[ic] Fix elements conversion in KeyedStoreGeneric

src/ic/keyed-store-generic.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/ic/keyed-store-generic.h"
 
 #include "src/compiler/code-assembler.h"
 #include "src/contexts.h"
 #include "src/isolate.h"
 
@@ skipping 121 matching lines @@
     var_target_map.Bind(LoadContextElement(
         native_context, Context::ArrayMapIndex(holey_to_kind)));
     Goto(&perform_transition);
   }
 
   // Found a supported transition target map, perform the transition!
   Bind(&perform_transition);
   {
     if (IsFastDoubleElementsKind(from_kind) !=
         IsFastDoubleElementsKind(to_kind)) {
-      Node* capacity = LoadFixedArrayBaseLength(elements);
+      Node* capacity = SmiUntag(LoadFixedArrayBaseLength(elements));
       GrowElementsCapacity(receiver, elements, from_kind, to_kind, capacity,
                            capacity, INTPTR_PARAMETERS, bailout);
     }
     StoreObjectField(receiver, JSObject::kMapOffset, var_target_map.value());
   }
 }
 
 void KeyedStoreGenericAssembler::TryChangeToHoleyMapHelper(
     Node* receiver, Node* receiver_map, Node* native_context,
     ElementsKind packed_kind, ElementsKind holey_kind, Label* done,
@@ skipping 387 matching lines @@
   Bind(&slow);
   {
     Comment("KeyedStoreGeneric_slow");
     TailCallRuntime(Runtime::kSetProperty, p->context, p->receiver, p->name,
                     p->value, SmiConstant(language_mode));
   }
 }
 
 }  // namespace internal
 }  // namespace v8