Fix keyed element access wrt string wrappers

src/ic/arm64/ic-arm64.cc

Index: src/ic/arm64/ic-arm64.cc
diff --git a/src/ic/arm64/ic-arm64.cc b/src/ic/arm64/ic-arm64.cc
index 13dd3913aedecfa1269663903c6702e71bda2d4e..1a9037e08defae0f513db7a0d3f0df53dbb9eeec 100644
--- a/src/ic/arm64/ic-arm64.cc
+++ b/src/ic/arm64/ic-arm64.cc
@@ -657,8 +657,11 @@ void KeyedStoreIC::GenerateMegamorphic(MacroAssembler* masm,
   Register instance_type = x10;
   __ CompareInstanceType(receiver_map, instance_type, JS_ARRAY_TYPE);
   __ B(eq, &array);
-  // Check that the object is some kind of JSObject.
-  __ Cmp(instance_type, FIRST_JS_OBJECT_TYPE);
+  // Check that the object is some kind of JS object EXCEPT JS Value type. In
+  // the case that the object is a value-wrapper object, we enter the runtime
+  // system to make sure that indexing into string objects works as intended.
+  DCHECK(JS_VALUE_TYPE < JS_OBJECT_TYPE);
+  __ Cmp(instance_type, JS_OBJECT_TYPE);
   __ B(lt, &slow);

[Jakob Kummerow, 2015/07/13 15:00:58]

s/lt/lo/ for unsigned comparison

 
   // Object case: Check key against length in the elements array.