Fix representation issue in FastArrayPushStub

src/code-stubs-hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-stubs.h"
 
 #include "src/bailout-reason.h"
 #include "src/crankshaft/hydrogen.h"
 #include "src/crankshaft/lithium.h"
 #include "src/field-index.h"
@@ skipping 776 matching lines @@
                                                    HValue* argument_elements,
                                                    ElementsKind kind) {
   // Precheck whether all elements fit into the array.
   if (!IsFastObjectElementsKind(kind)) {
     LoopBuilder builder(this, context(), LoopBuilder::kPostIncrement);
     HValue* start = graph()->GetConstant0();
     HValue* key = builder.BeginBody(start, argc, Token::LT);
     {
       HInstruction* argument =
           Add<HAccessArgumentsAt>(argument_elements, argc, key);
-      Representation r = IsFastSmiElementsKind(kind) ? Representation::Smi()
-                                                     : Representation::Double();
-      AddUncasted<HForceRepresentation>(argument, r);
+      IfBuilder can_store(this);
+      can_store.IfNot<HIsSmiAndBranch>(argument);
+      if (IsFastDoubleElementsKind(kind)) {
+        can_store.And();
+        can_store.IfNot<HCompareMap>(argument,
+                                     isolate()->factory()->heap_number_map());
+      }
+      can_store.ThenDeopt(Deoptimizer::kFastArrayPushFailed);
+      can_store.End();
     }
     builder.EndBody();
   }
 
   HValue* length = Add<HLoadNamedField>(object, nullptr,
                                         HObjectAccess::ForArrayLength(kind));
   HValue* new_length = AddUncasted<HAdd>(length, argc);
   HValue* max_key = AddUncasted<HSub>(new_length, graph()->GetConstant1());
 
   HValue* elements = Add<HLoadNamedField>(object, nullptr,
@@ skipping 1758 matching lines @@
   return Pop();
 }
 
 
 Handle<Code> KeyedLoadGenericStub::GenerateCode() {
   return DoGenerateCode(this);
 }
 
 }  // namespace internal
 }  // namespace v8