Allow HPhis to have an invalid merge index.

src/mips/lithium-mips.cc

Index: src/mips/lithium-mips.cc
diff --git a/src/mips/lithium-mips.cc b/src/mips/lithium-mips.cc
index 38ac19f609c2d8e4294b73a32f86efa78ae81db7..d998a3c576e1d248a8724c142342b7a158f37ff6 100644
--- a/src/mips/lithium-mips.cc
+++ b/src/mips/lithium-mips.cc
@@ -818,7 +818,11 @@ void LChunkBuilder::DoBasicBlock(HBasicBlock* block, HBasicBlock* next_block) {
     HEnvironment* last_environment = pred->last_environment();
     for (int i = 0; i < block->phis()->length(); ++i) {
       HPhi* phi = block->phis()->at(i);
-      if (phi->merged_index() < last_environment->length()) {
+      // TODO(mstarzinger): The length check below should actually not
+      // be necessary, but some array stubs already rely on it. This
+      // should be investigated and fixed.
+      if (phi->HasMergedIndex() &&
+          phi->merged_index() < last_environment->length()) {
         last_environment->SetValueAt(phi->merged_index(), phi);
       }
     }