Fix bogus assertion.

R=hpayer@chromium.org
BUG=347530

Review URL: https://codereview.chromium.org/183243002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19585 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/objects.cc b/src/objects.cc
index 59a5967..1d7c672 100644 (file)
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -13089,8 +13089,9 @@ void JSObject::GetElementsCapacityAndUsage(int* capacity, int* used) {
       }
       // Fall through if packing is not guaranteed.
     case FAST_HOLEY_DOUBLE_ELEMENTS: {
-      FixedDoubleArray* elms = FixedDoubleArray::cast(elements());
-      *capacity = elms->length();
+      *capacity = elements()->length();
+      if (*capacity == 0) break;
+      FixedDoubleArray * elms = FixedDoubleArray::cast(elements());
       for (int i = 0; i < *capacity; i++) {
         if (!elms->is_the_hole(i)) ++(*used);
       }