| Index: src/hydrogen.cc
 | 
| diff --git a/src/hydrogen.cc b/src/hydrogen.cc
 | 
| index 1d1f94bd0e82ffa58301ce91b772a9a86d28dc2b..b4f747a7aa76f5bc85a82588e3260c10f19d8401 100644
 | 
| --- a/src/hydrogen.cc
 | 
| +++ b/src/hydrogen.cc
 | 
| @@ -5482,7 +5482,8 @@ HInstruction* HGraphBuilder::BuildFastElementAccess(HValue* elements,
 | 
|    if (IsFastDoubleElementsKind(elements_kind)) {
 | 
|      return new(zone()) HLoadKeyedFastDoubleElement(elements, checked_key, mode);
 | 
|    } else {  // Smi or Object elements.
 | 
| -    return new(zone()) HLoadKeyedFastElement(elements, checked_key, mode);
 | 
| +    return new(zone()) HLoadKeyedFastElement(elements, checked_key,
 | 
| +                                             mode, elements_kind);
 | 
|    }
 | 
|  }
 | 
|  
 | 
| @@ -5530,7 +5531,7 @@ HInstruction* HGraphBuilder::BuildMonomorphicElementAccess(HValue* object,
 | 
|           fast_elements ||
 | 
|           map->has_fast_double_elements());
 | 
|    if (map->instance_type() == JS_ARRAY_TYPE) {
 | 
| -    length = AddInstruction(new(zone()) HJSArrayLength(object, mapcheck));
 | 
| +    length = AddInstruction(new(zone()) HJSArrayLength(object, mapcheck, true));
 | 
|    } else {
 | 
|      length = AddInstruction(new(zone()) HFixedArrayBaseLength(elements));
 | 
|    }
 | 
| @@ -5685,7 +5686,8 @@ HValue* HGraphBuilder::HandlePolymorphicElementAccess(HValue* object,
 | 
|  
 | 
|          set_current_block(if_jsarray);
 | 
|          HInstruction* length;
 | 
| -        length = AddInstruction(new(zone()) HJSArrayLength(object, typecheck));
 | 
| +        length =
 | 
| +            AddInstruction(new(zone()) HJSArrayLength(object, typecheck, true));
 | 
|          checked_key = AddInstruction(new(zone()) HBoundsCheck(key, length));
 | 
|          access = AddInstruction(BuildFastElementAccess(
 | 
|              elements, checked_key, val, elements_kind, is_store));
 | 
| @@ -5884,8 +5886,7 @@ void HGraphBuilder::VisitProperty(Property* expr) {
 | 
|      AddInstruction(new(zone()) HCheckNonSmi(array));
 | 
|      HInstruction* mapcheck =
 | 
|          AddInstruction(HCheckInstanceType::NewIsJSArray(array, zone()));
 | 
| -    instr = new(zone()) HJSArrayLength(array, mapcheck);
 | 
| -
 | 
| +    instr = new(zone()) HJSArrayLength(array, mapcheck, false);
 | 
|    } else if (expr->IsStringLength()) {
 | 
|      HValue* string = Pop();
 | 
|      AddInstruction(new(zone()) HCheckNonSmi(string));
 | 
| 
 |