[turbofan] Fix lowering of Array constructor with one argument.

src/compiler/js-create-lowering.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-create-lowering.h"
 
 #include "src/allocation-site-scopes.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 797 matching lines @@
   // where either no arguments are provided, or exactly one unsigned number
   // argument is given.
   if (site->CanInlineCall()) {
     if (p.arity() == 0) {
       Node* length = jsgraph()->ZeroConstant();
       int capacity = JSArray::kPreallocatedArrayElements;
       return ReduceNewArray(node, length, capacity, site);
     } else if (p.arity() == 1) {
       Node* length = NodeProperties::GetValueInput(node, 2);
       Type* length_type = NodeProperties::GetType(length);
-      if (!length_type->Maybe(Type::Unsigned32())) {
+      if (!length_type->Maybe(Type::Number())) {
         // Handle the single argument case, where we know that the value
         // cannot be a valid Array length.
         return ReduceNewArray(node, {length}, site);

[Michael Achenbach, 2017/04/26 12:36:08]

Are you sure this code is covered? Sancov bot shows a red mark here, gcov is
still working, lets see:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20gcov%20cov...

       }
       if (length_type->Is(Type::SignedSmall()) && length_type->Min() >= 0 &&
           length_type->Max() <= kElementLoopUnrollLimit &&
           length_type->Min() == length_type->Max()) {
         int capacity = static_cast<int>(length_type->Max());
         return ReduceNewArray(node, length, capacity, site);
       }
     } else if (p.arity() <= JSArray::kInitialMaxFastElementArray) {
       std::vector<Node*> values;
       values.reserve(p.arity());
@@ skipping 611 matching lines @@
   return jsgraph()->simplified();
 }
 
 MachineOperatorBuilder* JSCreateLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8