[stubs] Fix bug in ArrayPush builtin that only surfaces on MIPS debug

src/builtins/builtins-array.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins.h"
 #include "src/builtins/builtins-utils.h"
 
 #include "src/code-factory.h"
 #include "src/code-stub-assembler.h"
 #include "src/contexts.h"
@@ skipping 252 matching lines @@
   assembler.Bind(&smi_transition);
   {
     Node* arg = args.AtIndex(arg_index.value());
     assembler.GotoIf(assembler.TaggedIsSmi(arg), &default_label);
     Node* length = assembler.LoadJSArrayLength(receiver);
     // TODO(danno): Use the KeyedStoreGeneric stub here when possible,
     // calling into the runtime to do the elements transition is overkill.
     assembler.CallRuntime(Runtime::kSetProperty, context, receiver, length, arg,
                           assembler.SmiConstant(STRICT));
     assembler.Increment(arg_index);
+    // The runtime SetProperty call could have converted the array to dictionary
+    // mode, which must be detected to abort the fast-path.
+    Node* map = assembler.LoadMap(receiver);
+    Node* bit_field2 = assembler.LoadMapBitField2(map);
+    Node* kind = assembler.DecodeWord32<Map::ElementsKindBits>(bit_field2);
+    assembler.GotoIf(assembler.Word32Equal(
+                         kind, assembler.Int32Constant(DICTIONARY_ELEMENTS)),
+                     &default_label);
+
     assembler.GotoIfNotNumber(arg, &object_push);
     assembler.Goto(&double_push);
   }
 
   assembler.Bind(&object_push_pre);
   {
     assembler.Branch(assembler.Int32GreaterThan(
                          kind, assembler.Int32Constant(FAST_HOLEY_ELEMENTS)),
                      &double_push, &object_push);
   }
@@ skipping 20 matching lines @@
   assembler.Bind(&double_transition);
   {
     Node* arg = args.AtIndex(arg_index.value());
     assembler.GotoIfNumber(arg, &default_label);
     Node* length = assembler.LoadJSArrayLength(receiver);
     // TODO(danno): Use the KeyedStoreGeneric stub here when possible,
     // calling into the runtime to do the elements transition is overkill.
     assembler.CallRuntime(Runtime::kSetProperty, context, receiver, length, arg,
                           assembler.SmiConstant(STRICT));
     assembler.Increment(arg_index);
+    // The runtime SetProperty call could have converted the array to dictionary
+    // mode, which must be detected to abort the fast-path.
+    Node* map = assembler.LoadMap(receiver);
+    Node* bit_field2 = assembler.LoadMapBitField2(map);
+    Node* kind = assembler.DecodeWord32<Map::ElementsKindBits>(bit_field2);
+    assembler.GotoIf(assembler.Word32Equal(
+                         kind, assembler.Int32Constant(DICTIONARY_ELEMENTS)),
+                     &default_label);
     assembler.Goto(&object_push);
   }
 
   // Fallback that stores un-processed arguments using the full, heavyweight
   // SetProperty machinery.
   assembler.Bind(&default_label);
   {
     args.ForEach(
         [&assembler, receiver, context](Node* arg) {
           Node* length = assembler.LoadJSArrayLength(receiver);
@@ skipping 2432 matching lines @@
     Node* message = assembler.SmiConstant(MessageTemplate::kDetachedOperation);
     Node* result =
         assembler.CallRuntime(Runtime::kThrowTypeError, context, message,
                               assembler.HeapConstant(operation));
     assembler.Return(result);
   }
 }
 
 }  // namespace internal
 }  // namespace v8