[ic] Don't call LookupIterator::GetStoreTarget() when receiver is not a JSReceiver.

src/lookup.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_LOOKUP_H_
 #define V8_LOOKUP_H_
 
 #include "src/factory.h"
 #include "src/isolate.h"
 #include "src/objects.h"
@@ skipping 158 matching lines @@
   void NotFound() {
     has_property_ = false;
     state_ = NOT_FOUND;
   }
 
   Heap* heap() const { return isolate_->heap(); }
   Factory* factory() const { return isolate_->factory(); }
   Handle<Object> GetReceiver() const { return receiver_; }
 
   Handle<JSObject> GetStoreTarget() const {
+    DCHECK(receiver_->IsJSObject());
     if (receiver_->IsJSGlobalProxy()) {
       Map* map = JSGlobalProxy::cast(*receiver_)->map();
       if (map->has_hidden_prototype()) {
         return handle(JSGlobalObject::cast(map->prototype()), isolate_);
       }
     }
     return Handle<JSObject>::cast(receiver_);
   }
 
   bool is_dictionary_holder() const { return !holder_->HasFastProperties(); }
@@ skipping 177 matching lines @@
   const Handle<JSReceiver> initial_holder_;
   const uint32_t index_;
   uint32_t number_;
 };
 
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_LOOKUP_H_