Index: src/objects.cc |
diff --git a/src/objects.cc b/src/objects.cc |
index 4ff0e3404d495930ae65325158c63fee2f3fad89..6d65f48e1acd1318d67efed386cf33269805385d 100644 |
--- a/src/objects.cc |
+++ b/src/objects.cc |
@@ -8273,10 +8273,13 @@ bool HasEnumerableElements(JSObject* object) { |
return false; |
} |
case FAST_HOLEY_DOUBLE_ELEMENTS: { |
- FixedDoubleArray* elements = FixedDoubleArray::cast(object->elements()); |
int length = object->IsJSArray() |
? Smi::cast(JSArray::cast(object)->length())->value() |
- : elements->length(); |
+ : object->elements()->length(); |
+ // Zero-length arrays would use the empty FixedArray... |
+ if (length == 0) return false; |
+ // ...so only cast to FixedDoubleArray otherwise. |
+ FixedDoubleArray* elements = FixedDoubleArray::cast(object->elements()); |
for (int i = 0; i < length; i++) { |
if (!elements->is_the_hole(i)) return true; |
} |