Fix receiver check in arguments ICs.

src/x64/ic-x64.cc

Index: src/x64/ic-x64.cc
diff --git a/src/x64/ic-x64.cc b/src/x64/ic-x64.cc
index fe61cd9ca59e3be4894d727dba5080adca390d5c..8919765cbcdef48f2fc186c0d73192a04d96bdbe 100644
--- a/src/x64/ic-x64.cc
+++ b/src/x64/ic-x64.cc
@@ -1208,8 +1208,13 @@ static Operand GenerateMappedArgumentsLookup(MacroAssembler* masm,
                                              Label* slow_case) {
   Heap* heap = masm->isolate()->heap();
 
-  // Check that the receiver isn't a smi.
+  // Check that the receiver is a JSObject. Because of the elements
+  // map check later, we do not need to check for interceptors or
+  // whether it requires access checks.
   __ JumpIfSmi(object, slow_case);
+  // Check that the object is some kind of JSObject.
+  __ CmpObjectType(object, FIRST_JS_RECEIVER_TYPE, scratch1);
+  __ j(below, slow_case);
 
   // Check that the key is a positive smi.
   Condition check = masm->CheckNonNegativeSmi(key);