test/mjsunit/compiler · 4d07a89d66a782c755402e909dd25ebca4792347 · Linshizhi / V8

[turbofan] Disable speculation on Array.push if map check fails · 674402ff

Sigurd Schneider authored Dec 14, 2017

Bug: v8:7204, v8:7127
Change-Id: Id99b0e83385275508a9e7f46e17bb8263f7b256a
Reviewed-on: https://chromium-review.googlesource.com/826626Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50103}

674402ff

Name	Last commit	Last update
..
accessor-exceptions1.js		Loading commit data...
accessor-exceptions2.js		Loading commit data...
alloc-number-debug.js		Loading commit data...
alloc-number.js		Loading commit data...
alloc-object-huge.js		Loading commit data...
alloc-object.js		Loading commit data...
array-access.js		Loading commit data...
array-constructor.js		Loading commit data...
array-length.js		Loading commit data...
array-push-1.js		Loading commit data...
array-push-2.js		Loading commit data...
array-push-3.js		Loading commit data...
array-subclass.js		Loading commit data...
assignment-deopt.js		Loading commit data...
assignment.js		Loading commit data...
binary-ops.js		Loading commit data...
boolean-protototype.js		Loading commit data...
call-keyed.js		Loading commit data...
capture-context.js		Loading commit data...
compare-map-elim.js		Loading commit data...
compare-map-elim2.js		Loading commit data...
compare-objeq-elim.js		Loading commit data...
compare.js		Loading commit data...
complex-for-in.js		Loading commit data...
concurrent-invalidate-transition-map.js		Loading commit data...
concurrent-proto-change.js		Loading commit data...
constant-fold-cow-array.js		Loading commit data...
constant-fold-tostring.js		Loading commit data...
constructor-inlining-no-harmony-restrict-constructor-return.js		Loading commit data...
constructor-inlining.js		Loading commit data...
control-flow-0.js		Loading commit data...
control-flow-1.js		Loading commit data...
control-flow-2.js		Loading commit data...
count-deopt.js		Loading commit data...
countoperation.js		Loading commit data...
dead-code.js		Loading commit data...
dead-code2.js		Loading commit data...
dead-code3.js		Loading commit data...
dead-code4.js		Loading commit data...
dead-code5.js		Loading commit data...
dead-code6.js		Loading commit data...
dead-loops-neg.js		Loading commit data...
dead-loops.js		Loading commit data...
dead-string-add-warm.js		Loading commit data...
dead-string-add.js		Loading commit data...
delete.js		Loading commit data...
deopt-accessors1.js		Loading commit data...
deopt-accessors2.js		Loading commit data...
deopt-accessors3.js		Loading commit data...
deopt-accessors4.js		Loading commit data...
deopt-accessors5.js		Loading commit data...
deopt-accessors6.js		Loading commit data...
deopt-accessors7.js		Loading commit data...
deopt-args.js		Loading commit data...
deopt-array-builtins.js		Loading commit data...
deopt-array-push.js		Loading commit data...
deopt-bool.js		Loading commit data...
deopt-bool2.js		Loading commit data...
deopt-closure.js		Loading commit data...
deopt-during-eval-lookup.js		Loading commit data...
deopt-eager-and-lazy.js		Loading commit data...
deopt-eager-var-mutation-ite.js		Loading commit data...
deopt-eager-with-freeze.js		Loading commit data...
deopt-followed-by-gc.js		Loading commit data...
deopt-inlined-from-call.js		Loading commit data...
deopt-inlined-smi.js		Loading commit data...
deopt-lazy-freeze.js		Loading commit data...
deopt-lazy-shape-mutation.js		Loading commit data...
deopt-lazy-var-mutation.js		Loading commit data...
deopt-many-lazy.js		Loading commit data...
deopt-materialize-accumulator.js		Loading commit data...
deopt-now-lazy.js		Loading commit data...
deopt-numberoroddball-binop.js		Loading commit data...
deopt-simple-eager.js		Loading commit data...
deopt-simple-lazy.js		Loading commit data...
deopt-simple-try-catch.js		Loading commit data...
deopt-soft-simple.js		Loading commit data...
deopt-string-outofbounds.js		Loading commit data...
deopt-tonumber-binop.js		Loading commit data...
deopt-tonumber-compare.js		Loading commit data...
deopt-tonumber-shift.js		Loading commit data...
deopt-twice-on-call.js		Loading commit data...
deopt-twice.js		Loading commit data...
deoptimize-lazy-weak.js		Loading commit data...
division-by-constant.js		Loading commit data...
dont-constant-fold-deopting-checks.js		Loading commit data...
double-array-to-global.js		Loading commit data...
eager-deopt-simple.js		Loading commit data...
escape-analysis-1.js		Loading commit data...
escape-analysis-10.js		Loading commit data...
escape-analysis-11.js		Loading commit data...
escape-analysis-12.js		Loading commit data...
escape-analysis-13.js		Loading commit data...
escape-analysis-15.js		Loading commit data...
escape-analysis-16.js		Loading commit data...
escape-analysis-17.js		Loading commit data...
escape-analysis-2.js		Loading commit data...
escape-analysis-3.js		Loading commit data...
escape-analysis-4.js		Loading commit data...
escape-analysis-5.js		Loading commit data...
escape-analysis-6.js		Loading commit data...
escape-analysis-7.js		Loading commit data...
escape-analysis-8.js		Loading commit data...
escape-analysis-9.js		Loading commit data...
escape-analysis-arguments.js		Loading commit data...
escape-analysis-cycle.js		Loading commit data...
escape-analysis-deopt-1.js		Loading commit data...
escape-analysis-deopt-2.js		Loading commit data...
escape-analysis-deopt-3.js		Loading commit data...
escape-analysis-deopt-4.js		Loading commit data...
escape-analysis-deopt-5.js		Loading commit data...
escape-analysis-deopt-6.js		Loading commit data...
escape-analysis-framestate-use-at-branchpoint.js		Loading commit data...
escape-analysis-materialize.js		Loading commit data...
escape-analysis-phi-type-2.js		Loading commit data...
escape-analysis-phi-type.js		Loading commit data...
escape-analysis-replacement.js		Loading commit data...
escape-analysis-representation.js		Loading commit data...
escape-analysis-type-none-in-object-state.js		Loading commit data...
escape-analysis-typeguard.js		Loading commit data...
escape-analysis.js		Loading commit data...
eval-introduced-closure.js		Loading commit data...
expression-trees.js		Loading commit data...
feedback-after-throw.js		Loading commit data...
for-in-1.js		Loading commit data...
for-in-2.js		Loading commit data...
for-in-3.js		Loading commit data...
for-in-4.js		Loading commit data...
for-in-5.js		Loading commit data...
for-stmt.js		Loading commit data...
function-apply.js		Loading commit data...
function-bind.js		Loading commit data...
function-call.js		Loading commit data...
function-caller.js		Loading commit data...
generic-add.js		Loading commit data...
global-accessors.js		Loading commit data...
global-delete.js		Loading commit data...
global-var-delete.js		Loading commit data...
globals.js		Loading commit data...
increment-typefeedback.js		Loading commit data...
inline-accessors1.js		Loading commit data...
inline-accessors2.js		Loading commit data...
inline-arguments.js		Loading commit data...
inline-arity-mismatch.js		Loading commit data...
inline-closures.js		Loading commit data...
inline-compare.js		Loading commit data...
inline-conditional.js		Loading commit data...
inline-construct.js		Loading commit data...
inline-context-deopt.js		Loading commit data...
inline-context-slots.js		Loading commit data...
inline-dead-jscreate.js		Loading commit data...
inline-exception-1.js		Loading commit data...
inline-exception-2.js		Loading commit data...
inline-function-apply.js		Loading commit data...
inline-global-access.js		Loading commit data...
inline-literals.js		Loading commit data...
inline-omit-arguments-deopt.js		Loading commit data...
inline-omit-arguments-object.js		Loading commit data...
inline-omit-arguments.js		Loading commit data...
inline-param.js		Loading commit data...
inline-surplus-arguments-deopt.js		Loading commit data...
inline-surplus-arguments-object.js		Loading commit data...
inline-surplus-arguments.js		Loading commit data...
inline-throw.js		Loading commit data...
inline-two.js		Loading commit data...
inlined-array-pop-getter1.js		Loading commit data...
inlined-array-pop-getter2.js		Loading commit data...
inlined-array-pop-opt.js		Loading commit data...
inlined-call-mapcheck.js		Loading commit data...
inlined-call.js		Loading commit data...
instanceof-opt1.js		Loading commit data...
instanceof-opt2.js		Loading commit data...
instanceof-opt3.js		Loading commit data...
instanceof.js		Loading commit data...
integral32-add-sub.js		Loading commit data...
lazy-const-lookup.js		Loading commit data...
lazy-deopt-in-literal.js		Loading commit data...
lazy-iife-no-parens.js		Loading commit data...
literals-assignment.js		Loading commit data...
literals-optimized.js		Loading commit data...
literals.js		Loading commit data...
load-elimination-global.js		Loading commit data...
load-elimination-osr.js		Loading commit data...
load-elimination-params.js		Loading commit data...
load-elimination.js		Loading commit data...
logical-and.js		Loading commit data...
logical-or.js		Loading commit data...
loopcount.js		Loading commit data...
loops.js		Loading commit data...
manual-concurrent-recompile.js		Loading commit data...
materialize-dictionary-properties.js		Loading commit data...
materialize-mutable-heap-number.js		Loading commit data...
math-ceil.js		Loading commit data...
math-floor-global.js		Loading commit data...
math-floor-local.js		Loading commit data...
math-mul.js		Loading commit data...
math-round.js		Loading commit data...
math-sign.js		Loading commit data...
math-trunc.js		Loading commit data...
minus-zero.js		Loading commit data...
mul-div-52bit.js		Loading commit data...
multiply-add.js		Loading commit data...
multiply-sub.js		Loading commit data...
named-load.js		Loading commit data...
named-store.js		Loading commit data...
nary-binary-ops.js		Loading commit data...
native-context-specialization-hole-check.js		Loading commit data...
native-context-specialization-string-concat.js		Loading commit data...
new-cons-string.js		Loading commit data...
null-compare.js		Loading commit data...
number-isfinite.js		Loading commit data...
number-isinteger.js		Loading commit data...
number-isnan.js		Loading commit data...
number-issafeinteger.js		Loading commit data...
object-constructor.js		Loading commit data...
object-getprototypeof.js		Loading commit data...
object-is.js		Loading commit data...
object-isprototypeof.js		Loading commit data...
objectliterals.js		Loading commit data...
opt-next-call-turbo.js		Loading commit data...
opt-next-call.js		Loading commit data...
optimize-bitnot.js		Loading commit data...
optimize_max.js		Loading commit data...
optimize_min.js		Loading commit data...
optimized-closures.js		Loading commit data...
optimized-float32array-length.js		Loading commit data...
optimized-float64array-length.js		Loading commit data...
optimized-for-in.js		Loading commit data...
optimized-function-calls.js		Loading commit data...
optimized-instanceof-1.js		Loading commit data...
optimized-instanceof-2.js		Loading commit data...
optimized-int32array-length.js		Loading commit data...
optimized-uint32array-length.js		Loading commit data...
optimized-with.js		Loading commit data...
osr-alignment.js		Loading commit data...
osr-arguments.js		Loading commit data...
osr-array-len.js		Loading commit data...
osr-assert.js		Loading commit data...
osr-backedges1.js		Loading commit data...
osr-big.js		Loading commit data...
osr-block-scope-func.js		Loading commit data...
osr-block-scope-id.js		Loading commit data...
osr-block-scope.js		Loading commit data...
osr-follow.js		Loading commit data...
osr-for-let.js		Loading commit data...
osr-forin-nested.js		Loading commit data...
osr-forin.js		Loading commit data...
osr-forof.js		Loading commit data...
osr-function-id.js		Loading commit data...
osr-function-id2.js		Loading commit data...
osr-function.js		Loading commit data...
osr-infinite.js		Loading commit data...
osr-labeled.js		Loading commit data...
osr-literals-adapted.js		Loading commit data...
osr-literals.js		Loading commit data...
osr-manual1.js		Loading commit data...
osr-manual2.js		Loading commit data...
osr-maze1.js		Loading commit data...
osr-maze2.js		Loading commit data...
osr-multiple.js		Loading commit data...
osr-multiple2.js		Loading commit data...
osr-multiple3.js		Loading commit data...
osr-nested.js		Loading commit data...
osr-nested2.js		Loading commit data...
osr-nested2b.js		Loading commit data...
osr-nested3.js		Loading commit data...
osr-nested3b.js		Loading commit data...
osr-one.js		Loading commit data...
osr-regex-id.js		Loading commit data...
osr-regress-max-locals.js		Loading commit data...
osr-sar.js		Loading commit data...
osr-simple.js		Loading commit data...
osr-top1.js		Loading commit data...
osr-top2.js		Loading commit data...
osr-top3.js		Loading commit data...
osr-try-catch.js		Loading commit data...
osr-two.js		Loading commit data...
osr-uint32.js		Loading commit data...
osr-warm.js		Loading commit data...
osr-while-let.js		Loading commit data...
osr-with-args.js		Loading commit data...
phi-representations.js		Loading commit data...
pic.js		Loading commit data...
polymorphic-symbols.js		Loading commit data...
property-calls.js		Loading commit data...
property-refs.js		Loading commit data...
property-simple.js		Loading commit data...
property-static.js		Loading commit data...
property-stores.js		Loading commit data...
proto-chain-constant.js		Loading commit data...
proto-chain-load.js		Loading commit data...
receiver-conversion.js		Loading commit data...
recursive-deopt.js		Loading commit data...
reflect-apply.js		Loading commit data...
reflect-construct.js		Loading commit data...
reflect-get.js		Loading commit data...
reflect-getprototypeof.js		Loading commit data...
reflect-has.js		Loading commit data...
regress-0.js		Loading commit data...
regress-1.js		Loading commit data...
regress-106351.js		Loading commit data...
regress-1085.js		Loading commit data...
regress-1394.js		Loading commit data...
regress-177883.js		Loading commit data...
regress-2.js		Loading commit data...
regress-3.js		Loading commit data...
regress-3136962.js		Loading commit data...
regress-3185901.js		Loading commit data...
regress-3218915.js		Loading commit data...
regress-3249650.js		Loading commit data...
regress-3260426.js		Loading commit data...
regress-3786.js		Loading commit data...
regress-3812.js		Loading commit data...
regress-4.js		Loading commit data...
regress-411262.js		Loading commit data...
regress-416359.js		Loading commit data...
regress-4206.js		Loading commit data...
regress-4207.js		Loading commit data...
regress-4389-1.js		Loading commit data...
regress-4389-2.js		Loading commit data...
regress-4389-3.js		Loading commit data...
regress-4389-4.js		Loading commit data...
regress-4389-5.js		Loading commit data...
regress-4389-6.js		Loading commit data...
regress-439743.js		Loading commit data...
regress-4413-1.js		Loading commit data...
regress-443744.js		Loading commit data...
regress-444508.js		Loading commit data...
regress-444695.js		Loading commit data...
regress-445267.js		Loading commit data...
regress-445732.js		Loading commit data...
regress-445858.js		Loading commit data...
regress-445859.js		Loading commit data...
regress-445876.js		Loading commit data...
regress-445907.js		Loading commit data...
regress-446156.js		Loading commit data...
regress-446647.js		Loading commit data...
regress-446778.js		Loading commit data...
regress-4470-1.js		Loading commit data...
regress-447567.js		Loading commit data...
regress-451012.js		Loading commit data...
regress-452427.js		Loading commit data...
regress-463056.js		Loading commit data...
regress-468162.js		Loading commit data...
regress-468727.js		Loading commit data...
regress-469089.js		Loading commit data...
regress-491578.js		Loading commit data...
regress-5.js		Loading commit data...
regress-5074.js		Loading commit data...
regress-5100.js		Loading commit data...
regress-5129.js		Loading commit data...
regress-5158.js		Loading commit data...
regress-5278.js		Loading commit data...
regress-5320.js		Loading commit data...
regress-5538.js		Loading commit data...
regress-572409.js		Loading commit data...
regress-6.js		Loading commit data...
regress-600593.js		Loading commit data...
regress-607493.js		Loading commit data...
regress-621147.js		Loading commit data...
regress-621423.js		Loading commit data...
regress-625558.js		Loading commit data...
regress-625966.js		Loading commit data...
regress-626986.js		Loading commit data...
regress-628403.js		Loading commit data...
regress-628516.js		Loading commit data...
regress-628773.js		Loading commit data...
regress-630611.js		Loading commit data...
regress-633497.js		Loading commit data...
regress-638132.js		Loading commit data...
regress-639210.js		Loading commit data...
regress-644048.js		Loading commit data...
regress-644633.js		Loading commit data...
regress-645851.js		Loading commit data...
regress-650215.js		Loading commit data...
regress-664117.js		Loading commit data...
regress-664490.js		Loading commit data...
regress-665680.js		Loading commit data...
regress-668760.js		Loading commit data...
regress-669517.js		Loading commit data...
regress-671574.js		Loading commit data...
regress-673244.js		Loading commit data...
regress-674469.js		Loading commit data...
regress-675704.js		Loading commit data...
regress-693425.js		Loading commit data...
regress-694088.js		Loading commit data...
regress-7.js		Loading commit data...
regress-700883.js		Loading commit data...
regress-7121.js		Loading commit data...
regress-713367.js		Loading commit data...
regress-714483.js		Loading commit data...
regress-715204.js		Loading commit data...
regress-715651.js		Loading commit data...
regress-725743.js		Loading commit data...
regress-726554.js		Loading commit data...
regress-729369.js		Loading commit data...
regress-731495.js		Loading commit data...
regress-733181.js		Loading commit data...
regress-736567.js		Loading commit data...
regress-739902.js		Loading commit data...
regress-758096.js		Loading commit data...
regress-758983.js		Loading commit data...
regress-761892.js		Loading commit data...
regress-762057.js		Loading commit data...
regress-772420.js		Loading commit data...
regress-772872.js		Loading commit data...
regress-773954.js		Loading commit data...
regress-780658.js		Loading commit data...
regress-786521.js		Loading commit data...
regress-788539.js		Loading commit data...
regress-791245.js		Loading commit data...
regress-8.js		Loading commit data...
regress-arguments.js		Loading commit data...
regress-arrayliteral.js		Loading commit data...
regress-bit-number-constant.js		Loading commit data...
regress-closures-with-eval.js		Loading commit data...
regress-compare-negate.js		Loading commit data...
regress-const.js		Loading commit data...
regress-crbug-540593.js		Loading commit data...
regress-dead-throw-inlining.js		Loading commit data...
regress-deopt-call-as-function.js		Loading commit data...
regress-escape-analysis-indirect.js		Loading commit data...
regress-f64-w32-change.js		Loading commit data...
regress-funarguments.js		Loading commit data...
regress-funcaller.js		Loading commit data...
regress-gap.js		Loading commit data...
regress-gvn.js		Loading commit data...
regress-inline-callfunctionstub.js		Loading commit data...
regress-int32array-outofbounds-nan.js		Loading commit data...
regress-intoverflow.js		Loading commit data...
regress-lazy-deopt.js		Loading commit data...
regress-lbranch-double.js		Loading commit data...
regress-loadfield.js		Loading commit data...
regress-loop-deopt.js		Loading commit data...
regress-loop-variable-if.js		Loading commit data...
regress-loop-variable-unsigned.js		Loading commit data...
regress-math-sign-nan-type.js		Loading commit data...
regress-max.js		Loading commit data...
regress-ntl-effect.js		Loading commit data...
regress-number-is-hole-nan.js		Loading commit data...
regress-or.js		Loading commit data...
regress-register-allocator.js		Loading commit data...
regress-register-allocator2.js		Loading commit data...
regress-register-allocator3.js		Loading commit data...
regress-rep-change.js		Loading commit data...
regress-serialized-slots.js		Loading commit data...
regress-shared-deopt.js		Loading commit data...
regress-shift-left.js		Loading commit data...
regress-shift-right-logical.js		Loading commit data...
regress-shift-right.js		Loading commit data...
regress-stacktrace-methods.js		Loading commit data...
regress-stacktrace.js		Loading commit data...
regress-store-holey-double-array.js		Loading commit data...
regress-string-to-number-add.js		Loading commit data...
regress-to-number-binop-deopt.js		Loading commit data...
regress-toint32.js		Loading commit data...
regress-truncate-number-or-undefined-to-float64.js		Loading commit data...
regress-v8-5573.js		Loading commit data...
regress-v8-5756.js		Loading commit data...
regress-v8-6077.js		Loading commit data...
regress-v8-6631.js		Loading commit data...
regress-variable-liveness-let.js		Loading commit data...
regress-variable-liveness.js		Loading commit data...
rest-parameters.js		Loading commit data...
rotate.js		Loading commit data...
safepoint.js		Loading commit data...
shift-shr.js		Loading commit data...
short-circuit.js		Loading commit data...
simple-bailouts.js		Loading commit data...
simple-binary-op.js		Loading commit data...
simple-deopt.js		Loading commit data...
simple-global-access.js		Loading commit data...
simple-inlining.js		Loading commit data...
smi-stores-opt.js		Loading commit data...
spread-call.js		Loading commit data...
store-elimination.js		Loading commit data...
stress-deopt-count-1.js		Loading commit data...
stress-deopt-count-2.js		Loading commit data...
strict-recompile.js		Loading commit data...
string-add-try-catch.js		Loading commit data...
string-concat-try-catch.js		Loading commit data...
string-concat-yield.js		Loading commit data...
string-length.js		Loading commit data...
string-slice.js		Loading commit data...
switch-bailout.js		Loading commit data...
symbol-protototype.js		Loading commit data...
this-property-refs.js		Loading commit data...
thisfunction.js		Loading commit data...
to-fast-properties.js		Loading commit data...
truncating-store-deopt.js		Loading commit data...
truncating-store.js		Loading commit data...
try-binop.js		Loading commit data...
try-catch-deopt.js		Loading commit data...
try-context.js		Loading commit data...
try-deopt.js		Loading commit data...
try-finally-deopt.js		Loading commit data...
try-osr.js		Loading commit data...
turbo-number-feedback.js		Loading commit data...
type-speculative-safe-integer-add.js		Loading commit data...
typedarray-prototype-tostringtag.js		Loading commit data...
uint32.js		Loading commit data...
uint8-clamped-array.js		Loading commit data...
unary-add.js		Loading commit data...
unsigned-min-max.js		Loading commit data...
variables.js		Loading commit data...