Upload Kmake

deps/v8/test/mjsunit/maglev/regress/regress-1359382.js

@@ -0,0 +1,19 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+function foo() {
+  try {
+    throw null;
+  } catch (x) {
+  } finally {
+    return;
+  }
+}
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeMaglevOnNextCall(foo);
+foo();

deps/v8/test/mjsunit/maglev/regress/regress-1359723.js

@@ -0,0 +1,21 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function f(__v_51, __v_52, __v_53) {
+  var a = false;
+  var b = a;
+  try {
+    var c = false + false;
+  } catch {}
+  try {
+    var d = false - (null == true);
+  } catch {}
+  return a + b - c + d;
+}
+%PrepareFunctionForOptimization(f);
+assertEquals(0, f());
+%OptimizeMaglevOnNextCall(f);
+assertEquals(0, f());

deps/v8/test/mjsunit/maglev/regress/regress-1359928.js

@@ -0,0 +1,28 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --no-concurrent-recompilation
+
+function __f_0() {
+  var __v_1;
+  try {
+    class __c_0 extends (__v_4) {}
+  } catch {
+    console.log("soozie");
+  }
+  try {
+    Object.defineProperty(__v_2, 'x');
+  } catch {}
+  try {
+    console.log("foozie");
+    class __c_2 extends (eval('delete obj.x'), class {}) {}
+  } catch (__v_7) {
+    console.log("boozie");
+    __v_1 = __v_7;
+  }
+}
+%PrepareFunctionForOptimization(__f_0);
+__f_0();
+%OptimizeMaglevOnNextCall(__f_0);
+__f_0();

deps/v8/test/mjsunit/maglev/regress/regress-1363450.js

@@ -0,0 +1,22 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+class C extends (class {}) {
+  constructor() {
+    var f = () => {
+      try { C.__proto__ = null; } catch {}
+      try { super(); } catch {}
+    };
+    %PrepareFunctionForOptimization(f);
+    f();
+    %OptimizeMaglevOnNextCall(f);
+  }
+}
+try { new C(); } catch {}
+// The next 2 calls deopt before reaching relevant bits.
+try { new C(); } catch {}
+try { new C(); } catch {}
+try { new C(); } catch {}

deps/v8/test/mjsunit/maglev/regress/regress-1364074.js

@@ -0,0 +1,24 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev
+
+class Base {
+}
+let Class = class extends Base {
+  constructor() {
+      super();
+  }
+};
+for (let i = 0; i < 10; i++) {
+    Class = class extends Class {
+      constructor() {
+        try {
+          super();
+          super();
+        } catch (e) {}
+      }
+    };
+}
+let instance = new Class();

deps/v8/test/mjsunit/maglev/regress/regress-1368046.js

@@ -0,0 +1,19 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+function f(arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8, arg9, arg10, arg11) {
+  for (let i = 0; i < 0; i++) {}
+  try {
+    throw 42;
+  } catch (e) {
+  }
+}
+
+%PrepareFunctionForOptimization(f);
+f(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 42);
+f(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 42);
+%OptimizeMaglevOnNextCall(f);
+f(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 42);

deps/v8/test/mjsunit/maglev/regress/regress-1381663.js

@@ -0,0 +1,16 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+function foo() {
+  try {
+    Map.prototype.delete.call();
+  } catch (e) {}
+}
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeMaglevOnNextCall(foo);
+foo();

deps/v8/test/mjsunit/maglev/regress/regress-1383712.js

@@ -0,0 +1,26 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+// Pseudo-side-effecting function.
+function bar() {}
+%NeverOptimizeFunction(bar);
+
+function foo(i) {
+  // First load checks for HeapNumber map, allowing through Smis.
+  i['oh'];
+  // Cause side-effects to clear known maps of i.
+  bar(i);
+  // Second load should not crash for Smis.
+  i['no'];
+}
+
+%PrepareFunctionForOptimization(foo);
+// Give the two loads polymorphic feedback in HeapNumber and {some object}.
+foo({});
+foo(1);
+%OptimizeMaglevOnNextCall(foo);
+// Pass a Smi to loads with a HeapNumber map-check.
+foo(2);

deps/v8/test/mjsunit/maglev/regress/regress-1392936.js

@@ -0,0 +1,16 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+var func = function(){}
+function foo() {
+    let call = func.call;
+    call();
+}
+%PrepareFunctionForOptimization(foo);
+try {foo();} catch {}
+try {foo();} catch {}
+%OptimizeMaglevOnNextCall(foo);
+try {foo();} catch {}

deps/v8/test/mjsunit/maglev/regress/regress-1394279.js

@@ -0,0 +1,21 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --maglev --single-threaded
+
+function foo(b) {
+  foo.bind();
+  if (b) {
+    %OptimizeFunctionOnNextCall(foo);
+  }
+  for (let i = 0; i < 10000; i++) {}
+  foo instanceof foo;
+}
+
+  %PrepareFunctionForOptimization(foo);
+foo(false);
+%OptimizeMaglevOnNextCall(foo);
+foo(true);
+foo.prototype = foo;
+foo(true);

deps/v8/test/mjsunit/maglev/regress/regress-1403575.js

@@ -0,0 +1,14 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function f(y) {
+  const x = y % y;
+  return 1 / x;
+}
+%PrepareFunctionForOptimization(f);
+assertEquals(f(2), Infinity);
+%OptimizeMaglevOnNextCall(f);
+assertEquals(f(-2), -Infinity);

deps/v8/test/mjsunit/maglev/regress/regress-1405651.js

@@ -0,0 +1,52 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --harmony --no-always-turbofan --maglev
+
+function assertMaglevved(f) {
+  assertTrue(isMaglevved(f));
+}
+
+function f(x) {
+  return x[2];
+}
+
+let buff = new ArrayBuffer(1024);
+let arr = new Int32Array(buff);
+arr[2] = 42;
+
+%PrepareFunctionForOptimization(f);
+assertEquals(42, f(arr));
+
+%OptimizeMaglevOnNextCall(f);
+assertEquals(42, f(arr));
+
+assertMaglevved(f);
+// Detaching {buff} will cause {f} to deoptimize thanks to the protector.
+buff.transfer();
+assertUnoptimized(f);
+
+assertEquals(undefined, f(arr));
+
+let buff2 = new ArrayBuffer(1024);
+let arr2 = new Int32Array(buff2);
+arr2[2] = 42;
+
+// Re-optimizing {f} (which a fresh feedback), now that the protector for
+// detached array buffer doesn't hold anymore.
+%DeoptimizeFunction(f);
+%ClearFunctionFeedback(f);
+%PrepareFunctionForOptimization(f);
+assertEquals(42, f(arr2));
+%OptimizeMaglevOnNextCall(f);
+assertEquals(42, f(arr2));
+assertMaglevved(f);
+
+// The protector doesn't hold anymore, so detaching buff2 shouldn't deopt {f}.
+buff2.transfer();
+assertMaglevved(f);
+
+// The runtime check will call a deopt since {buff2} has been detached.
+assertEquals(undefined, f(arr2));
+assertUnoptimized(f);

deps/v8/test/mjsunit/maglev/regress/regress-1407959.js

@@ -0,0 +1,27 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+function func() {}
+function foo(x) {
+  return x instanceof func;
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeMaglevOnNextCall(foo);
+foo();
+
+let custom_has_instance_runs = 0;
+Object.defineProperty(func, Symbol.hasInstance, {
+  value: function() {
+    custom_has_instance_runs++;
+    return true;
+  }
+});
+
+assertTrue(foo());
+assertEquals(custom_has_instance_runs, 1);

deps/v8/test/mjsunit/maglev/regress/regress-1427809.js

@@ -0,0 +1,18 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --maglev
+
+function f0() {
+  try {
+    return Math.pow(129n);
+  } catch(e3) {
+    return 42;
+  }
+}
+%PrepareFunctionForOptimization(f0);
+assertEquals(f0(), 42);
+assertEquals(f0(), 42);
+%OptimizeMaglevOnNextCall(f0);
+assertEquals(f0(), 42);

deps/v8/test/mjsunit/maglev/regress/regress-1428764.js

@@ -0,0 +1,18 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --jit-fuzzing
+
+for (let v0 = 0; v0 < 25; v0++) {
+    async function f1() {
+        for (let i7 = 4294967296;
+            i7 < 6;
+            (() => {
+                i7++;
+            })()) {
+            await a4;
+        }
+    }
+    f1();
+}

deps/v8/test/mjsunit/maglev/regress/regress-1438990.js

@@ -0,0 +1,28 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+function foo(arr, do_store) {
+  // Load from arr.
+  arr[0];
+
+  if (do_store) {
+    // Store to arr.
+    arr[0] = 0.2;
+
+    arr instanceof foo;
+  }
+}
+
+%PrepareFunctionForOptimization(foo);
+// Initialise the load and store with PACKED_DOUBLE_ELEMENTS feedback.
+foo([0.5], true);
+// Transition just the load to PACKED_ELEMENTS feedback.
+foo([{}], false);
+%OptimizeMaglevOnNextCall(foo);
+// The compilation should succeed here despite `arr instanceof foo` trying to
+// read an impossible map (the load checks for PACKED_ELEMENTS, the store checks
+// for PACKED_DOUBLE_ELEMENTS).
+foo([{}], false);

deps/v8/test/mjsunit/maglev/regress/regress-1454478.js

@@ -0,0 +1,23 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --maglev
+
+function Class(a1, a2) {
+  return a1 === a2;
+}
+function foo(x) {
+  const instance = new Class(x, x + 1);
+  if (instance) {
+  } else {
+    fail("ToBoolean of instance should not be false, even though the constructor returns false.")
+  }
+}
+
+%PrepareFunctionForOptimization(Class);
+%PrepareFunctionForOptimization(foo);
+foo(0);
+foo(0);
+%OptimizeMaglevOnNextCall(foo);
+foo(0);

deps/v8/test/mjsunit/maglev/regress/regress-1455289.js

@@ -0,0 +1,20 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --maglev
+
+function foo(i) {
+  i++;
+  try {
+    [].forEach(i);
+  } catch (e) {
+    return 42;
+  }
+}
+
+%PrepareFunctionForOptimization(foo);
+print(42, foo(0));
+print(42, foo(0));
+%OptimizeMaglevOnNextCall(foo);
+print(42, foo(0));

deps/v8/test/mjsunit/maglev/regress/regress-1455295.js

@@ -0,0 +1,26 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --maglev
+
+function foo() {
+  let caught = 0;
+  try {
+    [].forEach(undefined);
+  } catch (e) {
+    caught += 2;
+  }
+  try {
+    [].forEach(undefined);
+  } catch (e) {
+    caught += 40;
+  }
+  return caught;
+}
+
+%PrepareFunctionForOptimization(foo);
+print(42, foo());
+print(42, foo());
+%OptimizeMaglevOnNextCall(foo);
+print(42, foo());

deps/v8/test/mjsunit/maglev/regress/regress-1455550.js

@@ -0,0 +1,33 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --maglev
+
+var o = { "foo": 42, "bar": 32 };
+
+function foo(o, k, do_lookup) {
+  if (do_lookup)
+    return o[k];
+}
+
+%PrepareFunctionForOptimization(foo);
+// Warm up the keyed load feedback in foo as always loading the name "foo".
+assertEquals(42, foo(o, "foo", true));
+assertEquals(42, foo(o, "foo", true));
+
+function bar(o, do_lookup) {
+  // Bar does a lookup with "bar" on the object, using foo.
+  return foo(o, "bar", do_lookup);
+}
+%PrepareFunctionForOptimization(bar);
+// Warm up bar as never having done the lookup, so that the named feedback in
+// foo stays "foo".
+assertEquals(undefined, bar(o, false));
+assertEquals(undefined, bar(o, false));
+
+// This optimization should not be confused by the potential mismatch between
+// the "foo" named feedback in foo, and the "bar" constant string in bar.
+%OptimizeMaglevOnNextCall(bar);
+assertEquals(undefined, bar(o, false));
+assertEquals(32, bar(o, true));

deps/v8/test/mjsunit/maglev/regress/regress-355484345.js

@@ -0,0 +1,25 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --maglev
+
+const o1 = {
+    "type": "function",
+};
+function f2() {
+    for (let v5 = 0; v5 < 5; v5++) {
+        v5 **= 256;
+        const o6 = {
+            "type": v5,
+        };
+        const o8 = {
+            get b() {
+            },
+        };
+    }
+}
+%PrepareFunctionForOptimization(f2);
+f2(f2());
+%OptimizeFunctionOnNextCall(f2);
+f2();

deps/v8/test/mjsunit/maglev/regress/regress-356913290.js

@@ -0,0 +1,24 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+
+let v8 = -2147483649;
+function f9() {
+    let v10 = 0;
+    let v12 = -1024;
+    for (let v13 = 0; v13 < 25; v13++) {
+        let v16 =v10 - 5 | v8;
+        const v18 = v10 + 2147483647;
+        v10 = v18 | f9;
+        v8 = v13;
+        v16++;
+        v12 = ((v12 & v18) && v16) | 0;
+    }
+}
+%PrepareFunctionForOptimization(f9);
+f9();
+%OptimizeFunctionOnNextCall(f9);
+f9();

deps/v8/test/mjsunit/maglev/regress/regress-356913462.js

@@ -0,0 +1,22 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --maglev
+
+
+function __f_1() {
+  var x = 2;
+  while (x-- > 0) {
+    x = x;
+    let o = {
+      get: function () {
+        x[638197]();
+      }
+    };
+    %OptimizeOsr();
+  }
+  return x;
+}
+%PrepareFunctionForOptimization(__f_1);
+assertTrue(__f_1() === -1);

deps/v8/test/mjsunit/maglev/regress/regress-356917015.js

@@ -0,0 +1,27 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function f0() {
+  function f1(a2) {
+      if (a2) {
+          throw_before_this_function_is_not_defined();
+      }
+  }
+  const v5 = %NeverOptimizeFunction(f1);
+  let v7 = undefined >>> undefined;
+  try {
+      f1();
+      v7 = 45;
+      f1(true);
+  } catch(e12) {
+      v7 + 3;
+  }
+  for (let v15 = 0; v15 < 100; v15++) {
+  }
+}
+const v16 = %PrepareFunctionForOptimization(f0);
+f0();
+f0();

deps/v8/test/mjsunit/maglev/regress/regress-367758074.js

@@ -0,0 +1,34 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --maglev-optimistic-peeled-loops
+
+(function() {
+  let i = 0;
+  function inc() { i = i + 1; }
+  %PrepareFunctionForOptimization(inc);
+  while (i < 10) {
+    let asdf = 0;
+    function xxx() { return asdf; }
+    function aliasing() {
+      var prevI = i;
+      var ok = true;
+      for (var y = 0; y < 2; ++y) {
+        // Non-peeled outer loop to start with empty analysis state
+        for (var x = 1; x < 3; ++x) {
+          // Create aliasing cache entry
+          inc();
+          // Check cache is consistent for every iteration
+          if (prevI+x != i) ok = false;
+        }
+        prevI = i;
+      }
+      // Assert needs to be outside of loop since it has effects
+      assertTrue(ok);
+    }
+    %PrepareFunctionForOptimization(aliasing);
+    aliasing();
+    %OptimizeMaglevOnNextCall(aliasing);
+  }
+})();

deps/v8/test/mjsunit/maglev/regress/regress-371044612.js

@@ -0,0 +1,22 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --maglev-optimistic-peeled-loops
+
+function f0() {
+    for (let i2 = 0;
+        (() => {
+            return i2 < 10;
+        })();
+        i2++) {
+        if (i2 <= NaN) {
+            throw 0;
+        }
+    }
+}
+f0();
+%PrepareFunctionForOptimization(f0);
+f0();
+%OptimizeMaglevOnNextCall(f0);
+f0();

deps/v8/test/mjsunit/maglev/regress/regress-379066970.js

@@ -0,0 +1,31 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function test() {
+  for (let v0 = 0; v0 < 5; v0++) {
+      let v1 = 35;
+      while ((() => {
+              const v2 = v1--;
+              function f3() {
+              }
+              function f4() {
+                  let v5 = 0;
+                  for (let v6 = 0; v6 < 5; v6++) {
+                      switch (v6) {
+                          case 4:
+                              v5 = f3;
+                      }
+                  }
+              }
+              f4();
+              return v2 > 31;
+          })()) {
+          const v11 = %OptimizeOsr();
+      }
+  }
+}
+%PrepareFunctionForOptimization(test);
+test();

deps/v8/test/mjsunit/maglev/regress/regress-383019484.js

@@ -0,0 +1,15 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --maglev --no-always-turbofan --no-use-ic
+
+var v = false;
+function f(p) {
+  return 0 == (p ? v : null);
+}
+%PrepareFunctionForOptimization(f);
+f(true);
+
+%OptimizeMaglevOnNextCall(f);
+assertFalse(f(false));

deps/v8/test/mjsunit/maglev/regress/regress-383999269.js

@@ -0,0 +1,17 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function fun() {
+  var f = [];
+  for (let v2 = 0; v2 < 5; v2++) {
+      const v3 = %OptimizeOsr();
+      const v5 = !(v2 ?? -0.0);
+      var f = v5;
+      -0.0 != v5;
+  }
+}
+%PrepareFunctionForOptimization(fun);
+fun();

deps/v8/test/mjsunit/maglev/regress/regress-399208503.js

@@ -0,0 +1,22 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function a(b, c) {
+  if (c != b) 'xxxxxxxxxxxxxxxxx' + c
+}
+
+%PrepareFunctionForOptimization(a);
+
+(function () {
+  a("", ".")
+})();
+
+(function () {
+  for (d = 2000; d; --d) {
+    e = "123";
+  }
+  a(3, e.length)
+})();

deps/v8/test/mjsunit/maglev/regress/regress-6373.js

@@ -0,0 +1,46 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+(function() {
+var A = {};
+
+A[Symbol.hasInstance] = function(x) {
+  return 1;
+};
+
+var a = {};
+
+function foo(o) {
+  return o instanceof A;
+};
+%PrepareFunctionForOptimization(foo);
+foo(a);
+foo(a);
+assertSame(foo(a), true);
+%OptimizeMaglevOnNextCall(foo);
+assertSame(foo(a), true);
+})();
+
+(function() {
+var A = {};
+
+A[Symbol.hasInstance] = function(x) {
+  %DeoptimizeFunction(foo);
+  return 1;
+};
+
+var a = {};
+
+function foo(o) {
+  return o instanceof A;
+};
+%PrepareFunctionForOptimization(foo);
+foo(a);
+foo(a);
+assertSame(foo(a), true);
+%OptimizeMaglevOnNextCall(foo);
+assertSame(foo(a), true);
+})();

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1392061.js

@@ -0,0 +1,37 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --maglev --allow-natives-syntax
+
+const obj7 = -1;
+function foo(arg) {
+    let obj10 = 0;
+    let obj11 = 0;
+    for(var i= 0 ;i<2;i++){
+        const obj15 = 1;
+        const obj17 = obj11 + 1;
+        const obj18 = 2;
+        const obj19 = 3;
+        const obj20 = obj10 / 3;
+        obj10 = obj20;
+        let obj21 = 0;
+        do {
+            try {
+                const obj23 = !obj7;
+
+            } catch(e) {
+            }
+            obj21++;
+        } while (obj21 < 2);
+    }
+
+}
+const obj32 = [1,2,3,4];
+
+
+%PrepareFunctionForOptimization(foo);
+foo(obj32);foo(obj32);foo(obj32);
+console.log("maglev");
+%OptimizeMaglevOnNextCall(foo);
+foo(obj32);

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1394036.js

@@ -0,0 +1,19 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function v1(v4) {
+    let v6 = 0;
+    const v8 = v6--;
+    for (let v11 = v6; v11 < 6; v11++) {
+        v4 = v6;
+    }
+    try {
+1(1,..."string",1024);
+    } catch(v18) {
+    }
+}
+
+for (let v19 = 0; v19 < 100; v19++) {
+    const v20 = v1();
+}

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1403280.js

@@ -0,0 +1,14 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+function __f_41() {
+    return "abc".charCodeAt(undefined/2);
+}
+
+%PrepareFunctionForOptimization(__f_41);
+assertEquals(97, __f_41());
+%OptimizeMaglevOnNextCall(__f_41);
+assertEquals(97, __f_41());

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1403323.js

@@ -0,0 +1,15 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+function foo(a) {
+  if (a.length > 0) {}
+}
+%PrepareFunctionForOptimization(foo);
+foo(false);
+foo(false);
+foo(4);
+%OptimizeMaglevOnNextCall(foo);
+assertThrows(foo);

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1403399.js

@@ -0,0 +1,36 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --maglev --allow-natives-syntax
+
+function __f_0() {
+    for (let __v_3 = 0; __v_3 < 52; ++__v_3) {
+      let __v_4 = __v_3 | 0;
+      switch (__v_4) {
+        case 28:
+            if (__v_3 != null && typeof __v_3 == "object") {
+              try {
+                 Object.defineProperty(  {
+                   get: function () {
+                           ({get: function () {
+                             return __v_4;
+                           }})
+                   }
+                 });
+              } catch (e) {}
+            }
+        case 29:
+        case 31:
+        case 32:
+        case 33:
+            __v_4 += 1;
+
+        case 34:
+      }
+    }
+}
+%PrepareFunctionForOptimization(__f_0);
+__f_0();
+%OptimizeMaglevOnNextCall(__f_0);
+__f_0();

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1403470.js

@@ -0,0 +1,14 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+function __f_0( __v_18) {
+  -1 % 11;
+  return -1 % 11;
+}
+%PrepareFunctionForOptimization(__f_0);
+assertEquals(-1, __f_0());
+%OptimizeMaglevOnNextCall(__f_0);
+assertEquals(-1, __f_0());

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1403749.js

@@ -0,0 +1,25 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+function f(x) {
+  let c = x | -6;
+  switch (c) {
+    case 0:
+    case 1:
+    case 2:
+    case 3:
+    case 4:
+    case -5: return 3;
+  }
+  return 0;
+}
+
+%PrepareFunctionForOptimization(f);
+assertEquals(0, f(-2147483648));
+assertEquals(3, f(-2127484783));
+%OptimizeMaglevOnNextCall(f);
+assertEquals(0, f(-2147483648));
+assertEquals(3, f(-2127484783));

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1405445.js

@@ -0,0 +1,16 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+function foo() {}
+function bar(...args) {
+  foo.apply(...args);
+}
+
+%PrepareFunctionForOptimization(bar);
+assertThrows('bar(2,3,4)');
+assertThrows('bar(2,3,4)');
+%OptimizeMaglevOnNextCall(bar);
+assertThrows('bar(2,3,4)');

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1416693.js

@@ -0,0 +1,22 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+function f() {
+  let i = 0;
+  let j = 0;
+
+  while (i < 1) {
+    j = i;
+    i++;
+  }
+
+  return j;
+}
+
+%PrepareFunctionForOptimization(f);
+f();
+%OptimizeMaglevOnNextCall(f);
+f();

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1416795.js

@@ -0,0 +1,18 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+function f(x) {
+  x++; // Making sure that {x} has a Float64 alternative
+  let phi = x ? 0 : x; // Creating a Phi whose inputs are Smi and Float64
+  const obj = { "d" : phi }; // Storing the Phi in a Smi field, which will
+                             // insert a CheckSmi
+  --phi; // Using the Smi as an Int32, which will insert a UnsafeSmiUntag
+}
+
+%PrepareFunctionForOptimization(f);
+f(1.5);
+%OptimizeMaglevOnNextCall(f);
+f(1.5);

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1417386.js

@@ -0,0 +1,27 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+function f(x) {
+  x++; // Making sure {x} has a Float64 alternative
+  let phi = x || 0;  // Creating a Phi whose inputs are Smi and Float64. Phi
+                     // untagging will make this a Float64 phi.
+  phi + 1;           // Float64 operation with {phi}, which will cause insert a
+                     // CheckedNumberToFloat64(phi). After phi untagging, the
+            // CheckedNumberToFloat64 will be killed, resulting in the addition
+            // to take {phi} directly as input.
+  phi << 4;  // Int operation with {phi}, which will produce a
+             // TruncateNumberToInt32(phi). TruncateNumberToInt32 doesn't check
+             // if the input is a Number, and call into runtime if necessary to
+             // to the truncation, so it can't deopt. After Phi untagging, this
+             // should be replaced by a Float64->Int32 truncation
+             // (TruncateFloat64ToInt32), which shouldn't deopt either (because
+             // we can't replace a non-deopting node by a deopting one).
+}
+
+%PrepareFunctionForOptimization(f);
+f(1.5);
+%OptimizeMaglevOnNextCall(f);
+f(1.5);

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1421237.js

@@ -0,0 +1,19 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+function f() {
+  for (let v6 = 0; v6 < 10; v6++) {
+    ~v6;
+    let obj = { enumerable: true, value: v6 };
+    Object.defineProperty(Float64Array, 2, obj);
+    v6 %= v6;
+  }
+}
+
+%PrepareFunctionForOptimization(f);
+f();
+%OptimizeMaglevOnNextCall(f);
+f();

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1421375.js

@@ -0,0 +1,20 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+function f(a) {
+  let v = 3.5 / a;
+  let x = 4.5 + v;
+  if (x) {
+    return 42;
+  } else {
+    return 12;
+  }
+}
+
+%PrepareFunctionForOptimization(f);
+assertEquals(f(), 12);
+%OptimizeMaglevOnNextCall(f);
+assertEquals(f(), 12);

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1421712.js

@@ -0,0 +1,20 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+function f0(a) {
+  while (a > 0) {
+    [115,109,-1,96,127,5,,1,9223372036854775806,17,2,0,103];
+    const v35 = Math.round(-1e-15);
+    Math[v35];
+    a = 0;
+  }
+  return f0;
+}
+
+%PrepareFunctionForOptimization(f0);
+f0(1);
+%OptimizeMaglevOnNextCall(f0);
+f0(1);

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1422864.js

@@ -0,0 +1,32 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+function f(a) {
+  let not_a_smi = a ^ 1073741824; // Greater than Smi::kMaxValue (and cannot be
+                                  // a Constant, because we don't untag
+                                  // Phi(Constant,Constant)).
+  let phi = a ? not_a_smi : 4; // During feedback collection, this is a heap
+                               // number, but Phi untagging will decide that it
+                               // should be a Int32 phi.
+  let truncated = phi | 0; // Will insert a CheckedTruncateNumberToInt32
+                           // conversion, which will become an Idendity after
+                           // phi untagging, but is an input to the following
+                           // deopt state, which should thus be updated.
+  10 * "a"; // can lazy deopt (an operation that can eager deopt could cause a
+            // similar bug, but it's a bit harder to set up the repro, because
+            // the deopt state used for lazy deopts is the "current" one,
+            // whereas eager deopt can use an earlier state as long as there is
+            // no side-effects between the state and the current operation. Here
+            // for instance, replacing `10 * "a"` by `10000000 * a` (which can
+            // eager deopts) doesn't reproduce the bug, because an earlier deopt
+            // state is used, which doesn't contain `truncated`).
+  return truncated; // uses `truncated` so that it's part of the lazy deopt state above
+}
+
+%PrepareFunctionForOptimization(f);
+f(1);
+%OptimizeMaglevOnNextCall(f);
+f(1);

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1423580.js

@@ -0,0 +1,45 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+function f_StoreTaggedFieldWithWriteBarrier() {
+  try {
+    function f4() {
+    }
+    "k"["k"]();
+  } catch(e8) {
+    e8.c = f_StoreTaggedFieldWithWriteBarrier;
+    for (let v11 = 1261610744; v11 < 1261610744; v11 = v11 + 3) {
+      // This code is unreachable. However, due to feedback sharing, this store
+      // will have an initialized feedback slot: it shares its slot with
+      // `e8.c = f0` despite the 2 having different receivers, because both receivers
+      // have index 2: `e8` in the context, and `v11` in the local.
+      v11.c = e8;
+    }
+    const t11 = 3;
+  }
+}
+
+%PrepareFunctionForOptimization(f_StoreTaggedFieldWithWriteBarrier);
+f_StoreTaggedFieldWithWriteBarrier();
+%OptimizeMaglevOnNextCall(f_StoreTaggedFieldWithWriteBarrier);
+f_StoreTaggedFieldWithWriteBarrier();
+
+
+function f_CheckedStoreSmiField(obj) {
+  obj.c = 42;
+  for (let v11 = 3.5; v11 < 3.5; v11 = v11 + 3) {
+    // This code is unreachable. However, due to feedback sharing, this store
+    // will have an initialized feedback slot: it shares its slot with
+    // `obj.c = f0` despite the 2 having different receivers, because they both
+    // have index 0: `obj` in the parameters, and `v11` in the locals.
+    v11.c = 4;
+  }
+}
+
+%PrepareFunctionForOptimization(f_CheckedStoreSmiField);
+f_CheckedStoreSmiField({c:42});
+%OptimizeMaglevOnNextCall(f_CheckedStoreSmiField);
+f_CheckedStoreSmiField({c:42});

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1423610.js

@@ -0,0 +1,32 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax --expose-gc
+
+function f(a) {
+  let phi = a ? 0 : 4.2; // Phi untagging will untag this to a Float64
+  phi |= 0; // Causing a CheckedSmiUntag to be inserted
+  a.c = phi; // The graph builder will insert a StoreTaggedFieldNoWriteBarrier
+             // because `phi` is a Smi. Afterphi untagging, this should become a
+             // StoreTaggedFieldWithWriteBarrier, because `phi` is now a float.
+}
+
+// Allocating an object and making it old (its `c` field should be neither a Smi
+// nor a Double, so that the graph builder inserts a StoreTaggedFieldxxx rather
+// than a StoreDoubleField or CheckedStoreSmiField).
+let obj = {c:"a"};
+gc();
+gc();
+
+%PrepareFunctionForOptimization(f);
+f(obj);
+
+%OptimizeMaglevOnNextCall(f);
+// This call to `f` will store a young object into that `c` field of `obj`. This
+// should be done with a write barrier.
+f(obj);
+
+// If the write barrier was dropped, the GC will complain because it will see an
+// old->new pointer without remembered set entry.
+gc();

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1425124.js

@@ -0,0 +1,21 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+function f() {
+  let v8 = 0;
+  let v9 = -1024;
+  for (let i = 0; i < 5; i++) {
+    const v23 = v8 - 55598 | 0;
+    const v24 = v8 + 2147483647;
+    v8 = v24 | f;
+    v9 = ((v9 & v24) && v23) | 0;
+  }
+}
+
+%PrepareFunctionForOptimization(f);
+f();
+%OptimizeMaglevOnNextCall(f);
+f();

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1428464.js

@@ -0,0 +1,17 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax --maglev-untagged-phis
+
+function f(a) {
+  let heap_number = 2000000000;
+  let phi = a ? 42 : heap_number;
+  let float64_use = phi + 1.5;
+  let truncated_int32_use = phi ^ 25;
+}
+
+%PrepareFunctionForOptimization(f);
+f(0);
+%OptimizeMaglevOnNextCall(f);
+f(1);

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1428524.js

@@ -0,0 +1,26 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax --maglev-untagged-phis
+
+function f(a) {
+  let int32 = a + 1;
+
+  let int32_phi = a ? int32 : 42;
+  let int32_use = int32_phi + 1;
+
+  // {float64_phi} has an Int32 input and a Float64 use, we should thus generate
+  // a Float64 phi for it. One of its inputs is {int32_phi}, which should have
+  // been untagged as Int32, and for which we should thus require an
+  // Int32ToFloat64 conversion.
+  let float64_phi = a ? int32_phi : int32;
+  let float64_use = float64_phi + 4.5;
+
+  return float64_use;
+}
+
+%PrepareFunctionForOptimization(f);
+f(1);
+%OptimizeMaglevOnNextCall(f);
+f(1);

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1429753.js

@@ -0,0 +1,12 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --maglev --allow-natives-syntax --noenable-lazy-source-positions
+
+function f1() {
+    (true ? typeof~0 === "bigint" : 0) && 0;
+}
+%PrepareFunctionForOptimization(f1);
+%OptimizeMaglevOnNextCall(f1);
+f1();

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1429810.js

@@ -0,0 +1,16 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax --maglev-untagged-phis
+
+function f(a) {
+  let phi = a ? 0.5 : 1.5;
+  let truncated_int32_use = phi ^ 2;
+  let float64_use = phi + 2.5;
+}
+
+%PrepareFunctionForOptimization(f);
+f(1);
+%OptimizeMaglevOnNextCall(f);
+f(1);

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1433505.js

@@ -0,0 +1,16 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --maglev --allow-natives-syntax
+
+function f() {
+    const v9 = -Infinity && -27872;
+    +v9;
+    v9 % v9;
+}
+
+%PrepareFunctionForOptimization(f);
+f();
+%OptimizeMaglevOnNextCall(f);
+f();

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1465326.js

@@ -0,0 +1,25 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --maglev --allow-natives-syntax
+
+class A {}
+
+var x = Function;
+
+class B extends A {
+  constructor() {
+    x = new.target;
+    super();
+  }
+}
+function construct() {
+  return Reflect.construct(B, [], Function);
+}
+%PrepareFunctionForOptimization(B);
+construct();
+construct();
+%OptimizeMaglevOnNextCall(B);
+var arr = construct();
+console.log(arr.prototype);

deps/v8/test/mjsunit/maglev/regress/regress-crbug-1513626.js

@@ -0,0 +1,27 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+const v11 = new Promise(()=>{});
+for (let v12 = 0; v12 < 5; v12++) {
+    async function* f13( a15) {
+        for (let v16 = 0; v16 < 5; v16++) {
+            if (v12 == 4 && v16 == 4) {
+                %OptimizeOsr();
+            }
+            for (const v17 in v11) {
+                yield* SharedArrayBuffer;
+            }
+        }
+        for (let v24 = 0; v24 < 5; v24++) {
+            Math.acosh(a15 %= 4096 % v24);
+        }
+        return f13;
+    }
+    if (v12 == 0) {
+      %PrepareFunctionForOptimization(f13);
+    }
+    f13().next();
+}

deps/v8/test/mjsunit/maglev/regress/regress-v8-13289.js

@@ -0,0 +1,24 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function Thingy() {}
+Thingy.prototype = {
+  foo: function() { return 42; }
+};
+
+const x = new Thingy();
+
+function f(o) {
+  return o.foo();
+}
+
+%PrepareFunctionForOptimization(f);
+assertEquals(42, f(x));
+%OptimizeMaglevOnNextCall(f);
+assertEquals(42, f(x));
+
+Thingy.prototype.foo = function() { return 56; }
+assertEquals(56, f(x));