Reland of Improve test coverage for non-extensible holey array in optimized code

This is reland of https://chromium-review.googlesource.com/c/v8/v8/+/1575036 which the flaky test is fixed by moving '%PrepareFunctionForOptimization' around

Bug: v8:6831
Change-Id: I0e8c3d2452b14c86e8ff0851e1840294734435e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1582481Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#61050}

test/mjsunit/compiler/array-access.js

@@ -45,7 +45,8 @@ function GetAAN(a,n) {
   return a[a[a[n]]];
 }
 
-function RunGetTests() {
+function RunGetTests(packed=true) {
+  if (packed) {
     var a = [2,0,1];
     assertEquals(2, Get0(a));
 
@@ -62,6 +63,25 @@ function RunGetTests() {
     assertEquals(0, GetAAN(a,0));
     assertEquals(1, GetAAN(a,1));
     assertEquals(2, GetAAN(a,2));
+  }
+  else {
+    var a = ['2','0','1'];
+    assertEquals('2', Get0(a));
+
+    assertEquals('2', GetN(a, 0));
+    assertEquals('0', GetN(a, 1));
+    assertEquals('1', GetN(a, 2));
+
+    assertEquals('1', GetA0(a));
+
+    assertEquals('1', GetAN(a,0));
+    assertEquals('2', GetAN(a,1));
+    assertEquals('0', GetAN(a,2));
+
+    assertEquals('0', GetAAN(a,0));
+    assertEquals('1', GetAAN(a,1));
+    assertEquals('2', GetAAN(a,2));
+  }
 }
 
 
@@ -81,29 +101,39 @@ function SetNX(a, n, x) {
   a[n] = x;
 }
 
-function RunSetTests(a) {
+function RunSetTests(a, packed=true) {
   Set07(a);
+  if (packed) {
     assertEquals(7, a[0]);
+  }
   assertEquals(0, a[1]);
   assertEquals(0, a[2]);
 
   Set0V(a, 1);
+  if (packed) {
     assertEquals(1, a[0]);
+  }
   assertEquals(0, a[1]);
   assertEquals(0, a[2]);
 
   SetN7(a, 2);
+  if (packed) {
     assertEquals(1, a[0]);
+  }
   assertEquals(0, a[1]);
   assertEquals(7, a[2]);
 
   SetNX(a, 1, 5);
+  if (packed) {
     assertEquals(1, a[0]);
+  }
   assertEquals(5, a[1]);
   assertEquals(7, a[2]);
 
   for (var i = 0; i < 3; i++) SetNX(a, i, 0);
+  if (packed) {
     assertEquals(0, a[0]);
+  }
   assertEquals(0, a[1]);
   assertEquals(0, a[2]);
 }
@@ -131,31 +161,55 @@ for (var i = 0; i < 1000; i++) {
 
 RunArrayBoundsCheckTest();
 
+// Packed
 // Non-extensible
-a = Object.seal([0,0,0]);
-o = Object.seal({0: 0, 1: 0, 2: 0});
+a = Object.preventExtensions([0,0,0,'a']);
+o = Object.preventExtensions({0: 0, 1: 0, 2: 0});
 for (var i = 0; i < 1000; i++) {
   RunGetTests();
+  RunGetTests(false);
   RunSetTests(a);
   RunSetTests(o);
 }
 
-RunArrayBoundsCheckTest();
-
 // Sealed
-a = Object.seal([0,0,0]);
+a = Object.seal([0,0,0,'a']);
 o = Object.seal({0: 0, 1: 0, 2: 0});
 for (var i = 0; i < 1000; i++) {
   RunGetTests();
+  RunGetTests(false);
   RunSetTests(a);
   RunSetTests(o);
 }
 
-RunArrayBoundsCheckTest();
+// Frozen
+a = Object.freeze([0,0,0,'a']);
+o = Object.freeze({0: 0, 1: 0, 2: 0});
+for (var i = 0; i < 1000; i++) {
+  RunGetTests();
+  RunGetTests(false);
+}
+
+// Holey
+// Non-extensible
+a = Object.preventExtensions([,0,0,'a']);
+for (var i = 0; i < 1000; i++) {
+  RunGetTests();
+  RunGetTests(false);
+  RunSetTests(a, false);
+}
+
+// Sealed
+a = Object.seal([,0,0,'a']);
+for (var i = 0; i < 1000; i++) {
+  RunGetTests();
+  RunGetTests(false);
+  RunSetTests(a, false);
+}
 
 // Frozen
-a = Object.seal([0,0,0]);
-o = Object.seal({0: 0, 1: 0, 2: 0});
+a = Object.freeze([,0,0,'a']);
 for (var i = 0; i < 1000; i++) {
   RunGetTests();
+  RunGetTests(false);
 }

test/mjsunit/compiler/array-constructor.js

@@ -108,41 +108,82 @@
   assertInstanceof(foo(-1), RangeError);
 })();
 
+// Packed
 // Test non-extensible Array call with multiple parameters.
 (() => {
-  function foo(x, y, z) { return Object.preventExtensions(new Array(x, y, z)); }
+  function foo(x, y, z, t) { return Object.preventExtensions(new Array(x, y, z, t)); }
 
   %PrepareFunctionForOptimization(foo);
-  assertEquals([1, 2, 3], foo(1, 2, 3));
-  assertEquals([1, 2, 3], foo(1, 2, 3));
-  assertFalse(Object.isExtensible(foo(1,2,3)));
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertFalse(Object.isExtensible(foo(1,2,3, 'a')));
   %OptimizeFunctionOnNextCall(foo);
-  assertEquals([1, 2, 3], foo(1, 2, 3));
-  assertFalse(Object.isExtensible(foo(1,2,3)));
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertFalse(Object.isExtensible(foo(1,2,3, 'a')));
 })();
 
 // Test sealed Array call with multiple parameters.
 (() => {
-  function foo(x, y, z) { return Object.seal(new Array(x, y, z)); }
+  function foo(x, y, z, t) { return Object.seal(new Array(x, y, z, t)); }
 
   %PrepareFunctionForOptimization(foo);
-  assertEquals([1, 2, 3], foo(1, 2, 3));
-  assertEquals([1, 2, 3], foo(1, 2, 3));
-  assertTrue(Object.isSealed(foo(1,2,3)));
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertTrue(Object.isSealed(foo(1,2,3, 'a')));
   %OptimizeFunctionOnNextCall(foo);
-  assertEquals([1, 2, 3], foo(1, 2, 3));
-  assertTrue(Object.isSealed(foo(1,2,3)));
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertTrue(Object.isSealed(foo(1,2,3, 'a')));
 })();
 
 // Test frozen Array call with multiple parameters.
 (() => {
-  function foo(x, y, z) { return Object.freeze(new Array(x, y, z)); }
+  function foo(x, y, z, t) { return Object.freeze(new Array(x, y, z, t)); }
 
   %PrepareFunctionForOptimization(foo);
-  assertEquals([1, 2, 3], foo(1, 2, 3));
-  assertEquals([1, 2, 3], foo(1, 2, 3));
-  assertTrue(Object.isFrozen(foo(1,2,3)));
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertTrue(Object.isFrozen(foo(1,2,3, 'a')));
   %OptimizeFunctionOnNextCall(foo);
-  assertEquals([1, 2, 3], foo(1, 2, 3));
-  assertTrue(Object.isFrozen(foo(1,2,3)));
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertTrue(Object.isFrozen(foo(1,2,3, 'a')));
+})();
+
+// Holey
+// Test non-extensible Array call with multiple parameters.
+(() => {
+  function foo(x, y, z, t) { return Object.preventExtensions([, x, y, z, t]); }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertFalse(Object.isExtensible(foo(1,2,3, 'a')));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertFalse(Object.isExtensible(foo(1,2,3, 'a')));
+})();
+
+// Test sealed Array call with multiple parameters.
+(() => {
+  function foo(x, y, z, t) { return Object.seal([, x, y, z, t]); }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertTrue(Object.isSealed(foo(1,2,3, 'a')));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertTrue(Object.isSealed(foo(1,2,3, 'a')));
+})();
+
+// Test frozen Array call with multiple parameters.
+(() => {
+  function foo(x, y, z, t) { return Object.freeze([, x, y, z, t]); }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertTrue(Object.isFrozen(foo(1,2,3, 'a')));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertTrue(Object.isFrozen(foo(1,2,3, 'a')));
 })();

test/mjsunit/compiler/array-every.js

@@ -17,27 +17,53 @@
   assertTrue(foo([3, 3, 3], {x:3}));
   assertFalse(foo([3, 3, 2], {x:3}));
 
+  // Packed
   // Non-extensible array
   %PrepareFunctionForOptimization(foo);
-  assertTrue(foo(Object.preventExtensions([3, 3, 3]), {x:3}));
-  assertFalse(foo(Object.preventExtensions([3, 3, 2]), {x:3}));
+  assertTrue(foo(Object.preventExtensions(['3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.preventExtensions(['3', '3', '2']), {x:'3'}));
   %OptimizeFunctionOnNextCall(foo);
-  assertTrue(foo(Object.preventExtensions([3, 3, 3]), {x:3}));
-  assertFalse(foo(Object.preventExtensions([3, 3, 2]), {x:3}));
+  assertTrue(foo(Object.preventExtensions(['3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.preventExtensions(['3', '3', '2']), {x:'3'}));
 
   // Sealed array
   %PrepareFunctionForOptimization(foo);
-  assertTrue(foo(Object.seal([3, 3, 3]), {x:3}));
-  assertFalse(foo(Object.seal([3, 3, 2]), {x:3}));
+  assertTrue(foo(Object.seal(['3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.seal(['3', '3', '2']), {x:'3'}));
   %OptimizeFunctionOnNextCall(foo);
-  assertTrue(foo(Object.seal([3, 3, 3]), {x:3}));
-  assertFalse(foo(Object.seal([3, 3, 2]), {x:3}));
+  assertTrue(foo(Object.seal(['3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.seal(['3', '3', '2']), {x:'3'}));
 
   // Frozen array
   %PrepareFunctionForOptimization(foo);
-  assertTrue(foo(Object.freeze([3, 3, 3]), {x:3}));
-  assertFalse(foo(Object.freeze([3, 3, 2]), {x:3}));
+  assertTrue(foo(Object.freeze(['3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.freeze(['3', '3', '2']), {x:'3'}));
   %OptimizeFunctionOnNextCall(foo);
-  assertTrue(foo(Object.freeze([3, 3, 3]), {x:3}));
-  assertFalse(foo(Object.freeze([3, 3, 2]), {x:3}));
+  assertTrue(foo(Object.freeze(['3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.freeze(['3', '3', '2']), {x:'3'}));
+
+  // Holey
+  // Non-extensible array
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.preventExtensions([, '3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.preventExtensions([, '3', '3', '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.preventExtensions([, '3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.preventExtensions([, '3', '3', '2']), {x:'3'}));
+
+  // Sealed array
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.seal([, '3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.seal([, '3', '3', '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.seal([, '3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.seal([, '3', '3', '2']), {x:'3'}));
+
+  // Frozen array
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.freeze([, '3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.freeze([, '3', '3', '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.freeze([, '3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.freeze([, '3', '3', '2']), {x:'3'}));
 })();

test/mjsunit/compiler/array-find.js

@@ -17,27 +17,53 @@
   assertEquals(3, foo([1, 2, 3], {x:3}));
   assertEquals(undefined, foo([0, 1, 2], {x:3}));
 
+  // Packed
   // Non-extensible
   %PrepareFunctionForOptimization(foo);
-  assertEquals(3, foo(Object.preventExtensions([1, 2, 3]), {x:3}));
-  assertEquals(undefined, foo(Object.preventExtensions([0, 1, 2]), {x:3}));
+  assertEquals(3, foo(Object.preventExtensions(['1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.preventExtensions(['0', 1, 2]), {x:3}));
   %OptimizeFunctionOnNextCall(foo);
-  assertEquals(3, foo(Object.preventExtensions([1, 2, 3]), {x:3}));
-  assertEquals(undefined, foo(Object.preventExtensions([0, 1, 2]), {x:3}));
+  assertEquals(3, foo(Object.preventExtensions(['1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.preventExtensions(['0', 1, 2]), {x:3}));
 
   // Sealed
   %PrepareFunctionForOptimization(foo);
-  assertEquals(3, foo(Object.seal([1, 2, 3]), {x:3}));
-  assertEquals(undefined, foo(Object.seal([0, 1, 2]), {x:3}));
+  assertEquals(3, foo(Object.seal(['1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.seal(['0', 1, 2]), {x:3}));
   %OptimizeFunctionOnNextCall(foo);
-  assertEquals(3, foo(Object.seal([1, 2, 3]), {x:3}));
-  assertEquals(undefined, foo(Object.seal([0, 1, 2]), {x:3}));
+  assertEquals(3, foo(Object.seal(['1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.seal(['0', 1, 2]), {x:3}));
 
   // Frozen
   %PrepareFunctionForOptimization(foo);
-  assertEquals(3, foo(Object.freeze([1, 2, 3]), {x:3}));
-  assertEquals(undefined, foo(Object.freeze([0, 1, 2]), {x:3}));
+  assertEquals(3, foo(Object.freeze(['1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.freeze(['0', 1, 2]), {x:3}));
   %OptimizeFunctionOnNextCall(foo);
-  assertEquals(3, foo(Object.freeze([1, 2, 3]), {x:3}));
-  assertEquals(undefined, foo(Object.freeze([0, 1, 2]), {x:3}));
+  assertEquals(3, foo(Object.freeze(['1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.freeze(['0', 1, 2]), {x:3}));
+
+  // Holey
+  // Non-extensible
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo(Object.preventExtensions([, '1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.preventExtensions([, '0', 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(Object.preventExtensions([, '1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.preventExtensions([, '0', 1, 2]), {x:3}));
+
+  // Sealed
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo(Object.seal([, '1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.seal([, '0', 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(Object.seal([, '1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.seal([, '0', 1, 2]), {x:3}));
+
+  // Frozen
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo(Object.freeze([, 1, 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.freeze([, 0, 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(Object.freeze([, 1, 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.freeze([, 0, 1, 2]), {x:3}));
 })();

test/mjsunit/compiler/array-findindex.js

@@ -17,27 +17,53 @@
   assertEquals(2, foo([1, 2, 3], {x:3}));
   assertEquals(-1, foo([0, 1, 2], {x:3}));
 
+  // Packed
   // Non-extensible
   %PrepareFunctionForOptimization(foo);
-  assertEquals(2, foo(Object.preventExtensions([1, 2, 3]), {x:3}));
-  assertEquals(-1, foo(Object.preventExtensions([0, 1, 2]), {x:3}));
+  assertEquals(2, foo(Object.preventExtensions(['1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.preventExtensions(['0', 1, 2]), {x:3}));
   %OptimizeFunctionOnNextCall(foo);
-  assertEquals(2, foo(Object.preventExtensions([1, 2, 3]), {x:3}));
-  assertEquals(-1, foo(Object.preventExtensions([0, 1, 2]), {x:3}));
+  assertEquals(2, foo(Object.preventExtensions(['1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.preventExtensions(['0', 1, 2]), {x:3}));
 
   // Sealed
   %PrepareFunctionForOptimization(foo);
-  assertEquals(2, foo(Object.seal([1, 2, 3]), {x:3}));
-  assertEquals(-1, foo(Object.seal([0, 1, 2]), {x:3}));
+  assertEquals(2, foo(Object.seal(['1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.seal(['0', 1, 2]), {x:3}));
   %OptimizeFunctionOnNextCall(foo);
-  assertEquals(2, foo(Object.seal([1, 2, 3]), {x:3}));
-  assertEquals(-1, foo(Object.seal([0, 1, 2]), {x:3}));
+  assertEquals(2, foo(Object.seal(['1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.seal(['0', 1, 2]), {x:3}));
 
   // Frozen
   %PrepareFunctionForOptimization(foo);
-  assertEquals(2, foo(Object.freeze([1, 2, 3]), {x:3}));
-  assertEquals(-1, foo(Object.freeze([0, 1, 2]), {x:3}));
+  assertEquals(2, foo(Object.freeze(['1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.freeze(['0', 1, 2]), {x:3}));
   %OptimizeFunctionOnNextCall(foo);
-  assertEquals(2, foo(Object.freeze([1, 2, 3]), {x:3}));
-  assertEquals(-1, foo(Object.freeze([0, 1, 2]), {x:3}));
+  assertEquals(2, foo(Object.freeze(['1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.freeze(['0', 1, 2]), {x:3}));
+
+  // Holey
+  // Non-extensible
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo(Object.preventExtensions([, '1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.preventExtensions([, '0', 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(Object.preventExtensions([, '1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.preventExtensions([, '0', 1, 2]), {x:3}));
+
+  // Sealed
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo(Object.seal([, '1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.seal([, '0', 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(Object.seal([, '1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.seal([, '0', 1, 2]), {x:3}));
+
+  // Frozen
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo(Object.freeze([, '1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.freeze([, '0', 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(Object.freeze([, '1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.freeze([, '0', 1, 2]), {x:3}));
 })();

test/mjsunit/compiler/array-is-array.js

@@ -110,6 +110,7 @@
   assertInstanceof(foo({}), TypeError);
 })();
 
+// Packed
 // Test JSObjectIsArray in JSTypedLowering for the case that the
 // input value is known to be a non-extensible Array literal.
 (function() {
@@ -151,3 +152,46 @@
   %OptimizeFunctionOnNextCall(foo);
   assertTrue(foo());
 })();
+
+// Holey
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be a non-extensible Array literal.
+(function() {
+  function foo() {
+    return Array.isArray(Object.preventExtensions([,]));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be a sealed Array literal.
+(function() {
+  function foo() {
+    return Array.isArray(Object.seal([,]));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be a frozen Array literal.
+(function() {
+  function foo() {
+    return Array.isArray(Object.freeze([,]));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();

test/mjsunit/compiler/array-length.js

@@ -56,18 +56,36 @@ function MainTest() {
 }
 MainTest();
 
+// Packed
 // Non-extensible, sealed, frozen
 a0 = Object.preventExtensions([]);
-a2 = Object.seal([1,2]);
-a5 = Object.freeze([1,2,3,4,5]);
+a2 = Object.seal([1,'2']);
+a5 = Object.freeze([1,2,'3',4,5]);
 MainTest();
 
 a0 = Object.seal([]);
-a2 = Object.freeze([1,2]);
-a5 = Object.preventExtensions([1,2,3,4,5]);
+a2 = Object.freeze([1,'2']);
+a5 = Object.preventExtensions([1,2,'3',4,5]);
 MainTest();
 
 a0 = Object.freeze([]);
-a2 = Object.preventExtensions([1,2]);
-a5 = Object.seal([1,2,3,4,5]);
+a2 = Object.preventExtensions([1,'2']);
+a5 = Object.seal([1,2,'3',4,5]);
+MainTest();
+
+// Holey
+// Non-extensible, sealed, frozen
+a0 = Object.preventExtensions([]);
+a2 = Object.seal([,'2']);
+a5 = Object.freeze([,2,'3',4,5]);
+MainTest();
+
+a0 = Object.seal([]);
+a2 = Object.freeze([,'2']);
+a5 = Object.preventExtensions([,2,'3',4,5]);
+MainTest();
+
+a0 = Object.freeze([]);
+a2 = Object.preventExtensions([,'2']);
+a5 = Object.seal([,2,3,4,5]);
 MainTest();

test/mjsunit/compiler/array-slice-clone.js

@@ -399,10 +399,11 @@
   assertEquals(narr, [6,6,6]);
 })();
 
+// Packed
 // Trigger JSCallReducer on slice() and slice(0)
 (function() {
   // Non-extensible:
-  var arr = Object.preventExtensions([1,2,3,4,5]);
+  var arr = Object.preventExtensions([1,2,'a',4,5]);
 
   function slice() {
     return arr.slice();
@@ -431,10 +432,51 @@
   test();
 
   // Sealed
-  arr = Object.seal([1,2,3,4,5]);
+  arr = Object.seal([1,2,'a',4,5]);
   test();
 
   // Frozen
-  arr = Object.freeze([1,2,3,4,5]);
+  arr = Object.freeze([1,2,'a',4,5]);
+  test();
+})();
+
+// Holey
+// Trigger JSCallReducer on slice() and slice(0)
+(function() {
+  // Non-extensible:
+  var arr = Object.preventExtensions([,1,2,'a',4,5]);
+
+  function slice() {
+    return arr.slice();
+  }
+
+  function slice0() {
+    return arr.slice(0);
+  }
+
+  function test() {
+    assertEquals(arr, slice());
+    assertFalse(arr === slice());
+    assertEquals(slice(), slice0());
+    assertEquals(slice0(), slice());
+
+    %PrepareFunctionForOptimization(slice0);
+    %PrepareFunctionForOptimization(slice);
+    %OptimizeFunctionOnNextCall(slice0);
+    assertEquals(slice(), slice0());
+    %OptimizeFunctionOnNextCall(slice);
+
+    assertEquals(slice(), slice0());
+    assertOptimized(slice0);
+    assertOptimized(slice);
+  }
+  test();
+
+  // Sealed
+  arr = Object.seal([,1,2,'a',4,5]);
+  test();
+
+  // Frozen
+  arr = Object.freeze([,1,2,'a',4,5]);
   test();
 })();

test/mjsunit/compiler/array-some.js

@@ -17,27 +17,53 @@
   assertTrue(foo([1, 2, 3], {x:3}));
   assertFalse(foo([0, 1, 2], {x:3}));
 
+  // Packed
   // Non-extensible
   %PrepareFunctionForOptimization(foo);
-  assertTrue(foo(Object.preventExtensions([1, 2, 3]), {x:3}));
-  assertFalse(foo(Object.preventExtensions([0, 1, 2]), {x:3}));
+  assertTrue(foo(Object.preventExtensions([1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.preventExtensions([0, 1, '2']), {x:'3'}));
   %OptimizeFunctionOnNextCall(foo);
-  assertTrue(foo(Object.preventExtensions([1, 2, 3]), {x:3}));
-  assertFalse(foo(Object.preventExtensions([0, 1, 2]), {x:3}));
+  assertTrue(foo(Object.preventExtensions([1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.preventExtensions([0, 1, '2']), {x:'3'}));
 
   // Sealed
   %PrepareFunctionForOptimization(foo);
-  assertTrue(foo(Object.seal([1, 2, 3]), {x:3}));
-  assertFalse(foo(Object.seal([0, 1, 2]), {x:3}));
+  assertTrue(foo(Object.seal([1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.seal([0, 1, '2']), {x:'3'}));
   %OptimizeFunctionOnNextCall(foo);
-  assertTrue(foo(Object.seal([1, 2, 3]), {x:3}));
-  assertFalse(foo(Object.seal([0, 1, 2]), {x:3}));
+  assertTrue(foo(Object.seal([1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.seal([0, 1, '2']), {x:'3'}));
 
   // Frozen
   %PrepareFunctionForOptimization(foo);
-  assertTrue(foo(Object.freeze([1, 2, 3]), {x:3}));
-  assertFalse(foo(Object.freeze([0, 1, 2]), {x:3}));
+  assertTrue(foo(Object.freeze([1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.freeze([0, 1, '2']), {x:'3'}));
   %OptimizeFunctionOnNextCall(foo);
-  assertTrue(foo(Object.freeze([1, 2, 3]), {x:3}));
-  assertFalse(foo(Object.freeze([0, 1, 2]), {x:3}));
+  assertTrue(foo(Object.freeze([1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.freeze([0, 1, '2']), {x:'3'}));
+
+  // Holey
+  // Non-extensible
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.preventExtensions([, 1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.preventExtensions([, 0, 1, '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.preventExtensions([, 1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.preventExtensions([, 0, 1, '2']), {x:'3'}));
+
+  // Sealed
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.seal([, 1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.seal([, 0, 1, '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.seal([, 1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.seal([, 0, 1, '2']), {x:'3'}));
+
+  // Frozen
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.freeze([, 1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.freeze([, 0, 1, '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.freeze([, 1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.freeze([, 0, 1, '2']), {x:'3'}));
 })();

test/mjsunit/compiler/constant-fold-cow-array.js

@@ -36,9 +36,10 @@
   assertUnoptimized(foo);
 })();
 
+// Packed
 // Non-extensible
 (function() {
-  const a = Object.preventExtensions([1, 2, 3]);
+  const a = Object.preventExtensions([1, 2, '3']);
   const foo = () => a[0];
   %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo());
@@ -52,7 +53,7 @@
 
 // Sealed
 (function() {
-  const a = Object.seal([1, 2, 3]);
+  const a = Object.seal([1, 2, '3']);
   const foo = () => a[0];
   %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo());
@@ -66,7 +67,50 @@
 
 // Frozen
 (function() {
-  const a = Object.freeze([1, 2, 3]);
+  const a = Object.freeze([1, 2, '3']);
+  const foo = () => a[0];
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo());
+  assertEquals(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo());
+  assertOptimized(foo);
+  a[0] = 42;
+  assertEquals(1, foo());
+})();
+
+// Holey
+// Non-extensible
+(function() {
+  const a = Object.preventExtensions([1, 2, , '3']);
+  const foo = () => a[0];
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo());
+  assertEquals(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo());
+  assertOptimized(foo);
+  a[0] = 42;
+  assertEquals(42, foo());
+})();
+
+// Sealed
+(function() {
+  const a = Object.seal([1, 2, , '3']);
+  const foo = () => a[0];
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo());
+  assertEquals(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo());
+  assertOptimized(foo);
+  a[0] = 42;
+  assertEquals(42, foo());
+})();
+
+// Frozen
+(function() {
+  const a = Object.freeze([1, 2, , '3']);
   const foo = () => a[0];
   %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo());

test/mjsunit/keyed-has-ic.js

@@ -405,12 +405,27 @@ for (test in tests) {
     return true;
   }
 
-  var ary = [0,1,2,3];
+  var ary = [0, 1, 2, '3'];
   function testArray(ary) {
     assertTrue(test(ary, 1));
     assertTrue(test(ary, 1));
   }
   testArray(ary);
+  // Packed
+  // Non-extensible
+  var b =  Object.preventExtensions(ary);
+  testArray(b);
+
+  // Sealed
+  var c =  Object.seal(ary);
+  testArray(c);
+
+  // Frozen
+  var d =  Object.freeze(ary);
+  testArray(d);
+
+  // Holey
+  var ary = [, 0, 1, 2, '3'];
   // Non-extensible
   var b =  Object.preventExtensions(ary);
   testArray(b);
@@ -430,7 +445,7 @@ for (test in tests) {
   assertFalse(test(str, 0));
 })();
 
-const heap_constant_ary = [0,1,2,3];
+const heap_constant_ary = [0,1,2,'3'];
 
 function testHeapConstantArray(heap_constant_ary) {
 
@@ -450,6 +465,7 @@ function testHeapConstantArray(heap_constant_ary) {
 }
 testHeapConstantArray(heap_constant_ary);
 
+// Packed
 // Non-extensible
 var b =  Object.preventExtensions(heap_constant_ary);
 testHeapConstantArray(b);
@@ -461,3 +477,17 @@ testHeapConstantArray(c);
 // Frozen
 var d =  Object.freeze(heap_constant_ary);
 testHeapConstantArray(d);
+
+// Holey
+const holey_heap_constant_ary = [,0,1,2,'3'];
+// Non-extensible
+var b =  Object.preventExtensions(holey_heap_constant_ary);
+testHeapConstantArray(b);
+
+// Sealed
+var c =  Object.seal(holey_heap_constant_ary);
+testHeapConstantArray(c);
+
+// Frozen
+var d =  Object.freeze(holey_heap_constant_ary);
+testHeapConstantArray(d);

test/mjsunit/keyed-ic.js

@@ -187,6 +187,73 @@ runTest = function() {
 
 runTest();
 
+// ----------------------------------------------------------------------
+// Indexed access for packed/holey elements
+// ----------------------------------------------------------------------
+runTest = function() {
+  var o = [ 'a', 43 ];
+
+  function test(o, holey=false) {
+    var initial_X = 0;
+    var X = initial_X;
+    var Y = 1;
+
+    function fieldTest(change_index) {
+      for (var i = 0; i < 10; i++) {
+        var property = o[X];
+        if (i <= change_index) {
+          if (holey) {
+            assertEquals(undefined, property);
+          } else {
+            assertEquals('a', property);
+          }
+        } else {
+          if (holey) {
+            assertEquals('a', property);
+          }
+          else {
+            assertEquals(43, property);
+          }
+        }
+        if (i == change_index) X = Y;
+      }
+      X = initial_X;
+    };
+
+    for (var i = 0; i < 10; i++) fieldTest(i);
+  }
+  test(o);
+
+  // Packed
+  // Non-extensible
+  var b =  Object.preventExtensions(o);
+  test(b);
+
+  // Sealed
+  var c =  Object.seal(o);
+  test(c);
+
+  // Frozen
+  var d =  Object.freeze(o);
+  test(d);
+
+  // Holey
+  // Non-extensible
+  o = [, 'a'];
+  var b =  Object.preventExtensions(o);
+  test(b, true);
+
+  // Sealed
+  var c =  Object.seal(o);
+  test(c, true);
+
+  // Frozen
+  var d =  Object.freeze(o);
+  test(d, true);
+}
+
+runTest();
+
 
 // ----------------------------------------------------------------------
 // Constant function access.