Ensure the receiver for EnableAccessCheck is always a JSObject

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index 42adde31c264b57093a8e2d074cbb253f6e128e0..dcb41b3dc6ae0709e6d29a877147ca752353cae6 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -2084,13 +2084,13 @@ RUNTIME_FUNCTION(Runtime_DisableAccessChecks) {
 RUNTIME_FUNCTION(Runtime_EnableAccessChecks) {
   HandleScope scope(isolate);
   ASSERT(args.length() == 1);
-  CONVERT_ARG_HANDLE_CHECKED(HeapObject, object, 0);
+  CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
   Handle<Map> old_map(object->map());
   RUNTIME_ASSERT(!old_map->is_access_check_needed());
   // Copy map so it won't interfere constructor's initial map.
   Handle<Map> new_map = Map::Copy(old_map);
   new_map->set_is_access_check_needed(true);
-  JSObject::MigrateToMap(Handle<JSObject>::cast(object), new_map);
+  JSObject::MigrateToMap(object, new_map);
   return isolate->heap()->undefined_value();
 }