Index: src/compiler/js-builtin-reducer.cc |
diff --git a/src/compiler/js-builtin-reducer.cc b/src/compiler/js-builtin-reducer.cc |
index b47d8162c9b742e2fd694901103ac9fa6f4c0660..762020438878fdbc5566ba07848fd601c870b6ca 100644 |
--- a/src/compiler/js-builtin-reducer.cc |
+++ b/src/compiler/js-builtin-reducer.cc |
@@ -275,8 +275,8 @@ Reduction JSBuiltinReducer::ReduceArrayPush(Node* node) { |
// here is to learn on deopt, i.e. disable Array.prototype.push inlining |
// for this function. |
if (IsFastSmiElementsKind(receiver_map->elements_kind())) { |
- value = effect = graph()->NewNode(simplified()->CheckTaggedSigned(), |
- value, effect, control); |
+ value = effect = |
+ graph()->NewNode(simplified()->CheckSmi(), value, effect, control); |
} else if (IsFastDoubleElementsKind(receiver_map->elements_kind())) { |
value = effect = |
graph()->NewNode(simplified()->CheckNumber(), value, effect, control); |