Check whether the receiver to a keyed-call is actually a heapobject.

test/mjsunit/regress/regress-crbug-325225.js

Index: test/mjsunit/regress/regress-crbug-325225.js
diff --git a/test/mjsunit/compiler/osr-uint32.js b/test/mjsunit/regress/regress-crbug-325225.js
similarity index 88%
copy from test/mjsunit/compiler/osr-uint32.js
copy to test/mjsunit/regress/regress-crbug-325225.js
index d6fcae546cfa82dbb7a32ca7baa5b4339c86ba77..2bc9f5c38243a466d06afac027fbcf63f2c2435d 100644
--- a/test/mjsunit/compiler/osr-uint32.js
+++ b/test/mjsunit/regress/regress-crbug-325225.js
@@ -25,15 +25,22 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Loop to force OSR.
-var j = 0;
-for (var i = 0; i < 80000; i++) {
-    j++;
+function f1(a) {
+  a[0](0);
 }
 
-function SarShr(val) {
-  return val >> (-2 >>> 0);
+function do1() {
+  f1([f1]);
 }
 
-var K3 = 0x80000000;
-assertEquals(-2, SarShr(K3 | 0));
+assertThrows(do1);

[Dmitry Lomov (no reviews), 2013/12/03 17:57:01]

assertThrows(do1, TypeError)

+
+function f2(a) {
+  a[0](true);
+}
+
+function do2() {
+  f2([function(a) { return f2("undefined", typeof f2(42, 0)); }]);
+}
+
+assertThrows(do2);

[Dmitry Lomov (no reviews), 2013/12/03 17:57:01]

Ditto.