Version 4.4.63.3 (cherry-pick)

src/runtime/runtime-array.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/arguments.h"
 #include "src/messages.h"
 #include "src/runtime/runtime-utils.h"
 
@@ skipping 1216 matching lines @@
 
   if (key < 0) {
     return object->elements();
   }
 
   uint32_t capacity = static_cast<uint32_t>(object->elements()->length());
   uint32_t index = static_cast<uint32_t>(key);
 
   if (index >= capacity) {
     if (object->WouldConvertToSlowElements(index)) {
-      JSObject::NormalizeElements(object);
+      // We don't want to allow operations that cause lazy deopt. Return a Smi
+      // as a signal that optimized code should eagerly deoptimize.
       return Smi::FromInt(0);
     }
 
     uint32_t new_capacity = JSObject::NewElementsCapacity(index + 1);
     ElementsKind kind = object->GetElementsKind();
     if (IsFastDoubleElementsKind(kind)) {
       JSObject::SetFastDoubleElementsCapacity(object, new_capacity);
     } else {
       JSObject::SetFastElementsCapacitySmiMode set_capacity_mode =
           object->HasFastSmiElements() ? JSObject::kAllowSmiElements
@@ skipping 144 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_FastOneByteArrayJoin) {
   SealHandleScope shs(isolate);
   DCHECK(args.length() == 2);
   // Returning undefined means that this fast path fails and one has to resort
   // to a slow path.
   return isolate->heap()->undefined_value();
 }
 }
 }  // namespace v8::internal