Add missing deopt-trigger to invalidation of some protector cells.

R=bmeurer@chromium.org

Change-Id: Idd9c45f733e2e5d518c69a6ead2b56f6433ca30e
Reviewed-on: https://chromium-review.googlesource.com/1114598Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54020}

src/isolate.cc

@@ -3517,24 +3517,27 @@ void Isolate::InvalidateArrayConstructorProtector() {
 void Isolate::InvalidateArraySpeciesProtector() {
   DCHECK(factory()->array_species_protector()->value()->IsSmi());
   DCHECK(IsArraySpeciesLookupChainIntact());
-  factory()->array_species_protector()->set_value(
-      Smi::FromInt(kProtectorInvalid));
+  PropertyCell::SetValueWithInvalidation(
+      this, factory()->array_species_protector(),
+      handle(Smi::FromInt(kProtectorInvalid), this));
   DCHECK(!IsArraySpeciesLookupChainIntact());
 }
 
 void Isolate::InvalidateTypedArraySpeciesProtector() {
   DCHECK(factory()->typed_array_species_protector()->value()->IsSmi());
   DCHECK(IsTypedArraySpeciesLookupChainIntact());
-  factory()->typed_array_species_protector()->set_value(
-      Smi::FromInt(kProtectorInvalid));
+  PropertyCell::SetValueWithInvalidation(
+      this, factory()->typed_array_species_protector(),
+      handle(Smi::FromInt(kProtectorInvalid), this));
   DCHECK(!IsTypedArraySpeciesLookupChainIntact());
 }
 
 void Isolate::InvalidatePromiseSpeciesProtector() {
   DCHECK(factory()->promise_species_protector()->value()->IsSmi());
   DCHECK(IsPromiseSpeciesLookupChainIntact());
-  factory()->promise_species_protector()->set_value(
-      Smi::FromInt(kProtectorInvalid));
+  PropertyCell::SetValueWithInvalidation(
+      this, factory()->promise_species_protector(),
+      handle(Smi::FromInt(kProtectorInvalid), this));
   DCHECK(!IsPromiseSpeciesLookupChainIntact());
 }
 

test/mjsunit/compiler/array-species.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Foo() {}
+
+function f() {
+  return [42].map(_ => 88);
+}
+
+let y;
+
+y = f();
+assertFalse(y instanceof Foo);
+assertInstanceof(y, Array);
+
+y = f();
+assertFalse(y instanceof Foo);
+assertInstanceof(y, Array);
+
+%OptimizeFunctionOnNextCall(f);
+
+y = f();
+assertFalse(y instanceof Foo);
+assertInstanceof(y, Array);
+
+assertTrue(Reflect.defineProperty(Array, Symbol.species, {value: Foo}));
+
+y = f();
+assertInstanceof(y, Foo);
+assertFalse(y instanceof Array);

test/mjsunit/compiler/promise-species.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class Foo extends Promise {};
+
+function f() {
+  return new Promise(r => 88).then(x => 88);
+}
+
+let y;
+
+y = f();
+assertFalse(y instanceof Foo);
+
+y = f();
+assertFalse(y instanceof Foo);
+
+%OptimizeFunctionOnNextCall(f);
+
+y = f();
+assertFalse(y instanceof Foo);
+
+assertTrue(Reflect.defineProperty(Promise, Symbol.species, {value: Foo}));
+
+y = f();
+assertInstanceof(y, Foo);