Index: src/ia32/ic-ia32.cc |
diff --git a/src/ia32/ic-ia32.cc b/src/ia32/ic-ia32.cc |
index 090ea401a4a26524afcc4aeceac5099899a4c217..7c5ca967a728309ff7f80d1984efbb4a1aef5cea 100644 |
--- a/src/ia32/ic-ia32.cc |
+++ b/src/ia32/ic-ia32.cc |
@@ -78,11 +78,11 @@ static void GenerateStringDictionaryReceiverCheck(MacroAssembler* masm, |
// Check that the receiver is a valid JS object. |
__ mov(r1, FieldOperand(receiver, HeapObject::kMapOffset)); |
__ movzx_b(r0, FieldOperand(r1, Map::kInstanceTypeOffset)); |
- __ cmp(r0, FIRST_JS_OBJECT_TYPE); |
+ __ cmp(r0, FIRST_OBJECT_OR_FUNCTION_CLASS_TYPE); |
__ j(below, miss); |
// If this assert fails, we have to check upper bound too. |
- ASSERT(LAST_TYPE == JS_FUNCTION_TYPE); |
+ ASSERT(LAST_TYPE == LAST_OBJECT_OR_FUNCTION_CLASS_TYPE); |
GenerateGlobalInstanceTypeCheck(masm, r0, miss); |
@@ -728,8 +728,12 @@ void KeyedStoreIC::GenerateGeneric(MacroAssembler* masm, |
__ CmpInstanceType(edi, JS_ARRAY_TYPE); |
__ j(equal, &array); |
// Check that the object is some kind of JS object. |
- __ CmpInstanceType(edi, FIRST_JS_OBJECT_TYPE); |
+ __ CmpInstanceType(edi, FIRST_JS_RECEIVER_TYPE); |
__ j(below, &slow); |
+ __ CmpInstanceType(edi, JS_PROXY_TYPE); |
+ __ j(equal, &slow); |
+ __ CmpInstanceType(edi, JS_FUNCTION_PROXY_TYPE); |
+ __ j(equal, &slow); |
// Object case: Check key against length in the elements array. |
// eax: value |