Index: src/compiler/js-typed-lowering.cc |
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc |
index 5455198cc35281334ed3733587a770f315ff8026..09d5d1680db3ee37b4bdaa8cfb80de75b0cf1223 100644 |
--- a/src/compiler/js-typed-lowering.cc |
+++ b/src/compiler/js-typed-lowering.cc |
@@ -61,7 +61,8 @@ class AllocationBuilder final { |
void AllocateArray(int length, Handle<Map> map) { |
Allocate(FixedArray::SizeFor(length)); |
Store(AccessBuilder::ForMap(), map); |
- Store(AccessBuilder::ForFixedArrayLength(), jsgraph()->Constant(length)); |
+ Store(AccessBuilder::ForFixedArrayLength(graph()->zone()), |
+ jsgraph()->Constant(length)); |
} |
// Compound store of a constant into a field. |
@@ -1409,7 +1410,8 @@ Reduction JSTypedLowering::ReduceJSForInPrepare(Node* node) { |
cache_array_false0 = cache_type; |
cache_length_false0 = efalse0 = graph()->NewNode( |
- simplified()->LoadField(AccessBuilder::ForFixedArrayLength()), |
+ simplified()->LoadField( |
+ AccessBuilder::ForFixedArrayLength(graph()->zone())), |
cache_array_false0, efalse0, if_false0); |
} |