[csa] Fix incorrect CAST in CSA::CheckEnumCache()

isheludko · Commit Bot · commit 7935d1969b06 · 2019-11-19T15:59:53.000Z
Bug: chromium:1022270 Change-Id: I6f1ee944b6cee977894d3cc425445f326a0866e5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1924351 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#65042}
diff --git a/src/codegen/code-stub-assembler.cc b/src/codegen/code-stub-assembler.cc
@@ -13187,7 +13187,12 @@ TNode<Map> CodeStubAssembler::CheckEnumCache(TNode<HeapObject> receiver,
   {
     // Avoid runtime-call for empty dictionary receivers.
     GotoIfNot(IsDictionaryMap(receiver_map), if_runtime);
-    TNode<NameDictionary> properties = CAST(LoadSlowProperties(CAST(receiver)));
+    TNode<HashTableBase> properties =
+        UncheckedCast<HashTableBase>(LoadSlowProperties(CAST(receiver)));
+    CSA_ASSERT(this, Word32Or(IsNameDictionary(properties),
+                              IsGlobalDictionary(properties)));
+    STATIC_ASSERT(static_cast<int>(NameDictionary::kNumberOfElementsIndex) ==
+                  static_cast<int>(GlobalDictionary::kNumberOfElementsIndex));
     TNode<Smi> length = GetNumberOfElements(properties);
     GotoIfNot(TaggedEqual(length, SmiConstant(0)), if_runtime);
     // Check that there are no elements on the {receiver} and its prototype
