[crankshaft] Properly deal with null prototype.

src/crankshaft/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/crankshaft/hydrogen.h"
 
 #include <memory>
 #include <sstream>
 
 #include "src/allocation-site-scopes.h"
@@ skipping 11334 matching lines @@
             (!to_string_tag.IsFound() || to_string_tag.IsData() ||
              to_string_tag.IsDataConstant()) &&
             value_of.CanAccessMonomorphic() && value_of.IsDataConstant() &&
             value_of.constant().is_identical_to(isolate()->object_value_of()) &&
             to_string.CanAccessMonomorphic() && to_string.IsDataConstant() &&
             to_string.constant().is_identical_to(
                 isolate()->object_to_string())) {
           // We depend on the prototype chain to stay the same, because we
           // also need to deoptimize when someone installs @@toPrimitive
           // or @@toStringTag somewhere in the prototype chain.
-          BuildCheckPrototypeMaps(handle(JSObject::cast(map->prototype())),
-                                  Handle<JSObject>::null());
+          Handle<Object> prototype(map->prototype(), isolate());
+          if (prototype->IsJSObject()) {
+            BuildCheckPrototypeMaps(Handle<JSObject>::cast(prototype),
+                                    Handle<JSObject>::null());
+          }
           AddCheckMap(left, map);
           AddCheckMap(right, map);
           // The caller expects a branch instruction, so make it happy.
           return New<HBranch>(
               graph()->GetConstantBool(op == Token::LTE || op == Token::GTE));
         }
       }
       Bailout(kUnsupportedNonPrimitiveCompare);
       return NULL;
     }
@@ skipping 1642 matching lines @@
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 }  // namespace internal
 }  // namespace v8