[turbofan] Unstable prototype maps are not supported currently.

src/compiler/access-info.cc

Index: src/compiler/access-info.cc
diff --git a/src/compiler/access-info.cc b/src/compiler/access-info.cc
index 010689027e8efe89df60a7a7e9d18dcafa1e4ef5..612170e5b1b64a422af12f1356245e97b3a1c4c9 100644
--- a/src/compiler/access-info.cc
+++ b/src/compiler/access-info.cc
@@ -156,6 +156,12 @@ bool AccessInfoFactory::ComputeElementAccessInfo(
       Handle<JSReceiver> prototype =
           PrototypeIterator::GetCurrent<JSReceiver>(i);
       if (!prototype->IsJSObject()) return false;
+      // TODO(bmeurer): We do not currently support unstable prototypes.
+      // We might want to revisit the way we handle certain keyed stores
+      // because this whole prototype chain check is essential a hack,
+      // and I'm not sure that it is correct at all with dictionaries in
+      // the prototype chain.
+      if (!prototype->map()->is_stable()) return false;
       holder = Handle<JSObject>::cast(prototype);
     }
   }