Ensure the receiver for EnableAccessCheck is always a JSObject

BUG=
TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/349923005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21929 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/runtime.cc

@@ -2084,13 +2084,13 @@ RUNTIME_FUNCTION(Runtime_DisableAccessChecks) {
 RUNTIME_FUNCTION(Runtime_EnableAccessChecks) {
   HandleScope scope(isolate);
   ASSERT(args.length() == 1);
-  CONVERT_ARG_HANDLE_CHECKED(HeapObject, object, 0);
+  CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
   Handle<Map> old_map(object->map());
   RUNTIME_ASSERT(!old_map->is_access_check_needed());
   // Copy map so it won't interfere constructor's initial map.
   Handle<Map> new_map = Map::Copy(old_map);
   new_map->set_is_access_check_needed(true);
-  JSObject::MigrateToMap(Handle<JSObject>::cast(object), new_map);
+  JSObject::MigrateToMap(object, new_map);
   return isolate->heap()->undefined_value();
 }