From 527e19afd59b11b018e22678b479262df098e567 Mon Sep 17 00:00:00 2001
From: jarin <jarin@chromium.org>
Date: Tue, 13 Jan 2015 00:40:39 -0800
Subject: [PATCH] [turbofan] Add missing deopt.

BUG=chromium:447567
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/809463005

Cr-Commit-Position: refs/heads/master@{#26033}
---
 src/compiler/linkage.cc                 |  2 ++
 test/mjsunit/compiler/regress-447567.js | 15 +++++++++++++++
 2 files changed, 17 insertions(+)
 create mode 100644 test/mjsunit/compiler/regress-447567.js

diff --git a/src/compiler/linkage.cc b/src/compiler/linkage.cc
index fc6b19e..f76bc60 100644
--- a/src/compiler/linkage.cc
+++ b/src/compiler/linkage.cc
@@ -179,6 +179,7 @@ bool Linkage::NeedsFrameState(Runtime::FunctionId function) {
     case Runtime::kNewObjectFromBound:
     case Runtime::kNewObjectWithAllocationSite:
     case Runtime::kObjectFreeze:
+    case Runtime::kObjectSeal:
     case Runtime::kOwnKeys:
     case Runtime::kParseJson:
     case Runtime::kPrepareStep:
@@ -202,6 +203,7 @@ bool Linkage::NeedsFrameState(Runtime::FunctionId function) {
     case Runtime::kStringBuilderJoin:
     case Runtime::kStringMatch:
     case Runtime::kStringReplaceGlobalRegExpWithString:
+    case Runtime::kThrowConstAssignError:
     case Runtime::kThrowNonMethodError:
     case Runtime::kThrowNotDateError:
     case Runtime::kThrowReferenceError:
diff --git a/test/mjsunit/compiler/regress-447567.js b/test/mjsunit/compiler/regress-447567.js
new file mode 100644
index 0000000..b6dc653
--- /dev/null
+++ b/test/mjsunit/compiler/regress-447567.js
@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-deoptimization
+
+assertThrows(function() {
+  [0].every(function(){ Object.seal((new Int8Array())); });
+})
+
+assertThrows(function() {
+  "use strict";
+  const v = 42;
+  v += 1;
+});
-- 
2.7.4