[ic] Allow strings to be used as receivers

Bug: chromium:1016709
Change-Id: Ib239336cb6dde7c5d555d31911453bff138a23e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1886921Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64617}

src/ic/ic.cc

@@ -1189,7 +1189,7 @@ namespace {
 
 bool ConvertKeyToIndex(Handle<Object> receiver, Handle<Object> key,
                        uint32_t* index) {
-  if (!receiver->IsJSReceiver()) return false;
+  DCHECK(receiver->IsJSReceiver() || receiver->IsString());
   if (key->ToArrayIndex(index)) return true;
 
   if (!receiver->IsJSTypedArray()) return false;
@@ -1206,7 +1206,7 @@ bool ConvertKeyToIndex(Handle<Object> receiver, Handle<Object> key,
 
 bool CanCache(Handle<Object> receiver, InlineCacheState state) {
   if (!FLAG_use_ic || state == NO_FEEDBACK) return false;
-  if (!receiver->IsJSReceiver()) return false;
+  if (!receiver->IsJSReceiver() && !receiver->IsString()) return false;
   return !receiver->IsAccessCheckNeeded() && !receiver->IsJSPrimitiveWrapper();
 }