GrowArrayElementsStub must save caller doubles for double ElementsKind.

src/code-stubs-hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/bailout-reason.h"
 #include "src/code-stubs.h"
 #include "src/field-index.h"
 #include "src/hydrogen.h"
@@ skipping 560 matching lines @@
 }
 
 
 Handle<Code> StoreScriptContextFieldStub::GenerateCode() {
   return DoGenerateCode(this);
 }
 
 
 template <>
 HValue* CodeStubGraphBuilder<GrowArrayElementsStub>::BuildCodeStub() {
+  ElementsKind kind = casted_stub()->elements_kind();
+  if (IsFastDoubleElementsKind(kind)) {
+    info()->MarkAsSavesCallerDoubles();
+  }
+
   HValue* object = GetParameter(GrowArrayElementsDescriptor::kObjectIndex);
   HValue* key = GetParameter(GrowArrayElementsDescriptor::kKeyIndex);
   HValue* current_capacity =
       GetParameter(GrowArrayElementsDescriptor::kCapacityIndex);
-  ElementsKind kind = casted_stub()->elements_kind();
 
   HValue* elements = AddLoadElements(object);
   HValue* length =
       casted_stub()->is_js_array()
           ? Add<HLoadNamedField>(object, static_cast<HValue*>(NULL),
                                  HObjectAccess::ForArrayLength(kind))
           : current_capacity;
 
   return BuildCheckAndGrowElementsCapacity(object, elements, kind, length,
                                            current_capacity, key);
@@ skipping 1512 matching lines @@
   // need.
   info()->MarkMustNotHaveEagerFrame();
 
   // Probe the stub cache.
   Add<HTailCallThroughMegamorphicCache>(receiver, name);
 
   // We never continue.
   return graph()->GetConstant0();
 }
 } }  // namespace v8::internal