Handle non-object constants in HConstant::GetMonomorphicJSObjectMap.

R=ulan@chromium.org
BUG=chromium:412162
LOG=N

Review URL: https://codereview.chromium.org/552243002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23803 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/hydrogen-instructions.h

@@ -3493,7 +3493,7 @@ class HConstant FINAL : public HTemplateInstruction<0> {
 
   virtual Handle<Map> GetMonomorphicJSObjectMap() OVERRIDE {
     Handle<Object> object = object_.handle();
-    if (object->IsHeapObject()) {
+    if (!object.is_null() && object->IsHeapObject()) {
       return v8::internal::handle(HeapObject::cast(*object)->map());
     }
     return Handle<Map>();

test/mjsunit/regress/regress-412162.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test() {
+  Math.abs(-NaN).toString();
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();