Correctly handle instances without elements in polymorphic keyed load/store.

src/stub-cache.cc

Index: src/stub-cache.cc
diff --git a/src/stub-cache.cc b/src/stub-cache.cc
index e8b94f104f87c689d5ff0c0e60a460ab6cf24de9..2aa139825f8409bce8285dbc01b50cfa3b55afb5 100644
--- a/src/stub-cache.cc
+++ b/src/stub-cache.cc
@@ -1668,6 +1668,8 @@ void KeyedLoadStubCompiler::CompileElementHandlers(MapHandleList* receiver_maps,
 
     if ((receiver_map->instance_type() & kNotStringTag) == 0) {
       cached_stub = isolate()->builtins()->KeyedLoadIC_String();
+    } else if (receiver_map->instance_type() < FIRST_JS_RECEIVER_TYPE) {
+      cached_stub = isolate()->builtins()->KeyedLoadIC_Slow();
     } else {
       bool is_js_array = receiver_map->instance_type() == JS_ARRAY_TYPE;
       ElementsKind elements_kind = receiver_map->elements_kind();
@@ -1712,6 +1714,8 @@ Handle<Code> KeyedStoreStubCompiler::CompileStoreElementPolymorphic(
           transitioned_map->elements_kind(),
           is_js_array,
           store_mode()).GetCode(isolate());
+    } else if (receiver_map->instance_type() < FIRST_JS_RECEIVER_TYPE) {
+      cached_stub = isolate()->builtins()->KeyedStoreIC_Slow();
     } else {
       if (receiver_map->has_fast_elements() ||
           receiver_map->has_external_array_elements()) {