Add proper support for proxies to HType.

TEST=mjsunit/regress/regress-crbug-448730
BUG=chromium:448730
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/847373002

Cr-Commit-Position: refs/heads/master@{#26056}

src/hydrogen-types.cc

@@ -24,6 +24,7 @@ HType HType::FromType(typename T::TypeHandle type) {
   if (type->Is(T::Undefined())) return HType::Undefined();
   if (type->Is(T::Array())) return HType::JSArray();
   if (type->Is(T::Object())) return HType::JSObject();
+  if (type->Is(T::Receiver())) return HType::JSReceiver();
   return HType::Tagged();
 }
 

src/hydrogen-types.h

@@ -30,9 +30,10 @@ class Object;
   V(String, 0x65)         /* 0000 0000 0110 0101 */ \
   V(Boolean, 0xa5)        /* 0000 0000 1010 0101 */ \
   V(Undefined, 0x125)     /* 0000 0001 0010 0101 */ \
-  V(JSObject, 0x221)       /* 0000 0010 0010 0001 */  \
-  V(JSArray, 0x621)        /* 0000 0110 0010 0001 */  \
-  V(None, 0x7ff)           /* 0000 0111 1111 1111 */
+  V(JSReceiver, 0x221)    /* 0000 0010 0010 0001 */ \
+  V(JSObject, 0x621)      /* 0000 0110 0010 0001 */ \
+  V(JSArray, 0xe21)       /* 0000 1110 0010 0001 */ \
+  V(None, 0xfff)          /* 0000 1111 1111 1111 */
 
 class HType FINAL {
  public:

test/mjsunit/regress/regress-crbug-448730.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-proxies
+
+function bar() {}
+bar({ a: Proxy.create({}) });
+function foo(x) { x.a.b == ""; }
+var x = {a: {b: "" }};
+foo(x);
+foo(x);
+%OptimizeFunctionOnNextCall(foo);
+foo(x);