[ic] Fix elements conversion in KeyedStoreGeneric

src/ic/keyed-store-generic.cc

Index: src/ic/keyed-store-generic.cc
diff --git a/src/ic/keyed-store-generic.cc b/src/ic/keyed-store-generic.cc
index c068b9bed4d30d0d82fced9d0f7b49f3734d7349..30faba85e949ba4d5d758e1a068111720fa5d7ea 100644
--- a/src/ic/keyed-store-generic.cc
+++ b/src/ic/keyed-store-generic.cc
@@ -139,7 +139,7 @@ void KeyedStoreGenericAssembler::TryRewriteElements(
   {
     if (IsFastDoubleElementsKind(from_kind) !=
         IsFastDoubleElementsKind(to_kind)) {
-      Node* capacity = LoadFixedArrayBaseLength(elements);
+      Node* capacity = SmiUntag(LoadFixedArrayBaseLength(elements));
       GrowElementsCapacity(receiver, elements, from_kind, to_kind, capacity,
                            capacity, INTPTR_PARAMETERS, bailout);
     }