Fix missing smi check in inlined indexOf/lastIndexOf.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <algorithm>
 
 #include "src/v8.h"
 #include "src/allocation-site-scopes.h"
@@ skipping 8520 matching lines @@
         HValue* search_number = Add<HLoadNamedField>(
             search_element, isheapnumber,
             HObjectAccess::ForHeapNumberValue());
         LoopBuilder loop(this, context(), direction);
         {
           HValue* index = loop.BeginBody(initial, terminating, token);
           HValue* element = AddUncasted<HLoadKeyed>(
               elements, index, static_cast<HValue*>(NULL),
               kind, ALLOW_RETURN_HOLE);
           IfBuilder if_issame(this);
-          HCompareMap* issame = if_issame.If<HCompareMap>(
+          if_issame.IfNot<HIsSmiAndBranch>(element);
+          HCompareMap* issame = if_issame.AndIf<HCompareMap>(
               element, isolate()->factory()->heap_number_map());
           if_issame.And();
           HValue* number = Add<HLoadNamedField>(
               element, issame, HObjectAccess::ForHeapNumberValue());
           if_issame.If<HCompareNumericAndBranch>(
               number, search_number, Token::EQ_STRICT);
           if_issame.Then();
           {
             Drop(1);
             Push(index);
@@ skipping 3587 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal