[array] Fix read-only property in NumberDictionary fast-path

This CL fixes the NumberDictionary fast-path in Array.p.sort, when
storing to a read-only property that was never read from.

R=jgruber@chromium.org

Bug: v8:7907
Change-Id: I2b772fb5b1619a94a7d239ba4417ecb7902a167c
Reviewed-on: https://chromium-review.googlesource.com/1119910
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54109}

src/builtins/array-sort.tq

@@ -50,24 +50,28 @@ module array {
   }
 
   macro Store<ElementsAccessor : type>(
-      context: Context, receiver: Object, index: Smi, value: Object) {
+      context: Context, receiver: Object, index: Smi, value: Object)
+      labels Bailout {
     SetProperty(context, receiver, index, value, kStrict);
   }
 
   Store<FastPackedSmiElements>(
-      context: Context, elements: Object, index: Smi, value: Object) {
+      context: Context, elements: Object, index: Smi, value: Object)
+      labels Bailout {
     let elems: FixedArray = unsafe_cast<FixedArray>(elements);
     elems[index] = value;
   }
 
   Store<FastSmiOrObjectElements>(
-      context: Context, elements: Object, index: Smi, value: Object) {
+      context: Context, elements: Object, index: Smi, value: Object)
+      labels Bailout {
     let elems: FixedArray = unsafe_cast<FixedArray>(elements);
     elems[index] = value;
   }
 
   Store<FastDoubleElements>(
-      context: Context, elements: Object, index: Smi, value: Object) {
+      context: Context, elements: Object, index: Smi, value: Object)
+      labels Bailout {
     let elems: FixedDoubleArray = unsafe_cast<FixedDoubleArray>(elements);
     let heap_val: HeapNumber = unsafe_cast<HeapNumber>(value);
     // Make sure we do not store signalling NaNs into double arrays.
@@ -82,18 +86,13 @@ module array {
   }
 
   Store<DictionaryElements>(
-      context: Context, elements: Object, index: Smi, value: Object) {
-    try {
-      let dictionary: NumberDictionary =
-          unsafe_cast<NumberDictionary>(elements);
-      let intptr_index: intptr = convert<intptr>(index);
-      BasicStoreNumberDictionaryElement(dictionary, intptr_index, value)
-      otherwise Fail, Fail;
-      return;
-    }
-    label Fail {
-      unreachable;
-    }
+      context: Context, elements: Object, index: Smi, value: Object)
+      labels Bailout {
+    let dictionary: NumberDictionary = unsafe_cast<NumberDictionary>(elements);
+    let intptr_index: intptr = convert<intptr>(index);
+    BasicStoreNumberDictionaryElement(dictionary, intptr_index, value)
+    otherwise Bailout, Bailout;
+    return;
   }
 
   builtin SortCompareDefault(
@@ -208,12 +207,12 @@ module array {
             initialReceiverLength, userCmpFn, sortCompare, tmp, element)
         otherwise Bailout;
         if (order > 0) {
-          Store<E>(context, elements, j + 1, tmp);
+          Store<E>(context, elements, j + 1, tmp) otherwise Bailout;
         } else {
           break;
         }
       }
-      Store<E>(context, elements, j + 1, element);
+      Store<E>(context, elements, j + 1, element) otherwise Bailout;
     }
   }
 
@@ -328,8 +327,8 @@ module array {
     }
 
     // v0 <= v1 <= v2.
-    Store<E>(context, elements, from, v0);
-    Store<E>(context, elements, to - 1, v2);
+    Store<E>(context, elements, from, v0) otherwise Bailout;
+    Store<E>(context, elements, to - 1, v2) otherwise Bailout;
 
     // Move pivot element to a place on the left.
     Swap<E>(context, elements, from + 1, third_index, v1) otherwise Bailout;
@@ -347,8 +346,8 @@ module array {
       value: Object)
   labels Bailout {
     let tmp: Object = Load<E>(context, elements, indexA) otherwise Bailout;
-    Store<E>(context, elements, indexB, tmp);
-    Store<E>(context, elements, indexA, value);
+    Store<E>(context, elements, indexB, tmp) otherwise Bailout;
+    Store<E>(context, elements, indexA, value) otherwise Bailout;
   }
 
   macro ArrayQuickSortImpl<E : type>(

test/mjsunit/regress/regress-crbug-7907.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let arr = new Array(10);
+Object.defineProperty(arr, 0, {value: 10, writable: false});
+Object.defineProperty(arr, 9, {value: 1, writable: false});
+
+arr.sort();