Fix keyed element access wrt string wrappers

src/ic/arm/ic-arm.cc

Index: src/ic/arm/ic-arm.cc
diff --git a/src/ic/arm/ic-arm.cc b/src/ic/arm/ic-arm.cc
index a3b74ce9f3477b307f1d7524d8d4ab5d034fe451..c85c6751a28ca7c355519769332c195a3e1468d1 100644
--- a/src/ic/arm/ic-arm.cc
+++ b/src/ic/arm/ic-arm.cc
@@ -658,9 +658,12 @@ void KeyedStoreIC::GenerateMegamorphic(MacroAssembler* masm,
   __ ldrb(r4, FieldMemOperand(receiver_map, Map::kInstanceTypeOffset));
   __ cmp(r4, Operand(JS_ARRAY_TYPE));
   __ b(eq, &array);
-  // Check that the object is some kind of JSObject.
-  __ cmp(r4, Operand(FIRST_JS_OBJECT_TYPE));
-  __ b(lt, &slow);
+  // Check that the object is some kind of JS object EXCEPT JS Value type. In
+  // the case that the object is a value-wrapper object, we enter the runtime
+  // system to make sure that indexing into string objects works as intended.
+  STATIC_ASSERT(JS_VALUE_TYPE < JS_OBJECT_TYPE);
+  __ cmp(r4, Operand(JS_OBJECT_TYPE));
+  __ b(lo, &slow);
 
   // Object case: Check key against length in the elements array.
   __ ldr(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));