[stubs] Fix bug in ArrayPush builtin that only surfaces on MIPS debug

src/builtins/builtins-array.cc

Index: src/builtins/builtins-array.cc
diff --git a/src/builtins/builtins-array.cc b/src/builtins/builtins-array.cc
index 9df9d980c543a02094d5bc1bab46da05220492d1..ec94c4cf6e290150c98296e250ff618056b2297a 100644
--- a/src/builtins/builtins-array.cc
+++ b/src/builtins/builtins-array.cc
@@ -270,6 +270,15 @@ void Builtins::Generate_FastArrayPush(compiler::CodeAssemblerState* state) {
     assembler.CallRuntime(Runtime::kSetProperty, context, receiver, length, arg,
                           assembler.SmiConstant(STRICT));
     assembler.Increment(arg_index);
+    // The runtime SetProperty call could have converted the array to dictionary
+    // mode, which must be detected to abort the fast-path.
+    Node* map = assembler.LoadMap(receiver);
+    Node* bit_field2 = assembler.LoadMapBitField2(map);
+    Node* kind = assembler.DecodeWord32<Map::ElementsKindBits>(bit_field2);
+    assembler.GotoIf(assembler.Word32Equal(
+                         kind, assembler.Int32Constant(DICTIONARY_ELEMENTS)),
+                     &default_label);
+
     assembler.GotoIfNotNumber(arg, &object_push);
     assembler.Goto(&double_push);
   }
@@ -310,6 +319,14 @@ void Builtins::Generate_FastArrayPush(compiler::CodeAssemblerState* state) {
     assembler.CallRuntime(Runtime::kSetProperty, context, receiver, length, arg,
                           assembler.SmiConstant(STRICT));
     assembler.Increment(arg_index);
+    // The runtime SetProperty call could have converted the array to dictionary
+    // mode, which must be detected to abort the fast-path.
+    Node* map = assembler.LoadMap(receiver);
+    Node* bit_field2 = assembler.LoadMapBitField2(map);
+    Node* kind = assembler.DecodeWord32<Map::ElementsKindBits>(bit_field2);
+    assembler.GotoIf(assembler.Word32Equal(
+                         kind, assembler.Int32Constant(DICTIONARY_ELEMENTS)),
+                     &default_label);
     assembler.Goto(&object_push);
   }