[TurboFan] Array.prototype.every inlined

Bug: v8:1956
Change-Id: Iee1c6245832b786993ebd71b615cf4257c6bd0bb
Reviewed-on: https://chromium-review.googlesource.com/758769
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50320}

src/builtins/builtins-array-gen.cc

@@ -2035,6 +2035,49 @@ TF_BUILTIN(TypedArrayPrototypeSome, ArrayBuiltinCodeStubAssembler) {
       &ArrayBuiltinCodeStubAssembler::NullPostLoopAction);
 }
 
+TF_BUILTIN(ArrayEveryLoopLazyDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
+  Node* context = Parameter(Descriptor::kContext);
+  Node* receiver = Parameter(Descriptor::kReceiver);
+  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
+  Node* this_arg = Parameter(Descriptor::kThisArg);
+  Node* initial_k = Parameter(Descriptor::kInitialK);
+  Node* len = Parameter(Descriptor::kLength);
+  Node* result = Parameter(Descriptor::kResult);
+
+  // This custom lazy deopt point is right after the callback. every() needs
+  // to pick up at the next step, which is either continuing to the next
+  // array element or returning false if {result} is false.
+  Label true_continue(this), false_continue(this);
+
+  // iii. If selected is true, then...
+  BranchIfToBooleanIsTrue(result, &true_continue, &false_continue);
+  BIND(&true_continue);
+  {
+    // Increment k.
+    initial_k = NumberInc(initial_k);
+
+    Return(CallBuiltin(Builtins::kArrayEveryLoopContinuation, context, receiver,
+                       callbackfn, this_arg, TrueConstant(), receiver,
+                       initial_k, len, UndefinedConstant()));
+  }
+  BIND(&false_continue);
+  { Return(FalseConstant()); }
+}
+
+TF_BUILTIN(ArrayEveryLoopEagerDeoptContinuation,
+           ArrayBuiltinCodeStubAssembler) {
+  Node* context = Parameter(Descriptor::kContext);
+  Node* receiver = Parameter(Descriptor::kReceiver);
+  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
+  Node* this_arg = Parameter(Descriptor::kThisArg);
+  Node* initial_k = Parameter(Descriptor::kInitialK);
+  Node* len = Parameter(Descriptor::kLength);
+
+  Return(CallBuiltin(Builtins::kArrayEveryLoopContinuation, context, receiver,
+                     callbackfn, this_arg, TrueConstant(), receiver, initial_k,
+                     len, UndefinedConstant()));
+}
+
 TF_BUILTIN(ArrayEveryLoopContinuation, ArrayBuiltinCodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
   Node* receiver = Parameter(Descriptor::kReceiver);

src/builtins/builtins-definitions.h

@@ -279,6 +279,10 @@ namespace internal {
   /* ES6 #sec-array.prototype.every */                                         \
   TFS(ArrayEveryLoopContinuation, kReceiver, kCallbackFn, kThisArg, kArray,    \
       kObject, kInitialK, kLength, kTo)                                        \
+  TFJ(ArrayEveryLoopEagerDeoptContinuation, 4, kCallbackFn, kThisArg,          \
+      kInitialK, kLength)                                                      \
+  TFJ(ArrayEveryLoopLazyDeoptContinuation, 5, kCallbackFn, kThisArg,           \
+      kInitialK, kLength, kResult)                                             \
   TFJ(ArrayEvery, SharedFunctionInfo::kDontAdaptArgumentsSentinel)             \
   /* ES6 #sec-array.prototype.some */                                          \
   TFS(ArraySomeLoopContinuation, kReceiver, kCallbackFn, kThisArg, kArray,     \

src/builtins/builtins.cc

@@ -172,6 +172,8 @@ Callable Builtins::CallableFor(Isolate* isolate, Name name) {
 #undef CASE_OTHER
     case kArrayFilterLoopEagerDeoptContinuation:
     case kArrayFilterLoopLazyDeoptContinuation:
+    case kArrayEveryLoopEagerDeoptContinuation:
+    case kArrayEveryLoopLazyDeoptContinuation:
     case kArrayFindIndexLoopAfterCallbackLazyDeoptContinuation:
     case kArrayFindIndexLoopEagerDeoptContinuation:
     case kArrayFindIndexLoopLazyDeoptContinuation:
@@ -237,6 +239,8 @@ bool Builtins::IsLazy(int index) {
     case kArrayForEachLoopLazyDeoptContinuation:   // https://crbug.com/v8/6786.
     case kArrayMapLoopEagerDeoptContinuation:      // https://crbug.com/v8/6786.
     case kArrayMapLoopLazyDeoptContinuation:       // https://crbug.com/v8/6786.
+    case kArrayEveryLoopEagerDeoptContinuation:    // https://crbug.com/v8/6786.
+    case kArrayEveryLoopLazyDeoptContinuation:     // https://crbug.com/v8/6786.
     case kArrayFilterLoopEagerDeoptContinuation:   // https://crbug.com/v8/6786.
     case kArrayFilterLoopLazyDeoptContinuation:    // https://crbug.com/v8/6786.
     case kArrayReduceLoopEagerDeoptContinuation:   // https://crbug.com/v8/6786.

src/compiler/js-call-reducer.cc

@@ -2257,6 +2257,229 @@ Node* JSCallReducer::SafeLoadElement(ElementsKind kind, Node* receiver,
   return element;
 }
 
+Reduction JSCallReducer::ReduceArrayEvery(Handle<JSFunction> function,
+                                          Node* node) {
+  if (!FLAG_turbo_inline_array_builtins) return NoChange();
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+
+  Node* outer_frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* context = NodeProperties::GetContextInput(node);
+  // Try to determine the {receiver} map.
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* fncallback = node->op()->ValueInputCount() > 2
+                         ? NodeProperties::GetValueInput(node, 2)
+                         : jsgraph()->UndefinedConstant();
+  Node* this_arg = node->op()->ValueInputCount() > 3
+                       ? NodeProperties::GetValueInput(node, 3)
+                       : jsgraph()->UndefinedConstant();
+  ZoneHandleSet<Map> receiver_maps;
+  NodeProperties::InferReceiverMapsResult result =
+      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+  if (result != NodeProperties::kReliableReceiverMaps) {
+    return NoChange();
+  }
+
+  // And ensure that any changes to the Array species constructor cause deopt.
+  if (!isolate()->IsArraySpeciesLookupChainIntact()) return NoChange();
+
+  if (receiver_maps.size() == 0) return NoChange();
+
+  const ElementsKind kind = receiver_maps[0]->elements_kind();
+
+  // TODO(pwong): Handle holey double elements kinds.
+  if (IsDoubleElementsKind(kind) && IsHoleyElementsKind(kind)) {
+    return NoChange();
+  }
+
+  for (Handle<Map> receiver_map : receiver_maps) {
+    if (!CanInlineArrayIteratingBuiltin(receiver_map)) return NoChange();
+    // We can handle different maps, as long as their elements kind are the
+    // same.
+    if (receiver_map->elements_kind() != kind) return NoChange();
+  }
+
+  dependencies()->AssumePropertyCell(factory()->species_protector());
+
+  Node* k = jsgraph()->ZeroConstant();
+
+  // Make sure the map hasn't changed before we construct the output array.
+  effect = graph()->NewNode(
+      simplified()->CheckMaps(CheckMapsFlag::kNone, receiver_maps), receiver,
+      effect, control);
+
+  Node* original_length = effect = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForJSArrayLength(kind)), receiver,
+      effect, control);
+
+  // Check whether the given callback function is callable. Note that this has
+  // to happen outside the loop to make sure we also throw on empty arrays.
+  Node* check_fail = nullptr;
+  Node* check_throw = nullptr;
+  {
+    // This frame state doesn't ever call the deopt continuation, it's only
+    // necessary to specifiy a continuation in order to handle the exceptional
+    // case.
+    std::vector<Node*> checkpoint_params(
+        {receiver, fncallback, this_arg, k, original_length});
+    const int stack_parameters = static_cast<int>(checkpoint_params.size());
+
+    Node* check_frame_state = CreateJavaScriptBuiltinContinuationFrameState(
+        jsgraph(), function, Builtins::kArrayEveryLoopLazyDeoptContinuation,
+        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
+        outer_frame_state, ContinuationFrameStateMode::LAZY);
+    WireInCallbackIsCallableCheck(fncallback, context, check_frame_state,
+                                  effect, &control, &check_fail, &check_throw);
+  }
+
+  // Start the loop.
+  Node* loop = control = graph()->NewNode(common()->Loop(2), control, control);
+  Node* eloop = effect =
+      graph()->NewNode(common()->EffectPhi(2), effect, effect, loop);
+  Node* terminate = graph()->NewNode(common()->Terminate(), eloop, loop);
+  NodeProperties::MergeControlToEnd(graph(), common(), terminate);
+  Node* vloop = k = graph()->NewNode(
+      common()->Phi(MachineRepresentation::kTagged, 2), k, k, loop);
+
+  Node* continue_test =
+      graph()->NewNode(simplified()->NumberLessThan(), k, original_length);
+  Node* continue_branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
+                                           continue_test, control);
+
+  Node* if_true = graph()->NewNode(common()->IfTrue(), continue_branch);
+  Node* if_false = graph()->NewNode(common()->IfFalse(), continue_branch);
+  control = if_true;
+
+  {
+    std::vector<Node*> checkpoint_params(
+        {receiver, fncallback, this_arg, k, original_length});
+    const int stack_parameters = static_cast<int>(checkpoint_params.size());
+
+    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
+        jsgraph(), function, Builtins::kArrayEveryLoopEagerDeoptContinuation,
+        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
+        outer_frame_state, ContinuationFrameStateMode::EAGER);
+
+    effect =
+        graph()->NewNode(common()->Checkpoint(), frame_state, effect, control);
+  }
+
+  // Make sure the map hasn't changed during the iteration.
+  effect =
+      graph()->NewNode(simplified()->CheckMaps(CheckMapsFlag::kNone,
+                                               receiver_maps, p.feedback()),
+                       receiver, effect, control);
+
+  Node* element =
+      SafeLoadElement(kind, receiver, control, &effect, &k, p.feedback());
+
+  Node* next_k =
+      graph()->NewNode(simplified()->NumberAdd(), k, jsgraph()->OneConstant());
+
+  Node* hole_true = nullptr;
+  Node* hole_false = nullptr;
+  Node* effect_true = effect;
+
+  if (IsHoleyElementsKind(kind)) {
+    // Holey elements kind require a hole check and skipping of the element in
+    // the case of a hole.
+    Node* check = graph()->NewNode(simplified()->ReferenceEqual(), element,
+                                   jsgraph()->TheHoleConstant());
+    Node* branch =
+        graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
+    hole_true = graph()->NewNode(common()->IfTrue(), branch);
+    hole_false = graph()->NewNode(common()->IfFalse(), branch);
+    control = hole_false;
+
+    // The contract is that we don't leak "the hole" into "user JavaScript",
+    // so we must rename the {element} here to explicitly exclude "the hole"
+    // from the type of {element}.
+    element = graph()->NewNode(common()->TypeGuard(Type::NonInternal()),
+                               element, control);
+  }
+
+  Node* callback_value = nullptr;
+  {
+    // This frame state is dealt with by hand in
+    // Builtins::kArrayEveryLoopLazyDeoptContinuation.
+    std::vector<Node*> checkpoint_params(
+        {receiver, fncallback, this_arg, k, original_length});
+    const int stack_parameters = static_cast<int>(checkpoint_params.size());
+
+    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
+        jsgraph(), function, Builtins::kArrayEveryLoopLazyDeoptContinuation,
+        node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
+        outer_frame_state, ContinuationFrameStateMode::LAZY);
+
+    callback_value = control = effect = graph()->NewNode(
+        javascript()->Call(5, p.frequency()), fncallback, this_arg, element, k,
+        receiver, context, frame_state, effect, control);
+  }
+
+  // Rewire potential exception edges.
+  Node* on_exception = nullptr;
+  if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
+    RewirePostCallbackExceptionEdges(check_throw, on_exception, effect,
+                                     &check_fail, &control);
+  }
+
+  // We have to coerce callback_value to boolean.
+  Node* if_false_callback;
+  Node* efalse_callback;
+  {
+    Node* boolean_result =
+        graph()->NewNode(simplified()->ToBoolean(), callback_value);
+    Node* check_boolean_result =
+        graph()->NewNode(simplified()->ReferenceEqual(), boolean_result,
+                         jsgraph()->TrueConstant());
+    Node* boolean_branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
+                                            check_boolean_result, control);
+    if_false_callback = graph()->NewNode(common()->IfFalse(), boolean_branch);
+    efalse_callback = effect;
+
+    // Nothing to do in the true case.
+    control = graph()->NewNode(common()->IfTrue(), boolean_branch);
+  }
+
+  if (IsHoleyElementsKind(kind)) {
+    Node* after_call_control = control;
+    Node* after_call_effect = effect;
+    control = hole_true;
+    effect = effect_true;
+
+    control = graph()->NewNode(common()->Merge(2), control, after_call_control);
+    effect = graph()->NewNode(common()->EffectPhi(2), effect, after_call_effect,
+                              control);
+  }
+
+  loop->ReplaceInput(1, control);
+  vloop->ReplaceInput(1, next_k);
+  eloop->ReplaceInput(1, effect);
+
+  control = graph()->NewNode(common()->Merge(2), if_false, if_false_callback);
+  effect =
+      graph()->NewNode(common()->EffectPhi(2), eloop, efalse_callback, control);
+  Node* return_value = graph()->NewNode(
+      common()->Phi(MachineRepresentation::kTagged, 2),
+      jsgraph()->TrueConstant(), jsgraph()->FalseConstant(), control);
+
+  // Wire up the branch for the case when IsCallable fails for the callback.
+  // Since {check_throw} is an unconditional throw, it's impossible to
+  // return a successful completion. Therefore, we simply connect the successful
+  // completion to the graph end.
+  Node* throw_node =
+      graph()->NewNode(common()->Throw(), check_throw, check_fail);
+  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
+
+  ReplaceWithValue(node, return_value, effect, control);
+  return Replace(return_value);
+}
+
 Reduction JSCallReducer::ReduceCallApiFunction(Node* node,
                                                Handle<JSFunction> function) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
@@ -2686,6 +2909,8 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
           return ReduceArrayFind(ArrayFindVariant::kFind, function, node);
         case Builtins::kArrayPrototypeFindIndex:
           return ReduceArrayFind(ArrayFindVariant::kFindIndex, function, node);
+        case Builtins::kArrayEvery:
+          return ReduceArrayEvery(function, node);
         case Builtins::kReturnReceiver:
           return ReduceReturnReceiver(node);
         case Builtins::kStringPrototypeIndexOf:

src/compiler/js-call-reducer.h

@@ -79,6 +79,7 @@ class JSCallReducer final : public AdvancedReducer {
   enum class ArrayFindVariant : uint8_t { kFind, kFindIndex };
   Reduction ReduceArrayFind(ArrayFindVariant variant,
                             Handle<JSFunction> function, Node* node);
+  Reduction ReduceArrayEvery(Handle<JSFunction> function, Node* node);
   Reduction ReduceCallOrConstructWithArrayLikeOrSpread(
       Node* node, int arity, CallFrequency const& frequency,
       VectorSlotPair const& feedback);

test/mjsunit/optimized-array-every.js

@@ -0,0 +1,502 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-inline-array-builtins --opt
+// Flags: --no-always-opt
+
+// Early exit from every functions properly.
+(() => {
+  const a = [1, 2, 3, 4, 5];
+  let result = 0;
+  function earlyExit() {
+    return a.every(v => {
+      result += v;
+      return v < 2;
+    });
+  }
+  assertFalse(earlyExit());
+  earlyExit();
+  %OptimizeFunctionOnNextCall(earlyExit);
+  assertFalse(earlyExit());
+  assertEquals(9, result);
+})();
+
+// Soft-deopt plus early exit.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+  let result = 0;
+  function softyPlusEarlyExit(deopt) {
+     return a.every(v => {
+       result += v;
+       if (v === 4 && deopt) {
+         a.abc = 25;
+       }
+       return v < 8;
+     });
+  }
+  assertFalse(softyPlusEarlyExit(false));
+  softyPlusEarlyExit(false);
+  %OptimizeFunctionOnNextCall(softyPlusEarlyExit);
+  assertFalse(softyPlusEarlyExit(true));
+  assertEquals(36*3, result);
+})();
+
+// Soft-deopt synced with early exit, which forces the lazy deoptimization
+// continuation handler to exit.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+  let called_values = [];
+  function softyPlusEarlyExit(deopt) {
+     called_values = [];
+     return a.every(v => {
+       called_values.push(v);
+       if (v === 4 && deopt) {
+         a.abc = 25;
+         return false;
+       }
+       return v < 8;
+     });
+  }
+  assertFalse(softyPlusEarlyExit(false));
+  assertArrayEquals([1, 2, 3, 4, 5, 6, 7, 8], called_values);
+  softyPlusEarlyExit(false);
+  %OptimizeFunctionOnNextCall(softyPlusEarlyExit);
+  assertFalse(softyPlusEarlyExit(true));
+  assertArrayEquals([1, 2, 3, 4], called_values);
+})();
+
+// Unknown field access leads to soft-deopt unrelated to every, should still
+// lead to correct result.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
+             20, 21, 22, 23, 24, 25];
+  let result = 0;
+  function eagerDeoptInCalled(deopt) {
+    return a.every((v, i) => {
+      if (i === 13 && deopt) {
+        a.abc = 25;
+      }
+      result += v;
+      return true;
+    });
+  }
+  eagerDeoptInCalled();
+  eagerDeoptInCalled();
+  %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
+  eagerDeoptInCalled();
+  assertTrue(eagerDeoptInCalled(true));
+  eagerDeoptInCalled();
+  assertEquals(1625, result);
+})();
+
+// Length change detected during loop, must cause properly handled eager deopt.
+(() => {
+  let called_values;
+  function eagerDeoptInCalled(deopt) {
+    const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+    called_values = [];
+    return a.every((v,i) => {
+      called_values.push(v);
+      a.length = (i === 5 && deopt) ? 8 : 10;
+      return true;
+    });
+  }
+  assertTrue(eagerDeoptInCalled());
+  assertArrayEquals([1, 2, 3, 4, 5, 6, 7, 8, 9, 10], called_values);
+  eagerDeoptInCalled();
+  %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
+  assertTrue(eagerDeoptInCalled());
+  assertTrue(eagerDeoptInCalled(true));
+  assertArrayEquals([1, 2, 3, 4, 5, 6, 7, 8], called_values);
+  eagerDeoptInCalled();
+})();
+
+// Lazy deopt from a callback that changes the input array. Deopt in a callback
+// execution that returns true.
+(() => {
+  const a = [1, 2, 3, 4, 5];
+  function lazyChanger(deopt) {
+    return a.every((v, i) => {
+      if (i === 3 && deopt) {
+        a[3] = 100;
+        %DeoptimizeNow();
+       }
+      return true;
+    });
+  }
+  assertTrue(lazyChanger());
+  lazyChanger();
+  %OptimizeFunctionOnNextCall(lazyChanger);
+  assertTrue(lazyChanger(true));
+  assertTrue(lazyChanger());
+})();
+
+// Lazy deopt from a callback that will always return true and no element is
+// found. Verifies the lazy-after-callback continuation builtin.
+(() => {
+  const a = [1, 2, 3, 4, 5];
+  function lazyChanger(deopt) {
+    return a.every((v, i) => {
+      if (i === 3 && deopt) {
+        %DeoptimizeNow();
+       }
+      return true;
+    });
+  }
+  assertTrue(lazyChanger());
+  lazyChanger();
+  %OptimizeFunctionOnNextCall(lazyChanger);
+  assertTrue(lazyChanger(true));
+  assertTrue(lazyChanger());
+})();
+
+// Lazy deopt from a callback that changes the input array. Deopt in a callback
+// execution that returns true.
+(() => {
+  const a = [1, 2, 3, 4, 5];
+  function lazyChanger(deopt) {
+    return a.every((v, i) => {
+      if (i === 2 && deopt) {
+        a[3] = 100;
+        %DeoptimizeNow();
+       }
+      return true;
+    });
+  }
+  assertTrue(lazyChanger());
+  lazyChanger();
+  %OptimizeFunctionOnNextCall(lazyChanger);
+  assertTrue(lazyChanger(true));
+  assertTrue(lazyChanger());
+})();
+
+// Escape analyzed array
+(() => {
+  let result = 0;
+  function eagerDeoptInCalled(deopt) {
+    const a_noescape = [0, 1, 2, 3, 4, 5];
+    a_noescape.every((v, i) => {
+      result += v | 0;
+      if (i === 13 && deopt) {
+        a_noescape.length = 25;
+      }
+      return true;
+    });
+  }
+  eagerDeoptInCalled();
+  eagerDeoptInCalled();
+  %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
+  eagerDeoptInCalled();
+  eagerDeoptInCalled(true);
+  eagerDeoptInCalled();
+  assertEquals(75, result);
+})();
+
+// Lazy deopt from runtime call from inlined callback function.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
+             20, 21, 22, 23, 24, 25];
+  let result = 0;
+  function lazyDeopt(deopt) {
+    a.every((v, i) => {
+      result += i;
+      if (i === 13 && deopt) {
+        %DeoptimizeNow();
+      }
+      return true;
+    });
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  lazyDeopt();
+  lazyDeopt(true);
+  lazyDeopt();
+  assertEquals(1500, result);
+})();
+
+// Lazy deopt from runtime call from non-inline callback function.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
+             20, 21, 22, 23, 24, 25];
+  let result = 0;
+  function lazyDeopt(deopt) {
+    function callback(v, i) {
+      result += i;
+      if (i === 13 && deopt) {
+        %DeoptimizeNow();
+      }
+      return true;
+    }
+    %NeverOptimizeFunction(callback);
+    a.every(callback);
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  lazyDeopt();
+  lazyDeopt(true);
+  lazyDeopt();
+  assertEquals(1500, result);
+})();
+
+// Call to a.every is done inside a try-catch block and the callback function
+// being called actually throws.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
+             20, 21, 22, 23, 24, 25];
+  let caught = false;
+  function lazyDeopt(deopt) {
+    try {
+      a.every((v, i) => {
+        if (i === 1 && deopt) {
+          throw("a");
+        }
+        return true;
+      });
+    } catch (e) {
+      caught = true;
+    }
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  lazyDeopt();
+  assertDoesNotThrow(() => lazyDeopt(true));
+  assertTrue(caught);
+  lazyDeopt();
+})();
+
+// Call to a.every is done inside a try-catch block and the callback function
+// being called actually throws, but the callback is not inlined.
+(() => {
+  let a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+  let caught = false;
+  function lazyDeopt(deopt) {
+    function callback(v, i) {
+      if (i === 1 && deopt) {
+        throw("a");
+      }
+      return true;
+    }
+    %NeverOptimizeFunction(callback);
+    try {
+      a.every(callback);
+    } catch (e) {
+      caught = true;
+    }
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  lazyDeopt();
+  assertDoesNotThrow(() => lazyDeopt(true));
+  assertTrue(caught);
+  lazyDeopt();
+})();
+
+// Call to a.every is done inside a try-catch block and the callback function
+// being called throws into a deoptimized caller function.
+(function TestThrowIntoDeoptimizedOuter() {
+  const a = [1, 2, 3, 4];
+  function lazyDeopt(deopt) {
+    function callback(v, i) {
+      if (i === 1 && deopt) {
+        %DeoptimizeFunction(lazyDeopt);
+        throw "some exception";
+      }
+      return true;
+    }
+    %NeverOptimizeFunction(callback);
+    let result = 0;
+    try {
+      result = a.every(callback);
+    } catch (e) {
+      assertEquals("some exception", e);
+      result = "nope";
+    }
+    return result;
+  }
+  assertEquals(true, lazyDeopt(false));
+  assertEquals(true, lazyDeopt(false));
+  assertEquals("nope", lazyDeopt(true));
+  assertEquals("nope", lazyDeopt(true));
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  assertEquals(true, lazyDeopt(false));
+  assertEquals("nope", lazyDeopt(true));
+})();
+
+// An error generated inside the callback includes every in it's
+// stack trace.
+(() => {
+  const re = /Array\.every/;
+  function lazyDeopt(deopt) {
+    const b = [1, 2, 3];
+    let result = 0;
+    b.every((v, i) => {
+      result += v;
+      if (i === 1) {
+        const e = new Error();
+        assertTrue(re.exec(e.stack) !== null);
+      }
+      return true;
+    });
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  lazyDeopt();
+})();
+
+// An error generated inside a non-inlined callback function also
+// includes every in it's stack trace.
+(() => {
+  const re = /Array\.every/;
+  function lazyDeopt(deopt) {
+    const b = [1, 2, 3];
+    let did_assert_error = false;
+    let result = 0;
+    function callback(v, i) {
+      result += v;
+      if (i === 1) {
+        const e = new Error();
+        assertTrue(re.exec(e.stack) !== null);
+        did_assert_error = true;
+      }
+      return true;
+    }
+    %NeverOptimizeFunction(callback);
+    b.every(callback);
+    return did_assert_error;
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  assertTrue(lazyDeopt());
+})();
+
+// An error generated inside a recently deoptimized callback function
+// includes every in it's stack trace.
+(() => {
+  const re = /Array\.every/;
+  function lazyDeopt(deopt) {
+    const b = [1, 2, 3];
+    let did_assert_error = false;
+    let result = 0;
+    b.every((v, i) => {
+      result += v;
+      if (i === 1) {
+        %DeoptimizeNow();
+      } else if (i === 2) {
+        const e = new Error();
+        assertTrue(re.exec(e.stack) !== null);
+        did_assert_error = true;
+      }
+      return true;
+    });
+    return did_assert_error;
+  }
+  lazyDeopt();
+  lazyDeopt();
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  assertTrue(lazyDeopt());
+})();
+
+// Verify that various exception edges are handled appropriately.
+// The thrown Error object should always indicate it was created from
+// an every call stack.
+(() => {
+  const re = /Array\.every/;
+  const a = [1, 2, 3];
+  let result = 0;
+  function lazyDeopt() {
+    a.every((v, i) => {
+      result += i;
+      if (i === 1) {
+        %DeoptimizeFunction(lazyDeopt);
+        throw new Error();
+      }
+      return true;
+    });
+  }
+  assertThrows(() => lazyDeopt());
+  assertThrows(() => lazyDeopt());
+  try {
+    lazyDeopt();
+  } catch (e) {
+    assertTrue(re.exec(e.stack) !== null);
+  }
+  %OptimizeFunctionOnNextCall(lazyDeopt);
+  try {
+    lazyDeopt();
+  } catch (e) {
+    assertTrue(re.exec(e.stack) !== null);
+  }
+})();
+
+// Messing with the Array prototype causes deoptimization.
+(() => {
+  const a = [1, 2, 3];
+  let result = 0;
+  function prototypeChanged() {
+    a.every((v, i) => {
+      result += v;
+      return true;
+    });
+  }
+  prototypeChanged();
+  prototypeChanged();
+  %OptimizeFunctionOnNextCall(prototypeChanged);
+  prototypeChanged();
+  a.constructor = {};
+  prototypeChanged();
+  assertUnoptimized(prototypeChanged);
+  assertEquals(24, result);
+})();
+
+// Verify holes are skipped.
+(() => {
+  const a = [1, 2, , 3, 4];
+  function withHoles() {
+    const callback_values = [];
+    a.every(v => {
+      callback_values.push(v);
+      return true;
+    });
+    return callback_values;
+  }
+  withHoles();
+  withHoles();
+  %OptimizeFunctionOnNextCall(withHoles);
+  assertArrayEquals([1, 2, 3, 4], withHoles());
+})();
+
+(() => {
+  const a = [1.5, 2.5, , 3.5, 4.5];
+  function withHoles() {
+    const callback_values = [];
+    a.every(v => {
+      callback_values.push(v);
+      return true;
+    });
+    return callback_values;
+  }
+  withHoles();
+  withHoles();
+  %OptimizeFunctionOnNextCall(withHoles);
+  assertArrayEquals([1.5, 2.5, 3.5, 4.5], withHoles());
+})();
+
+// Handle callback is not callable.
+(() => {
+  const a = [1, 2, 3, 4, 5];
+  function notCallable() {
+    return a.every(undefined);
+  }
+
+  assertThrows(notCallable, TypeError);
+  try { notCallable(); } catch(e) { }
+  %OptimizeFunctionOnNextCall(notCallable);
+  assertThrows(notCallable, TypeError);
+})();