Extra code to diagnose a crash bug.

src/full-codegen/x64/full-codegen-x64.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_X64
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/codegen.h"
 #include "src/compiler.h"
@@ skipping 2244 matching lines @@
   // Sanity check: The loaded value must be a JS-exposed kind of object,
   // not something internal (like a Map, or FixedArray). Check this here
   // to chase after a rare but recurring crash bug. It seems to always
   // occur for functions beginning with "this.foo.bar()", so be selective
   // and only insert the check for the first LoadIC (identified by slot).
   // TODO(jkummerow): Remove this when it has generated a few crash reports.
   // Don't forget to remove the Push() above as well!
   if (FeedbackVector()->GetIndex(prop->PropertyFeedbackSlot()) == 6) {
     __ Pop(LoadDescriptor::ReceiverRegister());
 
-    Label ok;
+    Label ok, sound_alarm;
     __ JumpIfSmi(rax, &ok, Label::kNear);
     __ movp(rbx, FieldOperand(rax, HeapObject::kMapOffset));
-    __ CmpInstanceType(rbx, LAST_PRIMITIVE_TYPE);
-    __ j(below_equal, &ok, Label::kNear);
-    __ CmpInstanceType(rbx, FIRST_JS_RECEIVER_TYPE);
-    __ j(above_equal, &ok, Label::kNear);
+    __ CompareRoot(rbx, Heap::kMetaMapRootIndex);
+    __ j(equal, &sound_alarm);
+    __ CompareRoot(rbx, Heap::kFixedArrayMapRootIndex);
+    __ j(not_equal, &ok, Label::kNear);
 
+    __ bind(&sound_alarm);
     __ Push(Smi::FromInt(0xaabbccdd));
     __ Push(LoadDescriptor::ReceiverRegister());
     __ movp(rbx, FieldOperand(LoadDescriptor::ReceiverRegister(),
                               HeapObject::kMapOffset));
     __ Push(rbx);
     __ movp(rbx, FieldOperand(LoadDescriptor::ReceiverRegister(),
                               JSObject::kPropertiesOffset));
     __ Push(rbx);
     __ int3();
 
@@ skipping 2921 matching lines @@
             Assembler::target_address_at(call_target_address,
                                          unoptimized_code));
   return OSR_AFTER_STACK_CHECK;
 }
 
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_X64