Patch trunk to version 2.2.3.1, reverting change 4401.

src/ic.cc

Index: src/ic.cc
===================================================================
--- src/ic.cc	(revision 4416)
+++ src/ic.cc	(working copy)
@@ -694,8 +694,8 @@
                           State state,
                           Handle<Object> object,
                           Handle<String> name) {
-  // Bail out if the result is not cachable.
-  if (!lookup->IsCacheable()) return;
+  // Bail out if we didn't find a result.
+  if (!lookup->IsProperty() || !lookup->IsCacheable()) return;
 
   // Loading properties from values is not common, so don't try to
   // deal with non-JS objects here.
@@ -709,9 +709,6 @@
     // Set the target to the pre monomorphic stub to delay
     // setting the monomorphic state.
     code = pre_monomorphic_stub();
-  } else if (!lookup->IsProperty()) {
-    // Nonexistent property. The result is undefined.
-    code = StubCache::ComputeLoadNonexistent(*name, *receiver);
   } else {
     // Compute monomorphic stub.
     switch (lookup->type()) {