| Index: src/elements.cc
|
| diff --git a/src/elements.cc b/src/elements.cc
|
| index 26b722beaaf88dbd7d620be2d3902af23dcf7f05..580a7186bdaa691fe210c3947b8b322b9f4ac47e 100644
|
| --- a/src/elements.cc
|
| +++ b/src/elements.cc
|
| @@ -1848,9 +1848,10 @@ MaybeHandle<Object> ElementsAccessorBase<ElementsAccessorSubclass,
|
| Handle<JSArray> array = Handle<JSArray>::cast(obj);
|
|
|
| // Fast case: The new length fits into a Smi.
|
| - Handle<Object> smi_length = Object::ToSmi(isolate, length);
|
| + Handle<Object> smi_length;
|
|
|
| - if (!smi_length.is_null() && smi_length->IsSmi()) {
|
| + if (Object::ToSmi(isolate, length).ToHandle(&smi_length) &&
|
| + smi_length->IsSmi()) {
|
| const int value = Handle<Smi>::cast(smi_length)->value();
|
| if (value >= 0) {
|
| Handle<Object> new_length = ElementsAccessorSubclass::
|
|
|