[ic] Don't call LookupIterator::GetStoreTarget() when receiver is not a JSReceiver.

test/cctest/test-api-interceptors.cc

Index: test/cctest/test-api-interceptors.cc
diff --git a/test/cctest/test-api-interceptors.cc b/test/cctest/test-api-interceptors.cc
index 1108c878594d1a1afc1d5c6e730da0247014725b..3e2d8dc5be77cb03c5d3335adc54a503aa25dba3 100644
--- a/test/cctest/test-api-interceptors.cc
+++ b/test/cctest/test-api-interceptors.cc
@@ -3292,6 +3292,25 @@ THREADED_TEST(Regress149912) {
   CompileRun("Number.prototype.__proto__ = new Bug; var x = 0; x.foo();");
 }
 
+THREADED_TEST(Regress625155) {
+  LocalContext context;
+  v8::HandleScope scope(context->GetIsolate());
+  Local<FunctionTemplate> templ = FunctionTemplate::New(context->GetIsolate());
+  AddInterceptor(templ, EmptyInterceptorGetter, EmptyInterceptorSetter);
+  context->Global()
+      ->Set(context.local(), v8_str("Bug"),
+            templ->GetFunction(context.local()).ToLocalChecked())
+      .FromJust();
+  CompileRun(
+      "Number.prototype.__proto__ = new Bug;"
+      "var x;"
+      "x = 0xdead;"
+      "x.boom = 0;"
+      "x = 's';"
+      "x.boom = 0;"
+      "x = 1.5;"
+      "x.boom = 0;");
+}
 
 THREADED_TEST(Regress125988) {
   v8::HandleScope scope(CcTest::isolate());