Fix keyed element access wrt string wrappers

src/arm/macro-assembler-arm.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <limits.h>  // For LONG_MIN, LONG_MAX.
 
 #include "src/v8.h"
 
 #if V8_TARGET_ARCH_ARM
 
@@ skipping 3773 matching lines @@
 
 
 void MacroAssembler::JumpIfDictionaryInPrototypeChain(
     Register object,
     Register scratch0,
     Register scratch1,
     Label* found) {
   DCHECK(!scratch1.is(scratch0));
   Factory* factory = isolate()->factory();
   Register current = scratch0;
-  Label loop_again;
+  Label loop_again, end;
 
   // scratch contained elements pointer.
   mov(current, object);
+  ldr(current, FieldMemOperand(current, HeapObject::kMapOffset));
+  ldr(current, FieldMemOperand(current, Map::kPrototypeOffset));
+  cmp(current, Operand(factory->null_value()));

[Jakob Kummerow, 2015/07/13 15:00:58]

why not CompareRoot()?

+  b(eq, &end);
 
   // Loop based on the map going up the prototype chain.
   bind(&loop_again);
   ldr(current, FieldMemOperand(current, HeapObject::kMapOffset));
+
+  DCHECK(JS_PROXY_TYPE < JS_OBJECT_TYPE);
+  DCHECK(JS_VALUE_TYPE < JS_OBJECT_TYPE);
+  ldrb(scratch1, FieldMemOperand(current, Map::kInstanceTypeOffset));
+  cmp(r4, Operand(JS_OBJECT_TYPE));

[Jakob Kummerow, 2015/07/13 15:00:58]

s/r4/scratch1/

Why don't tests catch this?

+  b(lt, found);
+
   ldr(scratch1, FieldMemOperand(current, Map::kBitField2Offset));
   DecodeField<Map::ElementsKindBits>(scratch1);
   cmp(scratch1, Operand(DICTIONARY_ELEMENTS));
   b(eq, found);
   ldr(current, FieldMemOperand(current, Map::kPrototypeOffset));
   cmp(current, Operand(factory->null_value()));
   b(ne, &loop_again);
+
+  bind(&end);
 }
 
 
 #ifdef DEBUG
 bool AreAliased(Register reg1,
                 Register reg2,
                 Register reg3,
                 Register reg4,
                 Register reg5,
                 Register reg6,
@@ skipping 81 matching lines @@
     }
   }
   if (mag.shift > 0) mov(result, Operand(result, ASR, mag.shift));
   add(result, result, Operand(dividend, LSR, 31));
 }
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_ARM