[turbofan] Fix lowering of Array constructor with one argument.

src/compiler/js-create-lowering.cc

Index: src/compiler/js-create-lowering.cc
diff --git a/src/compiler/js-create-lowering.cc b/src/compiler/js-create-lowering.cc
index 6a726b9f645b0b33e471a0d9a3392fa7b6f6906d..6d383caac0ba7e209cce1fb4ba6702141ec56cf2 100644
--- a/src/compiler/js-create-lowering.cc
+++ b/src/compiler/js-create-lowering.cc
@@ -815,7 +815,7 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
     } else if (p.arity() == 1) {
       Node* length = NodeProperties::GetValueInput(node, 2);
       Type* length_type = NodeProperties::GetType(length);
-      if (!length_type->Maybe(Type::Unsigned32())) {
+      if (!length_type->Maybe(Type::Number())) {
         // Handle the single argument case, where we know that the value
         // cannot be a valid Array length.
         return ReduceNewArray(node, {length}, site);

[Michael Achenbach, 2017/04/26 12:36:08]

Are you sure this code is covered? Sancov bot shows a red mark here, gcov is
still working, lets see:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20gcov%20cov...