[turbofan] Disable speculation on Array.push if map check fails

Bug: v8:7204, v8:7127
Change-Id: Id99b0e83385275508a9e7f46e17bb8263f7b256a
Reviewed-on: https://chromium-review.googlesource.com/826626Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50103}

src/compiler/js-builtin-reducer.cc

@@ -992,6 +992,11 @@ Reduction JSBuiltinReducer::ReduceArrayPop(Node* node) {
 // ES6 section 22.1.3.18 Array.prototype.push ( )
 Reduction JSBuiltinReducer::ReduceArrayPush(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+
   int const num_values = node->op()->ValueInputCount() - 2;
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
@@ -1022,12 +1027,9 @@ Reduction JSBuiltinReducer::ReduceArrayPush(Node* node) {
       if (receiver_map->is_stable()) {
         dependencies()->AssumeMapStable(receiver_map);
       } else {
-        // TODO(turbofan): This is a potential - yet unlikely - deoptimization
-        // loop, since we might not learn from this deoptimization in baseline
-        // code. We need a way to learn from deoptimizations in optimized to
-        // address these problems.
         effect = graph()->NewNode(
-            simplified()->CheckMaps(CheckMapsFlag::kNone, receiver_maps),
+            simplified()->CheckMaps(CheckMapsFlag::kNone, receiver_maps,
+                                    p.feedback()),
             receiver, effect, control);
       }
     }

test/mjsunit/compiler/deopt-array-push.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+(function test() {
+  function foo(a) { a.push(a.length = 2); }
+
+  foo([1]);
+  foo([1]);
+  %OptimizeFunctionOnNextCall(foo);
+  foo([1]);
+  %OptimizeFunctionOnNextCall(foo);
+  foo([1]);
+  assertOptimized(foo);
+})();
+
+(function test() {
+  function bar(a) { a.x = 2 };
+  %NeverOptimizeFunction(bar);
+  function foo(a) { a.push(bar(a)); }
+
+  foo(["1"]);
+  foo(["1"]);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(["1"]);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(["1"]);
+  assertOptimized(foo);
+})();
+
+(function test() {
+  function foo(a) { a.push(a.length = 2); }
+
+  foo([0.34234]);
+  foo([0.34234]);
+  %OptimizeFunctionOnNextCall(foo);
+  foo([0.34234]);
+  %OptimizeFunctionOnNextCall(foo);
+  foo([0.34234]);
+  assertOptimized(foo);
+})();