[turbofan] Properly ensure that deoptimization is enabled.

We cannot optimize global proxy access unless deoptimization is enabled.

BUG=chromium:687990
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2675793002
Cr-Commit-Position: refs/heads/master@{#42928}

src/compiler/js-native-context-specialization.cc

@@ -750,11 +750,13 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccessFromNexus(
   Node* const receiver = NodeProperties::GetValueInput(node, 0);
   Node* const effect = NodeProperties::GetEffectInput(node);
 
-  // Check if we are accessing the current native contexts' global proxy.
-  HeapObjectMatcher m(receiver);
-  if (m.HasValue() && m.Value().is_identical_to(global_proxy())) {
-    // Optimize accesses to the current native contexts' global proxy.
-    return ReduceGlobalAccess(node, nullptr, value, name, access_mode);
+  if (flags() & kDeoptimizationEnabled) {
+    // Check if we are accessing the current native contexts' global proxy.
+    HeapObjectMatcher m(receiver);
+    if (m.HasValue() && m.Value().is_identical_to(global_proxy())) {
+      // Optimize accesses to the current native contexts' global proxy.
+      return ReduceGlobalAccess(node, nullptr, value, name, access_mode);
+    }
   }
 
   // Check if the {nexus} reports type feedback for the IC.

test/mjsunit/regress/regress-crbug-687990.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var x = 1;
+
+var foo = (function() {
+  "use asm";
+  var o = this;
+  return function() { o.x = null; }
+})();
+
+%OptimizeFunctionOnNextCall(foo);
+foo();