Fix a few bugs in array bound checking