| Index: src/x64/ic-x64.cc
|
| diff --git a/src/x64/ic-x64.cc b/src/x64/ic-x64.cc
|
| index f05e6a2479ee21befc8c8d241912e975ab8dd0e0..77dd6767881602da687ad7c9f8cdcd1c62df70fb 100644
|
| --- a/src/x64/ic-x64.cc
|
| +++ b/src/x64/ic-x64.cc
|
| @@ -76,11 +76,11 @@ static void GenerateStringDictionaryReceiverCheck(MacroAssembler* masm,
|
| // Check that the receiver is a valid JS object.
|
| __ movq(r1, FieldOperand(receiver, HeapObject::kMapOffset));
|
| __ movb(r0, FieldOperand(r1, Map::kInstanceTypeOffset));
|
| - __ cmpb(r0, Immediate(FIRST_JS_OBJECT_TYPE));
|
| + __ cmpb(r0, Immediate(FIRST_OBJECT_OR_FUNCTION_CLASS_TYPE));
|
| __ j(below, miss);
|
|
|
| // If this assert fails, we have to check upper bound too.
|
| - ASSERT(LAST_TYPE == JS_FUNCTION_TYPE);
|
| + ASSERT(LAST_TYPE == LAST_OBJECT_OR_FUNCTION_CLASS_TYPE);
|
|
|
| GenerateGlobalInstanceTypeCheck(masm, r0, miss);
|
|
|
| @@ -731,8 +731,12 @@ void KeyedStoreIC::GenerateGeneric(MacroAssembler* masm,
|
| __ CmpInstanceType(rbx, JS_ARRAY_TYPE);
|
| __ j(equal, &array);
|
| // Check that the object is some kind of JS object.
|
| - __ CmpInstanceType(rbx, FIRST_JS_OBJECT_TYPE);
|
| + __ CmpInstanceType(rbx, FIRST_JS_RECEIVER_TYPE);
|
| __ j(below, &slow);
|
| + __ CmpInstanceType(rbx, JS_PROXY_TYPE);
|
| + __ j(equal, &slow);
|
| + __ CmpInstanceType(rbx, JS_FUNCTION_PROXY_TYPE);
|
| + __ j(equal, &slow);
|
|
|
| // Object case: Check key against length in the elements array.
|
| // rax: value
|
|
|