| Index: src/compiler/js-builtin-reducer.cc
|
| diff --git a/src/compiler/js-builtin-reducer.cc b/src/compiler/js-builtin-reducer.cc
|
| index b47d8162c9b742e2fd694901103ac9fa6f4c0660..762020438878fdbc5566ba07848fd601c870b6ca 100644
|
| --- a/src/compiler/js-builtin-reducer.cc
|
| +++ b/src/compiler/js-builtin-reducer.cc
|
| @@ -275,8 +275,8 @@ Reduction JSBuiltinReducer::ReduceArrayPush(Node* node) {
|
| // here is to learn on deopt, i.e. disable Array.prototype.push inlining
|
| // for this function.
|
| if (IsFastSmiElementsKind(receiver_map->elements_kind())) {
|
| - value = effect = graph()->NewNode(simplified()->CheckTaggedSigned(),
|
| - value, effect, control);
|
| + value = effect =
|
| + graph()->NewNode(simplified()->CheckSmi(), value, effect, control);
|
| } else if (IsFastDoubleElementsKind(receiver_map->elements_kind())) {
|
| value = effect =
|
| graph()->NewNode(simplified()->CheckNumber(), value, effect, control);
|
|
|