| Index: src/hydrogen.cc
|
| diff --git a/src/hydrogen.cc b/src/hydrogen.cc
|
| index 809640fb437aa303c39e0d51e087e59b3e210b29..30406d656c3ee4d293877ab96ec36eaee7168e09 100644
|
| --- a/src/hydrogen.cc
|
| +++ b/src/hydrogen.cc
|
| @@ -9727,18 +9727,8 @@
|
| native_context, nullptr,
|
| HObjectAccess::ForContextSlot(Context::ARRAY_BUFFER_MAP_INDEX)));
|
|
|
| - HConstant* empty_fixed_array =
|
| - Add<HConstant>(isolate()->factory()->empty_fixed_array());
|
| - Add<HStoreNamedField>(
|
| - result, HObjectAccess::ForJSArrayOffset(JSArray::kPropertiesOffset),
|
| - empty_fixed_array);
|
| - Add<HStoreNamedField>(
|
| - result, HObjectAccess::ForJSArrayOffset(JSArray::kElementsOffset),
|
| - empty_fixed_array);
|
| - Add<HStoreNamedField>(
|
| - result, HObjectAccess::ForJSArrayBufferBackingStore().WithRepresentation(
|
| - Representation::Smi()),
|
| - graph()->GetConstant0());
|
| + Add<HStoreNamedField>(result, HObjectAccess::ForJSArrayBufferBackingStore(),
|
| + Add<HConstant>(ExternalReference()));
|
| Add<HStoreNamedField>(result, HObjectAccess::ForJSArrayBufferByteLength(),
|
| byte_length);
|
| Add<HStoreNamedField>(result, HObjectAccess::ForJSArrayBufferBitFieldSlot(),
|
| @@ -9945,7 +9935,7 @@
|
| CHECK_ALIVE(VisitForValue(arguments->at(kObjectArg)));
|
| HValue* obj = Pop();
|
|
|
| - if (!arguments->at(kArrayIdArg)->IsLiteral()) {
|
| + if (arguments->at(kArrayIdArg)->IsLiteral()) {
|
| // This should never happen in real use, but can happen when fuzzing.
|
| // Just bail out.
|
| Bailout(kNeedSmiLiteral);
|
|
|