libv8 3.11.8.17 → 3.16.14.0

data/vendor/v8/test/mjsunit/accessor-map-sharing.js

@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --fast-accessor-properties
+// Flags: --allow-natives-syntax
 
 // Handy abbreviations.
 var dp = Object.defineProperty;
@@ -35,7 +35,7 @@ function getter() { return 111; }
 function setter(x) { print(222); }
 function anotherGetter() { return 333; }
 function anotherSetter(x) { print(444); }
-var obj1, obj2;
+var obj1, obj2, obj3, obj4;
 
 // Two objects with the same getter.
 obj1 = {};
@@ -174,3 +174,19 @@ assertEquals(getter, gop(obj1, "papa").get);
 assertEquals(setter, gop(obj1, "papa").set);
 assertTrue(gop(obj1, "papa").configurable);
 assertFalse(gop(obj1, "papa").enumerable);
+
+// Two objects with the same getter on the prototype chain.
+obj1 = {};
+dp(obj1, "quebec", { get: getter });
+obj2 = Object.create(obj1);
+obj3 = Object.create(obj2);
+obj4 = Object.create(obj2);
+assertTrue(%HaveSameMap(obj3, obj4));
+
+// Two objects with the same setter on the prototype chain.
+obj1 = {};
+dp(obj1, "romeo", { set: setter });
+obj2 = Object.create(obj1);
+obj3 = Object.create(obj2);
+obj4 = Object.create(obj2);
+assertTrue(%HaveSameMap(obj3, obj4));

data/vendor/v8/test/mjsunit/allocation-site-info.js

@@ -0,0 +1,126 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --smi-only-arrays --expose-gc
+// Flags: --track-allocation-sites
+
+// Test element kind of objects.
+// Since --smi-only-arrays affects builtins, its default setting at compile
+// time sticks if built with snapshot.  If --smi-only-arrays is deactivated
+// by default, only a no-snapshot build actually has smi-only arrays enabled
+// in this test case.  Depending on whether smi-only arrays are actually
+// enabled, this test takes the appropriate code path to check smi-only arrays.
+
+support_smi_only_arrays = %HasFastSmiElements(new Array(1,2,3,4,5,6,7,8));
+
+if (support_smi_only_arrays) {
+  print("Tests include smi-only arrays.");
+} else {
+  print("Tests do NOT include smi-only arrays.");
+}
+
+var elements_kind = {
+  fast_smi_only            :  'fast smi only elements',
+  fast                     :  'fast elements',
+  fast_double              :  'fast double elements',
+  dictionary               :  'dictionary elements',
+  external_byte            :  'external byte elements',
+  external_unsigned_byte   :  'external unsigned byte elements',
+  external_short           :  'external short elements',
+  external_unsigned_short  :  'external unsigned short elements',
+  external_int             :  'external int elements',
+  external_unsigned_int    :  'external unsigned int elements',
+  external_float           :  'external float elements',
+  external_double          :  'external double elements',
+  external_pixel           :  'external pixel elements'
+}
+
+function getKind(obj) {
+  if (%HasFastSmiElements(obj)) return elements_kind.fast_smi_only;
+  if (%HasFastObjectElements(obj)) return elements_kind.fast;
+  if (%HasFastDoubleElements(obj)) return elements_kind.fast_double;
+  if (%HasDictionaryElements(obj)) return elements_kind.dictionary;
+}
+
+function assertKind(expected, obj, name_opt) {
+  if (!support_smi_only_arrays &&
+      expected == elements_kind.fast_smi_only) {
+    expected = elements_kind.fast;
+  }
+  assertEquals(expected, getKind(obj), name_opt);
+}
+
+if (support_smi_only_arrays) {
+  function fastliteralcase(literal, value) {
+    // var literal = [1, 2, 3];
+    literal[0] = value;
+    return literal;
+  }
+
+  function get_standard_literal() {
+    var literal = [1, 2, 3];
+    return literal;
+  }
+
+  // Case: [1,2,3] as allocation site
+  obj = fastliteralcase(get_standard_literal(), 1);
+  assertKind(elements_kind.fast_smi_only, obj);
+  obj = fastliteralcase(get_standard_literal(), 1.5);
+  assertKind(elements_kind.fast_double, obj);
+  obj = fastliteralcase(get_standard_literal(), 2);
+  assertKind(elements_kind.fast_double, obj);
+
+  obj = fastliteralcase([5, 3, 2], 1.5);
+  assertKind(elements_kind.fast_double, obj);
+  obj = fastliteralcase([3, 6, 2], 1.5);
+  assertKind(elements_kind.fast_double, obj);
+  obj = fastliteralcase([2, 6, 3], 2);
+  assertKind(elements_kind.fast_smi_only, obj);
+
+  // Verify that we will not pretransition the double->fast path.
+  obj = fastliteralcase(get_standard_literal(), "elliot");
+  assertKind(elements_kind.fast, obj);
+
+  // This fails until we turn off optimistic transitions to the
+  // most general elements kind seen on keyed stores. It's a goal
+  // to turn it off, but for now we need it.
+  // obj = fastliteralcase(3);
+  // assertKind(elements_kind.fast_double, obj);
+
+  function fastliteralcase_smifast(value) {
+    var literal = [1, 2, 3, 4];
+    literal[0] = value;
+    return literal;
+  }
+
+  obj = fastliteralcase_smifast(1);
+  assertKind(elements_kind.fast_smi_only, obj);
+  obj = fastliteralcase_smifast("carter");
+  assertKind(elements_kind.fast, obj);
+  obj = fastliteralcase_smifast(2);
+  assertKind(elements_kind.fast, obj);
+}

data/vendor/v8/test/mjsunit/array-bounds-check-removal.js

@@ -29,6 +29,29 @@
 
 var a = new Int32Array(1024);
 
+// Test that we do not assert if the accessed index has not an int32 rep.
+var v = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9];
+function test_do_not_assert_on_non_int32(vector, base) {
+  var r = 0;
+  var a1 = base + 1;
+  var a2 = base + 2;
+  var a3 = base + 3;
+  var a4 = base + 4;
+  if (a1 == 2) {
+    r += vector[a1];
+    r += vector[a4];
+    r += vector[a2];
+    r += vector[a3];
+  }
+  return r;
+}
+test_do_not_assert_on_non_int32(v,1);
+test_do_not_assert_on_non_int32(v,1);
+test_do_not_assert_on_non_int32(v,"a");
+test_do_not_assert_on_non_int32(v,"a");
+%OptimizeFunctionOnNextCall(test_do_not_assert_on_non_int32);
+test_do_not_assert_on_non_int32(v,0);
+
 function test_base(base,cond) {
   a[base + 1] = 1;
   a[base + 4] = 2;
@@ -123,7 +146,7 @@ check_test_minus(7,false);
 // ALWAYS: 3
 // NEVER: 4
 
-if (false) {
+// Test that we still deopt on failed bound checks
 test_base(5,true);
 test_base(6,true);
 test_base(5,false);
@@ -139,7 +162,45 @@ test_base(6,false);
 %OptimizeFunctionOnNextCall(test_base);
 test_base(2048,true);
 assertTrue(%GetOptimizationStatus(test_base) != 1);
+
+// Specific test on negative offsets
+var short_a = new Array(100);
+for (var i = 0; i < short_a.length; i++) short_a[i] = 0;
+function short_test(a, i) {
+  a[i + 9] = 0;
+  a[i - 10] = 0;
+}
+short_test(short_a, 50);
+short_test(short_a, 50);
+%OptimizeFunctionOnNextCall(short_test);
+short_a.length = 10;
+short_test(a, 0);
+assertTrue(%GetOptimizationStatus(short_test) != 1);
+
+
+// A test for when we would modify a phi index.
+var data_phi = [0, 1, 2, 3, 4, 5, 6, 7, 8];
+function test_phi(a, base, check) {
+  var index;
+  if (check) {
+    index = base + 1;
+  } else {
+    index = base + 2;
+  }
+  var result = a[index];
+  result += a[index + 1];
+  result += a[index - 1];
+  return result;
 }
+var result_phi = 0;
+result_phi = test_phi(data_phi, 3,  true);
+assertEquals(12, result_phi);
+result_phi = test_phi(data_phi, 3,  true);
+assertEquals(12, result_phi);
+%OptimizeFunctionOnNextCall(test_phi);
+result_phi = test_phi(data_phi, 3,  true);
+assertEquals(12, result_phi);
+
 
 gc();
 

data/vendor/v8/test/mjsunit/array-iteration.js

@@ -40,7 +40,7 @@
   // Simple use.
   var a = [0,1];
   assertArrayEquals([0], a.filter(function(n) { return n == 0; }));
-  assertArrayEquals(a, a);
+  assertArrayEquals([0,1], a);
 
   // Use specified object as this object when calling the function.
   var o = { value: 42 }

data/vendor/v8/test/mjsunit/array-literal-transitions.js

@@ -26,6 +26,8 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --smi-only-arrays --expose-gc
+// Flags: --noparallel-recompilation
+
 // Test element kind of objects.
 // Since --smi-only-arrays affects builtins, its default setting at compile
 // time sticks if built with snapshot.  If --smi-only-arrays is deactivated

data/vendor/v8/test/mjsunit/array-natives-elements.js

@@ -0,0 +1,317 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --smi-only-arrays
+// Flags: --noparallel-recompilation
+
+// Test element kind of objects.
+// Since --smi-only-arrays affects builtins, its default setting at compile time
+// sticks if built with snapshot. If --smi-only-arrays is deactivated by
+// default, only a no-snapshot build actually has smi-only arrays enabled in
+// this test case. Depending on whether smi-only arrays are actually enabled,
+// this test takes the appropriate code path to check smi-only arrays.
+
+support_smi_only_arrays = %HasFastSmiElements([1,2,3,4,5,6,7,8,9,10]);
+
+if (support_smi_only_arrays) {
+  print("Tests include smi-only arrays.");
+} else {
+  print("Tests do NOT include smi-only arrays.");
+}
+
+// IC and Crankshaft support for smi-only elements in dynamic array literals.
+function get(foo) { return foo; }  // Used to generate dynamic values.
+
+function array_natives_test() {
+
+  // Ensure small array literals start in specific element kind mode.
+  assertTrue(%HasFastSmiElements([]));
+  assertTrue(%HasFastSmiElements([1]));
+  assertTrue(%HasFastSmiElements([1,2]));
+  assertTrue(%HasFastDoubleElements([1.1]));
+  assertTrue(%HasFastDoubleElements([1.1,2]));
+
+  // Push
+  var a0 = [1, 2, 3];
+  if (%HasFastSmiElements(a0)) {
+    assertTrue(%HasFastSmiElements(a0));
+    a0.push(4);
+    assertTrue(%HasFastSmiElements(a0));
+    a0.push(1.3);
+    assertTrue(%HasFastDoubleElements(a0));
+    a0.push(1.5);
+    assertTrue(%HasFastDoubleElements(a0));
+    a0.push({});
+    assertTrue(%HasFastObjectElements(a0));
+    a0.push({});
+    assertTrue(%HasFastObjectElements(a0));
+  } else {
+    assertTrue(%HasFastObjectElements(a0));
+    a0.push(4);
+    a0.push(1.3);
+    a0.push(1.5);
+    a0.push({});
+    a0.push({});
+    assertTrue(%HasFastObjectElements(a0));
+  }
+  assertEquals([1,2,3,4,1.3,1.5,{},{}], a0);
+
+  // Concat
+  var a1;
+  a1 = [1,2,3].concat([]);
+  assertTrue(%HasFastSmiElements(a1));
+  assertEquals([1,2,3], a1);
+  a1 = [1,2,3].concat([4,5,6]);
+  assertTrue(%HasFastSmiElements(a1));
+  assertEquals([1,2,3,4,5,6], a1);
+  a1 = [1,2,3].concat([4,5,6], [7,8,9]);
+  assertTrue(%HasFastSmiElements(a1));
+  assertEquals([1,2,3,4,5,6,7,8,9], a1);
+  a1 = [1.1,2,3].concat([]);
+  assertTrue(%HasFastDoubleElements(a1));
+  assertEquals([1.1,2,3], a1);
+  a1 = [1,2,3].concat([1.1, 2]);
+  assertTrue(%HasFastDoubleElements(a1));
+  assertEquals([1,2,3,1.1,2], a1);
+  a1 = [1.1,2,3].concat([1, 2]);
+  assertTrue(%HasFastDoubleElements(a1));
+  assertEquals([1.1,2,3,1,2], a1);
+  a1 = [1.1,2,3].concat([1.2, 2]);
+  assertTrue(%HasFastDoubleElements(a1));
+  assertEquals([1.1,2,3,1.2,2], a1);
+
+  a1 = [1,2,3].concat([{}]);
+  assertTrue(%HasFastObjectElements(a1));
+  assertEquals([1,2,3,{}], a1);
+  a1 = [1.1,2,3].concat([{}]);
+  assertTrue(%HasFastObjectElements(a1));
+  assertEquals([1.1,2,3,{}], a1);
+  a1 = [{}].concat([1,2,3]);
+  assertTrue(%HasFastObjectElements(a1));
+  assertEquals([{},1,2,3], a1);
+  a1 = [{}].concat([1.1,2,3]);
+  assertTrue(%HasFastObjectElements(a1));
+  assertEquals([{},1.1,2,3], a1);
+
+  // Slice
+  var a2 = [1,2,3];
+  assertTrue(%HasFastSmiElements(a2.slice()));
+  assertTrue(%HasFastSmiElements(a2.slice(1)));
+  assertTrue(%HasFastSmiElements(a2.slice(1, 2)));
+  assertEquals([1,2,3], a2.slice());
+  assertEquals([2,3], a2.slice(1));
+  assertEquals([2], a2.slice(1,2));
+  a2 = [1.1,2,3];
+  assertTrue(%HasFastDoubleElements(a2.slice()));
+  assertTrue(%HasFastDoubleElements(a2.slice(1)));
+  assertTrue(%HasFastDoubleElements(a2.slice(1, 2)));
+  assertEquals([1.1,2,3], a2.slice());
+  assertEquals([2,3], a2.slice(1));
+  assertEquals([2], a2.slice(1,2));
+  a2 = [{},2,3];
+  assertTrue(%HasFastObjectElements(a2.slice()));
+  assertTrue(%HasFastObjectElements(a2.slice(1)));
+  assertTrue(%HasFastObjectElements(a2.slice(1, 2)));
+  assertEquals([{},2,3], a2.slice());
+  assertEquals([2,3], a2.slice(1));
+  assertEquals([2], a2.slice(1,2));
+
+  // Splice
+  var a3 = [1,2,3];
+  var a3r;
+  a3r = a3.splice(0, 0);
+  assertTrue(%HasFastSmiElements(a3r));
+  assertTrue(%HasFastSmiElements(a3));
+  assertEquals([], a3r);
+  assertEquals([1, 2, 3], a3);
+  a3 = [1,2,3];
+  a3r = a3.splice(0, 1);
+  assertTrue(%HasFastSmiElements(a3r));
+  assertTrue(%HasFastSmiElements(a3));
+  assertEquals([1], a3r);
+  assertEquals([2, 3], a3);
+  a3 = [1,2,3];
+  a3r = a3.splice(0, 0, 2);
+  assertTrue(%HasFastSmiElements(a3r));
+  assertTrue(%HasFastSmiElements(a3));
+  assertEquals([], a3r);
+  assertEquals([2, 1, 2, 3], a3);
+  a3 = [1,2,3];
+  a3r = a3.splice(0, 1, 2);
+  assertTrue(%HasFastSmiElements(a3r));
+  assertTrue(%HasFastSmiElements(a3));
+  assertEquals([1], a3r);
+  assertEquals([2, 2, 3], a3);
+
+  a3 = [1.1,2,3];
+  a3r = a3.splice(0, 0);
+  assertTrue(%HasFastDoubleElements(a3r));
+  assertTrue(%HasFastDoubleElements(a3));
+  assertEquals([], a3r);
+  assertEquals([1.1, 2, 3], a3);
+  a3 = [1.1,2,3];
+  a3r = a3.splice(0, 1);
+  assertTrue(%HasFastDoubleElements(a3r));
+  assertTrue(%HasFastDoubleElements(a3));
+  assertEquals([1.1], a3r);
+  assertEquals([2, 3], a3);
+  a3 = [1.1,2,3];
+  a3r = a3.splice(0, 0, 2);
+  // Commented out since handled in js, which takes the best fit.
+  // assertTrue(%HasFastDoubleElements(a3r));
+  assertTrue(%HasFastSmiElements(a3r));
+  assertTrue(%HasFastDoubleElements(a3));
+  assertEquals([], a3r);
+  assertEquals([2, 1.1, 2, 3], a3);
+  a3 = [1.1,2,3];
+  a3r = a3.splice(0, 1, 2);
+  assertTrue(%HasFastDoubleElements(a3r));
+  assertTrue(%HasFastDoubleElements(a3));
+  assertEquals([1.1], a3r);
+  assertEquals([2, 2, 3], a3);
+  a3 = [1.1,2,3];
+  a3r = a3.splice(0, 0, 2.1);
+  // Commented out since handled in js, which takes the best fit.
+  // assertTrue(%HasFastDoubleElements(a3r));
+  assertTrue(%HasFastSmiElements(a3r));
+  assertTrue(%HasFastDoubleElements(a3));
+  assertEquals([], a3r);
+  assertEquals([2.1, 1.1, 2, 3], a3);
+  a3 = [1.1,2,3];
+  a3r = a3.splice(0, 1, 2.2);
+  assertTrue(%HasFastDoubleElements(a3r));
+  assertTrue(%HasFastDoubleElements(a3));
+  assertEquals([1.1], a3r);
+  assertEquals([2.2, 2, 3], a3);
+  a3 = [1,2,3];
+  a3r = a3.splice(0, 0, 2.1);
+  // Commented out since handled in js, which takes the best fit.
+  // assertTrue(%HasFastDoubleElements(a3r));
+  assertTrue(%HasFastSmiElements(a3r));
+  assertTrue(%HasFastDoubleElements(a3));
+  assertEquals([], a3r);
+  assertEquals([2.1, 1, 2, 3], a3);
+  a3 = [1,2,3];
+  a3r = a3.splice(0, 1, 2.2);
+  assertTrue(%HasFastDoubleElements(a3r));
+  assertTrue(%HasFastDoubleElements(a3));
+  assertEquals([1], a3r);
+  assertEquals([2.2, 2, 3], a3);
+
+  a3 = [{},2,3];
+  a3r = a3.splice(0, 0);
+  assertTrue(%HasFastObjectElements(a3r));
+  assertTrue(%HasFastObjectElements(a3));
+  assertEquals([], a3r);
+  assertEquals([{}, 2, 3], a3);
+  a3 = [1,2,{}];
+  a3r = a3.splice(0, 1);
+  assertTrue(%HasFastObjectElements(a3r));
+  assertTrue(%HasFastObjectElements(a3));
+  assertEquals([1], a3r);
+  assertEquals([2, {}], a3);
+  a3 = [1,2,3];
+  a3r = a3.splice(0, 0, {});
+  assertTrue(%HasFastObjectElements(a3r));
+  assertTrue(%HasFastObjectElements(a3));
+  assertEquals([], a3r);
+  assertEquals([{}, 1, 2, 3], a3);
+  a3 = [1,2,3];
+  a3r = a3.splice(0, 1, {});
+  assertTrue(%HasFastObjectElements(a3r));
+  assertTrue(%HasFastObjectElements(a3));
+  assertEquals([1], a3r);
+  assertEquals([{}, 2, 3], a3);
+
+  a3 = [1.1,2,3];
+  a3r = a3.splice(0, 0, {});
+  assertTrue(%HasFastObjectElements(a3r));
+  assertTrue(%HasFastObjectElements(a3));
+  assertEquals([], a3r);
+  assertEquals([{}, 1.1, 2, 3], a3);
+  a3 = [1.1,2,3];
+  a3r = a3.splice(0, 1, {});
+  assertTrue(%HasFastObjectElements(a3r));
+  assertTrue(%HasFastObjectElements(a3));
+  assertEquals([1.1], a3r);
+  assertEquals([{}, 2, 3], a3);
+
+  // Pop
+  var a4 = [1,2,3];
+  assertEquals(3, a4.pop());
+  assertTrue(%HasFastSmiElements(a4));
+  a4 = [1.1,2,3];
+  assertEquals(3, a4.pop());
+  assertTrue(%HasFastDoubleElements(a4));
+  a4 = [{},2,3];
+  assertEquals(3, a4.pop());
+  assertTrue(%HasFastObjectElements(a4));
+
+  // Shift
+  var a4 = [1,2,3];
+  assertEquals(1, a4.shift());
+  assertTrue(%HasFastSmiElements(a4));
+  a4 = [1.1,2,3];
+  assertEquals(1.1, a4.shift());
+  assertTrue(%HasFastDoubleElements(a4));
+  a4 = [{},2,3];
+  assertEquals({}, a4.shift());
+  assertTrue(%HasFastObjectElements(a4));
+
+  // Unshift
+  var a4 = [1,2,3];
+  a4.unshift(1);
+  assertTrue(%HasFastSmiElements(a4));
+  assertEquals([1,1,2,3], a4);
+  a4 = [1,2,3];
+  a4.unshift(1.1);
+  // TODO(verwaest): We'll want to support double unshifting as well.
+  // assertTrue(%HasFastDoubleElements(a4));
+  assertTrue(%HasFastObjectElements(a4));
+  assertEquals([1.1,1,2,3], a4);
+  a4 = [1.1,2,3];
+  a4.unshift(1);
+  // assertTrue(%HasFastDoubleElements(a4));
+  assertTrue(%HasFastObjectElements(a4));
+  assertEquals([1,1.1,2,3], a4);
+  a4 = [{},2,3];
+  a4.unshift(1);
+  assertTrue(%HasFastObjectElements(a4));
+  assertEquals([1,{},2,3], a4);
+  a4 = [{},2,3];
+  a4.unshift(1.1);
+  assertTrue(%HasFastObjectElements(a4));
+  assertEquals([1.1,{},2,3], a4);
+}
+
+if (support_smi_only_arrays) {
+  for (var i = 0; i < 3; i++) {
+    array_natives_test();
+  }
+  %OptimizeFunctionOnNextCall(array_natives_test);
+  array_natives_test();
+}