[builtins] fix mapcheck in Array.includes fast-case when searching for String

[builtins] fix mapcheck in Array.includes fast-case when searching for String

Use LoadInstanceType() rather than LoadMapInstanceType(), as this part of the
code is operating on a JS-accessible HeapObject rather than a Map.

BUG=chromium:633883, v8:5162
R=mstarzinger@chromium.org, bmeurer@chromium.org

Committed: https://crrev.com/c4ee3d94740f865f485173f4a3a194b6973f2d34
Cr-Commit-Position: refs/heads/master@{#38297}

[caitp, 2016-08-03 12:58:50]

PTAL

I have no idea why I was not able to reproduce this on an x64 build.

[caitp, 2016-08-03 13:06:56]

The CQ bit was checked by caitp@igalia.com to run a CQ dry run

[commit-bot: I haz the power, 2016-08-03 13:07:03]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Michael Starzinger, 2016-08-03 13:31:52]

LGTM.

[commit-bot: I haz the power, 2016-08-03 14:14:00]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-03 14:14:01]

Dry run: This issue passed the CQ dry run.

[caitp, 2016-08-03 14:25:18]

The CQ bit was checked by caitp@igalia.com

[commit-bot: I haz the power, 2016-08-03 14:25:31]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-03 14:26:48]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-08-03 14:27:53]

Description was changed from

==========
[builtins] fix mapcheck in Array.includes fast-case when searching for String

Use LoadInstanceType() rather than LoadMapInstanceType(), as this part of the
code is operating on a JS-accessible HeapObject rather than a Map.

BUG=chromium:633883, v8:5162
R=mstarzinger@chromium.org, bmeurer@chromium.org
==========

to

==========
[builtins] fix mapcheck in Array.includes fast-case when searching for String

Use LoadInstanceType() rather than LoadMapInstanceType(), as this part of the
code is operating on a JS-accessible HeapObject rather than a Map.

BUG=chromium:633883, v8:5162
R=mstarzinger@chromium.org, bmeurer@chromium.org

Committed: https://crrev.com/c4ee3d94740f865f485173f4a3a194b6973f2d34
Cr-Commit-Position: refs/heads/master@{#38297}
==========

[commit-bot: I haz the power, 2016-08-03 14:27:54]

Patchset 1 (id:??) landed as
https://crrev.com/c4ee3d94740f865f485173f4a3a194b6973f2d34
Cr-Commit-Position: refs/heads/master@{#38297}