Throw an exception when wrong arguments are passed into SwapElements.

This runtime function should operate on elements and thus 'receiver'
must be JSObject and indices should be numbers.

TBR=lrm@chromium.org,ricow@chromium.org

Review URL: http://codereview.chromium.org/1960001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4583 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/runtime.cc

@@ -7777,29 +7777,23 @@ static Object* Runtime_SwapElements(Arguments args) {
 
   ASSERT_EQ(3, args.length());
 
-  Handle<Object> object = args.at<Object>(0);
+  CONVERT_ARG_CHECKED(JSObject, object, 0);
   Handle<Object> key1 = args.at<Object>(1);
   Handle<Object> key2 = args.at<Object>(2);
 
   uint32_t index1, index2;
-  // That must be the most common case.
-  if (object->IsJSObject()
-      && Array::IndexFromObject(*key1, &index1)
-      && Array::IndexFromObject(*key2, &index2)) {
-    Handle<JSObject> jsobject = Handle<JSObject>::cast(object);
-    Handle<Object> tmp1 = GetElement(jsobject, index1);
-    Handle<Object> tmp2 = GetElement(jsobject, index2);
-
-    SetElement(jsobject, index1, tmp2);
-    SetElement(jsobject, index2, tmp1);
-  } else {
-    Handle<Object> tmp1 = GetProperty(object, key1);
-    Handle<Object> tmp2 = GetProperty(object, key2);
-
-    SetProperty(object, key1, tmp2, NONE);
-    SetProperty(object, key2, tmp1, NONE);
+  if (!Array::IndexFromObject(*key1, &index1)
+      || !Array::IndexFromObject(*key2, &index2)) {
+    return Top::ThrowIllegalOperation();
   }
 
+  Handle<JSObject> jsobject = Handle<JSObject>::cast(object);
+  Handle<Object> tmp1 = GetElement(jsobject, index1);
+  Handle<Object> tmp2 = GetElement(jsobject, index2);
+
+  SetElement(jsobject, index1, tmp2);
+  SetElement(jsobject, index2, tmp1);
+
   return Heap::undefined_value();
 }