Fix polymorphic load handling.

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 98191ce650daab15f282f0ab7a496e084c606d34..0b189d5e3fe890fafc4129c7ae1b4137e1eea7ad 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5697,10 +5697,15 @@ void HOptimizedGraphBuilder::HandlePolymorphicLoadNamedField(
   int count = 0;
   HBasicBlock* join = NULL;
   HBasicBlock* number_block = NULL;
+  bool handled_string = false;
 
   bool handle_smi = false;
   for (int i = 0; i < types->length() && count < kMaxLoadPolymorphism; ++i) {
     PropertyAccessInfo info(this, IC::MapToType(types->at(i)), name);
+    if (info.type()->Is(HeapType::String())) {
+      if (handled_string) continue;
+      handled_string = true;
+    }
     if (info.CanLoadMonomorphic()) {
       count++;
       if (info.type()->Is(HeapType::Number())) {
@@ -5711,8 +5716,8 @@ void HOptimizedGraphBuilder::HandlePolymorphicLoadNamedField(
   }
 
   count = 0;
-  bool handled_string = false;
   HControlInstruction* smi_check = NULL;
+  handled_string = false;
 
   for (int i = 0; i < types->length() && count < kMaxLoadPolymorphism; ++i) {
     PropertyAccessInfo info(this, IC::MapToType(types->at(i)), name);