[TurboFan] Support Double arrays in Array.prototype.filter inlining.

Bug: v8:1956
Change-Id: I8e35ab6614dbf98facb6c9053fa5c50d4afeda42
Reviewed-on: https://chromium-review.googlesource.com/729019
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49211}

src/compiler/js-call-reducer.cc

@@ -1247,8 +1247,8 @@ Reduction JSCallReducer::ReduceArrayFilter(Handle<JSFunction> function,
 
   const ElementsKind kind = receiver_maps[0]->elements_kind();
 
-  // TODO(danno): Handle holey and double elements kinds.
-  if (!IsFastPackedElementsKind(kind) || IsDoubleElementsKind(kind)) {
+  // TODO(danno): Handle holey elements kinds.
+  if (!IsFastPackedElementsKind(kind)) {
     return NoChange();
   }
 
@@ -1467,10 +1467,9 @@ Node* JSCallReducer::DoFilterPostCallbackWork(ElementsKind kind, Node** control,
         simplified()->LoadField(AccessBuilder::ForFixedArrayLength()), elements,
         etrue, if_true);
 
-    GrowFastElementsMode mode = GrowFastElementsMode::kSmiOrObjectElements;
-    // TODO(mvstanton): Make sure{flags} is correct when we handle{a} as a
-    // double output array.
-    DCHECK(!IsDoubleElementsKind(kind));
+    GrowFastElementsMode mode =
+        IsDoubleElementsKind(kind) ? GrowFastElementsMode::kDoubleElements
+                                   : GrowFastElementsMode::kSmiOrObjectElements;
     elements = etrue =
         graph()->NewNode(simplified()->MaybeGrowFastElements(mode), a, elements,
                          checked_to, elements_length, etrue, if_true);