[Turbofan] Inline Array.prototype.some

Bug: v8:1956
Change-Id: Ie941811110b3c106e252a2621544864673074da5
Reviewed-on: https://chromium-review.googlesource.com/846759Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50357}

src/builtins/builtins-array-gen.cc

@@ -1973,6 +1973,48 @@ TF_BUILTIN(TypedArrayPrototypeForEach, ArrayBuiltinCodeStubAssembler) {
       &ArrayBuiltinCodeStubAssembler::NullPostLoopAction);
 }
 
+TF_BUILTIN(ArraySomeLoopLazyDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
+  Node* context = Parameter(Descriptor::kContext);
+  Node* receiver = Parameter(Descriptor::kReceiver);
+  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
+  Node* this_arg = Parameter(Descriptor::kThisArg);
+  Node* initial_k = Parameter(Descriptor::kInitialK);
+  Node* len = Parameter(Descriptor::kLength);
+  Node* result = Parameter(Descriptor::kResult);
+
+  // This custom lazy deopt point is right after the callback. every() needs
+  // to pick up at the next step, which is either continuing to the next
+  // array element or returning false if {result} is false.
+  Label true_continue(this), false_continue(this);
+
+  // iii. If selected is true, then...
+  BranchIfToBooleanIsTrue(result, &true_continue, &false_continue);
+  BIND(&true_continue);
+  { Return(TrueConstant()); }
+  BIND(&false_continue);
+  {
+    // Increment k.
+    initial_k = NumberInc(initial_k);
+
+    Return(CallBuiltin(Builtins::kArraySomeLoopContinuation, context, receiver,
+                       callbackfn, this_arg, FalseConstant(), receiver,
+                       initial_k, len, UndefinedConstant()));
+  }
+}
+
+TF_BUILTIN(ArraySomeLoopEagerDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
+  Node* context = Parameter(Descriptor::kContext);
+  Node* receiver = Parameter(Descriptor::kReceiver);
+  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
+  Node* this_arg = Parameter(Descriptor::kThisArg);
+  Node* initial_k = Parameter(Descriptor::kInitialK);
+  Node* len = Parameter(Descriptor::kLength);
+
+  Return(CallBuiltin(Builtins::kArraySomeLoopContinuation, context, receiver,
+                     callbackfn, this_arg, FalseConstant(), receiver, initial_k,
+                     len, UndefinedConstant()));
+}
+
 TF_BUILTIN(ArraySomeLoopContinuation, ArrayBuiltinCodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
   Node* receiver = Parameter(Descriptor::kReceiver);

src/builtins/builtins-definitions.h

@@ -287,6 +287,10 @@ namespace internal {
   /* ES6 #sec-array.prototype.some */                                          \
   TFS(ArraySomeLoopContinuation, kReceiver, kCallbackFn, kThisArg, kArray,     \
       kObject, kInitialK, kLength, kTo)                                        \
+  TFJ(ArraySomeLoopEagerDeoptContinuation, 4, kCallbackFn, kThisArg,           \
+      kInitialK, kLength)                                                      \
+  TFJ(ArraySomeLoopLazyDeoptContinuation, 5, kCallbackFn, kThisArg, kInitialK, \
+      kLength, kResult)                                                        \
   TFJ(ArraySome, SharedFunctionInfo::kDontAdaptArgumentsSentinel)              \
   /* ES6 #sec-array.prototype.filter */                                        \
   TFS(ArrayFilterLoopContinuation, kReceiver, kCallbackFn, kThisArg, kArray,   \

src/builtins/builtins.cc

@@ -189,6 +189,8 @@ Callable Builtins::CallableFor(Isolate* isolate, Name name) {
     case kArrayReduceLoopLazyDeoptContinuation:
     case kArrayReduceRightLoopEagerDeoptContinuation:
     case kArrayReduceRightLoopLazyDeoptContinuation:
+    case kArraySomeLoopEagerDeoptContinuation:
+    case kArraySomeLoopLazyDeoptContinuation:
     case kConsoleAssert:
       return Callable(code, BuiltinDescriptor(isolate));
     default:
@@ -247,6 +249,8 @@ bool Builtins::IsLazy(int index) {
     case kArrayReduceLoopLazyDeoptContinuation:    // https://crbug.com/v8/6786.
     case kArrayReduceRightLoopEagerDeoptContinuation:
     case kArrayReduceRightLoopLazyDeoptContinuation:
+    case kArraySomeLoopEagerDeoptContinuation:  // https://crbug.com/v8/6786.
+    case kArraySomeLoopLazyDeoptContinuation:   // https://crbug.com/v8/6786.
     case kCheckOptimizationMarker:
     case kCompileLazy:
     case kDeserializeLazy:

src/compiler/js-call-reducer.cc

@@ -2449,6 +2449,229 @@ Reduction JSCallReducer::ReduceArrayEvery(Handle<JSFunction> function,
   return Replace(return_value);
 }
 
+Reduction JSCallReducer::ReduceArraySome(Handle<JSFunction> function,
+                                         Node* node) {
+  if (!FLAG_turbo_inline_array_builtins) return NoChange();
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+
+  Node* outer_frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* context = NodeProperties::GetContextInput(node);
+  // Try to determine the {receiver} map.
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* fncallback = node->op()->ValueInputCount() > 2
+                         ? NodeProperties::GetValueInput(node, 2)
+                         : jsgraph()->UndefinedConstant();
+  Node* this_arg = node->op()->ValueInputCount() > 3
+                       ? NodeProperties::GetValueInput(node, 3)
+                       : jsgraph()->UndefinedConstant();
+  ZoneHandleSet<Map> receiver_maps;
+  NodeProperties::InferReceiverMapsResult result =
+      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+  if (result != NodeProperties::kReliableReceiverMaps) {
+    return NoChange();
+  }
+
+  // And ensure that any changes to the Array species constructor cause deopt.
+  if (!isolate()->IsArraySpeciesLookupChainIntact()) return NoChange();
+
+  if (receiver_maps.size() == 0) return NoChange();
+
+  const ElementsKind kind = receiver_maps[0]->elements_kind();
+
+  // TODO(pwong): Handle holey double elements kinds.
+  if (IsDoubleElementsKind(kind) && IsHoleyElementsKind(kind)) {
+    return NoChange();
+  }
+
+  for (Handle<Map> receiver_map : receiver_maps) {
+    if (!CanInlineArrayIteratingBuiltin(receiver_map)) return NoChange();
+    // We can handle different maps, as long as their elements kind are the
+    // same.
+    if (receiver_map->elements_kind() != kind) return NoChange();
+  }
+
+  dependencies()->AssumePropertyCell(factory()->species_protector());
+
+  Node* k = jsgraph()->ZeroConstant();
+
+  // Make sure the map hasn't changed before we construct the output array.
+  effect = graph()->NewNode(
+      simplified()->CheckMaps(CheckMapsFlag::kNone, receiver_maps), receiver,
+      effect, control);
+
+  Node* original_length = effect = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForJSArrayLength(kind)), receiver,
+      effect, control);
+
+  // Check whether the given callback function is callable. Note that this has
+  // to happen outside the loop to make sure we also throw on empty arrays.
+  Node* check_fail = nullptr;
+  Node* check_throw = nullptr;
+  {
+    // This frame state doesn't ever call the deopt continuation, it's only
+    // necessary to specifiy a continuation in order to handle the exceptional
+    // case.
+    std::vector<Node*> checkpoint_params(
+        {receiver, fncallback, this_arg, k, original_length});
+    const int stack_parameters = static_cast<int>(checkpoint_params.size());
+
+    Node* check_frame_state = CreateJavaScriptBuiltinContinuationFrameState(
+        jsgraph(), function, Builtins::kArraySomeLoopLazyDeoptContinuation,
+        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
+        outer_frame_state, ContinuationFrameStateMode::LAZY);
+    WireInCallbackIsCallableCheck(fncallback, context, check_frame_state,
+                                  effect, &control, &check_fail, &check_throw);
+  }
+
+  // Start the loop.
+  Node* loop = control = graph()->NewNode(common()->Loop(2), control, control);
+  Node* eloop = effect =
+      graph()->NewNode(common()->EffectPhi(2), effect, effect, loop);
+  Node* terminate = graph()->NewNode(common()->Terminate(), eloop, loop);
+  NodeProperties::MergeControlToEnd(graph(), common(), terminate);
+  Node* vloop = k = graph()->NewNode(
+      common()->Phi(MachineRepresentation::kTagged, 2), k, k, loop);
+
+  Node* continue_test =
+      graph()->NewNode(simplified()->NumberLessThan(), k, original_length);
+  Node* continue_branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
+                                           continue_test, control);
+
+  Node* if_true = graph()->NewNode(common()->IfTrue(), continue_branch);
+  Node* if_false = graph()->NewNode(common()->IfFalse(), continue_branch);
+  control = if_true;
+
+  {
+    std::vector<Node*> checkpoint_params(
+        {receiver, fncallback, this_arg, k, original_length});
+    const int stack_parameters = static_cast<int>(checkpoint_params.size());
+
+    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
+        jsgraph(), function, Builtins::kArraySomeLoopEagerDeoptContinuation,
+        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
+        outer_frame_state, ContinuationFrameStateMode::EAGER);
+
+    effect =
+        graph()->NewNode(common()->Checkpoint(), frame_state, effect, control);
+  }
+
+  // Make sure the map hasn't changed during the iteration.
+  effect =
+      graph()->NewNode(simplified()->CheckMaps(CheckMapsFlag::kNone,
+                                               receiver_maps, p.feedback()),
+                       receiver, effect, control);
+
+  Node* element =
+      SafeLoadElement(kind, receiver, control, &effect, &k, p.feedback());
+
+  Node* next_k =
+      graph()->NewNode(simplified()->NumberAdd(), k, jsgraph()->OneConstant());
+
+  Node* hole_true = nullptr;
+  Node* hole_false = nullptr;
+  Node* effect_true = effect;
+
+  if (IsHoleyElementsKind(kind)) {
+    // Holey elements kind require a hole check and skipping of the element in
+    // the case of a hole.
+    Node* check = graph()->NewNode(simplified()->ReferenceEqual(), element,
+                                   jsgraph()->TheHoleConstant());
+    Node* branch =
+        graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
+    hole_true = graph()->NewNode(common()->IfTrue(), branch);
+    hole_false = graph()->NewNode(common()->IfFalse(), branch);
+    control = hole_false;
+
+    // The contract is that we don't leak "the hole" into "user JavaScript",
+    // so we must rename the {element} here to explicitly exclude "the hole"
+    // from the type of {element}.
+    element = graph()->NewNode(common()->TypeGuard(Type::NonInternal()),
+                               element, control);
+  }
+
+  Node* callback_value = nullptr;
+  {
+    // This frame state is dealt with by hand in
+    // Builtins::kArrayEveryLoopLazyDeoptContinuation.
+    std::vector<Node*> checkpoint_params(
+        {receiver, fncallback, this_arg, k, original_length});
+    const int stack_parameters = static_cast<int>(checkpoint_params.size());
+
+    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
+        jsgraph(), function, Builtins::kArraySomeLoopLazyDeoptContinuation,
+        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
+        outer_frame_state, ContinuationFrameStateMode::LAZY);
+
+    callback_value = control = effect = graph()->NewNode(
+        javascript()->Call(5, p.frequency()), fncallback, this_arg, element, k,
+        receiver, context, frame_state, effect, control);
+  }
+
+  // Rewire potential exception edges.
+  Node* on_exception = nullptr;
+  if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
+    RewirePostCallbackExceptionEdges(check_throw, on_exception, effect,
+                                     &check_fail, &control);
+  }
+
+  // We have to coerce callback_value to boolean.
+  Node* if_true_callback;
+  Node* etrue_callback;
+  {
+    Node* boolean_result =
+        graph()->NewNode(simplified()->ToBoolean(), callback_value);
+    Node* check_boolean_result =
+        graph()->NewNode(simplified()->ReferenceEqual(), boolean_result,
+                         jsgraph()->TrueConstant());
+    Node* boolean_branch = graph()->NewNode(
+        common()->Branch(BranchHint::kFalse), check_boolean_result, control);
+    if_true_callback = graph()->NewNode(common()->IfTrue(), boolean_branch);
+    etrue_callback = effect;
+
+    // Nothing to do in the false case.
+    control = graph()->NewNode(common()->IfFalse(), boolean_branch);
+  }
+
+  if (IsHoleyElementsKind(kind)) {
+    Node* after_call_control = control;
+    Node* after_call_effect = effect;
+    control = hole_true;
+    effect = effect_true;
+
+    control = graph()->NewNode(common()->Merge(2), control, after_call_control);
+    effect = graph()->NewNode(common()->EffectPhi(2), effect, after_call_effect,
+                              control);
+  }
+
+  loop->ReplaceInput(1, control);
+  vloop->ReplaceInput(1, next_k);
+  eloop->ReplaceInput(1, effect);
+
+  control = graph()->NewNode(common()->Merge(2), if_false, if_true_callback);
+  effect =
+      graph()->NewNode(common()->EffectPhi(2), eloop, etrue_callback, control);
+  Node* return_value = graph()->NewNode(
+      common()->Phi(MachineRepresentation::kTagged, 2),
+      jsgraph()->FalseConstant(), jsgraph()->TrueConstant(), control);
+
+  // Wire up the branch for the case when IsCallable fails for the callback.
+  // Since {check_throw} is an unconditional throw, it's impossible to
+  // return a successful completion. Therefore, we simply connect the successful
+  // completion to the graph end.
+  Node* throw_node =
+      graph()->NewNode(common()->Throw(), check_throw, check_fail);
+  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
+
+  ReplaceWithValue(node, return_value, effect, control);
+  return Replace(return_value);
+}
+
 Reduction JSCallReducer::ReduceCallApiFunction(Node* node,
                                                Handle<JSFunction> function) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());

src/compiler/js-call-reducer.h

@@ -80,6 +80,7 @@ class JSCallReducer final : public AdvancedReducer {
   Reduction ReduceArrayFind(ArrayFindVariant variant,
                             Handle<JSFunction> function, Node* node);
   Reduction ReduceArrayEvery(Handle<JSFunction> function, Node* node);
+  Reduction ReduceArraySome(Handle<JSFunction> function, Node* node);
   Reduction ReduceArrayPrototypePush(Node* node);
   Reduction ReduceArrayPrototypePop(Node* node);
   Reduction ReduceArrayPrototypeShift(Node* node);

test/mjsunit/optimized-array-some.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-inline-array-builtins --opt
+// Flags: --no-always-opt
+
+// Early exit from some functions properly.
+(() => {
+  const a = [1, 2, 3, 4, 5];
+  let result = 0;
+  function earlyExit() {
+    return a.some(v => {
+      result += v;
+      return v > 2;
+    });
+  }
+  assertTrue(earlyExit());
+  earlyExit();
+  %OptimizeFunctionOnNextCall(earlyExit);
+  assertTrue(earlyExit());
+  assertEquals(18, result);
+})();
+
+// Soft-deopt plus early exit.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+  let result = 0;
+  function softyPlusEarlyExit(deopt) {
+     return a.some(v => {
+       result += v;
+       if (v === 4 && deopt) {
+         a.abc = 25;
+       }
+       return v > 7;
+     });
+  }
+  assertTrue(softyPlusEarlyExit(false));
+  softyPlusEarlyExit(false);
+  %OptimizeFunctionOnNextCall(softyPlusEarlyExit);
+  assertTrue(softyPlusEarlyExit(true));
+  assertEquals(36*3, result);
+})();
+
+// Soft-deopt synced with early exit, which forces the lazy deoptimization
+// continuation handler to exit.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+  let called_values = [];
+  function softyPlusEarlyExit(deopt) {
+     called_values = [];
+     return a.some(v => {
+       called_values.push(v);
+       if (v === 4 && deopt) {
+         a.abc = 25;
+         return true;
+       }
+       return v > 7;
+     });
+  }
+  assertTrue(softyPlusEarlyExit(false));
+  assertArrayEquals([1, 2, 3, 4, 5, 6, 7, 8], called_values);
+  softyPlusEarlyExit(false);
+  %OptimizeFunctionOnNextCall(softyPlusEarlyExit);
+  assertTrue(softyPlusEarlyExit(true));
+  assertArrayEquals([1, 2, 3, 4], called_values);
+})();
+
+// Unknown field access leads to soft-deopt unrelated to some, should still
+// lead to correct result.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
+             20, 21, 22, 23, 24, 25];
+  let result = 0;
+  function eagerDeoptInCalled(deopt) {
+    return a.some((v, i) => {
+      if (i === 13 && deopt) {
+        a.abc = 25;
+      }
+      result += v;
+      return false;
+    });
+  }
+  eagerDeoptInCalled();
+  eagerDeoptInCalled();
+  %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
+  eagerDeoptInCalled();
+  assertFalse(eagerDeoptInCalled(true));
+  eagerDeoptInCalled();
+  assertEquals(1625, result);
+})();
+
+// Length change detected during loop, must cause properly handled eager deopt.
+(() => {
+  let called_values;
+  function eagerDeoptInCalled(deopt) {
+    const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+    called_values = [];
+    return a.some((v,i) => {
+      called_values.push(v);
+      a.length = (i === 5 && deopt) ? 8 : 10;
+      return false;
+    });
+  }
+  assertFalse(eagerDeoptInCalled());
+  assertArrayEquals([1, 2, 3, 4, 5, 6, 7, 8, 9, 10], called_values);
+  eagerDeoptInCalled();
+  %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
+  assertFalse(eagerDeoptInCalled());
+  assertFalse(eagerDeoptInCalled(true));
+  assertArrayEquals([1, 2, 3, 4, 5, 6, 7, 8], called_values);
+  eagerDeoptInCalled();
+})();
+
+// Lazy deopt from a callback that changes the input array. Deopt in a callback
+// execution that returns true.
+(() => {
+  const a = [1, 2, 3, 4, 5];
+  function lazyChanger(deopt) {
+    return a.some((v, i) => {
+      if (i === 3 && deopt) {
+        a[3] = 100;
+        %DeoptimizeNow();
+       }
+      return false;
+    });
+  }
+  assertFalse(lazyChanger());
+  lazyChanger();
+  %OptimizeFunctionOnNextCall(lazyChanger);
+  assertFalse(lazyChanger(true));
+  assertFalse(lazyChanger());
+})();
+
+// Lazy deopt from a callback that will always return false and no element is
+// found. Verifies the lazy-after-callback continuation builtin.
+(() => {
+  const a = [1, 2, 3, 4, 5];
+  function lazyChanger(deopt) {
+    return a.some((v, i) => {
+      if (i === 3 && deopt) {
+        %DeoptimizeNow();
+       }
+      return false;
+    });
+  }
+  assertFalse(lazyChanger());
+  lazyChanger();
+  %OptimizeFunctionOnNextCall(lazyChanger);
+  assertFalse(lazyChanger(true));
+  assertFalse(lazyChanger());
+})();
+
+// Lazy deopt from a callback that changes the input array. Deopt in a callback
+// execution that returns false.
+(() => {
+  const a = [1, 2, 3, 4, 5];
+  function lazyChanger(deopt) {
+    return a.every((v, i) => {
+      if (i === 2 && deopt) {
+        a[3] = 100;
+        %DeoptimizeNow();
+       }
+      return false;
+    });
+  }
+  assertFalse(lazyChanger());
+  lazyChanger();
+  %OptimizeFunctionOnNextCall(lazyChanger);
+  assertFalse(lazyChanger(true));
+  assertFalse(lazyChanger());
+})();
+
+// Escape analyzed array
+(() => {
+  let result = 0;
+  function eagerDeoptInCalled(deopt) {
+    const a_noescape = [0, 1, 2, 3, 4, 5];
+    a_noescape.some((v, i) => {
+      result += v | 0;
+      if (i === 13 && deopt) {
+        a_noescape.length = 25;
+      }
+      return false;
+    });
+  }
+  eagerDeoptInCalled();
+  eagerDeoptInCalled();
+  %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
+  eagerDeoptInCalled();
+  eagerDeoptInCalled(true);
+  eagerDeoptInCalled();
+  assertEquals(75, result);
+})();
+
+// Lazy deopt from runtime call from inlined callback function.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
+             20, 21, 22, 23, 24, 25];
+  let result = 0;
+  function lazyDeopt(deopt) {
+    a.some((v, i) => {
+      result += i;
+      if (i === 13 && deopt) {
+        %DeoptimizeNow();
+      }
+      return false;
+    });
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  lazyDeopt();
+  lazyDeopt(true);
+  lazyDeopt();
+  assertEquals(1500, result);
+})();
+
+// Lazy deopt from runtime call from non-inline callback function.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
+             20, 21, 22, 23, 24, 25];
+  let result = 0;
+  function lazyDeopt(deopt) {
+    function callback(v, i) {
+      result += i;
+      if (i === 13 && deopt) {
+        %DeoptimizeNow();
+      }
+      return false;
+    }
+    %NeverOptimizeFunction(callback);
+    a.some(callback);
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  lazyDeopt();
+  lazyDeopt(true);
+  lazyDeopt();
+  assertEquals(1500, result);
+})();
+
+// Call to a.some is done inside a try-catch block and the callback function
+// being called actually throws.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
+             20, 21, 22, 23, 24, 25];
+  let caught = false;
+  function lazyDeopt(deopt) {
+    try {
+      a.some((v, i) => {
+        if (i === 1 && deopt) {
+          throw("a");
+        }
+        return false;
+      });
+    } catch (e) {
+      caught = true;
+    }
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  lazyDeopt();
+  assertDoesNotThrow(() => lazyDeopt(true));
+  assertTrue(caught);
+  lazyDeopt();
+})();
+
+// Call to a.some is done inside a try-catch block and the callback function
+// being called actually throws, but the callback is not inlined.
+(() => {
+  let a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+  let caught = false;
+  function lazyDeopt(deopt) {
+    function callback(v, i) {
+      if (i === 1 && deopt) {
+        throw("a");
+      }
+      return false;
+    }
+    %NeverOptimizeFunction(callback);
+    try {
+      a.some(callback);
+    } catch (e) {
+      caught = true;
+    }
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  lazyDeopt();
+  assertDoesNotThrow(() => lazyDeopt(true));
+  assertTrue(caught);
+  lazyDeopt();
+})();
+
+// Call to a.some is done inside a try-catch block and the callback function
+// being called throws into a deoptimized caller function.
+(function TestThrowIntoDeoptimizedOuter() {
+  const a = [1, 2, 3, 4];
+  function lazyDeopt(deopt) {
+    function callback(v, i) {
+      if (i === 1 && deopt) {
+        %DeoptimizeFunction(lazyDeopt);
+        throw "some exception";
+      }
+      return false;
+    }
+    %NeverOptimizeFunction(callback);
+    let result = 0;
+    try {
+      result = a.some(callback);
+    } catch (e) {
+      assertEquals("some exception", e);
+      result = "nope";
+    }
+    return result;
+  }
+  assertEquals(false, lazyDeopt(false));
+  assertEquals(false, lazyDeopt(false));
+  assertEquals("nope", lazyDeopt(true));
+  assertEquals("nope", lazyDeopt(true));
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  assertEquals(false, lazyDeopt(false));
+  assertEquals("nope", lazyDeopt(true));
+})();
+
+// An error generated inside the callback includes some in it's
+// stack trace.
+(() => {
+  const re = /Array\.some/;
+  function lazyDeopt(deopt) {
+    const b = [1, 2, 3];
+    let result = 0;
+    b.some((v, i) => {
+      result += v;
+      if (i === 1) {
+        const e = new Error();
+        assertTrue(re.exec(e.stack) !== null);
+      }
+      return false;
+    });
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  lazyDeopt();
+})();
+
+// An error generated inside a non-inlined callback function also
+// includes some in it's stack trace.
+(() => {
+  const re = /Array\.some/;
+  function lazyDeopt(deopt) {
+    const b = [1, 2, 3];
+    let did_assert_error = false;
+    let result = 0;
+    function callback(v, i) {
+      result += v;
+      if (i === 1) {
+        const e = new Error();
+        assertTrue(re.exec(e.stack) !== null);
+        did_assert_error = true;
+      }
+      return false;
+    }
+    %NeverOptimizeFunction(callback);
+    b.some(callback);
+    return did_assert_error;
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  assertTrue(lazyDeopt());
+})();
+
+// An error generated inside a recently deoptimized callback function
+// includes some in it's stack trace.
+(() => {
+  const re = /Array\.some/;
+  function lazyDeopt(deopt) {
+    const b = [1, 2, 3];
+    let did_assert_error = false;
+    let result = 0;
+    b.some((v, i) => {
+      result += v;
+      if (i === 1) {
+        %DeoptimizeNow();
+      } else if (i === 2) {
+        const e = new Error();
+        assertTrue(re.exec(e.stack) !== null);
+        did_assert_error = true;
+      }
+      return false;
+    });
+    return did_assert_error;
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  assertTrue(lazyDeopt());
+})();
+
+// Verify that various exception edges are handled appropriately.
+// The thrown Error object should always indicate it was created from
+// a some call stack.
+(() => {
+  const re = /Array\.some/;
+  const a = [1, 2, 3];
+  let result = 0;
+  function lazyDeopt() {
+    a.some((v, i) => {
+      result += i;
+      if (i === 1) {
+        %DeoptimizeFunction(lazyDeopt);
+        throw new Error();
+      }
+      return false;
+    });
+  }
+  assertThrows(() => lazyDeopt());
+  assertThrows(() => lazyDeopt());
+  try {
+    lazyDeopt();
+  } catch (e) {
+    assertTrue(re.exec(e.stack) !== null);
+  }
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  try {
+    lazyDeopt();
+  } catch (e) {
+    assertTrue(re.exec(e.stack) !== null);
+  }
+})();
+
+// Messing with the Array prototype causes deoptimization.
+(() => {
+  const a = [1, 2, 3];
+  let result = 0;
+  function prototypeChanged() {
+    a.some((v, i) => {
+      result += v;
+      return false;
+    });
+  }
+  prototypeChanged();
+  prototypeChanged();
+  %OptimizeFunctionOnNextCall(prototypeChanged);
+  prototypeChanged();
+  a.constructor = {};
+  prototypeChanged();
+  assertUnoptimized(prototypeChanged);
+  assertEquals(24, result);
+})();
+
+// Verify holes are skipped.
+(() => {
+  const a = [1, 2, , 3, 4];
+  function withHoles() {
+    const callback_values = [];
+    a.some(v => {
+      callback_values.push(v);
+      return false;
+    });
+    return callback_values;
+  }
+  withHoles();
+  withHoles();
+  %OptimizeFunctionOnNextCall(withHoles);
+  assertArrayEquals([1, 2, 3, 4], withHoles());
+})();
+
+(() => {
+  const a = [1.5, 2.5, , 3.5, 4.5];
+  function withHoles() {
+    const callback_values = [];
+    a.some(v => {
+      callback_values.push(v);
+      return false;
+    });
+    return callback_values;
+  }
+  withHoles();
+  withHoles();
+  %OptimizeFunctionOnNextCall(withHoles);
+  assertArrayEquals([1.5, 2.5, 3.5, 4.5], withHoles());
+})();
+
+// Handle callback is not callable.
+(() => {
+  const a = [1, 2, 3, 4, 5];
+  function notCallable() {
+    return a.some(undefined);
+  }
+
+  assertThrows(notCallable, TypeError);
+  try { notCallable(); } catch(e) { }
+  %OptimizeFunctionOnNextCall(notCallable);
+  assertThrows(notCallable, TypeError);
+})();