Keep the inline caches for the builtins object monomorphic when...

src/ic.cc

Index: src/ic.cc
===================================================================
--- src/ic.cc	(revision 293)
+++ src/ic.cc	(working copy)
@@ -167,6 +167,19 @@
 
     return MONOMORPHIC_PROTOTYPE_FAILURE;
   }
+
+  // The builtins object is special.  It only changes when javascript
+  // builtins are loaded lazily.  It is important to keep inline
+  // caches for the builtins object monomorphic.  Therefore, if we get
+  // an inline cache miss for the builtins object after lazily loading
+  // javascript builtins, we clear the code cache and return
+  // uninitialized as the state to force the inline cache back to
+  // monomorphic state.
+  if (receiver->IsJSBuiltinsObject()) {
+    map->ClearCodeCache();
+    return UNINITIALIZED;
+  }
+
   return MONOMORPHIC;
 }