
-    case kMathCos:
-    case kMathCosh:
-    case kMathExp:
-    case kMathExpm1:
-    case kMathFloor:
-    case kMathFround:
-    case kMathLog:
-    case kMathLog10:
-    case kMathLog1p:
-    case kMathLog2:
-    case kMathMax:
-    case kMathMin:
-    case kMathRound:
-    case kMathSign:
-    case kMathSin:
-    case kMathSinh:
-    case kMathSqrt:
-    case kMathTan:
-    case kMathTanh:
-    case kMathTrunc:
-    case kModulus:
-    case kMultiply:
-    case kNonPrimitiveToPrimitive_Default:
-    case kNonPrimitiveToPrimitive_Number:
-    case kNonPrimitiveToPrimitive_String:
-    case kNumberIsFinite:
-    case kNumberIsInteger:
-    case kNumberIsNaN:
-    case kNumberIsSafeInteger:
-    case kNumberPrototypeValueOf:
-    case kObjectPrototypeToLocaleString:
-    case kObjectPrototypeValueOf:
-    case kPromiseCapabilityDefaultReject:
-    case kPromiseCapabilityDefaultResolve:
-    case kPromiseConstructorLazyDeoptContinuation:
-    case kPromiseInternalReject:
-    case kPromiseInternalResolve:
-    case kPromiseResolveTrampoline:
-    case kPromiseThrowerFinally:
-    case kPromiseValueThunkFinally:
-    case kProxyConstructor:
-    case kReflectHas:
-    case kRegExpPrototypeDotAllGetter:
-    case kRegExpPrototypeGlobalGetter:
-    case kRegExpPrototypeIgnoreCaseGetter:
-    case kRegExpPrototypeMultilineGetter:
-    case kRegExpPrototypeSourceGetter:
-    case kRegExpPrototypeStickyGetter:
-    case kRegExpPrototypeUnicodeGetter:
-    case kReturnReceiver:
-    case kSetPrototypeEntries:
-    case kSetPrototypeGetSize:
-    case kSetPrototypeValues:
-    case kStoreGlobalIC_Slow:
-    case kStoreGlobalICTrampoline:
-    case kStoreICTrampoline:
-    case kStringPrototypeBig:
-    case kStringPrototypeBlink:
-    case kStringPrototypeBold:
-    case kStringPrototypeConcat:
-    case kStringPrototypeFixed:
-    case kStringPrototypeItalics:
-    case kStringPrototypeIterator:
-    case kStringPrototypeSmall:
-    case kStringPrototypeStrike:
-    case kStringPrototypeSub:
-    case kStringPrototypeSup:
-#ifdef V8_INTL_SUPPORT
-    case kStringPrototypeToLowerCaseIntl:
-#endif
-    case kSubtract:
-    case kSymbolPrototypeToPrimitive:
-    case kSymbolPrototypeToString:
-    case kSymbolPrototypeValueOf:
-    case kThrowWasmTrapDivByZero:
-    case kThrowWasmTrapDivUnrepresentable:
-    case kThrowWasmTrapFloatUnrepresentable:
-    case kThrowWasmTrapFuncInvalid:
-    case kThrowWasmTrapFuncSigMismatch:
-    case kThrowWasmTrapMemOutOfBounds:
-    case kThrowWasmTrapRemByZero:
-    case kThrowWasmTrapUnreachable:
-    case kToInteger:
-    case kTypedArrayConstructor:
-    case kWasmStackGuard:
-    case kWeakMapGet:
-    case kWeakMapHas:
-    case kWeakMapPrototypeDelete:
-    case kWeakMapPrototypeSet:
-    case kWeakSetHas:
-    case kWeakSetPrototypeAdd:
-    case kWeakSetPrototypeDelete:
 #else
-    case kAbortJS:
-    case kAdd:
-    case kAllocateHeapNumber:
-    case kArrayEvery:
-    case kArrayEveryLoopContinuation:
-    case kArrayEveryLoopEagerDeoptContinuation:
-    case kArrayEveryLoopLazyDeoptContinuation:
-    case kArrayFilterLoopEagerDeoptContinuation:
-    case kArrayFilterLoopLazyDeoptContinuation:
-    case kArrayFindIndexLoopAfterCallbackLazyDeoptContinuation:
-    case kArrayFindIndexLoopContinuation:
-    case kArrayFindIndexLoopEagerDeoptContinuation:
-    case kArrayFindIndexLoopLazyDeoptContinuation:
-    case kArrayFindLoopAfterCallbackLazyDeoptContinuation:
-    case kArrayFindLoopContinuation:
-    case kArrayFindLoopEagerDeoptContinuation:
-    case kArrayFindLoopLazyDeoptContinuation:
-    case kArrayForEach:
-    case kArrayForEachLoopContinuation:
-    case kArrayForEachLoopEagerDeoptContinuation:
-    case kArrayForEachLoopLazyDeoptContinuation:
-    case kArrayFrom:
-    case kArrayIncludes:
-    case kArrayIndexOf:
-    case kArrayIsArray:
-    case kArrayMapLoopContinuation:
-    case kArrayMapLoopEagerDeoptContinuation:
-    case kArrayMapLoopLazyDeoptContinuation:
-    case kArrayOf:
-    case kArrayPrototypeEntries:
-    case kArrayPrototypeFind:
-    case kArrayPrototypeFindIndex:
-    case kArrayPrototypeKeys:
-    case kArrayPrototypeSlice:
-    case kArrayPrototypeValues:
-    case kArrayReduce:
-    case kArrayReduceLoopContinuation:
-    case kArrayReduceLoopEagerDeoptContinuation:
-    case kArrayReduceLoopLazyDeoptContinuation:
-    case kArrayReducePreLoopEagerDeoptContinuation:
-    case kArrayReduceRight:
-    case kArrayReduceRightLoopContinuation:
-    case kArrayReduceRightLoopEagerDeoptContinuation:
-    case kArrayReduceRightLoopLazyDeoptContinuation:
-    case kArrayReduceRightPreLoopEagerDeoptContinuation:
-    case kArraySome:
-    case kArraySomeLoopContinuation:
-    case kArraySomeLoopEagerDeoptContinuation:
-    case kArraySomeLoopLazyDeoptContinuation:
-    case kAsyncFromSyncIteratorPrototypeNext:
-    case kAsyncFromSyncIteratorPrototypeReturn:
-    case kAsyncFromSyncIteratorPrototypeThrow:
     case kAsyncFunctionAwaitFulfill:
-    case kAsyncFunctionAwaitReject:
-    case kAsyncFunctionPromiseCreate:
-    case kAsyncFunctionPromiseRelease:
-    case kAsyncGeneratorAwaitFulfill:
-    case kAsyncGeneratorAwaitReject:
-    case kAsyncGeneratorResumeNext:
-    case kAsyncGeneratorReturnClosedFulfill:
-    case kAsyncGeneratorReturnClosedReject:
-    case kAsyncGeneratorReturnFulfill:
-    case kAsyncGeneratorYieldFulfill:
-    case kAsyncIteratorValueUnwrap:
-    case kBitwiseNot:
-    case kBooleanPrototypeToString:
-    case kBooleanPrototypeValueOf:
-    case kCallProxy:
-    case kConstructFunction:
-    case kConstructProxy:
-    case kContinueToCodeStubBuiltin:
-    case kContinueToCodeStubBuiltinWithResult:
-    case kContinueToJavaScriptBuiltin:
-    case kContinueToJavaScriptBuiltinWithResult:
-    case kCreateGeneratorObject:
-    case kCreateIterResultObject:
-    case kCreateRegExpLiteral:
-    case kDatePrototypeGetDate:
-    case kDatePrototypeGetDay:
-    case kDatePrototypeGetFullYear:
-    case kDatePrototypeGetHours:
-    case kDatePrototypeGetMilliseconds:
-    case kDatePrototypeGetMinutes:
-    case kDatePrototypeGetMonth:
-    case kDatePrototypeGetSeconds:
-    case kDatePrototypeGetTime:
-    case kDatePrototypeGetTimezoneOffset:
-    case kDatePrototypeGetUTCDate:
-    case kDatePrototypeGetUTCDay:
-    case kDatePrototypeGetUTCFullYear:
-    case kDatePrototypeGetUTCHours:
-    case kDatePrototypeGetUTCMilliseconds:
-    case kDatePrototypeGetUTCMinutes:
-    case kDatePrototypeGetUTCMonth:
-    case kDatePrototypeGetUTCSeconds:
-    case kDatePrototypeToPrimitive:
-    case kDatePrototypeValueOf:
-    case kDecrement:
-    case kDeleteProperty:
-    case kDivide:
-    case kEqual:
-    case kFastConsoleAssert:
-    case kFastNewClosure:
-    case kFastNewFunctionContextEval:
-    case kFastNewFunctionContextFunction:
-    case kFastNewObject:
-    case kFindOrderedHashMapEntry:
-    case kForInEnumerate:
-    case kForInFilter:
-    case kFunctionPrototypeHasInstance:
-    case kGeneratorPrototypeNext:
-    case kGeneratorPrototypeReturn:
-    case kGeneratorPrototypeThrow:
-    case kGetSuperConstructor:
-    case kGlobalIsFinite:
-    case kGlobalIsNaN:
-    case kGreaterThan:
-    case kGreaterThanOrEqual:
-    case kHasProperty:
-    case kIncrement:
-    case kInstanceOf:
-    case kKeyedLoadIC_Megamorphic:
-    case kKeyedLoadIC_PolymorphicName:
-    case kKeyedLoadIC_Slow:
-    case kKeyedLoadICTrampoline:
-    case kKeyedStoreIC_Slow:
-    case kKeyedStoreICTrampoline:
-    case kLessThan:
-    case kLessThanOrEqual:
-    case kLoadField:
-    case kLoadGlobalIC:
-    case kLoadGlobalICInsideTypeof:
-    case kLoadGlobalICInsideTypeofTrampoline:
-    case kLoadGlobalIC_Slow:
-    case kLoadGlobalICTrampoline:
-    case kLoadIC:
-    case kLoadIC_FunctionPrototype:
-    case kLoadIC_Noninlined:
-    case kLoadIC_Slow:
-    case kLoadIC_StringLength:
-    case kLoadIC_StringWrapperLength:
-    case kLoadICTrampoline:
-    case kLoadIC_Uninitialized:
-    case kMapPrototypeEntries:
-    case kMapPrototypeForEach:
-    case kMapPrototypeGet:
-    case kMapPrototypeGetSize:
-    case kMapPrototypeHas:
-    case kMapPrototypeKeys:
-    case kMapPrototypeValues:
-    case kMathAcos:
-    case kMathAcosh:
-    case kMathAsin:
-    case kMathAsinh:
-    case kMathAtan:
-    case kMathAtan2:
-    case kMathAtanh:
-    case kMathCbrt:
-    case kMathCeil:
-    case kMathCos:
-    case kMathCosh:
-    case kMathExp:
-    case kMathExpm1:
-    case kMathFloor:
-    case kMathFround:
-    case kMathLog:
-    case kMathLog10:
-    case kMathLog1p:
-    case kMathLog2:
-    case kMathMax:
-    case kMathMin:
-    case kMathRound:
-    case kMathSign:
-    case kMathSin:
-    case kMathSinh:
-    case kMathSqrt:
-    case kMathTan:
-    case kMathTanh:
-    case kMathTrunc:
-    case kModulus:
-    case kMultiply:
-    case kNegate:
-    case kNewArgumentsElements:
-    case kNonNumberToNumber:
-    case kNonNumberToNumeric:
-    case kNonPrimitiveToPrimitive_Default:
-    case kNonPrimitiveToPrimitive_Number:
-    case kNonPrimitiveToPrimitive_String:
-    case kNumberConstructor:
-    case kNumberIsFinite:
-    case kNumberIsInteger:
-    case kNumberIsNaN:
-    case kNumberIsSafeInteger:
-    case kNumberParseFloat:
-    case kNumberPrototypeValueOf:
-    case kNumberToString:
-    case kObjectConstructor:
-    case kObjectCreate:
-    case kObjectIs:
-    case kObjectKeys:
-    case kObjectPrototypeHasOwnProperty:
-    case kObjectPrototypeIsPrototypeOf:
-    case kObjectPrototypeToLocaleString:
-    case kObjectPrototypeToString:
-    case kObjectPrototypeValueOf:
-    case kOrderedHashTableHealIndex:
-    case kOrdinaryHasInstance:
-    case kOrdinaryToPrimitive_Number:
-    case kOrdinaryToPrimitive_String:
-    case kPromiseAll:
-    case kPromiseCapabilityDefaultReject:
-    case kPromiseCapabilityDefaultResolve:
-    case kPromiseCatchFinally:
-    case kPromiseConstructor:
-    case kPromiseConstructorLazyDeoptContinuation:
-    case kPromiseFulfillReactionJob:
-    case kPromiseInternalConstructor:
-    case kPromiseInternalReject:
-    case kPromiseInternalResolve:
-    case kPromisePrototypeCatch:
-    case kPromisePrototypeFinally:
-    case kPromiseRace:
-    case kPromiseReject:
-    case kPromiseRejectReactionJob:
-    case kPromiseResolve:
-    case kPromiseResolveThenableJob:
-    case kPromiseResolveTrampoline:
-    case kPromiseThenFinally:
-    case kPromiseThrowerFinally:
-    case kPromiseValueThunkFinally:
-    case kProxyConstructor:
-    case kProxyGetProperty:
-    case kProxyHasProperty:
-    case kProxySetProperty:
-    case kRecordWrite:
-    case kReflectHas:
-    case kRegExpConstructor:
-    case kRegExpPrototypeCompile:
-    case kRegExpPrototypeDotAllGetter:
-    case kRegExpPrototypeFlagsGetter:
-    case kRegExpPrototypeGlobalGetter:
-    case kRegExpPrototypeIgnoreCaseGetter:
-    case kRegExpPrototypeMultilineGetter:
-    case kRegExpPrototypeReplace:
-    case kRegExpPrototypeSearch:
-    case kRegExpPrototypeSourceGetter:
-    case kRegExpPrototypeSplit:
-    case kRegExpPrototypeStickyGetter:
-    case kRegExpPrototypeUnicodeGetter:
-    case kResolvePromise:
-    case kReturnReceiver:
-    case kRunMicrotasks:
-    case kSameValue:
-    case kSetPrototypeEntries:
-    case kSetPrototypeForEach:
-    case kSetPrototypeGetSize:
-    case kSetPrototypeHas:
-    case kSetPrototypeValues:
-    case kStoreGlobalIC_Slow:
+    case kAsyncFunctionAwaitReject:
+    case kAsyncGeneratorAwaitFulfill:
+    case kAsyncGeneratorAwaitReject:
+    case kAsyncGeneratorReturnClosedFulfill:
+    case kAsyncGeneratorReturnClosedReject:
+    case kAsyncGeneratorReturnFulfill:
+    case kAsyncGeneratorYieldFulfill:
+    case kConstructFunction:
+    case kContinueToCodeStubBuiltin:
+    case kContinueToCodeStubBuiltinWithResult:
+    case kContinueToJavaScriptBuiltin:
+    case kContinueToJavaScriptBuiltinWithResult:
+    case kKeyedLoadICTrampoline:
+    case kKeyedStoreICTrampoline:
+    case kLoadGlobalICInsideTypeofTrampoline:
+    case kLoadGlobalICTrampoline:
+    case kLoadIC_StringLength:
+    case kLoadIC_StringWrapperLength:
+    case kLoadICTrampoline:
+    case kOrderedHashTableHealIndex:
+    case kPromiseFulfillReactionJob:
     case kStoreGlobalICTrampoline:
     case kStoreICTrampoline:
-    case kStrictEqual:
-    case kStringCodePointAtUTF16:
-    case kStringCodePointAtUTF32:
-    case kStringConstructor:
-    case kStringEqual:
-    case kStringGreaterThan:
-    case kStringGreaterThanOrEqual:
-    case kStringIndexOf:
-    case kStringLessThan:
-    case kStringLessThanOrEqual:
-    case kStringPrototypeAnchor:
-    case kStringPrototypeBig:
-    case kStringPrototypeBlink:
-    case kStringPrototypeBold:
-    case kStringPrototypeCharCodeAt:
-    case kStringPrototypeCodePointAt:
-    case kStringPrototypeConcat:
-    case kStringPrototypeFixed:
-    case kStringPrototypeFontcolor:
-    case kStringPrototypeFontsize:
-    case kStringPrototypeIncludes:
-    case kStringPrototypeIndexOf:
-    case kStringPrototypeItalics:
-    case kStringPrototypeIterator:
-    case kStringPrototypeLink:
-    case kStringPrototypeMatch:
-    case kStringPrototypePadEnd:
-    case kStringPrototypePadStart:
-    case kStringPrototypeRepeat:
-    case kStringPrototypeReplace:
-    case kStringPrototypeSearch:
-    case kStringPrototypeSmall:
-    case kStringPrototypeStrike:
-    case kStringPrototypeSub:
-    case kStringPrototypeSup:
-#ifdef V8_INTL_SUPPORT
-    case kStringPrototypeToLowerCaseIntl:
-    case kStringToLowerCaseIntl:
-#endif
-    case kStringPrototypeToString:
-    case kStringPrototypeValueOf:
     case kStringRepeat:
-    case kStringToNumber:
-    case kSubtract:
-    case kSymbolPrototypeToPrimitive:
-    case kSymbolPrototypeToString:
-    case kSymbolPrototypeValueOf:
-    case kThrowWasmTrapDivByZero:
-    case kThrowWasmTrapDivUnrepresentable:
-    case kThrowWasmTrapFloatUnrepresentable:
-    case kThrowWasmTrapFuncInvalid:
-    case kThrowWasmTrapFuncSigMismatch:
-    case kThrowWasmTrapMemOutOfBounds:
-    case kThrowWasmTrapRemByZero:
-    case kThrowWasmTrapUnreachable:
-    case kToBoolean:
-    case kToBooleanLazyDeoptContinuation:
-    case kToInteger:
-    case kToInteger_TruncateMinusZero:
-    case kToName:
-    case kToNumber:
-    case kToNumeric:
-    case kToString:
-    case kTypedArrayConstructor:
-    case kTypedArrayConstructor_ConstructStub:
-    case kTypedArrayPrototypeByteLength:
-    case kTypedArrayPrototypeByteOffset:
-    case kTypedArrayPrototypeEntries:
-    case kTypedArrayPrototypeEvery:
-    case kTypedArrayPrototypeFind:
-    case kTypedArrayPrototypeFindIndex:
-    case kTypedArrayPrototypeForEach:
-    case kTypedArrayPrototypeKeys:
-    case kTypedArrayPrototypeLength:
-    case kTypedArrayPrototypeReduce:
-    case kTypedArrayPrototypeReduceRight:
-    case kTypedArrayPrototypeSet:
-    case kTypedArrayPrototypeSlice:
-    case kTypedArrayPrototypeSome:
-    case kTypedArrayPrototypeSubArray:
-    case kTypedArrayPrototypeToStringTag:
-    case kTypedArrayPrototypeValues:
     case kTypeof:
-    case kWasmStackGuard:
-    case kWeakMapGet:
-    case kWeakMapHas:
     case kWeakMapLookupHashIndex:
-    case kWeakMapPrototypeDelete:
-    case kWeakMapPrototypeSet:
-    case kWeakSetHas:
-    case kWeakSetPrototypeAdd:
-    case kWeakSetPrototypeDelete:
 #endif
       return true;
     default:
@@ -829,154 +340,15 @@ bool Builtins::IsOffHeapSafe(int index) {
   switch (index) {
 #ifdef DEBUG
     case kAbortJS:
-    case kAllocateHeapNumber:
-    case kArrayEveryLoopEagerDeoptContinuation:
-    case kArrayFilterLoopEagerDeoptContinuation:
-    case kArrayFindIndexLoopEagerDeoptContinuation:
-    case kArrayFindIndexLoopLazyDeoptContinuation:
-    case kArrayFindLoopEagerDeoptContinuation:
-    case kArrayFindLoopLazyDeoptContinuation:
-    case kArrayForEachLoopEagerDeoptContinuation:
-    case kArrayForEachLoopLazyDeoptContinuation:
-    case kArrayMapLoopEagerDeoptContinuation:
-    case kArrayReduceLoopEagerDeoptContinuation:
-    case kArrayReduceLoopLazyDeoptContinuation:
-    case kArrayReducePreLoopEagerDeoptContinuation:
-    case kArrayReduceRightLoopEagerDeoptContinuation:
-    case kArrayReduceRightLoopLazyDeoptContinuation:
-    case kArrayReduceRightPreLoopEagerDeoptContinuation:
-    case kArraySomeLoopEagerDeoptContinuation:
-    case kBitwiseNot:
-    case kBooleanPrototypeToString:
-    case kBooleanPrototypeValueOf:
     case kContinueToCodeStubBuiltin:
     case kContinueToCodeStubBuiltinWithResult:
     case kContinueToJavaScriptBuiltin:
     case kContinueToJavaScriptBuiltinWithResult:
-    case kDatePrototypeGetDate:
-    case kDatePrototypeGetDay:
-    case kDatePrototypeGetFullYear:
-    case kDatePrototypeGetHours:
-    case kDatePrototypeGetMilliseconds:
-    case kDatePrototypeGetMinutes:
-    case kDatePrototypeGetMonth:
-    case kDatePrototypeGetSeconds:
-    case kDatePrototypeGetTime:
-    case kDatePrototypeGetTimezoneOffset:
-    case kDatePrototypeGetUTCDate:
-    case kDatePrototypeGetUTCDay:
-    case kDatePrototypeGetUTCFullYear:
-    case kDatePrototypeGetUTCHours:
-    case kDatePrototypeGetUTCMilliseconds:
-    case kDatePrototypeGetUTCMinutes:
-    case kDatePrototypeGetUTCMonth:
-    case kDatePrototypeGetUTCSeconds:
-    case kDatePrototypeToPrimitive:
-    case kDatePrototypeValueOf:
-    case kDecrement:
-    case kDivide:
-    case kGlobalIsFinite:
-    case kGlobalIsNaN:
-    case kIncrement:
     case kKeyedLoadIC_Slow:
-    case kKeyedLoadICTrampoline:
     case kKeyedStoreIC_Slow:
-    case kKeyedStoreICTrampoline:
-    case kLoadField:
-    case kLoadGlobalICInsideTypeofTrampoline:
     case kLoadGlobalIC_Slow:
-    case kLoadGlobalICTrampoline:
     case kLoadIC_Slow:
-    case kLoadICTrampoline:
-    case kMapPrototypeEntries:
-    case kMapPrototypeGet:
-    case kMapPrototypeGetSize:
-    case kMapPrototypeHas:
-    case kMapPrototypeKeys:
-    case kMapPrototypeValues:
-    case kMathAcos:
-    case kMathAcosh:
-    case kMathAsin:
-    case kMathAsinh:
-    case kMathAtan:
-    case kMathAtan2:
-    case kMathAtanh:
-    case kMathCbrt:
-    case kMathCeil:
-    case kMathCos:
-    case kMathCosh:
-    case kMathExp:
-    case kMathExpm1:
-    case kMathFloor:
-    case kMathFround:
-    case kMathLog:
-    case kMathLog10:
-    case kMathLog1p:
-    case kMathLog2:
-    case kMathMax:
-    case kMathMin:
-    case kMathRound:
-    case kMathSign:
-    case kMathSin:
-    case kMathSinh:
-    case kMathSqrt:
-    case kMathTan:
-    case kMathTanh:
-    case kMathTrunc:
-    case kModulus:
-    case kMultiply:
-    case kNonPrimitiveToPrimitive_Default:
-    case kNonPrimitiveToPrimitive_Number:
-    case kNonPrimitiveToPrimitive_String:
-    case kNumberIsFinite:
-    case kNumberIsInteger:
-    case kNumberIsNaN:
-    case kNumberIsSafeInteger:
-    case kNumberPrototypeValueOf:
-    case kObjectPrototypeToLocaleString:
-    case kObjectPrototypeValueOf:
-    case kPromiseCapabilityDefaultReject:
-    case kPromiseCapabilityDefaultResolve:
-    case kPromiseConstructorLazyDeoptContinuation:
-    case kPromiseInternalReject:
-    case kPromiseInternalResolve:
-    case kPromiseResolveTrampoline:
-    case kPromiseThrowerFinally:
-    case kPromiseValueThunkFinally:
-    case kProxyConstructor:
-    case kReflectHas:
-    case kRegExpPrototypeDotAllGetter:
-    case kRegExpPrototypeGlobalGetter:
-    case kRegExpPrototypeIgnoreCaseGetter:
-    case kRegExpPrototypeMultilineGetter:
-    case kRegExpPrototypeSourceGetter:
-    case kRegExpPrototypeStickyGetter:
-    case kRegExpPrototypeUnicodeGetter:
-    case kReturnReceiver:
-    case kSetPrototypeEntries:
-    case kSetPrototypeGetSize:
-    case kSetPrototypeValues:
     case kStoreGlobalIC_Slow:
-    case kStoreGlobalICTrampoline:
-    case kStoreICTrampoline:
-    case kStringPrototypeBig:
-    case kStringPrototypeBlink:
-    case kStringPrototypeBold:
-    case kStringPrototypeConcat:
-    case kStringPrototypeFixed:
-    case kStringPrototypeItalics:
-    case kStringPrototypeIterator:
-    case kStringPrototypeSmall:
-    case kStringPrototypeStrike:
-    case kStringPrototypeSub:
-    case kStringPrototypeSup:
-#ifdef V8_INTL_SUPPORT
-    case kStringPrototypeToLowerCaseIntl:
-#endif
-    case kSubtract:
-    case kSymbolPrototypeToPrimitive:
-    case kSymbolPrototypeToString:
-    case kSymbolPrototypeValueOf:
     case kThrowWasmTrapDivByZero:
     case kThrowWasmTrapDivUnrepresentable:
     case kThrowWasmTrapFloatUnrepresentable:
@@ -985,16 +357,7 @@ bool Builtins::IsOffHeapSafe(int index) {
     case kThrowWasmTrapMemOutOfBounds:
     case kThrowWasmTrapRemByZero:
     case kThrowWasmTrapUnreachable:
-    case kToInteger:
-    case kTypedArrayConstructor:
     case kWasmStackGuard:
-    case kWeakMapGet:
-    case kWeakMapHas:
-    case kWeakMapPrototypeDelete:
-    case kWeakMapPrototypeSet:
-    case kWeakSetHas:
-    case kWeakSetPrototypeAdd:
-    case kWeakSetPrototypeDelete:
 #else
     case kAbortJS:
     case kAdd:
@@ -1063,9 +426,7 @@ bool Builtins::IsOffHeapSafe(int index) {
     case kBitwiseNot:
     case kBooleanPrototypeToString:
     case kBooleanPrototypeValueOf:
-    case kCallProxy:
     case kConstructFunction:
-    case kConstructProxy:
     case kContinueToCodeStubBuiltin:
     case kContinueToCodeStubBuiltinWithResult:
     case kContinueToJavaScriptBuiltin:
@@ -1182,7 +543,6 @@ bool Builtins::IsOffHeapSafe(int index) {
     case kNonPrimitiveToPrimitive_Default:
     case kNonPrimitiveToPrimitive_Number:
     case kNonPrimitiveToPrimitive_String:
-    case kNumberConstructor:
     case kNumberIsFinite:
     case kNumberIsInteger:
     case kNumberIsNaN:
@@ -1191,7 +551,6 @@ bool Builtins::IsOffHeapSafe(int index) {
     case kNumberPrototypeValueOf:
     case kNumberToString:
     case kObjectConstructor:
-    case kObjectConstructor_ConstructStub:
     case kObjectCreate:
     case kObjectIs:
     case kObjectKeys:
@@ -1225,7 +584,6 @@ bool Builtins::IsOffHeapSafe(int index) {
     case kPromiseThenFinally:
     case kPromiseThrowerFinally:
     case kPromiseValueThunkFinally:
-    case kProxyConstructor:
     case kProxyGetProperty:
     case kProxyHasProperty:
     case kProxySetProperty:
@@ -1259,7 +617,6 @@ bool Builtins::IsOffHeapSafe(int index) {
     case kStrictEqual:
     case kStringCodePointAtUTF16:
     case kStringCodePointAtUTF32:
-    case kStringConstructor:
     case kStringEqual:
     case kStringGreaterThan:
     case kStringGreaterThanOrEqual:

src/isolate.cc

@@ -2671,7 +2671,6 @@ void Isolate::Deinit() {
   ClearSerializerData();
 
   for (InstructionStream* stream : off_heap_code_) {
-    CHECK(FLAG_stress_off_heap_code);
     delete stream;
   }
   off_heap_code_.clear();

test/cctest/test-isolate-independent-builtins.cc

@@ -20,131 +20,174 @@ namespace internal {
 namespace test_isolate_independent_builtins {
 
 #ifdef V8_EMBEDDED_BUILTINS
-TEST(VerifyBuiltinsIsolateIndependence) {
-  Isolate* isolate = CcTest::i_isolate();
-  HandleScope handle_scope(isolate);
-
-  Snapshot::EnsureAllBuiltinsAreDeserialized(isolate);
-
-  // Build a white-list of all isolate-independent RelocInfo entry kinds.
-  constexpr int all_real_modes_mask =
-      (1 << (RelocInfo::LAST_REAL_RELOC_MODE + 1)) - 1;
-  constexpr int mode_mask =
-      all_real_modes_mask & ~RelocInfo::ModeMask(RelocInfo::COMMENT) &
-      ~RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) &
-      ~RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED) &
-      ~RelocInfo::ModeMask(RelocInfo::CONST_POOL) &
-      ~RelocInfo::ModeMask(RelocInfo::VENEER_POOL);
-  STATIC_ASSERT(RelocInfo::LAST_REAL_RELOC_MODE == RelocInfo::VENEER_POOL);
-  STATIC_ASSERT(RelocInfo::ModeMask(RelocInfo::COMMENT) ==
-                (1 << RelocInfo::COMMENT));
-  STATIC_ASSERT(
-      mode_mask ==
-      (RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
-       RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
-       RelocInfo::ModeMask(RelocInfo::WASM_CONTEXT_REFERENCE) |
-       RelocInfo::ModeMask(RelocInfo::WASM_FUNCTION_TABLE_SIZE_REFERENCE) |
-       RelocInfo::ModeMask(RelocInfo::WASM_GLOBAL_HANDLE) |
-       RelocInfo::ModeMask(RelocInfo::WASM_CALL) |
-       RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL) |
-       RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY) |
-       RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE)));
-
-  constexpr bool kVerbose = false;
-  bool found_mismatch = false;
-  for (int i = 0; i < Builtins::builtin_count; i++) {
-    Code* code = isolate->builtins()->builtin(i);
-
-    if (kVerbose) {
-      printf("%s %s\n", Builtins::KindNameOf(i), isolate->builtins()->name(i));
-    }
-
-    bool is_isolate_independent = true;
-    for (RelocIterator it(code, mode_mask); !it.done(); it.next()) {
-      is_isolate_independent = false;
+UNINITIALIZED_TEST(VerifyBuiltinsIsolateIndependence) {
+  FLAG_stress_off_heap_code = false;  // Disable off-heap trampolines.
+
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+  v8::Isolate* v8_isolate = v8::Isolate::New(create_params);
+
+  {
+    v8::Isolate::Scope isolate_scope(v8_isolate);
+    v8::internal::Isolate* isolate =
+        reinterpret_cast<v8::internal::Isolate*>(v8_isolate);
+    HandleScope handle_scope(isolate);
+
+    Snapshot::EnsureAllBuiltinsAreDeserialized(isolate);
+
+    // TODO(jgruber,v8:6666): Investigate CONST_POOL and VENEER_POOL kinds.
+    // CONST_POOL is currently relevant on {arm,arm64,mips,mips64,ppc,s390}.
+    //            Rumors are it will also become relevant on x64. My
+    //            understanding is that we should be fine if we ensure it
+    //            doesn't contain heap constants and we use pc-relative
+    //            addressing.
+    // VENEER_POOL is arm64-only. From what I've seen, jumps are pc-relative
+    //             and stay within the same code object and thus should be
+    //             isolate-independent.
+
+    // Build a white-list of all isolate-independent RelocInfo entry kinds.
+    constexpr int all_real_modes_mask =
+        (1 << (RelocInfo::LAST_REAL_RELOC_MODE + 1)) - 1;
+    constexpr int mode_mask =
+        all_real_modes_mask & ~RelocInfo::ModeMask(RelocInfo::COMMENT) &
+        ~RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) &
+        ~RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED) &
+        ~RelocInfo::ModeMask(RelocInfo::CONST_POOL) &
+        ~RelocInfo::ModeMask(RelocInfo::VENEER_POOL);
+    STATIC_ASSERT(RelocInfo::LAST_REAL_RELOC_MODE == RelocInfo::VENEER_POOL);
+    STATIC_ASSERT(RelocInfo::ModeMask(RelocInfo::COMMENT) ==
+                  (1 << RelocInfo::COMMENT));
+    STATIC_ASSERT(
+        mode_mask ==
+        (RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
+         RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
+         RelocInfo::ModeMask(RelocInfo::WASM_CONTEXT_REFERENCE) |
+         RelocInfo::ModeMask(RelocInfo::WASM_FUNCTION_TABLE_SIZE_REFERENCE) |
+         RelocInfo::ModeMask(RelocInfo::WASM_GLOBAL_HANDLE) |
+         RelocInfo::ModeMask(RelocInfo::WASM_CALL) |
+         RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL) |
+         RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY) |
+         RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE)));
+
+    constexpr bool kVerbose = false;
+    bool found_mismatch = false;
+    for (int i = 0; i < Builtins::builtin_count; i++) {
+      Code* code = isolate->builtins()->builtin(i);
 
-#ifdef ENABLE_DISASSEMBLER
       if (kVerbose) {
-        RelocInfo::Mode mode = it.rinfo()->rmode();
-        printf("  %s\n", RelocInfo::RelocModeName(mode));
+        printf("%s %s\n", Builtins::KindNameOf(i),
+               isolate->builtins()->name(i));
       }
+
+      bool is_isolate_independent = true;
+      for (RelocIterator it(code, mode_mask); !it.done(); it.next()) {
+        is_isolate_independent = false;
+
+#ifdef ENABLE_DISASSEMBLER
+        if (kVerbose) {
+          RelocInfo::Mode mode = it.rinfo()->rmode();
+          printf("  %s\n", RelocInfo::RelocModeName(mode));
+        }
 #endif
-    }
+      }
 
-    const bool expected_result = Builtins::IsIsolateIndependent(i);
-    if (is_isolate_independent != expected_result) {
-      found_mismatch = true;
-      printf("%s %s expected: %d, is: %d\n", Builtins::KindNameOf(i),
-             isolate->builtins()->name(i), expected_result,
-             is_isolate_independent);
+      // Relaxed condition only checks whether the isolate-independent list is
+      // valid, not whether it is complete. This is to avoid constant work
+      // updating the list.
+      bool should_be_isolate_independent = Builtins::IsIsolateIndependent(i);
+      if (should_be_isolate_independent && !is_isolate_independent) {
+        found_mismatch = true;
+        printf("%s %s expected: %d, is: %d\n", Builtins::KindNameOf(i),
+               isolate->builtins()->name(i), should_be_isolate_independent,
+               is_isolate_independent);
+      }
     }
+
+    CHECK(!found_mismatch);
   }
 
-  CHECK(!found_mismatch);
+  v8_isolate->Dispose();
 }
 
-TEST(VerifyBuiltinsOffHeapSafety) {
-  Isolate* isolate = CcTest::i_isolate();
-  HandleScope handle_scope(isolate);
-
-  Snapshot::EnsureAllBuiltinsAreDeserialized(isolate);
-
-  constexpr int all_real_modes_mask =
-      (1 << (RelocInfo::LAST_REAL_RELOC_MODE + 1)) - 1;
-  constexpr int mode_mask =
-      all_real_modes_mask & ~RelocInfo::ModeMask(RelocInfo::COMMENT) &
-      ~RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) &
-      ~RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED) &
-      ~RelocInfo::ModeMask(RelocInfo::CONST_POOL) &
-      ~RelocInfo::ModeMask(RelocInfo::VENEER_POOL) &
-      ~RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE);
-  STATIC_ASSERT(RelocInfo::LAST_REAL_RELOC_MODE == RelocInfo::VENEER_POOL);
-  STATIC_ASSERT(RelocInfo::ModeMask(RelocInfo::COMMENT) ==
-                (1 << RelocInfo::COMMENT));
-  STATIC_ASSERT(
-      mode_mask ==
-      (RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
-       RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
-       RelocInfo::ModeMask(RelocInfo::WASM_CONTEXT_REFERENCE) |
-       RelocInfo::ModeMask(RelocInfo::WASM_FUNCTION_TABLE_SIZE_REFERENCE) |
-       RelocInfo::ModeMask(RelocInfo::WASM_GLOBAL_HANDLE) |
-       RelocInfo::ModeMask(RelocInfo::WASM_CALL) |
-       RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL) |
-       RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY)));
-
-  constexpr bool kVerbose = false;
-  bool found_mismatch = false;
-  for (int i = 0; i < Builtins::builtin_count; i++) {
-    Code* code = isolate->builtins()->builtin(i);
-
-    if (kVerbose) {
-      printf("%s %s\n", Builtins::KindNameOf(i), isolate->builtins()->name(i));
-    }
+UNINITIALIZED_TEST(VerifyBuiltinsOffHeapSafety) {
+  FLAG_stress_off_heap_code = false;  // Disable off-heap trampolines.
+
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+  v8::Isolate* v8_isolate = v8::Isolate::New(create_params);
+
+  {
+    v8::Isolate::Scope isolate_scope(v8_isolate);
+    v8::internal::Isolate* isolate =
+        reinterpret_cast<v8::internal::Isolate*>(v8_isolate);
+    HandleScope handle_scope(isolate);
+
+    Snapshot::EnsureAllBuiltinsAreDeserialized(isolate);
+
+    constexpr int all_real_modes_mask =
+        (1 << (RelocInfo::LAST_REAL_RELOC_MODE + 1)) - 1;
+    constexpr int mode_mask =
+        all_real_modes_mask & ~RelocInfo::ModeMask(RelocInfo::COMMENT) &
+        ~RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) &
+        ~RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED) &
+        ~RelocInfo::ModeMask(RelocInfo::CONST_POOL) &
+        ~RelocInfo::ModeMask(RelocInfo::VENEER_POOL) &
+        ~RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE);
+    STATIC_ASSERT(RelocInfo::LAST_REAL_RELOC_MODE == RelocInfo::VENEER_POOL);
+    STATIC_ASSERT(RelocInfo::ModeMask(RelocInfo::COMMENT) ==
+                  (1 << RelocInfo::COMMENT));
+    STATIC_ASSERT(
+        mode_mask ==
+        (RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
+         RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
+         RelocInfo::ModeMask(RelocInfo::WASM_CONTEXT_REFERENCE) |
+         RelocInfo::ModeMask(RelocInfo::WASM_FUNCTION_TABLE_SIZE_REFERENCE) |
+         RelocInfo::ModeMask(RelocInfo::WASM_GLOBAL_HANDLE) |
+         RelocInfo::ModeMask(RelocInfo::WASM_CALL) |
+         RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL) |
+         RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY)));
+
+    constexpr bool kVerbose = false;
+    bool found_mismatch = false;
+    for (int i = 0; i < Builtins::builtin_count; i++) {
+      Code* code = isolate->builtins()->builtin(i);
 
-    bool is_off_heap_safe = true;
-    for (RelocIterator it(code, mode_mask); !it.done(); it.next()) {
-      is_off_heap_safe = false;
-#ifdef ENABLE_DISASSEMBLER
       if (kVerbose) {
-        RelocInfo::Mode mode = it.rinfo()->rmode();
-        printf("  %s\n", RelocInfo::RelocModeName(mode));
+        printf("%s %s\n", Builtins::KindNameOf(i),
+               isolate->builtins()->name(i));
       }
-#endif
-    }
 
-    // TODO(jgruber): Remove once we properly set up the on-heap code
-    // trampoline.
-    if (Builtins::IsTooShortForOffHeapTrampoline(i)) is_off_heap_safe = false;
+      bool is_off_heap_safe = true;
+      for (RelocIterator it(code, mode_mask); !it.done(); it.next()) {
+        is_off_heap_safe = false;
+#ifdef ENABLE_DISASSEMBLER
+        if (kVerbose) {
+          RelocInfo::Mode mode = it.rinfo()->rmode();
+          printf("  %s\n", RelocInfo::RelocModeName(mode));
+        }
+#endif
+      }
 
-    const bool expected_result = Builtins::IsOffHeapSafe(i);
-    if (is_off_heap_safe != expected_result) {
-      found_mismatch = true;
-      printf("%s %s expected: %d, is: %d\n", Builtins::KindNameOf(i),
-             isolate->builtins()->name(i), expected_result, is_off_heap_safe);
+      // TODO(jgruber): Remove once we properly set up the on-heap code
+      // trampoline.
+      if (Builtins::IsTooShortForOffHeapTrampoline(i)) is_off_heap_safe = false;
+
+      // Relaxed condition only checks whether the off-heap-safe list is
+      // valid, not whether it is complete. This is to avoid constant work
+      // updating the list.
+      bool should_be_off_heap_safe = Builtins::IsOffHeapSafe(i);
+      if (should_be_off_heap_safe && !is_off_heap_safe) {
+        found_mismatch = true;
+        printf("%s %s expected: %d, is: %d\n", Builtins::KindNameOf(i),
+               isolate->builtins()->name(i), should_be_off_heap_safe,
+               is_off_heap_safe);
+      }
     }
+
+    CHECK(!found_mismatch);
   }
 
-  CHECK(!found_mismatch);
+  v8_isolate->Dispose();
 }
 #endif  // V8_EMBEDDED_BUILTINS
 

tools/testrunner/local/variants.py

@@ -19,6 +19,7 @@ ALL_VARIANT_FLAGS = {
   "stress": [["--stress-opt", "--always-opt"]],
   "stress_background_compile": [["--background-compile", "--stress-background-compile"]],
   "stress_incremental_marking":  [["--stress-incremental-marking"]],
+  "stress_off_heap_code":  [["--stress-off-heap-code"]],
   # Trigger stress sampling allocation profiler with sample interval = 2^14
   "stress_sampling": [["--stress-sampling-allocation-profiler=16384"]],
   "trusted": [["--no-untrusted-code-mitigations"]],