Handle non-JSObject heap objects using slow-path IC stub guarded by the map.

src/objects-inl.h

Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index c2dc7504d2d543e1f08397d9bf27473c3d0cf628..28144faca81c520fe571553e33115c846a5e8d5d 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -551,8 +551,7 @@ bool Object::IsJSReceiver() {
 
 bool Object::IsJSObject() {
   STATIC_ASSERT(LAST_JS_OBJECT_TYPE == LAST_TYPE);
-  return IsHeapObject() &&
-      HeapObject::cast(this)->map()->instance_type() >= FIRST_JS_OBJECT_TYPE;
+  return IsHeapObject() && HeapObject::cast(this)->map()->is_jsobject_map();
 }
 
 
@@ -3508,6 +3507,11 @@ void Map::set_non_instance_prototype(bool value) {
 }
 
 
+bool Map::is_jsobject_map() {
+  return instance_type() >= FIRST_JS_OBJECT_TYPE;
+}
+
+
 bool Map::has_non_instance_prototype() {
   return ((1 << kHasNonInstancePrototype) & bit_field()) != 0;
 }