| Index: src/compiler/js-typed-lowering.cc
|
| diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
|
| index 5455198cc35281334ed3733587a770f315ff8026..09d5d1680db3ee37b4bdaa8cfb80de75b0cf1223 100644
|
| --- a/src/compiler/js-typed-lowering.cc
|
| +++ b/src/compiler/js-typed-lowering.cc
|
| @@ -61,7 +61,8 @@ class AllocationBuilder final {
|
| void AllocateArray(int length, Handle<Map> map) {
|
| Allocate(FixedArray::SizeFor(length));
|
| Store(AccessBuilder::ForMap(), map);
|
| - Store(AccessBuilder::ForFixedArrayLength(), jsgraph()->Constant(length));
|
| + Store(AccessBuilder::ForFixedArrayLength(graph()->zone()),
|
| + jsgraph()->Constant(length));
|
| }
|
|
|
| // Compound store of a constant into a field.
|
| @@ -1409,7 +1410,8 @@ Reduction JSTypedLowering::ReduceJSForInPrepare(Node* node) {
|
|
|
| cache_array_false0 = cache_type;
|
| cache_length_false0 = efalse0 = graph()->NewNode(
|
| - simplified()->LoadField(AccessBuilder::ForFixedArrayLength()),
|
| + simplified()->LoadField(
|
| + AccessBuilder::ForFixedArrayLength(graph()->zone())),
|
| cache_array_false0, efalse0, if_false0);
|
| }
|
|
|
|
|