Don't compile code for LoadICs if the receiver is primitive

BUG=chromium:609134
R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/1966853004
Cr-Commit-Position: refs/heads/master@{#36168}

src/ic/ic.cc

@@ -1075,6 +1075,7 @@ Handle<Code> LoadIC::CompileHandler(LookupIterator* lookup,
             LoadApiGetterStub stub(isolate(), true, index);
             return stub.GetCode();
           }
+          if (info->is_sloppy() && !receiver->IsJSReceiver()) break;
           NamedLoadHandlerCompiler compiler(isolate(), map, holder,
                                             cache_holder);
           return compiler.CompileLoadCallback(lookup->name(), info);
@@ -1551,6 +1552,7 @@ Handle<Code> StoreIC::CompileHandler(LookupIterator* lookup,
           TRACE_GENERIC_IC(isolate(), "StoreIC", "incompatible receiver type");
           break;
         }
+        if (info->is_sloppy() && !receiver->IsJSReceiver()) break;
         NamedStoreHandlerCompiler compiler(isolate(), receiver_map(), holder);
         return compiler.CompileStoreCallback(receiver, lookup->name(), info,
                                              language_mode());

test/cctest/test-accessors.cc

@@ -797,5 +797,6 @@ TEST(Regress609134) {
   CompileRun(
       "var f = new Fun();"
       "Number.prototype.__proto__ = f;"
-      "[42][0].foo");
+      "var a = 42;"
+      "for (var i = 0; i<3; i++) { a.foo; }");
 }