Fix keyed element access wrt string wrappers

src/ic/arm/ic-arm.cc

Index: src/ic/arm/ic-arm.cc
diff --git a/src/ic/arm/ic-arm.cc b/src/ic/arm/ic-arm.cc
index a3b74ce9f3477b307f1d7524d8d4ab5d034fe451..9ad02d4c472e7992cebffa7e4576ca61cd14e40f 100644
--- a/src/ic/arm/ic-arm.cc
+++ b/src/ic/arm/ic-arm.cc
@@ -658,8 +658,11 @@ void KeyedStoreIC::GenerateMegamorphic(MacroAssembler* masm,
   __ ldrb(r4, FieldMemOperand(receiver_map, Map::kInstanceTypeOffset));
   __ cmp(r4, Operand(JS_ARRAY_TYPE));
   __ b(eq, &array);
-  // Check that the object is some kind of JSObject.
-  __ cmp(r4, Operand(FIRST_JS_OBJECT_TYPE));
+  // Check that the object is some kind of JS object EXCEPT JS Value type. In
+  // the case that the object is a value-wrapper object, we enter the runtime
+  // system to make sure that indexing into string objects works as intended.
+  DCHECK(JS_VALUE_TYPE < JS_OBJECT_TYPE);
+  __ cmp(r4, Operand(JS_OBJECT_TYPE));
   __ b(lt, &slow);

[Jakob Kummerow, 2015/07/13 15:00:58]

s/lt/lo/ for unsigned comparison

 
   // Object case: Check key against length in the elements array.