Handle indexed properties on value objects correctly.

src/arguments.h

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 60 matching lines @@
   Object** arguments_;
 };
 
 
 // Custom arguments replicate a small segment of stack that can be
 // accessed through an Arguments object the same way the actual stack
 // can.
 class CustomArguments : public Relocatable {
  public:
   inline CustomArguments(Object* data,
-                         JSObject* self,
+                         Object* self,
                          JSObject* holder) {
     values_[2] = self;
     values_[1] = holder;
     values_[0] = data;
   }
 
   inline CustomArguments() {
 #ifdef DEBUG
     for (size_t i = 0; i < ARRAY_SIZE(values_); i++) {
       values_[i] = reinterpret_cast<Object*>(kZapValue);
     }
 #endif
   }
 
   void IterateInstance(ObjectVisitor* v);
   Object** end() { return values_ + ARRAY_SIZE(values_) - 1; }
  private:
   Object* values_[3];
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_ARGUMENTS_H_