Fix instance type check in apply optimization....

test/mjsunit/arguments-apply.js

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 62 matching lines @@
   return ReturnReceiver.apply(receiver, arguments);
 }
 
 assertEquals(42, NonObjectReceiver(42));
 assertEquals("object", typeof NonObjectReceiver(42));
 assertTrue(NonObjectReceiver(42) instanceof Number);
 assertTrue(this === NonObjectReceiver(null));
 assertTrue(this === NonObjectReceiver(void 0));
 
 
+function FunctionReceiver() {
+  return ReturnReceiver.apply(Object, arguments);
+}
+
+assertTrue(Object === FunctionReceiver());
+
+
 function ShadowApply() {
   function f() { return 42; }
   f.apply = function() { return 87; }
   return f.apply(this, arguments);
 }
 
 assertEquals(87, ShadowApply());
 assertEquals(87, ShadowApply(1));
 assertEquals(87, ShadowApply(1, 2));
 
@@ skipping 25 matching lines @@
 
 assertEquals(0, ShadowArgumentsWithConstant().length);
 assertEquals(0, ShadowArgumentsWithConstant(1).length);
 assertEquals(0, ShadowArgumentsWithConstant(1, 2).length);
 
 
 // Make sure we can deal with unfolding lots of arguments on the
 // stack even in the presence of the apply optimizations.
 var array = new Array(2048);
 assertEquals(2048, Global.apply(this, array).length);