Fix a potential crash bug in keyed calls for non-string keys.

src/ia32/ic-ia32.cc

Index: src/ia32/ic-ia32.cc
===================================================================
--- src/ia32/ic-ia32.cc	(revision 6762)
+++ src/ia32/ic-ia32.cc	(working copy)
@@ -108,6 +108,9 @@
                                            Register name,
                                            Register r0,
                                            Register r1) {
+  // Assert that name contains a string.
+  if (FLAG_debug_code) __ AbortIfNotString(name);
+
   // Compute the capacity mask.
   const int kCapacityOffset =
       StringDictionary::kHeaderSize +
@@ -1208,7 +1211,14 @@
   //  -- esp[(argc + 1) * 4] : receiver
   // -----------------------------------
 
+  // Check if the name is a string.
+  Label miss;
+  __ test(ecx, Immediate(kSmiTagMask));
+  __ j(zero, &miss);
+  Condition cond = masm->IsObjectStringType(ecx, eax, eax);
+  __ j(NegateCondition(cond), &miss);
   GenerateCallNormal(masm, argc);
+  __ bind(&miss);
   GenerateMiss(masm, argc);
 }