Check whether the receiver to a keyed-call is actually a heapobject.

test/mjsunit/regress/regress-crbug-325225.js

Index: test/mjsunit/regress/regress-crbug-325225.js
diff --git a/test/mjsunit/regress/regress-crbug-242870.js b/test/mjsunit/regress/regress-crbug-325225.js
similarity index 87%
copy from test/mjsunit/regress/regress-crbug-242870.js
copy to test/mjsunit/regress/regress-crbug-325225.js
index 7183375ca811cedc81c870d34e694e98cf727f9b..798d54839d8404c00cb7a7542cc5c591d8e2ebaa 100644
--- a/test/mjsunit/regress/regress-crbug-242870.js
+++ b/test/mjsunit/regress/regress-crbug-325225.js
@@ -25,19 +25,22 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+function f1(a) {
+  a[0](0);
+}
+
+function do1() {
+  f1([f1]);
+}
 
-var non_const_true = true;
+assertThrows(do1, TypeError);
 
-function f() {
-  return (non_const_true || true && g());
+function f2(a) {
+  a[0](true);
 }
 
-function g() {
-  for (;;) {}
+function do2() {
+  f2([function(a) { return f2("undefined", typeof f2(42, 0)); }]);
 }
 
-assertTrue(f());
-assertTrue(f());
-%OptimizeFunctionOnNextCall(f);
-assertTrue(f());
+assertThrows(do2, TypeError);