Monomorphic prototype failures should be reserved for already-seen keys.

src/ic.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 78 matching lines @@
   // Construct the IC structure with the given number of extra
   // JavaScript frames on the stack.
   IC(FrameDepth depth, Isolate* isolate);
   virtual ~IC() {}
 
   State state() const { return state_; }
   inline Address address() const;
 
   // Compute the current IC state based on the target stub, receiver and name.
   void UpdateState(Handle<Object> receiver, Handle<Object> name);
-  void MarkMonomorphicPrototypeFailure() {
+  bool IsNameCompatibleWithMonomorphicPrototypeFailure(Handle<Object> name);
+  void MarkMonomorphicPrototypeFailure(Handle<Object> name) {
+    ASSERT(IsNameCompatibleWithMonomorphicPrototypeFailure(name));
     state_ = MONOMORPHIC_PROTOTYPE_FAILURE;
   }
 
   // Clear the inline cache to initial state.
   static void Clear(Isolate* isolate,
                     Address address,
                     ConstantPoolArray* constant_pool);
 
 #ifdef DEBUG
   bool IsLoadStub() const {
@@ skipping 817 matching lines @@
 DECLARE_RUNTIME_FUNCTION(MaybeObject*, ElementsTransitionAndStoreIC_Miss);
 DECLARE_RUNTIME_FUNCTION(MaybeObject*, BinaryOpIC_Miss);
 DECLARE_RUNTIME_FUNCTION(MaybeObject*, BinaryOpIC_MissWithAllocationSite);
 DECLARE_RUNTIME_FUNCTION(MaybeObject*, CompareNilIC_Miss);
 DECLARE_RUNTIME_FUNCTION(MaybeObject*, ToBooleanIC_Miss);
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_IC_H_