[turbofan] Unstable prototype maps are not supported currently.

src/compiler/access-info.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <ostream>
 
 #include "src/accessors.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-info.h"
 #include "src/field-index-inl.h"
@@ skipping 138 matching lines @@
 
   // Certain (monomorphic) stores need a prototype chain check because shape
   // changes could allow callbacks on elements in the chain that are not
   // compatible with monomorphic keyed stores.
   MaybeHandle<JSObject> holder;
   if (access_mode == AccessMode::kStore && map->prototype()->IsJSObject()) {
     for (PrototypeIterator i(map); !i.IsAtEnd(); i.Advance()) {
       Handle<JSReceiver> prototype =
           PrototypeIterator::GetCurrent<JSReceiver>(i);
       if (!prototype->IsJSObject()) return false;
+      // TODO(bmeurer): We do not currently support unstable prototypes.
+      // We might want to revisit the way we handle certain keyed stores
+      // because this whole prototype chain check is essential a hack,
+      // and I'm not sure that it is correct at all with dictionaries in
+      // the prototype chain.
+      if (!prototype->map()->is_stable()) return false;
       holder = Handle<JSObject>::cast(prototype);
     }
   }
 
   *access_info =
       ElementAccessInfo(Type::Class(map, zone()), elements_kind, holder);
   return true;
 }
 
 
@@ skipping 304 matching lines @@
   }
   return false;
 }
 
 
 Factory* AccessInfoFactory::factory() const { return isolate()->factory(); }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8