| Index: src/ia32/lithium-codegen-ia32.cc
 | 
| diff --git a/src/ia32/lithium-codegen-ia32.cc b/src/ia32/lithium-codegen-ia32.cc
 | 
| index f3bcf1abc3fc1974af2b7bd55a8aeec35aec8269..1e744a64e101c7482cc7d622d4a4e3d6661cc18d 100644
 | 
| --- a/src/ia32/lithium-codegen-ia32.cc
 | 
| +++ b/src/ia32/lithium-codegen-ia32.cc
 | 
| @@ -2705,6 +2705,10 @@ Operand LCodeGen::BuildFastArrayOperand(
 | 
|      uint32_t additional_index) {
 | 
|    Register elements_pointer_reg = ToRegister(elements_pointer);
 | 
|    int shift_size = ElementsKindToShiftSize(elements_kind);
 | 
| +  // Even though the HLoad/StoreKeyedFastElement instructions force the input
 | 
| +  // representation for the key to be an integer, the input gets replaced during
 | 
| +  // bound check elimination with the index argument to the bounds check, which
 | 
| +  // can be tagged, so that case must be handled here, too.
 | 
|    if (key_representation.IsTagged() && (shift_size >= 1)) {
 | 
|      shift_size -= kSmiTagSize;
 | 
|    }
 | 
| @@ -3681,8 +3685,14 @@ void LCodeGen::DoStoreNamedGeneric(LStoreNamedGeneric* instr) {
 | 
|  
 | 
|  void LCodeGen::DoBoundsCheck(LBoundsCheck* instr) {
 | 
|    if (instr->index()->IsConstantOperand()) {
 | 
| -    __ cmp(ToOperand(instr->length()),
 | 
| -           Immediate(ToInteger32(LConstantOperand::cast(instr->index()))));
 | 
| +    int constant_index =
 | 
| +        ToInteger32(LConstantOperand::cast(instr->index()));
 | 
| +    if (instr->hydrogen()->length()->representation().IsTagged()) {
 | 
| +      __ cmp(ToOperand(instr->length()),
 | 
| +             Immediate(Smi::FromInt(constant_index)));
 | 
| +    } else {
 | 
| +      __ cmp(ToOperand(instr->length()), Immediate(constant_index));
 | 
| +    }
 | 
|      DeoptimizeIf(below_equal, instr->environment());
 | 
|    } else {
 | 
|      __ cmp(ToRegister(instr->index()), ToOperand(instr->length()));
 | 
| 
 |