[turbofan] Use unreliable LOAD_IC feedback for Array.prototype.push.

src/compiler/js-native-context-specialization.cc

Index: src/compiler/js-native-context-specialization.cc
diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc
index 4103646c22615ad0e713c789c6f2f5525d9b8341..337451d28d2dce3fca1733122fdae9b5195240f5 100644
--- a/src/compiler/js-native-context-specialization.cc
+++ b/src/compiler/js-native-context-specialization.cc
@@ -2267,7 +2267,19 @@ bool JSNativeContextSpecialization::ExtractReceiverMaps(
 bool JSNativeContextSpecialization::InferReceiverMaps(
     Node* receiver, Node* effect, MapHandleList* receiver_maps) {
   ZoneHandleSet<Map> maps;
-  if (NodeProperties::InferReceiverMaps(receiver, effect, &maps)) {
+  NodeProperties::InferReceiverMapsResult result =
+      NodeProperties::InferReceiverMaps(receiver, effect, &maps);
+  if (result == NodeProperties::kReliableReceiverMaps) {
+    for (size_t i = 0; i < maps.size(); ++i) {
+      receiver_maps->Add(maps[i]);
+    }
+    return true;
+  } else if (result == NodeProperties::kUnreliableReceiverMaps) {
+    // For untrusted receiver maps, we can still use the information
+    // if the maps are stable.
+    for (size_t i = 0; i < maps.size(); ++i) {
+      if (!maps[i]->is_stable()) return false;
+    }
     for (size_t i = 0; i < maps.size(); ++i) {
       receiver_maps->Add(maps[i]);
     }