[turbofan] Add missing test coverage for JSTypedLowering optimizations.

Properly test the abstract equality - both JSEqual and JSNotEqual - for
the case of symbols. Also add tests for the corner cases of the
JSObjectIsArray operator, which is used to implement Array.isArray()
builtin.

Bug: v8:8015
Change-Id: Ib008e85553d04527a5992a904ec77774761f872e
Reviewed-on: https://chromium-review.googlesource.com/1238237
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56121}

test/mjsunit/compiler/abstract-equal-symbol.js

@@ -0,0 +1,135 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --noalways-opt
+
+// Known symbols abstract equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo() { return a == b; }
+
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Known symbols abstract in-equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo() { return a != b; }
+
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Known symbol on one side abstract equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo(a) { return a == b; }
+
+  // Warmup
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertOptimized(foo);
+
+  // Make optimized code bail out
+  assertFalse(foo("a"));
+  assertUnoptimized(foo);
+
+  // Make sure TurboFan learns the new feedback
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo("a"));
+  assertOptimized(foo);
+})();
+
+// Known symbol on one side abstract in-equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo(a) { return a != b; }
+
+  // Warmup
+  assertFalse(foo(b));
+  assertTrue(foo(a));
+  assertFalse(foo(b));
+  assertTrue(foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(b));
+  assertTrue(foo(a));
+
+  // Make optimized code bail out
+  assertTrue(foo("a"));
+  assertUnoptimized(foo);
+
+  // Make sure TurboFan learns the new feedback
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo("a"));
+  assertOptimized(foo);
+})();
+
+// Feedback based symbol abstract equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo(a, b) { return a == b; }
+
+  // Warmup
+  assertTrue(foo(b, b));
+  assertFalse(foo(a, b));
+  assertTrue(foo(a, a));
+  assertFalse(foo(b, a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(a, a));
+  assertFalse(foo(b, a));
+
+  // Make optimized code bail out
+  assertFalse(foo("a", b));
+  assertUnoptimized(foo);
+
+  // Make sure TurboFan learns the new feedback
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo("a", b));
+  assertOptimized(foo);
+})();
+
+// Feedback based symbol abstract in-equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo(a, b) { return a != b; }
+
+  assertFalse(foo(b, b));
+  assertTrue(foo(a, b));
+  assertFalse(foo(a, a));
+  assertTrue(foo(b, a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(a, a));
+  assertTrue(foo(b, a));
+
+  // Make optimized code bail out
+  assertTrue(foo("a", b));
+  assertUnoptimized(foo);
+
+  // Make sure TurboFan learns the new feedback
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo("a", b));
+  assertOptimized(foo);
+})();

test/mjsunit/compiler/array-is-array.js

@@ -0,0 +1,105 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be an Array literal.
+(function() {
+  function foo() {
+    return Array.isArray([]);
+  }
+
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be a Proxy for an Array literal.
+(function() {
+  function foo() {
+    return Array.isArray(new Proxy([], {}));
+  }
+
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be an Object literal.
+(function() {
+  function foo() {
+    return Array.isArray({});
+  }
+
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be a Proxy for an Object literal.
+(function() {
+  function foo() {
+    return Array.isArray(new Proxy({}, {}));
+  }
+
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that
+// TurboFan doesn't know anything about the input value.
+(function() {
+  function foo(x) {
+    return Array.isArray(x);
+  }
+
+  assertFalse(foo({}));
+  assertFalse(foo(new Proxy({}, {})));
+  assertTrue(foo([]));
+  assertTrue(foo(new Proxy([], {})));
+  assertThrows(() => {
+    const {proxy, revoke} = Proxy.revocable([], {});
+    revoke();
+    foo(proxy);
+  }, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo({}));
+  assertFalse(foo(new Proxy({}, {})));
+  assertTrue(foo([]));
+  assertTrue(foo(new Proxy([], {})));
+  assertThrows(() => {
+    const {proxy, revoke} = Proxy.revocable([], {});
+    revoke();
+    foo(proxy);
+  }, TypeError);
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that
+// we pass a revoked proxy and catch the exception locally.
+(function() {
+  function foo(x) {
+    const {proxy, revoke} = Proxy.revocable(x, {});
+    revoke();
+    try {
+      return Array.isArray(proxy);
+    } catch (e) {
+      return e;
+    }
+  }
+
+  assertInstanceof(foo([]), TypeError);
+  assertInstanceof(foo({}), TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertInstanceof(foo([]), TypeError);
+  assertInstanceof(foo({}), TypeError);
+})();