[ic] Don't call LookupIterator::GetStoreTarget() when receiver is not a JSReceiver.

test/cctest/test-api-interceptors.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 
 #include "test/cctest/test-api.h"
 
 #include "include/v8-util.h"
 #include "src/api.h"
@@ skipping 3274 matching lines @@
   v8::HandleScope scope(context->GetIsolate());
   Local<FunctionTemplate> templ = FunctionTemplate::New(context->GetIsolate());
   AddInterceptor(templ, EmptyInterceptorGetter, EmptyInterceptorSetter);
   context->Global()
       ->Set(context.local(), v8_str("Bug"),
             templ->GetFunction(context.local()).ToLocalChecked())
       .FromJust();
   CompileRun("Number.prototype.__proto__ = new Bug; var x = 0; x.foo();");
 }
 
+THREADED_TEST(Regress625155) {
+  LocalContext context;
+  v8::HandleScope scope(context->GetIsolate());
+  Local<FunctionTemplate> templ = FunctionTemplate::New(context->GetIsolate());
+  AddInterceptor(templ, EmptyInterceptorGetter, EmptyInterceptorSetter);
+  context->Global()
+      ->Set(context.local(), v8_str("Bug"),
+            templ->GetFunction(context.local()).ToLocalChecked())
+      .FromJust();
+  CompileRun(
+      "Number.prototype.__proto__ = new Bug;"
+      "var x;"
+      "x = 0xdead;"
+      "x.boom = 0;"
+      "x = 's';"
+      "x.boom = 0;"
+      "x = 1.5;"
+      "x.boom = 0;");
+}
 
 THREADED_TEST(Regress125988) {
   v8::HandleScope scope(CcTest::isolate());
   Local<FunctionTemplate> intercept = FunctionTemplate::New(CcTest::isolate());
   AddInterceptor(intercept, EmptyInterceptorGetter, EmptyInterceptorSetter);
   LocalContext env;
   env->Global()
       ->Set(env.local(), v8_str("Intercept"),
             intercept->GetFunction(env.local()).ToLocalChecked())
       .FromJust();
@@ skipping 648 matching lines @@
             ->Set(env.local(), v8_str("Fun"),
                   fun_templ->GetFunction(env.local()).ToLocalChecked())
             .FromJust());
 
   CompileRun(
       "var f = new Fun();"
       "Number.prototype.__proto__ = f;"
       "var a = 42;"
       "for (var i = 0; i<3; i++) { a.foo; }");
 }