Fix storing to primitive objects by applying ToObject. This is necessary to ensure that we properly…

src/ic.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "v8.h"
 
 #include "accessors.h"
 #include "api.h"
 #include "arguments.h"
 #include "codegen.h"
@@ skipping 1257 matching lines @@
     return TypeError("non_object_property_store", object, name);
   }
 
   // The length property of string values is read-only. Throw in strict mode.
   if (strict_mode() == STRICT && object->IsString() &&
       String::Equals(isolate()->factory()->length_string(), name)) {
     return TypeError("strict_read_only_property", object, name);
   }
 
   // Ignore other stores where the receiver is not a JSObject.
-  // TODO(1475): Must check prototype chains of object wrappers.
-  if (!object->IsJSObject()) return value;
+  if (!object->IsJSObject()) {
+    // Proxies are already handled above.
+    ASSERT(!object->IsJSReceiver());
+    Handle<JSReceiver> receiver;
+    Handle<Context> native_context(isolate()->context()->native_context());
+    if (Object::ToObject(
+            isolate(), object, native_context).ToHandle(&receiver)) {
+      Handle<Object> result;
+      ASSIGN_RETURN_ON_EXCEPTION(
+          isolate(),
+          result,
+          JSReceiver::SetProperty(
+              receiver, name, value, NONE, strict_mode(), store_mode),
+          Object);
+    }
+    return value;
+  }
 
   Handle<JSObject> receiver = Handle<JSObject>::cast(object);
 
   // Check if the given name is an array index.
   uint32_t index;
   if (name->AsArrayIndex(&index)) {
     Handle<Object> result;
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate(),
         result,
@@ skipping 1752 matching lines @@
 #undef ADDR
 };
 
 
 Address IC::AddressFromUtilityId(IC::UtilityId id) {
   return IC_utilities[id];
 }
 
 
 } }  // namespace v8::internal