This actually seems to be unrelated to which configuration is being used and solely relies on GC timing. I can make both configuration either succeed or fail by slightly changing the GC timing. Needs further investigation.
This is caused by the {StoreFastElementStub} used inside a polymorphic keyed store but ignoring the prototype chain. The following is a stable repro across configurations:
function foo(a) { a[0] = 3; }
var v = [,6];
v.__proto__ = [];
foo(v);
delete v[0];
var count = 0;
v.__proto__.__defineSetter__(0, function() { print("YUP!"); count++; });
foo([1]);
foo(v);
print(count);
Comment 1 by machenb...@chromium.org
, Feb 6 2017Components: -Blink>JavaScript Blink>JavaScript>Compiler
Status: Available (was: Untriaged)
// PTAL. Requires always opt for repro: function foo(a) { a[0] = 3; } var v = {}; foo(v); v.__p_1469921916 = 0; foo([3]); foo(v); v = [,5]; gc(); v.__proto__ = []; foo(v); delete v[0]; var count = 0; v.__proto__.__defineSetter__(0, function() { count++; }); foo([,5]); foo(v); print(count); // Output: # Compared x64,ignition with x64,ignition_turbo_opt # # Flags of x64,ignition: --abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed 1234 --ignition --turbo-filter=~ --hydrogen-filter=~ --validate-asm --nocrankshaft # Flags of x64,ignition_turbo_opt: --abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed 1234 --ignition-staging --turbo --always-opt --validate-asm # # Difference: - 1 + 0 # # Source file: none # ### Start of configuration x64,ignition: 1 ### End of configuration x64,ignition # ### Start of configuration x64,ignition_turbo_opt: 0 ### End of configuration x64,ignition_turbo_opt