| Index: src/ia32/ic-ia32.cc
 | 
| diff --git a/src/ia32/ic-ia32.cc b/src/ia32/ic-ia32.cc
 | 
| index 090ea401a4a26524afcc4aeceac5099899a4c217..7c5ca967a728309ff7f80d1984efbb4a1aef5cea 100644
 | 
| --- a/src/ia32/ic-ia32.cc
 | 
| +++ b/src/ia32/ic-ia32.cc
 | 
| @@ -78,11 +78,11 @@ static void GenerateStringDictionaryReceiverCheck(MacroAssembler* masm,
 | 
|    // Check that the receiver is a valid JS object.
 | 
|    __ mov(r1, FieldOperand(receiver, HeapObject::kMapOffset));
 | 
|    __ movzx_b(r0, FieldOperand(r1, Map::kInstanceTypeOffset));
 | 
| -  __ cmp(r0, FIRST_JS_OBJECT_TYPE);
 | 
| +  __ cmp(r0, FIRST_OBJECT_OR_FUNCTION_CLASS_TYPE);
 | 
|    __ j(below, miss);
 | 
|  
 | 
|    // If this assert fails, we have to check upper bound too.
 | 
| -  ASSERT(LAST_TYPE == JS_FUNCTION_TYPE);
 | 
| +  ASSERT(LAST_TYPE == LAST_OBJECT_OR_FUNCTION_CLASS_TYPE);
 | 
|  
 | 
|    GenerateGlobalInstanceTypeCheck(masm, r0, miss);
 | 
|  
 | 
| @@ -728,8 +728,12 @@ void KeyedStoreIC::GenerateGeneric(MacroAssembler* masm,
 | 
|    __ CmpInstanceType(edi, JS_ARRAY_TYPE);
 | 
|    __ j(equal, &array);
 | 
|    // Check that the object is some kind of JS object.
 | 
| -  __ CmpInstanceType(edi, FIRST_JS_OBJECT_TYPE);
 | 
| +  __ CmpInstanceType(edi, FIRST_JS_RECEIVER_TYPE);
 | 
|    __ j(below, &slow);
 | 
| +  __ CmpInstanceType(edi, JS_PROXY_TYPE);
 | 
| +  __ j(equal, &slow);
 | 
| +  __ CmpInstanceType(edi, JS_FUNCTION_PROXY_TYPE);
 | 
| +  __ j(equal, &slow);
 | 
|  
 | 
|    // Object case: Check key against length in the elements array.
 | 
|    // eax: value
 | 
| 
 |