[compiler] Fix flipped boolean checks in marked tier-up

Fixes incorrect checks for handle validity when checking the compiled
code, as well as incorrect uses of tst in arm and ppc flag checking
code. Also adds a test that the tier-up works correctly.

Review-Url: https://codereview.chromium.org/2478323002
Cr-Commit-Position: refs/heads/master@{#40915}

src/builtins/arm/builtins-arm.cc

@@ -1484,7 +1484,7 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   __ ldrb(r5, FieldMemOperand(entry,
                               SharedFunctionInfo::kMarkedForTierUpByteOffset));
   __ tst(r5, Operand(1 << SharedFunctionInfo::kMarkedForTierUpBitWithinByte));
-  __ b(eq, &gotta_call_runtime_no_stack);
+  __ b(ne, &gotta_call_runtime_no_stack);
   // Is the full code valid?
   __ ldr(entry, FieldMemOperand(entry, SharedFunctionInfo::kCodeOffset));
   __ ldr(r5, FieldMemOperand(entry, Code::kFlagsOffset));

src/builtins/ppc/builtins-ppc.cc

@@ -1506,7 +1506,7 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   __ lbz(r8, FieldMemOperand(entry,
                              SharedFunctionInfo::kMarkedForTierUpByteOffset));
   __ TestBit(r8, SharedFunctionInfo::kMarkedForTierUpBitWithinByte, r0);
-  __ beq(&gotta_call_runtime);
+  __ bne(&gotta_call_runtime);
   // Is the full code valid?
   __ LoadP(entry, FieldMemOperand(entry, SharedFunctionInfo::kCodeOffset));
   __ lwz(r8, FieldMemOperand(entry, Code::kFlagsOffset));

src/compiler.cc

@@ -879,7 +879,7 @@ MaybeHandle<Code> GetLazyCode(Handle<JSFunction> function) {
         }
 
         Handle<Code> code;
-        if (!GetBaselineCode(function).ToHandle(&code)) {
+        if (GetBaselineCode(function).ToHandle(&code)) {
           return code;
         }
         break;
@@ -893,7 +893,7 @@ MaybeHandle<Code> GetLazyCode(Handle<JSFunction> function) {
 
         Handle<Code> code;
         // TODO(leszeks): Look into performing this compilation concurrently.
-        if (!GetOptimizedCode(function, Compiler::NOT_CONCURRENT)
+        if (GetOptimizedCode(function, Compiler::NOT_CONCURRENT)
                 .ToHandle(&code)) {
           return code;
         }

src/runtime/runtime-test.cc

@@ -268,6 +268,9 @@ RUNTIME_FUNCTION(Runtime_GetOptimizationStatus) {
   if (function->IsOptimized() && function->code()->is_turbofanned()) {
     return Smi::FromInt(7);  // 7 == "TurboFan compiler".
   }
+  if (function->IsInterpreted()) {
+    return Smi::FromInt(8);  // 8 == "Interpreted".
+  }
   return function->IsOptimized() ? Smi::FromInt(1)   // 1 == "yes".
                                  : Smi::FromInt(2);  // 2 == "no".
 }

test/mjsunit/shared-function-tier-up-default.js

@@ -0,0 +1,32 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --mark-shared-functions-for-tier-up --allow-natives-syntax --no-ignition --no-ignition-staging --no-turbo
+
+(function() {
+  var sum = 0;
+  var i = 0;
+  for (var i = 0; i < 3; ++i) {
+    var f = function(x) {
+      return 2 * x;
+    }
+    sum += f(i);
+
+    if (%GetOptimizationStatus(f) == 3 || %GetOptimizationStatus(f) == 4) {
+      // If we are always or never optimizing f, just exit, this test is useless.
+      return;
+    }
+
+    if (i == 1) {
+      // f must be baseline code.
+      assertEquals(2, %GetOptimizationStatus(f));
+
+      // Run twice (i = 0, 1), then tier-up.
+      %OptimizeFunctionOnNextCall(f);
+    } else if (i == 2) {
+      // Tier-up at i = 2 should go up to crankshaft.
+      assertEquals(1, %GetOptimizationStatus(f));
+    }
+  }
+})()

test/mjsunit/shared-function-tier-up-ignition.js

@@ -0,0 +1,41 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --mark-shared-functions-for-tier-up --allow-natives-syntax --ignition-staging --no-turbo
+
+(function() {
+  var sum = 0;
+  var i = 0;
+  for (var i = 0; i < 5; ++i) {
+    var f = function(x) {
+      return 2 * x;
+    }
+    sum += f(i);
+
+    if (%GetOptimizationStatus(f) == 3 || %GetOptimizationStatus(f) == 4) {
+      // If we are always or never optimizing f, just exit, this test is useless.
+      return;
+    }
+
+    if (i == 1) {
+      // f must be interpreted code.
+      assertEquals(8, %GetOptimizationStatus(f));
+
+      // Allow it to run twice (i = 0, 1), then tier-up to baseline.
+      %BaselineFunctionOnNextCall(f);
+    } else if (i == 2) {
+      // Tier-up at i = 2 should only go up to baseline.
+      assertEquals(2, %GetOptimizationStatus(f));
+    } else if (i == 3) {
+      // Now f must be baseline code.
+      assertEquals(2, %GetOptimizationStatus(f));
+
+      // Run two more times (i = 2, 3), then tier-up to optimized.
+      %OptimizeFunctionOnNextCall(f);
+    } else if (i == 4) {
+      // Tier-up at i = 4 should now go up to crankshaft.
+      assertEquals(1, %GetOptimizationStatus(f));
+    }
+  }
+})()

test/mjsunit/shared-function-tier-up-turbo.js

@@ -0,0 +1,32 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --mark-shared-functions-for-tier-up --allow-natives-syntax --ignition-staging --turbo
+
+(function() {
+  var sum = 0;
+  var i = 0;
+  for (var i = 0; i < 3; ++i) {
+    var f = function(x) {
+      return 2 * x;
+    }
+    sum += f(i);
+
+    if (%GetOptimizationStatus(f) == 3 || %GetOptimizationStatus(f) == 4) {
+      // If we are always or never optimizing f, just exit, this test is useless.
+      return;
+    }
+
+    if (i == 1) {
+      // f must be interpreted code.
+      assertEquals(8, %GetOptimizationStatus(f));
+
+      // Run twice (i = 0, 1), then tier-up.
+      %OptimizeFunctionOnNextCall(f);
+    } else if (i == 2) {
+      // Tier-up at i = 2 should go up to turbofan.
+      assertEquals(7, %GetOptimizationStatus(f));
+    }
+  }
+})()