Fix keyed element access wrt string wrappers

src/ic/mips/ic-mips.cc

Index: src/ic/mips/ic-mips.cc
diff --git a/src/ic/mips/ic-mips.cc b/src/ic/mips/ic-mips.cc
index 5a6f95a231e5c257c4381a8bb9fa7871bd412125..0c0063a743fc2d389de2507afda301f8643c79bf 100644
--- a/src/ic/mips/ic-mips.cc
+++ b/src/ic/mips/ic-mips.cc
@@ -656,8 +656,11 @@ void KeyedStoreIC::GenerateMegamorphic(MacroAssembler* masm,
   // Check if the object is a JS array or not.
   __ lbu(t0, FieldMemOperand(receiver_map, Map::kInstanceTypeOffset));
   __ Branch(&array, eq, t0, Operand(JS_ARRAY_TYPE));
-  // Check that the object is some kind of JSObject.
-  __ Branch(&slow, lt, t0, Operand(FIRST_JS_OBJECT_TYPE));
+  // Check that the object is some kind of JS object EXCEPT JS Value type. In
+  // the case that the object is a value-wrapper object, we enter the runtime
+  // system to make sure that indexing into string objects works as intended.
+  DCHECK(JS_VALUE_TYPE < JS_OBJECT_TYPE);
+  __ Branch(&slow, lt, t0, Operand(JS_OBJECT_TYPE));

[Jakob Kummerow, 2015/07/13 15:00:58]

s/lt/lo/ for unsigned comparison

 
   // Object case: Check key against length in the elements array.
   __ lw(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));