Index: src/compiler/js-builtin-reducer.cc |
diff --git a/src/compiler/js-builtin-reducer.cc b/src/compiler/js-builtin-reducer.cc |
index 705735baf052864479a32c4ffb45ed4e74e777d7..afb9b1b6c009c4a0076e9eefaf1b99d694979afe 100644 |
--- a/src/compiler/js-builtin-reducer.cc |
+++ b/src/compiler/js-builtin-reducer.cc |
@@ -842,11 +842,11 @@ Reduction JSBuiltinReducer::ReduceArrayPop(Node* node) { |
Node* receiver = NodeProperties::GetValueInput(node, 1); |
Node* effect = NodeProperties::GetEffectInput(node); |
Node* control = NodeProperties::GetControlInput(node); |
- // TODO(turbofan): Extend this to also handle fast (holey) double elements |
+ // TODO(turbofan): Extend this to also handle fast holey double elements |
// once we got the hole NaN mess sorted out in TurboFan/V8. |
if (GetMapWitness(node).ToHandle(&receiver_map) && |
CanInlineArrayResizeOperation(receiver_map) && |
- IsFastSmiOrObjectElementsKind(receiver_map->elements_kind())) { |
+ receiver_map->elements_kind() != FAST_HOLEY_DOUBLE_ELEMENTS) { |
// Install code dependencies on the {receiver} prototype maps and the |
// global array protector cell. |
dependencies()->AssumePropertyCell(factory()->array_protector()); |
@@ -878,9 +878,11 @@ Reduction JSBuiltinReducer::ReduceArrayPop(Node* node) { |
receiver, efalse, if_false); |
// Ensure that we aren't popping from a copy-on-write backing store. |
- elements = efalse = |
- graph()->NewNode(simplified()->EnsureWritableFastElements(), receiver, |
- elements, efalse, if_false); |
+ if (IsFastSmiOrObjectElementsKind(receiver_map->elements_kind())) { |
+ elements = efalse = |
+ graph()->NewNode(simplified()->EnsureWritableFastElements(), |
+ receiver, elements, efalse, if_false); |
+ } |
// Compute the new {length}. |
length = graph()->NewNode(simplified()->NumberSubtract(), length, |