| Index: src/compiler/js-builtin-reducer.cc
|
| diff --git a/src/compiler/js-builtin-reducer.cc b/src/compiler/js-builtin-reducer.cc
|
| index 705735baf052864479a32c4ffb45ed4e74e777d7..afb9b1b6c009c4a0076e9eefaf1b99d694979afe 100644
|
| --- a/src/compiler/js-builtin-reducer.cc
|
| +++ b/src/compiler/js-builtin-reducer.cc
|
| @@ -842,11 +842,11 @@ Reduction JSBuiltinReducer::ReduceArrayPop(Node* node) {
|
| Node* receiver = NodeProperties::GetValueInput(node, 1);
|
| Node* effect = NodeProperties::GetEffectInput(node);
|
| Node* control = NodeProperties::GetControlInput(node);
|
| - // TODO(turbofan): Extend this to also handle fast (holey) double elements
|
| + // TODO(turbofan): Extend this to also handle fast holey double elements
|
| // once we got the hole NaN mess sorted out in TurboFan/V8.
|
| if (GetMapWitness(node).ToHandle(&receiver_map) &&
|
| CanInlineArrayResizeOperation(receiver_map) &&
|
| - IsFastSmiOrObjectElementsKind(receiver_map->elements_kind())) {
|
| + receiver_map->elements_kind() != FAST_HOLEY_DOUBLE_ELEMENTS) {
|
| // Install code dependencies on the {receiver} prototype maps and the
|
| // global array protector cell.
|
| dependencies()->AssumePropertyCell(factory()->array_protector());
|
| @@ -878,9 +878,11 @@ Reduction JSBuiltinReducer::ReduceArrayPop(Node* node) {
|
| receiver, efalse, if_false);
|
|
|
| // Ensure that we aren't popping from a copy-on-write backing store.
|
| - elements = efalse =
|
| - graph()->NewNode(simplified()->EnsureWritableFastElements(), receiver,
|
| - elements, efalse, if_false);
|
| + if (IsFastSmiOrObjectElementsKind(receiver_map->elements_kind())) {
|
| + elements = efalse =
|
| + graph()->NewNode(simplified()->EnsureWritableFastElements(),
|
| + receiver, elements, efalse, if_false);
|
| + }
|
|
|
| // Compute the new {length}.
|
| length = graph()->NewNode(simplified()->NumberSubtract(), length,
|
|
|