Upload Kmake

deps/v8/test/mjsunit/baseline/batch-compilation.js

@@ -0,0 +1,74 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --sparkplug --no-always-sparkplug --sparkplug-filter="test*"
+// Flags: --allow-natives-syntax --expose-gc --no-always-turbofan
+// Flags: --baseline-batch-compilation --baseline-batch-compilation-threshold=200
+// Flags: --invocation-count-for-feedback-allocation=4
+// Flags: --no-concurrent-sparkplug
+
+// Flags to drive Fuzzers into the right direction
+// TODO(v8:11853): Remove these flags once fuzzers handle flag implications
+// better.
+// Flags: --lazy-feedback-allocation --no-stress-concurrent-inlining
+
+// Basic test
+(function() {
+  // Bytecode length 24 -> estimated instruction size 120 - 168.
+  function test1 (a,b) {
+    return (a + b + 11) * 42 / a % b;
+  }
+
+  // Bytecode length 24 -> estimated instruction size 120 - 168.
+  function test2 (a,b) {
+    return (a + b + 11) * 42 / a % b;
+  }
+
+  %NeverOptimizeFunction(test1);
+  // Trigger bytecode budget interrupt for test1.
+  for (let i=0; i<5; ++i) {
+    test1(i,4711);
+  }
+  // Shouldn't be compiled because of batch compilation.
+  assertFalse(isBaseline(test1));
+
+  %NeverOptimizeFunction(test2);
+  // Trigger bytecode budget interrupt for test2.
+  for (let i=0; i<5; ++i) {
+    test2(i,4711);
+  }
+
+  // Call test1 again so baseline code gets installed on the function.
+  test1(1,2);
+
+  // Both functions should be compiled with baseline now.
+  assertTrue(isBaseline(test1));
+  assertTrue(isBaseline(test2));
+})();
+
+// Test function weak handle.
+(function() {
+  function test_weak (a,b) {
+    return (a + b + 11) * 42 / a % b;
+  }
+
+  function test2 (a,b) {
+    return (a + b + 11) * 42 / a % b;
+  }
+
+  %NeverOptimizeFunction(test_weak);
+  for (let i=0; i<5; ++i) {
+    test_weak(i,4711);
+  }
+
+  gc(); // GC should cause the handle to test_weak to be freed.
+
+  %NeverOptimizeFunction(test2);
+  // Trigger bytecode budget interrupt for test2.
+  for (let i=0; i<5; ++i) {
+    test2(i,4711);
+  }
+
+  assertTrue(isBaseline(test2));
+})();

deps/v8/test/mjsunit/baseline/cross-realm.js

@@ -0,0 +1,121 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --sparkplug --no-always-sparkplug
+
+// Tier-up across Realms
+
+// Ensure a feedback vector is created when sharing baseline code.
+(function() {
+  function factory1() {
+    return function(a) {
+      return a;
+    }
+  }
+
+  var realm1 = Realm.createAllowCrossRealmAccess();
+  var realm2 = Realm.createAllowCrossRealmAccess();
+
+  // f1 and f2 have the same code, so share a SharedFunctionInfo (i.e. share
+  // bytecode and baseline code).
+  let f1 = Realm.eval(realm1, "(" + factory1.toString() + ")")();
+  let f2 = Realm.eval(realm2, "(" + factory1.toString() + ")")();
+  %NeverOptimizeFunction(f1);
+  %NeverOptimizeFunction(f2);
+
+  // Compile f1 to baseline, f2 stays uncompiled
+  %CompileBaseline(f1);
+  assertEquals(0, f1(0));
+  assertTrue(isBaseline(f1));
+  assertFalse(isBaseline(f2));
+
+  // f2 tiers up to baseline via lazy compile
+  assertEquals(0, f2(0));
+  assertTrue(isBaseline(f1));
+  assertTrue(isBaseline(f2));
+})();
+
+// Ensure a feedback vector is created when sharing baseline code and a closure
+// feedback cell array already exists.
+(function() {
+  function factory2() {
+    return function(a) {
+      return a;
+    }
+  }
+
+  var realm1 = Realm.createAllowCrossRealmAccess();
+  var realm2 = Realm.createAllowCrossRealmAccess();
+
+  // f1, f2 and f3 have the same code, so share a SharedFunctionInfo (i.e. share
+  // bytecode and baseline code).
+  let f1 = Realm.eval(realm1, "(" + factory2.toString() + ")")();
+  let realmFactory = Realm.eval(realm2, "(" + factory2.toString() + ")");
+  // f2 and f3 are in the same realm, so share a feedback vector cell.
+  let f2 = realmFactory();
+  let f3 = realmFactory();
+  %NeverOptimizeFunction(f1);
+  %NeverOptimizeFunction(f2);
+  %NeverOptimizeFunction(f3);
+
+  // Compile f1 to baseline, f2 to interpreter, f3 stays uncompiled.
+  assertEquals(0, f2(0));
+  %CompileBaseline(f1);
+  assertEquals(0, f1(0));
+  assertTrue(isBaseline(f1));
+  assertFalse(isBaseline(f2));
+  assertFalse(isBaseline(f3));
+
+  // Compile f3, tiers up to baseline via lazy compile and installs the feedback
+  // vector
+  assertEquals(0, f3(0));
+  assertTrue(isBaseline(f3));
+  assertFalse(isBaseline(f2));
+
+  // Run f2, tiers up to baseline via interpreter entry.
+  assertEquals(0, f2(0));
+  assertTrue(isBaseline(f2));
+})();
+
+// Ensure a feedback vector is created when sharing baseline code and a closure
+// feedback cell array already exists.
+(function() {
+  function factory3() {
+    return function(a) {
+      return a;
+    }
+  }
+
+  var realm1 = Realm.createAllowCrossRealmAccess();
+  var realm2 = Realm.createAllowCrossRealmAccess();
+
+  // f1, f2 and f3 have the same code, so share a SharedFunctionInfo (i.e. share
+  // bytecode and baseline code).
+  let f1 = Realm.eval(realm1, "(" + factory3.toString() + ")")();
+  let realmFactory = Realm.eval(realm2, "(" + factory3.toString() + ")");
+  // f2 and f3 are in the same realm, so share a feedback vector cell.
+  let f2 = realmFactory();
+  let f3 = realmFactory();
+  %NeverOptimizeFunction(f1);
+  %NeverOptimizeFunction(f2);
+  %NeverOptimizeFunction(f3);
+
+  // Compile f1 to baseline, f2 to interpreter, f3 stays uncompiled.
+  assertEquals(0, f2(0));
+  %CompileBaseline(f1);
+  assertEquals(0, f1(0));
+  assertTrue(isBaseline(f1));
+  assertFalse(isBaseline(f2));
+  assertFalse(isBaseline(f3));
+
+  // Run f2, tiers up to baseline via interpreter entry and installs the
+  // feedback vector
+  assertEquals(0, f2(0));
+  assertTrue(isBaseline(f2));
+  assertFalse(isBaseline(f3));
+
+  // Compile f3, tiers up to baseline via lazy compile.
+  assertEquals(0, f3(0));
+  assertTrue(isBaseline(f3));
+})();

deps/v8/test/mjsunit/baseline/flush-baseline-code.js

@@ -0,0 +1,113 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --stress-flush-code --allow-natives-syntax
+// Flags: --baseline-batch-compilation-threshold=0 --sparkplug
+// Flags: --no-always-sparkplug --lazy-feedback-allocation
+// Flags: --flush-baseline-code --flush-bytecode --no-turbofan --no-maglev
+// Flags: --no-stress-concurrent-inlining
+// Flags: --no-concurrent-sparkplug
+
+function HasBaselineCode(f) {
+  let opt_status = %GetOptimizationStatus(f);
+  return (opt_status & V8OptimizationStatus.kBaseline) !== 0;
+}
+
+function HasByteCode(f) {
+  let opt_status = %GetOptimizationStatus(f);
+  return (opt_status & V8OptimizationStatus.kInterpreted) !== 0;
+}
+
+var x = {b:20, c:30};
+function f() {
+  return x.b + 10;
+}
+
+(async function () {
+  // Test bytecode gets flushed
+  f();
+  assertTrue(HasByteCode(f));
+  // We need to invoke GC asynchronously and wait for it to finish, so that
+  // it doesn't need to scan the stack. Otherwise, some objects may not be
+  // reclaimed because of conservative stack scanning and the test may not
+  // work as intended.
+  await gc({ type: 'major', execution: 'async' });
+  assertFalse(HasByteCode(f))
+})();
+
+(async function () {
+  // Test baseline code and bytecode gets flushed
+  for (i = 1; i < 50; i++) {
+    f();
+  }
+  assertTrue(HasBaselineCode(f));
+  // We need to invoke GC asynchronously and wait for it to finish, so that
+  // it doesn't need to scan the stack. Otherwise, some objects may not be
+  // reclaimed because of conservative stack scanning and the test may not
+  // work as intended.
+  await gc({ type: 'major', execution: 'async' });
+  assertFalse(HasBaselineCode(f));
+  assertFalse(HasByteCode(f));
+})();
+
+// Check bytecode isn't flushed if it's held strongly from somewhere but
+// baseline code is flushed.
+function f1(should_recurse) {
+  if (should_recurse) {
+    assertTrue(HasByteCode(f1));
+    for (i = 1; i < 50; i++) {
+      f1(false);
+    }
+    assertTrue(HasBaselineCode(f1));
+    // Here we are not checking whether some object was indeed reclaimed,
+    // so should not worry if conservative stack scanning is performed.
+    gc();
+    // TODO(jgruber, v8:12161): No longer true since we now always tier up to
+    // available Sparkplug code as early as possible. By the time we reach this
+    // assert, SP code is being executed and is thus alive.
+    // assertFalse(HasBaselineCode(f1));
+    // Also, the active tier is Sparkplug and not Ignition.
+    // assertTrue(ActiveTierIsIgnition(f1));
+  }
+  return x.b + 10;
+}
+
+(async function () {
+  f1(false);
+  // Recurse first time so we have bytecode array on the stack that keeps
+  // bytecode alive.
+  f1(true);
+
+  // Flush bytecode.
+  // We need to invoke GC asynchronously and wait for it to finish, so that
+  // it doesn't need to scan the stack. Otherwise, some objects may not be
+  // reclaimed because of conservative stack scanning and the test may not
+  // work as intended.
+  await gc({ type: 'major', execution: 'async' });
+  assertFalse(HasBaselineCode(f1));
+  assertFalse(HasByteCode(f1));
+})();
+
+// Check baseline code and bytecode aren't flushed if baseline code is on
+// stack.
+function f2(should_recurse) {
+  if (should_recurse) {
+    assertTrue(HasBaselineCode(f2));
+    f2(false);
+    // Here we are not checking whether some object was indeed reclaimed,
+    // so should not worry if conservative stack scanning is performed.
+    gc();
+    assertTrue(HasBaselineCode(f2));
+  }
+  return x.b + 10;
+}
+
+(async function () {
+  for (i = 1; i < 50; i++) {
+    f2(false);
+  }
+  assertTrue(HasBaselineCode(f2));
+  // Recurse with baseline code on stack
+  f2(true);
+})();

deps/v8/test/mjsunit/baseline/flush-only-baseline-code.js

@@ -0,0 +1,75 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --stress-flush-code --allow-natives-syntax
+// Flags: --baseline-batch-compilation-threshold=0 --sparkplug
+// Flags: --no-always-sparkplug --lazy-feedback-allocation
+// Flags: --flush-baseline-code --no-flush-bytecode --no-turbofan --no-maglev
+// Flags: --no-stress-concurrent-inlining
+// Flags: --no-concurrent-sparkplug
+
+function HasBaselineCode(f) {
+  let opt_status = %GetOptimizationStatus(f);
+  return (opt_status & V8OptimizationStatus.kBaseline) !== 0;
+}
+
+function HasByteCode(f) {
+  let opt_status = %GetOptimizationStatus(f);
+  return (opt_status & V8OptimizationStatus.kInterpreted) !== 0;
+}
+
+var x = {b:20, c:30};
+function f() {
+  return x.b + 10;
+}
+
+(async function () {
+  // Test bytecode gets flushed
+  f();
+  assertTrue(HasByteCode(f));
+  // We need to invoke GC asynchronously and wait for it to finish, so that
+  // it doesn't need to scan the stack. Otherwise, some objects may not be
+  // reclaimed because of conservative stack scanning and the test may not
+  // work as intended.
+  await gc({ type: 'major', execution: 'async' });
+  assertTrue(HasByteCode(f));
+})();
+
+(async function () {
+  // Test baseline code gets flushed but not bytecode.
+  for (i = 1; i < 50; i++) {
+    f();
+  }
+  assertTrue(HasBaselineCode(f));
+  // We need to invoke GC asynchronously and wait for it to finish, so that
+  // it doesn't need to scan the stack. Otherwise, some objects may not be
+  // reclaimed because of conservative stack scanning and the test may not
+  // work as intended.
+  await gc({ type: 'major', execution: 'async' });
+  assertFalse(HasBaselineCode(f));
+  assertTrue(HasByteCode(f));
+})();
+
+(async function () {
+  // Check baseline code and bytecode aren't flushed if baseline code is on
+  // stack.
+  function f2(should_recurse) {
+    if (should_recurse) {
+      assertTrue(HasBaselineCode(f2));
+      f2(false);
+      // Here we are not checking whether some object was indeed reclaimed,
+      // so should not worry if conservative stack scanning is performed.
+      gc();
+      assertTrue(HasBaselineCode(f2));
+    }
+    return x.b + 10;
+  }
+
+  for (i = 1; i < 50; i++) {
+    f2(false);
+  }
+  assertTrue(HasBaselineCode(f2));
+  // Recurse with baseline code on stack
+  f2(true);
+})();

deps/v8/test/mjsunit/baseline/test-baseline-module-helper.mjs

@@ -0,0 +1,5 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export default 12;

deps/v8/test/mjsunit/baseline/test-baseline-module.mjs

@@ -0,0 +1,24 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --super-ic --sparkplug --no-always-sparkplug
+
+export let exported = 17;
+import imported from 'test-baseline-module-helper.mjs';
+
+function run(f, ...args) {
+  try { f(...args); } catch (e) {}
+  %CompileBaseline(f);
+  return f(...args);
+}
+
+function construct(f, ...args) {
+  try { new f(...args); } catch (e) {}
+  %CompileBaseline(f);
+  return new f(...args);
+}
+
+assertEquals(17, run((o)=>{ return exported; }));
+assertEquals(12, run((o)=>{ return imported; }));
+assertEquals(20, run((o)=>{ exported = 20; return exported; }));

deps/v8/test/mjsunit/baseline/test-baseline.js

@@ -0,0 +1,328 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --super-ic --sparkplug --no-always-sparkplug
+
+function run(f, ...args) {
+  try { f(...args); } catch (e) {}
+  %CompileBaseline(f);
+  return f(...args);
+}
+
+function construct(f, ...args) {
+  try { new f(...args); } catch (e) {}
+  %CompileBaseline(f);
+  return new f(...args);
+}
+
+// Constants
+assertEquals(run(()=>undefined), undefined);
+assertEquals(run(()=>null), null);
+assertEquals(run(()=>true), true);
+assertEquals(run(()=>false), false);
+assertEquals(run(()=>"bla"), "bla");
+assertEquals(run(()=>42), 42);
+assertEquals(run(()=>0), 0);
+
+// Variables
+assertEquals(run(()=>{let a = 42; return a}), 42);
+assertEquals(run(()=>{let a = 42; let b = 32; return a}), 42);
+
+// Arguments
+assertEquals(run((a)=>a, 42), 42);
+assertEquals(run((a,b)=>b, 1, 42), 42);
+assertEquals(run((a,b,c)=>c, 1, 2, 42), 42);
+
+// Property load
+assertEquals(run((o)=>o.a, {a:42}), 42);
+assertEquals(run((o, k)=>o[k], {a:42}, "a"), 42);
+
+// Property store
+assertEquals(run((o)=>{o.a=42; return o}, {}).a, 42);
+assertEquals(run((o, k)=>{o[k]=42; return o}, {}, "a").a, 42);
+
+// Global load/store
+global_x = 45;
+assertEquals(run(()=>global_x), 45);
+run(()=>{ global_x = 49 })
+assertEquals(global_x, 49);
+
+// Context load
+(function () {
+  let x = 42;
+  assertEquals(run(()=>{return x;}), 42);
+})();
+(function () {
+  let x = 4;
+  x = 42;
+  assertEquals(run(()=>{return x;}), 42);
+})();
+
+// Context store
+(function () {
+  let x = 4;
+  run(()=>{x = 42;});
+  assertEquals(x, 42);
+})();
+
+
+// Super
+// var o = {__proto__:{a:42}, m() { return super.a }};
+// assertEquals(run(o.m), 42);
+
+// Control flow
+assertEquals(run((x)=>{ if(x) return 5; return 10;}), 10);
+assertEquals(run(()=>{ var x = 0; for(var i = 1; i; i=0) x=10; return x;}), 10);
+assertEquals(run(()=>{ var x = 0; for(var i = 0; i < 10; i+=1) x+=1; return x;}), 10);
+assertEquals(run(()=>{ var x = 0; for(var i = 0; i < 10; ++i) x+=1; return x;}), 10);
+
+// Typeof
+function testTypeOf(o, t) {
+  let types = ['number', 'string', 'symbol', 'boolean', 'bigint', 'undefined',
+               'function', 'object'];
+  assertEquals(t, eval('run(()=>typeof ' + o + ')'),
+               `(()=>typeof ${o})() == ${t}`);
+  assertTrue(eval('run(()=>typeof ' + o + ' == "' + t + '")'),
+             `typeof ${o} == ${t}`);
+  var other_types = types.filter((x) => x !== t);
+  for (var other of other_types) {
+    assertFalse(eval('run(()=>typeof ' + o + ' == "' + other + '")'),
+                `typeof ${o} != ${other}`);
+  }
+}
+
+testTypeOf('undefined', 'undefined');
+testTypeOf('null', 'object');
+testTypeOf('true', 'boolean');
+testTypeOf('false', 'boolean');
+testTypeOf('42.42', 'number');
+testTypeOf('42', 'number');
+testTypeOf('42n', 'bigint');
+testTypeOf('"42"', 'string');
+testTypeOf('Symbol(42)', 'symbol');
+testTypeOf('{}', 'object');
+testTypeOf('[]', 'object');
+testTypeOf('new Proxy({}, {})', 'object');
+testTypeOf('new Proxy([], {})', 'object');
+testTypeOf('(_ => 42)', 'function');
+testTypeOf('function() {}', 'function');
+testTypeOf('function*() {}', 'function');
+testTypeOf('async function() {}', 'function');
+testTypeOf('async function*() {}', 'function');
+testTypeOf('new Proxy(_ => 42, {})', 'function');
+testTypeOf('class {}', 'function');
+testTypeOf('Object', 'function');
+
+// Binop
+assertEquals(run((a,b)=>{return a+b}, 41, 1), 42);
+assertEquals(run((a,b)=>{return a*b}, 21, 2), 42);
+assertEquals(run((a)=>{return a+3}, 39), 42);
+assertEquals(run((a,b)=>{return a&b}, 0x23, 0x7), 0x3);
+assertEquals(run((a)=>{return a&0x7}, 0x23), 0x3);
+assertEquals(run((a,b)=>{return a|b}, 0x23, 0x7), 0x27);
+assertEquals(run((a)=>{return a|0x7}, 0x23), 0x27);
+assertEquals(run((a,b)=>{return a^b}, 0x23, 0x7), 0x24);
+assertEquals(run((a)=>{return a^0x7}, 0x23), 0x24);
+
+// Unop
+assertEquals(run((x)=>{return x++}, 41), 41);
+assertEquals(run((x)=>{return ++x}, 41), 42);
+assertEquals(run((x)=>{return x--}, 41), 41);
+assertEquals(run((x)=>{return --x}, 41), 40);
+assertEquals(run((x)=>{return !x}, 41), false);
+assertEquals(run((x)=>{return ~x}, 41), ~41);
+
+// Calls
+function f0() { return 42; }
+function f1(x) { return x; }
+function f2(x, y) { return x + y; }
+function f3(x, y, z) { return y + z; }
+assertEquals(run(()=>{return f0()}), 42);
+assertEquals(run(()=>{return f1(42)}), 42);
+assertEquals(run(()=>{return f2(41, 1)}), 42);
+assertEquals(run(()=>{return f3(1, 2, 40)}), 42);
+
+// Mapped Arguments
+function mapped_args() {
+  return [arguments.length, ...arguments];
+}
+function mapped_args_dup(a,a) {
+  return [arguments.length, ...arguments];
+}
+assertEquals(run(mapped_args, 1, 2, 3), [3,1,2,3]);
+assertEquals(run(mapped_args_dup, 1, 2, 3), [3,1,2,3]);
+
+// Unmapped Arguments
+function unmapped_args() {
+  "use strict";
+  return [arguments.length, ...arguments];
+}
+assertEquals(run(unmapped_args, 1, 2, 3), [3,1,2,3]);
+
+// Rest Arguments
+function rest_args(...rest) {
+  return [rest.length, ...rest];
+}
+assertEquals(run(rest_args, 1, 2, 3), [3,1,2,3]);
+
+// Property call
+let obj = {
+  f0: () => { return 42; },
+  f1: (x) => { return x; },
+  f2: (x, y) => { return x + y; },
+  f3: (x, y, z) => { return y + z; }
+}
+assertEquals(run(()=>{return obj.f0()}), 42);
+assertEquals(run(()=>{return obj.f1(42)}), 42);
+assertEquals(run(()=>{return obj.f2(41, 1)}), 42);
+assertEquals(run(()=>{return obj.f3(1, 2, 40)}), 42);
+
+// Call with spread
+let ns = [2, 40];
+assertEquals(run(()=>{return f3("x", ...ns)}), 42);
+
+// Construct
+function C(a, b, c) { this.x = 39 + b + c; }
+assertEquals(run(()=>{return (new C("a", 1, 2)).x}), 42);
+assertEquals(run(()=>{return (new C("a", ...ns)).x}), 81);
+
+// Construct Array
+assertEquals(run(()=>{return new Array(1, 2, 39);}).reduce((a,x)=>a+x), 42);
+
+// Call Runtime
+assertMatches(run(() => { return %NewRegExpWithBacktrackLimit("ax", "", 50); }), "ax");
+run(() => { %CompileBaseline(()=>{}); });
+
+// CallRuntimeForPair
+assertEquals(run(()=>{with (f0) return f0();}), 42);
+
+// Closure
+assertEquals(run((o)=>{if (true) {let x = o; return ()=>x}}, 42)(), 42);
+assertEquals(run((o)=>{return ()=>o}, 42)(), 42);
+
+// Object / Array Literals
+assertEquals(run((o)=>{return {a:42}}), {a:42});
+assertEquals(run((o)=>{return [42]}), [42]);
+assertEquals(run((o)=>{return []}), []);
+assertEquals(run((o)=>{return {}}), {});
+assertEquals(run((o)=>{return {...o}}, {a:42}), {a:42});
+assertEquals(run((o)=>{return /42/}), /42/);
+assertEquals(run((o)=>{return [...o]}, [1,2,3,4]), [1,2,3,4]);
+
+// Construct
+// Throw if the super() isn't a constructor
+class T extends Object { constructor() { super() } }
+T.__proto__ = null;
+assertThrows(()=>construct(T));
+
+run((o)=>{ try { } finally { } });
+
+// SwitchOnSmiNoFeeback
+run((o) => {
+  var x = 0;
+  var y = 0;
+  while (true) {
+    try {
+      x++;
+      if (x == 2) continue;
+      if (x == 5) break;
+    } finally {
+      y++;
+    }
+  }
+  return x + y;
+}, 10);
+
+// GetIterator
+assertEquals(run((o)=>{
+  let sum = 0; for (x of [1, 2]) {sum += x;} return sum;}), 3);
+
+// ForIn
+assertEquals(run((o)=>{ let sum = 0; for (let k in o) { sum += o[k] }; return sum }, {a:41,b:1}), 42);
+
+// In
+assertTrue(run((o, k)=>{return k in o}, {a:1}, "a"));
+assertFalse(run((o, k)=>{return k in o}, {a:1}, "b"));
+
+class D {}
+assertTrue(run((o, c)=>{return o instanceof c}, new D(), D));
+assertTrue(run((o, c)=>{return o instanceof c}, new D(), Object));
+assertFalse(run((o, c)=>{return o instanceof c}, new D(), RegExp));
+
+// CreateArrayFromIterable
+assertEquals(run((a)=>{return [...a]}, [1,2,3]), [1,2,3]);
+
+// Generator
+let gen = run(function*() {
+  yield 1;
+  yield 2;
+  yield 3;
+});
+let i = 1;
+for (let val of gen) {
+  assertEquals(i++, val);
+}
+assertEquals(4, i);
+
+// Generator with a lot of locals
+let gen_func_with_a_lot_of_locals = eval(`(function*() {
+  ${ Array(32*1024).fill().map((x,i)=>`let local_${i};`).join("\n") }
+  yield 1;
+  yield 2;
+  yield 3;
+})`);
+i = 1;
+for (let val of run(gen_func_with_a_lot_of_locals)) {
+  assertEquals(i++, val);
+}
+assertEquals(4, i);
+
+// Async await
+run(async function() {
+  await 1;
+  await 1;
+  await 1;
+  return 42;
+}).then(x=>assertEquals(42, x));
+
+// Try-catch
+assertEquals(run((x)=>{
+  if (x) {
+    try {
+      if (x) throw x;
+      return 45;
+    } catch (e) {
+      return e;
+    }
+  }
+}, 42), 42);
+
+// Tier-up via InterpreterEntryTrampoline
+(function() {
+  function factory() {
+    return function(a) {
+      return a;
+    };
+  }
+  let f1 = factory();
+  let f2 = factory();
+  %NeverOptimizeFunction(f1);
+  %NeverOptimizeFunction(f2);
+
+  assertEquals(f1(0), 0);
+  assertEquals(f2(0), 0);
+  assertTrue(isInterpreted(f1))
+  assertFalse(isBaseline(f1));
+  assertTrue(isInterpreted(f2))
+  assertFalse(isBaseline(f2));
+
+  %CompileBaseline(f1);
+  assertEquals(f1(0), 0);
+  assertTrue(isBaseline(f1));
+  assertFalse(isBaseline(f2));
+
+  assertEquals(f2(0), 0);
+  assertTrue(isBaseline(f1));
+  assertTrue(isBaseline(f2));
+})();

deps/v8/test/mjsunit/baseline/test-osr-maglev-tf.js

@@ -0,0 +1,57 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --sparkplug --no-always-sparkplug --use-osr
+// Flags: --turbofan --no-always-turbofan --deopt-every-n-times=0
+// Flags: --maglev --maglev-osr --osr-from-maglev
+// Flags: --concurrent-recompilation
+
+function isExecutingBaseline(func) {
+  let opt_status = %GetOptimizationStatus(func);
+  return (opt_status & V8OptimizationStatus.kTopmostFrameIsBaseline) !== 0;
+}
+
+function f() {
+  for (var i = 0; i <= 20; i++) {
+    if (i == 5) {
+      %BaselineOsr();
+    }
+    if (i > 5) {
+      assertTrue(isBaseline(f));
+      assertTrue(isExecutingBaseline(f));
+    }
+  }
+}
+
+%NeverOptimizeFunction(f);
+f();
+
+var expectedStatus = V8OptimizationStatus.kTopmostFrameIsInterpreted;
+
+function checkTopmostFrame(func) {
+  let opt_status = %GetOptimizationStatus(func);
+  assertTrue ((opt_status & expectedStatus) !== 0, "Expected flag " +
+      expectedStatus + " to be set in optimization status");
+}
+
+function g() {
+  for (var i = 0; i <= 20; i++) {
+    console.log(i)
+    checkTopmostFrame(g)
+    if (i == 2) {
+      %BaselineOsr();
+      expectedStatus = V8OptimizationStatus.kTopmostFrameIsBaseline;
+    }
+    if (i == 10 || i == 5) {
+      %OptimizeOsr();
+      // Load these to make sure maglev does not deopt before we tier up.
+      let ml = V8OptimizationStatus.kTopmostFrameIsMaglev;
+      let tf = V8OptimizationStatus.kTopmostFrameIsTurboFanned;
+      expectedStatus = i == 5 ? ml : tf;
+    }
+  }
+}
+
+%PrepareFunctionForOptimization(g);
+g();

deps/v8/test/mjsunit/baseline/test-osr-maglev.js

@@ -0,0 +1,52 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --sparkplug --no-always-sparkplug --use-osr
+// Flags: --turbofan --no-always-turbofan --deopt-every-n-times=0
+// Flags: --maglev --maglev-osr
+
+function isExecutingBaseline(func) {
+  let opt_status = %GetOptimizationStatus(func);
+  return (opt_status & V8OptimizationStatus.kTopmostFrameIsBaseline) !== 0;
+}
+
+function f() {
+  for (var i = 0; i <= 20; i++) {
+    if (i == 5) {
+      %BaselineOsr();
+    }
+    if (i > 5) {
+      assertTrue(isBaseline(f));
+      assertTrue(isExecutingBaseline(f));
+    }
+  }
+}
+
+%NeverOptimizeFunction(f);
+f();
+
+var expectedStatus = V8OptimizationStatus.kTopmostFrameIsInterpreted;
+
+function checkTopmostFrame(func) {
+  let opt_status = %GetOptimizationStatus(func);
+  assertTrue ((opt_status & expectedStatus) !== 0, "Expected flag " +
+      expectedStatus + " to be set in optimization status");
+}
+
+function g() {
+  for (var i = 0; i <= 20; i++) {
+    checkTopmostFrame(g)
+    if (i == 2) {
+      %BaselineOsr();
+      expectedStatus = V8OptimizationStatus.kTopmostFrameIsBaseline;
+    }
+    if (i == 5) {
+      %OptimizeOsr();
+      expectedStatus = V8OptimizationStatus.kTopmostFrameIsMaglev;
+    }
+  }
+}
+
+%PrepareFunctionForOptimization(g);
+g();

deps/v8/test/mjsunit/baseline/test-osr.js

@@ -0,0 +1,52 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --sparkplug --no-always-sparkplug --use-osr
+// Flags: --turbofan --no-always-turbofan --deopt-every-n-times=0
+// Flags: --no-maglev-osr
+
+function isExecutingBaseline(func) {
+  let opt_status = %GetOptimizationStatus(func);
+  return (opt_status & V8OptimizationStatus.kTopmostFrameIsBaseline) !== 0;
+}
+
+function f() {
+  for (var i = 0; i <= 20; i++) {
+    if (i == 5) {
+      %BaselineOsr();
+    }
+    if (i > 5) {
+      assertTrue(isBaseline(f));
+      assertTrue(isExecutingBaseline(f));
+    }
+  }
+}
+
+%NeverOptimizeFunction(f);
+f();
+
+var expectedStatus = V8OptimizationStatus.kTopmostFrameIsInterpreted;
+
+function checkTopmostFrame(func) {
+  let opt_status = %GetOptimizationStatus(func);
+  assertTrue ((opt_status & expectedStatus) !== 0, "Expected flag " +
+      expectedStatus + " to be set in optimization status");
+}
+
+function g() {
+  for (var i = 0; i <= 20; i++) {
+    checkTopmostFrame(g)
+    if (i == 2) {
+      %BaselineOsr();
+      expectedStatus = V8OptimizationStatus.kTopmostFrameIsBaseline;
+    }
+    if (i == 5) {
+      %OptimizeOsr();
+      expectedStatus = V8OptimizationStatus.kTopmostFrameIsTurboFanned;
+    }
+  }
+}
+
+%PrepareFunctionForOptimization(g);
+g();

deps/v8/test/mjsunit/baseline/verify-bytecode-offsets.js

@@ -0,0 +1,37 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-sparkplug --allow-natives-syntax
+
+// This test mainly exists to make ClusterFuzz aware of
+// d8.test.verifySourcePositions.
+
+globalValue = false;
+
+function foo(param1, ...param2) {
+  try {
+    for (let key in param1) { param2.push(key); }
+    for (let a of param1) { param2.push(a); }
+    let [a, b] = param2;
+    let copy = [{literal:1}, {}, [], [1], 1, ...param2];
+    return a + b + copy.length;
+  } catch (e) {
+    return e.toString().match(/[a-zA-Z]+/g);
+  } finally {
+    globalValue = new String(23);
+  }
+  return Math.min(Math.random(), 0.5);
+}
+
+var obj = [...Array(10).keys()];
+obj.foo = 'bar';
+foo(obj, obj);
+
+d8.test.verifySourcePositions(foo);
+
+// Make sure invalid calls throw.
+assertThrows(() => {d8.test.verifySourcePositions(0)});
+assertThrows(() => {d8.test.verifySourcePositions(obj)});
+assertThrows(() => {d8.test.verifySourcePositions(new Proxy(foo, {}))});
+assertThrows(() => {d8.test.verifySourcePositions(%GetUndetectable())});