[csa] avoid FixedDoubleArray CAST on empty FixedArray

Bug: chromium:871886
Change-Id: I91c6099ebaa064575db1ee3d7354e02cd42bbfd2
Reviewed-on: https://chromium-review.googlesource.com/1166906
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55010}

src/code-stub-assembler.cc

@@ -8451,14 +8451,15 @@ void CodeStubAssembler::TryLookupElement(Node* object, Node* map,
   }
   BIND(&if_isdouble);
   {
-    TNode<FixedDoubleArray> elements = CAST(LoadElements(object));
+    TNode<FixedArrayBase> elements = LoadElements(object);
     TNode<IntPtrT> length = LoadAndUntagFixedArrayBaseLength(elements);
 
     GotoIfNot(UintPtrLessThan(intptr_index, length), &if_oob);
 
     // Check if the element is a double hole, but don't load it.
-    LoadFixedDoubleArrayElement(elements, intptr_index, MachineType::None(), 0,
-                                INTPTR_PARAMETERS, if_not_found);
+    LoadFixedDoubleArrayElement(CAST(elements), intptr_index,
+                                MachineType::None(), 0, INTPTR_PARAMETERS,
+                                if_not_found);
     Goto(if_found);
   }
   BIND(&if_isdictionary);

test/mjsunit/regress/regress-crbug-871886.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let arr = [1.5, 2.5];
+arr.slice(0,
+  { valueOf: function () {
+      arr.length = 0;
+      return 2;
+    }
+  });