Merge 6006:6095 from bleeding_edge to experimental/gc branch.

src/arm/codegen-arm.cc

Index: src/arm/codegen-arm.cc
===================================================================
--- src/arm/codegen-arm.cc	(revision 6095)
+++ src/arm/codegen-arm.cc	(working copy)
@@ -5602,6 +5602,12 @@
   __ tst(tmp2, Operand(kSmiTagMask));
   deferred->Branch(nz);
 
+  // Check that both indices are valid.
+  __ ldr(tmp2, FieldMemOperand(object, JSArray::kLengthOffset));
+  __ cmp(tmp2, index1);
+  __ cmp(tmp2, index2, hi);
+  deferred->Branch(ls);
+
   // Bring the offsets into the fixed array in tmp1 into index1 and
   // index2.
   __ mov(tmp2, Operand(FixedArray::kHeaderSize - kHeapObjectTag));
@@ -6475,7 +6481,7 @@
     case Token::INSTANCEOF: {
       Load(left);
       Load(right);
-      InstanceofStub stub;
+      InstanceofStub stub(InstanceofStub::kNoFlags);
       frame_->CallStub(&stub, 2);
       // At this point if instanceof succeeded then r0 == 0.
       __ tst(r0, Operand(r0));