Fix receiver check in arguments ICs.

src/arm/ic-arm.cc

Index: src/arm/ic-arm.cc
diff --git a/src/arm/ic-arm.cc b/src/arm/ic-arm.cc
index 09e2c5b468046d95b147594e1bd0952a8a708e6d..676baeb35fb8f220712e2a613fa3c8063e7c20ca 100644
--- a/src/arm/ic-arm.cc
+++ b/src/arm/ic-arm.cc
@@ -892,8 +892,13 @@ static MemOperand GenerateMappedArgumentsLookup(MacroAssembler* masm,
                                                 Label* slow_case) {
   Heap* heap = masm->isolate()->heap();
 
-  // Check that the receiver isn't a smi.
+  // Check that the receiver is a JSObject. Because of the map check
+  // later, we do not need to check for interceptors or whether it
+  // requires access checks.
   __ JumpIfSmi(object, slow_case);
+  // Check that the object is some kind of JSObject.
+  __ CompareObjectType(object, scratch1, scratch2, FIRST_JS_RECEIVER_TYPE);
+  __ b(lt, slow_case);
 
   // Check that the key is a positive smi.
   __ tst(key, Operand(0x8000001));