Check whether the receiver to a keyed-call is actually a heapobject.

src/code-stubs-hydrogen.cc

Index: src/code-stubs-hydrogen.cc
diff --git a/src/code-stubs-hydrogen.cc b/src/code-stubs-hydrogen.cc
index e52ec65c4b7632ac81cb082bfcd5d727cce3a574..96cfc378476943483ab2f6dc862f3cf3389848f9 100644
--- a/src/code-stubs-hydrogen.cc
+++ b/src/code-stubs-hydrogen.cc
@@ -614,6 +614,7 @@ HValue* CodeStubGraphBuilder<KeyedArrayCallStub>::BuildCodeStub() {
   info()->set_parameter_count(argc);
 
   HValue* receiver = Add<HParameter>(1);
+  BuildCheckHeapObject(receiver);
 
   // Load the expected initial array map from the context.
   JSArrayBuilder array_builder(this, casted_stub()->elements_kind());