diff --git a/src/objects.cc b/src/objects.cc index 4ff0e3404d..6d65f48e1a 100644 --- a/src/objects.cc +++ b/src/objects.cc @@ -8273,10 +8273,13 @@ bool HasEnumerableElements(JSObject* object) { return false; } case FAST_HOLEY_DOUBLE_ELEMENTS: { - FixedDoubleArray* elements = FixedDoubleArray::cast(object->elements()); int length = object->IsJSArray() ? Smi::cast(JSArray::cast(object)->length())->value() - : elements->length(); + : object->elements()->length(); + // Zero-length arrays would use the empty FixedArray... + if (length == 0) return false; + // ...so only cast to FixedDoubleArray otherwise. + FixedDoubleArray* elements = FixedDoubleArray::cast(object->elements()); for (int i = 0; i < length; i++) { if (!elements->is_the_hole(i)) return true; } diff --git a/test/mjsunit/regress/regress-crbug-569534.js b/test/mjsunit/regress/regress-crbug-569534.js new file mode 100644 index 0000000000..e1419ea8b0 --- /dev/null +++ b/test/mjsunit/regress/regress-crbug-569534.js @@ -0,0 +1,7 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +var array = [,0.5]; +array.length = 0; +for (var i in array) {}