Fix receiver check in arguments ICs.

Fix receiver check in arguments ICs.

The receiver needs to be checked in the same way as all other KeyedLoadICs to take non-JSObject and objects that require access checks or has interceptors into account.

R=sgjesse@chromium.org
BUG=87478
TEST=mjsunit/regress/regress-crbug-87478.js

Committed: http://code.google.com/p/v8/source/detail?r=8429

[Søren Thygesen Gjesse, 2011-06-27 13:00:26]

LGTM

http://codereview.chromium.org/7259015/diff/1/test/mjsunit/regress/regress-cr...
File test/mjsunit/regress/regress-crbug-87478.js (right):

http://codereview.chromium.org/7259015/diff/1/test/mjsunit/regress/regress-cr...
test/mjsunit/regress/regress-crbug-87478.js:31: function args(a) { return
arguments; }
Maybe add a comment here that this puts the array[0] IC above into arguments IC
state.